Wide Non-Linear Encoding for White-Box Cryptography Key Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the context of white-box cryptography, where an attacker has complete control over the hardware and software, existing methods struggle to securely protect cryptographic keys and prevent unauthorized access to digital content, as they can reverse-engineer or observe memory accesses to retrieve decryption keys.
Innovation Solution
A method involving a cryptographic system with multiple substitution layers, using non-linear encodings of varying sizes in each layer, and XOR functions to obscure key operations, ensuring that even if an attacker guesses an intermediate value, collisions are minimized, thereby strengthening key protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If decryption keys are stored in memory for content decryption, then content playback functionality is enabled, but attackers can observe memory accesses to retrieve the decryption keys
Solution Approach 1:
The decryption key is divided into multiple key segments that are stored separately in memory rather than as a single key. During decryption operations, these segments are temporarily combined in a secure manner, ensuring that the complete key never exists in memory at one location. This segmentation prevents attackers from retrieving the full decryption key through memory observation.
Solution Approach 2:
A secure memory management module acts as an intermediary between the decryption key and the decryption function. This module controls key segment storage, retrieval, and combination operations, ensuring that key material is protected during all memory operations. The intermediary abstracts the key handling process and implements security protocols that prevent direct attacker access to key segments.
2Reliability
If license database access functions are made secure to protect asset keys, then key security is improved, but the complexity of the system increases
Solution Approach 1:
The secure memory management module serves multiple functions: it manages key segment storage, controls decryption operations, handles license database access, and provides security protection. By consolidating these functions into a single multi-functional module, the system achieves high key security without proportionally increasing overall system complexity.
Solution Approach 2:
The secure memory management module automatically handles key segment combination and protection operations without requiring external security management. The module self-manages the secure storage, retrieval, and combination of key segments, reducing the need for additional security infrastructure and simplifying the overall system architecture.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A method for a method for mapping an input message to an output message by a keyed cryptographic operation in a cryptographic system, the keyed cryptographic operation including a plurality of substitution layers and state data, including: mapping the input message to first state data in a first substitution layer of the keyed cryptographic operation, wherein the first substitution layer includes N basic blocks that implement the first substitution layer and wherein a non-linear encoding having a first size is placed on the inputs and outputs of the N basic blocks of the first substitution layer, where N is an integer; mapping the first state data to second state data in a plurality of intermediate substitution layers of the keyed cryptographic operation, wherein the intermediate substitution layers include M blocks that implement the intermediate substitution layers and wherein a plurality of non-linear encodings having a second size are placed on the inputs and outputs of the M basic blocks of the intermediate substitution layers, where M is an integer; and mapping the second state data to an output message in a final substitution layer of the keyed cryptographic operation, wherein the final substitution layer includes K basic blocks that implement the final substitution layer and wherein a non-linear encoding having a third size is placed on the inputs and outputs of the K basic blocks of the final substitution layer, where K is an integer, wherein the first and second size is greater than the second size, wherein N > M, and wherein K>M.