KR102033351B1 - Computer-executable lightweight white-box cryptographic method and apparatus thereof - Google Patents

Abstract

The present invention provides a computer-implemented lightweight whitebox encryption method comprising the steps of: (a) generating a plain text, (b) generating a whitebox cryptographic GFN (Generalized Feistel Network) generated as a lookup table with the round function internally encoded with a round key. And (c) providing the ciphertext by providing the externally encoded plaintext to the whitebox encrypted GFN.

Description

COMPUTER-EXECUTABLE LIGHTWEIGHT WHITE-BOX CRYPTOGRAPHIC METHOD AND APPARATUS THEREOF}

The present invention relates to encryption technology, and more particularly, a computer-implemented light weight which improves security through a white box cryptographic Generalized Feistel Network (GFN) structure that is able to construct a lightweight environment of the Internet of Things and is safe against white box attacks. A method and apparatus for whitebox encryption are provided.

Block encryption technology based on DES (Data Encryption Standard) performs encryption by applying encryption keys and algorithms in units of data blocks to create a ciphertext. More specifically, the DES-based block ciphering technique applies ciphertext from the previous cipher block to the next block in order so that the same blocks of plaintext are not the same ciphertext in one message, and the same messages encrypted at the same time are By combining the initialization vector by the random number generator with the first block of plaintext so that no ciphertext is produced, the next blocks can be different from the previous cipher block.

Block cipher technology based on Generalized Feistel networks (GFN) is a typical example, which performs network transformation using a key to form a block cipher, and performs a single round. By repeating the encryption step several times, the encryption operation is performed by repeating the round function F in each round step. This will be described in more detail with reference to FIG. 1.

1 is a diagram illustrating a generalized Fiestel network. More specifically, each of FIGS. 1 (a), 1 (b) and 1 (c) shows a block cipher technique using a first type, second type and third type of generalized Fiestel network, and FIG. 1 (d) represents an encryption process of a Lightweight Encryption Algorithm (LEA), which is one of the third types. A representative example of the first type (Type-I) in Figure 1 (a) is a CAST-256 algorithm, a representative example of the second type (Type-II) in Figure 1 (b) is a HIGHT algorithm, A representative example of the third type (Type-III) in FIG. 1C is LEA.

Among these, the LEA is an algorithm for encrypting a 128-bit block of data developed by the National Security Research Institute. The LEA avoids the use of S-BOX (Substitution-box) and consists of ARX (Addition, Rotation, XOR) to reduce the weight. Yes, it provides faster computational speeds than the Advanced Encryption Standard (AES) and can provide a higher level of safety than the HIGHT algorithm. The LEA algorithm encrypts keys 128, 192, and 256 bits for 128 bits, with each round being 24, 28, and 32 rounds.

In the left block diagram of Fig. 1 (d), the encryption process is performed as follows. In the operation of each round function, the input value is a 128-bit input value consisting of four 32-bit internal state variables, a 192-bit round key, and the output value is a 128-bit internal state variable. In operation, the key is processed as XOR process, and each block bit descends in the direction of the arrow and goes through the Addition process and the Rotation process. In FIG. 1 (d), ROR means right bit rotation and ROL means left bit rotation. The number displayed for each bit rotation means that the bit is rotated by that number. After all the operations are finished, each block moves to the left, and the first round variable moves to the bottom, ending the operation of the encryption round function. Decryption is performed in the same process as the right block diagram of FIG. 1 (d), and the calculation formula is the same as that of encryption, except that the addition is used for encryption, so the subtraction is used for decryption.

While the encryption technology based on the conventional generalized Fiestel network structure is high in convenience of implementation, there is still a weak point to the white box attack during the encryption and decryption process.

The DES-based block cipher technology described above is based on a black box encryption mechanism that operates under the assumption that the encryption key is securely maintained. In contrast, the whitebox encryption technology is based on a whitebox encryption mechanism that prevents an attacker from easily inferring a cryptographic key, even when internal operations are exposed. This will be described in more detail with reference to FIG. 2.

2 is a diagram illustrating a basic concept of white box encryption.

In FIG. 2, the whitebox encryption technique makes the encryption key easier even if an attacker analyzes its internal behavior by hiding the algorithm into a large lookup table and hiding the encryption key therein with the software implemented encryption algorithm. Do not allow inference. More specifically, the whitebox encryption technique performs the encoding process (Mi) and the decoding process (Mi) ^-1 internally by using separate tables so that intermediate values are not exposed, and consequently, by offsetting encoding and decoding. The intermediate data and key of the round operation can be safely hidden from the attacker by setting the same as the result of only the encryption operation (Xi).

Conventional white box encryption technology has a disadvantage in that it is difficult to implement in a lightweight environment for the Internet of Things or a mobile device because the size of the table is too large to implement high security.

Korean Patent Registration No. 10-1623503 (2016.05.17) relates to an apparatus and method for implementing a white box cryptography of an EL block cipher, and comprising a plurality of tables of cryptographic algorithms including cryptographic keys in the source code or memory area of the cryptographic algorithm. The present invention provides an apparatus and method for implementing an LEA block cipher white box cipher that can prevent a cipher key from being searched through, a plain text input unit that receives an encoded encoded plain text, and an encoding input from the plain text input unit. A round function unit for receiving a result of a round function or a previous round function unit and performing a modular addition and rotation operation based on a random table and outputting a result of distributed processing of a round key operation position using a linear transformation, and the round function unit Round function execution is completed for all round keys among outputs processed by There is consists to the result of encoding including a ciphertext outputted cipher text output for outputting.

Korean Patent Laid-Open No. 10-2015-0090438 (2015.08.06) relates to a white box encryption device and a method thereof, and an operation unit for performing encryption operations using white box encryption tables for each round and a result output for each round. A table mixing unit for mixing an array of tables.

Korean Patent Registration No. 10-1623503 (2016.05.17) Korean Patent Publication No. 10-2015-0090438 (2015.08.06)

An embodiment of the present invention provides a computer-implemented lightweight white box encryption method and apparatus for improving security through a white box encrypted GFN (Generalized Feistel Network) structure that can build a lightweight environment of the Internet of Things and is safe against white box attacks. To provide.

One embodiment of the present invention is to provide a computer-implemented lightweight white box encryption method and apparatus that can be applied to a memory limited environment can be significantly reduced by adjusting the reuse of the look-up table to significantly reduce the total required table size .

One embodiment of the present invention is to provide a computer-implemented lightweight white box encryption method and apparatus that can easily reduce the number of rounds to improve the operation speed.

Among the embodiments, a computer-implemented lightweight whitebox encryption method includes: (a) externally encoding a plain text, (b) a whitebox cryptographic Generalized Feistel Network (GFN) generated as a lookup table that internally encodes a round function with a round key. And (c) providing the externally encoded plaintext to the whitebox encrypted GFN to provide a ciphertext.

Step (a) may include performing the external encoding based on an encoding table in which a plurality of encoding types are defined.

The step (a) may further include dividing the externally encoded plain text into an internal state variable having n bits (where n is a natural number) and m (the m is a natural number) bits.

The step (b) may include calculating the lookup table by performing an ARX (Addition, Rotation, XOR) operation on the round key.

Step (b) includes generating the lookup table per single round by (n-1-t), where n is the number of internal state variables and t is the number of reuse lookup tables. can do.

The step (b) may further include maintaining t at the same value in each of r rounds (where r is a natural number).

Step (b) may include determining a stability index for the whitebox cryptographic GFN to determine the total number of required round keys (N) and the number of bits (m) of internal state variables.

Step (b) may include determining the number of round iterations (r), the number of internal state variables (n), and the number of reuse lookup tables (t) based on the total number of required round keys (N). Can be.

Step (b) may comprise combining the total required round keys to generate a secret key for a whitebox cryptogram.

Step (c) may include performing lightweight white box encryption by performing external encoding on the cipher text.

Among the embodiments, the lightweight whitebox encryption device may include a plaintext management unit that externally encodes plaintext, and a whitebox cryptographic GFN that generates a whitebox encrypted GFN generated as a lookup table that internally encodes a round function with a round key. And a cipher text providing unit for providing a cipher text by providing the generator and the externally encoded plain text to the white box cipher type GFN.

The disclosed technique can have the following effects. However, since a specific embodiment does not mean to include all of the following effects or only the following effects, it should not be understood that the scope of the disclosed technology is limited by this.

The computer-implemented lightweight whitebox encryption method and apparatus according to an embodiment of the present invention can enhance security through a whitebox encrypted GFN (Generalized Feistel Network) structure that can secure a whitebox attack while constructing a lightweight environment of the Internet of Things. You can.

The computer-implemented lightweight whitebox encryption method and apparatus according to an embodiment of the present invention can significantly reduce the total required table size by adjusting the reuse of the lookup table, and thus can be easily applied to a memory limited environment.

The computer-implemented lightweight whitebox encryption method and apparatus according to an embodiment of the present invention can easily improve the operation speed by reducing and controlling the number of rounds.

1 is a diagram illustrating a generalized Fiestel network.
2 is a diagram illustrating a basic concept of white box encryption.
3 is a block diagram showing the configuration of a lightweight white box encryption apparatus according to an embodiment of the present invention.
FIG. 4 is a block diagram illustrating an embodiment of a structure of a white box encrypted GFN generated by the lightweight white box encryption device of FIG. 3.
FIG. 5 is a diagram illustrating an embodiment of a process of generating a white box encrypted GFN for reducing the size of a total table by the lightweight white box encryption apparatus of FIG. 3.
FIG. 6 is a diagram illustrating embodiments in which the lightweight white box encryption apparatus of FIG. 3 significantly reduces the size of a total table by performing a computer-implemented lightweight white box encryption method.
7 is a flowchart illustrating a lightweight white box encryption method performed by the lightweight white box encryption device of FIG. 3.
FIG. 8 is a diagram illustrating a relationship graph between a ratio (t _r ) and a number of round iterations (r) of a reuse lookup table that may be derived in the process of generating a whitebox encrypted GFN by the lightweight whitebox encryption apparatus of FIG. 3. .

Description of the present invention is only an embodiment for structural or functional description, the scope of the present invention should not be construed as limited by the embodiments described in the text. That is, since the embodiments may be variously modified and may have various forms, the scope of the present invention should be understood to include equivalents capable of realizing the technical idea. In addition, the objects or effects presented in the present invention does not mean that a specific embodiment should include all or only such effects, the scope of the present invention should not be understood as being limited thereby.

On the other hand, the meaning of the terms described in the present application should be understood as follows.

Terms such as "first" and "second" are intended to distinguish one component from another component, and the scope of rights should not be limited by these terms. For example, the first component may be named a second component, and similarly, the second component may also be named a first component.

When a component is referred to as being "connected" to another component, it should be understood that there may be other components in between, although it may be directly connected to the other component. On the other hand, when a component is referred to as being "directly connected" to another component, it should be understood that there is no other component in between. On the other hand, other expressions describing the relationship between the components, such as "between" and "immediately between" or "neighboring to" and "directly neighboring to", should be interpreted as well.

Singular expressions should be understood to include plural expressions unless the context clearly indicates otherwise, and terms such as "comprise" or "have" refer to a feature, number, step, operation, component, part, or feature thereof. It is to be understood that the combination is intended to be present and does not exclude in advance the possibility of the presence or addition of one or more other features or numbers, steps, operations, components, parts or combinations thereof.

In each step, an identification code (e.g., a, b, c, etc.) is used for convenience of description, and the identification code does not describe the order of the steps, and each step clearly indicates a specific order in context. Unless stated otherwise, they may occur out of the order noted. That is, each step may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

The present invention can be embodied as computer readable code on a computer readable recording medium, and the computer readable recording medium includes all kinds of recording devices in which data can be read by a computer system. . Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like, and are also implemented in the form of a carrier wave (for example, transmission over the Internet). It also includes. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. Generally, the terms defined in the dictionary used are to be interpreted to coincide with the meanings in the context of the related art, and should not be interpreted as having ideal or excessively formal meanings unless clearly defined in the present application.

3 is a block diagram showing the configuration of a lightweight white box encryption apparatus according to an embodiment of the present invention.

Referring to FIG. 3, the lightweight white box encryption apparatus 300 may include a plain text management unit 310, a white box encrypted GFN generation unit 320, and a cipher text providing unit 330.

The lightweight white box encryption apparatus 300 may correspond to a computing device capable of performing white box encryption, and in one embodiment, may be implemented as a desktop, tablet PC, laptop or smartphone. In one embodiment, the lightweight white box encryption apparatus 300 may provide a security function based on a block cipher algorithm for safely encrypting and decrypting data against a white box attack by building a lightweight environment of the IoT.

The plain text manager 310 externally encodes the plain text. More specifically, the plain text manager 310 may generate data as an encryption target in plain text, and perform external encoding on the generated plain text to generate a white box cryptographic based ciphertext based on the externally encoded plain text. Can be. In one embodiment, the length of the plaintext block may be equal to the length of the ciphertext. The plain text manager 310 may convert the plain text into an externally encoded plain text through an encoding function and provide the externally encoded plain text as an input to the whitebox encrypted GFN generator 320. The plain text manager 310 may perform external encoding based on an encoding table in which a plurality of encoding types are defined. For example, the plain text manager 310 may perform an external encoding by selectively applying a specific encoding type among a plurality of encoding types in the encoding table, and thus, may use various encoding methods in the process of performing the external encoding. Can enhance safety.

The plaintext manager 310 may divide the externally encoded plaintext into an internal state variable having n (n is a natural number) m (m is a natural number) bits. In one embodiment, the plaintext manager 310 blocks the externally encoded plaintext to have the same m bit size, and divides the n internal state variables X ₁ , X ₂ ,... , X _n (see 410), for example, if the block size of the outer encoded plain text is 40 bits, the plain text can be partitioned to generate five internal state variables that are 8 bits each. Internal state variables may be provided as inputs to the whitebox cryptographic GFN generator 320.

The white box cryptographic GFN generation unit 320 generates a white box cryptographic GFN (Generalized Feistel Network) 400 generated as a lookup table 420 which internally encodes a round function as a round key (RK). ). This will be described with reference to FIG. 4.

FIG. 4 is a block diagram illustrating an embodiment of a structure of a white box encrypted GFN generated by the lightweight white box encryption device of FIG. 3.

In FIG. 4, the whitebox cryptographic GFN 400 is divided from plain text and has n internal state variables X ₁ , X ₂ ,..., Each having m bits. , X _n 410 is received as an input of the first round 430, and (n-1) lookup tables T ₁ , T ₂ ,..., Based on (n-1) round keys per single round. , T _{n -1} 420 may be calculated, and the internal state variables to be applied as inputs in the next round may be updated through operations on internal state variables received as inputs in the current round for each round. Here, a round means a repeated process for encryption and decryption, a round function indicates a function necessary for performing encryption and decryption, and a secret key indicates a function for encryption and decryption in the repeated round. Can be used as an argument.

The white box cryptographic GFN generation unit 320 may generate a plurality of round keys from a secret key. The white box cryptographic GFN generation unit 320 may generate as many round keys as the number of round functions F used for each single round. In one embodiment, the whitebox encrypted GFN generation unit 320 may generate a plurality of round keys through block partitioning for the secret key, and in another embodiment, a key schedule related to the secret key. It is possible to generate a plurality of round keys extended through the) operation. For example, the whitebox encrypted GFN generation unit 320 may set all the required round keys as the secret key, and if the size of the secret key is 16 bits, key-schedule based on the secret key to expand the round key to 128 bits. can do.

In one embodiment, the whitebox cryptographic GFN generator 320 is based on the structure of a generalized Feistel network (see FIG. 1) and is a whitebox cipher with a lookup table 420 that internally encodes each round function with a round key. The type GFN 400 may be generated and, for example, designed based on the second or third type of Feistel structure.

The white box cryptographic GFN generation unit 320 may calculate an lookup table 420 by performing an ARX (Addition, Rotation, XOR) operation on the round key. More specifically, the white box cryptographic GFN generator 320 may be configured with at least one of addition, rotation, and exclusive OR operations, which are relatively easy to implement the round function F. In addition, even when Xi is 8 bits, the partitioning operation may be performed in units of 4 bits.

In one embodiment, the white box cryptographic GFN generator 320 selects a lookup table 420 per single round (n-1-t), where n is the number of internal state variables and t is the number of reuse lookup tables. As many as the above integers). More specifically, the white box cryptographic GFN generation unit 320 may generate (n-1-t) pieces of the round keys used for a single round in consideration of reuse, and generate (n-1-t) pieces The round keys may be used to generate (n-1-t) lookup tables 420 per single round to reduce the total table size.

In one embodiment, the whitebox cryptographic GFN generator 320 may maintain t at the same value in each of r (r is a natural number) rounds. For example, the total number of lookup tables 420 used in a single round is (n-1-t), and if t lookup tables 420 are reused in each of r rounds, The number can be calculated as r * (n-1-t), and likewise, the number N of total required round keys can be calculated as r * (n-1-t).

In one embodiment, the whitebox encrypted GFN generation unit 320 defines a stability index (S) for the whitebox encrypted GFN 400 to determine the total number of required round keys (N) and internal state variables 410. ), The number of bits m may be determined, and for example, N and m may be calculated as appropriate values from the stability index S based on Equation 1 below.

[Equation 1]

S = N * m

In one embodiment, the whitebox encrypted GFN generation unit 320 is based on the total number of round keys (N) required round iteration number (r), the number of internal state variables (n) and the number of reuse lookup table (t) can be determined, for example, m, n, t and r can be set to appropriate values according to the environment based on Equation 2 below.

[Equation 2]

N = r * (n-1-t)

For example, the white box cryptographic GFN generation unit 320 assumes that the size m of the internal state variable 410 is 8 when the block size of the plain text is 40 bits and the stability index S is set to 32. If (bit), the number n of the internal state variable 410 can be calculated as 5, and if the number (t) of the reuse lookup table is 2, the number of round iterations r can be calculated as 2. As another example, when the white box cryptographic GFN generation unit 320 assumes the above case, if the size m of the internal state variable 410 is 4 (bits), the number n of the internal state variables 410 is n. Can be calculated as 10, and if the number (t) of reuse lookup tables is 4, the number of round repetitions r can be calculated as 2.

In another embodiment, the whitebox cryptographic GFN generator 320 is the maximum stability that can be implemented therefrom when at least one of the number of round keys (N) and the number of bits (m) of the internal state variable 410 is limited. The remainder of the number N of round keys and the number m of bits of the internal state variable 410 may be determined such that the exponent S is calculated.

In one embodiment, the whitebox cryptographic GFN generator 320 defines the size T of the total required lookup table 420 to determine the ratio t _r of the reused lookup table in the round and the number of round iterations r. For example, r and t may be set to appropriate values according to the environment based on Equation 3 below.

[Equation 3]

T = r * (n-1) * (1-t _r ) * 2 ^m * m

S = r * (n-1) * (1-t _r ) * m

Where t _r corresponds to the ratio of reuse lookup tables that can be calculated as t / (n-1) per round, with 0 <t _r <1

For example, the white box cryptographic GFN generation unit 320 is limited to the size (T) of the lookup table 420 required as a total memory constraint of the environment to 1 KB or less and to the white box cryptographic GFN (400) Assuming that the stability index (S) in relation to 512 is assumed, the number of bits (m) of the internal state variable 410 can be calculated as 4 according to T / S = 2 ^m = 8192/512 = 2 ⁴ . And the ratio (t _r ) of the reuse lookup table in the round according to the number n of the internal state variables 410 based on the relation r * (n-1) * (1-t _r ) = 128 calculated accordingly. The relationship graph (see FIG. 8) between and the number of round repetitions r can be derived. Accordingly, the ratio t _r and the number of round repetitions _r of the lookup table can be set.

The white box cryptographic GFN generation unit 320 may generate a secret key for the white box encryption by combining the total required round keys. In the above example, the size of the secret key may be set to N * m bits. In one embodiment, the whitebox cryptographic GFN generation unit 320 may determine a stability index (S) regarding the security level of the target whitebox friendly algorithm as the size of the secret key, and this stability index (S) is It may be set by the designer or user to a value suitable for the usage environment.

In one embodiment, the whitebox cryptographic GFN generator 320 may set the round function F to be implemented as a small table when the size of each of the internal state variables 410 is 4 or 8 bits.

The ciphertext providing unit 330 provides the ciphertext by providing the externally encoded plaintext to the white box cipher GFN 400. In an embodiment, the ciphertext providing unit 330 provides an externally encoded plain text as an input to the whitebox cipher GFN 400 generated by the whitebox cipher GFN generator 320 to perform a whitebox encryption operation. The ciphertext may be generated by performing a concatenation operation on the data finally output from the white box cryptographic GFN 400. Here, the concatenation refers to concatenating at least two inputs bit by bit.

The ciphertext provider 330 may perform lightweight white box encryption by performing external encoding on the ciphertext. In one embodiment, the ciphertext provider 330 may perform external encoding on the ciphertext generated through the whitebox cipher GFN 400 based on an encoding table in which a plurality of encoding types are defined.

FIG. 5 is a diagram illustrating an embodiment of a process of generating a white box encrypted GFN for reducing the size of a total table by the lightweight white box encryption apparatus of FIG. 3.

In FIG. 5, the lightweight white box encryption apparatus 100 is a variable for reducing the total number of lookup tables 420 required in the process of performing encryption and decryption, as described above, and the number of internal state variables 410. (n), the number of reuse lookup tables (t), the number of round keys required per single round (n-1-t), and the number of round iterations (r) can be used as key variables, and thus the total required The number N of round keys can be set to r * (n-1-t).

The lightweight white box encryption apparatus 100 may calculate r = 128 (= 256 / (5-1-2)) by setting n = 5 and t = 2 when N = 256 is fixed. The white box cryptographic GFN 500 as shown in FIG. 5 may be generated based on each variable.

More specifically, the lightweight white box encryption apparatus 100 may reuse the reuse lookup tables T ₁ and T ₂ twice in total, using two round keys for use in the first round, and the second round. You can reuse the reuse lookup tables T ₃ and T ₄ twice, using two other round keys not used in the previous round, and you can repeat this process for 128 rounds. Accordingly, the lightweight white box encryption apparatus 100 may prepare for a white box attack through white box encryption and may significantly reduce the total number of required tables through reuse of lookup tables.

FIG. 6 is a diagram illustrating embodiments in which the lightweight white box encryption apparatus of FIG. 3 significantly reduces the size of a total table by performing a computer-implemented lightweight white box encryption method.

More specifically, FIG. 6 (a) shows an embodiment in which the lightweight white box encryption device 300 configures the white box encrypted GFN 400 without reusing the lookup table 420, and FIGS. 6 (b) and FIG. 6C illustrates one embodiment of the white box cryptographic GFN 400 by reusing the lookup table 420.

6 (a) to 6 (c) show how remarkably the total number of required lookup tables 420 can be reduced depending on the presence or the degree of reuse of the reuse lookup table. Here, the environment conditions of the block size 40 (= m * n) bits of the plain text and the size 16 bits of the secret key are the same for the configuration of the white box encrypted GFN in FIGS. 6 (a) to 6 (c). It is assumed to apply.

6A illustrates a case where the lookup table 420 is not reused. The lightweight white box encryption apparatus 300 sets the size (m) of the internal state variable 410 to 8 bits and the number of round iterations r to 4 to set the total size of the required table to 32,768 bits (= 16 * 2 ^8). * 8) can be calculated. Here, the round key 16 bits can be extended to 128 bits through the secret key and key-schedule.

6 (b) to 6 (c) show a case in which the lookup table 420 is reused, each of which reduces the memory usage while satisfying a stability index S of 32 for the white box encrypted GFN 400. Let's assume a situation. In FIG. 6B, the lightweight white box encryption apparatus 300 may derive S = r * (n-1) * (1-t _r ) * m = 32 based on Equation 3 above. In this case, by setting the size (m) of the internal state variable (410) to 8 bits, the number (n) of the internal state variables (410) can be calculated as five, and the ratio (t _r ) of the reuse lookup table is 2/5. The number of round repetitions r can be calculated as 2 by setting to. In this case, the lightweight white box encryption apparatus 300 calculates the total size of the required table as 8,196 bits (= 4 * 2 ⁸ * 8), thereby reducing the size of the total required table to about 1 (a). Can be reduced by / 4 times.

In FIG. 6C, the lightweight white box encryption apparatus 300 may derive S = r * (n-1) * (1-t _r ) * m = 32 based on Equation 3 above. In this case, by setting the size (m) of the internal state variable (410) to 4 bits, the number (n) of the internal state variables (410) can be calculated as 10, and the ratio (t _r ) of the reuse lookup table is 2/5. The number of round repetitions r can be calculated as 2 by setting to. In this case, the lightweight white box encryption apparatus 300 calculates the total size of the required table as 640 bits (= 10 * 2 ⁴ * 4), thereby reducing the size of the total required table to about 1 (a). Can be reduced by / 51 times.

In one embodiment, the lightweight white box encryption apparatus 300 may remove memory constraints by adjusting parameters according to the environment as described above, and increase security by increasing the size of the secret key by using the secret key as a round key. As the safety is enhanced, the number of round repetitions r can be reduced, thereby greatly improving the encryption speed.

7 is a flowchart illustrating a lightweight white box encryption method performed by the lightweight white box encryption device of FIG. 3.

In FIG. 7, the plain text manager 310 generates plain text (step S710). The whitebox cryptographic GFN generation unit 320 generates a whitebox cryptographic GFN 400 generated as a lookup table 420 in which the round function is internally encoded with a round key (step S720). The ciphertext providing unit 330 provides the ciphertext by providing the externally encoded plain text to the white box cipher GFN 400 (step S730).

In one embodiment, the whitebox encrypted GFN generation unit 320 may significantly reduce the number and size of tables required in the whitebox encryption process by reusing the lookup table 420 used for encryption and decryption for each round. Accordingly, the present invention may be more suitably implemented in a lightweight environment based on the Internet of Things (IoT), which requires a limited memory and speed environment.

Although described above with reference to a preferred embodiment of the present invention, those skilled in the art will be variously modified and changed within the scope of the invention without departing from the spirit and scope of the invention described in the claims below I can understand that you can.

300: Lightweight Whitebox Encryption Device
310: plain text management unit 320: white box encrypted GFN generation unit
330: ciphertext provider
400: Generalized Feistel Network (GFN) with white box encryption
410: internal state variable 420: lookup table

Claims (11)

(a) externally encoding the plain text;
(b) generating, according to at least one parameter, a whitebox cryptographic Generalized Feistel Network (GFN) generated as a lookup table with the round function internally encoded with a round key; And
(c) providing the ciphertext by providing the externally encoded plaintext to the whitebox encrypted GFN,
In step (b), the stability index for the white box cryptographic GFN is defined as the size of the secret key and the at least one parameter is based on the total size of the table and the stability index required for implementing the lookup table. And determining said computer executable lightweight whitebox encryption method.
The method of claim 1, wherein step (a)
And performing the external encoding based on an encoding table in which a plurality of encoding types are defined.
The method of claim 2, wherein step (a)
And partitioning the externally encoded plaintext into an internal state variable having n bits (where n is a natural number) m (the m is a natural number) bits based on the stability index. Box encryption method.
The method of claim 1, wherein step (b)
Computing the lookup table by performing an ARX (Addition, Rotation, XOR) operation on the round key.
The method of claim 1, wherein step (b)
Generating as many as (n-1-t) the lookup table per single round based on the stability index, where n is the number of internal state variables and t is the number of reuse lookup tables. Lightweight whitebox encryption method executable by the computer, characterized in that.
The method of claim 5, wherein step (b)
and maintaining said t at the same value in each of r rounds (where r is a natural number).
The method of claim 1, wherein step (b)
Determining the total number of required round keys (N) and the number of bits (m) of internal state variables based on the stability index.
The method of claim 7, wherein step (b)
Determining the number of round iterations (r), the number of internal state variables (n), and the number of reuse lookup tables (t) based on the total number of required round keys (N). Possible lightweight whitebox encryption method.
The method of claim 8, wherein step (b)
Combining the total required round keys to generate a secret key for a whitebox cryptogram.
The method of claim 1, wherein step (c)
And performing light weight white box encryption by performing external encoding on the cipher text.
A plain text manager for externally encoding the plain text;
A whitebox cryptographic GFN generation unit for generating a whitebox cryptographic GFN (Generalized Feistel Network) generated as a lookup table internally encoded with a round key according to at least one parameter; And
It includes a cipher text providing unit for providing a cipher text by providing the externally encoded plain text to the white box cipher type GFN,
The white box encrypted GFN generation unit defines a stability index for the white box encrypted GFN as the size of the secret key and based on the total size of the table required for the implementation of the lookup table and the stability index. Lightweight white box encryption apparatus, characterized in that for determining the parameters.

Images