Cloud-based whitebox node locking
A secure cloud-based node-locking service with built-in attack detection to eliminate fuzzing, cloning and other attacks is disclosed. White-box base files are securely stored on the cloud service and are not vulnerable to accidental leakage. A secure cloud-based dynamic secret encoding service reduces the risk of exposure of unprotected secrets and other sensitive data.
1. A method of enabling secure generation of an output in a run-time device, comprising:
receiving a request to register a whitebox implementation for generating an output in a cloud service from a build-time device, the request comprising:
a base file; and
a list of unlocked whitebox look up tables (LUTs);
registering the base file and the list of unlocked whitebox LUTs in the cloud service;
returning a surrogate whitebox implementation having a build identifier (ID) and a plurality of blank LUTs to the build-time device;
receiving a lock request from the run-time device upon execution of the surrogate whitebox implementation, the lock request comprising a fingerprint of the run-time device determined by the run-time device upon first execution of the surrogate whitebox implementation and the build ID;
generating a locked whitebox implementation according to the received fingerprint of the run-time device and the build identifier, the locked whitebox implementation having a plurality of run-time device specific locked whitebox LUTs;
transmitting a run-time device specific locked whitebox LUTs from the cloud service to the run-time device;
receiving a request for a secret from the run-time device, the request for the secret including the build ID; and
transmitting an encoded secret;
wherein:
the lock request is automatically transmitted from a first address; and
the method further comprises:
determining if a preceding node locking request having a same build ID was received from a second address; and
rejecting the lock request in response to the preceding node locking request having the same build ID was received from the second address.
2. A method of enabling secure generation of an output in a run-time device, comprising:
receiving a request to register a whitebox implementation for generating an output in a cloud service from a build-time device, the request comprising:
a base file; and
a list of unlocked whitebox look up tables (LUTs);
registering the base file and the list of unlocked whitebox LUTs in the cloud service;
returning a surrogate whitebox implementation having a build identifier (ID) and a plurality of blank LUTs to the build-time device;
receiving a lock request from the run-time device upon execution of the surrogate whitebox implementation, the lock request comprising a fingerprint of the run-time device determined by the run-time device upon first execution of the surrogate whitebox implementation and the build ID;
generating a locked whitebox implementation according to the received fingerprint of the run-time device and the build ID, the locked whitebox implementation having a plurality of run-time device specific locked whitebox LUTs;
transmitting a run-time device specific locked whitebox LUTs from the cloud service to the run-time device;
receiving a request for a secret from the run-time device, the request for the secret including the build ID; and
transmitting an encoded secret;
wherein:
the lock request is automatically transmitted from a first address and;
the method further comprises:
determining if a preceding node locking request having a different build ID was received from the first address; and
rejecting the lock request in response to the preceding node locking request having the different build ID was received from the first address.
3. An apparatus for enabling secure generation of an output in a runt-time device, comprising:
a processor;
a memory, communicatively coupled to the processor, the memory storing processor instructions comprising processor instructions for:
receiving a request to register a whitebox implementation for generating an output in a cloud service from a build-time device, the request comprising:
a base file; and
a list of unlocked whitebox look up tables (LUTs);
registering the base file and the list of unlocked whitebox LUTs in the cloud service;
returning a surrogate whitebox implementation having a build identifier (ID) and a plurality of blank LUTs to the build-time device;
receiving a lock request from the run-time device upon execution of the surrogate whitebox implementation, the lock request comprising a fingerprint of the run-time device determined by the run-time device upon first execution of the surrogate whitebox implementation and the build ID;
generating a locked whitebox implementation according to the received fingerprint of the run-time device and the build ID, the locked whitebox implementation having a plurality of run-time device specific locked whitebox LUTs;
transmitting a run-time device specific locked whitebox LUTs from the cloud service to the run-time device;
receiving a request for a secret from the run-time device, the request for the secret including the build ID; and
transmitting an encoded secret;
wherein:
the lock request is automatically transmitted from a first address; and
the processor instructions further comprise processor instructions for:
determining if a preceding node locking request having a same build ID was received from a second address; and
rejecting the lock request in response to the preceding node locking request having the same build ID was received from the second address.
4. An apparatus for enabling secure generation of an output in a run-time device, comprising:
a processor;
a memory, communicatively coupled to the processor, the memory storing processor instructions comprising processor instructions for:
receiving a request to register a whitebox implementation for generating an output in a cloud service from a build-time device, the request comprising:
a base file; and
a list of unlocked whitebox look up tables (LUTs);
registering the base file and the list of unlocked whitebox LUTs in the cloud service;
returning a surrogate whitebox implementation having a build identifier (ID) and a plurality of blank LUTs to the build-time device;
receiving a lock request from the run-time device upon execution of the surrogate whitebox implementation, the lock request comprising a fingerprint of the run-time device determined by the run-time device upon first execution of the surrogate whitebox implementation and the build ID;
generating a locked whitebox implementation according to the received fingerprint of the run-time device and the build ID, the locked whitebox implementation having a plurality of run-time device specific locked whitebox LUTs;
transmitting a run-time device specific locked whitebox LUTs from the cloud service to the run-time device;
receiving a request for a secret from the run-time device, the request including the build ID; and
transmitting an encoded secret;
wherein:
the lock request is automatically transmitted from a first address;
the processor instructions further comprise processor instructions for:
determining if a preceding node locking request having a different build ID was received from the first address; and
rejecting the lock request in response to the preceding node locking request having the different build ID was received from the first address.