WHITE-BOX SOFT-LOCKING

1 . A method of enabling secure generation of an output, comprising:

generating a white-box implementation according to a base file having a plurality of secrets, the white-box implementation having:

unlocked white-box look up table (LUTs) for node-encoded secrets, the node-encoded secrets to be encoded for operation solely on a node of a network; and

globally encoded white-box LUTs for globally-encoded secrets to be encoded for operation on the node and at least another node;

generating, a soft-locked white-box implementation according to a fingerprint of the node, the unlocked white-box LUTs, and the globally encoded white-box LUTs, the soft-locked white-box implementation having a plurality of node-specific locked white-box LUTs and modified globally encoded LUTs;

receiving a global secret encoded according to the base file;

generating the node-encoded secrets by applying node-specific locking transformations to the global secret; and

generating, by the node, the output according to at least one of the globally-encoded secrets or the node-encoded secrets.

2 . The method of claim 1 , wherein generating the soft-locked white-box implementation according to the fingerprint of the node comprises:

encoding the unlocked white-box LUTs by applying locking transformations specific to the node to the unlocked white-box LUTs according to at least the fingerprint; and

generating the modified globally encoded LUTs to accept data from at least one node-specific locked white-box LUT or to provide data to at least one node-specific locked white-box LUT.

3 . The method of claim 1 , wherein:

the method further comprises generating the fingerprint of the node.

4 . The method of claim 3 , wherein:

the node comprises a plurality combination of a entities selected from a group comprising:

one or more hardware devices; and

one or more virtual machine instances.

5 . The method of claim 1 , wherein:

the global secret is received from a server having the base file.

6 . The method of claim 1 , wherein:

the global secret is received from a second white-box implementation of another device of another node and is generated according to the base file.

7 . The method of claim 1 , wherein:

the output comprises an asymmetric key pair encoded for the node; and

generating the output according to at least one of the globally-encoded secrets or the node-encoded secrets comprises:

receiving a request for the encoded asymmetric key pair;

generating the asymmetric key pair; and

node-encoding the generated asymmetric key pair according to the node-specific locking transformations.

8 . The method of claim 1 , wherein:

the output comprises a digital certificate encoded for the node; and

generating the output according to at least one of the encoded global secrets or the node-encoded secrets comprises:

receiving a request for the digital certificate encoded for the node;

generating an asymmetric key pair; and

generating the digital certificate from the asymmetric key pair; and

node-encoding a private key of the digital certificate according to the node-specific locking transformations.

9 . The method of claim 1 , wherein:

the output comprises a write request signed by the white-box implementation; and

generating the output according to at least one of the encoded global secrets or the node-encoded secrets comprises:

receiving a request for an operation to write data to secure cloud storage wherein the data is node-encoded according to the node-specific node locking transformations;

generating a cryptographic hash from a unique identifier of the data, the fingerprint, and one of the node-encoded secrets; and

signing the request for the operation to write data and the data according to the generated cryptographic hash using at least one of the node-specific locked white-box LUTs of the soft-locked white-box implementation; and

wherein the secure cloud storage verifies the write request according to the base file before writing the data to the secure cloud storage.

10 . An apparatus for securely generating an output, comprising:

a first processor;

a first memory, communicatively coupled to the processor, the first memory storing processor instructions comprising processor instructions for:

generating a white-box implementation according to a base file having a plurality of secrets, the white-box implementation having:

unlocked white-box look up table (LUTs) for node-encoded secrets, the node-encoded secrets to be encoded for operation solely on a node of a network; and

globally encoded white-box LUTs for globally-encoded secrets to be encoded for operation on the node and at least another node;

a second processor;

a second memory, communicatively coupled to the second processor, the second memory storing second processor instructions comprising second processor instructions for:

generating, a soft-locked white-box implementation according to a fingerprint of the node, the unlocked white-box LUTs, and the globally encoded white-box LUTs, the soft-locked white-box implementation having a plurality of node-specific locked white-box LUTs and modified globally encoded LUTs;

receiving a global secret encoded according to the base file;

generating the node-encoded secrets by applying node-specific locking transformations to the global secret; and

generating the output according to at least one of the globally-encoded secrets or the node-encoded secrets.

11 . The apparatus of claim 10 , wherein the second processor instructions for generating the soft-locked white-box implementation according to the fingerprint of the node comprises second processor instructions for:

encoding the unlocked white-box LUTs by applying locking transformations specific to the node to the unlocked white-box LUTs according to at least the fingerprint; and

generating the modified globally encoded LUTs to accept data from at least one node-specific locked white-box LUT or to provide data to at least one node-specific locked white-box LUT.

12 . The apparatus of claim 10 , wherein:

the second processor instructions further comprise second processor instructions for generating the fingerprint of the node.

13 . The apparatus of claim 12 , wherein:

the node comprises a plurality combination of a entities selected from a group comprising:

one or more hardware devices; and

one or more virtual machine instances.

14 . The apparatus of claim 10 , wherein:

the global secret is received from a server having the base file.

15 . The apparatus of claim 10 , wherein:

the global secret is received from a second white-box implementation of another device of another node and is generated according to the base file.

16 . The apparatus of claim 10 , wherein:

the output comprises an asymmetric key pair encoded for the node; and

the second processor instructions for generating the output according to at least one of the globally-encoded secrets or the node-encoded secrets comprise second processor instructions for:

receiving a request for the encoded asymmetric key pair;

generating the asymmetric key pair; and

node-encoding the generated asymmetric key pair according to the node-specific locking transformations.

17 . The apparatus of claim 10 , wherein:

the output comprises a digital certificate encoded for the node; and

the second processor instructions for generating the output according to at least one of the encoded global secrets or the node-encoded secrets comprise second processor instructions for:

receiving a request for the digital certificate encoded for the node;

generating an asymmetric key pair; and

generating the digital certificate from the asymmetric key pair; and

node-encoding a private key of the digital certificate according to the node-specific locking transformations.

18 . The apparatus of claim 10 , wherein:

the output comprises a write request signed by the white-box implementation; and

the second processor instructions for generating the output according to at least one of the encoded global secrets or the node-encoded secrets comprise second processor instructions for:

receiving a request for an operation to write data to secure cloud storage wherein the data is node-encoded according to the node-specific node locking transformations;

generating a cryptographic hash from a unique identifier of the data, the fingerprint, and one of the node-encoded secrets; and

signing the request for the operation to write data and the data according to the generated cryptographic hash using at least one of the node-specific locked white-box LUTs of the soft-locked white-box implementation; and

wherein the secure cloud storage verifies the write request according to the base file before writing the data to the secure cloud storage.

19 . An apparatus for enabling secure generation of an output, comprising:

means for generating a white-box implementation according to a base file having a plurality of secrets, the white-box implementation having:

unlocked white-box look up table (LUTs) for node-encoded secrets, the node-encoded secrets to be encoded for operation solely on a node of a network; and

globally encoded white-box LUTs for globally-encoded secrets to be encoded for operation on the node and at least another node;

means for generating, a soft-locked white-box implementation according to a fingerprint of the node, the unlocked white-box LUTs, and the globally encoded white-box LUTs, the soft-locked white-box implementation having a plurality of node-specific locked white-box LUTs and modified globally encoded LUTs;

means for receiving a global secret encoded according to the base file;

means for generating the node-encoded secrets by applying node-specific locking transformations to the global secret; and

means for generating, by the node, the output according to at least one of the globally-encoded secrets or the node-encoded secrets.

20 . The apparatus of claim 19 , wherein the means for generating the soft-locked white-box implementation according to the fingerprint of the node comprises:

means for encoding the unlocked white-box LUTs by applying locking transformations specific to the node to the unlocked white-box LUTs according to at least the fingerprint; and

means for generating the modified globally encoded LUTs to accept data from at least one node-specific locked white-box LUT or to provide data to at least one node-specific locked white-box LUT.