System and method for protecting computer software from a white box attack
Methods and systems related to increasing the cryptographic security of keys used by software with cryptographic functions. This is done by increasing the mathematical complexity of the software. The components and functions used by the software are first determined and, using these components, functions, and the data exchanged between them, the software is made more resistant to analysis. The methods used in increasing analytical resistance are grouped into 3 general types: adjusting the information exchanged between the components, replacing some components with different but related components, and adjusting the data flow between the components.
1. A method of enhancing cryptographic security for a cryptographic key used in software that has cryptographic components, the method comprising:
(a) ascertaining the different components of said software; and
(b) increasing the mathematical complexity of said software by:
i) separating, across a plurality of nodes of a network, components which access cryptographic key information, and
ii) applying transformations to communications between said nodes.
2. A method according to claim 1 wherein said applying transformations step comprises adjusting a data flow between components of said software.
3. A method according to claim 2 wherein specific data used by components of said software is stored in locations logically distinct from locations where said components are stored.
4. A method according to claim 2 wherein at least one component used by said software is executed at a data processing node logically distinct from a node where said software is executed, said node where said software is executed being in communication with said data processing node.
5. A method according to claim 2 wherein data used by said components of said software is routed between said components in a routing based on said key.
6. A method according to claim 2 wherein data used by said components of said software is routed in a routing based on contents of said data.
7. A method according to claim 1 wherein said applying transformations step comprises adjusting information exchanged between said components of said software.
8. A method accordingly to claim 7 wherein information exchanged between said components is expanded prior to being transmitted from a component by introducing redundancy in said information.
9. A method according to claim 8 wherein information exchanged between said components is expanded prior to being received by a component by removing said redundancy in said information.
10. A method according to claim 7 wherein said information exchanged between said components is mixed with other related data prior to being exchanged between components.
11. A method according to claim 10 wherein key information being exchanged between said components is mixed with text information.
12. A method according to claim 10 wherein mixing said information with said other related data is accomplished through using Latin-square combining functions.
13. A method according to claim 7 wherein said information is mapped onto different information prior to being exchanged with said components, said different information being exchanged with said components in place of said information.
14. A method according to claim 13 wherein different information received by a component from other components is mapped onto said information subsequent to being exchanged with said other components, said information being used by said component for processing.
15. A method according to claim 1 further comprising replacing specific components of said software with different but related components.
16. A method according to claim 15 wherein different but related components used by said software are stored in locations logically distinct from the location where said software is stored.
17. A method according to claim 15 wherein said different but related components implement a maximum distance separable function.
18. A method according to claim 17 wherein at least one of said specific components being replaced also implements a maximum distance separable function.
19. A method according to claim 15 wherein said specific components implement affine functions and said different but related components implement non-affine functions.
20. A method according to claim 19 wherein said non-affine functions are constructed by interleaving inputs and outputs of said affine functions implemented by said specific components.
21. A method according to claim 15 wherein said specific components represent mathematical transformations as matrices.
22. A method according to claim 21 wherein said different but related components represent mathematical transformations as mixing functions.
23. A method according to claim 22 wherein said mixing functions are maximum distance separable functions.
24. A method according to claim 15 wherein said specific components contain lookup tables and said different but related components contain polynomials used in place of said tables.