Side channel timing attack mitigation in securing data in transit

A method for side-channel attack mitigation in streaming encryption includes reading into a decryption process executing in memory of a computer, an input stream and extracting from the input stream both an encryption envelope and cipher text and extracting from the encryption envelope, a wrapped key. Then, decryption may be performed in constant time of the cipher text using one of two different keys, a first for authenticated decryption comprising the wrapped key, and a second for unauthenticated encryption comprising a dummy key, with no difference in timing of execution regardless of which of the two different keys are utilized during decryption of the cipher text.

BACKGROUND OF THE INVENTION

Field of the Invention

The present invention relates to the field of data security and more particularly to securing data in transit in a data processing system.

Description of the Related Art

In the field of data processing, data at rest refers to inactive data stored physically in any digital form including within a database, data warehouse, document including a spreadsheet, or digital archive or other persistent memory including that found within a mobile device. Data at rest may be compared to data in use and data in transit, thus defining three understood states of digital data Like data in use and data at rest, data in transmit, also known as streaming data, also must be secured for view by unauthorized entities. To that end, data encryption is commonly used to protect data in transit. General encryption techniques employed for data in transmit include strong encryption methods such as advanced encryption standard (AES) or Rivest-Shamir-Adleman (RSA) and ensure that encrypted data remains encrypted when access controls such as usernames and password fail.

General encryption of data in transmit is not without its challenges. In this regard, existing methods of authenticating associated data with encrypted content with cryptographic systems such as AES requires the use of a method authentication code (MAC) whose signature is checked to authenticate both the ciphertext of the associated data as well as any additional authenticated data (AAD). It is common for an encryption envelope to include an AAD.

The foregoing process works well when retrieving all of the encrypted content at once by throwing an exception at the end of the reading of data, and notifying the client that the content failed the MAC signature check. However, if the data is streamed, the exception will not be raised until the entirety of the content has been read. Yet, it is undesirable to decrypt secret data with a real key when it has been determined that the encryption envelope and/or AAD have been tampered with. It is also undesirable to short circuit the decryption of the encrypted cipher text of the streaming data if the encryption envelope and/or AAD have been determined to have been tampered with as to do so introduces timing difference between processing legitimate streaming data and illegitimate streaming data.

More particular, the foregoing introduces a side-channel timing attack based upon the variable time processing of streaming data. In a side-channel timing attack, the attacker attempts to compromise a cryptosystem by analyzing the time taken to execute cryptographic algorithms. Indeed, the malicious determination of otherwise protected secrets through timing information may be significantly easier than using cryptanalysis of known plaintext, ciphertext pairs. Sometimes timing information is combined with cryptanalysis to increase the rate of information leakage.

BRIEF SUMMARY OF THE INVENTION

Embodiments of the present invention address deficiencies of the art in respect to streaming encryption and the prevention of side-channel timing attacks and provide a novel and non-obvious method, system and computer program product for side-channel attack mitigation in streaming encryption. In an embodiment of the invention, a method for side-channel attack mitigation in streaming encryption includes reading into a decryption process executing in memory of a computer, an input stream and extracting from the input stream both an encryption envelope and cipher text and extracting from the encryption envelope, a wrapped key. Then, decryption may be performed in constant time of the cipher text using one of two different keys, a first for authenticated decryption comprising the wrapped key, and a second for unauthenticated encryption comprising a dummy key, with no difference in timing of execution regardless of which of the two different keys are utilized during decryption of the cipher text.

In one aspect of the embodiment, the decryption in constant time includes the generation of the dummy key that differs from the wrapped key, the reading from the input stream of a message authentication code (MAC) and then generation of a MAC for the encryption envelope. Then, the encryption envelope is authenticated by comparing both MAC. On the condition that the encryption envelope passes authentication, the wrapped key is used to decrypt the cipher text. But, on the condition that the encryption envelope fails authentication, the dummy key is utilized to decrypt the cipher text. Optionally, a MAC verification is performed on the cipher text after decryption with a returning of a failure code upon failure. But otherwise, the decrypted cipher text is returned as output of the decryption process.

In another embodiment of the invention, a streaming decryption data processing system is provided. The system includes a host computer with memory and at least one processor and a decryption process executing in the memory of the host computer and performing decryption of input streams. The system also includes a side-channel attack mitigation module. The module includes computer program code executing in the memory of the host computer. The program code during execution is operable in streaming encryption to read in an input stream into the decryption process, extract from the input stream both an encryption envelope and cipher text and extract from the encryption envelope, a wrapped key, and perform decryption in constant time of the cipher text using one of two different keys, a first for authenticated decryption that includes the wrapped key, and a second for unauthenticated encryption that includes a dummy key, with no difference in timing of execution regardless of which of the two different keys are utilized during decryption of the cipher text.

DETAILED DESCRIPTION OF THE INVENTION

Embodiments of the invention provide for side-channel timing attack mitigation in streaming data decryption. In accordance with an embodiment of the invention, streaming data is received that includes each of cipher text symmetrically encrypted using a legitimate key, an encryption envelope holding a key purportedly to be the legitimate key, and a MAC computed for the encryption envelope purportedly using the legitimate key. Then, using constant-time decryption, the cipher text is decrypted to produce legitimate clear text, or illegitimate clear text depending upon whether or not the MAC for the encryption envelope is determined to be authentic or inauthentic. Optionally, an additional MAC verification is performed on the cipher text after decryption and a failure code returned upon failure, but otherwise the decrypted cipher text is provided as the output of the decryption process

In further illustration,FIG. 1is pictorial illustration of a process for side-channel timing attack mitigation in streaming data decryption. As shown inFIG. 1, clear, unencrypted data110A may be symmetrically encrypted utilizing actual key120A to produce cipher text130. The actual key120A is then wrapped with wrapping key120E to wrapped key120D which is then placed in encryption envelope140and a MAC150A generated using the actual key120A and a hash MAC generation function160to produce the MAC150A. The data including encryption envelope140, MAC150A and cipher text130is then transmitted over computer communications network170to a recipient client.

Upon receipt of cipher text130, an encryption envelope140and a received MAC150B therefore, the recipient client extracts from the encryption envelope140the enveloped key120A that purports to be the actual key120A and creates a dummy key120C in a secure fashion from the enveloped key120B that differs from the enveloped key120B and the actual key120A, and that explicitly has no relation to the actual key120A. Then, a MAC150C is generated for the encryption envelope140utilizing the enveloped key120B and hash MAC generation function160. To the extent that the enveloped key120B is in fact the actual key120A and the content of the encryption envelope140including any AAD has not changed since prior to transmission, then the generated MAC150C will be the same as the received MAC150B. However, if the enveloped key120B is different than the actual key120A, or if the content of the encryption envelope140including any AAD included in the encryption envelope140has changed since transmission, then the generated MAC150C will be different than the received MAC150B.

Consequently, both the generated MAC150C and the MAC150B are compared to one another in comparator190. On the condition that the generated MAC150C is equivalent to the received MAC150B, then the cipher text130is decrypted utilizing the enveloped key120B to produce the original, clear, unencrypted data110A. Otherwise, on the opposite condition that the generated MAC150C differs from the received MAC150B, then the cipher text130is decrypted utilizing the generated dummy key120C so as to produce decrypted, dummy data110B. But, in either circumstance, the decryption will have been performed in constant computational time irrespective of whether or not the original, clear, unencrypted data110A is produced, or the decrypted, dummy data110B.

The process described in connection withFIG. 1may be implemented within a streaming data processing system. In further illustration,FIG. 2schematically depicts a streaming data processing system configured for side-channel timing attack migration. The system includes a host computing system210that includes memory220and at least one processor230. The host computing system210is communicatively coupled to different computing devices250,250a-nover computer communications network240and is enabled to receive from each of the devices250, an encrypted data stream280. Finally, the system includes a constant time decryption module300.

The constant time decryption module300includes computer program instructions enabled upon execution in the memory220of the host computing system210to perform constant time decryption of the encrypted data stream280. In this regard, the program instructions during execution extract from the encrypted data stream280a key disposed in an encryption envelope of the encrypted data stream280and also a MAC included in the encrypted data stream280. The program instructions during execution further generate based upon the extracted key a dummy key, and the program instructions during execution create a MAC based upon the content of the encryption envelope and the extracted key. The program instructions during execution yet further compare the created MAC with the extracted MAC. On the condition that the MACs are equivalent, the program instructions decrypt the cipher text of the encrypted data stream280utilizing the extracted key to produce cipher text270. But otherwise, the program instructions decrypt the cipher text of the encrypted data stream280utilizing the dummy key to produce dummy text260.

In even yet further illustration of the operation of the constant time decryption module300,FIG. 3is a flow chart illustrating a process for side-channel timing attack mitigation in streaming data decryption. Beginning in block310, a cipher stream is received in memory of the computing system and in block320, a key disposed within an encryption envelope of the cipher stream is extracted. In block330, a MAC also is extracted from the received cipher stream and in block340, a dummy key is generated. As well, in block350, a MAC is generated using a hash function and the extracted key.

In block360, the generated MAC and the extracted MAC are compared to one another. In decision block370, if it is determined that the generated MAC and the extracted MAC are equivalent, then in block380the cipher text of the cipher stream is decrypted utilizing the extracted key. But otherwise, if it is determined in block370that the generated MAC and the extracted MAC are not equivalent, then in block390the cipher text of the cipher stream is decrypted using the generated dummy key.

The present invention may be embodied within a system, a method, a computer program product or any combination thereof. The computer program product may include a computer readable storage medium or media having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention. The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing.

Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.