# US 2017/0286647 A1 · Watermarking input and output of a white-box implementation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0286647 A1
- Document ID: US20170286647A1
- Status: Published application
- Kind: A1
- Application number: 15/084,817
- Filed: 2016-03-30
- Published: 2017-10-05
- Earliest claimed: 2016-03-30
- Assignees: NXP B.V.
- Applicants: NXP B.V.
- Inventors: Wilhelmus Petrus Adrianus Johannus MICHIELS; Stefan Kuipers
- Web page: https://patentgrep.com/patent/US20170286647A1

## CPC

- G06F 21/16: Program or content traceability, e.g. by watermarking
- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)}
- H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation}
- H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms}
- G06F 21/1063: {Personalisation}
- H04L 2209/16: Obfuscation or hiding, e.g. involving white box
- H04L 2209/606: Traitor tracing
- H04L 2209/608: Watermarking
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method of mapping an input message to an output message by a keyed cryptographic encryption operation, wherein the keyed cryptographic encryption operation includes a first round, including: performing a substitution function on a first portion of the input message to produce an output, wherein the substitution function incorporates a portion of a cryptographic key; and performing a watermarking function on the output, wherein the watermarking function produces a watermark output when the first input portion has a specific predetermined value, wherein the watermark output uniquely identifies the keyed cryptographic encryption operation.

## Claims

### Claim 1

A non-transitory machine-readable storage medium encoded with instructions for mapping an input message to an output message by a keyed cryptographic encryption operation, wherein the keyed cryptographic encryption operation includes a first round, comprising:
instructions for performing a substitution function on a first portion of the input message to produce an output, wherein the substitution function incorporates a portion of a cryptographic key; and
instructions for performing a watermarking function on the output, wherein the watermarking function produces a watermark output when the first input portion has a specific predetermined value,
wherein the watermark output uniquely identifies the keyed cryptographic encryption operation.

### Claim 2 (depends on 1)

The non-transitory machine-readable storage medium of claim 1, wherein the watermarking function produces a weighted output when the first input portion has a value other than the specific predetermined value.

### Claim 3 (depends on 2)

The non-transitory machine-readable storage medium of claim 2, wherein:
the cryptographic encryption operation is an advanced encryption standard (AES) operation; and
the watermarking function implements a portion of an AES MixColumns operation.

### Claim 4 (depends on 1)

The non-transitory machine-readable storage medium of claim 1, wherein producing the watermark output is further based upon a watermark condition, wherein the watermark condition is based upon a second portion of the input message.

### Claim 5 (depends on 1)

The non-transitory machine-readable storage medium of claim 1, wherein the first portion of the input is a first ASCII value and wherein watermark value is a different second ASCII value that has an appearance similar to the first ASCII value.

### Claim 6 (depends on 1)

The non-transitory machine-readable storage medium of claim 1, wherein the keyed cryptographic encryption operation includes a plurality of lookup tables.

### Claim 7 (depends on 1)

The non-transitory machine-readable storage medium of claim 1, wherein the keyed cryptographic encryption operation includes a plurality of finite state machines.

### Claim 8

A method of mapping an input message to an output message by a keyed cryptographic encryption operation, wherein the keyed cryptographic encryption operation includes a first round, comprising:
performing a substitution function on a first portion of the input message to produce an output, wherein the substitution function incorporates a portion of a cryptographic key; and
performing a watermarking function on the output, wherein the watermarking function produces a watermark output when the first input portion has a specific predetermined value,
wherein the watermark output uniquely identifies the keyed cryptographic encryption operation.

### Claim 9 (depends on 8)

The method of claim 8, wherein the watermarking function produces a weighted output when the first input portion has a value other than the specific predetermined value.

### Claim 10 (depends on 9)

The method of claim 9, wherein:
the cryptographic encryption operation is an advanced encryption standard (AES) operation; and
the watermarking function implements a portion of an AES MixColumns operation.

### Claim 11 (depends on 8)

The method of claim 8, wherein producing the watermark output is further based upon a watermark condition, wherein the watermark condition is based upon a second portion of the input message.

### Claim 12 (depends on 8)

The method of claim 8, wherein the first portion of the input is a first ASCII value and wherein watermark value is a different second ASCII value that has an appearance similar to the first ASCII value.

### Claim 13 (depends on 8)

The method of claim 8, wherein the keyed cryptographic encryption operation includes a plurality of lookup tables.

### Claim 14 (depends on 8)

The method of claim 8, wherein the keyed cryptographic encryption operation includes a plurality of finite state machines.

### Claim 15

A non-transitory machine-readable storage medium encoded with instructions for mapping an input message to an output message by a keyed cryptographic decryption operation, wherein the keyed cryptographic decryption operation includes a last round and a state, comprising:
instructions for performing a watermarking function on a first portion of the state prior to input to the last round, wherein the watermarking function produces a first output when the first portion has a specific predetermined value;
instructions for performing a substitution function in the last round on the first output to produce a watermark output, wherein the substitution function incorporates a portion of a cryptographic key,
wherein the watermark output uniquely identifies the keyed cryptographic encryption operation.

### Claim 16 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein the watermarking function produces an output equal to the first input portion when the first input portion has a value other than the specific predetermined value.

### Claim 17 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein producing the watermark output is further based upon a watermark condition, wherein the watermark condition is based upon a second portion of the state.

### Claim 18 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein the cryptographic decryption operation is an advanced encryption standard (AES) operation.

### Claim 19 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein when the first portion of the state is input to the substitution function a first ASCII value results and wherein watermark value is a different second ASCII value that has an appearance similar to the first ASCII value.

### Claim 20 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein the keyed cryptographic decryption operation includes a plurality of lookup tables.

### Claim 21 (depends on 15)

The non-transitory machine-readable storage medium of claim 15, wherein the keyed cryptographic decryption operation includes a plurality of finite state machines.

### Claim 22

A method of mapping an input message to an output message by a keyed cryptographic decryption operation, wherein the keyed cryptographic decryption operation includes a last round and a state, comprising:
performing a watermarking function on a first portion of the state prior to input to the last round, wherein the watermarking function produces a first output when the first portion has a specific predetermined value;
performing a substitution function in the last round on the first output to produce a watermark output, wherein the substitution function incorporates a portion of a cryptographic key,
wherein the watermark output uniquely identifies the keyed cryptographic encryption operation.

### Claim 23 (depends on 22)

The method of claim 22, wherein the watermarking function produces an output equal to the first input portion when the first input portion has a value other than the specific predetermined value.

### Claim 24 (depends on 22)

The method of claim 22, wherein producing the watermark output is further based upon a watermark condition, wherein the watermark condition is based upon a second portion of the state.

### Claim 25 (depends on 22)

The method of claim 22, wherein the cryptographic decryption operation is an advanced encryption standard (AES) operation.

### Claim 26 (depends on 22)

The method of claim 22, wherein when the first portion of the state is input to the substitution function a first ASCII value results and wherein watermark value is a different second ASCII value that has an appearance similar to the first ASCII value.

### Claim 27 (depends on 22)

The method of claim 22, wherein the keyed cryptographic decryption operation includes a plurality of lookup tables.

### Claim 28 (depends on 22)

The method of claim 22, wherein the keyed cryptographic decryption operation includes a plurality of finite state machines.