加密计算中数据结构的编译混淆
Compiled Obfuscation for Data Structures in Encrypted Computing
摘要：
加密计算是一种新兴技术，其基础是一种“并行工作”的处理器，将加密输入转换为加密输出，而数据始终保持加密形式。它旨在保护用户数据免受操作员和操作系统（不知道用户的加密密钥，无法在处理器中访问它）可能的内部攻击。用于加密计算的形式上的“混淆”编译是这样的，即在源代码的每次重新编译时，发出相同结构的机器码，对于这些机器码，运行时跟踪也都具有相同的结构，但是加密下的每个字与标称不同，在重新编译时具有最大可能的熵。相对于加密的安全性，这为数据生成了经典的加密语义安全性，但它只能保证单个单词，并且对手有更多的解密尝试。本文将现有的基于整数的技术扩展到double、float、array、struct和union等数据结构，覆盖了ANSI C。一个单一的原则驱动编译器的设计，并改善现有的安全理论，以量化的结果：每一个算术指令，写必须改变到最大可能的范围。
英文摘要：
Encrypted computing is an emerging technology based on a processor that `works encrypted', taking encrypted inputs to encrypted outputs while data remains in encrypted form throughout. It aims to secure user data against possible insider attacks by the operator and operating system (who do not know the user's encryption key and cannot access it in the processor). Formally `obfuscating' compilation for encrypted computing is such that on each recompilation of the source code, machine code of the same structure is emitted for which runtime traces also all have the same structure but each word beneath the encryption differs from nominal with maximal possible entropy across recompilations. That generates classic cryptographic semantic security for data, relative to the security of the encryption, but it guarantees only single words and an adversary has more than that on which to base decryption attempts. This paper extends the existing integer-based technology to doubles, floats, arrays, structs and unions as data structures, covering ANSI C. A single principle drives compiler design and improves the existing security theory to quantitative results: every arithmetic instruction that writes must vary to the maximal extent possible.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
