阅读说明：本技术 同步故障注入的故障攻击防护 (Fault attack protection for synchronous fault injection ) 是由 斯特凡·多尔 马库斯·雷格纳 桑迪普·贾殷 于 2019-06-12 设计创作，主要内容包括：本发明涉及同步故障注入的故障攻击防护。各种实施例涉及一种电路,其包括：第一安全电路,其被配置成接收输入并产生第一输出；第一延迟电路,其被配置成接收所述第一输出并产生延迟时间N的第一延迟输出；第二延迟电路,其被配置成接收所述输入并产生延迟时间N的延迟输入；第二安全电路,其被配置成接收所述延迟输入并产生第二延迟输出；以及比较器,其被配置成比较所述第一延迟输出与所述第二延迟输出并产生结果,其中当所述第一延迟输出匹配所述第二延迟输出时所述结果是所述第一延迟输出或所述第二延迟输出中的一个且当所述第一延迟输出不匹配所述第二延迟输出时所述结果是误差值。(The invention relates to fault attack protection for synchronous fault injection. Various embodiments relate to a circuit, comprising: a first safety circuit configured to receive an input and to generate a first output; a first delay circuit configured to receive the first output and generate a first delayed output of delay time N; a second delay circuit configured to receive the input and generate a delay input of delay time N; a second safety circuit configured to receive the delay input and to generate a second delay output; and a comparator configured to compare the first delayed output and the second delayed output and generate a result, wherein the result is one of the first delayed output or the second delayed output when the first delayed output matches the second delayed output and an error value when the first delayed output does not match the second delayed output.)

1. A circuit, comprising:

a first safety circuit configured to receive an input and to generate a first output;

a first delay circuit configured to receive the first output and generate a first delayed output of delay time N;

a second delay circuit configured to receive the input and generate a delay input of delay time N;

a second safety circuit configured to receive the delay input and to generate a second delay output; and

a comparator configured to compare the first delayed output and the second delayed output and generate a result, wherein the result is one of the first delayed output or the second delayed output when the first delayed output matches the second delayed output and an error value when the first delayed output does not match the second delayed output.

2. The circuit of claim 1, wherein the value of N is randomly selected.

3. The circuit of claim 1, wherein the value of N changes periodically.

4. The circuit of claim 1, further comprising:

a third delay circuit configured to receive the result and generate a delayed result of delay time M.

5. The circuit of claim 4, wherein the value of N is randomly selected, and wherein the value M is x-N, where x is a constant total delay value.

6. The circuit of claim 5, wherein the N and M values change periodically.

7. A method of securely generating an output from a circuit, comprising:

receiving an input by a first safety circuit and generating a first output;

receiving the output by a first delay circuit and producing a first delayed output of delay time N;

receiving the input by a second delay circuit and generating a delay input of delay time N;

receiving, by a second safety circuit, the delay input and generating a second delay output; and

comparing, by a comparator, the first delayed output and the second delayed output and producing a result, wherein the result is one of the first delayed output or the second delayed output when the first delayed output matches the second delayed output and an error value when the first delayed output does not match the second delayed output.

8. The method of claim 7, wherein the value of N is randomly selected.

9. The method of claim 7, wherein the value of N is periodically changed.

10. A circuit, comprising:

a first delay circuit configured to receive an input and generate a first delay input delayed by a time a · N, where N is a time delay and a is a scalar value from 0 to N;

a second delay circuit configured to receive the input and generate a second delayed input delayed by a delay time b · N, where b is a scalar value from 0 to N;

a third delay circuit configured to receive the input and generate a third delayed input delayed by a delay time c · N, where c is a scalar value from 0 to N;

a first safety circuit configured to receive the first delay input and to generate a first delay output;

a second safety circuit configured to receive the second delay input and to generate a second delay output;

a third safety circuit configured to receive the third delay input and generate a third delay output;

a fourth delay circuit configured to receive the first delayed output and to generate a fourth delayed output of delay time (N-a) · N;

a fifth delay circuit configured to receive the second delayed output and generate a fifth delayed output of delay time (N-b). N;

a sixth delay circuit configured to receive the third delayed output and generate a sixth delayed output of delay time (N-c). N; and

a comparator configured to compare the fourth, fifth, and sixth delayed outputs and produce a result, wherein the result is one of the fourth, fifth, or second delayed outputs when the fourth, fifth, and sixth delayed outputs are all equal to each other, and otherwise the result is an error value.

Technical Field

Various exemplary embodiments disclosed herein relate generally to fault attack protection for synchronous fault injection.

Background

Various schemes for attacking cryptographic hardware have been developed, including fault attacks that inject a fault into the cryptographic hardware. The attacker can then cause a failure and analyze the results to obtain secret information about the cryptographic hardware, e.g. cryptographic keys.

Disclosure of Invention

An overview of various embodiments is presented below. Some simplifications and omissions may be made in the following summary, which is intended to highlight and introduce some aspects of the various exemplary embodiments, but not to limit the scope of the invention. Detailed descriptions of exemplary embodiments sufficient to enable those of ordinary skill in the art to make and use the inventive concepts will be described in later sections.

Various embodiments relate to a circuit, comprising: a first safety circuit configured to receive an input and to generate a first output; a first delay circuit configured to receive the first output and generate a first delayed output of delay time N; a second delay circuit configured to receive the input and generate a delay input of delay time N; a second safety circuit configured to receive the delay input and to generate a second delay output; and a comparator configured to compare the first delayed output and the second delayed output and generate a result, wherein the result is one of the first delayed output or the second delayed output when the first delayed output matches the second delayed output and an error value when the first delayed output does not match the second delayed output.

Various embodiments are described in which the value of N is randomly selected.

Various embodiments are described in which the value of N is periodically changed.

Various embodiments are described that additionally include: a third delay circuit configured to receive the result and generate a delayed result of the delay time M.

Various embodiments are described in which the value of N is randomly selected and the value M ═ x-N, where x is a constant total delay value.

Various embodiments are described in which the N and M values are periodically changed.

A method of securely generating an output by a circuit, comprising: receiving an input by a first safety circuit and generating a first output; receiving the output by the first delay circuit and generating a first delayed output of delay time N; receiving an input by a second delay circuit and generating a delay input of delay time N; receiving, by a second safety circuit, a delay input and generating a second delay output; and comparing, by the comparator, the first delayed output with the second delayed output and producing a result, wherein the result is one of the first delayed output or the second delayed output when the first delayed output matches the second delayed output, and the result is an error value when the first delayed output does not match the second delayed output.

Various embodiments are described in which the value of N is randomly selected.

Various embodiments are described in which the value of N is periodically changed.

Various embodiments are described that additionally include: the result is received by the third delay circuit and a delay result is generated for a delay time M.

Various embodiments are described in which the value of N is randomly selected and the value M ═ x-N, where x is a constant total delay value.

Various embodiments are described in which the N and M values are periodically changed.

Various further embodiments relate to a circuit comprising: a first delay circuit configured to receive an input and generate a first delay input delayed by a time a · N, where N is a time delay and a is a scalar value from 0 to N; a second delay circuit configured to receive an input and generate a second delay input delayed by a delay time b · N, where b is a scalar value from 0 to N; a third delay circuit configured to receive an input and generate a third delay input of delay time c · N, where c is a scalar value from 0 to N; a first safety circuit configured to receive a first delay input and to generate a first delay output; a second safety circuit configured to receive a second delay input and to generate a second delay output; a third safety circuit configured to receive a third delay input and generate a third delay output; a fourth delay circuit configured to receive the first delayed output and generate a fourth delayed output of delay time (N-a). N; a fifth delay circuit configured to receive the second delayed output and generate a fifth delayed output of delay time (N-b). N; a sixth delay circuit configured to receive the third delayed output and generate a sixth delayed output of delay time (N-c). N; and a comparator configured to compare the fourth, fifth, and sixth delayed outputs and generate a result, wherein the result is one of the fourth, fifth, or second delayed outputs when the fourth, fifth, and sixth delayed outputs are all equal to one another, and the result is an error value otherwise.

Various embodiments are described in which the value of N is randomly selected.

Various embodiments are described in which the value of N is periodically changed.

Various embodiments are described that additionally include: a third delay circuit configured to receive the result and generate a delayed result of the delay time M.

Various embodiments are described in which the value of N is randomly selected and the value M ═ x-N, where x is a constant total delay value.

Various embodiments are described in which the N and M values are periodically changed.

Various embodiments are described in which at least two of the scalar values a, b, and c are different.

Drawings

For a better understanding of the various exemplary embodiments, reference is made to the accompanying drawings, in which:

FIG. 1 illustrates a safety circuit using redundant safety circuits;

FIG. 2 illustrates an embodiment of a safety circuit using redundant safety circuits with additional delay; and

fig. 3 illustrates another embodiment of a safety circuit using redundant safety circuits with additional delay.

To facilitate understanding, the same reference numerals have been used to designate elements having substantially the same or similar structure and/or substantially the same or similar function.

Detailed Description

The description and drawings illustrate the principles of the invention. It will thus be appreciated that those skilled in the art will be able to devise various arrangements which, although not explicitly described or shown herein, embody the principles of the invention and are included within its spirit and scope. Moreover, all examples cited herein are principally intended expressly to be only for pedagogical purposes to aid the reader in understanding the principles of the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically cited examples and conditions. Additionally, as used herein, the term "or" refers to a non-exclusive or (i.e., and/or), unless otherwise indicated (e.g., "or otherwise" or in the alternative). Furthermore, the various embodiments described herein are not necessarily mutually exclusive, as some embodiments may be combined with one or more other embodiments to form new embodiments.

An attacker of the security circuit (e.g. a cryptographic accelerator) may attempt to break the output of these circuits at a fine granularity (ideally bit-by-bit) in order to observe the reaction of the entire apparatus or to produce a favorable reaction. Fault attacks such as laser attacks may be employed for this purpose. In this attack, a laser beam is focused on a specific part of the circuit to cause a fault in a specific bit or group of bits. By observing the inputs and outputs of the security circuit during normal operation and then observing the operation of the circuit when a fault is raised, an attacker can perform statistical and/or other analysis to obtain information about security information, such as encryption keys.

As a countermeasure against such a fault attack, the safety circuit may be implemented redundantly, for example, with two or more instances of the safety circuit and the output of a redundant safety circuit combined with comparison logic. I.e. the outputs of two different circuits are compared and if they match, the output is valid and if the outputs do not match, the output is invalid. Fig. 1 shows a safety circuit 100 using redundant safety circuits. Specifically, the encryption cores 110 and 115 receive the same input data 105. The operation of the two encryption cores 110 and 115 is synchronized in time. The outputs of the two encryption cores 110 and 115 are then input into the compare and infect countermeasure circuit 120. If the outputs of the two encryption cores match, then the outputs of encryption cores 110 and 115 are deemed valid and output as result 125. If the outputs of the two cryptographic cores do not match, an error value is generated as a result by compare and infect countermeasure circuit 120, where the error is inserted in the result to affect more bits than are corrupted by an attacker. Thus, an attacker attempting to modify only a few bits of the result 125 may eventually disturb a large number of bits. This limits what an attacker can learn through such attacks. The comparison and infection countermeasure circuit may also be referred to as a comparator.

It has previously been considered difficult to coordinate attacks on multiple instances of the security circuit at the time of correction. This redundant implementation of the security circuit requires an attacker to attack all instances simultaneously and with precise timing that is more difficult to achieve. However, researchers have devised new ways to coordinate attacks on all redundant instances of the security circuit simultaneously, for example using optical methods such as splitting a laser beam with a prism. These methods overcome the high hurdles of previous synchronization attacks.

Embodiments of protecting circuits against these simple synchronization attacks will now be described. Such attacks can be counteracted by inserting delays in the circuit at different locations in the redundant instance.

Fig. 2 illustrates an embodiment of a safety circuit using redundant safety circuits with additional delay. Specifically, the security circuit includes encryption cores 210 and 215, a comparison and infection countermeasure circuit 220, and delay circuits 230, 235, and 240. The encryption core 210 receives input data 205. The encryption core 210 then processes the input data and generates an output that is fed into the delay circuit 230. The delay circuit 230 delays the output of the encryption core 210 by a time N. The output of the delay circuit is then input to the compare and tamper countermeasures circuit 220. Input data 205 is also an input to delay circuit 235, which delays input 205 by a time N. The encryption core 215 then receives a delay input from the delay circuit 235. The output of the encryption core 215 is then input into the compare and infect countermeasures circuit 220. If the output of the encryption core 215 and the delay circuit 230 match, the encryption core output is deemed valid. If the output of the encryption core 215 and the delay circuit 230 do not match, an error value is generated as a result 225 by the compare and infect countermeasure circuit 220, where the error is inserted in the result 225 to affect a greater number of bits than are corrupted by an attacker. The output of the compare and infect countermeasure circuit 220 may optionally be input to a delay element 240 that delays the assertion of the result 225 by a time M.

In fig. 2, it can be seen that the input of redundant cryptographic core 215 will only be available at a certain delay N after the input has become available to cryptographic core 210. Thus, encryption core 210 will produce its output earlier than encryption core 215. However, since the output of encryption core 210 is delayed by the same amount of time N, the comparison of the outputs of encryption cores 210 and 215 for the same input will occur simultaneously. Now, an attacker's synchronization attack will destroy the output of the cryptographic core at different times, which will be detected by the compare and infect counter circuit, which will then introduce additional errors into the output to thwart the attack.

As mentioned, a delay circuit 240 may optionally be added, wherein the delay circuit 240 delays the output by a time M. The difficulty of an attacker may be additionally increased by varying the delay N over time, for example based on the output of the random number generator. The value of N may vary with some regular or even varying periodicity. In addition, the randomness of the delay N can be hidden by keeping the sum of M + N constant. In this case, M is chosen to be M ═ x-N, where x is the fixed total delay and N is chosen randomly.

Fig. 3 illustrates another embodiment of a safety circuit using redundant safety circuits with additional delay. The safety circuit 300 shows how the use of delay is generalized to more than two examples of safety circuits. Specifically, the security circuit includes encryption cores 312, 322, and 332, a comparison and infection countermeasure circuit 340, and delay circuits 310, 314, 320, 324, 330, 334, and 345. Delay circuits 310, 320, and 330 receive input data 305. The delay circuits 310, 320, and 330 output input data delayed by aN, bN, and cN, respectively. N is the time delay. The values a, b and c are scalar values from 0 to n that are selected to be different for each delay circuit so that the total delay for each circuit is different. The outputs of delay circuits 310, 320, and 330 are input to encryption cores 312, 322, and 332, respectively. The outputs of encryption cores 312, 322, and 332 are then input to delay circuits 314, 324, and 334, respectively. Delay circuits 314, 324, and 334 have delays of (N-a) N, (N-b) N, and (N-c) N, respectively. The outputs of delay circuits 314, 324, and 334 are then input to compare and infect countermeasure circuit 340. If the outputs of all delay circuits 314, 324, and 334 match, then the encryption core output is considered valid. If the outputs of delay circuits 314, 324, and 334 do not match, an error value is generated by compare and infect countermeasure circuit 340 as result 350, where the error is inserted in result 350 to affect more bits than are corrupted by the attacker. The output of the compare and infect countermeasure circuit 340 may optionally be input to a delay element 345, which delays the result 350 by a time M. In this embodiment, the value of N may also be randomly selected, and the value of M may then be selected such that M + nN is constant, as previously described. This will hide the randomness of the values. In addition, the scalar values a, b, and c may be fixed or randomly selected. At least two of the scalar values a, b, and c need to be different so that input data is processed at different times in at least two cryptographic cores. The security circuit 300 can be extended to even more instances by adding additional cryptographic cores and associated delays. In addition, the security circuit 300 can be simplified by setting a to 0 and b to n. Thus, delay 310 and delay 324 may be eliminated from the circuit, as each of these delays will be zero.

The embodiments described in fig. 1 to 3 may also be implemented entirely in hardware or a combination of hardware and software. Any combination of the specific software running on a processor to implement embodiments of the present invention constitutes a specific specialized machine.

As used herein, the term "non-transitory machine-readable storage medium" should be understood to exclude transitory propagating signals but include all forms of volatile and non-volatile memory.

It will be appreciated by those skilled in the art that any block diagrams herein represent conceptual views of illustrative circuitry embodying the principles of the invention.

While various exemplary embodiments have been described in detail with particular reference to certain aspects thereof, it should be understood that the invention is capable of other embodiments and its details are capable of modifications in various obvious aspects. As will be readily apparent to those skilled in the art, variations and modifications can be effected while remaining within the spirit and scope of the embodiments. Accordingly, the foregoing disclosure, description, and drawings are for illustrative purposes only and are not intended to limit the invention, which is defined only by the claims, in any way.