Quantitative digital sensor

Abstract

A device for protecting an integrated circuit from a disturbance attack is provided. The device comprises a sensing unit (30) configured to detect a disturbance attack, the sensing unit comprising a group of digital sensors, the group of digital sensors comprising at least two sensors, the sensors being arranged in parallel. Each digital sensor provides a digitized bit output having a binary value in response to input data, the sensing unit being configured to transmit at least one binary vector comprising a multi-bit value, the multi-bit value comprising at least two bit outputs provided by the group of digital sensors. The sensing device (3) further comprises an analysis unit (31), the analysis unit being configured to receive at least one binary vector provided by the sensing unit (30), the analysis unit being configured to detect a disturbance attack based on the at least one binary vector.

Description

Technical Field

[0001] The present invention relates generally to digital circuits and, in particular, to methods, systems, and computer program products for protecting an integrated circuit (1) from perturbation attacks. Background Art

[0002] Most embedded devices (e.g. smart cards, mobile phones, set-top boxes) use cryptographic algorithms (also called cryptography) to secure their data. Such cryptographic algorithms are implemented in embedded devices by using hardware encryption and / or decryption circuits. However, such hardware circuits may lead to security vulnerabilities.

[0003] Embedded devices based on integrated circuits may be threatened by two types of physical attacks: observation attacks (also known as side channel attacks) and perturbation attacks (also known as fault injection attacks). Such attacks aim to obtain confidential information (such as the key of an encryption algorithm) in order to decrypt the encrypted information contained in the embedded device.

[0004] Fault injection attacks are a type of perturbation attack that can be performed by injecting malicious faults into a cryptographic device and observing the corresponding erroneous output. Using this type of attack, the number of experiments required for an attacker to obtain confidential information can be reduced.

[0005] In particular, as disclosed in Marc Joye and Michael Tunstall in "Fault Analysis in Cryptography" (published in Springer LNCS in March 2011, URL: http: / / joye.site88.net / FAbook.html, DOI: 10.1007 / 978-3-642-29656-7; ISBN 978-3-642-29655-0), cryptanalysis can be performed using incorrect computations in cryptographic primitives.

[0006] Fault attacks can target program execution and can bypass security-critical operations, or skip security tests, etc. All of these effects can lead to a breach of chip security if handled properly by an attacker.

[0007] Countermeasures against perturbation attacks have become a major challenge to the security of embedded devices.

[0008] For example, it is known that a single failure on AES-128 may be sufficient to reveal its key under certain conditions, as disclosed below:

[0009] Marc Joye and Michael Tunstall, “Fault Analysis in Cryptography,” published in Springer LNCS, March 2011, http: / / joye.site88.net / FAbook.html, DOI: 10.1007 / 978-3-642-29656-7; ISBN 978-3-642-29655-0; and

[0010] Michael Tunstall, Debdeep Mukhopadhyay, and Subidh Ali, “Differential Fault Analysis of the Advanced Encryption Standard Using a Single Fault,” edited by Claudio Agostino Ardagna and Jianying Zhou, published in WISTP, Springer Lecture Notes in Computer Science, volume 6633, pp. 224-233, 2011.

[0011] Existing countermeasures are designed to prevent failures from leading to the disclosure of false values, thus preventing attackers from exploiting them to extract secrets.

[0012] Solutions have been proposed to counter perturbation attacks, which consist in detecting abnormal operating environments by using sensors to detect specific values ​​(e.g. parameter values ​​outside a predefined range) of some environmental parameters (e.g. temperature, voltage, clock frequency, critical path, etc.).

[0013] The solution described in EP2960665 discloses a device for detecting abnormal critical paths. In EP2960665, a calibration device for calibrating a digital sensor is specifically disclosed, the digital sensor being configured to protect a target digital circuit fed by a clock signal having a clock period by triggering an alarm according to a trigger condition related to the clock period and an optimal alarm threshold, the optimal alarm threshold being determined by minimizing an amount depending on the probability of occurrence of a false positive and the probability of occurrence of a false negative.

[0014] Digital sensors protect digital circuits or sub-circuits from attacks by triggering an alarm based on a trigger condition.

[0015] However, conventional approaches based on using sensors to detect abnormal parameter values ​​result in Boolean alarms that lack interpretability. In particular, it is impossible to identify whether an alarm is a false positive or actually caused by an attack attempt.

[0016] Since hardware implementations of some cryptographic algorithms such as AES (Advanced Encryption Standard) execute in a small number of clock cycles (10 clock cycles for AES-128), the sensor's reaction needs to be fast by definition. However, existing approaches are based on distinguishing between false positives and true positives, which requires time to collect statistics and calculate decisions. Such approaches are incompatible with security requirements, since a fault attack may lead to an illegal exploit in a very limited time frame.

[0017] Therefore, there is a need for improved systems, methods, and computer program products for protecting integrated circuits from attacks. Summary of the invention

[0018] To address these and other problems, a device for protecting an integrated circuit from a disturbance attack is provided, the device comprising a sensing unit configured to detect a disturbance attack. The sensing unit comprises a set of digital sensors, the set of digital sensors comprising at least two sensors, the at least two sensors being arranged in parallel, each digital sensor providing a digitized bit output having a binary value in response to input data. The sensing unit may be configured to transmit at least one binary vector comprising a multi-bit value comprising at least two bit outputs provided by the set of digital sensors. The sensing device may also include an analysis unit configured to receive at least one binary vector provided by the sensing unit, the analysis unit being configured to detect a disturbance attack from at least one binary vector.

[0019] In one embodiment, the analyzing unit may be configured to determine, from the at least one binary vector, a quantity representing a quantitative estimate and / or a qualitative estimate of the detected perturbation attack and / or a classification of the detected perturbation attack.

[0020] Each sensor of the sensing unit may include:

[0021] - an input memory block for storing input data;

[0022] - a first data path, the first data path being used to propagate input data and form a first delay chain;

[0023] - a second data path for propagating input data and forming a second delay chain.

[0024] The input memory block and the second path may further include a combination unit configured to determine a bit output of the sensor using the input data.

[0025] The input memory block may include an input memory element for storing input data generated using the stimulus generator, the first data path being configured to propagate data from the input memory element to a buffer element that buffers the data propagated through the initial delay chain.

[0026] In an embodiment, the device may further include an output memory associated with each sensor, the output memory for storing the bit output transmitted by the sensor.

[0027] A second data path for a given sensor is formed as a laddered delay chain, the second data path propagating the value bits from the buffer elements to an output memory associated with the given sensor.

[0028] In another embodiment, the device may further include an output memory configured to store the bit output transmitted by the sensor.

[0029] In an embodiment, the device may further include a register configured to store values ​​of bit outputs transmitted by the sensor at different instants of time.

[0030] In some embodiments, the sensing unit may include at least one pair of sensors, each pair of sensors including a reference sensor and a redundant sensor, the sensors of each pair are adjacent, the reference sensor and the redundant sensor are interleaved, the sensing unit is configured to transmit a first vector including bit outputs of the reference sensor and a second vector including bit outputs of the redundant sensor, and the analysis unit is configured to classify the detected perturbation attack based on a comparison between the first vector and the second vector.

[0031] The first output vector and the second output vector may have the same bit size, and the analyzing unit is configured to classify the detected perturbation attack as a local attack if it determines that the first vector and the second vector differ with respect to each other by a Hamming distance of values ​​strictly greater than one.

[0032] The analyzing unit may further be configured to classify the detected perturbation attack as a local attack if it determines that consecutive values ​​of the first vector and the second vector differ relative to each other by a Hamming distance of the values ​​being strictly greater than one.

[0033] The nominal value of the bit output may be set to zero, and the analysis unit may be configured to classify the detected perturbation attack as a localized attack by further determining whether the bit output is non-monotonic.

[0034] In an embodiment, the analyzing unit may include an aging function configured to estimate an aging level of the target circuit, and the sensing unit includes at least a SRAM PUF, each output of the SRAM PUF corresponding to a sensor output.

[0035] In some embodiments, the analysis unit may be configured to calculate an attack risk level based on the estimated aging level.

[0036] In some embodiments, the aging function may be configured to measure a value of each bit transmitted by the SRAM PUF and to calculate an average value taking into account the measured bit values, the average value representing an estimate of the reliability of the SRAM-PUF, the analysis unit being configured to determine the aging of the circuit based on the reliability.

[0037] In some embodiments, each digital sensor may provide a digitized bit output at each clock cycle of the system clock. The digitized bit provided at a given clock cycle may be monitored at each clock cycle or at each clock cycle of the system clock.

[0038] In some embodiments, the analysis unit may include a classifier configured to classify the alarm as a false positive or a true positive based on the digitized bit output provided by the set of digital sensors. The classifier may implement a machine learning algorithm selected from the group including support vector machines, random forests, Bayes, rotation forests, multiboost algorithms, and clustering algorithms.

[0039] In some embodiments, the classifier can be configured to build an attack classification model by performing a first learning phase including determining sensor output using one or more integrated circuits, determining sensor output under different operating conditions, and determining sensor output within a predefined learning time interval, and a second learning phase. The second learning phase can include performing one or more attacks on the integrated circuit.

[0040] In some embodiments, the sensing unit may include additional heterogeneous sensors configured to generate data by monitoring different physical parameters and / or different software activities performed by the integrated circuit, and the analysis unit is configured to aggregate the data generated by at least some of the additional heterogeneous sensors and is configured to select the sensor with the lowest variability.

[0041] In some embodiments, the additional sensors may be selected from the group consisting of: software sensors configured to monitor the activity of a processor of an integrated circuit or a given peripheral device; software sensors configured to monitor congestion on a system bus; software sensors configured to monitor hardware performance counters; software sensors configured to monitor a software stack; and physical sensors configured to measure temperature or pressure or voltage or frequency or light or current in a substrate or in motion.

[0042] In some embodiments, one or more of the digital sensors may be configured to upload the digitized bit output to a remote uplink server, which is configured to update the classification model based on the digitized bits.

[0043] A method for protecting an integrated circuit from a perturbation attack is also provided, wherein the method comprises the step of detecting a perturbation attack using a set of digital sensors comprising at least two sensors, the sensors being arranged in parallel, each digital sensor providing a digitized bit output having a binary value in response to input data, the step of detecting a perturbation attack comprising determining at least one binary vector comprising a multi-bit value, the multi-bit value comprising at least two bit outputs provided by the set of digital sensors, the method comprising detecting a perturbation attack based on the at least one binary vector.

[0044] A computer program comprising instructions for performing the steps of the method is also provided.

[0045] The above summary provides a simplified summary in order to provide a basic understanding of some aspects of the systems and / or methods discussed herein. This summary is not intended to provide an extensive overview of the systems and / or methods discussed herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings, which are incorporated in and constitute a part of this specification, and together with the general description of the invention given above and the detailed description of the embodiments given below, show various embodiments of the present invention and are for illustrative purposes only and are used to explain embodiments of the present invention.

[0047] Figure 1 is a schematic diagram of a protection system including a digital circuit according to some embodiments.

[0048] Figure 2 is a schematic diagram of a detection device according to some embodiments.

[0049] Figure 3 is a schematic diagram of a detection device according to an embodiment.

[0050] Figure 4 is a schematic diagram of a sensing unit with a ladder structure according to an embodiment.

[0051] Figure 5 A dual multi-bit sense cell configured to deliver a set of sense outputs according to another embodiment is depicted.

[0052] Figure 6 A dual multi-bit sense cell including a register data structure according to one embodiment is depicted.

[0053] Figure 7is a diagram showing an exemplary change in status output bits over time according to one embodiment.

[0054] Figure 8 A dual multi-bit sense cell configured to detect locally occurring signal faults is depicted according to one embodiment.

[0055] Fig. 9 A dual multi-bit sense unit configured to detect locally occurring signal failures with high priority according to another embodiment is depicted.

[0056] Fig.10 A dual multi-bit sense cell configured to detect an attack that suddenly changes the state of a bit is depicted according to yet another embodiment.

[0057] Fig.11 A sensing device configured to determine aging of a circuit is depicted according to an embodiment.

[0058] Fig.12 is a flow chart depicting a process for aging a target circuit using the output of a SRAM-PUF sensor, according to an embodiment.

[0059] Fig.13 is a flow chart depicting a learning phase of a classification method according to an embodiment.

[0060] Fig.14 is a flow chart depicting a method of classifying attacks according to an embodiment.

[0061] Fig.15 Depicted is a FSM for implementing false alarms according to an embodiment.

[0062] Fig.16 , Fig.17 and Fig.18 Examples of zero, one, and two prunings are depicted, respectively.

[0063] Fig.19 is a schematic diagram of a digital sensor according to an embodiment.

[0064] Fig. 20 is a flow chart depicting a method for deriving a classification model using machine learning techniques according to some embodiments.

[0065] Fig.21 is a flow chart depicting a method for building an attack-only model according to some embodiments.

[0066] Fig. 22 is a schematic diagram of a system in which machine learning methods are used to improve attack models learned in the field, according to some embodiments.

[0067] Fig.23is a schematic diagram of an exemplary computing system for implementing a digital sensor. DETAILED DESCRIPTION

[0068] refer to Figure 1 , a system 100 including a digital circuit or subcircuit 1 (also referred to as a "target circuit" or "protected target") is shown. The target circuit 1 is fed by a clock signal having a clock period. The system 100 also includes a detection device 3, which is hereinafter also referred to as a "quantitative digital sensor" or simply a "digital sensor" or a "sensing device". The digital sensor 3 can be configured to detect a disturbance attack performed on the digital circuit 1. The digital sensor 3 can also be configured to perform real-time diagnosis on the detected disturbance attack.

[0069] The target circuit 1 can be part of an integrated circuit device (IC device), which can be any embedded device or system that manipulates and / or incorporates confidential data and / or requires a level of integrity, such as a smart card, a security device, a multimedia player, a recorder, or a mobile storage device (such as a memory card and a hard disk). Such an IC device can be used for a wide range of communication and data processing applications, such as in the automotive industry, in secure access solutions, in mobile phone devices, in payment fields such as the banking industry, etc. An operating environment 10 according to an embodiment of the present invention is shown. The IC device can implement one or more cryptographic mechanisms to ensure the security, authentication, protection and / or privacy of data during data storage and / or data transmission within the IC device. The cryptographic mechanism can use a cryptographic key to generate cipher data (also referred to as "ciphertext") from the original data (also referred to as "plaintext"), and access to the data requires the application of a decryption mechanism and the knowledge of the cryptographic key used to encrypt the original data.

[0070] It should be noted that although the digital sensor 3 and the target digital circuit 1 are Figure 3 1 and 2 are represented as separate functional blocks, but in some embodiments they may alternatively be implemented on the same circuit or in a SOC (system on a chip).

[0071] Figure 2 A schematic diagram of a detection device 3 according to some embodiments is shown. The detection device 3 may include:

[0072] - a sensing unit 30, which is configured to transmit a plurality of bits O 1 ,…O i ,…,O n The flow, and

[0073] An analysis unit 31 configured to detect, in real time, a perturbation attack on the target circuit 1 from the stream of bits received from the sensing unit 30 .

[0074] The sensing unit 30 may use hardware to transmit a stream of multiple bits. The sensing unit 30 may thus measure the state in real time.

[0075] According to an embodiment of the present invention, the detection against fault injection attacks benefits from real-time measurement and analysis, thereby leaving no blind spots in time. Advantageously, the detection device 3 does not leave any weak time when the injection is more favorable to the attacker. Due to the hardware implementation, both the detection and analysis methods according to various embodiments of the present invention can perform real-time detection.

[0076] In one embodiment, the sensing unit 30 may include a set of n binary digital sensors 300-1, ..., 300-i, ..., 300-n (where n≥1), the sensing unit 30 includes at least two sensors, and the digital sensors are arranged in parallel. In the following, the reference numeral "300" will generally be used to refer to the sensor.

[0077] The plurality of bits O transmitted by the sensing unit 30 1 ,…O i ,…,O n The stream may include a set of digitized sensor outputs, each sensor output O i is derived from the output of each sensor 300-i. Each output O i Is a binary value (bit value) having a value equal to "0" (zero) or "1" (one). To detect disturbances, the digitized output bit provided at a given clock cycle of the system clock can be monitored in the following i value:

[0078] Every other clock cycle: In this case, all events correspond to the same edge polarity propagation;

[0079] At each clock cycle: in this case, two delays corresponding to 0 and 1 can be measured, each possibility having a different duration; since the rising and falling edge propagation mobilize different (effectively "complementary") transistors in the CMOS gate, this advantageously provides a dual environment measurement.

[0080] The number of sensing signals transmitted by the sensing unit 30 is denoted n, i being between 1 and n. The digital sensor 3 is digital. Therefore, the digital sensor 3 provides a digital signal including a set of bits. i Multiple outputs (multiple outputs).

[0081] The sensors 300 may be of different types or of the same type. In embodiments where the sensors 300 include at least two sensors of the same type, these sensors of the same type may have different or the same sensitivity. The sensors may operate in an independent mode or be linked together to provide consistent sensing information.

[0082] In one embodiment, the sensing unit 30 may further include an output memory 4 to store bit outputs transmitted by one or more sensors. i In one embodiment, the output memory 4 may include a plurality of output memory elements 36 .

[0083] In some embodiments, the output memory element 36 may be associated with each sensor 300. Alternatively, the output memory element 36 may be associated with a group of at least two sensors 300 and may be configured to store the bit outputs of the sensors included in such a group of sensors. i Each output memory element 36 is therefore connected to at least one output of the sensor 300 .

[0084] Each output memory element 36 may be configured to trigger reading of the associated sensor output, for example periodically or upon the occurrence of dedicated event(s), such as detection of movement, crossing of a threshold (of temperature, humidity, etc.).

[0085] For purposes of illustration only, some embodiments of the present invention will be described below with reference to an output memory element 36 associated with each sensor 300 (whereby each output memory element 36 is connected to the output of one of the sensors 300).

[0086] The sensing unit 30 thus provides n>1 binary sensing outputs O 1 ,…O i ,…,O n In one embodiment, the sensing unit may transmit the set of binary sensing outputs directly to the analysis unit 31. Alternatively, the sensing unit 300 may include a post-processing block 304 to determine an output vector V (hereinafter also referred to as a "sensing vector") based on the set of binary sensing outputs, which is transmitted to the analysis unit 31. In one embodiment, the i-th component of the sensing vector V may be the bit output V transmitted by the i-th sensor 300-i. i Alternatively, the i-th component of the sensing vector V may be an output bit derived from one or more output bits transmitted by the sensor 300. To aid understanding of the present invention and for simplicity and illustration purposes only, some embodiments of the present invention will be described below with reference to a sensing vector V comprising n components, the i-th component being the output bit transmitted by the i-th sensor 300-i:

[0087] V=[O 1 , ..., O i , ..., O n ](1)

[0088] refer to Figure 3, each sensing output O i It may be stored in the memory 36 (eg, a data flip-flop (DFF)).

[0089] In some embodiments, the analysis unit 31 may be configured to detect a fault or aging based on the output of the sensing unit 30 and in particular based on the sensing vector V.

[0090] In some embodiments, the analysis unit 31 may determine, in response to the detection of a perturbation attack, a quantity Q representing a quantitative estimate of the detected perturbation attack and / or a classification of the detected perturbation attack.

[0091] The quantitative digital sensing device 3 according to the present invention can be configured to ensure that no false alarms (also called "false positives") are issued unless the target circuit 1 is in an out-of-spec operating condition to avoid erasing all valuable data in the target circuit (security condition). In addition, the quantitative digital sensing device 3 can be configured to ensure that no false negatives are generated. In other words, in response to an attacker successfully creating an erroneous calculation into the target digital circuit 1, the quantitative digital sensing device 3 can ensure that an alarm is actually issued to prevent missing certain security events (security conditions).

[0092] As used herein, a "false positive error" or simply "false positive", also known as a "false alarm", refers to a test (which can have a "true" or "false" result value) that falsely indicates that an alarm condition has been met when in fact the alarm condition has not been met.

[0093] Furthermore, as used herein, a "false negative" error, also referred to as a "false negative," refers to a test of an alarm condition that indicates the alarm condition failed when in fact the alarm condition succeeded.

[0094] According to some embodiments, the digital sensing device 3 may be configured to determine whether an alarm is a false positive or a false negative while providing an explanation of the detected perturbation attack (classification of the perturbation) to upper layers of an integrated circuit device incorporating the protected circuit.

[0095] The diversity of sensors, coupled with the properties of some sensors, such as sensitivity and persistence, allows to feed rich information to the analysis unit 31 of the digital sensing device 3. This information allows to improve the confidence in the distinction of false positives from false negatives and the characterization of the injection.

[0096] In some embodiments, the digital sensing device 3 can be used to determine whether an alarm is a false positive or a true positive. In some embodiments, the digital sensing device 3 can be configured to distinguish true alarms from false alarms based on predefined thresholds. For example, considering the threshold i th (1≤i th ≤n), if the bit output is 0 in the normal state 1 =O2 =…=O i , which is O i+1 =…=O n The complementary value of , then:

[0097] If i≤i th , a true positive is detected,

[0098] Otherwise, a false positive is detected.

[0099] The threshold i can be selected or predefined according to various criteria th . Alternatively, the digital sensing device 3 (more specifically, the analysis unit 31) may include a classifier based on machine learning (ML) to determine whether the alarm is a false positive or a true positive. In such an ML-based classification method, the classifier (also referred to as a "classification unit") may include a training engine configured to build a model during a training cycle (including a registration phase for determining laws, and / or models, and / or thresholds as an example). The classification unit may also include a test block configured to test the model against real data. The classification unit may implement different types of machine learning (ML) algorithms, such as SVM (Support Vector Machine), RF (Random Forest), Bayesian, Rotation Forest (RTF), Multiboost algorithm, or clustering algorithm. In particular, the SVM algorithm is binary in its mode of operation, but can be extended to more than two categories.

[0100] The classification performed by the classifier of the analysis unit 31 may be "binary" in that it is able to distinguish between two situations, namely a "benign" situation (where no attack is being performed) and an "abnormal" situation (where an attack is being performed).

[0101] Machine learning advantageously allows for improved learning methods that greatly improve attack detection rates while not compromising false positive detection rates. In the case of perturbation attacks detected in the context of embedded devices, specific learning methods can be customized.

[0102] The learning method may include two learning phases: a first learning phase performed offline and a second learning phase performed online when the target circuit 1 is subjected to one or more attacks.

[0103] The first learning phase enables the construction of an attack classification model (also referred to as an "attack model" or "classification model") that takes into account both benign and malicious environmental conditions. This first phase may include three steps. The first step is implemented to learn benign diffusion behavior across several chips without user interference. Thus, technical diffusion is learned to determine how sensor results / outputs vary from chip to chip.

[0104] In a second step, the response of the digital sensor 300 under different selected operating conditions (e.g., when quiescent, when performing sensitive operations, when restarting, when entering sleep mode, or when performing performance adjustment(s) using dynamic voltage and frequency scaling (DVFS), etc.) is learned.

[0105] A third step is then implemented to learn on a single chip over time (e.g., over a predefined learning interval). In one embodiment, during the third step, for a given chip, irreversible and passive diffusion can be learned over time to determine how the sensor's results change during the "lifetime" of the chip (including variability in the software executed, changes in user data, and wear and tear of physical properties at the hardware level (also known as "aging"), including defects and / or damage to the sensor).

[0106] Based on the three learning steps of the first phase, the natural variability of the digital sensor 300 can be learned. This variability can be "benign", which means that the variability should not be interpreted as an attack. Otherwise, the variability will constitute a false positive.

[0107] The second learning phase can be performed under attack. This allows the detection of anomalous behavior (interpreted as an attack). By performing two phases of the learning method, false positive variations due to chip-to-chip variability or due to operating conditions depending on the application context and aging can be decorrelated with undesired variability due to perturbation attacks.

[0108] The second learning phase can be completed under different attack conditions. In order to cover the uncountable set of attack parameters as widely as possible, a core set of environmental perturbations can be preferably selected. For example, among all the parameters that the attacker can adjust, pressure can be selected to explore the largest possible range (minimum to maximum).

[0109] Core group learning is mainly about selecting a set of points so that the model learned on the selected subgroup is competitive with the rest of the data points of the model. This allows both detection of attacks and identification of attacks in different attack categories during the classification step. This identification is very important because it allows manufacturers to verify the power of potential attackers. For example, a global attack is less likely to succeed than a centralized (or local) attack because only one sensor can detect a global attack, while a local attack can impact between sensors. Moreover, the information collected about the attack category makes it possible to characterize and better understand the attacker and his methods, which gives the opportunity to adapt the defense strategy to the observed attack pattern and the associated attack environment. For example, the response can be selected as: defensive, deceptive, adaptive, or offensive. This can be achieved with multi-class classification.

[0110] The models learned from the data collected in the first learning phase and the second learning phase are advantageously independent. Therefore, the models learned during these two phases can be combined into one model in order to construct a specific learning method, such as a class classification.

[0111] "One-class ML classification" refers to an algorithm that learns a decision function for novelty detection, which is used to classify new data as similar or different from the training data / sequences.

[0112] Advantageously, the first and second phases of learning can be used during the classification step to subtract the commonality due to the natural non-malicious / benign diffusion model learned according to the three steps of the first phase and the diffusion caused by different types of attacks taken into account during the second learning phase.

[0113] Furthermore, the use of ML allows exploiting other digital information sources. The sensing unit 30 may therefore include additional heterogeneous sensors configured to generate data by monitoring different physical parameters and / or software activities, such as:

[0114] - software sensors configured to monitor the activity of the system processor (CPU) of the integrated circuit 1 or of certain given peripheral devices,

[0115] - a sensor configured to monitor congestion on the system bus,

[0116] -Sensors configured to monitor hardware performance counters, watchdogs, and timers, and

[0117] -Sensors configured to monitor the software stack in order to detect buffer overflow attacks.

[0118] In addition to the digital sensor 300, additional sensors that may be used include any sensor configured to measure environmental physical parameters such as temperature and pressure. The additional sensors may be digital sensors configured to monitor and digitally measure health tests performed by a true random number generator (TRNG) or monitor reliability estimation hardware / software performed by a physically unclonable function (PUF). Advantageously, these heterogeneous actuators / sensors may be aggregated such that their joint measurements provide multimodal measurements.

[0119] The use of multiple homogeneous or heterogeneous sensors allows to improve learning and classification methods by implementing detection within one device and selecting sensors with the lowest variability, which can enhance attack detection.An advantage of the present invention is to perform dimensionality reduction measures guided by ML.

[0120] The ML approach allows to remotely monitor the behavior of the target circuit 1 and obtain relevant information during its life cycle. For example, in addition to allowing the environment to be classified as benign or malicious, the sensor can also upload its measurements to a remote uplink server that can improve the model. For example, if an attack was carried out without being noticed, the remote uplink server can adjust the decision model in order to catch such an attack in subsequent similar attacks.

[0121] Figure 4 Schematic diagram showing a sensing unit 30 having a ladder structure according to one embodiment.

[0122] In such an embodiment, the sensing unit 30 includes a set of binary digital sensors 300. Figure 4 In the embodiment of the present invention, the sensing unit 30 is configured to transmit a set of digital sensing outputs having binary values. i , the i-th sensing output O i is derived from the output of the i-th sensor 300-i. Each sensing output O transmitted by the sensing unit 30 i It may be temporarily stored in an output memory element 36 such as a register. Figure 4 In the example shown in FIG. 3 , register 36 is a data flip-flop (DFF).

[0123] The output of the sensing unit 30 may include at least one multi-bit output having an in-bit output O i A set of bit components selected in .

[0124] Figure 3 Each sensor 300 of the sensing unit 30 may be implemented in the form of a digital circuit, the digital circuit comprising:

[0125] - an input memory block 301 for storing input data;

[0126] - a first data path 302 for propagating input data and forming a first delay chain;

[0127] - A second data path 303 for propagating input data and forming a second delay chain.

[0128] The input memory block 301 may include an input memory element 311 for storing input data generated using a stimulus generator (eg, a data flip-flop (DFF)).

[0129] The initial delay chain 302 may be configured to propagate data from the input memory element 311 to the buffer element 35 , which buffers the data propagating through the initial delay chain 302 .

[0130] The data path 303 (formed in a laddered delay chain) can propagate the value bit from the element 35 to the corresponding sensor output memory element 36 .

[0131] The input memory block 301 and the second path 302 may also include combined standard cells 370, 371. The combined standard cells 370, 371 may be configured to use the signal stored in the input memory element 311 as an input value to determine the value to be stored in the output memory element 36. The combined standard cells may include memoryless logic gates (e.g., inverter gates 371) that may implement Boolean functions, buffers (e.g., gates 371) whose function is to amplify and / or delay the data path, and / or buffers (e.g., gates 372). Figure 4 Other combination standard cells of buffer 370 used in the example shown in FIG.

[0132] The input memory block may be configured to generate stimulus.The memory element 311 of the input memory block 301 may be any element configured to change the sensor state at each clock cycle using the sampling of the inverted value provided by the inverter gate 371, such as an input DFF.

[0133] This has the effect of generating a string of 010101... which constantly excites the sensor at every clock cycle. As a result, a new, fresh measurement can be made at every clock cycle. This causes the sensor to sense continuously.

[0134] In the following description of some embodiments, for illustration purposes, an input memory block 301 of a DFF type storing a value of I will be considered.

[0135] If the data correctly arrives from the input memory element 311 to the output memory element 36 in the time for sampling (ie, in less than a clock cycle), the computation is considered successful.

[0136] The quantitative digital sensing device 3 can be used to detect abnormal operating conditions of the target circuit.

[0137] The quantitative digital sensing device 3 can be advantageously constructed with the same logic elements as other digital circuits, so that it is sensitive to out-of-specification operating conditions (e.g., temperature, voltage, clock frequency, etc.). For example, if the temperature increases beyond a given threshold, the propagation delay of the combinational gates of the quantitative digital sensor data path 302 will increase to the point where the data arrives at the output memory element 36 after the rising edge of the clock, thereby causing a set violation fault. This late arrival can induce a fault condition in the output memory element 36 relative to a reference signal. This can be detected by comparing a set of values ​​0 in the output memory element 36. i The fault condition is detected and can be used by the analysis unit 31 to generate an alarm.

[0138] exist Figure 4 In the embodiment of the present invention, each i-th sensor 300-i includes an input element 301, an initial delay chain 302, a ladder-like delay chain 303 and a storage element 304. i The sensor output memory element 36. With such a ladder structure, a disturbance will create a strong change in the critical path 303, involving a significant change in the state bit relative to the nominal and non-disturbance operation. Therefore, a false positive may only cause a few paths to fail, while a true positive may cause more paths to fail.

[0139] In the prior art, in order to protect the target digital circuit 1 from attack, the digital sensor triggers the alarm based on an alarm threshold arbitrarily selected in a wide interval and without studying the time variation of the measurement. Therefore, the target digital circuit 1 operates at a clock frequency much lower than the clock frequency it can actually handle, which leads to low circuit performance. This makes it possible to minimize the occurrence of false positives at the cost of performance. False positives lie in the detection of alarms, although there is no risk to the circuit. Such events may cause countermeasures to be activated (e.g., restart of the circuit), which reduces the user experience.

[0140] By using the output value O transmitted by the sensor 300 i to detect abnormal operating conditions of the target circuit, the quantitative digital sensing device 3 is able to operate at a higher clock frequency, thereby improving circuit performance. In addition, the quantitative digital circuit is able to detect attacks even before the stress has actually caused a malfunction. In fact, due to the calibration of the attack test tool and the methodical chip scanning, the physical characteristics of the output memory element 36 (or more generally the output memory 4) used to store the output vector V will fluctuate during the evaluation period corresponding to the identification phase. Therefore, according to an embodiment of the present invention, the attack preparation phase can already be detected.

[0141] To detect abnormal operating conditions, the Figure 3 and Figure 4 The digital sensing device 3 of the embodiment is designed so that there is a period from the input DFFI (respectively I′) of the sensor 300 to DFFO i (respectively O′ i ), and:

[0142] (1) All paths in the digital sensor 3 are shorter in time than the critical path;

[0143] (2) The critical path is compatible with the nominal environment (clock cycle, power supply, etc.).

[0144] Figure 5 Depicted is a circuit configured to transmit a set of n sensing outputs {O1 , ..., O i , ..., O n In such an embodiment, the analysis unit 31 may include a classifier 310 ( Figure 2 ), the classifier 310 is configured to classify the detected disturbance attack that induced the fault. For example, in one embodiment, the classifier can be configured to determine whether the detected fault is:

[0145] - local (i.e., associated with a dedicated portion of the chip), such as focused laser fault injection, or

[0146] - Global (i.e., involving the chip as a whole), such as power / clock failures or EM pulse attacks.

[0147] A laser attack may, for example, target a few transistors and is therefore selective. In particular, it may hit logic far from the sensor 300. As a result, even though the indirect effects of a local laser emission may propagate far within the chip, it may bypass the sensor 300. Therefore, when a local laser perturbation attack is detected, such an attack and a fast reaction may be required to prevent a serious threat to the security of the chip. In contrast, some types of attacks are more general. Those more general types of attacks may be captured by at least one sensor. Therefore, those attacks do not require a fast reaction to trigger appropriate actions.

[0148] In such an embodiment, the sensing unit 30 may include at least one quantitative sensor tuple. Each sensor tuple may include a reference sensor 300 and one or more redundant sensors.

[0149] In certain embodiments, the sensing unit 30 may include at least one pair of quantitative sensors 300-i and 300-i' (a pair of sensors is generally referred to as {300, 300'} hereinafter). The reference sensor and the redundant sensor may be the same or similar. Some embodiments will be described below with reference to a sensing unit including at least one pair of reference sensors.

[0150] exist Figure 5 In the exemplary embodiment of the present invention, a pair of two sensors 300 and 300' is used. Each pair of sensors {300, 300'} includes a reference sensor 300 and a redundant sensor 300' (the reference numerals with a prime are related to the redundant sensors of a pair of sensors). In the sensing unit 30, the reference sensors 300 (corresponding to each reference sensor of the "reference" ladder structure) and the redundant sensors 300' (corresponding to each redundant sensor of the "redundant" ladder structure) are further interleaved (in other words, in the sensing unit 30, the redundant sensor 300' is physically arranged between the two reference sensors).

[0151] The analysis unit 31 may be configured to convert the first output vector V of each pair of reference sensors 300 into 1 ... i ... n ] (also called a “reference vector”) and the second output vector V′=[O′ 1 ...O′ i …O′ n ] (also referred to as a "redundant vector") for comparison. Classifier 310 can then classify the disturbance based on the results of the statistical test (e.g., based on the results of the comparison between the two vectors). Such a classifier can advantageously implement a machine learning algorithm that is configured to be trained and perform classification.

[0152] The sensing unit 30 may also transmit a first vector V including bit outputs of the reference sensor 300 and a second vector V′ including bit outputs of the redundant sensor 300 ′, and the analysis unit 31 is configured to classify the detected disturbance attack based on a comparison between the first vector V and the second vector V′.

[0153] In one embodiment, the analyzing unit 31 may be configured to: if for a predefined number of sensor pairs {300, 300′} of a set of sensors, the output vector of the reference sensor 300 in each pair of sensors and the output vector of the redundant sensor 300′ in the same pair have different state bits. i and O′ i (Such conditions on the output vectors of the reference sensor and the redundant sensor are also referred to as "state bit conditions" hereinafter), it is determined that a disturbance has occurred and that the disturbance is local. In particular, the analysis unit 31 can be configured to: if the state bit conditions are satisfied for all sensor pairs {300, 300'} of a set of sensors, it is determined that a disturbance has occurred and that the disturbance is local. If the attack is determined to be local, the attack may change one ladder structure more than another attack (for example, a redundant ladder structure may be subject to more changes than a reference ladder structure, or vice versa). Otherwise, if the sensor evolves over time but tracks (that is, if the sensor changes at each instantaneous time, for all i between 1 and n, the equality condition O is satisfied). i =O′ i ), the analysis unit 31 can detect that an attack with global impact is being made. It should be noted that the analysis unit 31 can also be adapted to determine whether the disturbance is both global and local (the two diagnoses can be complementary). Attacks both global and local reach a significant number of sensors (this number may be at least equal to three) with unevenly distributed pressure.

[0154] In another embodiment, the analysis unit 31 can not only compare the reference vector V with the redundant vector V′, but also check the status bit O i Changes over time to determine if the attack is localized.

[0155] A local attack can be detected when two state words V and V' suddenly and strongly differ. As used herein, two state words V and V' are considered to differ "suddenly" if their successive values ​​in time differ relative to each other and the Hamming distance of the values ​​is strictly greater than 1, i.e., if the two successive values ​​have at least two different bits (such a condition is hereinafter referred to as the "Hamming distance condition").

[0156] The analysis unit 31 may include a comparator configured to compare the status words and / or status bits. In order to be able to compare, the analysis unit 31 may be configured to use, for example, a comparator configured to store each output bit resulting from the sampling. i / O′ i The output memory 4 of the continuous value in time, for the state words V and V' (vector V = (O 1 , ..., O n ) and V = (O' 1 , ..., O′ n The sensor output bits of the sensor are sampled multiple times. The data structure can be, for example, a shift register, a FIFO (first in first out), or a LIFO (last in first out).

[0157] Figure 6 A partial view of a qualitative digital sensing device 3 (comparators not shown) is shown comprising a FIFO of depth d for storing each output bit O i / O′ i d consecutive values ​​of in time (for each output bit O i The comparator may use the successive values ​​of each status word over time to detect and / or classify an attack.

[0158] Figure 7 Each output bit O in response to an input I applied to the sensor 300 changing from 0 to 1 is shown in waveform form. i / O′ i Changes in time. Figure 7 Thus an example of the history of a quantitative digital sensing device 3 over time is shown. The portion of the comparator 42 configured to check the Hamming distance condition (difference strictly greater than one (1)) may advantageously be implemented in hardware for faster response. Figure 7As shown in FIG. 1 , the dividing line between the value at “0…0” and the value at “1 1…1” fluctuates in time, that is, the boundary between a series of zeros and a series of ones is not always at the output bit 0. i at the same index j (1≤j≤n) of .

[0159] Figure 8 A quantitative digital sensor 3 is shown including a comparator 42. The comparator 42 may be implemented using a set of elementary comparators 420. Each elementary comparator 420 may be configured to compare each i-th output bit O of the reference sensor 300 at a given instant in time. i The value of the redundant sensor 300' is equal to the i-th output bit O' i In one embodiment, the comparator 42 may include as many basic comparators as the number n of output bits transmitted by each sensor 300 or 300'. In one embodiment, each basic comparator 420 may be implemented as an exclusive OR (XOR), and the i-th basic comparator 420 is implemented to receive each i-th output bit O of the reference sensor 300. i The value of the i-th output bit O′ i As the input value of XOR, so if the output bit of the reference sensor 300 is O i Equal to the i-th output bit O′ i If the output of the reference sensor 300 is 0, the output of the basic comparator is equal to 0. i Different from the i-th output bit O′ i The output of the basic comparator 420 is equal to 1 (as defined by the truth table of XOR). The output of the set of basic comparators 420 can then be input to a logical OR 450 provided in the analysis unit 31, and the output of the OR 450 is equal to 1 if at least one output of the set of basic comparators 420 is equal to 1; that is, if for at least index i (i=1 to n), the output bit O of the reference sensor 300 i Different from the i-th output bit O′ i In this case, a local attack may be detected. The analysis unit 31 may be configured to trigger an alarm if such a local attack is detected (the output of the OR operator 450 is equal to 1).

[0160] Fig. 9A quantitative digital sensing device 3 comprising a comparator 42 according to another embodiment is shown. In such an embodiment, the comparator 42 of the analysis unit 41 can detect that two state words V and V' are considered to be "strongly" different if there is a Hamming weight between V and V', while the Hamming weight is strictly greater than one (">1"). The Hamming distance between two words V and V' can be seen as the Hamming weight of V-V'. Since V and V' are binary strings, the Hamming distance is equal to the number of ones ("1") in V XOR V'.

[0161] exist Fig. 9 In the embodiment of the present invention, the comparator 42 is also implemented using a set of basic comparators 420 each implemented as XOR, such as in combination with Figure 8 The output of the set of elementary comparators 420 may then be provided as input to a summation operator 46 (denoted as "∑"), which is configured to determine the Hamming weight between V and V'. The Hamming distance between V and V' is also denoted as d h (V, V′), and equal to w h (V XOR V,), where:

[0162]

[0163] The output of block 46 is then provided as input to a weight comparator 47, which is configured to determine whether the received input (i.e., the Hamming distance) is strictly greater than one (">1") (i.e., greater than or equal to 2 ("≥2")). If so, the status words V and V' are "strongly" different, and if such a local attack is detected (the output of comparator 47 is greater than or equal to 2), the analysis unit 31 can trigger an alarm.

[0164] Fig.10 An exemplary quantitative sensing device 3 according to an embodiment is depicted, which is configured to implement a Hamming distance condition, ie to detect whether two state words V or V' are "suddenly" different. Fig.10 and Fig. 9 The difference is that the comparator 42 includes two XORs 421 and 421' configured to compare two different states of each binary vector V or V' in time. More specifically, in Fig.10 In the embodiment, the comparator 42 includes a first XOR 421 and a second XOR 421 ′, and the first XOR is configured to perform the following XOR:

[0165] First input V prev , which corresponds to the first binary vector V=(O 1 , ..., O n )(reference vector) at time t0 the previous state of

[0166] The second input V corresponds to the second binary vector V=(O 1 , ..., O n )(reference vector) at time t 1 <t 0 The subsequent state.

[0167] Block 46 may be provided to receive the output of the first XOR 421 to determine a Hamming weight, the Hamming weight thus determined being input to a weight comparator 47 to determine whether the Hamming weight is strictly greater than one (">1") (i.e., greater than or equal to 2 ("≥2"). If so, then at time t 0 and t 1 The two states of the state word V at are considered to differ “suddenly” and the analysis unit 31 can trigger an alarm if such a sudden difference is detected.

[0168] Similarly, the comparator 42 may include a second XOR 421' configured to perform the following XOR:

[0169] The first input V' prev , which corresponds to the second binary vector V′=(O 1 , ..., O n )(redundant vector) at time t 0 the previous state of

[0170] The second input V′ corresponds to the second binary vector V′=(O′ 1 , ..., O′ n ) at time t 1 >t 0 The subsequent state.

[0171] The analysis unit may include a block 46' configured to receive the output of the second XOR 421' to determine a Hamming weight, the Hamming weight thus determined being input to a weight comparator 47' to check whether the Hamming weight is strictly greater than one (">1") (i.e., greater than or equal to 2 ("≥2")). If so, then at time t 0 and t 1 The two states of the second binary vector V are considered to be “suddenly” different, and the analysis unit 31 may trigger an alarm if such a sudden difference is detected.

[0172] In another embodiment, the analysis unit 31 may be configured to iMore specifically, the analysis unit 31 may be configured to detect a local attack by using a bit pattern. More specifically, when the nominal value of the state bit (the nominal value of the state bit is the value of the state bit when there is no attack) is:

[0173] O 1 =O 2 …=O th =I and O th+1 =O th+2 …=O n = not(I),

[0174] Control status bit O i Is it monotonic, in other words, for an input I varying from 0 to 1, is it:

[0175] 0≤O 1 ≤O 2 …≤O n-1 ≤O n Or 1 ≥O 2 …≥O n-1 ≥O n .

[0176] If the evaluation unit 31 detects the status bit 0 i is non-monotonic, the analysis unit determines that the probability of performing an attack on the circuit is high. In practice, the attacker is likely to flip one or several state flip-flops 36 as a side effect of his attack using a precise injection tool (e.g., a laser). In addition, the analysis unit 31 can be configured to compare the state words V and V′ of the two interleaved sensors 300 and 300′.

[0177] In another embodiment, the analysis unit 31 may be configured to enable status bits from multiple sensors to be i The circuit 1 may be associated with a device, such as to measure the aging level of the circuit 1, and / or use this information for calculating a threat level (e.g., low, medium, high). It should be noted that the longer the age of the circuit 1, the more likely it is that an attacker will develop specialized techniques, so the threat level should be increased to take into account the increased attack based on the knowledge of the target.

[0178] In a particular embodiment, the analysis unit 31 may be configured to generate an output signal based on the output signal transmitted by the set of sensors 300. ito measure the aging of the protected circuit 1. The aging is related to the time when the circuit was first powered on and the duration and / or frequency of the usage phases. In such an embodiment, the analysis unit 31 may include a PUF (Physically Unclonable Function) structure, such as an SRAM-PUF (SRAM is an abbreviation for "Static Random Access Memory"), to measure the aging of the circuit 1, the aging of the circuit 1 being measured as a change in the reliability of certain PUF (Physically Unclonable Function) structures. The reliability of the PUF can therefore be used as a sensor for the aging of the circuit. Therefore, over the entire usage duration of the circuit 1, the reliability of the SRAM-PUF can be regarded as an unforgeable quantitative digital sensor 3, and a set of bit outputs Bc of the SRAM-PUF corresponds to the output O of the digital sensor. i .

[0179] In such an embodiment, the sensing unit 30 may include at least two sensors 300 implemented in the form of SRAM-PUF, the at least two sensors 300 transmitting SRAM bits in response to inputs, each of the SRAM bits outputted by the SRAM bits forming a bit output. i .

[0180] Fig.11 A detailed view of the SRAM-PUF is shown.

[0181] A static random access memory (SRAM) based PUF uses SRAM as a PUF source. It may also include a fuzzy (key) extractor (not shown) configured to derive a stable and unique key from the SRAM PUF.

[0182] SRAM-PUF is a memory-based intrinsic PUF (also called "memory PUF") based on the stable state of SRAM memory elements. SRAM-PUF is associated with a finite number of different challenges. In addition, a memory address can be used as a challenge. The response Bc of the SRAM-PUF depends on the input c. Many independent Bc values ​​can be obtained by scanning all values ​​of c.

[0183] Static random access memory (SRAM) retains its stored information as long as power is supplied. The term "random access" means that in an array of SRAM cells, each cell can be read or written in any order, regardless of which cell was accessed last.

[0184] An SRAM cell has a symmetrical structure and includes a set of transistors (e.g., MOSFETs). An example of an SRAM is a 6T-SRAM that uses six transistors per bit. Other types of SRAM chips may use 4, 8, 10 (4T, 8T, 10TSRAM) or more transistors per bit.

[0185] Each bit in the SRAM is stored on a subset of storage transistors forming two cross-coupled inverters. For example, in a 6T-SRAM, each bit in the SRAM is stored on four transistors (M1, M2, M3, M4) forming two cross-coupled inverters.

[0186] Each of these inverters is connected to the power supply line V ss and V DD Between the power lines V DD includes low positive DC voltage, and the power line V ss This includes a reference potential, such as ground.

[0187] Two additional access transistors may be used to control access to the storage transistor during read and write operations.

[0188] Some of the memory transistors (M1, M2, M3, M4) (e.g., M1 and M4) act as "pull-down" transistors, while other memory transistors (e.g., M2 and M3) act as "pull-up" transistors. The pull-up transistors may be equivalent P-channel devices, and the pull-down transistors may be equivalent N-channel devices. Figure 6 In FIG. 1 , only four transistors M1 , M2 , M3 and M4 are shown.

[0189] Access to the cell is achieved by controlling the word line WL to access transistors M5 and M6. The access transistors can control whether the cell should be connected to a memory cell including a bit line BL and an inverted bit line The two bit lines are used to transmit data for both read and write operations and are controlled by a bit line driver (not shown). During read access, the bit lines are actively driven high and low by the inverters in the SRAM cell.

[0190] The core of the SRAM cell is thus formed by two inverters, the output potential of each inverter being fed as input to the other.

[0191] In standby mode, the word line WL is low, thereby turning off the access transistor. In this state, the inverter is in a complementary state.

[0192] To write information, data is applied to the bit line BL and inverted data is applied to the inverted bit line On. By setting the word line WL high, the access transistor can be turned on. Since the driver of the bit line is stronger, the inverter transistor can be set. Once the information is stored in the inverter, the access transistor can be turned off and the information in the inverter is retained.

[0193] For reading, the word line WL is turned on to activate the access transistor while information is sensed at the bit line.

[0194] According to some embodiments of the present invention, the analysis unit 31 may implement an aging method comprising a step for determining the reliability of the SRAM-PUF and thus comparing the determined reliability with a reference value corresponding to a non-aged SRAM-PUF, which may be saved, for example, in a non-volatile memory (NVM). The greater the aging difference, the greater the reliability difference (reliability increases on average with increasing device lifetime).

[0195] In the above embodiments, the digital sensor 300 relies on similar kinds of measurements, typically converting some effect into a time delay (i.e., the propagation time along a delay chain). Advantageously, in some embodiments, the digital sensor 300 can be configured to convert to another physical quantity, such as a frequency, where the sensor is constructed as an oscillating structure, the frequency typically being obtained by looping the delay chain sensor over itself, counting a number of turns.

[0196] Fig.12 is a flow chart depicting a process of aging the target circuit 1 using the output of the SRAM-PUF sensor 300 .

[0197] In step 700 , the SRAM bit is received by the evaluation unit 31 .

[0198] The following steps are repeated for all SRAM bits (block 701).

[0199] More specifically, step 703 is repeated n times (for each iteration in block 701), where n represents the number of SRAM bits.

[0200] In step 703 , the current iteration consists in measuring the value of the current SRAM bit.

[0201] In step 704 , an average value is calculated taking into account the values ​​of the n SRAM bits measured in n iterations of step 703 .

[0202] The average value thus obtained represents an estimate of the SRAM-PUF reliability evolving over time.

[0203] In step 705, an estimation of aging may be performed based on the average value determined in step 704. This average value increases with aging. Thus, aging may be inferred by comparing the current reliability estimate with a reference value stored in a non-volatile memory. Such a reference value may be determined by a learning phase (also called a registration phase).

[0204] After some processing (e.g., "accumulation" step 704), the SRAM PUF output bits (thereby forming one or more vectors of bits for the memory output "word") sense the "aging" of the circuit. Thus, the values ​​read out of the PUF (in steps 701 and 703) represent the outputs of multiple sensors 300.

[0205] In some embodiments, analysis unit 31 may be configured to use the output of sensing unit 30 to compute real-time diagnostics regarding an attack.

[0206] The analysis unit 31 may be configured to transmit an output including an indication of the detected threat level (e.g., low, medium, high). The output of the analysis unit 31 may be in any form, such as a notification or a dashboard including the detected threat level. The output of the analysis unit 31 may be interpreted as an indication of whether the observed state change is due to an attack or due to other reasons unrelated to the attack, such as a drop in power supply voltage.

[0207] In some embodiments, the analysis unit 31 can be configured to additionally or alternatively trigger an alarm based on the detected attack level (e.g., if a high level is detected). Such an alarm can be used, for example, to trigger a chip reset signal, and / or trigger the freezing of the processor pipeline, and / or trigger a message to the operating system (to sandbox the current process, and / or log the event). Such an alarm can also be used as an input to a classification algorithm based on machine learning, or to trigger the automatic destruction of the chip.

[0208] It should be noted that in some embodiments, the classifier of the analysis unit 31 may perform a specific classification based on machine learning, for example using SVM (Support Vector Machine) or RRF (Rotated Random Forest).

[0209] The classification performed by the classifier may be "binary" in that it is able to distinguish between two situations, namely a "benign" situation (no attack is being performed) and an "abnormal" situation (an attack is being performed).

[0210] However, the classification can have a greater granularity, as it can distinguish between different attack scenarios, such as:

[0211] - "benign" situations (no attack is being performed),

[0212] - “Abnormal” situations (attacks being performed), which themselves can be broken down into several sub-categories: “clock failure”, “reset failure”, “power failure”, “electromagnetic fault injection”, “laser shot injection”, etc.

[0213] More generally, the classifier may be adapted to classify attack scenarios in P categories.

[0214] Fig.13 is a graph depicting the possible categories (C 1 , C 2 , …, C P ) is a flowchart of a method for classifying attacks (classification method). Fig.13 The learning phase is shown.

[0215] The method may include an initial learning phase that may be performed offline in a protected environment.

[0216] The learning phase may include a step 800 of initializing an empty data set of measurements V divided for each P category.

[0217] Then for each category C i The following steps are repeated (loop). More specifically, in step 804, for 1 , C 2 , …, C P Each category C in i (Block 802), under environmental conditions C i The V is measured.

[0218] In step 806, a classification model is learned using an appropriate classification technique (defined by the classification algorithm).

[0219] In step 808, the accuracy level (also referred to as an "accuracy index" or "accuracy metric") of the classification for the learned model may be calculated.

[0220] In step 810, conditions related to the accuracy level are checked. In one embodiment, Fig.13 As depicted in , step 810 may include determining whether the accuracy level determined in step 808 is greater than a predefined threshold (if the accuracy level is expressed as a percentage, the threshold may be, for example, 99%).

[0221] If the condition is met, the loop can be interrupted (that is, the method will not be executed for the next category C). i+1 To C P Further iterations are performed). Thus, in step 813, the learning phase may terminate and the method may return to the learned model.

[0222] Otherwise, if the condition related to the accuracy level is not met in step 810, then for category C i+1 To C P The next iteration is performed (block 812) until all categories have been processed (block 811) or until the loop is interrupted (blocks 811 and 812).

[0223] The learning phase thus results in a learned model.

[0224] After the learning phase, the classification method can perform the matching phase online.

[0225] Fig.14 is a diagram illustrating a method for selecting a possible class (C 1 , C 2 , …, C P Flowchart of the classification phase of a classification method for classifying attacks in ).

[0226] In step 820, a measurement of V may be performed.

[0227] In step 821, classification is applied to the learning model to determine the category of the attack. In step 822, the category C determined in step 821 is returned, where C belongs to the group of categories {C 1 , C 2 , …, C P}.

[0228] The various embodiments of the present invention accordingly improve the protection of an IC device 1 from perturbation attacks, where the IC device 1 is, for example, an embedded system (e.g., a smart card, a multimedia player, a recorder, a mobile storage device such as a memory card and a hard disk, etc.) or an IC device in an M2M platform or terminal implemented in an IoT architecture (IoT stands for "Internet of Things").

[0229] Advantageously, the latency in the analysis performed by the digital sensing device 3 may be as low as one clock cycle, e.g. Figure 6 , Figure 8 , Fig. 9 , Fig.10 and Fig.14 As shown in the embodiment of the present invention.

[0230] The protection methods and devices according to embodiments of the present invention can be used in a wide range of communication and data processing applications, such as in automotive industry applications to ensure anti-theft protection, in service provider systems to make access cards secure, in RFID tags and electronic keys, in mobile phone devices to verify control and access to batteries and accessories, in the manufacture of embedded devices and equipment to provide protection for hardware and software algorithms from cloning and reverse engineering, in the banking industry to make bank accounts and financial transactions secure, etc.

[0231] In one embodiment, the digital sensor 3 may be configured to detect electromagnetic fault injection (EMFI) attacks to reduce false positives.

[0232] EMFI (Electromagnetic Fault Injection) is almost uniquely characterized by the following properties:

[0233] -EMFI threats must be of considerable magnitude to be effective;

[0234] -EMFI threats have both positive and negative deviation values ​​due to resonance and subsequent damped vibrations;

[0235] - EMFI threats last for a long time (EMFI can be compared to earthquakes that propagate and have rebound effects);

[0236] -However, EMFI threats can slow down sensors and speed up cryptographic systems, causing undetected malfunctions.

[0237] In order to detect electromagnetic fault injection (EMFI) attacks to reduce false positives, the digital sensor 3 can perform a binary check during N cycles of M cycles, where 1≤N≤M. The binary check consists in checking whether the state value is above a predetermined maximum threshold or below a predetermined minimum threshold. In these latter two cases, the binary check can return "true" or "false". This makes it possible to verify a certain persistence of pressure. The digital sensor 3 can be further pruned by keeping the same pressure detection range while reducing the measurement accuracy (therefore saving area at the expense of digital resolution).

[0238] The false alarm (or "false positive") rate of N cycles to M cycles can be advantageously implemented in an area-first manner using a finite state machine (FSM).

[0239] Fig.15 Depicted is a FSM for implementing false alarms according to an embodiment.

[0240] Fig.15 The FSM 50 is configured to raise an alarm only when a threshold violation is detected during N=8 cycles outside the M=16 window.

[0241] like Fig.15As shown in , the decision to issue an alarm can be triggered in response to the detection of a violation. If the digital sensor state exceeds a given value and / or underflows a given value, a violation represented by the signal "viol" is detected. If a violation is detected, the timeout represented by the signal "tmt" is set to M, and the number of violations in this time window (timeout) of M clock cycles is counted by the signal "cnt" (representing a counter signal). The "tmt" signal decreases by one in each clock cycle. The values ​​of N and M can be stored in a programmable memory such as an OTP (one-time programmable) memory. Each time a violation is detected, the "cnt" signal is incremented. If "cnt" reaches the number N before the timeout reaches the value "0" (zero), the FSM enters an alarm state. Advantageously, FSM 50 is compact and can be implemented in hardware for real-time analysis. In addition, FSM 50 can implement the definition of some constants, such as the way to calculate the signal "viol" and the values ​​of N and M based on the signal "state". Therefore, calibration of the FSM can be done after production, which is of particular advantage in applications of the invention where the digital sensor 3 is produced using advanced CMOS technology processes with very large variability.

[0242] according to Fig.15 In an embodiment, a smaller maximum threshold and / or a higher minimum threshold (tighter bounds) may be used to calculate the violation signal "viol" than in the "determine at each clock" approach (M=N=1). The tighter the threshold, the more violations are reported over time. However, the finite state machine may issue an alarm only when M of the violations are reported in N clock cycles (as in the "determine at each clock" approach) in order to timely cross-check the possibility that the alarm is caused by an intentional (i.e., malicious) disturbance.

[0243] In some embodiments, several state bits (state gates) corresponding to the least significant bits (LSBs) of output vector 36 may be discarded to achieve area savings. Fig.16 , Fig.17 and Fig.18 Examples of zero, one, and two prunings are depicted, respectively.

[0244] exist Fig.16 In the example, no output bits Oi are discarded, but in Fig.17 (one bit of resolution is discarded: the output bit Oi of the exponent is reduced, for example O 1 , O 3 ..), and Fig.18 In this case, two bits of resolution are discarded (e.g., for each output bit O i , where i = 0 to n, retaining the output bit O i, and discard the output bits Oi+1, Oi+2, Oi+3). It should be noted that although Fig.17 and Fig.18 The discarded output bits are shown in light grey in , but they actually correspond to gates that were removed. Fig.17 , trims half of the status bits (upward logic), and Fig.18 In the case of i bits of resolution being discarded, the last two LSBs will be supported by logic pruning (discarding (2 i For example, for an output vector 36 comprising n=32 bits, discarding three times (since the number of state bits is divided by two each time a bit of resolution is dropped, only bits remain), the area is approximately halved.

[0245] Fig.19 The structure of the digital sensor according to the embodiment is shown, wherein the digital sensor 3 is configured to convert into frequency.

[0246] As used herein, the term “converted to frequency” means that after N system clock cycles, the frequency is measured by the digital sensor 3 as the number of turns d in a cycle of n elements.

[0247] Fig. 20 1 is a flow chart showing the steps implemented during the first and second phases of the model learning method to build a classification model taking into account both benign and malicious environmental conditions. Steps 161 to 163 correspond to the three steps of the first model learning phase, which are performed offline when the target circuit is not under attack. Step 164 corresponds to the second learning phase performed when the target circuit is under one or more attacks. The outputs of these steps are used as inputs to step 165 which is performed to enrich / improve the model.

[0248] Thus, at step 161 , model learning may be performed on several circuits / chips without user interference.

[0249] At step 162 , model learning may be performed considering different operating conditions.

[0250] At step 163 , model learning may be performed on a single chip within a predefined time learning interval.

[0251] At step 164 , model learning may be performed while the target circuit is subjected to one or more attacks taking into account different attack conditions and environmental perturbations.

[0252] Fig.21is a flowchart showing the steps of an ML-based learning and classification method based on merging the models learned during the first and second learning stages of ML-based classification. In fact, the models learned based on the data collected at steps 171 to 174 are independent. The method enables the use of such decorrelation to merge the models into one model, and to construct a specific learning method and attack only the model. Therefore, at step 171, model learning can be performed on several circuits / chips. At step 172, model learning can be performed considering different operating conditions. At step 173, model learning can be performed by applying one or more perturbation attacks to the target circuit 1. At step 175, the output learning data generated at each of steps 171, 172 and 173 can be merged to enrich / update the benign model that depends only on the environmental deformability.

[0253] At step 176 , when the target circuit is subjected to one or more perturbation attacks, an attack model may be constructed based on the learning data generated at step 174 .

[0254] At step 177 , an attack-only model may be derived by subtracting the benign model determined at step 175 from the attack model generated at step 176 .

[0255] Fig. 22 A system is shown in which machine learning techniques according to some embodiments of the present invention are used to remotely detect the behavior of user devices (UDs) and obtain information during the life cycle of such devices. Machine learning techniques use data obtained in the field (also referred to as "field measurements") to improve classification / attack models. Therefore, n (where n varies between 10 and 100) engineering samples (ES) can be generated and the n engineering samples can be collected in a database. The collected data can use machine learning techniques to build an initial model that is pushed on-site on multiple user devices. In addition, the measurements collected in the field enable the database storing the field measurements to be updated and the model to be improved during the life cycle of the user device, which can integrate the improved model after being deployed in the field.

[0256] Embodiments of the present invention may be implemented in hardware, software, and / or a combination of software and hardware, for example using an application specific integrated circuit (ASIC), a general purpose computer or any other hardware equivalents.

[0257] In particular, the methods described herein can be implemented by computer program instructions provided to a processor of any type of computer to produce a machine having a processor that executes instructions to implement the functions / actions specified herein. These computer program instructions can also be stored in a computer-readable medium that can instruct a computer to operate in a particular manner. To this end, the computer program instructions can be loaded onto a computer to cause the execution of a series of operational steps, and thereby produce a computer-implemented process, so that the executed instructions provide a process for implementing the functions / actions specified herein.

[0258] Additionally, in certain embodiments of the present invention, program code described herein may be identified based upon the application or software component in which the program code is implemented.

[0259] Fig.23 is a high-level block diagram of a general-purpose computer suitable for implementing some or all of the functionality of analysis unit 31 according to some embodiments of the present invention.

[0260] like Fig.23 As shown, some or all of the functionality of the analysis unit 31 may be implemented on one or more computing devices or systems, collectively referred to as a computer (e.g., computer 80). The computer 80 may include a processor 82, a memory 84, a mass storage memory device 86, an input / output (I / O) interface 88, and a human-machine interface (HMI) 89. The computer 80 may also be operably coupled to one or more external resources 92 via a network 97 and / or the I / O interface 88. The external resources may include, but are not limited to, servers, databases, mass storage devices, peripheral devices, cloud-based network services, or suitable computing resources that may be used by the computer 80.

[0261] The processor 82 may include one or more devices selected from the following: a microprocessor; a microcontroller; a digital signal processor; a microcomputer; a central processing unit; a field programmable gate array; a programmable logic device; a state machine; a logic circuit; an analog circuit; a digital circuit; or any other device that manipulates (analog or digital) signals based on operable instructions stored in the memory 84. The memory 84 may include a single memory device or multiple memory devices, including but not limited to read-only memory (ROM), random access memory (RAM), volatile memory, non-volatile memory, static random access memory (SRAM), dynamic random access memory (DRAM), flash memory, cache memory, or any other device capable of storing information. The mass storage memory device 86 may include a data storage device, such as a hard drive, an optical drive, a tape drive, a non-volatile solid-state device, or any other device capable of storing information. The database 94 may be located on the mass storage memory device 86 and may be used to collect and organize data used by the various systems and modules described herein.

[0262] The processor 82 may operate under the control of an operating system 96 located in the memory 84. The operating system 96 may manage computing resources so that computer program code embodied as one or more computer software applications (e.g., applications 98 located in the memory 84) may have instructions executed by the processor 82. In an alternative embodiment, the processor 82 may directly execute the applications 98, in which case the operating system 96 may be omitted. One or more data structures 99 may also be located in the memory 84 and may be used by the processor 82, the operating system 96, and / or the applications 98 to store or manipulate data.

[0263] While embodiments of the present invention have been illustrated by the description of various examples, and while these embodiments have been described in considerable detail, it is not the intention of the applicant to restrict or in any way limit the scope of the appended claims to such detail.

[0264] In particular, it should be noted that the present invention is not limited to a particular type of sensor.

[0265] The sensor 300 may include, for example, an “environmental sensor” including:

[0266] - one or more sensors configured to measure temperature, and / or

[0267] - one or more sensors for measuring movement, such as MEMS (Micro-Electro-Mechanical Systems), and / or

[0268] - one or more sensors configured to measure voltage, such as brownout sensors (measuring a drop in power supply), and / or

[0269] - One or more sensors configured to measure frequency, for example to detect problems related to the clock signal (eg overclocking).

[0270] It should also be noted that sensors can be instantiated specifically for security reasons, for example:

[0271] - a light sensor that can be configured to detect that the device packaging has been opened,

[0272] - a laser sensor configured to measure an electric current in the substrate,

[0273] - Invariants of some properties, thereby detecting functional errors.

[0274] Furthermore, it should be noted that each sensor 300 may be a logical sensor. Such a logical sensor may wait for the operating system (OS) to issue some security events (e.g., those logged in " / var / log / dmesg" under GNU / Linux OS) or invalid events (illegal instructions, stack overflow, memory segment violation, abnormal return code for a function or program, etc.).

[0275] Additional advantages and modifications resulting from the combination of some embodiments will be apparent to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details, representative methods, and illustrative examples shown and described.

Claims

1. A device for protecting an integrated circuit (1) from a disturbance attack, wherein: The device comprises a sensing unit (30) configured to detect a disturbance attack, the sensing unit comprising a group of digital sensors, the group of digital sensors comprising at least two sensors (300), the sensors (300) being arranged in parallel, each digital sensor (300) providing a digitized bit output having a binary value in response to input data, the sensing unit (30) being configured to transmit at least one binary vector comprising a multi-bit value, the multi-bit value comprising at least two bit outputs provided by the group of digital sensors, the device further comprising an analysis unit (31), the analysis unit (31) being configured to receive at least one binary vector provided by the sensing unit (30), the analysis unit (31) being configured to detect a disturbance attack according to the at least one binary vector; Each sensor of the sensing unit (30) includes: an input memory block (301) for storing input data, a first data path (302) for propagating the input data and forming a first delay chain, and a second data path (303) for propagating the input data and forming a second delay chain, the input memory block (301) and the second data path (302) further include a combination unit (370, 371), the combination unit (370, 371) is configured to use the input data (311) to determine the bit output of the sensor (300); wherein the device further comprises an output memory (36) associated with each sensor (300), the output memory (36) being used to store the bit output transmitted by the sensor (300), and wherein the components of the binary vector are the bit output transmitted by one of the sensors or output bits derived from the one or more output bits transmitted by the sensor; The analyzing unit (31) is configured to determine, in response to the detected perturbation attack, a quantity representing a quantitative estimate of the detected perturbation attack and / or a classification of the detected perturbation attack based on the at least one binary vector.

2. The device according to claim 1, wherein: The input memory block (301) includes an input memory element (311) for storing input data generated using an excitation generator, and the first data path (302) is configured to propagate data from the input memory element (311) to a buffer element (35), and the buffer element (35) buffers the data propagated through the first data path (302).

3. The device according to claim 2, wherein: The second data path (303) of a given sensor is formed as a laddered delay chain, the second data path (303) propagating value bits from the buffer element (35) to the output memory (36) associated with the given sensor.

4. The device according to any one of the preceding claims 1 to 3, wherein: The device also includes a register (4) configured to store the values ​​of the bit output transmitted by the sensor (300) at different instants of time.

5. The device according to any one of the preceding claims 2 to 4, wherein: The sensing unit (30) comprises at least one pair of sensors (300, 300'), each pair of sensors comprises a reference sensor (300) and a redundant sensor (300'), the sensors of each pair are adjacent, the reference sensor and the redundant sensor are interleaved, the sensing unit (30) is configured to transmit a first vector comprising the bit output of the reference sensor and a second vector comprising the bit output of the redundant sensor, and the analysis unit (31) is configured to classify the detected disturbance attack based on a comparison between the first vector and the second vector.

6. The device according to claim 5, wherein: The first vector and the second vector have the same bit size, and the analysis unit (31) is configured to: classify the detected perturbation attack as a local attack if the analysis unit determines that the first vector and the second vector are different from each other by a Hamming distance of values ​​strictly greater than one.

7. The device according to claim 5, wherein: The analysis unit (31) is further configured to classify the detected perturbation attack as a local attack if the analysis unit determines that consecutive values ​​of the first vector and the second vector differ relative to each other by a Hamming distance of the values ​​being strictly greater than one.

8. The device according to claim 1, wherein: The nominal value of the bit output is set to zero, and the analysis unit (31) is configured to classify the detected perturbation attack as a local attack by further determining whether the bit output is non-monotonic.

9. The device according to any one of the preceding claims 1 to 3, wherein: The analyzing unit (31) comprises an aging function configured to estimate an aging level of the integrated circuit (1), and the sensing unit (30) comprises at least a SRAM PUF, each output of the SRAM PUF corresponding to a sensor output.

10. The device according to claim 9, wherein: The analysis unit (31) is configured to calculate an attack risk level based on the estimated aging level.

11. The device according to claim 1, wherein: A digitized bit output is provided by each digital sensor (300) at each clock cycle of a system clock, and the digitized bit provided at a given clock cycle is monitored at each clock cycle or at each clock cycle of the system clock.

12. The device according to claim 1, wherein: The analysis unit (31) includes a classifier configured to classify an alarm as a false positive or a true positive based on the digitized bit output provided by the set of digital sensors, the classifier implementing a machine learning algorithm selected from the group including support vector machines, random forests, Bayes, rotation forests, multiboost algorithms, and clustering algorithms.

13. The device according to claim 12, wherein: The classifier is configured to construct an attack classification model by performing a first learning phase and a second learning phase, wherein the first learning phase includes determining sensor output using one or more integrated circuits (1), determining the sensor output under different operating conditions, and determining the sensor output within a predefined learning time interval, and the second learning phase includes performing one or more attacks on the integrated circuit (1).

14. The apparatus according to claim 1, wherein: The sensing unit (30) includes additional heterogeneous sensors, which are configured to generate data by monitoring different physical parameters and / or different software activities executed by the integrated circuit (1), and the analysis unit (31) is configured to aggregate the data generated by at least some of the additional heterogeneous sensors and select the sensor with the lowest variability.

15. The device according to claim 14, wherein: The additional sensor is selected from the group consisting of: a software sensor configured to monitor the activity of a processor of the integrated circuit (1) or a given peripheral device; a software sensor configured to monitor congestion on a system bus; a software sensor configured to monitor hardware performance counters; a software sensor configured to monitor a software stack; a physical sensor configured to measure temperature or pressure or voltage or frequency or light or current in a substrate or in motion.

16. The apparatus according to claim 1, wherein: One or more of the digital sensors (300) are configured to upload the digitized bit output to a remote uplink server, and the remote uplink server is configured to update a classification model based on the digitized bits.

17. The apparatus according to claim 10, wherein: The aging function is configured to measure the value of each bit transmitted by the SRAM PUF (300) and calculate an average value taking into account the measured bit values, the average value representing an estimation of the reliability of the SRAM PUF, and the analysis unit is configured to determine the aging of the circuit (1) based on the reliability.

Images