Method and apparatus for countering repeated side channel attacks

Abstract

A computing device incorporating a repetitive side channel attack (SCA) countermeasure may include a timer circuit and a capacitive delay circuit that notifies of a potential repetitive-based attack by sending an activity detection signal that can be used to initiate an appropriate countermeasure response. Additionally or independently, a computing device incorporating a repetitive SCA countermeasure may include at least one storage unit that can store an incoming input signal, at least one comparator that compares the incoming input signal to another signal and indicates a match, and a counter that increments upon a match. When the counter reaches a specified limit, an out-of-limit signal may be sent to notify of a potential repetitive-based attack and initiate an appropriate countermeasure response.

Description

Background Art

[0001] A smart card is a portable personal secure computing device that can securely carry sensitive information, enable secure transactions, authenticate an individual within a secure system, and verify that the information requester is authorized to access the information carried on the card. Smart cards are configured to maintain the integrity of the information stored on the card and make the information available for secure interactions with the overall system.

[0002] Side channel attack (SCA) refers to a group of attack techniques that can be used to compromise the security of smart cards or other computing devices. SCA generally includes attacks based on information obtained from the physical implementation of the cryptographic system, including timing information, power consumption, electromagnetic leakage, and sound. Repetitive SCA involves repeated activities involving the application of input signals in order to capture information from, for example, the power pins or signal lines of a smart card.

[0003] Countermeasures against SCA may include a detection component and a response component. The detection component includes hardware and / or software that determines that a possible attack is occurring (e.g., it may be a binary determination that an attack condition is triggered or a probabilistic determination that provides a confidence value). The response component includes hardware and / or software that performs an action in response to the detection component indicating that an attack is occurring (with or without a certain confidence level). As some examples, the response component may be a switch that resets or turns off a cryptographic engine, or even a more complex circuit that changes a characteristic of the device. Summary of the invention

[0004] This article describes a repetitive SCA countermeasure for computing devices. The countermeasure described is suitable for preventing side-channel attacks when repetitive behavior of the attack occurs.

[0005] A computing device incorporating a repetition side channel attack (SCA) countermeasure may include a timer circuit and a capacitive delay circuit that signals a potential repetition-based attack by sending an activity detection signal, such as resetting a computing engine or performing other appropriate countermeasure responses.

[0006] The timer circuit can receive the clock signal and reset signal of the computing device, and output the timer start notification to the computing engine of the computing device circuit, and output the delayed capture signal to the capacitive delay circuit. The capacitive delay circuit can be configured to output the activity detection signal in response to the computing device applying power or resetting within a specified amount of time after the previous power application or reset. In some cases, when the amount of time the computing device is powered is shorter than the amount of time of typical operation, the activity detection signal can be output. The capacitive delay circuit may include a capacitor, an amplifier, and a latch or trigger gate. The capacitor may be coupled between the power supply (VDD) and ground (VSS or GND) of the computing device. The amplifier may be coupled to the capacitor to sense the charge on the capacitor and output the signal to the latch or trigger gate. When the clock from the timer circuit is turned on, the delayed capture signal is output and the signal from the amplifier has a sufficiently high value, the latch or trigger gate receives the delayed capture signal from the timer circuit to output the activity detection signal to the computing engine.

[0007] A computing device incorporating a repetitive SCA countermeasure may include at least one storage unit that can store incoming input signals to a computing engine of the computing device; at least one comparator that compares a next incoming input signal to a previously incoming signal stored in the storage unit and indicates a match, and increments a counter when a match occurs. When the counter reaches a specified limit, an out-of-limit signal may be sent to notify of a potential repetitive-based attack and initiate an appropriate countermeasure response.

[0008] In some cases, multiple comparators and storage units may be provided so that the input signal sequence can be analyzed for repetitive signals.One or more counters may be coupled to the multiple comparators.

[0009] This Summary is provided to introduce some concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1A An illustrative smart card pinout is shown for a smart card chip that may include any of the hardware countermeasures described herein.

[0011] Figure 1B A schematic diagram of a smart card is provided.

[0012] Figure 2 An example hardware implementation of a repetitive SCA countermeasure using capacitive delays is shown.

[0013] Figure 3An example implementation of a repeated SCA countermeasure using a comparator is shown.

[0014] Figure 4A and Figure 4B An example implementation of a repeated SCA countermeasure suitable for a multi-input repeated attack is shown.

[0015] Figure 5 A method is shown that may be performed by iterative SCA countermeasures using one or more comparators.

[0016] Figure 6 A schematic diagram of a smart card implementing a duplicate SCA countermeasure is shown. DETAILED DESCRIPTION

[0017] This article describes a repeated side channel attack (SCA) countermeasure for a computing device. The countermeasure described is suitable for preventing a side channel attack when repeated behavior of the attack is occurring. An example of a computing device is a cryptographic engine, which can be implemented as part of a smart card.

[0018] In one repetitive side-channel attack scenario, the smart card applies different signals with resets in between. A smart card (or other computing device subject to such a side-channel attack scenario) incorporating a repetitive SCA countermeasure may include a timer circuit and a capacitive delay circuit that notifies of a potential repetition-based attack by sending an activity detection signal that may be used to initiate an appropriate countermeasure response. For example, when the smart card is powered for an amount of time that is shorter than the amount of time of typical operation or in response to the smart card applying power or resetting within a specified amount of time after a previous application of power or reset, the activity detection signal may be used to reset the cryptographic engine of the smart card or execute another appropriate countermeasure response.

[0019] In another repetitive side-channel attack scenario, the smart card is repeatedly subjected to the same input signal. A smart card (or other computing device subject to such a side-channel attack scenario) incorporating a repetitive SCA countermeasure may include at least one storage unit that may store incoming input signals; at least one comparator that compares the next incoming input signal to the previously incoming signal stored in the storage unit and indicates a match, and increments a counter upon a match. When the counter reaches a specified limit, an out-of-limit signal may be sent to notify of a potential repetitive-based attack and initiate an appropriate countermeasure response.

[0020] Figure 1A shows an illustrative smart card pinout for a smart card chip that may include any of the hardware countermeasures described herein; and Figure 1B A schematic diagram of a smart card chip is provided. The smart card chip 100 includes a circuit and a package. Currently, the standard smart card chip package provides a 6-pin or 8-pin bus pin assignment. Figure 1A As shown, the package of the smart card chip 100 may include pads for the following items: VCC (power input), RST (may be used alone or in conjunction with an internal reset control circuit), CLK (clock or timing signal), GND (ground-ground or VSS signal), VPP (programming voltage input), and I / O (serial data input or output to a microcontroller inside the smart card). Two additional connection pads (e.g., C4 and C8) may be included for dedicated inputs (or outputs) or future standards. The pads are coupled to the smart card chip circuit including the cryptographic engine block 110. Although in Figure 1B Only the cryptographic engine block 110 is shown in the figure, but the smart card chip 100 may include a plurality of different circuit blocks and sub-blocks in addition to the cryptographic engine block 110, including but not limited to a processor, a memory, an analog circuit, and an interface circuit. In addition, any one or combination of the countermeasures described herein may be included as part of the smart card chip 100.

[0021] The data input signal to the smart card for the transaction (and provided to the cryptographic engine 110 via the I / O pin) is referred to herein as an information cycle. The information cycle may include, but is not limited to, an input signal formed by digital bits, analog waveforms, or mixed signal data. In many cases, the information cycle uses plain text or cipher text.

[0022] During normal operation of the smart card chip 100, a smart card embedded with the chip 100 can be inserted into a contact-based card reader or placed in a location for a wireless card reader connection. It is generally expected that there will be a reasonable time period between transactions using smart cards. For example, it takes a certain amount of time to complete a purchase, slide the card into the card reader, enter the pin and complete the transaction; and then go to another store or make another purchase at the same store, slide the card into the card reader, enter the pin and complete another purchase.

[0023] In normal use of a smart card, such as during a credit / debit card transaction, the owner of the smart card may initiate a transaction at one store, and then initiate another transaction at a different store a few minutes later (or longer). There is a reasonable time interval between each iteration of running the instructions in this process, and the information period for each iteration may be different.

[0024] In contrast to normal use of a smart card, a repetitive side channel attack typically involves performing an activity repeatedly over a short amount of time. In the attack, the information cycle may be the same or different each time. A typical repetitive attack may be performed, for example, 1000-10,000 times per second or more. An oscilloscope may be used to observe this repetitive information cycle, and a probing device may be used to record fluctuations in voltage or current at power pins or points of interest within the smart card. Such analysis of a smart card may allow an attacker to derive a key based on known arithmetic operations within the algorithm and the value of the input text.

[0025] The repetitive SCA countermeasures described herein can identify when too many access attempts are made within a fixed amount of time (even in the event of a system reset), indicating abnormal use. Additionally, the repetitive SCA countermeasures described herein can identify when too many attempts are made to use the same information cycle of the input data. Once identified, the smart card or other computing device can enter a protected mode, a completely corrupted card mode, or initiate some other security action to stop the extraction of information.

[0026] Figure 2 An example hardware implementation of a repetitive SCA countermeasure using capacitive delay is shown. As described above, the repetitive SCA countermeasure using capacitive delay may include a timer circuit coupled to a clock signal pin and a reset signal pin; and a capacitive delay circuit coupled to a power signal pin and a ground signal pin, wherein the timer circuit receives a clock signal from the clock signal pin and a reset signal from the reset signal pin, and outputs a delayed capture signal to the capacitive delay circuit, wherein the capacitive delay circuit receives a power signal from the power signal pin, a ground signal from the ground signal pin, and a delayed capture signal from the timer circuit, and outputs an activity detection signal to a computing engine of a computing device. Reference Figure 2 In a specific smart card implementation example, the smart card 200 may include a cryptographic engine 202, a timer circuit 204, and a capacitive delay circuit 206. The timer circuit 204 is coupled to a clock signal pin (CLK) and a reset signal pin (RST) of the smart card 200. The timer circuit 204 receives a clock signal from the clock signal pin and a reset signal from the reset signal pin, and outputs a delayed capture signal to the capacitive delay circuit 206. The pin may receive clock and reset signals from a card reader or a test jig inserted into the smart card 200.

[0027] The capacitive delay circuit 206 is coupled to the power signal pin (VCC) and the ground signal pin (GND) of the smart card 200. The capacitive delay circuit 206 receives a power signal from the power signal pin, a ground signal from the ground signal pin, and a delayed capture signal 204 from the timer circuit 204, and outputs an activity detection signal to the cryptographic engine 202. The power and ground signals may be received from a card reader or a test fixture inserted into the smart card 200. In some cases, an "enable" switch may be included between the power signal pin and the capacitive delay circuit 206, which is controlled by an attack detection enable signal, which will be set if countermeasures are to be used, otherwise it will be cleared. The capacitive delay circuit 206 may include a capacitor 208, an amplifier 210, and a latch or trigger gate 212. The capacitor 208 is coupled to the power signal pin (VCC) and the ground signal pin (GND). For implementations using an enable switch, the enable switch may be located between the power signal pin and the capacitor 208. An amplifier 210 is coupled to the capacitor 208 to sense the charge on the capacitor 208. The amplifier may be a high gain amplifier and amplifies the charge (e.g., voltage amplitude) sensed on the capacitor 208, captures the state of the capacitor, and sets a latch or trigger gate 212 after the capacitor 208 has charged to a threshold level. The latch or trigger gate 212 is coupled to the amplifier 210 to receive the output of the amplifier 210 and to the timer circuit 204 to receive the delayed capture signal. The output of the latch or trigger gate 212 is coupled to the cryptographic engine 202 to provide an activity detection signal. The latch or trigger gate 212 may be a D flip-flop.

[0028] The cryptographic engine 202 may include one or more processing cores and memory storage devices. The processing core may be implemented using an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a microprocessor, or other hardware circuit. Common cryptographic algorithms implemented in the cryptographic engine include variations of AES, ECC, DES, and RSA. The memory storage device may include non-volatile memory (NVM) and volatile memory. Examples of NVM include flash memory, various read-only memories (ROM, PROM, EPROM, EEPROM), phase change memory, magnetic and ferromagnetic / ferroelectric memory (MRAM, FeRAM). Examples of volatile memory include random access memory (RAM, DRAM, SRAM).

[0029] The illustrated smart card 200 can initiate a countermeasure response based on an activity detection signal received by the cryptographic engine 202, which may be a result of the amount of time the smart card is powered for longer than the amount of time of typical operation. Then, a countermeasure response can be initiated based on the activity detection signal received by the cryptographic engine 202. In some cases, the timer circuit 204 is coupled to the cryptographic engine 202 to output a timer-on notification to the cryptographic engine 202. The cryptographic engine 202 can use the timer-on notification to signal to read the input of the capacitive delay circuit 206. An illustrative scenario is provided as follows.

[0030] After smart card 200 is inserted into a card reader (or test fixture), the RST signal goes high and timer circuit 204 begins operation. Initially, upon first insertion, or if a sufficient amount of time has passed since smart card 200 was previously inserted into a card reader or test fixture, the charge on capacitor 208 is minimal. Thus, when timer circuit 204 sends a delayed capture signal to flip-flop 212 to cause flip-flop 212 to capture its input value, latch or flip-flop gate 212 outputs a low value to cryptographic engine 202, indicating that an attack has not (yet) been detected.

[0031] Since power is supplied to the card 200, the capacitor 208 begins to charge after the smart card 200 is inserted into the card reader. As the capacitor 208 is charged, the amplifier 210 amplifies the signal (e.g., voltage amplitude) provided to the latch or trigger gate 212. Once the capacitor 208 is charged to a value above the threshold, the input of the latch or trigger gate 212 may switch to a high value. The next timer circuit 204 sends a delayed capture signal to the latch or trigger gate 212 to allow the latch or trigger gate 212 to capture its input state, which will be high. In this state, the latch or trigger gate 212 will output a high activity detection value to alert the cryptographic engine 202 that an attack is in progress.

[0032] As described above, when the timer circuit further provides a timer start notification, the cryptographic engine (or a designated control portion of the smart card) can read the value output by the latch or trigger gate 212.

[0033] The size / capacitance of the capacitor may be selected to support a delay of a certain amount of time (e.g., time for charging to a threshold level), such as 3-5 seconds. If access to the smart card 200 is requested within a few seconds of a previous access or a previous reset operation, the charge on the capacitor continues to charge and is sufficient to cause the output of the latch or trigger gate 212 to be high, which, when read by the cryptographic engine (or a designated control portion of the smart card), can be used to initiate countermeasures. If the capacitor 208 is sufficiently discharged, the state of the latch or trigger gate 212 is low, and the output of the trigger is low, indicating that the SCA method is not under attack (and access is safe).

[0034] The specific countermeasures implemented can obfuscate or alter the data in some way determined by the smart card designer. For example, the smart card can be disabled and not execute a response to the input data, or it can switch from executing an appropriate response to executing an inappropriate response. An inappropriate response is one that is intended to create a power signature that indicates a different key or a random key.

[0035] Incorporating a capacitive delay circuit into a smart card can cause an attacker to spend approximately 80 times longer to capture the data needed to extract the key via SCA (e.g., differential power analysis (DPA)). Additionally, by increasing the discharge time of the capacitor, the amount of time required to extract the key during an attack directly increases.

[0036] In another embodiment of the repetitive SCA countermeasure described herein, one or more comparators may be used. The repetitive SCA countermeasure may include counting the number of times the smart card receives the same information cycle. Repeated reception of the same information cycle may indicate an attack.

[0037] Figure 3 An example implementation of a repeated SCA countermeasure using a comparator is shown. As described above, the repeated SCA countermeasure using a comparator may include one or more comparators coupled to an I / O pin of a computing device; a storage unit coupled to each comparator; and a counter coupled to receive an output of the comparator, the output of the counter being coupled to a computing engine to provide an out-of-limit signal to the computing engine. Figure 3 As an example of a specific smart card implementation, smart card 300 may include a cryptographic engine 302, a storage unit 304, a comparator 306, and a counter 308. Storage unit 304 may be a register, such as a first-in-first-out (FIFO) register, or a suitable non-volatile memory (NVM). The storage unit has a size to store information cycles received via an I / O pin. Although specific reference is made to the described countermeasures applied to a smart card, the circuit may be applicable to any computing device that may be subject to repeated attacks via signal lines.

[0038] Comparator 306 can receive a complete information cycle at a time from the I / O pin and can output a signal indicating a match. The information cycle can be a data block of a predetermined length, such as 64 bits. In some cases, the comparator is a 64-bit comparator. In some cases, the comparator includes a plurality of smaller comparators, each of which is capable of processing a certain number of bits of the data block within the information cycle. Storage unit 304 is coupled to comparator 306 and stores previously received information cycles. Storage unit 304 can be part of a memory storage device within cryptographic engine 302, part of other memory storage devices on smart card 300, or a separate storage device on smart card 300. Comparator 306 compares the previously stored information cycle in storage unit 304 with the newly received information cycle. If the comparator outputs a signal indicating that the newly received information cycle matches the previously stored information cycle, counter 308 will increment.

[0039] exist Figure 3 In the smart card 300, for example, Figure 1A and Figure 1B The described I / O pins are used to receive input data. The input data may include information cycles representing input data (such as but not limited to plain text or cipher text). When the smart card is inserted into a card reader or test fixture (or other device), the exchange of information cycles begins. The smart card 300 can use the described countermeasure circuit to detect whether a newly received information cycle is a repeated transmission of a previous information cycle.

[0040] A single match between a newly received information cycle and a previously stored information cycle does not necessarily indicate an attack. The smart card designer can determine how many repeated information cycles are acceptable before implementing countermeasures. For example, if there are more than 3 repeated information cycles since the last reset, an attack may be considered possible. If the counter 308 exceeds a predetermined acceptable level, the counter (or other circuitry coupled to the counter) may output an out-of-limit signal to the cryptographic engine 302 to indicate an attack. The out-of-limit signal may be used to generate an abort, interrupt, or pause signal. Similar to Figure 2 In the example embodiment of the smart card, the countermeasures may include obfuscating or altering the data in some manner determined by the smart card designer, shutting down the device, or other countermeasures.

[0041] The number of comparators and memory cells used in a smart card can vary based on the expected sophistication of a potential attacker. For example, an attacker may learn that a smart card is disabled after 3 attempts to send the same information cycle. The attacker can start sending a pattern of two repeated information cycles followed by a different information cycle to gain access to the smart card, which is referred to herein as a "multi-input" repetition attack.

[0042] Figure 4A and Figure 4B An example implementation of a repetitive SCA countermeasure applicable to a multiple-input repetition attack is shown. Although specific reference is made to smart cards, Figure 4A and Figure 4B The example implementation of the repetition SCA countermeasure shown in is applicable to any computing device that receives input and is subject to a multiple-input repetition attack. Figure 4A , smart card 400 may include a plurality of comparators and storage units, such as n comparators (402, 404, 406, 408, 410) coupled to n corresponding storage units (412, 414, 416, 418, 420). Each comparator may receive a block of information cycles and output an activity detection signal to counter 422. Counter 422 is coupled to receive an output from each comparator and output an out-of-limit signal to cryptographic engine 424.

[0043] As about Figure 3 As described, the storage unit (e.g., 412, 414, 416, 418, 420) can be a register, such as a D-type register, or an appropriate non-volatile memory (NVM). Each storage unit has a size for storing an information cycle received via an I / O pin. In addition, in some cases, the comparator is a 64-bit comparator. In some cases, the comparator includes a plurality of smaller comparators, each of which is capable of processing a certain number of bits of a data block within an information cycle. Multiple storage units (e.g., 412, 414, 416, 418, 420) can be part of a memory storage device within a cryptographic engine 424, part of other memory storage devices on smart card 400, or a separate storage device on smart card 400. Each comparator (e.g., 402, 404, 406, 408, 410) compares the previously stored information cycle in the storage unit (e.g., 412, 414, 416, 418, 420) associated with the comparator with the newly received information cycle. If any comparator outputs a signal indicating that a newly received information cycle matches a previously stored information cycle, then counter 422 will increment.

[0044] Each of the n comparators (402, 404, 406, 408, 410) can receive a complete information cycle from the I / O pin. In some cases, the comparators are connected in series, and the comparators fill the incoming information cycle similar to a first-in, first-out operation before performing the comparison operation. In some cases, the comparators are connected in parallel so that the incoming information cycle is directed to the appropriate comparator before performing the comparison. Any configuration can be operated so that not all comparators are filled and used for comparison during operation.

[0045] In some cases, more than one counter may be used; and the configuration may be considered to provide limit values ​​for the counters.

[0046] refer to Figure 4B , the countermeasures included in smart card 450 may be similar to those described with respect to Figure 4A The countermeasures described above for the smart card 400 include circuitry 440 that directs the storage of appropriate input data in a memory cell. The circuitry 440 is coupled to each comparator (402, 404, 406, 408, 410) to receive the output of the comparator: the output of the comparator is a comparison between the input data of the received information cycle and the input data stored in the corresponding memory cell (412, 414, 416, 418, 420); and if the output of the comparator indicates a mismatch, the received input data is stored in a selected one of the memory cells.

[0047] Within counter 422 may be a set of counters, each corresponding to a comparator. A single match between a newly received information cycle and a previously stored information cycle does not necessarily indicate an attack. The smart card designer may determine how many repeated information cycles are acceptable before implementing countermeasures. For example, if there are more than 3 repeated information cycles since the last reset, an attack may be considered possible. If counter 422 (on all counters or by a single counter within counter 422) exceeds a predetermined acceptable level, the counter (or other circuitry coupled to the counter) may output an out-of-limit signal to the cryptographic engine 424 to indicate an attack, such as described with respect to 3; and take appropriate countermeasures. In some cases, no countermeasures are taken in response to an out-of-limit signal. For example, countermeasures may be taken when a certain number of out-of-limit signals are received.

[0048] In some cases, the circuit 440 can determine whether any storage cell (412, 414, 416, 418, 420) does not store previous input data; if all storage cells store previous input data, the circuit 440 can select a random storage cell among the plurality of storage cells and load the input data of the received information cycle to the random storage cell; and if any storage cell does not store previous input data, an empty storage cell among the empty storage cells can be selected and the input data of the received information cycle can be loaded to the empty storage cell. The selection of the empty storage cell can be random, according to a predetermined pattern, or sequential. In some cases, when all storage cells store previous input data, the circuit 440 can select the storage cell according to a predetermined pattern rather than randomly. In some cases, each of the n storage cells (412, 414, 416, 418, 420) is coupled to a corresponding full / empty indicator device (426, 428, 430, 432, 434). A full / empty indicator device may be coupled to circuit 440 to indicate whether the memory cell is an empty information cycle or a full information cycle.

[0049] Figure 5 5 shows a method that can be performed by using a repeated SCA countermeasure using one or more comparators. Method 500 can be performed by any computing device that includes a repeated SCA countermeasure. In some cases, Figure 5 The method 500 shown in FIG. 5 may be implemented by a smart card (eg, Figure 3 , Figure 4A and Figure 4B , 300, 400, and 450 of smart cards). The described iterative SCA countermeasure can begin when data is first input into the smart card (or other computing device) using, for example, an I / O connection pin (502). The smart card can be in a wait state until new input is received (504). Once the new input is received, the new input is loaded into both the computing engine (e.g., a cryptographic engine) and the storage unit (506). Next, the input data is compared to all valid (i.e., non-empty) storage units (508). This step can occur in a parallel process in which the input data can be compared to all valid storage units at the same time—whether there is a single storage unit (e.g., as described with respect to smart card 300) or multiple storage units (e.g., as described with respect to smart cards 400 and 450).

[0050] When the input data matches any data already stored in any valid storage unit (510), the counter will be incremented (512). The counter can be checked to see if the number of matches exceeds a limit (514). If the number of matches exceeds the limit, a signal is generated to initiate a countermeasure (516). As some examples, the signal can be an abort signal, an interrupt signal, or a signal to stop the cryptographic operation. If the number of matches does not exceed the limit (as determined during operation 514), the process can return to operation 504 to wait for new input.

[0051] If during operation 510, the input data does not match any data already stored in any valid storage unit, the smart card / computing device can check whether there are any empty storage units (518). When there are empty storage units, the input data can be loaded into the next empty storage unit (520), and the process can then return to operation 504 to wait for new input. If there are no empty storage units, a storage unit can be selected randomly or according to some predetermined pattern (522), and the input data can be loaded into the selected storage unit (524). The process can then return to operation 504 to wait for new input.

[0052] In some cases, one or more comparators and / or the method 500 itself may be implemented in software stored on a computing device and executed by a processor of the computing device. For example, a computer-implemented method may include: receiving input data of an information cycle; comparing the input data with one or more previous input data; when the input data matches any of the one or more previous input data, incrementing a counter; and when the counter reaches or exceeds a limit, generating a signal to initiate a repeat SCA countermeasure. In some cases, the method also includes: when the input data of the information cycle does not match any previous input data, checking whether there is an empty storage cell; and when there is an empty storage cell, loading the input data into the next empty storage cell, and when there is no empty storage cell, selecting a storage cell and loading the input data into the selected storage cell. The selection of the storage cell may include randomly selecting one of a plurality of storage cells. For example, a random number generator may be used to select the selected storage cell to generate a selection pattern. In some cases, the selected storage cell may be selected according to a predetermined pattern.

[0053] Figure 6 Schematic diagram showing a smart card implementing a duplicate SCA countermeasure. Figure 6, the smart card chip 600 may include a cryptographic engine 610; and pads for the following items: VCC (power input), RST (can be used alone or in conjunction with an internal reset control circuit), CLK (clock or timing signal), GND (ground-ground or VSS signal), VPP (programming voltage input), I / O (serial data input or output to a microcontroller inside the smart card); and optionally two additional connection pads for dedicated inputs (or outputs) or future standards, such as with respect to Figure 1A and Figure 1B The smart card chip 600 may include multiple SCA countermeasures, including countermeasure 1 (CM1) 620 and countermeasure 2 (CM2) 630. CM1 620 may provide a repeated SCA countermeasure using capacitive delay (e.g., Figure 2 ), including a timer circuit and a capacitive delay circuit. CM2630 can provide a repetitive SCA countermeasure using one or more comparators (e.g., Figure 3-5 One or both countermeasures may be enabled for a particular chip.

[0054] Although smart cards and cryptographic engines are specifically described and illustrated herein, some of the SCA countermeasures described herein may be applied to any computing device that receives signals such as clock or timing signals, reset signals, ground signals, and power input signals. Furthermore, some of the SCA countermeasures described herein may be applied to any computing device that receives input signals that are input in information cycles.

[0055] Although the subject matter is described in language specific to structural features and / or acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as examples of implementing the claims, and other equivalent features and acts are intended to be within the scope of the claims.

Claims

1. A computing device, comprising: a comparator, coupled to an I / O pin of the computing device, for detecting a repeated input signal; a storage unit coupled to the comparator and configured to store a previous input signal, wherein the comparator compares a current input signal received via the I / O pin with the previous input signal stored in the storage unit to determine whether the current input signal matches the previous input signal, wherein the previous input signal stored in the storage unit is a previously incoming signal received via the I / O pin; and a counter coupled to receive the output of the comparator, wherein the counter is incremented when the output of the comparator indicates that the current input signal matches the previous input signal and is therefore a repeated input signal, wherein the output of the counter is coupled to a computing engine to provide an exceed limit signal to the computing engine when the counter exceeds a predetermined acceptable level of repeated input signals.

2. The computing device of claim 1, wherein: The computing device is a smart card.

3. The computing device of claim 1, wherein: The computing engine includes a cryptographic engine.

4. The computing device of claim 1, wherein: The storage unit stores a first information cycle, and the comparator receives a second information cycle to compare the second information cycle with the first information cycle.

5. The computing device of claim 1, wherein: The comparator is a 64-bit comparator.

6. The computing device of claim 1 , further comprising: Multiple comparators; as well as Corresponding multiple storage units.

7. The computing device of claim 6, further comprising: A corresponding plurality of counters are coupled to the plurality of comparators.

8. The computing device of claim 6, further comprising circuitry to direct storage of appropriate input data in the memory cell.

9. The computing device of claim 8, wherein: the circuit being coupled to each comparator to receive an output of the comparator, the output being a comparison between input data of the received information cycle and input data stored in a corresponding memory cell; and determining whether any memory cell does not store previous input data when the output of the comparator indicates a mismatch; When all the storage units store the previous input data, selecting a random storage unit among the plurality of storage units, and loading the received input data of the information cycle into the random storage unit; and loading the input data of the received information cycle into the next empty storage unit when any of the storage units does not store previous input data.

10. The computing device of claim 9, further comprising: A full / empty indicator device is coupled to each of the storage cells, and the circuit is coupled to the full / empty indicator device.

11. The computing device according to any one of claims 1 to 10, further comprising: a timer circuit coupled to a clock signal pin and a reset signal pin of the computing device; as well as A capacitive delay circuit is coupled to a power signal pin and a ground signal pin of the computing device and is further coupled to the computing engine to provide an activity detection signal.

12. The computing device of claim 11, wherein: The capacitive delay circuit comprises: capacitor, coupled to the power signal pin and the ground signal pin, an amplifier coupled to the capacitor to sense the charge on the capacitor, and A latch or flip-flop gate is coupled to the amplifier to receive the output of the amplifier and to the timer circuit to receive the delayed capture signal from the timer circuit, wherein the output of the latch or flip-flop gate is coupled to the computation engine to provide the activity detection signal.

13. A computer-implemented method comprising: receiving input data of an information cycle at a comparator coupled to an I / O pin of a computing device for detecting a repetitive input signal; comparing, via the comparator, the input data with one or more previous input data stored at a storage unit coupled to the comparator to determine whether the input data matches the one or more previous input data, wherein the one or more previous input data stored at the storage unit are previous incoming signals received via the I / O pin; when the output of the comparator indicates that the input data matches any of the one or more previous input data and is therefore a repeated input signal, incrementing a number in a counter coupled to receive the output of the comparator, wherein the number in the counter represents the number of matches, the output of the counter being coupled to a computing engine to provide an exceed limit signal to the computing engine when the counter exceeds a predetermined acceptable level of repeated input signals; When the counter reaches or exceeds a limit corresponding to an acceptable level of the predetermined repetitive input signal, a signal is generated to initiate repetitive SCA countermeasures.

14. The method according to claim 13, further comprising: when the input data of the information cycle does not match any previous input data of the previous input data, checking whether there is an empty storage cell; as well as When there is an empty memory cell, the input data is loaded into the empty memory cell, and if there is no empty memory cell, a memory cell is selected and the input data is loaded into the selected memory cell.

Images