Cryptographic integrated circuit and method for detecting fault injection attacks on cryptographic devices

Abstract

The present invention relates to countermeasures against fault injection attacks on cryptographic integrated circuits, and more specifically to laser fault injection attacks. The invention comprises generating bit sequences belonging to a set of allowed sequences and storing these sequences on a set of flip-flops. Afterwards, the sequences stored on the flip-flops are checked, and if they do not belong to the allowed sequences, then this is a sign that a fault injection attack has occurred and caused a bit flip in one of the flip-flops. An alarm signal is then generated.

Description

Technical Field

[0001] The present invention generally relates to security of devices. More particularly, the present invention relates to detecting laser fault injection attacks on cryptographic devices. Background Art

[0002] Cryptographic algorithms are used in an increasing number of devices that carry sensitive information, such as smart cards, cellular phones, set-top boxes, and the like.

[0003] Cryptographic algorithms are used to ensure confidentiality, security, authentication, integrity and privacy of digital data during its storage and / or its transmission over an insecure network. They can also be used to ensure the security of transactions and transactions between devices, secure payments, secure authentication of devices in a network, etc.

[0004] In order to protect sensitive information carried by the device from attack, one or more encryption functions based on cryptographic algorithms are often implemented. The encryption function encrypts the original data or "plaintext" using one or more encryption keys. The encryption process produces cryptographic data or "ciphertext" that can only be viewed in its original form when decrypted using the appropriate key.

[0005] Cryptographic algorithms, such as the DES (Data Encryption Standard) algorithm and the AES (Advanced Encryption Standard) algorithm, are based on a secret key unique to each user / device and allow the user / device to securely encrypt / decrypt messages or data.

[0006] Cryptographic algorithms may be implemented by integrated circuits (ICs) of generally small size to be embedded in a device. For example, a UICC (Universal Integrated Circuit Card) card or a credit card includes a cryptographic IC that is provided to secure transactions or communications using one or more cryptographic secret keys that are bound to a user or the like. Thus, preserving such secret keys from attack is critical to enhancing the security of a large number of embedded devices.

[0007] In order to preserve the secret keys, cryptographic keys are designed to be extremely difficult to crack mathematically: an attacker seeking the secret key must perform a brute force analysis, which requires the attacker to try all possible secret keys. Accordingly, cryptographic algorithms are designed so that such attacks require unreasonably high amounts of time and resources to be effective.

[0008] However, other types of attacks, known as "fault injection attacks," have emerged that enable attackers to obtain secret keys more quickly. Fault injection attacks involve performing hardware attacks on an IC to obtain a secret key. One type of fault injection attack involves inserting a fault into a computation of a cryptographic IC to generate a fault result, and includes analyzing the fault result to obtain a secret key associated with the IC. This analysis of the fault result, which is used to infer information related to the secret key, is called DFA (differential fault analysis). Protection against fault injection attacks is a major challenge facing cryptographic devices today because such attacks dramatically reduce the number of attempts required by an attacker to crack a secret key embedded in a cryptographic IC. An overview of fault injection attacks and existing countermeasures is provided in Barenghi, A., Breveglieri, L., Koren, I., & Naccache, D. (2012), Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures, Proceedings of the IEEE, 100 (11), 3056-3076.

[0009] Laser fault injection is a particularly powerful fault injection attack. Laser fault injection involves sending a laser beam at specific points of the IC, thereby generating bit errors during cryptographic calculations, thereby injecting faults into the cryptographic calculations. Laser fault injection attacks, while expensive, are known to be very powerful attacks because they are efficient in injecting faults at very precise locations on the IC. Furthermore, fault injection attacks can be replicated very accurately.

[0010] For example, many cryptographic ICs contain interconnected flip-flops (FFs) that perform encryption / decryption. Each FF stores a binary value. These FFs are synchronized using a clock. The binary value of each FF is updated at each clock signal (often at the rising edge of the clock signal) based on the combination of binary values ​​of other FFs connected to its input port. The interconnection of FFs allows encryption and decryption to be performed using a secret key, which is often stored in an external memory that can be protected by a physical unclonable function (PUF) or a one-time programmable (OTP) master key. The key is transmitted to the cryptographic circuit via a bus. Laser fault injection attacks can target a single FF, thereby injecting a bit fault during calculation. Bit faults can include artificially setting the value of the FF to 0 or 1, or performing a bit flip.

[0011] Laser fault injection attacks are generally performed in two main steps. The first calibration step consists in performing fault injections at random or pseudo-random locations of the IC, thereby identifying the most sensitive FFs, which are the FFs that must be attacked in order to crack the secret key. The second step consists in actually performing the fault injections in the sensitive FFs, analyzing the fault results, and then decrypting the secret key. The power of the laser fault injection attack lies in its ability to be easily replicated on ICs of the same model / manufacturer. This is because the topology of ICs belonging to the same model (for example, the same model of UICC cards) is identical, while only the secret key used by the IC (the SIM key in this example) changes. Therefore, once the calibration step has been performed and the sensitive FFs of the circuit have been identified, the fault injection attack can be reproduced on the same model of IC in a fairly simple way, thereby retrieving each of the secret keys stored in each IC.

[0012] Laser fault injection attacks can be performed from the front side of the IC (front attack) or from the back side of the IC (back attack). In each case, the wavelength of the laser beam must have a specific value. For front attacks, the wavelength of the laser beam must be at least 800nm ​​to have enough energy to inject faults. For back attacks, the wavelength of the laser beam must be substantially equal to 1064nm, because this wavelength is the only wavelength that makes the silicon substrate of the IC transparent, and therefore the only wavelength that allows laser fault injection from the back side of the IC.

[0013] There are many countermeasures known to protect ICs from laser fault injection attacks.

[0014] For example, a shield can be placed on top of the IC to prevent the laser beam from reaching the IC. However, such a solution is costly and does not protect the IC from backside attacks.

[0015] Another countermeasure includes placing an analog light sensor in the IC to detect the laser beam and protect the circuit in the event of detection of the laser beam (e.g., by stopping the execution of encryption / decryption or submitting an erroneous result). The advantage of this solution is that it ensures that laser fault injection cannot be successfully performed in the area of ​​the IC where the laser beam can be detected by the sensor. However, analog sensors often cannot sense light on the entire surface of the IC. Accordingly, laser fault injections occurring in areas of the IC that are far from the sensor may not be detected. In addition, such sensors tend to be large and thus occupy significant surfaces that could otherwise be used for computing logic units and / or allow the size and power consumption of the IC to be reduced. Analog sensors can also be easily detected by attackers.

[0016] In some existing solutions, it is known to replace analog sensors by digital light sensors. Digital sensors are smaller than analog sensors, allowing the occupied size to be optimized. However, they can still be detected by an experienced attacker. In addition, although laser detection is generally effective, it is very difficult to quantify the protection provided by digital sensors. Thus, it is difficult to define the actual protected area of ​​the IC (i.e., the area of ​​the IC that will be detected by the laser beam by the digital sensor) with reasonable certainty using either analog or digital light sensor solutions.

[0017] Therefore, prior art countermeasures against laser fault injection attacks suffer from the disadvantages of being incomplete, impossible to quantify, and / or high cost.

[0018] Accordingly, there is a need for a cryptographic device that is able to detect laser fault injection attacks on an entire cryptographic IC with a defined certainty at a reasonable cost. Summary of the invention

[0019] To this end, the present invention discloses a cryptographic integrated circuit (IC), which includes: one or more processing logic units configured to generate one or more bit sequences belonging to a set of allowed sequences; a group of flip-flops (FFs), which includes two or more flip-flops configured to store the bit sequences; and one or more processing logic units configured to generate a signal indicating the occurrence of a fault injection attack when the bit sequence defined by the bits stored by the two or more FFs of the group does not belong to the set of allowed sequences.

[0020] Advantageously, the Hamming distance between two different sequences belonging to the set of allowed sequences is at least equal to two.

[0021] Advantageously, the set of allowed sequences comprises two sequences, the first sequence of the set being the complement of the second sequence of the set.

[0022] Advantageously, the one or more processing logic units configured to generate one or more bit sequences belonging to a set of allowed sequences include the two or more FFs configured to store the bit sequences, and one or more logic gates connected to generate a different bit sequence belonging to the set of allowed sequences in each clock cycle; the one or more processing logic units configured to generate a signal indicating the occurrence of a fault injection attack include one or more logic gates configured to perform a logical operation to generate a predefined signal when the bit sequence at the output of the two or more FFs configured to store the bit sequence does not belong to the set of allowed sequences.

[0023] Advantageously, at least one of the FFs has an input that is the complement of its output.

[0024] Advantageously, the cryptographic integrated circuit (IC) comprises at least one first FF, the output of which is connected to the input of at least one second FF and the input of a NOT logic gate, the output of which is connected to the input of the first FF.

[0025] Advantageously, the cryptographic integrated circuit (IC) includes: a first FF and a second FF for storing the bit sequence; a NOT logic gate; an XNOR (exclusive NOR) logic gate; wherein the output of the first FF is connected to the input of the NOT logic gate, to the input of the second FF, and to the first input of the second XNOR logic gate; the output of the NOT logic gate 411a is connected to the input of the first FF; the output of the second FF is connected to the second input of the XNOR logic gate; and the signal indicating the occurrence of a fault injection attack is the output of the XNOR logic gate that is equal to 1.

[0026] Advantageously, the cryptographic integrated circuit (IC) comprises a plurality of FFs connected on the same clock signal, the output of each of these FFs being respectively negated and connected to its input.

[0027] Advantageously, a cryptographic integrated circuit (IC) comprises: an error correction code encoder configured to generate one or more bit sequences, the group of allowed sequences comprising error-free codes; a group of FFs configured to store one or more bit sequences at the output of the error correction code encoder; an error correction code decoder configured to decode the codes stored in the group of FFs and generate a signal indicating the occurrence of a fault injection attack if the codes stored in the group of FFs comprise errors.

[0028] Advantageously, the error correction code is a Hamming code.

[0029] Advantageously, a cryptographic integrated circuit (IC) includes a security manager configured to modify an output of execution of a cryptographic algorithm in response to receiving a signal indicative of the occurrence of a fault injection attack.

[0030] Advantageously, the security manager is configured to count a total number of fault injections and, in response to receiving a signal indicative of the occurrence of a fault injection attack, modify an output of the execution of the cryptographic algorithm in dependence on the total number of fault injections.

[0031] Advantageously, the security manager is configured to disable the cryptographic integrated circuit (IC) if the total number of fault injections is higher than or equal to a predefined threshold.

[0032] Advantageously, the cryptographic integrated circuit (IC) further comprises one or more sensors configured to detect a global fault injection attack performed on the integrated circuit (IC).

[0033] Advantageously, the one or more sensors include at least one sensor selected from the group consisting of: an analog or digital light sensor configured to detect light or laser fault injection attacks; a voltmeter configured to detect fault injection attacks based on modification of the voltage of an integrated circuit (IC); a temperature sensor configured to detect fault injection attacks based on overheating of the integrated circuit (IC); a clock sensor configured to detect fault injection attacks based on modification of the clock of the integrated circuit (IC).

[0034] The present invention also discloses a method for detecting a fault injection attack performed on an integrated circuit (IC), wherein the integrated circuit (IC) includes a group of flip-flops (FF), wherein the method includes: generating one or more bit sequences belonging to a group of allowed sequences; storing the bit sequences in a group of said flip-flops (FF) including two or more flip-flops; if the bit sequence defined by the bits stored by the two or more FFs of the group does not belong to the group of allowed sequences, then generating a signal indicating the occurrence of a fault injection attack.

[0035] The present invention also discloses a computer program product for detecting a fault injection attack performed on an integrated circuit (IC), wherein the integrated circuit (IC) includes a group of flip-flops (FF), and the computer program product includes: a non-transitory computer-readable storage medium; and a program code stored on the non-transitory computer-readable storage medium, wherein the program code, when executed by one or more processors, causes the one or more processors to: generate one or more bit sequences belonging to a group of allowed sequences; store the bit sequences in a group of registers including two or more registers; and generate a signal indicating the occurrence of a fault injection attack if the bit sequence defined by the bits stored by the two or more registers of the group does not belong to the group of allowed sequences.

[0036] The present disclosure allows the areas of an integrated circuit to be protected to be accurately defined, and the level of protection to be quantified.

[0037] The present disclosure also allows determining the certification level of an IC, which characterizes the protection of the IC against fault injection attacks.

[0038] The present disclosure also provides a solution at a low cost while not requiring a calibration phase.

[0039] The present disclosure may be used in addition to other protection solutions.

[0040] Another advantage of various embodiments of the present disclosure is that they do not generate false positive alarms.

[0041] Furthermore, an attacker cannot detect whether an integrated circuit is protected by the present disclosure.

[0042] In the future, as the triggers are further miniaturized, while the constraints with respect to the laser wavelength remain the same, the probability that the laser beam will hit nearby triggers including mine triggers when hitting a sensitive trigger will also increase. Therefore, it can be expected that the level of protection provided by the present disclosure using a defined number of triggers will increase in the future. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The present invention will be better understood and its various features and advantages will become apparent through the following description of several exemplary embodiments and the accompanying drawings, in which:

[0044] Figure 1 Depicted are examples of cryptographic integrated circuits in several embodiments of the present invention;

[0045] Figure 2a and Figure 2b Depicted are two examples of positioning of triggers for a fault injection attack detection cluster in some embodiments of the present invention;

[0046] Figure 3a and Figure 3b Two block diagrams of a fault injection attack detection cluster in several embodiments of the present invention are respectively depicted;

[0047] Figure 4a , Figure 4b and Figure 4c Three examples of fault injection attack detection clusters in some embodiments of the present invention are respectively shown;

[0048] Figure 5 An example of a fault injection attack detection cluster using error correction codes in an embodiment of the present invention is depicted;

[0049] Figure 6a and Figure 6b Two examples of fault injection attack detection clusters using finite state machines in some embodiments of the present invention are respectively depicted;

[0050] Figure 7 Examples of fault injection attack detection methods in several embodiments of the present invention are shown. DETAILED DESCRIPTION

[0051] refer to Figure 1 , which shows an example of a cryptographic integrated circuit according to some embodiments related to the disclosed solution.

[0052] Integrated circuit (IC) 100 (also referred to as "cryptographic IC") is configured to implement cryptographic functions. IC 100 can be used in any application requiring cryptography. For example, IC 100 can be used to perform secure authentication or secure transactions.

[0053] IC 100 may be, for example, a SoC (System on Chip). However, the present invention may be embedded in other kinds of ICs such as a System in Package (SiP) or a System on Package (SoP).

[0054] The cryptographic IC 100 may include a processor 110, a cryptographic cluster 120 running a cryptographic algorithm, a fault injection attack detection cluster 130, and a security manager 140, and a bus 150 configured to ensure communication between the aforementioned components. The processor 110 may send a command to the cryptographic cluster 120 via the bus 150 to request that a key be used to encode a message. The security manager may be software running on a processor, for example, or may be an independent hardware cluster.

[0055] Both the cryptographic cluster 120 and the fault injection attack detection cluster 130 rely on calculations performed by flip-flops (FFs) of the IC. Fault injection attacks, and more specifically laser fault injection attacks, analyze fault results based on the injection of bit flips to FFs that execute cryptographic algorithms. According to some embodiments, the fault injection attack detection cluster 130 may include a group of two or more FFs. In addition, the fault injection attack detection cluster 130 may be configured to issue an alarm signal S indicating the occurrence of a fault injection attack if a bit represented by at least one FF in the group of FFs changes, for example, being hit by a laser beam during a laser fault injection attack. A Thus, the fault injection attack detection cluster 130 is adapted to detect any attack that relies on injecting faults into the FF using radiation injection, such as a laser fault injection attack, an optical fault injection attack, or an electromagnetic fault injection attack.

[0056] In response to the fault injection attack detection cluster 130 detecting the attack and issuing an alarm signal S A , the alarm signal may be sent to the security manager 140. The security manager 140 may be configured to respond to the alarm signal in different ways. The security manager 140 may be configured to modify the output of the cryptographic algorithm executed by the cryptographic cluster 120 so as not to transmit the failure result expected by the attacker. To achieve this effect, it is possible to simply not transmit any result, or to transmit a failure result (e.g., a random value). Accordingly, the current attack attempt fails. Transmitting the failure result advantageously convinces the attacker that the attack has not been detected.

[0057] According to embodiments of the present invention, the modification of the output of the cryptographic algorithm may be performed in different ways. For example, the execution of the cryptographic algorithm may be simply stopped. Alternatively, the result of the calculation may be confused / corrupted, or the security manager 140 may reset the IC 100.

[0058] During a fault injection attack, the attacker generally performs multiple consecutive fault injections to identify sensitive FFs that allow the secret key to be cracked. In some embodiments, the security manager 140 can be configured to use a counter to count the number of fault injections, for example, by incrementing the counter each time an alarm signal is received. Afterwards, the security manager 140 can adjust the response to the fault injection attack based on the number of fault injections that have been performed. For example, at the first fault injection, the execution of the cryptographic algorithm can be simply stopped or a random value can be sent as a result, while in the next injection, a stronger response can be performed, for example, if the number of detected fault injections corresponds to a predefined maximum number of fault injections, then the security manager 140 can explicitly disable IC 100. The security manager 140 can also be configured to temporarily disable IC 100 so that other attacks cannot be performed during a predefined amount of time. This amount of time can increase dramatically over time.

[0059] This allows tailoring of responses depending on the intensity of the attack. For example, the security manager 140 can be configured to disable the IC 100 only in the event of a severe attack performed by an experienced attacker being detected. However, the security manager 140 will ensure in all cases that in the event of a fault injection being detected, the attacker will not be able to analyze the fault results.

[0060] It should be noted that the present invention is not limited to such examples and encompasses any appropriate measures to prevent the attacker from obtaining fault results when a fault injection attack is detected.

[0061] Figure 2a and Figure 2b Two examples of trigger localization of a fault injection attack detection cluster according to some embodiments of the present invention are respectively depicted.

[0062] refer to Figure 2a , the cryptographic IC 100 is implemented in the form of a cryptographic IC 200a. Figure 2a Each of the circles shown in (eg, circle 210) represents an FF of the fault injection attack detection cluster 130. For example, FF 131 and FF 132 belong to the fault injection attack detection cluster 130. Figure 2a As can be seen in FIG. 1 , such FFs can be placed throughout the IC 200a. The FFs of the fault injection attack detection cluster 130 are also referred to as “laser mines” or “mines” below, because in the case of a laser attack, if the laser beam hits one of the FFs of the fault injection attack detection cluster 130, an alarm signal S will be generated. A , and the security manager 140 will cause the detection of the attack and the execution of appropriate actions.

[0063] Embodiments of the present invention advantageously allow quantification of the protection introduced to IC 200a in the event of a laser fault injection attack. More specifically, the protection ratio may be defined as:

[0064]

[0065] In Formula 1:

[0066] -N mine represents the number of laser mines, that is, the number of FFs of the fault injection attack detection cluster 130;

[0067] -N FF represents the total number of FFs of the IC cryptographic cluster 120;

[0068] -l represents the radius of the laser beam, which is at least equal to the wavelength of the laser beam;

[0069] -S represents the surface area of ​​FF.

[0070] Equation 1 can be interpreted as follows: When the attacker performs a laser fault injection attack, the attacker has no prior knowledge of the FFs used for cryptographic computation or fault injection detection (assuming the attacker even knows that IC 100 performs fault injection detection). The ratio of the surface area occupied by the mine FFs to the total surface area of ​​the FFs is Furthermore, the surface area hit by the laser beam depends on the wavelength of the laser beam and is equal to Because the laser beam hits a circle with a diameter equal to the laser wavelength. FF has a surface area equal to S. Therefore, each time the laser beam hits IC 200a, the laser beam will hit an average of FFs, where the probability of each FF being a mine is

[0071] Thus, the level of protection provided by various embodiments of the present invention can be measured according to the number of FFs used by the fault injection attack detection cluster 130. In addition, the present invention allows the area of ​​the protected circuit to be determined and the desired level of protection to be achieved by setting an appropriate level of laser mines. In some embodiments, it is possible to further enhance protection by placing laser mines relative to the most sensitive FFs of the cryptographic cluster 120 (i.e., the FFs that are the most critical FFs for cryptographic calculations) to increase the probability of detecting an attack in the event that a sensitive FF is hit. Specifically, such enhanced protection can be obtained by placing laser mines in the neighborhood of the most sensitive FFs of the cryptographic cluster 120.

[0072] Thus, quantification of the protection allows determining with a defined certainty the probability that each attempt will be detected. It is thus possible to prove the qualification of an IC against fault injection attacks.

[0073] Circle 220 represents the size of the area hit by the laser beam. Figure 2a As shown in , the size of circle 220 is larger than that of FF. This is due to the fact that the wavelength of the laser beam is generally equal to 800nm ​​for frontal attack and 1064nm for rear attack, while FF generally has an average height of about 400nm, which is much lower than the diameter of the circle hit by the laser beam. Thus, when the attacker hits the sensitive FF, the probability of hitting the neighboring mine is high.

[0074] It should be noted that the level of protection provided by embodiments of the present invention is expected to increase over time with the expected changes in FF sizing. For example, the average height of FFs is expected to decrease over time in the future, while the wavelength of the laser beam required to perform a laser fault injection attack is not expected to be modified. Therefore, as ICs and FFs are further miniaturized, it will become much more difficult for an attacker to hit a sensitive FF without hitting a nearby mine.

[0075] The advantages of the embodiments of the present invention are also that good protection is provided at low cost, and the cost of using FF as a mine is almost zero. In addition, it is almost impossible for an attacker to detect that the protection according to the embodiments of the present invention is used before the attack, because the FF belonging to the cryptographic cluster 120 cannot be distinguished from the FF belonging to the fault injection attack detection cluster 130. It is only possible to infer that the protection according to the present disclosure is used after the attack fails.

[0076] Furthermore, the fault injection attack detection cluster of the present invention advantageously does not require any calibration phase.

[0077] refer to Figure 2b , which illustrates another example of positioning of triggers of a fault injection attack detection cluster according to some embodiments.

[0078] exist Figure 2b , cryptographic IC 200b is similar to cryptographic IC 200a, but further includes a global attack detector 230b. Global attack detector 230b can be any detector that detects a global fault injection attack. A global fault injection attack is a fault injection attack that creates interference with the global parameters of the IC (such as voltage, clock, temperature, etc.). For example, global attack detector 230b can be a voltmeter, a temperature sensor, or a clock sensor. Thus, such a global attack detector can detect several global fault injection attacks (i.e., fault injection attacks that modify the behavior of the entire IC), such as attacks based on changes in power supply voltage, attacks based on modifications of clock frequency, attacks based on overheating, etc.

[0079] In response to detecting a global attack, the security manager 140 may modify the output of the cryptographic algorithm and / or the behavior of the IC based on the same principles as explained above. Accordingly, the method and system for detecting fault injection according to an embodiment of the present invention may be used in conjunction with any other fault injection attack countermeasures.

[0080] It should be noted that the present invention is not limited to the exemplary sensors listed above, and any sensor or combination of sensors suitable for globally detecting fault injection attacks may be used. More than one sensor and / or more than one type of sensor may be used. For example, IC 230b may include a voltage and temperature sensor; two light sensors in two different places, etc.

[0081] Figure 3a and Figure 3b Two block diagrams of a fault injection attack detection cluster in several embodiments of the present invention are respectively depicted.

[0082] Figure 3a A block diagram of a fault injection attack detection cluster according to an embodiment of the present invention is shown.

[0083] The fault injection attack detection cluster 300 may be incorporated into an integrated circuit, which may be part of the SoC 100, for example. Figure 2a and Figure 2b As indicated, the fault injection attack cluster 300 includes a plurality of FFs, which may be part of the FFs used by the cryptographic algorithm. Thus, some FFs may be used for both the cryptographic algorithm and the fault injection attack detection.

[0084] As shown in Fig. 3, the fault injection attack detection cluster 300 may include one or more sequence generation processing logic units 310, which are configured to generate one or more bit sequences belonging to a set of allowed sequences. According to various embodiments of the present invention, the processing logic unit may be any logic unit suitable for performing a calculation or operation based on an input, such as a logic gate, a flip-flop, a processor operating according to software instructions, a hardware configuration of a processor, or a combination thereof.

[0085] The one or more processing logic units 310 may be configured to generate a different bit sequence at each clock signal, for example, at a rising edge of a clock signal. The bit sequence generated by the one or more sequence generation processing logic units 310 belongs to a set of allowed sequences. Accordingly, if the sequence includes n bits, then all 2 n possible sequences or only a subset of them.

[0086] The present invention may use any suitable means that allow the generation of a bit sequence belonging to a set of allowed sequences. For example, a sequence may be generated according to a predefined set of allowed sequences.

[0087] The fault injection detection cluster 300 may further include a set of FFs 320, which includes two or more FFs 321, 322, to store the bit sequence generated by the one or more processing logic units 310. Figure 3a A group 320 comprising two FFs 321, 322 is shown to store a bit sequence, but those skilled in the art will readily recognize that more FFs may be used, the number of FFs being at least equal to the number of bits in the sequence. In some embodiments, the fault injection attack detection cluster may thus comprise a higher number of FFs.

[0088] The fault injection attack detection cluster 300 may further include one or more sequence check processing logic units 330 configured to detect whether the bit sequence defined by the bits stored by the group of FFs 320 belongs to the set of allowed sequences. If it does not belong to the set of allowed sequences, the sequence check processing logic unit 330 may be configured to generate a signal S indicating the occurrence of a fault injection attack. A .

[0089] As a result, if a fault injection attack does not occur, the bits stored by the FFs of the group of FFs 320 are not modified, and the sequence defined by them belongs to the group of allowed sequences. In contrast, if a fault injection attack occurs, such as a laser fault injection attack, and if the injection attack hits one of the FFs in the group of FFs 320 and changes the bits stored by the hit FF, the bit sequence defined by the FFs of the group of FFs 320 will no longer belong to the group of allowed sequences.

[0090] Therefore, the attack signal S will be generated only when a fault injection attack occurs. A . Thus, the present invention avoids false positives.

[0091] Thus, if at least one of the FFs of the set 320 is hit, embodiments of the present invention will make it possible to detect a fault injection attack, including any kind of radiation-based (laser, optical, electromagnetic) fault injection attack.

[0092] In some embodiments, the FF may be associated with an oscillator, for example, the oscillator may be created by coupling an FF controlled by the rising edge of a clock with an FF controlled by the falling edge of a clock, as proposed by Breier, J., Bhasin, S., & He, W. (2017, March), An electromagnetic fault injection sensor using Hogge phase-detector, Quality Electronic Design (ISQED), 2017 18th International Symposium, (pp. 307-312), IEEE. This improves the ability of the IC to detect electromagnetic fault injection.

[0093] In one embodiment, the Hamming distance between two different bit sequences in the set of allowed sequences is at least equal to the number of bits in the sequence. This means that any pair of bit sequences in the set of allowed sequences do not have any common bits. Thus, if a fault injection attack performs a bit flip of a single FF in the set 320, the resulting bit sequence will not likely belong to the set of allowed sequences. Therefore, the attack is required to hit at least two FFs in the cluster simultaneously to not be detected. Assuming that the attacker does not have any prior knowledge of the FFs belonging to the detection cluster (even if the attacker further recognizes that there is a fault injection attack detection cluster), the probability that the attacker hits two FFs to generate another bit sequence belonging to the set of allowed sequences is also extremely low. Thus, the present invention advantageously allows detection of any fault injection attack that hits at least one FF from the set of FFs 320.

[0094] It should be noted that the probability of having an undetected attack can be reduced by using a higher Hamming distance: for example, some sets of allowed sequences will require at least 3 FFs to be hit simultaneously for the attack to remain undetected, while others will require at least 4 FFs to be hit, and so on.

[0095] Therefore, in several embodiments of the present invention, the fault injection detection cluster includes at least 3 FFs, and the Hamming distance of a set of allowed sequences is at least 3. This means that in order for the attack to remain undetected, the attacker must hit at least 3 FFs in a synchronized manner. More generally, this introduces redundancy that makes the mine more resilient to higher levels of attack and greatly improves the system's ability to detect fault injection attacks.

[0096] It should also be noted that according to embodiments of the present invention, any appropriate means may be used to verify whether the bit sequence defined by the group of FFs 320 belongs to the group of allowed sequences. For example, one or more sequence check processing logic units 330 may be configured to verify whether the sequence belongs to a predefined set of allowed sequences. Alternatively, the allowed sequences may share certain characteristics, and one or more sequence check processing logic units 330 may verify whether these characteristics are met.

[0097] In several embodiments of the present invention, all FFs of group 320 are synchronized by the same clock signal. Therefore, their values ​​are updated substantially at the same time, and attacks can be detected without delay. For example, the value of the FF can be updated on the rising edge of the clock signal.

[0098] In several embodiments of the present invention, the clock signal is the same for all FFs of the circuit. In other embodiments of the present invention, the FFs of the fault injection detection cluster (e.g., FF 320) are synchronized on a clock different from the other FFs of the circuit. This allows the mine FFs to be synchronized on a clock with a frequency different from the other FFs. For example, the mine FFs can be synchronized on a clock with a higher frequency than the other FFs. Therefore, their values ​​are updated more frequently, and fault injection errors can be detected more quickly. At the same time, the clock frequency of the other FFs of the circuit is not increased, which prevents a significant increase in circuit energy consumption.

[0099] In several embodiments of the present invention, it is also possible to disable fault injection detection as needed to reduce the energy consumption of the circuit. For example, the mine FF can be disabled by a disable signal. Alternatively, if the mine FF is synchronized on a separate clock, clock gating can be used in a way that stops the execution of the operation of the FF by stopping the oscillation of the clock.

[0100] In several embodiments of the present invention, the FFs of the fault injection detection cluster (e.g., FF 320) may be powered with a lower voltage than other FFs. In effect, the FFs powered with a lower voltage are more sensitive to fault injection. As a result, the relative sensitivity of the mine FFs to laser attacks becomes higher than that of other FFs of the circuit, which improves their ability to detect attacks.

[0101] It is also possible to select a landmine FF to have a different type than the other FFs of the circuit. For example, the type of transistor used to make the FF has an effect on the behavior of the FF. For example, the landmine FF can be selected to have a low driver strength, i.e., the transition between the two states of the FF is slow. This increases the relative sensitivity of the landmine FF to fault injection attacks.

[0102] Figure 3b A block diagram of a fault injection attack detection cluster according to an embodiment of the present invention is shown.

[0103] In some embodiments of the present invention, the fault injection detection cluster 300 includes at least one processing logic unit 340 to store the alarm signal. Thus, when the alarm signal is issued, even if the FF 320 exhibits an allowed sequence in a subsequent iteration, the circuit still retains the information that the alarm has been issued: the alarm signal is thus latched and remains valid, even if the FF 320 exhibits an allowed sequence in a subsequent iteration.

[0104] The alarm signal can be locked in different ways. In one example, the alarm signal S A As the first input of the OR gate 341, the output of the OR gate is another FF 342. The output of the other FF 342 is connected to the second input of the OR gate 341. Therefore, when no alarm signal is issued, the alarm signal S A Both the FF 342 and the other FF 342 maintain the value "0". The other FF 342 outputs the latched alarm signal S AL , which in this case has a value of "0". Thus, the OR gate 341 has two "0" inputs and outputs "0", which will not modify the state of the other FF 342 until the first alarm signal is issued. If an alarm is issued, then the signal S A The output of the OR gate 341 also becomes 1, and at the next clock signal, the other FF 342 takes the value "1". Then, the output of the other FF 342 remains 1 because it acts as an input to the OR gate 341, so even if the FF 320 exhibits an enabling sequence and the alarm signal S A Returning to the value 0, the OR gate 341 always outputs "1". Therefore, even if the alarm signal S A Returns to value 0, locks the alarm signal S AL Also remains at 1. Thus, the alarm signal is sufficient to lock the value of this other FF to 1 and save the information that an alarm has been issued.

[0105] The other FF 342 may also receive a clock signal 343, which may be the same as the clock signal provided to the FF 320, and may receive a reset signal 344, which may be used to reset the value of the other FF 342 to 0, thereby unlocking the signal.

[0106] Figure 4a to Figure 4c as well as Figure 5 An exemplary generation of allowed sequences using either automatically occurring sequences or error correction codes is depicted.

[0107] Figure 4a , Figure 4b and Figure 4c Three examples of fault injection attack detection clusters according to some embodiments are respectively shown.

[0108] In several embodiments of the present invention, the fault injection detection cluster includes at least one FF whose output is negated and then connected to its input. This allows the generation of a substitute signal whose value changes between 0 and 1 at each clock signal without requiring any input. Later, this substitute signal can be used as an input to other FFs and / or an input to a processing logic unit to generate an alarm signal.

[0109] This allows the mine to be independent of any input. For example, this allows the mine to be placed at a location in the circuit where a digital input is not available. It also uses FFs for both generating and storing the allowed bit sequences, so fewer FFs are required for the fault injection detection cluster.

[0110] Figure 4a , Figure 4b and Figure 4c Examples of such fault injection detection clusters are provided. However, they are provided only for example, and other fault injection detection clusters can be defined with the aid of such FFs that autonomously establish signal oscillations at each clock cycle.

[0111] In several embodiments of the present invention, the output of such an FF generating an oscillating signal is provided as input to at least one other FF of the fault injection detection cluster. Thus, a bit sequence can be autonomously generated and stored on multiple FFs without external input.

[0112] Such a design also has robustness relative to compiler optimization. In fact, ICs (e.g., IC 100) are often designed using high-level languages. High-level design provides many advantages: it makes IC design easier and faster. It also allows high-level verification of the circuit to be performed, for example, verification that the target function of the circuit is fulfilled or that the target timing is met. The compiler of the high-level language also performs optimization of the circuit, thereby (for example) removing redundancy. The fault injection cluster design containing such FFs that generate oscillating signals provides the advantage of being robust relative to compiler optimization: the compiler will detect that each FF is intended to exhibit different values ​​on each clock. On the other hand, a circuit in which different FFs receive the same external input (the purpose of which is to introduce redundancy to detect whether one of the two FFs has been attacked) may be subject to compiler optimization that is not desired to occur when the compiler detects and removes the redundancy.

[0113] Therefore, in a fault injection detection cluster design, the output of a first FF is negated and provided as an input of the first FF to generate an oscillating signal, and the output of the first FF is provided as an input to at least one other FF. Such a fault injection detection cluster design provides the following advantages: it allows the fault injection detection cluster to be placed anywhere in the circuit independently of the presence of digital inputs, while allowing the use of a high-level language compiler and being robust against undesirable compiler optimizations.

[0114] More specifically, Figure 4a A first example of a fault injection attack detection cluster according to one embodiment is shown. Figure 4a As shown in FIG. 4 , the fault attack detection cluster 400 a is formed by two FFs 421 a and 422 a , a NOT logic gate 411 a , and an XNOR logic gate 430 a .

[0115] The output of the first FF 421a is connected to the input of the second FF 422a and to the input of the NOT logic gate 411a. The output of the NOT logic gate 411a is connected to the input of the first FF 421a. The outputs of the first FF 421a and the second FF 422a are connected to the inputs of the XNOR logic gate 430a, respectively.

[0116] FF 421a and FF 422a are synchronized by a clock. The clock may be the same clock as the clock used to run the cryptographic algorithm, or may be a different clock. At each clock signal, for example, on the rising edge of the clock signal, each FF may take on the value present at its input and then send such a value as an output. Thus, the combination of FFs and logic gates automatically generates a bit sequence at each clock signal based on the previous sequence.

[0117] It should be pointed out that:

[0118] -FF 421a and NOT logic gate 411a form a processing logic unit 410a, which is configured to generate a bit sequence (also called a "sequencer");

[0119] -FF 421a and FF 422a are FF 420a for storing a bit sequence;

[0120] - XNOR logic gate 430a is a processing logic unit configured to generate a signal (S) indicating that a fault injection attack has occurred if the bit sequence defined by the bits stored by FF 420a does not belong to the set of allowed sequences. A ).

[0121] Thus, FF 421a is used to generate (in conjunction with NOT logic gate 411a) and store bit sequences simultaneously. Such a design is advantageous in that it provides a low-cost solution for generating and storing bit sequences. As noted above, this allows the generation of an oscillating input signal that serves as the basis for the set of allowed sequences without the need for external input.

[0122] In connection with the bit sequences generated by the fault attack detection cluster without and with a fault injection attack, the following bit values ​​are defined on consecutive clock signals:

[0123] - value 441a at the output of the first FF 421a, the input of the second FF 422a and the input of the XNOR logic gate 430a, which is also the value stored by FF 421a;

[0124] - value 442a at the input of the first FF 421a, which thus corresponds to applying the NOT logic gate 411a to the bit value 441a;

[0125] - value 443a at the output of FF 422a and the input of XNOR logic gate 430a, which is also the value stored by FF 422a;

[0126] - Value 444a at the output of XNOR logic gate 430a.

[0127] In the absence of a fault injection attack, the bit values ​​at successive clock cycles may include:

[0128] Clock cycle Place value 441a Place value 442a Place value 443a Place value 444a 1 0 1 1 0 2 1 0 0 0 3 0 1 1 0 4 1 0 0 0

[0129] Table 1 – Bit sequence at successive clock cycles without attack

[0130] As shown in Table 1, if the attack is not performed, the sequence formed by the bits stored by FF 421a and 422a is always (1,0) or (0,1). Such two sequences form an allowed sequence, where the Hamming distance is equal to 2. XNOR logic gate 430a is configured to receive such a value as input and always output a value 444a equal to 0 when the bit value (441a, 443a) stored in the FF belongs to the allowed sequence.

[0131] Assuming that a fault injection attack is performed on the first FF 421a at cycle 3, for example, by using a laser fault injection attack, the bit stored by the FF 421a flips to 1, and the value of the bit includes:

[0132] Table 2 - Bit sequence at successive clock cycles when attacking FF 421a at the third cycle

[0133] In cycle 3, the bit sequence thus becomes (1,1), which is not part of the allowed sequence. The bit value 444a at the output of XNOR gate 430a becomes 1 instead of 0, thereby indicating that a fault injection attack has occurred.

[0134] Assuming that a fault injection attack is performed on the second FF 422a at cycle 3, for example, by using a laser fault injection attack, the bit stored by the FF 422a flips to 0, and the value of the bit includes:

[0135]

[0136]

[0137] Table 3 - Bit sequence at successive clock cycles when attacking FF 422a at the third cycle

[0138] In cycle 3, the bit sequence thus becomes (0,0), which is not part of the allowed sequence. The bit value 444a at the output of XNOR gate 430a also becomes 1 instead of 0, thereby indicating that a fault injection attack has occurred.

[0139] Such an example shows that if one of FF 421a or FF 422a is hit by a fault injection attack, then the bit value 444a must become 1 instead of 0. Therefore, the bit value 444a equal to 1 is a signal S indicating that a fault injection attack has been performed. A .

[0140] The fault injection attack detection cluster according to such embodiments provides many advantages, including but not limited to the following advantages:

[0141] - it does not produce false alarms: in the absence of fault injection in bit values ​​441a or 443a, bit value 444a is always 0;

[0142] - It forms a low-cost solution without the need to operate large sensors;

[0143] - It does not require any calibration phase;

[0144] -FFs 421a and 422a may be interleaved with FFs used to run cryptographic algorithms; therefore, it is impossible for an attacker to know the FFs used for cryptography or attack detection, or even to identify whether some FFs are used for attack detection;

[0145] - If any of the two FFs 421a and 422a is hit by a fault injection (in this example,

[0146] If 444a=1), an alarm signal S will be issued A; If two FFs are hit simultaneously, the attack may eventually remain undetected, although the probability of such a situation is very low;

[0147] -Multiple fault injection attack detection clusters (e.g., cluster 400a) can be placed in an IC, and their outputs can be combined into a single alarm, for example by combining using an OR gate. Thus, a global signal alarm can be issued, which will indicate whether any FF of the fault injection attack detection cluster has been hit, regardless of its number. This allows setting the expected number of mine FFs for detecting fault injection attacks. Laser fault injection attacks require a certain number of preliminary attacks to be performed to identify the most sensitive FFs. Thus, the number of mine FFs can be defined to have a high probability that the attacker will hit at least one mine FF during the calibration phase of the attack.

[0148] Figure 4b A second example of a fault injection attack detection cluster according to some embodiments is shown. Cluster 400b is similar to cluster 400a, but has a higher number of components including the following components: - a group 420b consisting of three FFs 421b, 422b and 423b for storing a 3-bit sequence;

[0149] - a processing logic unit 410b configured to generate one or more bit sequences belonging to a set of allowed sequences, comprising a FF 421b and a first NOT gate 411b;

[0150] - A group 430b consisting of a processing logic unit configured to generate a signal (S) indicating the occurrence of a fault injection attack if the bit sequence defined by the bits stored in two or more FFs of the group does not belong to the allowed sequence of the group; A ), and the group 430b includes a second NOT gate 431b, a NOR gate 432b, an AND gate 433b and an XNOR gate 434a.

[0151] The components of the cluster are interconnected as follows:

[0152] - the output of the first FF 421b is connected to the input of the first NOT gate 411b, the input of the second NOT gate 432b, the input of the second FF 422b, and the input of the third FF 423b;

[0153] - The output of the first NOT gate 431b is connected to the input of the first FF 421b;

[0154] - the output of the second FF 422b is connected to the input of the NOR gate 432b and the input of the AND gate 433b;

[0155] - the output of the second NOT gate 431 b is connected to the input of the NOR gate 432 b and to the input of the AND gate 433 b;

[0156] - the output of the third FF 423b is connected to the input of the NOR gate 432a and the input of the AND gate 433b;

[0157] The output of the -NOR gate 432a and the output of the AND gate 433b are connected to the input of the XNOR gate 434b.

[0158] Thus, a bit sequence is generated at each clock cycle. In the absence or with fault injection attack, the following bit values ​​in this cluster will be verified at each clock cycle:

[0159] - the value 441b at the output of the first FF 421b (which is also the value stored by the FF 421b, and the values ​​at the inputs of the first and second NOT gates 411b and 431b, the second and third FFs 422b and 423b);

[0160] - the value 442b at the output of the first NOT gate 411b and the input of the first FF 421b;

[0161] - the value 443b at the output of the second FF 422b, the NOR gate 432b and the input of the AND gate 433b, which is also the value stored by the second FF 422b;

[0162] - value 444b at the output of the second NOT gate 431b, the NOR gate 432a and the input of the AND gate 433b;

[0163] - the value 445b at the output of the third FF 423b, the NOR gate 432a and the input of the AND gate 433b, which is also the value stored by the third FF 423b;

[0164] - the output of NOR gate 432b and the value 446b at the input of XNOR gate 434b;

[0165] - the output of AND gate 433b and the value 447b at the input of XNOR gate 434b;

[0166] - Value 448b at the output of XNOR gate 434b.

[0167] Thus in the absence of an attack, the bit values ​​take the following values ​​at successive clock cycles:

[0168] Clock cycle Bit 441b Bit 442b Bit 443b Bit 444b Bit 445b Bit 446b Bit 447b Bit 448b 1 0 1 1 1 1 0 1 0 2 1 0 0 0 0 1 0 0 3 0 1 1 1 1 0 1 0 4 1 0 0 0 0 1 0 0

[0169] Table 4 – Bit sequence at successive clock cycles without attack

[0170] It should be noted that in the absence of an attack, the sequence formed by bits (441b, 443b, 445b) belongs to a set of two complementary allowed sequences (0, 1, 1) and (1, 0, 0). The Hamming distance between these two allowed sequences is 3. If these allowed sequences are met, bit 448b is always equal to 0.

[0171] In the case where the first FF 421b, the second FF 422b, and the third FF 423b are subjected to a fault injection attack at the third cycle, the sequence becomes accordingly:

[0172] Clock cycle Bit 441b Bit 442b Bit 443b Bit 444b Bit 445b Bit 446b Bit 447b Bit 448b 1 0 1 1 1 1 0 1 0 2 1 0 0 0 0 1 0 0 3 1 0 1 0 1 0 0 1

[0173] Table 5 - Bit sequence at successive clock cycles with attack on first FF 421b at cycle 3

[0174]

[0175]

[0176] Table 6 - Bit sequence at successive clock cycles with attack on second FF 422b at cycle 3

[0177] Clock cycle Bit 441b Bit 442b Bit 443b Bit 444b Bit 445b Bit 446b Bit 447b Bit 448b 1 0 1 1 1 1 0 1 0 2 1 0 0 0 0 1 0 0 3 0 1 1 1 0 0 0 1

[0178] Table 7 - Bit sequence at successive clock cycles with attack on third FF 423b at cycle 3

[0179] Accordingly, in each possible attack, the bit sequence (441b, 443b, 445b) does not belong to the set of allowed sequences and the bit 448b takes the value 1, which is the alarm signal S A In order to go undetected, the attack would need to hit FFs 421b, 422b, and 423b simultaneously, which is almost impossible because it would require performing a synchronized fault injection attack using three laser beams and attacking the three FFs 421b, 422b, and 423b simultaneously without prior knowledge of the FFs used for cryptography or attack detection.

[0180] Figure 4c A third example of a fault injection attack detection cluster in accordance with some embodiments is shown.

[0181] In several embodiments of the present invention, the fault injection detection cluster includes a plurality of FFs connected on the same clock signal, the output of each of these FFs being respectively negated and connected to its input. Thus, each FF of the fault injection detection cluster independently generates a signal oscillating between 0 and 1 at each clock cycle. The set of allowed sequences thus includes only two allowed sequences, the first allowed sequence being the complement of the second allowed sequence. If one of the FFs of the fault injection detection cluster is hit, the entire sequence will no longer belong to one of the two allowed sequences. This situation can be detected, for example, using a combination of logic gates on the output of the FF to issue an alarm signal.

[0182] This design offers many advantages:

[0183] - No external input signal is required, provided that each FF generates its own oscillating input;

[0184] - The Hamming distance of the set of allowed sequences is equal to the number of FFs in the fault injection cluster. Thus, the fault injection detection cluster can be customized to ensure that the target complexity level of the detected attack is met;

[0185] -When an FF is hit by an attack, its value keeps oscillating in each subsequent clock cycle. Therefore, in subsequent cycles, its value will remain out of sync with the values ​​of other FFs of the fault injection detection cluster, and the alarm signal will remain valid;

[0186] - Assuming that the FFs are synchronized in the same clock signal, they will be permanently synchronized on one of the two allowed sequences, unless one of the FFs is hit by an attack. Since the outputs of the FFs can be combined using logic gates to detect whether they exhibit one of the two allowed sequences, the attack can be detected without delay: the combination of the outputs of the FFs signals an alarm as early as when one of the FFs is hit by an attack. Thus, the alarm 449c is issued in less than one clock cycle.

[0187] Figure 4c Cluster 400c is shown, which is provided by way of example only as a cluster comprising a plurality of FFs connected on the same clock signal, the output of each of these FFs having its input negated and connected to its input, respectively.

[0188] Cluster 400c includes the following components:

[0189] - A group 420c consisting of four FFs 421c, 422c, 423c and 424c storing a 4-bit sequence;

[0190] - A processing logic unit 410c, which is configured to generate one or more bit sequences belonging to a set of allowed sequences, and includes four FFs 421c, 422c, 423c and 424c, a first NOT gate 412c and a second NOT gate 414c. The bit at the output of the first FF 421c is the inverted 411c, and the bit at the output of the third FF 423c is the inverted 413c, that is, the bits output by the FFs 421c and 423c are the inverted bits stored. Since the outputs of the FFs 421c and 423c are connected to their respective

[0191] The input of the FF 421c and the FF 423c is thus inverted at each clock cycle; a group 430c consisting of processing logic units, which is configured to generate a signal indicating the occurrence of a fault injection attack when the bit sequence defined by the bits stored by two or more FFs of the group 420c does not belong to the group of allowed sequences (S A ), and includes a first XNOR gate 431c, a second XNOR gate 433c and an OR gate 432c.

[0192] The components of the cluster are interconnected as follows:

[0193] - Due to the inversion 411c, the output of the first FF 421c is the inversion of the value stored in the first FF 421c, and it is connected to the input of the first FF 421c and the first XNOR gate 431c;

[0194] - the output of the second FF 422c is connected to the inputs of the first NOT gate 412c and the first XNOR gate 431c;

[0195] - Due to the inversion 413c, the output of the third FF 423c is the inversion of the value stored in the third FF 423c, and it is connected to the input of the third FF 423c and the second XNOR gate 433c;

[0196] - the output of the fourth FF 424c is connected to the input of the second NOT gate 414c and the second XNOR gate 433c;

[0197] - The output of the first NOT gate 412c is connected to the input of the second FF 422c;

[0198] - the output of the second NOT gate 414c is connected to the input of the fourth FF 424c;

[0199] - The outputs of the first XNOR gate 431c and the second XNOR gate 433c are connected to the inputs of the OR gate 432c.

[0200] Thus, a bit sequence is generated at each clock cycle. The following bit values ​​in this cluster will be verified at each clock cycle without or with a fault injection attack:

[0201] - the value 441c at the output of the first FF 421c (which is also the inverse of the value stored by the FF 421c and the value at the input of the first FF 411c and the first XNOR gate 431c);

[0202] - the output of the first NOT gate 412c and the value 442c at the input of the second FF 422c;

[0203] - The value 443c at the output and input of the third FF 423c. Thus, the value 443c is the inverse of the value stored in the third FF 423c;

[0204] - the value 444c at the output of the second NOT gate 414c and the input of the fourth FF 424c;

[0205] - the value 445c at the output of the second FF 422c and the input of the XNOR gate 431c;

[0206] - a value 446c at the output of the fourth FF 424c, the input of the second NOT gate 414c and the input of the second XNOR gate 433c;

[0207] - the output of the first XNOR gate 431 c and the value 447 c at the input of the OR gate 432 c;

[0208] - the output of the second XNOR gate 433c and the value 448c at the input of the AND gate 432c;

[0209] - Value 449c at the output of AND gate 432c.

[0210] Thus in the absence of an attack, the bit values ​​take the following values ​​at successive clock cycles:

[0211] Clock cycle Bit 441c Bit 442c Bit 443c Bit 444c Bit 445c Bit 446c Bit 447c Bit 448c Position 449c 1 1 1 1 1 0 0 0 0 0 2 0 0 0 0 1 1 0 0 0 3 1 1 1 1 0 0 0 0 0 4 0 0 0 0 1 1 0 0 0 5 1 1 1 1 0 0 0 0 0

[0212] Table 8 – Bit sequence at successive clock cycles without attack

[0213] For simplicity, the bit sequence is defined as the bits (441c, 443c, 445c, 446c) at the outputs of the four FFs, although the bits 445c and 446c at the outputs of the second FF 422c and the fourth FF 424c are actually the inverse of the bits stored within the FFs.

[0214] It should be noted that in the absence of an attack, the sequence formed by bits (441c, 443c, 445c, 446c) belongs to a set of two complementary allowed sequences: (1, 1, 0, 0) and (0, 0, 1, 1). The Hamming distance between these two allowed sequences is 4. If these allowed sequences are met, bit 449b is always equal to 0.

[0215] In the case where the first FF 421c, the second FF 422c, the third FF 423c and the fourth FF 424c are attacked by fault injection at the third cycle, the sequence becomes accordingly:

[0216] Clock cycle Bit 441c Bit 442c Bit 443c Bit 444c Bit 445c Bit 446c Bit 447c Bit 448c Position 449c 1 1 1 1 1 0 0 0 0 0 2 0 0 0 0 1 1 0 0 0 3 0 1 1 1 0 0 1 0 1 4 1 0 0 0 1 1 1 0 1 5 0 1 1 1 0 0 1 0 1

[0217] Table 9 - Bit sequence at successive clock cycles in the presence of an attack on the first FF 421c at cycle 3

[0218] Clock cycle Bit 441c Bit 442c Bit 443c Bit 444c Bit 445c Bit 446c Bit 447c Bit 448c Bit 449c 1 1 1 1 1 0 0 0 0 0 2 0 0 0 0 1 1 0 0 0 3 1 0 1 1 1 0 1 0 1 4 0 0 0 0 0 1 1 0 1 5 1 0 1 1 1 0 1 0 1

[0219] Table 10 - Bit sequence at successive clock cycles in the presence of an attack on the second FF 422c at cycle 3

[0220]

[0221]

[0222] Table 11 - Bit sequence at successive clock cycles in the presence of an attack on the third FF 423c at cycle 3

[0223] Clock cycle Bit 441c Bit 442c Bit 443c Bit 444c Bit 445c Bit 446c Bit 447c Bit 448c Position 449c 1 1 1 1 1 0 0 0 0 0 2 0 0 0 0 1 1 0 0 0 3 1 1 1 0 0 1 0 1 1 4 0 0 0 0 1 0 0 1 1 5 1 1 1 0 0 1 0 1 1

[0224] Table 12 - Bit sequence at successive clock cycles in the presence of an attack on the fourth FF 424c at cycle 3

[0225] Accordingly, in each possible attack, the bit sequence (441c, 443c, 445c, 446c) does not belong to the set of allowed sequences and the bit 449c takes the value 1, which is the alarm signal S A . The attack would need to hit FFs 421c, 422c, 423c, and 424c simultaneously in order to go undetected, which is almost impossible because it would require performing a synchronized fault injection attack using four laser beams and attacking four FFs 421c, 422c, 423c, and 424c simultaneously without prior knowledge of the FFs used for cryptography or attack detection.

[0226] As noted above, once an FF is hit, an alarm will be sounded without delay. In addition, the value of the hit FF in subsequent cycles remains asynchronous with other FFs, and the alarm signal remains triggered at each clock cycle. Those skilled in the art can define a combination of logic gates for each combination of possible allowed sequences to test whether the FF exhibits one of the two possible allowed sequences.

[0227] The cluster 400c is provided by way of example only as a cluster comprising a plurality of FFs connected together on the same clock signal, each of which has its output negated and connected to its input, respectively. Other clusters of the same type with different numbers of FFs may be defined. For example, FFs 421c, 422c may be combined with logic gates 411c, 412c, 431c to act as a fault injection detection cluster with two FFs, and if one of the two FFs 421c, 422c is hit, the signal 447c takes the value 1.

[0228] It should be pointed out that Figure 4a to Figure 4c is a non-limiting example, which is provided to illustrate the generation of a bit sequence belonging to a set of allowed sequences, and to illustrate the use of logic gates to verify whether a sequence belongs to the set of allowed sequences, and then to verify whether a fault injection attack is performed, according to an embodiment of the present invention.

[0229] Those skilled in the art will readily appreciate that the present invention encompasses other fault attack detection clusters of the same type that use a combination of FFs and / or logic gates to perform automatic generation and verification of sequences.

[0230] Advantageously, the set of allowed sequences may comprise only two allowed sequences, the first sequence of the set being the complement of the second sequence of the set, e.g. Figure 4a to Figure 4c Thus, in such an embodiment, the Hamming distance between two allowed sequences is equal to the number of bits in the sequence (i.e., the number of FFs), and an alarm can be raised if any FF is hit, and the attack will not be detected only if all FFs are hit simultaneously, which is extremely unlikely even with a set of two FFs, and becomes almost impossible as the number of FFs increases.

[0231] Such a kind of fault attack detection cluster can advantageously include at least one FF whose input is the complement of its output at each cycle. At each clock cycle, the bits stored in the FF are updated to take the value of its input, which advantageously provides a simple and efficient way to change the value stored in the FF at each clock cycle (for example, FF421a, 421b, 421c, 422c, 423c and 424c is the case).

[0232] Although the signal S indicating the occurrence of an attack is defined by an output bit equal to 1 in the above description of some embodiments, A , but it should be noted that the present invention is not limited to such a definition and covers any suitable A Definition of .

[0233] Figure 5 An example of a fault injection detection cluster using error correction codes according to an embodiment of the present invention is depicted.

[0234] like Figure 5 As shown in , the cluster 500 receives as input a group of four bits 501. The three bits 501 of the group are processed by a Hamming encoder (7,4) 510, which adds 3 redundant bits and encodes the four bits of the group onto 7 bits stored respectively on 7 FFs 520. The output of the FF 520 is processed by a Hamming decoder (7,4): if the attack is not performed, no error is found in the bits stored by the FF 520, and a group of bits 502 equivalent to the bits 501 of the group is sent as output.

[0235] In contrast, if a fault injection attack is performed, causing a bit flip in any FF in the group 520 of FFs, the Hamming decoding will detect that an error has occurred and issue an alarm signal S A .

[0236] Due to the redundancy introduced by the Hamming decoder, the attack will not be detected unless at least four FFs of group 520 are hit, which is almost impossible as mentioned above. The size of the input / output bit group and / or the number of redundant bits can be set to define the Hamming distance of the sequence generated by the Hamming encoder.

[0237] exist Figure 5 In the example:

[0238] - The Hamming encoder 510 generates a bit sequence belonging to a set of allowed sequences (i.e., sequences for which no errors were found);

[0239] - Group 520 of FFs stores said bit sequence;

[0240] - If at least one of the FFs of group 520 is hit by a fault injection attack, causing a bit flip,

[0241] Then the stored sequence will no longer belong to the set of allowed sequences;

[0242] - The Hamming decoder 530 detects whether there is an error in the code defined by the bit sequence stored in the set of FFs 520. If there is an error, then the bit sequence stored in the set of FFs 520 does not belong to the set of allowed sequences, a fault injection attack has been performed, and an alarm signal S is issued.A .

[0243] Although the fault injection attack detection cluster according to the present invention is implemented using a Hamming encoder and decoder, it should be noted that the present invention is not limited to such an implementation and any suitable error correction code may be used instead of the Hamming code.

[0244] also, Figure 5 The embodiment provides the advantage that the input and output signals 501, 502 can advantageously be part of a cryptographic algorithm. Thus, the group of FFs 520 can be used to store bit data used by cryptographic processing. The size of the input 501, output 502 and the group of FFs 520 can also be modified, and thus the number of redundant bits can also be modified.

[0245] Other embodiments are also available. For example, if a circuit is used to generate a state machine defined by multiple binary values ​​(which only take a subset of possible values), then the values ​​defining the states of the state machine can be provided as inputs to the FF, and a test can be performed to see if the FF exhibits one of the possible states of the state machine. Thus, the calculations performed by the circuit can be reused as inputs to the mine FF.

[0246] Figure 6a and Figure 6b Two examples of fault injection attack detection clusters using finite state machines according to some embodiments of the present invention are respectively depicted.

[0247] exist Figure 6a In , the IC is configured to use a FSM 610 as part of the calculations performed by the IC, which is configured to switch between three states 611a, 612a and 613a. These states are defined by the values ​​of two FFs. The three defined states correspond to the values ​​"0,1", "0,0" and "1,0", respectively. In several embodiments of the present invention, another FF is added to the FSM 610, and the values ​​of the possible states are enriched by parity bits. Therefore, the FSM 610 is transformed into a FSM 620a, and the three states 611a, 612a and 613a are respectively transformed into three states 621a, 622a and 623a, which correspond to the values ​​"0,1,0", "0,0,1" and "1,0,0", respectively. Therefore, in each case, the value of the third bit corresponds to the parity bit, and the value of the third bit is equal to 1 if the sum of the two other bits is an even number, and the value of the third bit is equal to 0 if the sum of the two other bits is an uneven number. Thus, whenever the value of one of the two other bits changes, the value of the parity bit is updated and will be equal to the associated parity bit unless a fault injection attack hits one of the FFs. Thus, doing so allows checking whether an attack has occurred while using the calculations currently being performed by the IC.

[0248] In other words and using the general structure of Figure 3, in this example, the state portion 320 is a merger between a functional state machine (e.g., a three-state machine with states 00, 01, 10) and only one additional FF for the mine. This is added to extend the state encoding by a parity check, so the states are now encoded as 001, 010, and 100, which have the property that in any sequence of transitions between states, the check module 330 will see a Hamming weight of one word. Any deviation indicates a fault injection, and an alarm will be raised.

[0249] exist Figure 6b In , the same principle is used, except that FSM 610 is transformed into FSM 620b, which has two parity bits instead of one: the states 611 and 613 with the sum of the bits and an even number are transformed into states 621b and 623b with two additional "0" bits, respectively. At the same time, the state 612 with the sum of the bits equal to 0 is split into two states 6221b, 6222b, which have an additional bit "1" and "0". Therefore, for each of these two states, there is a "1" parity bit in the absence of an attack, and this feature can be checked to sound an alarm. Here, it is again using the existing calculations of the IC to detect an attack. In addition, the addition of the second parity bit makes the detection even more sensitive, because there are more chances of hitting a FF.

[0250] In other words, the state machine may get stuck in a given state (e.g., state 00) for a long period of time. Therefore, it is also possible to replicate such a state into two states that are equal and alternate when the logic unit calculates that no functional state transition is necessary. The resulting encoding can still enjoy the property of Hamming weight one, at the cost of adding one more FF in the mine. Now, every transition at every clock cycle is valid, and the states are identical (0010 and 0001), plus the two functional states 0100 and 1000.

[0251] The invention is provided only by way of example. Figure 4a to Figure 4c as well as Figure 5 , Figure 6a and Figure 6b More generally, the invention is applicable to any kind of generation of a sequence belonging to a set of allowed sequences, using a FF to store said sequence, and detecting whether the FF exhibits one of the allowed sequences.

[0252] It should be noted that multiple clusters may be used and combined, and / or multiple alarms may be combined into a single alarm (eg, using an OR gate), such that the combined alarm signal is activated if at least one cluster is hit by an attack.

[0253] Figure 7 Methods of detecting fault injection attacks according to some embodiments of the invention are described.

[0254] The method (block 700) comprises a first step 710 of generating one or more bit sequences belonging to a set of allowed sequences.

[0255] In step 720, the bit sequence is stored in a set of flip-flops including two or more flip-flops.

[0256] In step 730, if the bit sequence defined by the bits stored by the two or more FFs of the group does not belong to the set of allowed sequences, a signal S is generated. A , signal S A Indicates that a fault injection attack has occurred.

[0257] The method 700 may further include a verification step 731 , which verifies whether the bit sequence stored in the FF belongs to an allowed sequence, and if so, proceeds to step 730 .

[0258] refer to Figure 4a to Figure 4c as well as Figure 5 The described embodiments may be implemented by method 700 , respectively.

[0259] The present invention may also be implemented as a computer program configured to perform cryptographic operations. Such a computer program may be vulnerable to fault injection attacks if an attacker attacks the registers storing bit values ​​used for cryptographic operations. Figure 4a to Figure 4c as well as Figure 5 The described embodiments may each be implemented by a computer program to detect fault injection attacks on registers storing bit values ​​used for cryptographic operations.

[0260] The program code embodied in such a computer program can be distributed as a program product in a variety of different forms, either individually or collectively. Specifically, such program code can be distributed using a computer-readable storage medium having computer-readable program instructions stored thereon, which are used to cause a processor to perform various aspects of an embodiment of the present invention.

[0261] In some alternative embodiments, the functions, actions and / or operations specified in the flow chart, sequence diagram and / or block diagram can be reordered, serially processed and / or processed in parallel to meet embodiments of the present invention. In addition, any of these flow charts, sequence diagrams and / or block diagrams may include more or less blocks than illustrated to meet embodiments of the present invention.

[0262] Although the entirety of the invention has been illustrated by the description of various embodiments, and although these embodiments have been described in considerable detail, it is not the intention of the applicant to restrict or limit the scope of the appended claims in any way to such detail. Additional advantages and modifications will be apparent to those skilled in the art.

Claims

1. A cryptographic integrated circuit (IC) (100, 200a, 200b, 300, 400a, 400b, 400c, 500) configured to detect a fault injection attack, the cryptographic integrated circuit (IC) comprising: - one or more processing logic units (310, 410a, 410b, 410c, 510) configured to generate one or more bit sequences belonging to a set of allowed sequences, the set of allowed sequences being a predefined set of sequences or a set of sequences sharing a characteristic generated by the one or more processing logic units; - a set of flip-flops (FF) (320, 420a, 420b, 420c, 520) comprising two or more flip-flops configured to store the bit sequence; - configured to check whether a bit sequence defined by bits stored by said two or more FFs of said group belongs to said set of allowed sequences, and to generate a signal indicating the occurrence of a fault injection attack if said bit sequence does not belong to said set of allowed sequences (S A ), The cryptographic integrated circuit (IC) includes at least one first FF (421a, 421b), and the output of the at least one first FF is connected to the input of at least one second FF (422a, 422b, 422c).

2. The cryptographic integrated circuit (IC) according to claim 1, wherein: A Hamming distance between two different sequences generated by the one or more processing logic units (310, 410a, 410b, 410c, 510) and belonging to the set of allowed sequences is at least equal to two.

3. The cryptographic integrated circuit (IC) according to claim 2, wherein: The set of allowed sequences includes two sequences, a first sequence of the set being the complement of a second sequence of the set.

4. A cryptographic integrated circuit (IC) (400a, 400b, 400c) according to one of claims 1 to 3, wherein: - the one or more processing logic units configured to generate one or more bit sequences belonging to a set of allowed sequences include the two or more FFs configured to store the bit sequences, and one or more logic gates (411a, 411b, 412c, 414c), the one or more logic gates being connected to generate a different bit sequence belonging to the set of allowed sequences at each clock cycle; - configured to generate a signal indicating the occurrence of a fault injection attack (S A ) includes one or more logic gates (430a, 431b, 432b, 433b, 434b, 431c, 432c, 433c), and the one or more logic gates (430a, 431b, 432b, 433b, 434b, 431c, 432c, 433c) are configured to perform a logic operation to generate a predefined signal when the bit sequence at the output of the two or more FFs configured to store the bit sequence does not belong to the set of allowed sequences.

5. The cryptographic integrated circuit (IC) according to claim 4, wherein: At least one of the FFs has its input the complement of its output.

6. The cryptographic integrated circuit (IC) according to claim 1, wherein: The output of the at least one first FF (421a, 421b) is connected to the input of a NOT logic gate (411a, 411b), and the output of the NOT logic gate is connected to the input of the first FF (421a, 421b).

7. The cryptographic integrated circuit (IC) according to claim 6, comprising: - a first FF (421a) and a second FF (422a) for storing the bit sequence; - NOT logic gate (411a); - XNOR logic gate (430a); in: - the output of the first FF (421a) is connected to the input of the NOT logic gate (411a), to the input of the second FF (422a), and to the first input of the XNOR logic gate (430a); - the output of the NOT logic gate (411a) is connected to the input of the first FF (421a); - the output of the second FF (422a) is connected to the second input of the XNOR logic gate (430a); -Signal indicating the occurrence of a fault injection attack (S A ) is the output of the XNOR logic gate (444a) equal to 1.

8. The cryptographic integrated circuit (IC) according to claim 1, comprising a plurality of FFs (421c, 422c, 423c, 424c) connected on the same clock signal, the output of each of the FFs being respectively negated and connected to its input.

9. The cryptographic integrated circuit (IC) (500) according to any one of claims 1 or 2, comprising: - an error correction code encoder (510) configured to generate the one or more bit sequences belonging to a set of allowed sequences, the set of allowed sequences comprising error-free codes; - a set of FFs (520) configured to store the one or more bit sequences at the output of the error correction code encoder; - an error correction code decoder (530) configured to decode the code stored in the set of FFs (520) and to generate a signal (S) indicating the occurrence of a fault injection attack if the code stored in the set of FFs includes an error A ).

10. The cryptographic integrated circuit (IC) according to claim 9, wherein: The error correction code is a Hamming code.

11. The cryptographic integrated circuit (IC) of claim 1 , comprising a circuit configured to respond to receiving a signal (S A ) to modify the output of the execution of the cryptographic algorithm.

12. The cryptographic integrated circuit (IC) according to claim 11, wherein: The security manager is configured to count a total number of fault injections and respond to receiving a signal indicating the occurrence of a fault injection attack based on the total number of fault injections. A ) to modify the output of the execution of the cryptographic algorithm.

13. The cryptographic integrated circuit (IC) according to claim 12, wherein: The security manager is configured to disable the cryptographic integrated circuit (IC) if the total number of fault injections is higher than or equal to a predefined threshold.

14. The cryptographic integrated circuit (IC) (200b) according to claim 1, wherein: It further includes one or more sensors (230b) configured to detect a global fault injection attack performed on the integrated circuit (IC).

15. The cryptographic integrated circuit (IC) according to claim 14, wherein: The one or more sensors include at least one sensor selected from the group consisting of: -Analog or digital optical sensors configured to detect optical or laser fault injection attacks; - a voltage meter configured to detect a fault injection attack based on a modification of a voltage of said integrated circuit (IC); - a temperature sensor configured to detect a fault injection attack based on overheating of the integrated circuit (IC); - a clock sensor configured to detect a fault injection attack based on a modification of a clock of said integrated circuit (IC).

16. A method (700) for detecting a fault injection attack performed on an integrated circuit (IC) (100, 200a, 200b, 300, 400a, 400b, 400c, 500), the integrated circuit (IC) comprising a set of flip-flops (FF), wherein: The method comprises: - generating (710) one or more bit sequences belonging to a set of allowed sequences, the set of allowed sequences being a predefined set of sequences or a set of sequences sharing a characteristic; - storing (720) said bit sequence in a set of said flip-flops (FF), said set of flip-flops comprising two or more flip-flops; - if the bit sequence defined by the bits stored by the two or more FFs of the group does not belong to the set of allowed sequences, generating a signal indicating the occurrence of a fault injection attack (S A ), The integrated circuit (IC) includes a cryptographic integrated circuit (IC), which includes at least one first FF (421a, 421b), and the output of the at least one first FF is connected to the input of at least one second FF (422a, 422b, 422c).

17. A computer program product for detecting a fault injection attack performed on an integrated circuit (IC) (100, 200a, 200b, 300, 400a, 400b, 400c, 500), the integrated circuit (IC) comprising a set of flip-flops (FF), the computer program product comprising: a non-transitory computer-readable storage medium; as well as program code stored on the non-transitory computer readable storage medium, which, when executed by one or more processors, causes the one or more processors to: - generating one or more bit sequences belonging to a set of allowed sequences, the set of allowed sequences being a predefined set of sequences or a set of sequences sharing a characteristic; - storing the bit sequence in a set of registers comprising two or more registers; - if the bit sequence defined by the bits stored by the two or more registers of the group does not belong to the set of allowed sequences, generating a signal indicating the occurrence of a fault injection attack (S A ), The integrated circuit (IC) includes a cryptographic integrated circuit (IC), which includes at least one first FF (421a, 421b), and the output of the at least one first FF is connected to the input of at least one second FF (422a, 422b, 422c).

Images