Circuits configured to monitor sensitive payloads

Abstract

An embodiment provides a circuit for monitoring a circuit payload, comprising: a plurality of sensors, the plurality of sensors being distributed in the circuit, close to a predefined circuit payload; one or more memory cells, the one or more memory cells being associated with the one or more sensors, the one or more memory cells being configured to store sensor measurements made by the one or more associated sensors every p clock cycles; wherein the circuit is configured to read the sensor measurements stored in at least some of the memory cells. Embodiments include: use of digital sensors or analog sensors coupled to digital converters; use of FIFO type memory cells, adjustment of the depth of the memory cells; use of a finite state machine configured to enable the circuit to receive sensor measurements; use of a data obfuscation and / or reduction module; use of a signature circuit; use of a circuit configured to determine one or more attacks based on the sensor measurements.

Description

Technical Field

[0001] The present invention relates generally to computer security and, more particularly, to methods and systems for monitoring circuits. Background Art

[0002] For many years, computer security has represented the main challenge of modern computerized systems, devices or digital circuits. Such systems or devices are constantly threatened by increasingly sophisticated attacks. This has led to a continuous increase in the complexity of computer security. At the same time, the applications of computer science continue to expand, for example, in the field of the Internet of Things, which involves new interactions between devices and introduces vulnerabilities.

[0003] Integrated circuits (e.g., smart cards, microprocessors, ASICs (short for Application Specific Integrated Circuits), or FPGAs (short for Field Programmable Gate Arrays)) are particularly susceptible to attacks. A circuit may include one or more sensitive parts (blocks, IP, etc.) called "payloads" that need to be protected or include sensitive data. The circuit payload may implement one or more cryptographic mechanisms to ensure security, authentication, protection, and / or privacy of data. An attacker willing to access sensitive assets from the circuit payload may use various types of attacks that, when successful, may result in the disclosure of sensitive assets such as keys, the failure of one or more sensitive functions, or the failure of access control policies that may result in access being granted without the correct credentials.

[0004] There are various solutions for protecting circuits. However, such solutions are either dedicated to a given type of attack performed on the circuit considered as a whole, or only enable the detection of attacks a posteriori, i.e. after the attack has been performed. In particular, they do not enable sufficient advance monitoring of sensitive circuit payloads to prevent attacks.

[0005] Therefore, there is a need for improved methods and systems for monitoring sensitive circuit payloads. Summary of the invention

[0006] A circuit for monitoring a circuit payload is provided, comprising:

[0007] - a plurality of sensors, the plurality of sensors being distributed in the circuit in proximity to a predefined circuit payload, the sensors being configured to provide measurements related to an environment of the circuit; one or more memory cells, the one or more memory cells being associated with the one or more sensors, the one or more memory cells being configured to store sensor measurements made by the one or more associated sensors every p clock cycles; wherein the circuit is configured to read the sensor measurements stored in at least some of the memory cells.

[0008] Examples include:

[0009] - the use of digital sensors or analog sensors coupled with digital converters; and / or

[0010] - Use of FIFO type memory cells, adjustment of the depth of the memory cells; and / or

[0011] - use of a finite state machine configured to cause the circuit to read sensor measurements every p clock cycles or during q out of p cycles; and / or

[0012] - Data obfuscation and / or reduction module usage; and / or

[0013] - use of a signature circuit; and / or

[0014] - Use of circuitry configured to determine one or more attacks based on sensor measurements.

[0015] Embodiments of the present invention present various advantages in various technical fields, including but not limited to: privacy, intelligence, finance (transactions, trade, etc.), government applications (e.g., passports, ID cards, driver's licenses, etc.), military applications (e.g., drones, remote sensors, etc.), transportation and logistics, protection of critical networks in energy, utilities, oil and gas, traffic regulations (e.g., airplanes, trains, cars, etc.), medical applications, communications (e.g., Internet of Things, machine-to-machine, data or voice communications), security (e.g., building or area access).

[0016] Embodiments of the present invention may be advantageously used in a wide range of communications and data processing applications, for example, in automotive industry applications to ensure anti-theft protection, in service provider systems to protect access cards, in RFID tags and electronic keys, in mobile phone devices to authenticate control and access to batteries and accessories, in the manufacture of embedded devices and equipment to provide protection of hardware and software algorithms to prevent cloning, in the banking industry to protect bank accounts and financial transactions, and the like. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate various embodiments of the invention and, together with the general description of the invention given above and the detailed description of the embodiments given below, serve to explain embodiments of the invention.

[0018] Figure 1 The general architecture of a monitored circuit according to different embodiments of the invention is shown.

[0019] Figure 2 An exemplary distribution of sensors monitoring the payload is shown.

[0020] Figures 3 to 6 Examples of recorded p and q cycles are shown. DETAILED DESCRIPTION

[0021] In order to facilitate the understanding of the following description of some embodiments, some terms used in this document are defined below.

[0022] A "sensor" (or "sensing unit") may be an analog sensor coupled to a digital converter and / or a "digital sensor". In some embodiments, only analog sensors (alongside an analog-to-digital converter) may be used. In alternative embodiments, only digital sensors may be used. In other embodiments, both analog and digital sensors may be used.

[0023] In some embodiments, at least one “sensor” may also be a “logical sensor.” Such a logical unit / logical sensor may wait for a security monitoring module (software and / or hardware) inside or outside the operating system (OS) to issue some security events (e.g., those recorded in “ / var / log / dmesg” under GNU / Linux OS).

[0024] In an embodiment, the "sensor" may include an analog sensor coupled to an analog / digital converter. Thus, commercially available sensors may be used. For example, an illuminating laser sensor may be used. In another example, a magnetic sensor may be used.

[0025] In an embodiment, the sensor may be a "passive" sensor. The passive nature of the sensor indicates that a measurement is taken from the environment, but there is no interaction with that environment to establish specific conditions before the measurement. In contrast, other types of sensors may require active interaction with the environment. Examples of such active sensors are: turning the power off and then on in the case of a RAM-PUF, or turning off a light in the case of a camera sensor, or moving from one physical location to another in the case of a linear accelerometer sensor. The passive nature enables the sensor to take measurements at any time without any external constraints.

[0026] In an embodiment, a sensor may communicate its measurements without even requiring a request. In an embodiment, a sensor outputs its measurements "continuously." In an embodiment, a sensor outputs one or more measurements of an environment "intermittently."

[0027] The sensor may be molded into, integrated with, coupled to, attached to, associated with, glued to, released from, or not released from a target circuit being monitored or under surveillance.

[0028] In an embodiment, the "sensing unit" may include a group of "digital sensors", the group of "digital sensors" including at least two sensors, the sensors are arranged in parallel, each "digital sensor" provides a digitized bit output having a binary value, and the "sensing unit" is configured to deliver at least one binary vector including a multi-bit value, the multi-bit value including at least two bit outputs provided by the group of digital sensors.

[0029] In an embodiment, a "digital sensor" may include one or more memory elements interconnected by a combination unit. The memory element may be configured to store input values, intermediate values, and / or output values. The combination standard unit is configured to calculate a value to be stored in the next memory element, using the signal stored in the previous memory element as an input value. The combination standard unit may include a memoryless logic gate, which may implement a Boolean function such as an inverter, an OR, an AND, an XOR. Other combination standard units may include a buffer, whose function is to amplify and / or delay some data paths.

[0030] As used herein, a "digital sensor" may include a set of n binary digital sensors arranged in parallel and providing a multi-bit output (multivariable output) comprising a set of bits.

[0031] A "digital sensor" may include a digital circuit having an input memory element for storing reference data, a data path for propagating the reference data, and an output memory element for storing data propagated through the data path. If the reference data correctly reaches the output memory element from the input memory element in the time it is sampled (i.e., in less than one clock cycle), the calculation may be considered successful. Such a digital sensor may detect abnormal operating conditions or operating conditions that exceed the specification. For example, if the temperature increases above a given threshold, the propagation delay of the combinational gates in the digital sensor data path will increase to a point where the data arrives at the output memory element after the rising edge of the clock. Such a late arrival may cause a fault state of the output memory element relative to the reference signal. This fault state may be detected by comparing the values ​​in the memory element that are further used to generate an alarm.

[0032] This digital sensor architecture advantageously addresses setup time violations. Setup time violations are a common source of faulty computations in digital circuits and are one of the common techniques used by attackers to perform fault injection. Setup time violations may occur because the propagation delay in the data path is so long that the modification cannot propagate and stabilize early enough before the rising edge of the clock.

[0033] The digital sensor alarm threshold may be statically determined during the design phase. Alternatively, the digital sensor alarm threshold may be dynamically selected by software and / or hardware at runtime. In some embodiments, a calibration device may calibrate a digital sensor configured to protect a payload or target digital circuit fed by a clock signal having a clock period by triggering an alarm according to a trigger condition associated with the clock period and an optimal alarm threshold, the optimal alarm threshold being determined by minimizing an amount that depends on the probability of occurrence of a false alarm and the probability of occurrence of a missed alarm. In an embodiment, the probability of a missed alarm may be determined based on the probability density of a critical path propagation delay of the target digital circuit and the probability density of the alarm threshold.

[0034] "Memories" (or memory cells) can be of different types. Memory cells can be volatile, or even a combination of both volatile and non-volatile memory cells can be used. Volatile memory can use one or more of RAM, DRAM (e.g., DDR SDRAM), SRAM, T-RAM, and Z-RAM. Using volatile memory generally presents the advantage of improved read / write performance and has lower cost / footprint compared to non-volatile writable memory. In an embodiment, one or more memory cells can use 3D XPoint, CBRAM, SONOS, RRAM, Racetrack memory, NRAM, Millipede memory, FJG RAM.

[0035] The memory units may be distributed or may take the form of a (macro) "shared memory".

[0036] In one embodiment, the memory unit is of the "First In First Out (FIFO)" type. FIFO specifies a method for organizing and manipulating a data buffer, in which the oldest (first) entry or "head" of the queue is processed first. It is similar to processing a queue with a first-come, first-served FCFS behavior. Physically, a finite state machine (FSM) can simulate a FIFO mechanism. In its hardware form, a FIFO mainly includes a set of read and write pointers, a storage device, and a control logic. The storage device can be a static random access memory (SRAM), a trigger, a latch, or any other suitable form of storage device. A dual-port SRAM can be used, in which one port is dedicated to writing and the other port is dedicated to reading. In some embodiments, a synchronous FIFO (a FIFO in which the same clock is used for both reading and writing) can be used. In some embodiments, an asynchronous FIFO (different clocks for reading and writing) can be used. For example, an asynchronous FIFO can use Gray code (or any unit distance code) as a read and write pointer to ensure reliable flag generation (pointer arithmetic or leaky bucket method). Examples of FIFO status flags include: full, empty, almost full, almost empty, etc. However, in some embodiments, other queuing systems other than FIFO can be used. For example, "priority queuing" can be used.

[0037] As used herein, a "circuit" or "module" is a hardware circuit or subcircuit. Any hardware can be encoded in software, and vice versa. Advantages of hardware embodiments include the fact that the circuits are less susceptible to interception and attack because they are all "internal". Advantages of software include the fact that they can reduce silicon surface (encoded in software) and that they can be upgraded after manufacturing.

[0038] A "signature" is an ID that can be used as a secret (not stored, but retrievable and replayable).

[0039] As used herein, a "payload" (or "target digital circuit") specifies a circuit or part of a circuit (e.g., such as a circuit block or circuit IP) that is "sensitive" or otherwise to be protected. For example, a payload may include an encryption unit or cipher (e.g., AES), a memory, a bus, a given microelectronic component, etc. The granularity of the payload may vary from "atomic" hardware to macroblocks designed and sold in a foundry. The payload may specifically be a "cryptographic accelerator" (e.g., an entire cryptographic component) or a computing unit for a dedicated cryptographic operation. The payload may be a memory that stores sensitive data, such as encryption keys, access IDs, certificates, amounts, etc. In the context of a security system, a payload may be an input from a specific sensor or an output to a specific activator that handles human safety or industrial expensive goods. The payload may specify any embedded device or system that manipulates and / or incorporates secret data and / or requires a level of integrity, such as a smart card, a security device, a multimedia player, a recorder, or a mobile storage device such as a memory card and a hard disk. The circuit payload may implement one or more cryptographic mechanisms to ensure the security, authentication, protection, and / or privacy of data. More generally, payload may specify any cargo that needs to be protected from prying eyes or alteration.

[0040] As used herein, the term "finite state machine", abbreviated as FSM, specifies a mathematical model for designing the calculation of both computer programs (i.e., software) and sequential logic circuits (i.e., hardware). Embodiments of the present invention may be specifically in software, or specifically in hardware, or a combination of software and hardware embodiments. In digital circuits, FSM can be constructed using programmable logic devices, programmable logic controllers, logic gates, and triggers or relays. According to an embodiment, FSM may be a Moore machine or a Mealy machine. In a Moore machine, FSM uses only entry actions, i.e., the output depends only on the state. The advantage of the Moore model is that the behavior of FSM is simplified. In an embodiment, FSM may be a Mealy machine. In a Mealy machine, FSM uses only input actions, i.e., the output depends on the input and the state. The use of Mealy FSM often leads to a reduction in the number of states. In an embodiment, FSM may be a UML (abbreviation for Unified Modeling Language) machine. Finite state machine FSM may be in one of a finite number of states. Finite state machine FSM can only be in one state at a time. At any given time, the state in which it is located is referred to as the "current" state. A finite state machine FSM can change from one state to another (a "transition") when initiated by a triggering event or condition. A specific finite state machine FSM is defined by a list of its states and by the triggering conditions for each transition. A state machine can be represented by a state transition table or list or diagram, showing the corresponding new state or "output state" for each state. It can also be represented by a directed graph known as a state diagram. Each state can be represented by a node (circle), while an edge (arrow) can show the transition from one state to another. More generally, in this specification, the expression "finite state machine" or "finite state machine FSM" can be replaced by "controller".

[0041] The "memory" can be modified by FSM to a FIFO type memory. The "memory" can also be named "register".

[0042] Marked as T clk The "clock cycle" or F clk The "clock rate" statement refers to the clock of the circuit being monitored, which may be integrated into a larger environment (e.g., 1333 MHz). clk The "clock period" of F is the duration of the elementary or atomic time step. The clock period and clock rate are related by the following relationship: clk =1 / T clk Clock rate generally refers to the frequency at which a circuit operates. It is typically measured in clock cycles per second, or its equivalent, in Hertz (Hz), kilohertz (kHz), megahertz (MHz), or gigahertz (GHz).

[0043] refer to Figure 1 , a circuit 100 for monitoring a circuit payload is shown, comprising: a plurality of sensors 101, 102, 103, the plurality of sensors 101, 102, 103 being distributed in the circuit, close to a predefined circuit payload 1, 2; one or more memory cells (111, 112, 113) associated with the one or more sensors, the one or more memory cells (111, 112, 113) being configured to store sensor measurements made by the one or more associated sensors every p clock cycles. The circuit is configured to read the sensor measurements stored in the memory cells.

[0044] As used herein, the expression "close to" (or "proximate to") encompasses arrangements in which the sensor may be located in, on, above, under, within, adjacent to, proximate to, or near a circuit payload.

[0045] In one embodiment, the sensors (101, 102, 103) may be digital sensors or analog sensors coupled with digital converters.

[0046] In one embodiment, the memory unit may be of FIFO type.

[0047] In some embodiments, one or more of the memory units may be FIFO (First In First Out) memory units. In other embodiments, other "priority queuing" mechanisms may be used (assuming that the measurements originating from the sensors are time stamped).

[0048] The depth M of the memory cell can be a function of the predefined computing operations performed in the monitored circuit payload. In some embodiments, the memory depth can be adjusted as a function of the type of sensitive computing operations to be performed. In an embodiment, the depth M of the memory cell can be configurable. Each, or all or some of the depths can be configurable, while other depths can be predefined. In some embodiments, one or more depths can be configurable (a finite state machine can be used). Contemporary hardware can mix invariant circuits with reprogrammable circuits (ASIC / FPGA). Therefore, different memory cell parts of the monitoring circuit according to the present invention can also be configured.

[0049] In some embodiments, the respective depths of the memory cells may be predefined (e.g., through expertise, an operator may place a particular value for the depth of a memory cell close to a payload known to be of a particular type); in other words, once designed, the depth of the memory cell may generally be set. However, in some other embodiments, one or more depths may be configurable (and in fact configured, e.g., via RAM settings, cycle depth, etc.).

[0050] In some embodiments, all memory cells may have the same depth M. In some embodiments, each memory cell may be adjusted in depth / size, for example, as a function of the duration of execution of a given payload. Sizing may allow for a minimum or optimal amount of memory to reduce gate cost on an ASIC or memory block allocation on an FPGA. In some embodiments, the memory cells may have different predefined depths (i.e., M1, M2, ... Mn; e.g., 15 memory cells at depth 1, 3 memory cells at depth 10, and one memory cell at depth 99).

[0051] In one embodiment, the circuit may also include a finite state machine or FSM configured to cause the circuit 100 to read the sensor's measurement every p clock cycles.

[0052] In one embodiment, a sensor can write in its associated memory cell, and another circuit (e.g., a signature block) can read the contents of that memory cell. This can be directed by a FSM that specifies software and / or hardware embodiments. In an embodiment, the FSM can be a hardware circuit. In another embodiment, the FSM can be soft-coded. In yet another embodiment, both software and hardware can be used.

[0053] In some embodiments, the circuit may further include another finite state machine or FSM configured to cause the circuit 130 to read the sensor's measurements during q of the p cycles.

[0054] More generally, one or more FSMs can apply a predefined temporal pattern of sensor data retrieval. For example, a sequence could be:

[0055] [1,0,0,5,0,0,0,0,0,80]: [collect during 1 cycle, collect nothing during 2 cycles, collect during 5 cycles, collect nothing during 5 cycles, collect during 80 cycles].

[0056] In one embodiment, p and / or q may be configurable.

[0057] The number p and q can be selected according to different criteria. For example, p and q can be selected to save energy while achieving full resolution monitoring. For example, because AES encryption performs 10 clock cycles for AES128 bits, the sensor is required to react quickly (e.g., p=1, q>=10).

[0058] In general, data freshness decreases rapidly, and there is generally no interest in long-term storage of sensor data. By adjusting N, M, P, and Q, the described monitoring system can advantageously cover more or less payload (number of sensors) in a space, can be reactive or proactive (depending on the operation or pre-planned, etc.).

[0059] In an embodiment, the arrangement in space of the sensors and memory cells is configured to optimize the gate count level of the circuit floorplan.

[0060] In an embodiment, one or more sensors and / or one or more memory units are interconnected via a single bus or multiple local buses.

[0061] All sensors may be interconnected in a topology with a bus (single point of failure). In one embodiment, each (one) sensor may be associated with its own (one) memory unit. In one embodiment, a sensor may be associated with one or more memory units. In another embodiment, one or more sensors may be associated with one memory unit. In one embodiment, one or more sensors may be associated with one memory unit.

[0062] In some embodiments, one or more memory units may take the form of a shared memory unit that is accessed in parallel by one or more sensors.

[0063] In some embodiments, the circuit further includes a data obfuscation module configured to obfuscate data originating from the one or more memory cells.

[0064] In an embodiment, the circuit further comprises a data reduction module configured to filter and / or reduce data originating from the one or more sensors.

[0065] Advantages include reduced wires if the modules are reduced (in space) close to the sensor, and / or reduced gate count if the modules are reduced (in space) close to the memory cell.

[0066] In an embodiment, one or more sensors and / or one or more memory cells are reprogrammable. In some embodiments, one or more sensors and / orOne or more memory cells may be writable, volatile (or non-volatile if the write operation can be performed in one clock cycle), reprogrammable (customizable in size; as in an FPGA).

[0067] In one embodiment, the payload inherently integrates one or more sensors and / or one or more memory units and / or one or more data reduction modules and / or one or more data obfuscation modules.

[0068] In one embodiment, one or more sensors and / or one or more memory units and / or one or more data reduction modules and / or one or more data obfuscation modules may be implemented by FPGA circuits (in contrast, ASIC circuits cannot be reprogrammed). In particular, by upgrading the configuration, a digital sensor may be a DS, which may be added in the FPGA component. This implies that the PUF function may be added to a product after the product is produced or even after it is sold.

[0069] In one embodiment, the arrangement according to the invention may be added to an existing payload or circuit: deposited, glued, attached, associated, etc.

[0070] The attachment may be definitive or temporary, for example, the arrangement may be releasable or detachable (eg, flexible electronics).

[0071] In one embodiment, the arrangement according to the invention is reconfigurable. The parameters of the reconfiguration (e.g., triggering facts or events) include the nature of the attack, the sensitive operations to be performed, and the continuous optimization of the "coverage" of the (possibly changing) payload by multiple sensors and memory units.

[0072] In one embodiment, the sensor and / or memory unit may be moved by itself or may be displaced onto the circuit or payload (eg, using MEMS or other types of actuators), thereby continuously optimizing coverage or placement of the payload.

[0073] In one embodiment, the circuit further includes a signature circuit 130 configured to determine one or more signatures from the sensor measurements.

[0074] In one embodiment, the circuit may constitute an "autonomous" physically unclonable function. The described circuit may in fact provide an "autonomous" system that exhibits the characteristics and properties of a PUF. As used herein, the term "autonomous system" refers to a system that does not require external specific excitation other than the excitation measured by a set of sensors (the circuit according to the invention continuously provides data that can be determined to be constant in a unique signature). It should be noted that it is not necessary to reveal the signature, as the circuit may output a stream of values ​​and the signature circuit 130 may be activated from time to time (to verify the signature of the circuit 100).

[0075] The circuit design is compatible with complex challenge response pair (CPR) embodiments: it can handle "challenges" that are punctual and so defined. For example, in one embodiment, the circuit can be challenged by an external human challenge (e.g., a challenge submitted via 199 in CPU 131). Such challenges can be conditionally received and then applied (if predefined conditions are met). For example, if a scan is detected (e.g., too many attempts, wrong range, etc.), the "PUF-like" circuit can silence or return a fake response.

[0076] In other words, instead of directly revealing its own PUF ID, a challenge-response protocol may be defined on top of the described embodiments of circuit 100 / 1000 / 10000 in order to prevent (or inhibit or prevent or inhibit) public disclosure of that ID (secret ID). For example, the protocol may include a step of identifying a given device (embedded in a circuit according to the present invention) from a remote server.

[0077] In another example, a zero-knowledge protocol may be implemented (e.g., a server may be identified by a circuit according to the present invention, with both the server and the device retaining a secret). In addition, data communication may be allowed or denied. In one embodiment, the PUFID may be a vector Vi. The challenge may correspond to a vector Vc of values ​​and a scalar Sc, and the response may correspond to a scalar Rs. The response may use intermediate values ​​D and Pc to generate Rs. D may be the distance between D=d(Vc-Vi), where d is the distance between the vectors. In such an embodiment, Pc=f(D)-Sc, where f is a function that transforms a vector into a scalar, and Rs=g(D, Pc), where g is a nonlinear function that transforms a vector into a scalar (g may be a parameter function modified by the scalar Pc). For mutual authentication, two consecutive challenges may be linked by the Pc value. For example, a server may send two challenges with the same Pc, thereby proving that it knows the entire vector Vi. Many other schemes or protocols may be designed.

[0078] like Figure 1 As shown in , the circuit may further include a circuit 140 configured to determine one or more attacks based on the sensor measurements.

[0079] The attack scenario may be known or predefined. Various comparisons of values ​​(outliers or excessive values) or other detection of attack patterns (e.g., using one or more thresholds, statistical or probabilistic methods) may result in the determination of an attack among multiple predefined attacks. Machine learning may be used.

[0080] A method for determining a signature or monitoring a circuit payload is also provided, the circuit comprising: a plurality of sensors (101, 102, 103), the plurality of sensors (101, 102, 103) being distributed in the circuit close to a predefined circuit payload (1, 2); one or more memory units (111, 112, 113) associated with the one or more sensors, the one or more memory units (111, 112, 113) being configured to store sensor measurements made by the one or more associated sensors every p clock cycles. The method comprises the following steps:

[0081] - reading sensor measurements stored in a memory unit; and

[0082] - determining a signature based on sensor measurements; and / or

[0083] -Determining one or more attacks on the payload based on the sensor measurements.

[0084] There is also provided a computer program product comprising instructions for carrying out the steps of this method when the computer program is executed on a computer device.

[0085] Figure 1 More specifically shown is payload 1 to be protected or otherwise monitored. Other payloads (eg, 2) may be present and may be similarly monitored (eg, by an orchestration or decision logic unit not shown).

[0086] Monitoring circuit 100 may include a plurality of sensors (e.g., 101, 102, 103) distributed in the circuit, in, on, around, or adjacent to a circuit payload, and one or more memory cells (e.g., 111, 112, 113) associated with one or more sensors. Monitoring circuit 100 may be configured to output sensor measurements ("measurements") stored in the memory cells every p clock cycles.

[0087] A collection of sensors globally reacts to (local and / or global) stresses or changes in the environment (e.g., temperature, electrostatic discharge, changes in voltage, modifications of clock cycles, electromagnetic environmental conditions, laser beams, crystal contraction from phonons (high frequency acoustic wave particles), piezoelectric effects, back-side free electron injection applied to a sub-portion of the circuit, etc.). As a result, if an attack is performed, at least a subset of the sensors will "react", meaning that their measurements or values ​​will drift or be otherwise modified. This collective behavior can be the subject of machine learning (downstream of the present invention). Prior to such a posteriori analysis, the data stream originating from the sensors / probes can be used to derive a signature and / or implement a computer security attack.

[0088] Depending on the embodiment, the topology or morphology of the association between the memory cells and the sensors may vary. Generally, 1 to U memory cells may be associated with 1 to T sensors (i.e., 1-T, U-1, UT). In some embodiments, the memory cells may be located in the vicinity of their associated sensors (advantages include reduction of silicon surface, harder to eavesdrop on, and optimized energy consumption).

[0089] In an embodiment, a FIFO memory unit may be used, wherein each sensor is associated with its own FIFO memory unit. In an embodiment, one or more sensors may share one or more memory units. In some embodiments, memory units may be shared. Alternatively, a single memory unit may be used.

[0090] In a particular embodiment, in order to save silicon surface (or to obtain better surface / power consumption), different modules (ie, circuits) may be placed in different ways.

[0091] One type of module may perform data reduction between the sensor and the memory unit. For example, a data reduction module (or block or unit) 121 may reduce or compress or otherwise filter the bit stream output by the sensor 101. In doing so, the memory unit (or block or module) 111 may process less but more important data.

[0092] The data reduction module and the memory cell can be placed according to three main approaches. In fact, a "sensor module" according to the present invention may include three blocks: a "sensing block" (or "sensor"), an optional data reduction block, and a memory block or cell. Depending on the placement constraints and the silicon area cost (wiring cost), three placement patterns can be used to place these three blocks on the floorplan.

[0093] The sensing portion may advantageously be placed close to the sensitive modules to protect the payload. However, it should be noted that the data reduction block and the memory block do not need to be close to the sensing block.

[0094] The three placement modes include:

[0095] 1. "Integrated" embodiment: the three blocks are gathered in a single block. Although the design process according to this first placement mode may seem easier, this may occupy a large position close to the payload.

[0096] 2. "Reduced wiring" embodiment: the sensing blocks and data reduction blocks are clustered together, while the memory blocks can be placed with fewer constraints, for example, at a certain distance.

[0097] 3. A "compact" embodiment, where only the sense block is placed close to the payload, while the data reduction block and memory block can be placed elsewhere. Since the sense block is separate from the other blocks and is generally smaller than the other blocks, it can be easily placed closer to the payload or even inside the payload. The remaining cost is all the signal wires routed to the data reduction block and the memory block.

[0098] Another type of module may include a data obfuscation module 122. As used herein, "obfuscation" refers to the operation of obfuscating or confusing data (generally intentionally) by permuting, reordering, or otherwise rearranging data. The obfuscation mechanism may include one or more Boolean-type logic gates. A symmetric deobfuscation module 1314 may perform the reverse operation(s) and make the data clear. Such obfuscation / deobfuscation may advantageously defeat eavesdropping on data transmitted in the circuit. Such operations may help improve the security of the monitoring circuit 100 because they are less complex and confusing than encryption / decryption.

[0099] Cycle time

[0100] p (integer) can be configured between 1 and P. An attack or perturbation can occur within 1 clock cycle. Therefore, at full resolution, p can be set to 1. At high values, for example, p=100, monitoring can be slowed down (standby, sleep).

[0101] The variable p specifies the "scanning resolution" which can range from 1 to P. "p" represents the number of clock cycles between two "measurements". When p=1, the detection system operates at "full resolution", i.e., some memory cells will not store any data, while some other memory cells will store any data. Any available data can be used at the finest granularity. When it is not necessary to monitor sensitive operations at full resolution (i.e., to follow environmental evolution), an idle monitoring state (when p>1) can be used. This monitoring is advantageous for early detection of slow environmental modifications when the attacker is preparing to establish conditions for an injection attack. When p is high (typically 100 or more), the proposed arrangement consumes very little energy ("low resolution" or "heartbeat" or "sleep mode" or "hibernation mode", etc.).

[0102] q can be configured between (M+2*M / p)+1 to Q. "q" counts in "p" clock cycles. The configuration (p times q) specifies or determines what the monitoring time pattern will be. For example, if p=5, q=30, then every p*q=5*30=150 clock cycles, the record and read sequence is iterated. In the case of AES128 (M=10), p*M=50 clock cycles are used for recording, 2*M=20 clock cycles are used to read the memory, and it is kept for 80 clock cycles to wait for the next iteration sequence (record and read).

[0103] The p and q numbers can be selected to save energy while achieving full resolution monitoring. For example, AES encryption performs 10 clock cycles for AES128 bits, thus requiring the sensor to react quickly (eg, p=1, q=30).

[0104] Data pull and / or push / triggers

[0105] The term "receive" implies pull and / or push, which means that data may be actively collected or requested (pull) and / or data may be passively transmitted or received (push), depending on the embodiment. In some embodiments, data may be pushed from a sensor (passively) through a memory unit: the sensor is not controllable and is not controlled. In some other embodiments, one or more sensors may be controllable or controlled.

[0106] In an embodiment, a "measurement" (a collection of sensor measurements) may be triggered by a finite state machine (FSM) (e.g., 1001). The FSM may trigger a read operation from a memory cell (e.g., 111, 112, 113), thereby specifying p. In the absence of FSM 1001, circuit 100 may be operatively coupled to a FSM or other mechanism to fill (write) memory cells. With FSM 1001, circuit 1000 may write to memory cells.

[0107] In an embodiment, a measurement (a collection of sensor measurements) may be triggered by software (API, operating system, application, etc.) thereby specifying p.

[0108] In an embodiment, an event may trigger a measurement. For example, it may be known that an AES encryption operation is about to begin. This operation may trigger monitoring according to the present invention at full resolution and last for at least 10 cycles, for example, AES128, the number of cycles depending on M, the recording memory depth.

[0109] In one embodiment, the second FSM 1311 may enable the circuit or logic unit 130 and / or 140 to read the written data in the memory cell. The second FSM 1311 may specify the parameter q.

[0110] The monitoring circuit 100 or 1000 according to the present invention may have various downstream uses. In particular, Figure 1 Two different uses are shown, which may be independent or coupled, for example, they may be performed in parallel or in series: the data output may be used to determine a signature (signature generation circuit 130) and / or detect an attack (attack detection circuit 140). In some embodiments, signature circuit 130 and attack detection circuit 140 may operate in parallel.

[0111] Purpose 1-Signature generation 130 "PUF-like"

[0112] In embodiments of the invention, the signature generation circuit (or block or module) may receive data pulled / requested by software or by a signature hardware acceleration (sigHA) circuit 130. Such circuitry may be independent, dedicated (coprocessor) or may correspond to a sub-portion of a general purpose computing unit, such as a central processing unit 131 (or GPU). In some embodiments (as shown), the hardware of the signature generation circuit may use both portions of the CPU 131 and some other dedicated portion or extension.

[0113] The signature hardware acceleration 131 may be coupled to the FSM 1311 , which in turn may control the q parameter.

[0114] In one embodiment, each of the N sensors may provide Mi continuous elementary measurements of its state. A FIFO memory unit may be used; alternatively, metadata or timestamp data or queue order information may be associated with the measurements. The signature corresponds to a set of statistical values ​​calculated from the set of measurements. The signature may be a 1-D vector or a 2-D Gaussian statistical plot: mean and standard deviation (or variance).

[0115] For a single measurement, each sensor provides a vector of M basic measurements (the value of its state, "FIFO depth" or buffer size). The period of a basic measurement can be 1 or P clock cycles. A set of N sensors thus provides N×M basic measurements for one single measurement. Since the signature process uses K measurements of the set, it uses K×N×M basic measurements.

[0116] In other words, the "depth" of the memory (e.g., FIFO memory) is M. The number M corresponds to the number of measurements or values ​​that can be stored in the memory FIFO. Every P clock cycles, a basic measurement of the sensor upon arrival can be triggered. Once the depth of the sensor is reached, the sensor under consideration can stop "recording".

[0117] In other words, the sequence of recording M values ​​in the FIFO can be regular every Q clock cycles (automatically monitored), or it can be processed as needed (by triggering), for example, before an event such as a sensitive computation (e.g., a cryptographic operation or the transfer of sensitive data).

[0118] For example, in standby mode, p can be equal to 5 and q can be equal to 100, where M is equal to 20. A FIFO memory of depth 20 receives (or reads) one measurement value of the sensor every 5 clock cycles. It takes 5*20(p*M)=100 clock cycles to fill the FIFO memory. Then, 2*M=40 clock cycles to read the memory. The recording / reading process starts over every p*q=500 clock cycles (q), leaving 360 cycles without any monitoring. This reduces energy consumption. A trigger to start recording / monitoring can be generated: either automatically every q cycles of p clock cycles, or on demand (protected by calculation).

[0119] Parameters q and p define the time mode and monitoring resolution.

[0120] In some embodiments, all depths M of all FIFO memory cells may be the same. In some embodiments, at least one depth M may be configurable. For example, given the nature of the computation to be protected, the corresponding depth may be configurable and configured. In one embodiment, the depth may correspond to the duration of the operation of interest of the payload. For example, for AES128, the depth M1 may be equal to 11; for AES256, the depth M2 may be equal to 15; for SHA-1, the depth M3 may be equal to 80; and so on. This optimization may advantageously gain or save silicon surface (number of gates or silicon area).

[0121] The signature construction process is based on dimensionality reduction of Gaussian probability distribution (mean μ and standard deviation σ) values ​​from 3-D (K×N×M) to 2-D (N×[a,b]) or 1-D (N). [a,b] is a subset of the values ​​from the M basic measurements.

[0122] Because the ID is generated by statistics of the chip's dynamic behavior, an attacker cannot retrieve the ID by reverse engineering the schematic or by opening the physical chip.

[0123] In an embodiment, the signature hardware acceleration (SigHA) 131 may be associated with a memory unit 1312 (e.g., to store instructions or a list 1313 of sensors to monitor). In some embodiments, the list may be static (simplicity may result in fast computation). In some embodiments, the list may change over time (dynamically, conditional on tests and other parameters, following predefined scenarios, enriched by machine learning, etc.). Groups or subgroups of sensors may be interrogated.

[0124] The combination of circuit 100 (a collection of sensors arranged together with a memory unit) and a signature generation circuit provides the functionality of a PUF: uniqueness of the output, and therefore uniqueness of the (deterministic) signature; non-clonability due to intrinsic and random imperfections in parts of the components that make up the sensors, memory unit and signature circuit. For a given set of sensors, there is one and only one signature. Since the sensors under consideration can vary, multiple signatures can be provided.

[0125] A notable feature of the invention is that, contrary to conventional challenge-response systems (CRP or PUF), no such "challenge" is needed. The combination according to the invention "continuously" or "spontaneously" or "passively" emits a stream of measurements, which can be used as a "challenge" to calculate one or more signatures (more or less stable, etc.). Therefore, no specific measurements with exclusive access are required, nor are actions triggered. The DS-PUF can retrieve information signed on the stream for normal use of the sensor. The "PUF" evaluation does not implicitly imply a specific measurement process: it collects (or snoops) measurement data from the sensor. All other PUFs require a specific measurement process with exclusive sensor access and specific environmental adjustments. Secret access is also different from other PUFs (except RAM-PUF, via PUF). No multiplication challenge test is required to extract multiple pieces of secrets to verify the PUF value. The DS-PUF can extract the entire secret value (signature) in one single internal evaluation (K sensor measurements). There is no recognizable "challenge" (leading to impersonation, deception, etc.), but the data stream has no timely privileges.

[0126] Incidentally, another notable feature is that the functionality of the proposed arrangement is not disabled during the "challenge" and / or signature generation. In conventional PUF systems (or in currently developed "synthetic PUFs"), the PUF hardware is mobilized to generate a response, and the hardware cannot perform its functions (if any). For example, a CMOS S-PUF must acquire images in the dark in order to further explore the statistical characteristics of active pixels and determine their signatures. During the image acquisition time, the imaging device cannot be used for other purposes. In contrast, the present invention allows the steps of the method (e.g., measuring, storing, collecting and generating keys) to be performed in parallel with the normal functions of the circuit (e.g., encryption, etc.). In other words, embodiments of the present invention do not cause or introduce disturbances in the circuit under consideration. This means that the challenge of a conventional PUF or SPUF implies that the hardware under consideration cannot perform its function or role during the challenge (i.e., the output of the response). For example, a CMOS SPUF must be placed in uniform dark conditions and cannot acquire images during CPR. In the present case, the data stream can be used to dynamically determine the uniqueness of a circuit based on the circuit, while at the same time providing data that can be used as a basis for detecting attacks (profiles, "signatures", etc.), triggering countermeasures, etc.

[0127] Depending on the data (flow), various downstream tasks can be enabled: authentication, identification, etc.

[0128] The data flow between sensors and the arithmetic operations performed in the signature generation circuit 130 may be vulnerable to attack (physical probing), but if not known, little can be extracted from it. The communication link between the sensor set and the processing unit (for detection, initial use; and for PUF signature construction) can be dedicated or protected (physical and / or logical). Physical protection may include, but is not limited to, one or more of the following: own dedicated wires, molded into the circuit, made to be unreachable, shielding (one or more) of the wires that detect attacks and disable the underlying layers. Logical protection may include one or more of the following: offsets or predefined tables known to the manufacturer to shift or otherwise modify values ​​or sensors after a memory block.

[0129] In some embodiments, signature hardware acceleration circuitry may speed up the calculation.

[0130] Purpose 2-Attack Detection 140

[0131] A data stream output by the circuit 100 or a collection of sensors and memory cells, for example triggered by a FSM, may be replicated (or forked or derived) to perform computer attack detection 140 .

[0132] Advantageously, the proposed arrangement enables detection of attacks by fault injection.The proposed arrangement may be referred to as a "Physical Attack Detection System (PADS)" or "Component Secure Intrusion Detector and Ranging" (SICDAR).

[0133] Various machine learning techniques may be used to classify or otherwise attribute attacks (supervised or unsupervised, (rotated) random forests, support vector machines, etc.).

[0134] In one embodiment, attack detection operation 140 may backtrack signature generation 130. Although signature generation 130 may be initiated in parallel with the attack detection function, in some embodiments, generation of the signature may be performed in response to receiving a message from attack detection operation block 140 indicating that data may be used for signature generation (i.e., no attack was detected).

[0135] If attack detection is performed, the signature calculation may first be disabled, reviewed, or otherwise managed.

[0136] Figure 2 An example of the distribution of sensors monitoring a payload is shown.

[0137] Sensors may be distributed in various ways to observe or monitor or otherwise measure circuit payload. In particular, Figure 2 Detection zones (1011, 1021, 1031) and aspects related to optimal layout of the space are shown.

[0138] Digital sensors may be placed "close to" a particular portion of hardware (i.e., payload) (e.g., "in it," "close to," "into it," "mixed with it," "under it," "on top of it," "beneath it," "adjacent to it," "adjacent to it"). Sensors may be "in" or "inside" or "on" or "below" or "over" a given payload: the manufacturer of a given circuit payload may integrate one or more sensors directly into it at the foundry. For example, sensor 103 may be inherently integrated into payload 1.

[0139] The digital sensor may be permanently associated with a circuit or payload. The digital sensor may be removable, removable, releasable or otherwise configurable. In some embodiments, the sensor is removable (permanently or temporarily) and may specifically be "placed" (i.e., afterwards or a posteriori) on a circuit including the payload in question. 2D circuits may be considered along side circuits in 3D (the sensor may be placed within a specific layer). Flexible electronics may be used.

[0140] The distribution of sensors in the target circuit may vary: sensors may be used as probes. Critical parts of the circuit may be specifically protected or monitored: for example, a greater number of sensors may be mobilized. In contrast, non-critical parts of the circuit may be left unprotected. In embodiments where no hardware modifications are required (no sensors are added to the circuit), existing sensors may be utilized (if directly accessible or indirectly accessible, for example via an API or operating system).

[0141] The topology (logical) or morphology (physical) or arrangement of the sensor and its detection zone can be optimized in several ways (see below).

[0142] Since various sensors may be used, the detection zone may vary. For example, associated with sensor 101, detection zone 1011 may be guided / constrained by a conductive element (e.g., a wire), and the shape of the monitored zone may be irregular (however, it may be predicted and / or measured by a model). Other examples of detection zones are zones 1031 and 1021, which may overlap. Thus, the coverage of the payload may be optimized in a variety of ways. For example, a laser beam (irradiation attack) may trigger both sensors 102 and 103, and be detected as such.

[0143] "Uncovered" spaces or "unmonitored floorplans" or "holes" may be handled in different ways. In one embodiment, additional sensors may be placed where monitoring is not performed. In one embodiment, one or more thresholds processed by the digital sensor may be changed (e.g., from 1031 to 1032), although this may affect false positives.

[0144] Figure 3 An example of a recording for one sensor is shown.

[0145] As used herein, the term "recording" designates the operation of writing individual sensor measurements in corresponding memory cells.

[0146] A "measurement" specifies the write record in the FIFO and the read back to 130 and 140. It consists of M elementary records in the FIFO memory cells (M is the FIFO depth).

[0147] N specifies the number of sensors (101, 102, 103, etc.). Mi specifies the depth of the FIFO for sensor i. Pi is the number of cycles between two consecutive records in the FIFO. Q specifies the number of cycles between two consecutive measurements.

[0148] In the example shown, M is a constant. The clock period is indicated by marker 300. P, which can be considered the "inter-record" delay, can include several clock cycles (e.g., 1 in 310, 3 in 320, 5 in 330). M basic (individual) measurements are obtained (more clock cycles may be required here to obtain the records that make up the third measurement, while for the first sensor, the first measurement will be determined more quickly).

[0149] In one embodiment, the (central) FSM 1001 can process records (or record content). In one embodiment, multiple FSM circuits associated with each memory cell can process records (the FSM can be encoded as a hardware circuit).

[0150] Then, circuit 100 is ready to read from another FSM 1311 located downstream (for different purposes, e.g., 130 and / or 140).

[0151] Figure 4 An example of recording with N sensors is shown.

[0152] The example shown now pertains to multiple (N) sensors, and the multiple (N) sensors can be associated with different memory cells (i.e., having different depths). In the example shown, Mi, Mj, and Mk are different memory depths, where Mi < Mj < Mk. The values of Mi, Mj, and Mk do not change over time. Then, the example shows different cycles p for writing in the memory. After one clock cycle (p = 1), three measurements are determined. Then, after three clock cycles (P = 3), three other measurements are obtained. In the example shown, it is possible that: with more (single) clock cycles, for p = 3, the memory cell is filled with some more data, which will be applied in a first-in, first-out manner in response to the arrival depth / buffer size. The fact that the sensors start recording simultaneously (pulse or clock cycle i) at the same time is important. This "captures" what is happening in the circuit within a comparable duration and simultaneously.

[0153] Figure 5 An example of a measurement including recording and reading steps with N sensors is shown.

[0154] This diagram changes perspective slightly, changing the perimeter from circuit 1000 to circuit 10000. At perimeter 1000, all N sensors in circuit 100 are processed in parallel: FSM 1001 writes data to memory cells at depths M1 to MN simultaneously (recording step 510). Thus, data is captured simultaneously in circuit 100. At perimeter 1000, in response to the writes, FSM 1311 may call or retrieve the data in a sequential manner (reading step 520): different buffers or memory cell contents may be accessed and read one after another for various downstream purposes. In some other embodiments, reads may also still be processed in parallel.

[0155] Figure 6 An example of a plurality of consecutive measurements including recording and reading steps with N sensors is shown.

[0156] The parameter Q may specify the delay between measurements (recording then reading) in number of P cycles (expressed in fundamental clock cycles). Q may be controlled in hardware and / or software.

[0157] For a given Qi cycle, the total recording time (parallel) is the maximum value of (PixMi), and the total reading time (sequential) is the sum of the reading times of Mi from i=1 to N. Therefore, the Qi time is greater than or equal to the total recording time (parallel) plus the total reading time (sequential).

[0158] The methods described herein can be implemented by computer program instructions supplied to a processor of any type of computer to produce a machine having a processor that executes instructions to implement the functions / actions specified herein. These computer program instructions can also be stored in a computer-readable medium, which can instruct the computer to operate in a particular manner. To this end, the computer program instructions can be loaded onto a computer so that a series of operating steps are performed, and a computer-implemented process is thereby generated, so that the executed instructions provide a process for implementing the functions / actions specified herein.

[0159] The program code embodying any embodiment of the present invention described herein can be distributed separately or collectively as a program product in various forms. In particular, the program code can be distributed using a computer-readable medium, which may include a computer-readable storage medium and a communication medium.

[0160] Although embodiments of the present invention have been illustrated by the description of various examples, and although these embodiments have been described in considerable detail, it is not the intention of the applicant to restrict or in any way limit the scope of the appended claims to such details. Additional advantages and modifications will readily occur to those skilled in the art. Therefore, the present invention in its broader aspects is not limited to the specific details, representative methods, and illustrative examples shown and described.

Claims

1. A circuit for monitoring a circuit payload, the circuit payload specifying a circuit or portion of a circuit that is sensitive or otherwise to be protected, wherein: The circuit comprises: - a plurality of sensors (101, 102, 103) distributed in the circuit, close to the circuit payload (1, 2), the sensors being configured to provide measurements related to the environment of the circuit; and - one or more memory units (111, 112, 113), the one or more memory units (111, 112, 113) being associated with one or more sensors, the memory units being configured to store sensor measurements made by the one or more sensors every p clock cycles; The circuit is configured to read sensor measurements stored in at least some of the memory cells, the circuit further comprising a finite state machine configured to cause the circuit to receive sensor measurements during q clock cycles out of p clock cycles, and the circuit further comprising a detection circuit (140) configured to detect an attack based on the sensor measurements.

2. The circuit according to claim 1, wherein The sensor is either a digital sensor or an analog sensor coupled to a digital converter.

3. The circuit according to claim 1, wherein: The memory unit is of FIFO type.

4. The circuit according to claim 3, wherein: The depth of the memory cell is determined according to predefined computational operations performed in the monitored circuit payload, the depth of the memory cell corresponding to the number of measurements or values ​​that can be stored in the memory cell.

5. The circuit according to claim 1, wherein: p and / or q are configurable.

6. The circuit according to claim 1, wherein: The circuit also includes a data obfuscation module configured to obfuscate data originating from one or more memory cells.

7. The circuit according to claim 1, wherein: The circuit also includes a data reduction module configured to filter and / or reduce the amount of data originating from one or more sensors.

8. The circuit according to claim 1, wherein: The one or more sensors and / or the one or more memory units are reprogrammable.

9. The circuit according to claim 1, wherein: The circuit also includes a signature circuit (130) configured to determine one or more signatures based on the sensor measurements.

10. The circuit according to claim 9, wherein: The circuit has properties including physical unclonability and unique signature while not requiring the unique signature to be revealed and / or conditionally responsive to external challenges given predefined admissibility criteria and / or a predefined shared secret.

11. The circuit according to claim 9, wherein: The signature circuit (130) and the detection circuit (140) are capable of operating in parallel.

12. A method for determining a signature or monitoring a circuit payload in a circuit, the circuit payload specifying a sensitive or otherwise protected circuit or portion of a circuit, the circuit comprising: - a plurality of sensors (101, 102, 103) distributed in the circuit, close to the circuit payload (1, 2), the sensors being configured to provide measurements related to the environment of the circuit; as well as - one or more memory units (111, 112, 113), the one or more memory units (111, 112, 113) being associated with the one or more sensors and being used to store sensor measurements made by the one or more sensors every p clock cycles; wherein the circuit further comprises a finite state machine configured to cause the circuit to receive sensor measurements during q clock cycles out of p clock cycles, and the circuit further comprises a detection circuit (140) configured to detect an attack based on the sensor measurements, and Wherein, the method comprises the following steps: - reading sensor measurements stored in at least some of said memory cells; and - determining a signature based on said sensor measurements; and / or - determining one or more attacks on the payload based on the sensor measurements.

Images