Method for protecting sensitive data in integrated circuit and integrated circuit

Abstract

The present invention relates to a method for protecting a sensitive data sequence within an integrated circuit. The method comprises generating a pseudorandom sequence based on a seed sequence stored in the integrated circuit, combining the sensitive data sequence and the pseudorandom sequence to generate a protected data sequence, and storing the protected data sequence in the integrated circuit. The protected data sequence cannot be accessed from outside the integrated circuit.

Description

Technical Field

[0001] The present invention relates to data security, and more particularly to a method for protecting sensitive data in an integrated circuit and an integrated circuit using the method. Background Art

[0002] Electronic devices rely on cryptographic systems to provide security for applications and associated data. Cryptographic systems are often targeted by unauthorized attackers who attempt to access applications or devices or to collect sensitive information, such as credit card numbers or encryption keys. A variety of tools and methods can be used to extract security information from electronic devices, including direct attacks, which exploit weaknesses in the cryptographic algorithms used by the target cryptographic system, and side-channel attacks, which rely on information gleaned from the physical implementation of the cryptographic system. Side-channel attacks attempt to derive sensitive information by measuring the physical properties of the cryptographic system, such as its power consumption, or through optical inspection, such as with a high-resolution camera or microscope.

[0003] Power monitoring attacks monitor the power consumption of a cryptographic system by measuring the current drawn by the device while performing cryptographic operations, and infer cryptographic operations or sensitive information from the power consumption. Power attacks can reveal the sequence of instructions executed by the cryptographic system. Differential power analysis (DPA) attacks combine power measurements with statistical analysis from basic power monitoring attacks to extract information about cryptographic keys or sensitive information used in cryptographic operations. Statistical tools are used to correlate voltage difference values and power consumption measurements to obtain sensitive information.

[0004] Optical attacks use high-magnification devices such as transmission electron microscopes (TEMs) to read and infer cryptographic keys or other sensitive information. Summary of the Invention

[0005] An embodiment of the present invention provides an integrated circuit comprising a seed register, a pseudo-random sequence generator, a combiner, and a non-volatile memory. The seed register is used to store a seed sequence. The pseudo-random sequence generator is used to generate a pseudo-random sequence based on the seed sequence. The combiner is used to combine a first data sequence and the pseudo-random sequence to generate a second data sequence, the second data sequence being inaccessible from outside the integrated circuit. The non-volatile memory is coupled to the combiner and is used to store the second data sequence.

[0006] An embodiment of the present invention further provides a method for protecting a sensitive data sequence within an integrated circuit, comprising: generating a pseudo-random sequence based on a seed sequence stored within the integrated circuit; combining the sensitive data sequence and the pseudo-random sequence to generate a protected data sequence, wherein the protected data sequence cannot be accessed from outside the integrated circuit; and storing the protected data sequence. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 FIG. 4 is a block diagram of an integrated circuit according to an embodiment of the present invention.

[0008] Figure 2 A schematic diagram showing a 16-bit linear feedback shift register.

[0009] Figure 3 FIG. 4 is a block diagram of another integrated circuit according to an embodiment of the present invention.

[0010] Figure 4 Flowchart of a method for protecting a sensitive data sequence of the integrated circuit of FIG. 1 .

[0011]

Explanation of symbols

[0012] 1, 3: integrated circuits

[0013] 10: Seed Cache

[0014] 12: Scrambler

[0015] 120, 320: Pseudo-random sequence generator

[0016] 122, 322: Combiner

[0017] 14: Non-volatile memory

[0018] 16: Region Selector

[0019] 20: Linear feedback shift register

[0020] 30: Processor

[0021] 32: Descrambler

[0022] Dss:Seed sequence

[0023] Drs: Pseudo-random sequence

[0024] Dks: Sensitive Data Sequence

[0025] Dps: Protect Data Sequence

[0026] Af: Initial area address

[0027] Awrt: write address

[0028] Ard: read address

[0029] C0 to C15: Shift register unit

[0030] G1 to G3: XOR gate

[0031] 400:Method

[0032] S402 to S410: Steps DETAILED DESCRIPTION

[0033] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0034] In the detailed description that follows, reference may be made to the various drawings that form part of this application and illustrate specific embodiments of the present application. In the drawings, similar reference numerals describe substantially similar components in different figures. Each specific embodiment of the present application is described below in sufficient detail to enable a person of ordinary skill in the art to implement the technical solutions of the present application. It should be understood that other embodiments may be utilized or that structural, logical, or electrical changes may be made to the embodiments of the present application.

[0035] Figure 1 The following is a block diagram of an integrated circuit 1 according to an embodiment of the present invention. Integrated circuit 1 can be used for graphics processing, memory control, or other applications, and sensitive data such as root keys, passwords, or credit card numbers are exclusively accessible within integrated circuit 1 and cannot be accessed from outside of integrated circuit 1. Sensitive data is scrambled with a pseudorandom sequence before being stored within integrated circuit 1. Therefore, in the event of an optical side-channel attack, the attacker can only obtain the scrambled sensitive data and cannot obtain the actual sensitive data. In the event of a power monitoring attack or differential power analysis attack, regardless of the actual sequence changes of the sensitive data, the power measurement of the scrambled sensitive data will only obtain substantially the same average power and substantially the same potential difference. In other words, the scrambled data has substantially the same average power and substantially the same potential difference. Therefore, the scrambled sensitive data can be used to mitigate differential power analysis attacks and protect sensitive data from visual extraction in optical side-channel attacks.

[0036] Integrated circuit 1 may include a seed register 10, a scrambler 12, a non-volatile memory 14, and a region selector 16. Scrambler 12 may include a pseudo-random sequence generator 120 and a combiner 122. Scrambler 12 and region selector 16 may be implemented by software, hardware, or a combination thereof. When implemented using software, scrambler 12 and region selector 16 may be implemented by a processor executing software code, which is stored in other non-volatile memory of integrated circuit 1. When implemented using hardware, seed register 10 is coupled to pseudo-random sequence generator 120 of scrambler 12, while combiner 122 and region selector 16 of scrambler 12 are coupled to non-volatile memory 14. Hardware implementation can provide enhanced security protection for sensitive data. That is, the data within the second data sequence has substantially the same average power and substantially the same potential difference.

[0037] The seed register 10 can store a seed sequence Dss. The seed sequence Dss can be a binary sequence specific to the integrated circuit 1 and can be a unique user identifier (UUID) associated with the user of a device using the integrated circuit 1, a unique device identifier (UDID) associated with the device using the integrated circuit 1, or a unique bit sequence generated by a random number generator (RNG) during factory setup. The RNG can be internal or external to the integrated circuit 1. The seed sequence Dss is written to the seed register 10 during factory setup.

[0038] During factory settings, the scrambler 12 receives a sensitive data sequence Dks (also known as a first data sequence), scrambles the sensitive data sequence Dks using a pseudo-random sequence Drs to generate a protected data sequence Dps (also known as a second data sequence), and writes the protected data sequence Dps into the non-volatile memory 14. Specifically, the pseudo-random sequence generator 120 generates a pseudo-random sequence Drs based on a seed sequence Dss, and the combiner 122 combines the sensitive data sequence Dks with the pseudo-random sequence Drs bit-by-bit to generate the protected data sequence Dps. The lengths of the sensitive data sequence Dks, the pseudo-random sequence Drs, and the protected data sequence Dps can be equal. The combiner 122 can include an exclusive-OR (XOR) gate, an exclusive-NOR (XNOR) gate, and / or other gates capable of providing various linear functions. The non-volatile memory 14 may be a one-time programmable (OTP) memory or an electrically programmable fuse (e-fuse) memory.

[0039] The pseudo-random sequence generator 120 may include a linear feedback shift register (LFSR). The LFSR may include a shift register that propagates bits through the shift register cells at each clock cycle, typically from one shift register cell to the next higher-order shift register cell. The output of a particular shift register cell is called a tap and is fed back to the first shift register cell via one or more XOR gates, XNOR gates, and / or other gates that provide a linear function. The LFSR may have a characteristic polynomial defined by the tap positions and a register length defined by the number of shift register cells, e.g., 16 bits. The data length of the seed sequence Dss may be equal to the register length, e.g., 16 bits. The characteristic polynomial may be a finite field polynomial. The LFSR may be loaded with the seed sequence Dss as an initial value to generate a binary pseudo-random sequence Drs. Figure 2 A schematic diagram of an embodiment of a 16-bit linear feedback shift register 20 for use in a pseudo-random sequence generator 120 is shown. The linear feedback shift register 20 includes 16 cells C0 to C15 and XOR gates G1 to G3. The taps of the linear feedback shift register 20 are located at the 11th, 13th, 14th, and 16th bit positions. The characteristic polynomial of the linear feedback shift register 20 is (1+x11+x13+x14+x16). Initially, cells C0 to C15 load a seed sequence Dss to generate a pseudo-random sequence Drs at the output of XOR gate G3. The generated bit is then fed back to cell C0 to generate the next bit of the pseudo-random sequence Drs. In this manner, the linear feedback shift register 20 can sequentially generate the pseudo-random sequence Drs. In some embodiments, the characteristic polynomial may be specific to a product version of the integrated circuit 1 , ie, a newer product version and a previous product version may have different characteristic polynomials, thereby enhancing data security between different product versions and preventing sensitive data sequence Dks from being extracted.

[0040] The sensitive data sequence Dks may have a data length that exceeds the register length of the linear feedback shift register 20. For example, the data length of the sensitive data sequence Dks may be 64 bits, and the register length of the linear feedback shift register 20 may be 16 bits. If the data length of the sensitive data sequence Dks is less than the register length of the linear feedback shift register 20, for example, 8 bits, the scrambler 12 may insert padding bits after the sensitive data sequence Dks to ensure that the padded data sequence has a data length equal to the register length of the linear feedback shift register 20, for example, 16 bits. If the data length of the sensitive data sequence Dks is greater than but not a multiple of the register length of the linear feedback shift register 20, for example, if the data length of the sensitive data sequence Dks is 24 bits, the scrambler 12 may insert padding bits after the sensitive data sequence Dks to ensure that the padded data sequence has a data length equal to a multiple of the register length of the linear feedback shift register 20, for example, 32 bits. Insertion of padding bits can be implemented by software or hardware mechanisms. The combiner 122 can use the pseudo-random sequence Drs to combine the padded data sequence to generate the protected data sequence Dps. The combiner 122 can sequentially output the protected data sequence Dps to the non-volatile memory 14 for storage in units of the register length.

[0041] The non-volatile memory 14 can be divided into multiple regions, each of which is assigned a unique region address. After the combiner 122 receives the sensitive data sequence Dks or the padded data sequence, the region selector 16 can receive the initial region address Af and use the initial region address Af as the write address Awrt to select a region of the non-volatile memory 14. The non-volatile memory 14 can store the protected data sequence Dps based on the write address Awrt. If the protected data sequence Dps exceeds the register length of the linear feedback shift register 20, the region selector 16 can update the write address Awrt based on the initial region address Af and the register length. In some embodiments, the region selector 16 can increase the write address Awrt by the register length at each predetermined time period, for example, increasing the write address Awrt by 16 bits every 16 clocks. In this way, the non-volatile memory 14 can sequentially store the protection data sequence Dps in units of register length according to the write address Awrt, and each protection data sequence Dps can be aligned with the register length of the linear feedback shift register 20 .

[0042] The sensitive data sequence Dks can be scrambled to generate a protected data sequence Dps before storage, thereby protecting the sensitive data sequence Dks from being extracted by optical attacks.

[0043] Figure 3This is a block diagram of another integrated circuit 3 according to an embodiment of the present invention. Integrated circuit 3 can descramble a protected data sequence Dps to recover a sensitive data sequence Dks. Integrated circuit 3 may include a seed register 10, a descrambler 32, a non-volatile memory 14, a region selector 16, and a processor 30. Integrated circuit 3 can be combined with integrated circuit 1 to form an integrated circuit. Integrated circuit 3 differs from integrated circuit 1 in the configuration and operation of processor 30, descrambler 32, and region selector 16, as explained below.

[0044] The descrambler 32 can be implemented using software, hardware, or a combination thereof. When implemented using software, the descrambler 32 can be implemented using software code stored in other non-volatile memory of the integrated circuit 3 and executed by the processor 30. When implemented using hardware, the processor 30 can be coupled to the descrambler 32 and the region selector 16, and the descrambler 32 and the region selector 16 can be coupled to the non-volatile memory 14. The descrambler 32 can include a pseudo-random sequence generator 320 and a combiner 322. The configuration and operation of the pseudo-random sequence generator 320 and combiner 322 can be similar to those of the pseudo-random sequence generator 120 and combiner 122 in FIG. 1 , as explained in the previous paragraph.

[0045] Upon activation, the processor 30 may instruct the pseudo-random sequence generator 320 to load the seed sequence Dss from the seed register 10 to generate the pseudo-random sequence Drs. It may also transmit the initial region address Af to the region selector 16 to generate the read address Ard for retrieving the protected data sequence Dps (or the first data sequence) from the non-volatile memory 14. The combiner 322 may combine the protected data sequence Dps and the pseudo-random sequence Drs in a bit-by-bit manner to recover the sensitive data sequence Dks (or the second data sequence) and transmit the sensitive data sequence Dks to the processor 30. The processor 30 may then store the sensitive data sequence Dks in a protected internal memory for use in cryptographic operations and discard the sensitive data sequence Dks from the protected internal memory upon completion of the operation.

[0046] The region selector 16 can update the read address Ard based on the initial region address Af and the register length. In some embodiments, the region selector 16 can increase the read address Ard by the register length at every predetermined time period, for example, increasing the read address Ard by 16 bits every 16 clocks. Thus, a protected data sequence Dps having a data length exceeding the register length of the linear feedback shift register 20 can be retrieved from the non-volatile memory 14.

[0047] After startup, the protected data sequence Dps can be descrambled to recover the sensitive data sequence Dks, thereby protecting the sensitive data sequence Dks from being extracted by power monitoring attacks or differential power analysis attacks.

[0048] Figure 4 Flowchart of method 400 for protecting the sensitive data sequence Dks of integrated circuits 1 and 3. Method 400 includes steps S402 to S410, wherein steps S402 to S406 are used to scramble the sensitive data sequence Dks to generate a protected data sequence Dps for storage, protecting the sensitive data sequence Dks from optical side-channel attacks. Steps S408 and S410 are used to descramble the protected data sequence Dps to recover the sensitive data sequence Dks used for cryptographic operations, protecting the sensitive data sequence Dks from power monitoring attacks and differential power analysis attacks. Any reasonable technical changes or step adjustments fall within the scope of the present invention. The explanation of steps S402 to S410 is as follows:

[0049] Step S402: The pseudo-random sequence generator 120 generates a pseudo-random sequence Drs according to the seed sequence Dss;

[0050] Step S404: The combiner 122 combines the sensitive data sequence Dks and the pseudo-random sequence Drs to restore the protected data sequence Dps, and the region selector 16 generates a write address Awrt;

[0051] Step S406: the non-volatile memory 14 stores the protection data sequence Dps according to the write address Awrt;

[0052] Step S408: After activation, the pseudo-random sequence generator 320 generates a pseudo-random sequence Drs according to the seed sequence Dss, and the region selector 16 generates a read address Ard to read the protected data sequence Dps from the non-volatile memory 14;

[0053] Step S410 : The combiner 322 combines the protected data sequence Dps and the pseudo-random sequence Drs to restore the sensitive data sequence Dks.

[0054] The explanation of steps S402 to S410 has been provided in the previous paragraph and will not be repeated here. The integrated circuits 1 and 3 can use the method 400 to protect sensitive data from optical side channel attacks, power monitoring attacks, and differential power analysis attacks.

[0055] The integrated circuits 1 and 3 and the method 400 are used to scramble sensitive data before storage and descramble protected data before use, so as to protect the sensitive data from optical side-channel attacks, power monitoring attacks, and differential power analysis attacks.

[0056] The above description is only a preferred embodiment of the present invention. All equivalent changes and modifications made according to the scope of the patent application of the present invention should fall within the scope of the present invention.

[0057] The above embodiments are only used to illustrate the present invention, and are not intended to limit the present invention. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the scope of the present invention. Therefore, all equivalent technical solutions should also fall within the scope of the present invention.

Claims

1. An integrated circuit comprising: a seed register for storing a seed sequence, wherein the seed sequence is received by the seed register during a manufacturing setup and has not been processed by the seed register, and the seed sequence is specific to the integrated circuit; a pseudo-random sequence generator, coupled to the seed register, for generating a pseudo-random sequence according to the seed sequence; a combiner coupled to the pseudo-random sequence generator for combining the first data sequence and the pseudo-random sequence in a bit-by-bit manner to generate a second data sequence, such that the first data sequence cannot be read from outside the integrated circuit, wherein: The combiner includes a plurality of logic gates, at least one output of the plurality of logic gates is coupled to an input of a linear feedback shift register in the pseudo-random sequence generator, and the data in the second data sequence have substantially the same average power and substantially the same potential difference; A non-volatile memory is coupled to the combiner and is used to store the second data sequence. 2 . The integrated circuit of claim 1 , wherein the first data sequence and the second data sequence are a sensitive data sequence and a protected data sequence, respectively.

3. The integrated circuit of claim 2, further comprising: a region selector coupled to the pseudo-random sequence generator, for receiving a region address and updating a write address according to a register length of the pseudo-random sequence generator and the region address; The non-volatile memory is used to store the protection data sequence according to the write address. 4 . The integrated circuit of claim 1 , wherein the first data sequence and the second data sequence are a protected data sequence and a sensitive data sequence, respectively.

5. The integrated circuit of claim 4 , further comprising: A region selector is coupled to the pseudo-random sequence generator, and is used for receiving a region address of the non-volatile memory and updating a read address according to the region address and a register length of the pseudo-random sequence generator. 6 . The integrated circuit of claim 5 , wherein the combiner is further configured to obtain the protection data sequence according to the read address after the integrated circuit is activated.

7. The integrated circuit of claim 1, 2, 3, 4, 5, or 6, wherein the pseudo-random sequence generator comprises a linear feedback shift register for loading the seed sequence to generate the pseudo-random sequence.

8. The integrated circuit of claim 1, 2, 3, 4, 5, or 6, wherein the pseudo-random sequence generator is associated with a characteristic polynomial, the characteristic polynomial being specific to a product version of the integrated circuit.

9. The integrated circuit of claim 1, 2, 3, 4, 5, or 6, wherein the non-volatile memory is a one-time programmable memory.

10. The integrated circuit of claim 1, 2, 3, 4, 5, or 6, wherein the seed sequence comprises at least one of: a unique user identifier (UUID), a unique device identifier (UDID), and a unique bit sequence generated by a random number generator during factory settings.

11. A method for protecting a sensitive data sequence in an integrated circuit, comprising: A pseudo-random sequence generator is used to generate a pseudo-random sequence according to a subsequence stored in the integrated circuit, wherein: The seed sequence is stored in a seed register, the seed sequence is received during a manufacturing setup process and has not been processed by the seed register, the seed sequence is specific to the integrated circuit, and the pseudo-random sequence generator is coupled to the seed register for generating a pseudo-random sequence based on the seed sequence; combining the sensitive data sequence and the pseudo-random sequence in a bit-by-bit manner using a combiner to generate a protected data sequence that is inaccessible from outside the integrated circuit, wherein the combiner comprises a plurality of logic gates, at least one output of the plurality of logic gates being coupled to an input of a linear feedback shift register in the pseudo-random sequence generator, and data in the protected data sequence having substantially the same average power and substantially the same potential difference; The protection data sequence is stored in a non-volatile memory in the integrated circuit.

12. The method of claim 11, further comprising: generating a write address according to a region address and a register length of the pseudo-random sequence generator; Storing the protection data sequence includes storing the protection data sequence in a non-volatile memory according to the write address. 13 . The method of claim 11 , wherein generating the pseudo-random sequence according to the seed sequence is based on a characteristic polynomial, wherein the characteristic polynomial is specific to a product version of the integrated circuit.

14. The method of claim 11, further comprising: The protected data sequence and the pseudo-random sequence are combined to recover the sensitive data sequence.

15. The method of claim 11, wherein the seed sequence comprises at least one of: a unique user identifier (UUID), a unique device identifier (UDID), and a unique bit sequence generated by a random number generator during factory settings.

Images