The system and process for compiling source code

Abstract

Embodiments of the present disclosure relate to systems and processes for compiling source code. According to one aspect, a method for compiling source code into computer executable code using a compilation tool includes: receiving the source code as input to the compilation tool; translating the source code into target code comprising machine instructions executable by a processor; then introducing additional instructions selected from illegal instructions and no-operation instructions between the machine instructions of the target code to obtain executable code; and then delivering the executable code as output of the compilation tool.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of French application No. 2011657, filed on November 13, 2020, which is incorporated herein by reference. Technical Field

[0003] Implementations and embodiments of the present disclosure relate to security of certain aspects of computer systems, such as, for example, security of instruction sets executed by the computer systems, and the present disclosure relates particularly to security or security aspects against fault injection attacks. Background Art

[0004] The embodiments apply advantageously, but not exclusively, to computer systems whose processing units comprise, for example, microcontrollers or microprocessors.

[0005] The program includes at least one object code composed of a plurality of machine instructions (or simply referred to as "instructions").

[0006] Machine instructions are the basic operations of object code that can be executed by a processor.

[0007] Machine instructions can be obtained from source code with the help of compilation tools.

[0008] A compilation tool (or "compiler") is a program that converts source code into target code. Specifically, the source code may include functions that are translated into instructions in the target code.

[0009] Furthermore, the execution of object code instructions by the processor is timed by a clock.

[0010] Interference may occur in the clock's electronic components. Such interference may affect the execution of instructions and thus reduce the safety of the program.

[0011] To ensure that a program executes correctly, it's possible to control the execution of instruction sequences at least at certain strategic steps in the program. This requires the application of specific coding rules. These specific coding rules require a high level of technical skill. Furthermore, the application of these coding rules takes time.

[0012] Therefore, a solution that avoids specific encodings is needed.

[0013] Furthermore, a misguided person could successfully interfere with the execution of program instructions by causing the clock used to time the execution of instructions to go awry through a fault injection attack.

[0014] Specifically, by causing the clock to go wrong, some instructions may be redirected and therefore not executed. Other instructions may be executed multiple times. When certain function-ending branch instructions are not executed, the executing program may execute subsequent functions in the code without calling the function.

[0015] Therefore, by making the clock wrong, the execution of the program may be out of control, which may cause safety problems.

[0016] Specifically, by interfering with the execution of the program's instructions, a misled person may successfully subvert the program.

[0017] To combat fault injection attacks, the executed instructions can be controlled and function calls can be replicated to ensure they are executed correctly.

[0018] The disadvantage of these solutions is that they are very intrusive to program code development.

[0019] These solutions also have the disadvantage that they cannot predict all possible outcomes of a fault injection into a program's execution. In practice, it is still possible for the fault injection to affect certain parts of the assembly code over which no execution control is exercised. Consequently, the fault injection may go undetected.

[0020] Furthermore, the compiled code is the same for any computer system using the common code. Specifically, the compiled code is the same for the same compiler tool using the same level of compiler optimization. Therefore, a fault injection attack can be easily reproduced on multiple platforms based on the same code.

[0021] Therefore, there is a need to make the program more robust against fault injection attacks and / or external interference.

[0022] There is also a need for solutions for detecting uncontrolled execution of programs that may be caused by fault injection attacks. Summary of the Invention

[0023] According to one aspect, a method for compiling source code into computer executable code by a compilation tool or compiler, the compilation tool being implemented within a computer processing unit, the method comprising: receiving source code as input to the compilation tool and storing the source code in a memory of the processing unit; the compilation tool translating the source code into target code comprising machine instructions executable by a processor; then the compilation tool introducing additional instructions selected from illegal instructions and no-operation instructions between the machine instructions of the target code to obtain executable code; and then delivering the executable code as output of the compilation tool.

[0024] Such a compilation method can be implemented by a compilation tool, which can be specifically executed by a computer. Such a compilation method can be implemented to obtain multiple executable codes that can be linked, thereby obtaining a compiled program executed by a computer system including a processing unit.

[0025] Such a compilation method thus makes it possible to obtain a modified object code comprising the translated instructions of the source code and the additional instructions introduced by the compilation tool.

[0026] The compilation method is performed according to the processor on which the obtained executable code is expected to be executed. For example, the processor on which the obtained executable code is expected to be executed may be a processor with an ARM type architecture. The source code is then translated into instructions that such a processor can read.

[0027] Specifically, the executable code may be executed by a processor of a microcontroller of a processing unit of a computer system.

[0028] Introducing additional instructions between the translated instructions of the source code can improve the security and robustness of the resulting executable code against fault injection attacks.

[0029] Such a compilation method can be implemented by a compilation tool. Specifically, the compilation tool can automatically implement the proposed compilation method during the compilation of the source code.

[0030] Such a compilation method may facilitate the development of executable code because the insertion of additional instructions is automatically performed by the compilation tool.

[0031] Furthermore, execution of the obtained executable code may be performed by using flash memory instead of random access memory (RAM).

[0032] An illegal instruction is an instruction with an invalid operation code. The operation code is invalid because it does not correspond to any type of instruction that can be executed by the processor on which the executable code is executed.

[0033] When an illegal instruction is read by the processor, the processor cannot execute the instruction. An illegal instruction exception is then issued.

[0034] Therefore, by introducing illegal instructions from the translated instructions of the source code, a fault in the execution of the executable code can be detected by detecting illegal instruction exceptions.

[0035] In particular, a control device may be used that is configured to detect illegal instruction exceptions caused by additional illegal instructions introduced from translated instructions of the source code.

[0036] The control device may also be configured to, upon detecting an illegal instruction exception, stop the uncontrolled execution of the executable code and then perform a security action to prevent the security issue. The security action to prevent the security issue may be, for example, reinitializing the processor executing the executable code or erasing sensitive data, such as encryption keys. The security action may also be writing to a real-time clock (RTC) register to store the error injection attack attempt in memory. The processor may also be slowed down to slow down the attack attempt.

[0037] It is possible to introduce only additional illegal instructions, only additional non-operation instructions, or a combination of these different types of additional instructions.

[0038] The object code may include functions with a set of machine instructions that were originally written in the source code.

[0039] In an advantageous implementation, additional illegal instructions are introduced between functions of the target code.

[0040] The introduction of illegal instructions has the advantage of being simple to implement and not interfering strongly with the execution of executable code.

[0041] In an advantageous implementation, at least one additional illegal instruction is introduced after a branch instruction of the target code translated from the source code.

[0042] For example, when at least one illegal instruction is inserted between two functions of the target code, the at least one illegal instruction is inserted after an unconditional branch instruction marking the end of a first function of the two functions of the target code.

[0043] Thus, when the code executes normally, the function-ending branch instruction is executed, and the at least one additional illegal instruction is not read. Further, when the code executes abnormally and when the function-ending branch instruction jumps, the at least one additional illegal instruction may be read. The reading of the at least one additional illegal instruction then generates an illegal instruction exception, indicating that the execution of the executable code is faulty.

[0044] In addition, some functions of the target code may include unconditional branch instructions. Then, at least one instruction may be inserted after the branch instruction included in the function.

[0045] Therefore, when the code is normally executed, the branch instruction in the function is executed and at least one additional illegal instruction is not read. In addition, when the branch instruction is jumped to following a fault in the execution of the executable code, at least one illegal instruction is read and an illegal instruction exception is generated, thereby indicating a fault in the execution of the executable code.

[0046] Additional illegal instructions may also be introduced after a conditional branch instruction when it is ensured that the condition for taking the branch will be checked during normal execution of the executable code.

[0047] In an advantageous implementation, an additional branch instruction and subsequently at least one additional illegal instruction are introduced between two machine instructions of the translated target code of the source code.

[0048] A branch instruction followed by the introduction of at least one illegal instruction may be executed at any point within a function, between two instructions.

[0049] Specifically, a branch instruction is introduced after a first instruction of two translation instructions of the source code, and the branch instruction takes the address of the second instruction of the two translation instructions from the source code as an operand.

[0050] Therefore, when the code is executed normally, the introduced branch instruction is executed and at least one additional illegal instruction is not read.The instruction that is subsequently executed is the next translated instruction of the source code.

[0051] Furthermore, when the branch instruction is jumped after a fault occurs in the execution of the executable code, at least one illegal instruction is read and an illegal instruction exception is generated, thereby indicating a fault in the execution of the executable code.

[0052] A branch instruction may be unconditional or conditional, ensuring that the conditions under which the branch is taken will be checked during normal execution of the executable code.

[0053] Specifically, in an advantageous embodiment, the target code of the source code translation includes a comparison instruction and a subsequent conditional branch instruction. Furthermore, an additional comparison instruction and a subsequent additional conditional branch instruction are introduced into the target code upstream of the source code translation comparison instruction or after the source code translation conditional branch instruction, wherein the additional comparison instruction is identical to the source code translation comparison instruction and the additional conditional branch instruction is opposite to the conditional branch instruction following the source code translation comparison instruction. Furthermore, at least one additional illegal instruction is introduced after the source code translation comparison instruction and the last conditional branch instruction of the translated conditional branch instruction.

[0054] Furthermore, in a preferred embodiment, after a function call branch instruction, at least one additional illegal instruction is introduced, and at least one add instruction is introduced into the function, the add instruction being configured to modify the return address stored in the link register by adding the number of additional illegal instructions introduced after the call function branch instruction to the return address.

[0055] In an advantageous implementation, at least two consecutive additional illegal instructions are introduced between at least two machine instructions of the translated target code of the source code.

[0056] During uncontrolled execution of the executable code, reads of additional illegal instructions may be jumped.

[0057] Therefore, by introducing a number of consecutive illegal instructions greater than two, the chance of reading additional illegal instructions during the uncontrolled execution of the executable code is higher. Therefore, the chance of detecting a fault in the execution of the executable code is higher.

[0058] In an advantageous implementation, the number of consecutive additional illegal instructions introduced between at least two machine instructions of the translated target code of the source code is randomly selected.

[0059] By introducing a random number of consecutive additional illegal instructions, different executable code can be obtained for each compilation of the same source code.

[0060] Since each executable code obtained from the same source code is different, a fault injection attack that has the same effect on the execution of each executable code is more difficult.

[0061] Therefore, introducing a random number of consecutive additional illegal instructions can complicate the replication of a fault injection attack on multiple different computer systems.

[0062] In an advantageous implementation, the introduction of additional instructions is performed only on a portion of the object code.

[0063] In an advantageous implementation, additional instructions are introduced into the object code at locations of the object code that are at least partially randomly selected.

[0064] Specifically, additional instructions are introduced at locations randomly selected from various possible locations.

[0065] By randomly introducing additional instructions, different executable code can be obtained for each compilation of the same source code.

[0066] Since each executable code generated from the same source code is different, it is more difficult to perform a fault injection attack with the same effect for each execution of the obtained executable code.

[0067] Thus, at least partially randomly introducing additional instructions may complicate the replication of a fault injection attack against multiple different computer systems.

[0068] According to another aspect, a compilation tool is provided, which is configured to implement the compilation method as described above.

[0069] According to another aspect, a computer-readable recording medium is proposed on which a compilation tool as previously described is recorded.

[0070] According to another aspect, a computer system includes: a memory including executable code obtained from the aforementioned compiling method; and a processor configured to execute the executable code.

[0071] In one advantageous implementation, the computer system further comprises a control device configured to receive an illegal instruction exception that can be generated by the processor when the processor reads an additional illegal instruction during execution of the executable code, and to halt execution of the executable code after receiving the illegal instruction exception. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Other advantages and features of the present invention will become apparent upon examination of the detailed description of non-limiting implementations and embodiments and the accompanying drawings, in which:

[0073] Figure 1 An embodiment compilation tool is illustrated;

[0074] Figure 2 illustrates an embodiment compilation method that may be implemented by a compilation tool; and

[0075] Figure 3 An embodiment computer system including non-volatile memory including executable code obtained from a compiled method is illustrated. DETAILED DESCRIPTION

[0076] Figure 1 A compilation tool CMP according to one embodiment is illustrated. The compilation tool CMP is a compiler or a compiler program implemented in a computer processing unit (eg a PC type computer).

[0077] The compiler CMP comprises an input IN and an output OUT. The input IN of the compilation tool CMP is configured to receive a source code CS. This source code CS is stored in a memory of the processing unit. The compilation tool CMP is configured to implement a compilation method according to an embodiment and described below. The compilation method makes it possible to obtain a computer-executable code PRG as an output OUT. The code PRG is specifically a program executable by a processor.

[0078] The processor on which the executable code can be executed may have an ARM type architecture. The processor may be a processor of a microcontroller. The processor may also be a microprocessor.

[0079] The source code is written in a programming language, such as C. The source code includes instructions written in the programming language. The source code may define multiple functions, each function including at least one instruction.

[0080] The executable code PRG includes binary instructions that can be executed by a processor.

[0081] The compilation method according to the embodiment that can be implemented by the compilation tool CMP is Figure 2 The compilation method makes it possible to compile a source code CS into a computer executable code PRG.

[0082] First, the method comprises a receiving step 20, in which the compilation tool receives source code as input.

[0083] The compilation method comprises a step 21 of translating a source code CS received as input to a compilation tool CMP. During this step 21, the compilation tool translates the instructions of the source code into machine instructions executable by a processor with which the executable code PRG must be executed.

[0084] The compilation method then comprises a step of introducing additional instructions 22. During this step 22, additional instructions are introduced between the translated machine instructions of the source code. This introduction step 22 makes it possible to obtain an executable code PRG.

[0085] The executable code PRG thus comprises the translated instructions of the source code in step 21 and the additional instructions introduced in step 22 .

[0086] The additional instructions that can be introduced may include illegal instructions and / or non-operation instructions. Specifically, additional instructions of the same type or multiple different types can be introduced.

[0087] The additional instruction is introduced at a location in the machine instruction code where it can be selected from a plurality of possible locations, in particular within a function of the code or between functions of the code. The location where the additional instruction is introduced may be randomly selected.

[0088] Additional instructions may be introduced into the entire machine instruction code or only into certain parts of the code. The number of additional instructions may also vary and be randomly selected.

[0089] In addition, especially in functions and for function calls, the introduction of additional instructions or the movement of literal pools described later may require updating the addresses of the translated instructions of the source code. Figure 2 In the example above, the addresses of the translated instructions of the source code are not updated.

[0090] Especially for error injection attacks or interference outside the processor, the introduction of additional instructions makes it possible to obtain a robust executable code PRG.

[0091] The compilation method then comprises a delivery step 23 in which the executable code PRG is delivered as output of the programming tool.

[0092] According to the C language source code shown in Example 1 in the appendix, various executable codes shown in Examples 3-1 to 3-8 in the appendix can be obtained through various implementations M1 to M8 of step 22 of the compilation method according to various embodiments.

[0093] The illustrated source code is only used to facilitate understanding of the compilation method.

[0094] The source code includes the "main" function, the "function_a" function, and the "function_b" function.

[0095] The "function_b" function is written after the "function_a" function.

[0096] The "main" function is written after the "function_b" function.

[0097] The main function includes a call to the "function_a" function.

[0098] The source code is translated into executable binary instructions by a processor having an ARM architecture. These translated instructions are shown in assembly language in Example 2 in the Appendix to facilitate understanding of the compilation method.

[0099] As shown in Example 2 in the appendix, the translation instructions for the "function_b" function follow the translation instructions for the "function_a" function.

[0100] In addition, the "function_a" and "function_b" functions each include a function-ending branch instruction shown in assembly language by the "bx lr" ARM instruction (see instructions 5c and 94), which translates a "return" instruction into C language as shown in Example 1 in the Appendix.

[0101] Additional instructions are then introduced into the translated instruction sequence of the source code. Various examples of additional instructions introduced into the translated instruction sequence of the source code are illustrated in Examples 3-1 to 3-8 in the Appendix. For ease of understanding, instructions are shown in these examples with assembly language.

[0102] In the embodiment M1 of step 22 shown in Example 3-1, additional illegal instructions are introduced between functions. Specifically, these additional illegal instructions are introduced after the function-ending branch instruction (ie, "bx lr" instruction) for each function.

[0103] These illegal instructions are represented by the expression " <undefined>” is shown.

[0104] In this embodiment M1, the same number of additional illegal instructions are introduced after the function end branch instruction of each function. Specifically, in this embodiment, three additional illegal instructions are introduced after the function end branch instruction. Preferably, at least two additional illegal instructions are added after the function end branch instruction.

[0105] Alternatively, in embodiment M2 of step 22 shown in Example 3-2, a random number of additional illegal instructions are introduced after the function-end branch instruction of each function. Here, for example, after the function-end branch instruction of the "function_a" function, 2 additional illegal instructions are introduced, after the function-end branch instruction of the "function_b" function, 4 additional illegal instructions are introduced, and after the function-end branch instruction of the "function_a" function, 5 additional illegal instructions are introduced. Preferably, at least two additional illegal instructions are added after the function-end branch instruction.

[0106] The introduced additional illegal instructions may be read by a processor on which the executable code PRG is executed. Reading the additional illegal instructions generates an illegal instruction exception.

[0107] When the executable code PRG runs correctly, the function end branch instruction is executed so that additional illegal instructions are not read.

[0108] These additional instructions may be read if the function-ending branch instruction is not executed by the processor, which is particularly likely to be jumped when the processor is subjected to a fault injection attack or interference from outside the processor.

[0109] When the function-ending branch instruction of a function is jumped, the processor can execute the function after the jump function. For example, if the function-ending branch instruction of the "function_a" function is not executed, the processor can execute the "function_b" function.

[0110] However, the reading of the additional illegal instruction after the function end branch instruction can generate an illegal instruction exception. Since the additional illegal instruction is only read when the function end branch instruction is not executed, the generation of the illegal instruction exception after the additional illegal instruction is read can indicate an execution failure of the executable code PRG.

[0111] Introducing at least two additional illegal instructions can reduce the chance that the additional illegal instructions are all jumped when a fault occurs in the execution of the executable code PRG.

[0112] In implementations such as those illustrated in Examples 3-3 and 3-4, additional illegal instructions may also be introduced within a function.

[0113] As shown in the implementation M3 of step 22 shown in Example 3-3, the compilation method can be applicable to introducing at least one additional unconditional branch instruction between two translation instructions of the source code, followed by at least one additional illegal instruction. Therefore, the additional unconditional branch instruction is located after the first instruction of the two translation instructions of the source code, and uses the address of the second instruction of these two instructions as an operand. Preferably, after the additional branch instruction, at least two additional illegal instructions are introduced. The number of additional illegal instructions after the additional unconditional branch instruction can also be randomly selected.

[0114] Introducing a random number of consecutive additional illegal instructions can complicate the replication of a fault injection attack on multiple different computer systems.

[0115] Specifically, in the example shown, these additional instructions are introduced between instructions 34 and 38 of the "function_a" function. The additional unconditional branch instruction points to the address of instruction 38 of the "function_a" function and is followed by two additional illegal instructions.

[0116] Therefore, when the executable code PRG is executed normally, the additional branch instruction is executed so that the additional illegal instruction is not read.

[0117] However, when additional branch instructions are not executed after a fault occurs in the execution of the executable code PRG, additional illegal instructions following these additional branch instructions are read. An illegal instruction exception is then generated. The illegal instruction exception can therefore be used to detect faults in the execution of the executable code PRG.

[0118] In addition, as shown in the implementation M4 of step 22 shown in Examples 3-4, at least one additional illegal instruction can be introduced into the function after the translated unconditional branch instruction of the source code. Preferably, at least two additional illegal instructions are added after the translated unconditional branch instruction of the source code. The number of additional illegal instructions after the translated branch instruction of the source code can also be randomly selected.

[0119] Specifically, in the example shown in Example 3-4, two additional illegal instructions are added after the unconditional branch instructions 2c, 4c, and 50 of the "function_a" function.

[0120] The unconditional branch instruction 2c is used before the "return" instruction of the first "if" structure of the "function_a" function in the source code. This branch instruction 2c then allows the execution of the function end branch instruction 5c which translates the "return" instruction.

[0121] The branch instruction 4c is thus used before the "return" instruction of the second "if" structure of the "function_a" function in the source code. This branch instruction 2c then enables the execution of the function-end branch instruction 5c, which translates the "return" instruction.

[0122] The branch instruction 50 is used to translate the "while(1)" structure of the "function_a" function in the source code.

[0123] Therefore, when the executable code PRG is normally executed, the translated branch instruction of the source code is executed so that the additional illegal instructions following it are not read.

[0124] However, when a fault occurs during the execution of the executable code PRG and the translated branch instruction of the source code is not executed, an additional illegal instruction following the branch instruction is read. An illegal instruction exception is then generated. These illegal instruction exceptions can therefore be used to detect faults during the execution of the executable code PRG.

[0125] Furthermore, certain literal pools may also be used as additional illegal instructions within a function, such as in implementation M5 of step 22 shown in Examples 3-5.

[0126] Literal values ​​are immediate values ​​that can be stored in the executable code area. These literal values ​​are not instructions to be executed by the processor and are processed as illegal instructions when read. Therefore, literal values ​​can be used as illegal instructions to detect faults in the execution of the executable code PRG. For example, by moving the pool of literal values ​​after an additional branch instruction introduced from a translated instruction of the source code, or after a translated branch instruction of the source code, the literal value can be used as an illegal instruction.

[0127] In the example shown in Example 3-5, two literal values ​​are used as illegal instructions: the address<function_a+0x60> The text value and address stored at<function_a+0x6c> An additional illegal instruction is introduced after the last literal value.

[0128] Specifically, as can be seen from Example 3-5, the literal pool has been moved and placed after the function end branch instruction.

[0129] Therefore, these two literal values ​​and the additional illegal instruction can be used to detect faults in the execution of the executable code PRG.

[0130] More specifically, when the executable code PRG is normally executed, the translated function end branch instruction of the source code is executed so that the literal values ​​and the additional illegal instructions following them are not executed.

[0131] However, when a fault occurs during the execution of the executable code PRG, and the function end branch instruction is not executed, the literal value can be read and interpreted as an illegal instruction. In this case, an illegal instruction exception is generated. Similarly, the reading of additional illegal instructions results in the generation of illegal instruction exceptions. These illegal instruction exceptions can therefore be used to detect faults during the execution of the executable code PRG.

[0132] Using literal values ​​as illegal instructions can reduce the number of additional illegal instructions inserted into the executable code PRG. This therefore makes it possible to reduce the size of the executable code PRG.

[0133] In addition, as shown in the implementation M6 of step 22 shown in Example 3-6, after the function call, at least one additional illegal instruction can be introduced. Preferably, after the function call, at least two additional illegal instructions can be introduced. The number of additional illegal instructions introduced after the function call can also be randomly selected.

[0134] Specifically, in the example shown in Example 3-6, in the branch instruction b4 ("bl 0<function_a> ”), three additional illegal instructions are added in the "main" function.

[0135] Adding an illegal instruction after a function call instruction involves modifying a link register (LR) at the end of the function call. Specifically, the link register is modified to point to the instruction address after the additional illegal instruction introduced after the function call instruction.

[0136] For example, in the example shown in Example 3-6, in order to modify the link register (LR), an additional instruction is added to the "function_a" function before the function end branch instruction 5c ("bx lr") that allows a return to the "main" function (the "return" instruction in the translated source code). The additional instruction is an addition instruction ("add lr, lr, #12") that allows the number of additional illegal instructions introduced after the function call instruction b4 to be added to the address contained in the link register (LR). Specifically, in Example 3-6, since three additional illegal instructions are introduced, 12 is added to the value of the link register (LR), and the size of each additional illegal instruction is four bytes.

[0137] Therefore, when the executable code PRG is executed normally, the branch instruction b4 for calling the "function_a" function is executed. Then, when the execution of the "function_a" function ends, the processor executes the instruction b8 following the additional illegal instruction. Therefore, the additional instruction is not read.

[0138] However, when a fault occurs during the execution of the executable code PRG, and the branch instruction b4 for calling the "function_a" function is not executed, the "function_a" function is not executed and the additional illegal instruction following the branch instruction is read. An illegal instruction exception is then generated. These illegal instruction exceptions can therefore be used to detect faults during the execution of the executable code PRG.

[0139] In addition, as shown in the implementation M7 of step 22 shown in Example 3-7, at least one additional illegal instruction can be introduced into the function after the conditional branch instruction (particularly after the "beq" or "bne" instruction). The conditional branch instruction can be a translation instruction of the source code, or even an instruction added from a translation instruction of the source code. In this last case, the conditional branch instruction is therefore introduced, followed by at least one additional illegal instruction from a translation instruction of the source code.

[0140] Specifically, during normal execution of the executable code PRG, additional illegal instructions are added after conditional branch instructions, the conditions of these branches being inevitably checked.

[0141] More specifically, a conditional branch instruction may be used, for example, after a compare instruction.

[0142] Comparison instructions make it possible to compare two values ​​to determine whether they are equal and then to execute certain other instructions depending on the result of the comparison. The selection of these other instructions is performed due to conditional branch instructions.

[0143] In order to ensure that the translated comparison instruction and the subsequent first conditional branch instruction of the source code are correctly executed during the execution of the executable code PRG, the same comparison instruction and the subsequent second conditional branch instruction can be introduced, and the second conditional branch instruction is opposite to the first conditional branch instruction. The comparison instruction and the subsequent second branch instruction can be introduced before or after the translated comparison instruction and the subsequent first branch instruction of the source code.

[0144] According to the execution order of the instructions of the executable code PRG, the additional illegal instruction is introduced at the furthest point after the compared conditional branch instruction. Therefore, if both the first conditional branch and the second conditional branch are not executed, the additional illegal instruction is read. This means that the execution of the executable code PRG does not occur correctly. In fact, since the two conditional branch instructions are opposite, during the normal execution of the executable code PRG, at least one of the two conditional branches must be executed.

[0145] The reading of an additional illegal instruction generates an illegal instruction exception. This illegal instruction exception can therefore be used to detect a fault in the execution of the executable code PRG.

[0146] Specifically, in the examples shown in Examples 3-7, additional instructions are introduced from the translated instructions of the source code to check whether the comparison instruction c4 and the conditional branch instruction c8 are correctly executed during the execution of the executable code PRG.

[0147] Specifically, the first series of additional instructions S1 are introduced between the translation instructions c0 and c4 of the source code. The first series of additional instructions are introduced to initialize the zero flag to "1". Specifically, the value of the zero flag is limited by the result of each comparison instruction. The conditional branch instruction uses the zero flag to determine whether the branch must be executed.

[0148] The first set of additional instructions includes a compare instruction for comparing the value of register r3 with the same value in register r3. Register r3 is the register used to compare the translated instruction c4 in the source code. If the two comparison values ​​are the same, the included compare instruction can determine that the two values ​​are equal. Therefore, the included compare instruction can initialize the zero flag to "1" when executed.

[0149] The first series of additional instructions also includes a conditional branch instruction after the comparison instruction and an additional illegal instruction after the conditional branch instruction. The conditional branch instruction is a "beq" (if equal, then branch) type, and therefore when the comparison result before the branch can determine that the two test values ​​are equal, the branch can be executed. The conditional branch instruction reads the zero flag to determine whether the branch must be executed. If the comparison instruction introduced before the conditional branch instruction has been correctly executed, the zero flag is "1", so that if the executable code PRG is normally executed, it is inevitable to branch, and the next instruction that must be executed is instruction c4. However, if the comparison instruction is not executed, then after a fault occurs, the branch is not executed and the additional illegal instruction is read. Reading this additional illegal instruction generates an illegal instruction exception. This illegal instruction exception makes it possible to detect the fault in the execution of the executable code PRG.

[0150] Instruction c4 following the first series of additional instructions is a comparison instruction translated from the source code, making it possible to compare the value of register r3 with the value “0”.

[0151] This instruction is followed by a conditional branch instruction c8 of the "bne" (branch if not equal) type that branches if the values ​​of the comparison test performed from instruction c4 are not equal.

[0152] After the translated instruction c8 of the source code, a second series of additional instructions S2 is introduced.

[0153] The second series of additional instructions includes a comparison instruction for comparing the value of register r3 with the value “1”. The comparison instruction introduced can therefore set the zero flag to “0”.

[0154] The second series of additional instructions also includes a conditional branch instruction after the comparison instruction and an additional illegal instruction after the conditional branch instruction. The conditional branch instruction is a "bne" (if unequal, then branch) type, and therefore when the comparison result before the branch can determine the difference between the two test values, the branch can be executed. The conditional branch instruction reads the zero flag to determine whether the branch must be executed. If the comparison instruction introduced before the conditional branch instruction has been correctly executed, the zero flag is "0", so that if the executable code PRG is normally executed, it is inevitable to branch, and the next instruction that must be executed is instruction yy. However, if the comparison instruction is not executed, then after a fault occurs, the branch is not executed and the additional illegal instruction is read. Reading this additional illegal instruction generates an illegal instruction exception. This illegal instruction exception makes it possible to detect the fault in the execution of the executable code PRG.

[0155] After the second series of additional instructions S2, a third series of additional instructions S3 is introduced.

[0156] The third series of additional instructions includes comparison instructions identical to the translated comparison instruction c4 of the source code.

[0157] The third series of additional instructions also includes a conditional branch instruction following the comparison instruction, and an additional illegal instruction following the conditional branch instruction.

[0158] The conditional branch instruction is of type "beq" (branch if equal) and is therefore the opposite of the conditional branch instruction c8.

[0159] During normal execution of the executable code PRG, the compare instruction of the third series of instructions can only be executed if the comparison performed from instruction c4 determines that register r3 is equal to "0." Therefore, during normal execution of the executable code PRG, the comparison performed from the compare instruction introduced into the third series of additional instructions must determine that the value of register r3 has not been modified and is still equal to "0." Therefore, during normal execution of the executable code PRG, the condition of the conditional branch instruction of the third series of additional instructions is checked and the branch must be taken. Therefore, the next instruction that must be read is instruction cc.

[0160] However, if an additional illegal instruction of the third series of additional instructions is read, this means that a fault has occurred in the execution of the executable code PRG. Reading this additional illegal instruction generates an illegal instruction exception. This illegal instruction exception makes it possible to detect a fault in the execution of the executable code PRG.

[0161] In an implementation in which additional illegal instructions are introduced from translated instructions of the source code, a control device DCTRL is provided in the computer system SYS, with which the executable code can be executed.

[0162] Such a computer system SYS Figure 3 The computer system SYS comprises a non-volatile memory MEM comprising executable code PRG obtained from the previously described compilation method.

[0163] The computer system SYS further comprises a processor PROC configured to execute an executable code PRG.

[0164] The control device DCTRL is configured to detect illegal instruction exceptions. The control device DCTRL is configured to stop the uncontrolled execution of the executable code PRG after detecting these illegal instruction exceptions and then perform a security action.

[0165] The security action can be, for example, reinitialization of the processor executing the executable code PRG or erasure of sensitive data (such as encryption keys). The security action can also be writing to the real-time clock (RTC) register to store the error injection attack attempt in memory. The processor can also be slowed down to slow down the attack attempt.

[0166] The computer system on which the executable code PRG is executed may comprise such a control device.

[0167] The control device can be implemented by software means or hardware means, for example, by a logic circuit.

[0168] Furthermore, as previously seen, the additional instructions introduced in step 22 of the compilation method may be no-operation ("nop") instructions. Such an implementation M8 of step 22 is shown in Examples 3-8.

[0169] These additional no-op instructions are introduced within the function at locations randomly chosen from the translated instructions of the source code.

[0170] In fact, the random introduction of non-operation instructions makes it possible to obtain a different executable code PRG for each compilation, thereby complicating the replication of fault injection attacks on multiple computer systems based on the same software implementation.

[0171] The introduction of additional instructions between the translated instructions of the source code makes it possible to improve the robustness of the compiled executable code PRG in terms of security and against fault injection attacks.

[0172] Such a compilation method can facilitate the development of executable code because the insertion of additional instructions is performed automatically by the compilation tool.

[0173] Furthermore, execution of executable code may be performed using flash memory rather than random access memory (RAM).

[0174] appendix

[0175] Example 1: Source code (C language):

[0176]

[0177] Example 2: Translated target code of the source code of Example 1 (ARM assembly language)

[0178]

[0179] Example 3-1: Executable code (translated into ARM assembly language) that can be obtained by the first implementation M1 of step 22 of the compilation method

[0180]

[0181] Example 3-2: Executable code (translated into ARM assembly language) that can be obtained by the second implementation M2 of step 22 of the compilation method

[0182]

[0183] Example 3-3: Executable code (translated into ARM assembly language) that can be obtained by the third implementation M3 of step 22 of the compilation method

[0184]

[0185] Example 3-4: Executable code (translated into ARM assembly language) that can be obtained by the fourth implementation M4 of step 22 of the compilation method

[0186]

[0187] Example 3-5: Executable code (translated into ARM assembly language) that can be obtained by the fifth implementation M5 of step 22 of the compilation method

[0188]

[0189] Example 3-6: Executable code (translated into assembly language) that can be obtained by the sixth implementation M6 of step 22 of the compilation method

[0190]

[0191] Example 3-7: Executable code (translated into assembly language) that can be obtained by the seventh implementation M7 of step 22 of the compilation method

[0192]

[0193] Example 3-8: Executable code (translated into assembly language ARM) that can be obtained by the eighth implementation M8 of step 22 of the compilation method

[0194] < / undefined>

Claims

1. A method for compiling source code into computer executable code using a compilation tool, wherein the compilation tool is implemented in a computer processing unit, the method comprising: receiving the source code as input to the compilation tool; storing the source code in a memory of the computer processing unit; translating the source code into target code comprising machine instructions executable by a processor by the compilation tool; After the translation, introducing, by the compilation tool, an introduced branch instruction and an additional instruction selected from additional illegal instructions or additional no-operation instructions after the introduced branch instruction between machine instructions of the target code to obtain the computer executable code, wherein the introduced branch instruction is an unconditional branch instruction; as well as After said importing, delivering said computer executable code as output of said compilation tool; At least one additional illegal instruction is introduced after the function call branch instruction; as well as At least one add instruction is introduced in the function, the at least one add instruction being configured to modify the return address stored in the link register by adding a plurality of additional illegal instructions introduced after the function call branch instruction to the return address.

2. The method of claim 1 , wherein the object code comprises a function comprising a machine instruction set, and the method comprises: The additional illegal instructions are introduced between the functions in the object code.

3. The method according to claim 1, further comprising: At least one additional illegal instruction is introduced after a branch instruction of the target code translated from the source code.

4. The method according to claim 1, further comprising: After the introduced branch instruction, at least one additional illegal instruction is introduced between two machine instructions of the target code translated from the source code.

5. The method of claim 1 , wherein the target code translated from the source code includes a translated compare instruction followed by a translated conditional branch instruction, and the method further comprises: introducing an additional compare instruction and a subsequent additional conditional branch instruction in the target code upstream of the translated compare instruction of the source code or after the translated conditional branch instruction of the source code, the additional compare instruction being identical to the translated compare instruction of the source code and the additional conditional branch instruction being the opposite of the translated conditional branch instruction following the translated compare instruction of the source code; as well as At least one additional illegal instruction is introduced after a last conditional branch instruction from the additional conditional branch instruction and the translated conditional branch instruction of the source code.

6. The method according to claim 1, further comprising: At least two consecutive additional illegal instructions are introduced between at least two machine instructions of the target code translated from the source code.

7. The method according to claim 6, further comprising: A number of consecutive additional illegal instructions is randomly selected to be introduced between the at least two machine instructions of the target code translated from the source code.

8. The method according to claim 1, further comprising: The introducing of the additional instructions is performed on only a portion of the object code.

9. The method according to claim 1, further comprising: The additional instructions are introduced into the object code at locations of the object code that are at least partially randomly selected.

10. A non-transitory computer-readable recording medium comprising: A compilation tool, for compiling source code into computer executable code, wherein the compilation tool is configured to: receiving the source code as input; storing the source code in a memory of a computer processing unit; translating the source code into object code comprising machine instructions executable by a processor; After the translation, introducing an introduced branch instruction and an additional instruction selected from additional illegal instructions or additional no-operation instructions after the introduced branch instruction between machine instructions of the target code to obtain the computer executable code, wherein the introduced branch instruction is an unconditional branch instruction; After said importing, delivering said computer executable code as output; At least one additional illegal instruction is introduced after the function call branch instruction; as well as At least one add instruction is introduced in the function, the at least one add instruction being configured to modify the return address stored in the link register by adding a plurality of additional illegal instructions introduced after the function call branch instruction to the return address. 11 . The non-transitory computer-readable recording medium according to claim 10 , wherein the object code includes functions including machine instruction sets, and wherein the compilation tool is configured to introduce the additional illegal instructions between the functions of the object code. 12 . The non-transitory computer-readable recording medium of claim 10 , wherein the compilation tool is configured to introduce at least one additional illegal instruction after a branch instruction of the target code translated from the source code.

13. The non-transitory computer-readable recording medium of claim 10, wherein the compilation tool is configured to introduce at least one additional illegal instruction between two machine instructions of the target code translated from the source code after the introduced branch instruction.

14. The non-transitory computer-readable recording medium of claim 10 , wherein the target code translated from the source code includes a translated comparison instruction followed by a translated conditional branch instruction, and wherein the compilation tool is configured to: introducing an additional compare instruction and a subsequent additional conditional branch instruction in the target code upstream of the translated compare instruction of the source code or after the translated conditional branch instruction of the source code, the additional compare instruction being identical to the translated compare instruction of the source code and the additional conditional branch instruction being the opposite of the translated conditional branch instruction following the translated compare instruction of the source code; and At least one additional illegal instruction is introduced after a last conditional branch instruction from the additional conditional branch instruction and the translated conditional branch instruction of the source code. 15 . The non-transitory computer-readable recording medium according to claim 10 , wherein the compilation tool is configured to introduce at least two consecutive additional illegal instructions between at least two machine instructions of the target code translated from the source code.

16. A computer system comprising: The non-transitory memory includes computer executable code obtained from source code by a compilation tool, configured to: receiving the source code as input; storing the source code in a memory of a computer processing unit; translating the source code into object code comprising machine instructions executable by a processor; After the translation, introducing an introduced branch instruction and an additional instruction selected from additional illegal instructions or additional no-operation instructions after the introduced branch instruction between machine instructions of the target code to obtain the computer executable code, wherein the introduced branch instruction is an unconditional branch instruction; as well as After said importing, delivering said computer executable code as output; At least one additional illegal instruction is introduced after the function call branch instruction; as well as introducing at least one add instruction in the function, the at least one add instruction being configured to modify the return address stored in the link register by adding a plurality of additional illegal instructions introduced after the function call branch instruction to the return address; as well as A processor is configured to execute the computer executable code.

17. The computer system according to claim 16, further comprising a control device, wherein the control device is configured to: receiving, during execution of the computer-executable code, an illegal instruction exception generated by the processor in response to the processor reading an additional illegal instruction; and After receiving the illegal instruction exception, the execution of the computer-executable code is halted.

18. The computer system of claim 16, wherein the object code comprises functions comprising a machine instruction set, and wherein the compilation tool is configured to introduce the additional illegal instructions between the functions in the object code.

19. The computer system of claim 16, wherein the compilation tool is configured to introduce at least one additional illegal instruction after a branch instruction of the target code translated from the source code.

20. The computer system of claim 16, wherein the compilation tool is configured to introduce at least one additional illegal instruction between two machine instructions of the target code translated from the source code after the introduced branch instruction.

21. The computer system of claim 16 , wherein the target code translated from the source code comprises a translated compare instruction followed by a translated conditional branch instruction, and wherein a compilation tool is configured to: introducing an additional compare instruction and a subsequent additional conditional branch instruction in the target code upstream of the translated compare instruction of the source code or after the translated conditional branch instruction of the source code, the additional compare instruction being identical to the translated compare instruction of the source code and the additional conditional branch instruction being the opposite of the translated conditional branch instruction following the translated compare instruction of the source code; and At least one additional illegal instruction is introduced after a last conditional branch instruction from the additional conditional branch instructions and the translated conditional branch instructions of the source code.

22. The computer system of claim 16, wherein the compilation tool is configured to introduce at least two consecutive additional illegal instructions between at least two machine instructions of the target code translated from the source code.

Images