Obfuscation of operations in computing devices

Abstract

This paper proposes a method for operation obfuscation using minimal additional hardware. The method can begin by performing a first iteration of a set of calculations, the execution of which produces a first iterative output. The method can continue by performing a second iteration of the set of calculations, wherein the second execution is different from the first iteration, but should meet a matching condition. The difference can be a rearrangement of sub-operations, the insertion of pseudo-sub-operations, or a combination of the two. After the iteration is completed, the iterative outputs can be compared. If the comparison of the first iterative output and the second iterative output meets the matching condition, the process result can be output. If the matching condition is not met, an error detection signal can be output.

Description

Background Art

[0001] Tampering with or hacking electronic systems can allow unauthorized users to access sensitive information. An example of such sensitive information might be secret key information used in cryptographic engine implementations such as AES (Advanced Encryption Standard). Differential Fault Analysis (DFA) is a type of side-channel attack that introduces faults into cryptographic implementations to reveal their internal state. These faults can be caused by a variety of methods, including applying high temperatures, applying unsupported power supply voltages or currents, inducing excessive overclocking, applying strong electric or magnetic fields, or even applying ionizing radiation. Summary of the Invention

[0002] A method for obfuscating the operations of a computing device is provided. The method is suitable for preventing DFA attacks. Obfuscating operations in a process such as an encryption process or other sensitive iterative process can be performed by inserting dummy operations, rearranging operations, or both.

[0003] The obfuscation method and countermeasure can begin by executing a first iteration of a set of calculations, the execution of which produces a first iterative output. The method can continue by executing a second iteration of a set of calculations, wherein the second execution is different from the first iteration, but should produce the same iterative output. The execution of the set of calculations produces a second iterative output. The difference between executing the first and second iterations can be a rearrangement of valid sub-operations, the insertion of pseudo-sub-operations, or a combination of the two. After the two iterations are completed, the iterative outputs can be compared. If the first and second iterative outputs meet the matching conditions, the results, such as ciphertext, can be provided as expected within the computing system. Otherwise, the results can be discarded and a notification can be provided to the processor for potential countermeasures.

[0004] A system for obfuscating operations is described. The system having operation obfuscation functionality may include: circuitry for executing a process, the process comprising a plurality of sub-operations, each sub-operation individually selectable for the operation; a comparator coupled to receive an output of the circuitry for comparison with outputs from an iteration of the process, the comparator outputting an error detection signal when a matching condition for the outputs from the iteration of the process is not satisfied; and control circuitry coupled to the circuitry for executing the process, the control circuitry configured to select a sub-operation of the process to execute a first iteration of a set of computations, the execution of the set of computations producing a first iteration output, and select a sub-operation of the process to execute a second iteration of the set of computations, the execution of the set of computations producing a second iteration output, wherein the control circuitry causes the second iteration to differ from the first iteration.

[0005] This summary is provided to introduce a series of concepts in a simplified form, which will be further described in the detailed description below. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 A timing diagram of a conventional differential fault analysis (DFA) attack countermeasure is shown.

[0007] Figures 2A to 2C A timing diagram of a DFA attack countermeasure with obfuscation is shown; Figure 2A shows the obfuscation using pseudo-ops, Figure 2B shows the confusion using reordering of operations, and Figure 2C The confusion using both pseudo-operations and reordering of operations is shown.

[0008] Figure 3 An example computing system with a DFA attack countermeasure that can implement the described obfuscation method is shown.

[0009] Figure 4A The process flow of obfuscation methods and countermeasures is shown.

[0010] Figure 4B A process flow implementation for obfuscation is shown such that the duration and / or order of operations differ between a first iteration and a second iteration. DETAILED DESCRIPTION

[0011] A method for obfuscating the operations of a computing device is provided. The method is suitable for preventing DFA attacks by, for example, increasing the difficulty of synchronization. Obfuscating operations in a process, such as an encryption process or other sensitive iterative process, can be performed by inserting dummy operations, rearranging operations, or both. Inserting dummy operations can make it difficult to discern the duration of a process with a set of operations, and rearranging operations within a process's set of operations can make injection at the same point in the process very difficult.

[0012] While the methods described are provided in the context of cryptographic systems, it should be understood that these methods may be applied to other systems where protection against differential fault analysis attacks is desired. Advantageously, certain methods described herein may be implemented using existing hardware within a cryptographic engine, including, but not limited to, state machines and counters. In some cases, attacks may be identified during operation of the methods, and the computing device may utilize the identification of the attack to improve security by implementing additional countermeasures.

[0013] Some encryption systems utilize AES encryption. AES typically consists of multiple rounds, which progressively transform the input (state) through repeated operations and progressively mix the result with a round key. Round keys are typically derived from the AES key. For encryption, the common operations performed in each round include byte substitution (SubBytes) (SBOX - substitution box - non-linear operation), row shift (ShiftRows) (the shift represents the rows of the state matrix of the input), column mixing (MixColumns) (linear transformation of each column of the state matrix), and round key addition (AddRoundKey) (exclusive OR (XOR) between the state and the round key).

[0014] One method of protecting cryptographic systems from DFA attacks involves replicating a computation and comparing the final results of the two computations. In particular, Figure 1 One such countermeasure shown includes three steps: an initial computation step that includes a set of computations grouped into different sub-operations, one or more repeated computation steps that use exactly the same inputs as the initial computation step, and a comparison step that compares the results of the initial computation with the repeated computations. If the results produced by this process match, the cryptographic engine produces the output; otherwise, the cryptographic engine rejects the output and alerts the upper layer.

[0015] Figure 1 The timing diagram of the traditional DFA attack countermeasure is shown in FIG. Figure 1 As shown, the system can initially be idle until the process of interest is called. For example, in an encryption process, plaintext can be received as part of the encryption operation, or ciphertext can be received as part of the decryption operation. Three sub-operations are shown for each iteration. As described above, the same input can be applied to two iterations and the results compared. For example, the input can be plaintext and the result can be ciphertext. In this illustration, each iteration executes the same process and takes the same amount of time T2. The result of the first iteration is stored and then compared with the result of the second iteration using a comparator (which may include a register / storage device that stores the result of the first iteration).

[0016] However, an experienced attacker can exploit known information about the system, such as duration, to eventually replicate the fault exactly in two comparison iterations (e.g., injecting a fault with period T2), thereby blocking the comparison step and producing a faulty ciphertext without alerting the system to the attack.

[0017] For example, the duration of an entire computation can be determined by examining the timing of inputs and outputs. With this knowledge, an attacker can inject a fault at precisely the same time in two consecutive loops. Eventually, the injection will be precise enough and both loops will be checked with the same comparison, causing the two interrupted operations to produce the same output. In this case, the system will not detect the attack, and the attacker will be able to see the erroneous ciphertext.

[0018] Figures 2A to 2C A timing diagram of a DFA attack countermeasure with obfuscation is shown; Figure 2A shows the obfuscation using a pseudo-sub-operation, Figure 2B shows the obfuscation using the reordering of valid sub-operations, and Figure 2C shows confusion using both pseudo-sub-operations and reordering of valid sub-operations. Figure 2A , dummy sub-operations can be included during a process to adjust the duration of an iteration. A dummy sub-operation can be the same operation as that performed in an active sub-operation. For example, if a process has three active sub-operations, a dummy sub-operation can be any of the three active sub-operations using different data or the same data (but with the results discarded). In some cases, a dummy sub-operation is an operation that is different from any active sub-operation of the process.

[0019] Pseudo-sub-operation can be inserted before the effective sub-operation of this process, be scattered between the effective sub-operation of this process, insert after the effective sub-operation of this process or their combination.In addition, the position and quantity of pseudo-sub-operation can change for each iteration so that the first iteration and the second iteration have different durations.In some cases, pseudo-operation can comprise the calculating of effective sub-operation, and wherein the result is discarded rather than being used.For example, effective sub-operation and pseudo-sub-operation can be carried out identical sub-operation.

[0020] Because the system knows which operations are pseudo-sub-operations and which operations are valid sub-operations, it can obtain appropriate results for each iteration. Since each iteration has a T2+variable extended duration, it is more challenging for an attacker to determine where / when to interrupt the operation. For example, if an attacker uses the same repeated attack with a period of T2, the DFA attack countermeasure can detect the failure when comparing the results of the first iteration with the results of the second iteration, because different parts of the process are affected differently than the attacker expected, and it is possible that one iteration is interrupted more than another (for example, a pseudo-sub-process can be one that is affected during one iteration, while a valid sub-operation is affected in another iteration).

[0021] refer to Figure 2B, valid sub-operations can be reordered to confuse the operations. For example, the first iteration can be in the order of sub-operation 2, sub-operation 3, and sub-operation 1; then, the second iteration can be in a different order of sub-operation 1, sub-operation 2, and sub-operation 3. Because the system knows the order in which each operation occurs, the appropriate results can be determined through appropriate procedures. Figure 2B In the scenario shown, although the duration of each iteration is the same, if the attacker uses the same repetitive attack with period T2, the DFA attack countermeasure can detect the failure when comparing the result of the first iteration with the result of the second iteration because different sub-operations may be interrupted.

[0022] refer to Figure 2C A combination of inserting dummy sub-operations and rearranging valid sub-operations can be performed to further obfuscate the process. In the illustrative example, each iteration contains three valid sub-operations and multiple dummy sub-operations. A valid sub-operation is a computation related to the actual computation, while a dummy sub-operation can be an operation performed on other data or an operation that does not affect the data being operated on. Furthermore, the order in which valid sub-operations are executed in the second iteration can be different from that in the first iteration. Adding dummy sub-operations makes durations more difficult to guess reliably, and rearranging valid sub-operations makes synchronization more difficult.

[0023] Although Figure 2C Two approaches are depicted in use, but either or both of these approaches may be used for a particular system at a particular time. For example, some iterations may include only pseudo sub-operations, some iterations may involve only rearranging valid sub-operations, and some iterations may include both (as long as the valid result is the result of comparison when executing the countermeasures shown). Signals indicating an attack can be used to trigger additional countermeasures or stronger countermeasures. In some cases, if an attack is suspected, the intensity of the type of obfuscation can be adjusted to provide greater security for the system. For example, if the default countermeasure technique is the rearrangement of valid sub-operations, such as with respect to Figure 2B As described, and when an attack is suspected to be occurring, the system can begin including dummy sub-operations in addition to or instead of rearranging valid sub-operations to limit the amount of data that an attacker can obtain.

[0024] Figure 3 An example computing system with a DFA attack countermeasure that can implement the described obfuscation method is shown. Figure 3, system 300 may include circuitry for executing a process that may be grouped into sub-operations. In the illustrative example, three sub-operations may be executed: SOP 1 310, SOP 2 320, and SOP 3 330. Each sub-operation (e.g., SOP 1 310, SOP 2 320, and SOP 3 330) may be individually selectable for the operation. In order to execute a countermeasure process that compares multiple iterations, a comparator 340 and a storage device 342 are used. To implement the obfuscation method, system 300 includes control circuitry including a state machine (not shown) and selection circuitry including a multiplexer (MUX) 350 and a demultiplexer (DEMUX) 360. System 300 may receive a set of control signals 370 (some of which may come from the state machine of system 300) and functional data 380. The control signals 370 may include enable signals 371, 372, 373 for various sub-operations, a select signal 374 indicating whether the operation is a valid sub-operation or a pseudo sub-operation, and an execution comparison signal 376 indicating whether the sub-operation is the last operation in the iteration and the result (e.g., process output 382) is ready for comparison. Before or during the operation, a first mode and a second mode different from the first mode may be generated and / or loaded into the state machine. The first iteration may be controlled according to the first mode, and the second iteration may be controlled according to the second mode. The first mode and the second mode include a sequence of valid sub-operations and where / when the pseudo sub-operations will be executed.

[0025] System 300 can output an attack detection signal 385 based on the result of comparing the iterations using comparator 340 (e.g., comparison result 345). An execution comparison signal 376 is used to indicate when an iteration is complete. Although execution comparison signal 376 is shown as being applied to comparator 340, it should be understood that the execution comparison signal can be applied to a transmission gate or switch so that comparator 340 only receives data at appropriate times.

[0026] In some cases, the comparator 340 stores the first iteration in the storage device 342 and then performs a comparison for the next iteration upon receiving the process output; the process output is then stored in the storage device 342 to compare the process output with the subsequent process output. In some cases, the comparator 340 stores the first iteration in the storage device 342 and compares each subsequent iteration with the value from the first iteration. As described above, if the comparison result indicates that the iteration does not meet the matching condition, the comparison result 345 of the error detection signal is output as an attack detection signal 385. The attack detection signal 385 can be received by the processor and used as a trigger to initiate more stringent defenses. If the comparison result indicates that the iteration does meet the matching condition, the process output signal 382 can be output to provide process result data 390. The process result data 390 can be, for example, a decrypted or encrypted version of the input function data (depending on the type of process implemented by the sub-operation).

[0027] System 300 can use MUX 350 and DEMUX 360 to support obfuscation techniques. For example, select signal 374 can select between a pseudo-loop and a valid loop. Select signal 374 can control multiplexer 350, which selects between a row of functional (valid) data 381 and one or more rows of dummy data 383. In the case of a pseudo-loop, a feed of dummy data 383 is used and passed through the system. Dummy data 383 can be pre-seeded data, randomly generated, the output of a previous pseudo-sub-operation, the output of a previous valid sub-operation, or a byproduct of some other computation. Individual enable signals 371, 372, 373 for various sub-operations 310, 320, 330 can allow the order of operations to be changed or allow a pseudo-sub-operation to interrupt the sequence of valid sub-operations. After completing a loop for each sub-operation, DEMUX 360 can be used to control whether the intermediate result is sent as valid data to the functional bus (e.g., as functional data 381) for application to a subsequent sub-operation or as dummy data (e.g., dummy data 383) to be sent to the dotted line.

[0028] Figure 4A The following diagram shows the process flow of obfuscation methods and countermeasures. Figure 4A , the method 400 may begin by performing a first iteration (410) of a set of calculations. For example, the cryptographic engine may receive inputs from a controller including a set of functional data and control signals; and inputs such as reference signals. Figure 3 The control circuitry described may be used to control the execution of the set of calculations. When the method 400 is executed as part of a cryptographic system, the calculations may be performed on input received by the system (e.g., such as information about Figure 3The decoding process or encoding process is performed by performing the function input 380 described above. The execution of the set of calculations during the first iteration produces a first iteration output. A second iteration (420) is then performed. The execution of the set of calculations during the second iteration produces a second iteration output. The second iteration performs the same set of calculations for the encryption (or other) process as the first iteration and uses the same input data (e.g., such as the Figure 3 380). However, the second iteration is different from the first iteration (e.g., has differences in characteristics). Examples of the second iteration being different from the first iteration may include, but are not limited to, a reordering of valid sub-operations, insertion of dummy sub-operations, or a combination of reordering and insertion of sub-operations that is different from the order of the first iteration. For example, Figure 4B The obfuscation method described in more detail may be applied to each iteration such that the duration and / or order of operations differ between two iterations.

[0029] After performing two iterations (and even after each subsequent iteration), the system compares (430) the first iteration output and the second iteration output (or any two outputs when more than two iterations are performed) to determine (435) whether the outputs meet the matching condition. If it is determined that the comparison meets the matching condition, the process result can be output (440). For example, when the input is plaintext and the system performs encryption, the resulting ciphertext is output (i.e., output as the iterative output from each iteration). If it is determined that the comparison does not meet the matching condition, a signal indicating a detected error can be output (450). In some cases, the process result is hidden or discarded in a manner that the system can avoid using an incorrect result. In some cases, the data is allowed to be output but is not used by the system for further processing.

[0030] A signal indicating a detected error can be output to a processor or other controller as an attack signal, triggering stronger countermeasures. Stronger countermeasures include, but are not limited to, implementing more obfuscation methods and increasing the obfuscation of existing methods. For example, the default level may simply be to rearrange sub-operations in the second iteration. Upon receiving an attack signal, the system can implement the insertion of pseudo-sub-operations. If more attack signals are received, the number of pseudo-operations can be increased, or more countermeasures can be introduced.

[0031] Figure 4BA process flow embodiment for obfuscation is shown such that the duration and / or order of operations differ between a first iteration and a second iteration. Obfuscation method 470 may begin by obtaining (472) a first sequence of valid sub-operations. The first sequence may be a predetermined or default sequence of sub-operations. In some cases, the order of the first sequence is a generated order (e.g., using any suitable sorting function). A first pattern of the first iteration is obtained (474) for use during execution of the first iteration of the group of computations (e.g., operation 410). The first pattern includes the first sequence of valid sub-operations. In some embodiments, pseudo sub-operations are also included in the first pattern.

[0032] Obfuscation method 470 continues by obtaining (476) a second sequence of valid sub-operations. Depending on the embodiment, the second sequence can be in the same order as the first sequence or in a different order. A second pattern of a second iteration is obtained (478) for use during execution of a second iteration of the set of computations (e.g., operation 420). The second pattern includes the second sequence of valid sub-operations. In some embodiments, dummy sub-operations are also included in the second pattern.

[0033] Where dummy sub-operations are included in the first pattern, one or more dummy sub-operations may be added (480) to obtain the first pattern (eg, operation 474).

[0034] Where dummy sub-operations are included in the second pattern, one or more dummy sub-operations may be added (490) to obtain the second pattern (eg, operation 478).

[0035] Obfuscation methods involve making the first iteration distinct from (ie, different from) the second iteration in some way.

[0036] In some embodiments, this can be achieved by reordering (485) the first sequence to generate the second sequence. For example, the first and second sequences can be made different by using ordered seeds to generate different permutations, using an ordering function (e.g., a function that changes the order), or following a predetermined / programmed pattern for different iterations.

[0037] In some embodiments where the second sequence is a reordered first sequence, the number and position of the added dummy sub-operations may be the same for both patterns. In some embodiments where the second sequence is a reordered first sequence, one or more dummy sub-operations are added / inserted in different amounts (e.g., fewer or more) and / or positions in the pattern.

[0038] In some embodiments, the first iteration is made different from the second iteration by using pseudo-sub-operations. Pseudo-sub-operations can be inserted before the effective sub-operations, interspersed between the effective sub-operations, inserted after the effective sub-operations of the process, or a combination thereof. In one case, as a result of inserting one or more pseudo-sub-operations into the second iteration during the execution of a series of calculations, the second iteration can be different from the first iteration, but the effective sub-operations have the same order. For example, the first pattern can not have pseudo-sub-operations, and the second pattern has one or more pseudo-sub-operations. For another example, the first pattern can have a certain number of pseudo-sub-operations, and the second pattern has different numbers of pseudo-sub-operations. For another example, the positions of the pseudo-sub-operations in the first pattern and the second pattern can be different (the total number of pseudo-sub-operations is the same). The number and position of the insertion of pseudo-sub-operations can be based on the seed formed at runtime, can be manually pre-programmed, or can be determined in some other way.

[0039] The system knows which operations are pseudo sub-operations and which operations are valid sub-operations. The system also knows the reordering of all sub-operations of the process. The matching conditions of the first iteration output and the second iteration output are determined according to a specific obfuscation method known to the system.

[0040] Although the subject matter has been described in language specific to structural features and / or acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as examples of implementing the claims, and other equivalent features and acts are intended to fall within the scope of the claims.

Claims

1. A method for obfuscating operations, suitable for preventing differential fault analysis attacks, comprising: obtaining a first sequence of a set of computations to be executed as a first iteration, wherein the first iteration of the set of computations includes valid sub-operations of the set of computations in the first sequence; executing the first iteration of the set of calculations, execution of the first iteration of the set of calculations producing a first iteration output; obtaining a second sequence of the same set of computations as performed in the first iteration to be performed as a second iteration different from the first iteration, wherein the second sequence of the second iteration differs from the first sequence of the first iteration in that at least an order of the valid sub-operations is different from the first sequence; After executing the first iteration, executing the second iteration of the set of calculations, execution of the second iteration of the set of calculations producing a second iteration output; comparing the first iteration output and the second iteration output; determining whether the comparison of the first iterative output and the second iterative output satisfies a matching condition; as well as A process result is output when the matching condition is satisfied, and an error detection signal is output when the matching condition is not satisfied. The method according to claim 1 , further comprising discarding the process result when the matching condition is not satisfied.

3. The method of claim 1 , wherein the first iteration of the set of computations further comprises one or more pseudo sub-operations, wherein the one or more pseudo sub-operations are at the beginning of the first sequence of valid sub-operations, interspersed within the first sequence of valid sub-operations, after the first sequence of valid sub-operations, or a combination thereof.

4. The method of claim 3 , wherein the second iteration differs from the first iteration in having fewer or more of the one or more pseudo-sub-operations than the first iteration, including the one or more pseudo-sub-operations in different locations than the first iteration, or a combination thereof.

5. The method of claim 3 , wherein the second iteration of the set of computations further comprises the one or more dummy sub-operations, wherein the one or more dummy sub-operations are at the beginning of the second sequence of valid sub-operations, interspersed within the second sequence of valid sub-operations, after the second sequence of valid sub-operations, or a combination thereof. The method of claim 3 , wherein the one or more pseudo sub-operations comprise computation of a valid sub-operation. The method according to claim 1 , further comprising increasing the strength of a countermeasure when outputting the error detection signal.

8. A system with an operation obfuscation function, suitable for preventing differential fault analysis attacks, comprising: Circuitry for performing a process, the process comprising a plurality of sub-operations, each sub-operation being individually selectable for the operation; a comparator coupled to receive an output of the circuit to compare an output from an iteration of the process, the comparator outputting an error detection signal when a match condition for the output from an iteration of the process is not satisfied; and a control circuit coupled to the circuit for performing a process, the control circuit being configured to: obtaining a first sequence of a set of computations to be executed as a first iteration by selecting at least sub-operations of the process, execution of the first iteration of the set of computations producing a first iteration output, wherein the first iteration of the set of computations includes valid sub-operations of the set of computations in the first sequence; and obtaining a second sequence of the same set of computations to be performed as a second iteration by selecting at least the same sub-operations of the process, execution of the second iteration of the set of computations occurring after the first iteration is executed and producing a second iteration output, wherein the control circuitry causes the second iteration to be different from the first iteration, wherein the second sequence of the second iteration differs from the first sequence of the first iteration in that at least the order of the valid sub-operations is different from the first sequence, Wherein, the comparator is configured to: comparing the first iteration output and the second iteration output; determining whether the comparison of the first iterative output and the second iterative output satisfies a matching condition; as well as An error detection signal is output when the matching condition is not satisfied.

9. The system of claim 8, wherein the control circuit comprises a state machine, a multiplexer (MUX), and a demultiplexer (DEMUX).

10. The system of claim 8, wherein the control circuit reorders the valid sub-operations to cause the second iteration to differ from the first iteration by selecting sub-operations of the process in the first sequence for the first iteration and selecting sub-operations of the process in the second sequence for the second iteration.

11. The system of claim 8, wherein the control circuitry is further configured to add one or more dummy sub-operations to the sub-operations of the process.

12. The system according to claim 11, wherein the control circuit further controls whether the intermediate result of the sub-operation is sent as valid data to the function bus or as dummy data to the dotted line.

13. The system of claim 11, wherein the second iteration differs from the first iteration further in that: the second iteration includes fewer or more of the one or more pseudo sub-operations compared to the first iteration, the second iteration includes the one or more pseudo sub-operations in different positions compared to the first iteration, or a combination thereof.

14. The system of claim 8 , wherein as part of obtaining the first sequence of the set of calculations to be performed as the first iteration and obtaining the second sequence of the same set of calculations to be performed as the second iteration, the control circuit is further configured to: Get the first set of valid sub-operations; obtaining a first pattern comprising the first set of valid sub-operations and one or more dummy sub-operations, wherein the control circuitry selects sub-operations of the process for the first iteration using the first pattern; Obtaining a second set of valid sub-operations that are identical to the first set of valid sub-operations; as well as A second pattern is obtained that includes the second set of valid sub-operations and the one or more dummy sub-operations, wherein the control circuitry selects sub-operations of the process for the second iteration using the second pattern.

15. The system of claim 14, wherein the control circuitry obtains the first mode by adding the one or more dummy sub-operations at the following locations: at the beginning of the first set of valid sub-operations, interspersed within the first set of valid sub-operations, after the first set of valid sub-operations, or a combination thereof.

16. The system of claim 14, wherein the control circuitry obtains the second mode by adding the one or more dummy sub-operations at the following locations: at the beginning of the second set of valid sub-operations, interspersed within the second set of valid sub-operations, after the second set of valid sub-operations, or a combination thereof.

Images