Method and integrated circuit for detecting reverse engineering on a processor using an instruction pointer

Abstract

Embodiments of the present disclosure relate to methods and integrated circuits for detecting reverse engineering on a processor using an instruction pointer. A method for detecting linear extraction of information in a processor using an instruction pointer. The method includes monitoring a value of the instruction pointer, determining a number of consecutive increments of the value of the instruction pointer by a constant amount, and generating a detection signal if the number is greater than or equal to a detection threshold.

Description

[0001] Cross-reference to related applications

[0002] This application claims priority to French patent application No. FR2013623, filed on December 18, 2020, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This disclosure generally relates to microelectronics, and in certain embodiments relates to protection against reverse engineering. Background Technology

[0004] Reverse engineering can be used to study and potentially clone the behavior of microcontrollers. A microcontroller typically includes at least one processor and memory connected via a data bus. Reverse engineering can include invasive attacks on the microcontroller to force the processor to linearly access information in memory. Specifically, the processor is forced into a linear read mode. In this state, the software embedded in memory no longer executes correctly, branch instructions are no longer executed, and as a result, the processor reads all instructions contained in memory sequentially (i.e., one after another).

[0005] One example includes a hardware analysis phase that uses de-layering and advanced microscopy techniques to identify hardware elements carrying secret information. The hardware analysis phase identifies the logic controlling address fetching calculations.

[0006] The data extraction phase using focused ion beam (FIB) or fault injection techniques can be used to force the extracted address logic circuitry into a linear execution mode (i.e., an operation mode in which the processor only executes branch instructions whose addressing mode includes the address currently read in the processor).

[0007] The processor reads the entire memory contents sequentially, and microsensor technology extracts what the processor has read. For example, data can be fetched at the instruction register to temporarily store each instruction from memory before execution.

[0008] Based on the secret content extracted through reverse engineering, the software embedded in the microcontroller can be reconstructed, and cloned products can be produced.

[0009] Conventional solutions using general hardware protection layers or interoperability techniques between two processors are known, and workarounds have been developed to circumvent them.

[0010] Detecting attempts to extract source code contained in memory would be advantageous. Furthermore, responding to such attempts would be beneficial. Additionally, making the detection and response solutions challenging to detect methods that complicate the development of possible workarounds would be helpful. Summary of the Invention

[0011] In one embodiment, this disclosure provides a method for linear extraction of information in a processor using an instruction pointer. The method includes monitoring the value of the instruction pointer, determining a continuous number of increments of the instruction pointer value by a constant amount, and generating a detection signal if the number of increments is greater than or equal to a detection threshold.

[0012] "Monitoring the value of the instruction pointer" is understood to mean, for example, systematically and routinely reading the value of the instruction pointer, which does not affect the regular use of the instruction pointer as a memory address indicator.

[0013] "Increment" is understood as, for example, a change in the value of the instruction pointer, which corresponds to adding a positive integer (which can be equal to or greater than 1) to the previous value of the instruction pointer. Therefore, "continuous increment of a constant" is understood as a continuous change in the value of the instruction pointer, with each change corresponding to adding the same positive integer to each previous value of the instruction pointer.

[0014] However, the linear code extraction steps of reverse engineering methods produce many consecutive increments to increment the value of the instruction pointer by a constant number, which can be higher than normal (i.e., higher than the detection threshold chosen in this regard).

[0015] Therefore, based on the value of the monitoring instruction pointer in this regard and the generation of detection signals, it is possible to detect and report the reverse engineering methods, especially the linear code extraction steps, that are being performed on the processor.

[0016] In addition, the value of the instruction pointer is usually stored in a register located inside the processor.

[0017] In one embodiment, the method can be directly integrated into the processor, which is difficult to identify in reverse engineering. This increases the complexity of the reverse engineering process and tends to make this type of process unprofitable overall.

[0018] In one embodiment, determining the number of consecutive increments of a constant involves comparing the increments of the instruction pointer value. This comparison allows determining whether the new value is equal to or different from the previous value. This allows monitoring a series of increments of a constant to detect whether the instruction pointer is incrementing linearly.

[0019] In one embodiment, determining the number of consecutive increments of a constant includes: if the two consecutive increments of the instruction pointer are equal, then decrementing the value of a counter previously set as a detection threshold; otherwise, if the two consecutive increments of the instruction pointer are different, then resetting the value of the counter to the detection threshold, and the detection signal is generated when the value of the counter is zero.

[0020] In terms of design, if a register containing the detection threshold is forced to return to its starting point in an attempt to bypass the detection method, then using decrementing is more robust than incrementing.

[0021] More specifically, the decrement counter is set to a threshold value, which is a priori value unknown to the person performing the reverse engineering. Conversely, the increment counter is a priori set to zero.

[0022] Therefore, the reverse engineering process would require additional work to determine the starting point of the counter, which increases the complexity of implementing the process and makes it unprofitable overall.

[0023] In one embodiment, the detection threshold value is selected in conjunction with the implementation of the source code to allow the instruction pointer value to continuously increment by a constant amount during normal execution of the source code by the processor.

[0024] Therefore, the joint selection of the detection threshold and the implementation of the source code achieve a good trade-off between the expected security level and the execution performance of the source code.

[0025] By jointly providing the implementation of the source code and the value of the detection threshold as a function in the source code, it is possible to prevent the generation of any detection signal during normal operation of the processor.

[0026] In this embodiment, the source code must meet a threshold. If normal execution of the source code triggers a detection signal, a skip branch instruction can be introduced into the source code to interrupt its linearity.

[0027] Since the choice of detection threshold limits the number of instructions that can be extracted during reverse engineering, the detection threshold should be advantageously minimized by adjusting the implementation of the source code in this regard.

[0028] In one embodiment, this disclosure provides a method for preventing linear extraction of information, including a detection method as defined above. In response to the generation of a detection signal, the method further includes the step of forcing the memory address of the next read operation of the processor to point to a memory location whose contents are not confidential.

[0029] Therefore, once linear code extraction is detected, the processor is forced to read only non-confidential content, thus limiting the information that reverse engineers can use.

[0030] In one embodiment, the method includes resetting the pointer to the value of an instruction pointer that was used prior to the generation of a detection signal or command access to a memory location whose original contents are not confidential.

[0031] Therefore, command access to memory locations intended to contain non-confidential raw content is a simple solution for protecting the processor in response to the detection of linear code extraction.

[0032] For the same purpose, the pointer can be reset to the value taken by the instruction pointer before the detection signal was generated, which forces the processor to read only the contents of memory that were read before the detection signal was generated.

[0033] More specifically, the value of the instruction pointer corresponds to the memory address that the processor is currently reading. Memory addresses that have not been read before the detection signal is generated are therefore protected.

[0034] Furthermore, resetting the instruction pointer to a value pointing to an address in memory makes it difficult for detection methods to identify, because the processor continues to operate in a linear information extraction mode, which may lead attackers to believe that linear code extraction is still in progress.

[0035] For example, in this respect, the pointer is reset to a value between the first and last values ​​of the instruction pointer, at which it has been determined that the number of consecutive increments of the constant increment is greater than or equal to a detection threshold. More specifically, this restricts the address values ​​read by the processor to instruction pointer values ​​acquired only during unauthorized increments.

[0036] In one embodiment, this disclosure provides an integrated circuit including a processor having a register for containing the value of an instruction pointer, a detector circuit having a monitoring circuit configured to monitor the value of the instruction pointer, a counter circuit configured to determine a number of consecutive increments of the value of the instruction pointer by a constant amount, and a generation circuit configured to generate a detection signal when the number of increments is greater than or equal to a detection threshold.

[0037] In one embodiment, the counter circuit is configured to compare the value of the instruction pointer by an amount that increments sequentially.

[0038] In one embodiment, the counter circuit is configured to decrement the counter value, which was previously set to a detection threshold, if two consecutive increments of the instruction pointer are equal; otherwise, to reset the counter value to the detection threshold. The generation circuit is configured to generate a detection signal when the counter value is zero.

[0039] In one embodiment, the selection of the detection threshold value and the implementation of the source code are coordinated to allow the value of the instruction pointer to continuously increment by a constant amount during normal execution of the source code by the processor.

[0040] In one embodiment, the integrated circuit further includes a response circuit configured to force the memory address of the processor's next read operation to point to a memory location whose contents are not confidential.

[0041] In one embodiment, the response circuit is configured to reset the pointer to the value of the instruction pointer used before the generation of the detection signal or command access to a memory location whose original contents are not confidential.

[0042] In one embodiment, the response circuit is configured to reset the instruction pointer to a value between a first value and a last value of the instruction pointer, at which a number of consecutive increments of a constant has been determined to be greater than or equal to a detection threshold.

[0043] In one embodiment, the detector circuit and the response circuit include logic circuitry located in a glue logic type logic circuitry region of the processor. Attached Figure Description

[0044] Other advantages and features of this disclosure will become clear after examining the detailed description of the implementations and embodiments (which are by no means limiting) and the accompanying drawings, in which:

[0045] Figure 1 This is a schematic diagram of the microcontroller in the embodiment;

[0046] Figure 2 yes Figure 1 A schematic diagram of the address fetch circuit, instruction pointer register, and detector circuit of the microcontroller in the diagram; and

[0047] Figure 3 This is a flowchart of the method in the embodiment. Detailed Implementation

[0048] Figure 1 A block diagram of an embodiment microcontroller (PE) during a reverse engineering attempt of the "Linear Code Extraction" (LCE) type is shown. The microcontroller (PE) shown includes a processor (CPU) connected via a data bus (B) to at least one memory MEM1, MEMn. For simplicity, the term "memory" will be used to specify at least one of the memories MEM1, ..., MEMn.

[0049] The processor (CPU) includes a controller circuit (UC) and an instruction decoding and execution circuit (IDEX). In an embodiment, the controller circuit (UC) includes an address fetch circuit (FA), an instruction pointer register (PC) containing the value of the instruction pointer, and an instruction register (IR).

[0050] During the operation of the processor (CPU), the address fetch circuit (FA) calculates the address to be read from memory MEM1, ..., MEMn, and the instruction pointer register (PC) of the instruction pointer stores this address.

[0051] The source code stored in memory at the address pointed to by the instruction pointer register (PC) is loaded into the instruction register (IR). The instruction register (IR) then transfers the source code to the IDEX circuit, which decodes the source code and executes the corresponding instructions.

[0052] In an embodiment, a linear code extraction (LCE) attempt may include an attack on the address fetch circuit (FA). For example, the address fetch circuit (FA) is forced to increment the value of the instruction pointer register (PC) by a constant number in a loop, such that addresses read by the processor (CPU) sequentially traverse the entire memory MEM1, ..., MEMn.

[0053] In an embodiment, the linear code extraction (LCE) attempt may include a first implementation (A1) that uses, for example, a focused ion beam (FIB) on an address acquisition circuit (FA) to apply a potential and thereby change the logic value.

[0054] In an embodiment, the first implementation (A1) may include fault injection techniques to force the address acquisition circuit (FA) into a linear increment mode.

[0055] In an embodiment, this fault injection technique provides physical modifications to the circuitry (e.g., by adding or removing electrical connections) to gain control over the address acquisition (FA) circuitry.

[0056] Furthermore, this attempt may also include using a second implementation (A2) and / or a third implementation (A3) to extract logic values. The second implementation (A2) and / or the third implementation (A3) utilize microsensors arranged on the path through which data flows from memory to the processor (CPU), for example, directly on the instruction register (IR) or on the data bus (B) that connects the instruction register (IR) to memory. Therefore, conventionally, source code can be read linearly from memory and temporarily stored in the instruction register (IR).

[0057] Figure 2 A block diagram of an embodiment is shown, illustrating the address acquisition circuit (FA), the instruction pointer register (PC), and a linearly increasing detector circuit (DFA) for detecting the instruction pointer register (PC) of the microcontroller (PE), as shown in the reference. Figure 1 As stated above.

[0058] In an embodiment, the detector circuit (DFA) is configured to report attempted linear code extraction (LCE), as referenced. Figure 1 As stated above.

[0059] In one embodiment, the first implementation (A1) of the extraction attempt includes a selector of the multiplexer (MUX) contained in the forced fetch address circuit (FA).

[0060] In an embodiment, the selector of the first implementation (A1) forces the multiplexer (MUX) to output a constant Cst by comparing it with the previous value PC of the instruction pointer register (PC). n-1 The address obtained by addition. This forced selection of the selector comes at the cost of other addresses AD1, AD2, ..., ADn, which can theoretically also be selected and generated at the output of the multiplexer (MUX) during normal operation of the microcontroller (PE).

[0061] Normal operation of a microcontroller (PE) is understood to mean operation as specified in, for example, the manufacturer's user manual (often called a datasheet).

[0062] Within the scope of methods used for linear extraction of detection information, normal operation can be considered as the case where the microcontroller is not subjected to linear code extraction attempts.

[0063] The address output from the multiplexer (MUX) of the fetch address circuit (FA) is then stored in the register of the instruction pointer register (PC).

[0064] In this embodiment, to detect linear code extraction attempts, the detector circuit (DFA) includes monitoring circuitry for reading consecutive values ​​PCn, PCn-1 stored in a register of the instruction pointer register (PC). For this purpose, the detector circuit (DFA) is connected to a register of the instruction pointer register (PC).

[0065] Furthermore, the detector circuit (DFA) also includes a counter circuit configured to determine the number of consecutive increments of the instruction pointer values ​​PCn, PCn-1 by a constant Cst. For this purpose, the counter circuit may, for example, include a counter whose current value represents the number of consecutive increments of the constant Cst.

[0066] In an embodiment, a linear extraction attempt is detected, for example, when the value of a counter indicates that the number of consecutive increments of a constant Cst is greater than or equal to a detection threshold; and as a result, a detection signal is generated.

[0067] In one embodiment, the detector circuit (DFA) includes a generation circuit configured to output a detection signal if the number of increments of a constant Cst is greater than or equal to a detection threshold. The value of the detection threshold can be selected in conjunction with a specific implementation of the source code contained in memory.

[0068] In an embodiment, the selection of the detection threshold value and the implementation of the source code can be determined to allow a constant number of "normal" increments during processor execution of the source code, which can be performed continuously without triggering a detection signal.

[0069] For example, skip branch instructions can be introduced during the implementation of the source code to adapt to the selected detection threshold, thereby reducing the normal incrementing number of times caused by the processor's execution of the source code.

[0070] By simulating the execution of source code by a processor (CPU) or by experience, the normal increment count can be automatically obtained.

[0071] In this embodiment, routine execution of increment branch instructions contained in the source code by the processor (CPU) causes a constant increment.

[0072] An "increment branch instruction" is understood as an instruction that uses addressing mode, where the next address to be read by the processor is defined relative to the address being read, typically by specifying the amount by which the address being read must be incremented. In other words, an increment branch instruction causes memory addresses to be read sequentially (i.e., one after another in ascending order of memory addresses).

[0073] An increment branch instruction, unlike a skip branch instruction, causes a jump to a memory address that is independent of the current address of the instruction pointer or the last address read by the processor. Skip branch instructions include, for example, assembly language instructions such as jump instructions, procedure call instructions, and return instructions after a procedure.

[0074] Advantageously, in the linear extraction method used for detecting information, the execution of a skip branch instruction by the processor (CPU) automatically causes the counter circuitry to reset. More specifically, the skip branch instruction interrupts the linear read of a memory address. Therefore, skipping a branch represents an operation that is not forced in linear code extraction.

[0075] Furthermore, it advantageously provides a response to the detection of linear code extraction attempts to protect the contents of memory that have not yet been read during the attempt.

[0076] The response circuit included in, for example, the detector circuit (DFA) is configured to reset the instruction pointer register (PC) to the address values ​​of the memory MEM1, ..., MEMn that were read before the attempt was detected.

[0077] For example, the value of the reset pointer can include an infinite loop of the value between the first and last value fetched by the instruction pointer during the fetch attempt (i.e., the first and last values ​​fetched by the instruction pointer register (PC) during a constant increment of Cst, which leads to the generation of a detection signal).

[0078] Furthermore, the detector circuit (DFA) and response circuit can, for example, be located in the area of ​​the processor (CPU).

[0079] In the embodiments, the detection and response circuitry is advantageously located in a "glue logic" type region. More specifically, techniques for concealing logic circuitry in such regions are known. Therefore, a particular advantage of placing the detector circuitry (DFA) among the elements in a glue logic type region is that it is difficult to destroy the detector circuitry (DFA).

[0080] Figure 3 It shows the reference Figure 2 A flowchart illustrating an embodiment of a detector circuit (DFA) implementation is provided. Step S1 includes monitoring consecutive values ​​PCn, PCn-1 of the instruction pointer register (PC) as each new value is stored in the register of the instruction pointer register (PC). In an embodiment, step S1 includes calculating an incrementing Dn corresponding to the difference between the consecutive values ​​PCn, PCn-1 of the instruction pointer register (PC) as each new value is stored.

[0081] Step S2 includes generating a comparison Comp between the value of the instruction pointer register (PC) and its incrementing consecutive increments Dn and Dn-1 to determine whether the two consecutive increments Dn and Dn-1 are the same or different at each increment. The comparison Comp is used to determine whether the consecutive increments are part of a series of constant increments.

[0082] Step S3 includes two distinct actions, depending on the result of the comparison Comp in the previous step S2. On one hand, if the two consecutive increments Dn and Dn-1 are equal, then step S3 includes decrementing the value of the counter Cnt, which was previously set as the detection threshold Th.

[0083] Alternatively, the counter Cnt can be incremented until the detection threshold Th is reached, in which case the value of the counter Cnt was previously set to zero.

[0084] On the other hand, if, conversely, the two consecutive increments Dn and Dn-1 of the instruction pointer values ​​PCn and PCn-1 are different, then step S3 includes resetting the value of the counter to the detection threshold Th.

[0085] Step S4 includes reading the value of the counter Cnt. If the value of the counter Cnt is between zero and the detection threshold Th, the method returns to step S1 and waits for a new value in the instruction pointer register (PC) to be stored in the corresponding register. If the value of the counter Cnt is equal to 0, and the counter is decremented, step S4 includes generating a detection signal LCEdetec, wherein the value of the detection signal LCEdetec changes from, for example, a logic value of 0 to a logic value of 1.

[0086] Alternatively, if the value of the counter Cnt is equal to the detection threshold Th, then step S4 includes generating a detection signal LCEdetec, wherein the value of the detection signal LCEdetec changes from, for example, logic value 0 to logic value 1 as the counter increments.

[0087] In both cases, the counter Cnt is reset when the detection signal LCEdetec is generated.

[0088] Alternatively, the down-counting (or up-counting) of the counter Cnt can be performed within a range of values ​​between two boundaries arbitrarily offset from zero.

[0089] In an embodiment, the non-zero offset value can be advantageously chosen to offset the two boundaries of the counter Cnt, which ensures that the start and end points of the counter Cnt cannot be known in advance.

[0090] In this embodiment, the upper limit of the range can be selected such that it equals the detection threshold plus the offset value, and the lower limit of the range can be selected such that it equals the offset value. In this embodiment, the counter decreases from the upper limit to the lower limit, or increases from the lower limit to the upper limit.

[0091] Furthermore, in this alternative embodiment, if the value of the counter Cnt is not between the lower and upper limits, a detection signal LCEdetec can also be generated, which can be used to counteract attempts to force the value of the counter Cnt to exceed the two boundaries. This again generates additional work that must be performed by the reverse engineering process and increases the complexity of the process, with the aim of making it unprofitable overall.

[0092] While the description has been detailed, it should be understood that various changes, substitutions, and alterations can be made without departing from the spirit and scope of this disclosure as defined by the appended claims. In different figures, the same elements are indicated by the same reference numerals. Furthermore, the scope of this disclosure is not intended to be limited to the specific embodiments described herein, as it will be readily understood from this disclosure by those skilled in the art that existing or future processes, machines, manufactures, compositions of matter, means, methods, or steps can perform substantially the same functions or achieve substantially the same results as the corresponding embodiments described herein. Therefore, the appended claims are intended to include such processes, machines, manufactures, compositions of matter, means, methods, or steps within their scope.

[0093] Therefore, the specification and drawings are simply regarded as a description of this disclosure as defined by the appended claims, and are intended to cover any and all modifications, variations, combinations or equivalents falling within the scope of this disclosure.

Claims

1. A signal detection method, comprising: Monitor the value of the instruction pointer register; Determine the number of increments to the value of the instruction pointer register, the increment corresponding to a constant and a continuous increment of the value of the instruction pointer register, wherein determining the number of increments includes: Compare the sequentially incrementing values ​​of the instruction pointer register; Determine that the values ​​of the corresponding values ​​incremented sequentially in the instruction pointer register are equal, and decrement a counter value based on the equality of these values, the counter value initially set to a threshold value; and The values ​​of the corresponding values ​​that are sequentially incremented in the instruction pointer register are determined to be different, and the value of the counter is reset to the value of the threshold based on the difference in the values ​​of the corresponding values; In response to determining that the value of the counter is zero, a detection signal is generated; and In response to the generation of the detection signal, a reverse engineering attack corresponding to the linear code extraction type of the processor including the instruction pointer register is detected.

2. The method of claim 1, wherein the value of the threshold is selected in conjunction with the implementation of the source code, such that the value of the instruction pointer register continuously and sequentially increases during normal execution of the source code by the processor.

3. The method of claim 1, further comprising, in response to the generation of the detection signal, forcing the memory address of the next read operation of the processor to point to a memory location having non-confidential content.

4. The method of claim 3, further comprising resetting the value of the instruction pointer register to the value prior to the generation of the detection signal or command access to the memory location having the non-confidential content.

5. The method of claim 4, wherein in response to determining that the increment count is greater than or equal to a threshold, the instruction pointer register is reset to a value between the first value and the last value of the instruction pointer register.

6. The method of claim 4, wherein the monitored value of the instruction pointer register corresponds to the monitored sequence or consecutive instructions.

7. An integrated circuit including a processor, said processor comprising: The instruction pointer register is configured to store pointer values; The detector circuit is configured to monitor the value of the instruction pointer register; The counter circuit is configured as follows: The increment count of the instruction pointer register value is determined, the increment corresponding to a constant and a continuous increment of the instruction pointer register value. Compare the sequentially incrementing values ​​of the instruction pointer register. The values ​​of the corresponding values ​​that are sequentially incremented in the instruction pointer register are determined to be equal, and a counter value is decremented based on the equality of these values. The counter value is initially set to a threshold value. The values ​​of the corresponding values ​​that are sequentially incremented in the instruction pointer register are determined to be different, and the value of the counter is reset to the value of the threshold based on the difference in the values ​​of the corresponding values; as well as A generator circuit is configured to generate a detection signal in response to determining that the value of the counter is zero, wherein the processor is configured to detect a reverse engineering attack corresponding to the processor's linear code extraction type in response to the generation of the detection signal.

8. The integrated circuit of claim 7, wherein the value of the threshold is selected in conjunction with the implementation of the source code such that the value of the instruction pointer register continuously and sequentially increases during normal execution of the source code by the processor.

9. The integrated circuit of claim 7, wherein the processor further comprises a response circuit configured to force the memory address of the next read operation of the processor to a memory location having non-confidential content in response to the generation of the detection signal.

10. The integrated circuit of claim 9, wherein the response circuit is configured to reset the value of the instruction pointer register to the value of the instruction pointer register prior to the generation of the detection signal or command access to the memory location having the non-confidential content.

11. The integrated circuit of claim 10, wherein the response circuit is configured to reset to a value between a first value and a last value of the instruction pointer register in response to determining that the increment count is greater than or equal to a threshold.

12. The integrated circuit of claim 11, wherein the detector circuit and the response circuit comprise logic circuitry located in a glue logic type logic circuitry region of the processor.

13. The integrated circuit of claim 7, wherein the monitored value of the instruction pointer register corresponds to the monitored sequence or consecutive instructions.

14. A processor, comprising: The instruction pointer register is configured to store pointer values; The detector circuit is configured to monitor the value of the instruction pointer register; The counter circuit is configured as follows: The increment count of the instruction pointer register value is determined, the increment corresponding to a constant and a continuous increment of the instruction pointer register value. Compare the sequentially incrementing values ​​of the instruction pointer register. The values ​​of the corresponding values ​​that are sequentially incremented in the instruction pointer register are determined to be equal, and a counter value is decremented based on the equality of these values. The counter value is initially set to a threshold value. The values ​​of the corresponding values ​​that are sequentially incremented in the instruction pointer register are determined to be different, and the value of the counter is reset to the value of the threshold based on the difference in the values ​​of the corresponding values; as well as A generator circuit is configured to generate a detection signal in response to determining that the value of the counter is zero, wherein the processor is configured to detect a reverse engineering attack corresponding to the processor's linear code extraction type in response to the generation of the detection signal.

15. The processor of claim 14, wherein the value of the threshold is selected in conjunction with the implementation of the source code such that the value of the instruction pointer register continuously and sequentially increases during normal execution of the source code by the processor.

16. The processor of claim 14, further comprising a response circuit configured to force, in response to the generation of the detection signal, that the memory address of the next read operation of the processor be directed to a memory location having non-confidential content.

17. The processor of claim 16, wherein the response circuitry is configured to reset the value of the instruction pointer register to the value of the instruction pointer register before generating the detection signal or command to access the memory location having the non-confidential content.

18. The processor of claim 17, wherein the response circuitry is configured to reset to a value between a first value and a last value of the instruction pointer register in response to determining that the increment count is greater than or equal to a threshold.

19. The processor of claim 16, wherein the detection circuit and the response circuit comprise logic circuitry located in a glue logic type logic circuitry region of the processor.

20. The processor of claim 14, wherein the monitored value of the instruction pointer register corresponds to a monitored sequence or consecutive instructions.

Images