Reverse engineering detection method on a processor and corresponding integrated circuit

Abstract

Embodiments of the present disclosure relate to a reverse engineering detection method on a processor and a corresponding integrated circuit. A method for detecting linear extraction of information in a processor using an instruction register for storing instructions includes an operation code. The method includes monitoring instructions successively stored in the instruction register, including decoding the operation code, determining a number of successive operation codes that encode an incremental branch, and generating a detection signal if the number is greater than or equal to a detection threshold.

Description

[0001] Cross-references to related applications

[0002] This application claims priority to French application No. 2013625, filed on December 18, 2020, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This disclosure generally relates to microelectronic devices, and in particular embodiments relates to prevention of reverse engineering. Background Technology

[0004] Reverse engineering can be used to study and potentially clone the behavior of microcontrollers. Microcontrollers typically include at least one processor and memory connected via a data bus. Reverse engineering on a microcontroller can include techniques of the "linear code extraction" type, where the processor can be forced to execute an incrementing branch instruction that requires the processor's address retrieval circuitry to sequentially read addresses in memory (i.e., traverse all addresses in memory one after another).

[0005] Examples include a hardware analysis phase that uses deformatting and advanced microscopy techniques to identify hardware components carrying secret information. This hardware analysis phase makes it possible to identify the logic controlling the processor's instruction register (IR).

[0006] The data extraction phase using focused ion beam (FIB) or fault injection techniques may include modifying current instructions stored in the instruction register. This can force the current instruction to include operation code corresponding to an incrementing branch, with its addressing mode including increments of the address currently being read from the processor.

[0007] Therefore, data extraction techniques include the step of applying incremental branch instructions to force the processor to operate in a linear execution mode (i.e., an operation mode in which the processor reads from memory in address order).

[0008] The processor will sequentially read the entire memory contents, and microsensor technology will be used to extract the contents read by the processor. For example, data can be extracted from the data bus, through which each item at an address is temporarily transferred from memory to the instruction register.

[0009] Based on the secrets extracted through reverse engineering, the software embedded in the microcontroller can be reconstructed, and cloned products can be manufactured.

[0010] Conventional solutions to prevent reverse engineering using general hardware protection layers or inter-operation techniques between two processors are known, and workarounds have been developed.

[0011] Detecting attempts to extract source code contained in memory would be advantageous. Furthermore, responding to such attempts would be beneficial. Additionally, making detection and response solutions difficult to identify would complicate the design of possible workarounds. Summary of the Invention

[0012] In an embodiment, this disclosure proposes a method for detecting linear extraction of information in a processor using an instruction register for storing instructions including operation codes. The method includes monitoring instructions consecutively stored in the instruction register, including decoded operation codes, determining the number of consecutive operation codes encoding an incrementing branch instruction, and generating a detection signal if the number is greater than or equal to a detection threshold.

[0013] "Monitoring instructions continuously stored in the instruction register, including decoding operation codes" is understood to mean, for example, the systematic and routine reading and decoding of the operation codes of instructions stored in the instruction register.

[0014] Monitoring advantageously does not affect the regular use of the instruction register as a store for the currently processed instruction in the processor.

[0015] An "incrementing branch instruction" is understood to mean, for example, an instruction that, once processed by the processor, automatically causes the next instruction stored at a memory address directly contiguous with the current instruction to be read.

[0016] However, the linear code extraction step of reverse engineering methods can produce an increasing number of branch instructions that are higher than normal (i.e., higher than the detection threshold chosen in this regard).

[0017] Therefore, in this respect, monitoring instructions continuously stored in the instruction register and generating detection signals allows for the detection and reporting of reverse engineering methods, particularly linear code extraction steps, that are being performed on the processor.

[0018] Moreover, the current instruction is conventionally stored in the instruction register located inside the processor.

[0019] Therefore, methods based on this approach can be implemented by direct integration into the processor, which makes identification during reverse engineering challenging. This increases the complexity of the reverse engineering process and tends to make this type of process unprofitable overall.

[0020] In this embodiment, determining the number of consecutive operation codes for the encoded incremental branch includes comparing the decoding operation codes with the list of operation codes for the encoded skipped branch.

[0021] For example, the processor can be provided with an exhaustive list of opcodes that encode skip branches. However, providing an exhaustive list of opcodes for incrementing branch instructions is not required, because the processor can be configured to default to incrementing branch instructions when no opcode is recognized.

[0022] Therefore, by comparing the decoded operation code with the list of encoded skip branches, it is possible to determine whether the operation code corresponds to an incrementing branch instruction, and thus monitor the continuity of a series of incrementing branches to detect linear code extraction.

[0023] "Skip branch instructions" are understood to refer to branch instructions that are not incremental branches, such as jump, call, or return instructions.

[0024] Therefore, the list of operation codes can include: operation codes for encoding jump instructions, operation codes for encoding process call instructions, and operation codes for encoding process return instructions.

[0025] This corresponds to a list that can be exhaustive or non-exhaustive, depending on the language of the processor's code, including the main operation code that encodes skipping branches.

[0026] In an embodiment, determining the number of consecutive operation codes encoding an incrementing branch further includes: when the operation code in the decoded operation code encodes an incrementing branch instruction, decrementing the value of a counter previously set to a detection threshold; when the operation code in the decoded operation code includes an operation code encoding a skipping branch, resetting the value of the counter to the detection threshold; and generating a detection signal when the value of the counter is zero.

[0027] By design, decrementing is more robust than incrementing when a register containing a detection threshold is forced to return to its starting point in an attempt to bypass the detection method.

[0028] More specifically, the decrement counter is set to a threshold value that is unknown a priori to the person performing the reverse engineering; conversely, the increment counter is a priori set to zero.

[0029] As a result, the reverse engineering process will require additional work to identify the starting point of the counter, which increases the complexity of the implementation process, with the aim of making it unprofitable overall.

[0030] In this embodiment, the value of the detection threshold is selected in conjunction with the implementation of the source code to allow the execution of continuously incrementing branch instructions during normal execution of the source code by the processor.

[0031] Therefore, the combined selection of the detection threshold and the implementation method of the source code achieves a good trade-off between the desired security level and the execution performance of the source code. By jointly providing the implementation method of the source code and the value of the detection threshold, it is possible to prevent the generation of any detection signals during normal processor operation.

[0032] In this embodiment, the source code must adhere to a threshold. If normal execution of the source code triggers a detection signal, a skip branch instruction can be introduced into the source code to disrupt its linearity.

[0033] Since the choice of detection threshold limits the number of instructions that can be extracted during reverse engineering, the detection threshold should potentially be minimized by adapting the implementation of the source code in this regard.

[0034] In an embodiment, this disclosure proposes a method for preventing linear extraction of information, the method including the detection method defined above, and including the step of forcing the memory address of the next read operation of the processor to point to a memory location whose contents are not secret in response to the generation of a detection signal.

[0035] For example, the steps include resetting the instruction pointer to the value taken before generating a detection signal or command to access a memory location whose original contents are not secret.

[0036] "Non-secret original content" is understood to refer to, for example, information originally intended to be transmitted to a third party.

[0037] Therefore, forcing the processor to read non-secret content after generating the detection signal ensures that the information extracted during the linear information extraction attempt is unusable within the scope of reverse engineering methods.

[0038] Moreover, forcing the processor to continue reading memory during the trial makes the detection method difficult to identify because the processor a priori continues to operate in a linear information extraction mode that does not reflect the detection of reverse engineering.

[0039] The alternative of resetting the instruction pointer (a term well known to those skilled in the art for a pointer to the address of the current instruction) to its previous value allows the processor to be forced to read only what is in memory that was read during linear fetching (i.e., before the generation of the detection signal).

[0040] In an embodiment, this disclosure proposes a detection integrated circuit including a processor. The processor includes an instruction register for storing instructions having operation codes. The detection integrated circuit includes: a monitoring circuit configured to monitor instructions continuously stored in the instruction register and decode the operation codes of the instructions; a counter circuit configured to determine the number of consecutive operation codes encoding an incrementing branch; and a generator circuit configured to generate a detection signal if the number is greater than or equal to a detection threshold.

[0041] In one embodiment, the counter circuit is configured to compare the operation code decoded by the monitoring circuit with a list of operation codes that are encoded to skip branches.

[0042] In this embodiment, the operation code list includes operation codes for encoding jump instructions, operation codes for encoding process call instructions, and operation codes for encoding process return instructions.

[0043] In one embodiment, the counter circuit is configured to decrement the value of the counter when the operation code in the middle of the decoded operation code encodes an incrementing branch instruction. The value of the counter is intended to be previously set to a detection threshold. When the operation code in the middle of the decoded operation code contains operation code that encodes a skip branch, the value of the counter is reset to the detection threshold. The generator circuit is configured to generate a detection signal when the value of the counter is zero.

[0044] In this embodiment, the selection of the detection threshold value and the implementation of the source code are adapted together to allow the processor to execute consecutive incrementing branch instructions during the normal execution of the source code.

[0045] In an embodiment, the integrated circuit defined above further includes a response circuit configured to, in response to the transmission of a detection signal, force the memory address of the processor's next read operation to point to a location in memory whose contents are not secret.

[0046] In one embodiment, the response circuit is configured to reset the instruction pointer to the value obtained before generating a detection signal or command to access a memory location whose original contents are not secret.

[0047] In one embodiment, the detector circuit and the response circuit include logic circuitry located in a glued logic-type logic circuitry region of the processor. Attached Figure Description

[0048] Other advantages and features of this disclosure will become apparent upon review of the detailed description and accompanying drawings of the implementations and embodiments, which are by no means limiting, wherein:

[0049] Figure 1 This is a diagram illustrating an embodiment of a microcontroller;

[0050] Figure 2 yes Figure 1 A diagram illustrating the address fetch circuit, instruction pointer register, and detector circuit of a microcontroller; and

[0051] Figure 3 This is a flowchart of the method in the embodiment. Detailed Implementation

[0052] Figure 1 The diagram illustrates a block diagram of an embodiment microcontroller (PE) during a reverse engineering attempt of the "Linear Code Extraction" (LCE) type. The illustrated microcontroller (PE) includes a processor (CPU) connected via a data bus (B) to at least one memory MEM1, MEMn. For simplicity, the memory should be used to specify at least one of the memories MEM1, ..., MEMn.

[0053] The processor (CPU) includes a controller circuit (CU) and an instruction decoding and execution circuit (IDEX). In an embodiment, the controller circuit (CU) includes an address fetch circuit (FA), an instruction register (IR), and an instruction pointer register (PC) that contains the memory address of the instruction being executed.

[0054] During a normal operating cycle of the processor (CPU), the instruction register (IR) contains the current instruction with its opcode, known by the technical term "opcode." The instruction register (IR) is coupled to the circuitry (IDEX).

[0055] Op codes are part of machine language instructions that specify the operations to be performed by the processor. In addition to op codes, most instructions also specify the data to be processed, called operands.

[0056] The decoding circuit decodes the opcode of the current instruction to determine which operation to perform. The decoding circuit is coupled to the fetch circuit (FA), which calculates the address of the next instruction to be fetched based on the opcode of the current instruction. The cycle restarts, with the next instruction replacing the current instruction in the instruction register (IR).

[0057] Linear code extraction attempts may include altering the processor's (CPU) operating cycle by attacking the instruction register (IR). A linear code extraction attempt may include steps in which the instruction register (IR) is forced to store a corrupted instruction.

[0058] The compromised instructions include, for example, “hacker” operation code (i.e., operation code imposed during the reverse engineering process) that allows linear code extraction (i.e., operation code configured to encode incremental branch instructions).

[0059] An increment branch instruction is interpreted as the current instruction. Once processed by the processor, it automatically causes the next instruction, stored at a memory address directly contiguous to the current instruction, to be fetched. Increment branch instructions use an addressing mode where the next address to be fetched by the processor is defined relative to the address being fetched; for example, specifying the number of increments the address being fetched must make.

[0060] Multiple incrementing branch instructions executed in a line are referred to as linear reads of memory by the CPU.

[0061] The increment branch instruction is the opposite of the skip branch instruction, which causes a jump to a memory address that is independent of the current address or the last address read by the processor (CPU).

[0062] Skip instructions are, for example, assembly language instructions such as jump instructions, procedure call instructions, and return instructions after a procedure.

[0063] You can provide the processor (CPU) with an exhaustive list of operation codes that encode skip branches. Conversely, you typically do not provide an exhaustive list of operation codes that encode increment branches.

[0064] More specifically, when the opcode is not in the list of opcodes that are used to skip branches, the processor (CPU) is configured to by default read the next instruction stored at a memory address that is directly contiguous with the memory address of the current instruction.

[0065] Therefore, the hacker's code aims to put the processor (CPU) into the default operating mode so that the processor (CPU) can read all the addresses of memory MEM1, ..., MEMn in sequence.

[0066] In practice, linear code extraction attempts can include a first implementation, A1, which uses, for example, a focused ion beam (FIB) on an instruction register (IR) to impose hacking code.

[0067] Alternatively, implementation A1 may include a fault injection technique that forces hacking code to be imposed on the instruction register (IR). This fault injection technique is provided for physically modifying the circuitry (e.g., by adding / removing connections) to impose hacking code on the instruction register (IR).

[0068] Furthermore, the attempt could also include using a second implementation, A2, for retrieving logical values ​​from memory. The second implementation, A2, uses microsensors arranged on a channel through which data flows from memory to the instruction register (IR), for example, directly on the data bus (B) that couples the instruction register (IR) to memory. Therefore, it would be conventionally possible to read source code linearly retrieved from memory and temporarily stored in the instruction register (IR).

[0069] Figure 2 The diagram illustrates the reference. Figure 1 A block diagram of an embodiment for detecting damage to the instruction register (IR) of a microcontroller (MC), comprising an address fetch circuit (FA), an instruction register (IR), an IDEX circuit, and a detector circuit (DIR).

[0070] In an embodiment, the detector circuit (DIR) is configured to report attempted linear code extraction (LCE), as referenced. Figure 1 As described. During a linear code extraction attempt, the first implementation A1 forces a corrupted instruction containing hacked ops into the instruction register (IR). As a result of this corruption, the decoder separates the hacked ops from the operands. The hacked ops are passed to the selector of a multiplexer (MUX), which generates the output address of the fetch circuit (FA) based on the hacked ops. The hacked ops force the multiplexer to select the address of the instruction that directly follows the address of the current instruction.

[0071] For example, the multiplexer selects an address whose value is equal to the address (AD) of the current instruction plus the size Cst of the current instruction (i.e., the number of memory addresses occupied by the current instruction).

[0072] The address of the next instruction is forced to be linearly dependent on the address of the current instruction, at the cost of other instruction addresses AD1, ..., ADn. Theoretically, other instruction addresses AD1, ..., ADn can also be selected and output from the multiplexer (MUX). This forces the hacker to manipulate code into the instruction register (IR), resulting in a linear read of code from memory.

[0073] To detect this linear code extraction attempt, the detector circuit (DIR) includes a monitoring circuit configured to monitor instructions continuously stored in the instruction register (IR) and decode the operation code of the instructions. For example, the monitoring circuit is integrated into a portion of the decoding circuitry that receives instructions and decodes the operation code (IDEX) in the decoding circuitry.

[0074] Furthermore, the detector circuit (DIR) also includes a counter circuit configured to determine the number of consecutive operation codes encoding an incrementing branch. For this purpose, the counter circuit may, for example, include a counter whose current value represents the number of consecutive incrementing branch instructions.

[0075] For example, a linear extraction attempt is detected when the counter value indicates the number of consecutive incrementing branch instructions that are greater than or equal to the detection threshold, and a detection signal is generated as a result.

[0076] In an embodiment, the detector circuit (DIR) includes a generator circuit configured to output a detection signal when the number of consecutive incrementing branch instructions is greater than or equal to a detection threshold.

[0077] Furthermore, the value of the detection threshold can be selected in conjunction with a specific implementation of the source code contained in memory. In an embodiment, the selection of the detection threshold value and the implementation of the source code are configured to allow a "normal" number of consecutively executed incremental branch instructions without triggering a detection signal.

[0078] In this embodiment, normal operation of the microcontroller uses an incrementing number of branch instructions that do not trigger detection signals. Normal operation of the microcontroller is understood to refer to the operation it is designed to perform, such as the operation specified in the manufacturer's user manual (often referred to as a datasheet).

[0079] To minimize the threshold value, skip branch instructions can be introduced during the implementation of the source code to adapt to the selected detection threshold, thereby reducing the normal number of incremental branch instructions present in the lines of code.

[0080] The constant, normally increasing number can be obtained automatically by simulating the execution of the source code by the processor (CPU) or by reading the source code.

[0081] Furthermore, it advantageously provides a response to the detection of linear source code extraction attempts to protect the contents of memory that have not yet been read during the linear source code extraction attempt.

[0082] For example, the response circuit included in the detector circuit (DIR) is configured to force the processor (CPU) to read a memory address that includes non-secret content.

[0083] "Non-secret content" is understood to refer to information intended for transmission to a third party that does not provide information that can be used within the scope of reverse engineering methods. The response circuit may, for example, have control terminals of a direct access multiplexer (MUX) and be configured to force the address ADn of the next instruction calculated by the address fetch circuit (FA).

[0084] Moreover, the detector circuit (DIR) and response circuit can be integrated and "hidden" within the processor (CPU), for example.

[0085] In the embodiments, the detector circuitry and the response circuitry are advantageously located in a "glue logic" type region. More specifically, techniques for hiding logic circuitry in such regions are known.

[0086] Therefore, a specific advantage of integrating detector circuits (DIRs) between components in a glue logic region is that it makes the detector circuits (DIRs) difficult to destroy.

[0087] Figure 3 The diagram illustrates the reference. Figure 2 A flowchart illustrating an embodiment of a detector circuit (DIR) implementation method is provided. Step S1 includes monitoring instructions continuously stored in the instruction register and decoding the operation code OpC for each newly stored current instruction. The monitoring of continuously stored instructions and the decoding of the operation code OpC can be implemented, for example, by the processor's decoding circuitry.

[0088] Step S2 includes generating a comparison Comp between the decoded operation code OpC and the encoded list of operation codes for skipping branches. The comparison Comp is used to determine whether the current instruction is an increment branch or a skip branch instruction.

[0089] For example, if the opcode of the current instruction belongs to the opcode list, then the comparison Comp can change the comparison result to a logical value of 1. Otherwise, the comparison Comp can change the comparison result to a logical value of 0. The opcode list may include, for example, opcodes corresponding to jump instructions Jmp, procedure call instructions Cll, or procedure return instructions Rtn.

[0090] Based on the comparison result Comp from the previous step S2, step S3 includes two distinct actions. On one hand, if the current instruction's opcode encodes an increment branch instruction (i.e., if the result of the comparison Comp is equal to 0), then step S3 includes decrementing the value of the counter Cnt, which was previously set to the detection threshold Th.

[0091] Alternatively, the counter Cnt can be incremented to the detection threshold Th, in which case the value of the counter Cnt was previously set to zero.

[0092] On the other hand, if, conversely, the current instruction's operation code encodes a skip branch instruction (i.e., if the result of comparing Comp is equal to 1), then step S3 includes resetting the counter's value to the detection threshold Th.

[0093] Step S4 involves reading the value of counter Cnt. If the value of counter Cnt is between 0 and the detection threshold Th, the method returns to step S1 and waits for the next instruction to be stored in the instruction register (IR).

[0094] If the counter is decremented, then when the value of the counter Cnt is equal to zero, step S4 then includes generating a detection signal LCEdetec, wherein the value of the detection signal LCEdetec changes from, for example, logic value 0 to logic value 1.

[0095] Alternatively, if the counter is incremented, the detection signal LCEdetec changes from logic 0 to logic 1 when the value of the counter Cnt equals the detection threshold Th.

[0096] In both cases, the counter Cnt is reset when the detection signal LCEdetec is generated.

[0097] Alternatively, the decrement (or increment) count of the counter Cnt can be implemented within a range of values ​​including those between two limits arbitrarily offset from zero.

[0098] More specifically, a non-zero offset value can be advantageously chosen to offset the two boundaries of the counter Cnt. This ensures that the start and end points of the counter Cnt cannot be known in advance.

[0099] For example, you can choose an upper limit to the range that equals the detection threshold plus the offset value, and you can choose a lower limit to the range that equals the offset value. In this example, the counter decreases from the upper limit to the lower limit, or increases from the lower limit to the upper limit.

[0100] Furthermore, in this alternative embodiment, a detection signal LCEdetec can also be generated if the value of the counter Cnt is not included between the lower and upper limits. Such generation can be used to counteract attempts to force the value of the counter Cnt beyond the two limits.

[0101] This creates additional work that must be done through reverse engineering, and increases the complexity of the process, with the aim of making it unprofitable overall.

[0102] Although this specification has been described in detail, it should be understood that various changes, substitutions, and modifications can be made without departing from the spirit and scope of this disclosure as defined by the appended claims. In the various drawings, the same elements are designated by the same reference numerals. Furthermore, the scope of this disclosure is not intended to be limited to the specific embodiments described herein, as it will be readily understood by those skilled in the art from this disclosure that existing or future processes, machines, manufactures, compositions of matter, means, methods, or steps can perform substantially the same functions or achieve substantially the same results as the corresponding embodiments described herein. Therefore, the appended claims are intended to include such processes, machines, manufactures, compositions of matter, means, methods, or steps within their scope.

[0103] Therefore, the specification and drawings are to be considered merely as a description of this disclosure as defined by the appended claims, and are intended to cover any and all modifications, variations, combinations or equivalents falling within the scope of this disclosure.

Claims

1. A method comprising: The threshold value is selected based on the implementation details in the source code. Monitoring instructions continuously stored in the processor's instruction pointer register, the monitoring including systematic and routine reading and decoding of the instruction's opcode; During the monitoring period, the number of consecutive operation codes corresponding to the encoding of the incrementing branch instruction is determined; In response to determining that the number of consecutive operation codes is greater than or equal to the threshold, a detection signal is generated, wherein determining that the number of consecutive operation codes is greater than or equal to the threshold includes: after determining that each consecutive operation code corresponds to the encoding of the incrementing branch instruction during normal execution of the source code, determining that the counter is equal to zero based on a sequentially decrementing counter, the counter being initially set to be equal to the threshold; In response to the generation of the detection signal, a linear extraction of information attack on the processor is detected; During the normal execution of the source code, a skip branch instruction is introduced to disrupt the linearity of the source code and minimize the threshold. In response to the generation of the detection signal, the memory address of the processor's next read operation is forced to be pointed to a memory location containing non-secret content; and The value of the instruction pointer register is reset to the value of the instruction pointer register before the generation of the detection signal or before the command accesses the memory location containing the non-secret content.

2. The method of claim 1, wherein determining the number of consecutive operation codes comprises: The decoded operation code is compared with a list that includes operation codes corresponding to skip branch instructions.

3. The method of claim 2, wherein the list of operation codes corresponding to skip branch instructions comprises: Operation codes for jump instructions, encoding process call instructions, and encoding process return instructions.

4. The method of claim 1, wherein determining the number of consecutive operation codes comprises: The first decoded operation code is determined to correspond to the encoding of the incremental branch instruction during the monitoring period; In response to determining that the first decoded operation code corresponds to the encoding of the increment branch instruction, the value of the counter is decremented; During the monitoring of the instruction, it is determined that the second decoded operation code corresponds to the encoding of the skip branch instruction; as well as In response to determining that the second decoded operation code corresponds to the encoding of the skip branch instruction, the value of the counter is reset to the threshold.

5. The method according to claim 1, wherein, Executes continuously incrementing branch instructions during the normal execution of the source code by the processor.

6. An integrated circuit, comprising a processor, said processor comprising: The instruction pointer register is configured to store instructions, one or more of which include opcodes. The detector circuit is configured to monitor instructions continuously stored in the instruction pointer register, the monitoring including systematic and routine reading and decoding of the operation code of the instructions; A counter circuit is configured to determine the number of consecutive operation codes corresponding to the encoding of an incrementing branch instruction during the monitoring period; A generator circuit is configured to generate a detection signal in response to determining that the number of consecutive operation codes is greater than or equal to a threshold, wherein the processor is configured to detect linear extraction of information attacks on the processor in response to the generation of the detection signal, the value of the threshold being selected in conjunction with the implementation of the source code, and determining that the number of consecutive operation codes is greater than or equal to the threshold includes: after determining that each consecutive operation code corresponds to the encoding of the incrementing branch instruction during normal execution of the source code, determining that the counter is equal to zero based on a sequentially decrementing counter, the counter being initially set to be equal to the threshold; During the normal execution of the source code, a skip branch instruction is introduced to disrupt the linearity of the source code and minimize the threshold. A response circuit configured to, in response to the generation of the detection signal, force the memory address of the processor's next read operation to be pointed to a location in memory containing non-secret content; The response circuit is further configured to reset the value of the instruction pointer register to the value of the instruction pointer register before the generation of the detection signal or before the command accesses the memory location having the non-secret content.

7. The integrated circuit of claim 6, wherein determining the number of consecutive operation codes by the counter circuit comprises: The decoded operation code is compared with a list that includes operation codes corresponding to skip branch instructions.

8. The integrated circuit of claim 7, wherein the list of operation codes corresponding to skip branch instructions comprises: Operation codes for jump instructions, encoding process call instructions, and encoding process return instructions.

9. The integrated circuit of claim 6, wherein determining the number of consecutive operation codes comprises: The first decoded operation code is determined to correspond to the encoding of the incremental branch instruction during the monitoring period; In response to determining that the first decoded operation code corresponds to the encoding of the increment branch instruction, the value of the counter is decremented; During the monitoring of the instruction, it is determined that the second decoded operation code corresponds to the encoding of the skip branch instruction; as well as In response to determining that the second decoded operation code corresponds to the encoding of the skip branch instruction, the value of the counter is reset to the threshold.

10. The integrated circuit of claim 6, wherein a continuously incrementing branch instruction is executed during normal execution of the source code by the processor.

11. The integrated circuit of claim 6, wherein the detector circuit and the response circuit comprise logic circuitry located in a glued logic type logic circuitry region of the processor.

12. A processor, comprising: The instruction pointer register is configured to store instructions, one or more of which include opcodes. The detector circuit is configured to monitor instructions continuously stored in the instruction pointer register, the monitoring including systematic and routine reading and decoding of the operation code of the instructions; A counter circuit is configured to determine the number of consecutive operation codes corresponding to the encoding of an incrementing branch instruction during the monitoring period; as well as A generator circuit is configured to generate a detection signal in response to determining that the number of consecutive opcodes is greater than or equal to a threshold, wherein the processor is configured to monitor linear extraction of information attacks on the processor in response to the generation of the detection signal, the value of the threshold being selected in conjunction with the implementation of the source code, and determining that the number of consecutive opcodes is greater than or equal to the threshold includes: after determining that each consecutive opcode corresponds to the encoding of the incrementing branch instruction during normal execution of the source code, determining that the counter is equal to zero based on a sequentially decrementing counter, the counter being initially set to be equal to the threshold; and During the normal execution of the source code, a skip branch instruction is introduced to disrupt the linearity of the source code and minimize the threshold. A response circuit configured to, in response to the generation of the detection signal, force the memory address of the processor's next read operation to be pointed to a location in memory containing non-secret content; The response circuit is further configured to reset the value of the instruction pointer register to the value of the instruction pointer register before the generation of the detection signal or before the command accesses the memory location having the non-secret content.

13. The processor of claim 12, wherein determining the number of consecutive operation codes by the counter circuit comprises: The decoded operation code is compared with a list that includes operation codes corresponding to skip branch instructions.

14. The processor of claim 13, wherein the list of operation codes corresponding to skip branch instructions comprises: Operation codes for jump instructions, encoding process call instructions, and encoding process return instructions.

15. The processor of claim 13, wherein determining the number of consecutive operation codes comprises: The first decoded operation code is determined to correspond to the encoding of the incremental branch instruction during the monitoring period; In response to determining that the first decoded operation code corresponds to the encoding of the increment branch instruction, the value of the counter is decremented; During the monitoring of the instruction, it is determined that the second decoded operation code corresponds to the encoding of the skip branch instruction; as well as In response to determining that the second decoded operation code corresponds to the encoding of the skip branch instruction, the value of the counter is reset to the threshold.

16. The processor of claim 12, wherein sequentially incrementing branch instructions are executed during normal execution of the source code by the processor.

Images