Anti-attack operational circuit in integrated circuit and protection method of integrated circuit

Abstract

The embodiment of the invention provides an anti-attack operation circuit in an integrated circuit and a protection method of the integrated circuit. The anti-attack operation circuit comprises a first operation stage, a second operation stage and a safety circuit. A first operational stage is configured to process one or more signals to generate one or more output signals, the first operational stage having a plurality of signal propagation paths. The second operational stage is configured to receive and process an output signal of the first operational stage. The safety circuit is configured to generate a synchronization signal indicating that propagation of the signal in the first operational stage has been completed, and to prevent the second operational stage from processing the output signal of the first operational stage within a time interval derived by the synchronization signal in accordance with the synchronization signal.

Description

Technical Field

[0001] The present application relates to the field of security of integrated circuits (ICs), and in particular to side-channel attack-resistant computing circuits. Background Art

[0002] Domain-Oriented Masking (DOM) and Threshold Implementation (TI) are known methods for making cryptographic circuits that are provably secure against side-channel attacks based on a given set of assumptions.

[0003] In the paper "Domain-Oriented Masking: Compact Masked Hardware Implementations with Arbitrary Protection Order", published in 2016 by H. Gross et al. from the Institute for Applied Information Processing and Communications (IAIK) at Graz University of Technology in Austria, the authors claim that passive physical attacks, such as power analysis, pose a serious threat to the security of embedded systems, and that countermeasures need to be implemented accordingly. The authors further show how the cost of protecting digital circuits from passive physical attacks can be significantly reduced by introducing a masking approach called domain-oriented masking (DOM), providing the same level of security as threshold implementation (TI), but requiring less chip area and less randomness.

[0004] U.S. Patent Application Publication No. 2021 / 0097175 describes a masked logic gate that uses a Boolean mask to protect against side-channel attacks, each input variable having d+1 shares, where d is an integer representing a protection order. The masked logic gate includes a first input configured to receive a first number of shares Yj; a second input configured to receive a second number of shares Xi, representing an intermediate output result of a layer of a gate tree that implements a low-latency mask; and an output of a third number of shares obtained by applying a logic function of the masked logic gate to the shares of the first input and the second input using a domain-oriented mask.

[0005] Another method to counter side-channel attacks is proposed in U.S. Patent 10,572,619, which describes a logic element including a logic block, a clock generator, a clock distributor, and at least one sampling element. The logic block performs a logic function on an input signal to obtain a plurality of output data signals. The output data signals are sampled by corresponding clock signals. The clock generator generates a phase-shifted clock signal from a reference clock signal. The clock distributor distributes different phase-shifted clock signals to corresponding output data signals. The sampling element samples the output signal according to the corresponding distributed phase-shifted clock signal.

[0006] U.S. Patent 8,947,123 proposes a Wave Dynamic Differential Logic (WDDL) method for preventing side channel attacks, in which a differential logic level is pre-charged or pre-discharged by a previous logic level (e.g., a previous SDDL level, WDDL level, etc.). In one embodiment, a Divided Wave Dynamic Differential Logic (DWDDL) is provided, in which the WDDL circuit can be conveniently implemented as a dual logic tree. Summary of the invention

[0007] One embodiment of the present invention is described herein to provide an attack resistant computing circuit (ARCCs), which is located in an IC. The ARCC includes a first computing stage, a second computing stage, and a security circuit. The first computing stage is configured to process one or more signals to generate one or more output signals, and the first computing stage has multiple signal propagation paths. The second computing stage is configured to receive and process the output signal of the first computing stage. The security circuit is configured to generate a synchronization signal, which indicates that the propagation of the signal in the first computing stage has been completed, and prevents the second computing stage from processing the output signal of the first computing stage within a time interval from the synchronization signal.

[0008] Typically, the time interval is shorter than one clock cycle of the signal. In some embodiments, the safety circuit is configured to mask the output signal of the first operation stage during the time interval so that the output signal cannot reach the second operation stage.

[0009] In some embodiments, the security circuit includes (i) a security gating timing circuit (SGTC), the SGTC being configured to output a synchronization signal when the propagation of the signal in the first operation stage is completed; and (ii) a security gating circuit (SGCs), the SGC being configured to gate the output signal of the first operation stage according to the synchronization signal. In various embodiments, the SGC may include a logic gate, a tri-state buffer, or a latch. In one embodiment, the SGTC is configured to set the time to output the synchronization signal based on the maximum propagation delay of the first operation stage.

[0010] In other embodiments, ARCC further includes a secure flip-flop (Secure Flip-Flop; SFF), which is coupled between the first operation stage and the second operation stage and is configured to (i) sample the output signal of the first operation stage according to the output synchronization signal (OS), and (ii) send an input synchronization signal (IS) to the second operation stage.

[0011] According to one embodiment described herein, a method for protecting an IC is further provided. The method includes processing one or more signals in a first operation stage having a plurality of signal propagation paths to generate one or more output signals, and receiving and processing the output signals of the first operation stage in a second operation stage. A synchronization signal is generated using a safety circuit, the synchronization signal indicating that the propagation of the signal in the first operation stage has been completed. The second operation stage is prohibited from processing the output signals of the first operation stage during a time interval derived from the synchronization signal.

[0012] The following is a detailed description of the embodiments, which can be used in conjunction with the drawings to more fully understand the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 is a block diagram schematically illustrating an anti-attack computing circuit (ARCC) according to an embodiment of the present invention;

[0014] Figure 2 is a block diagram schematically illustrating a secure combination circuit (SCC) according to an embodiment of the present invention;

[0015] Figure 3A is a block diagram schematically illustrating a safety trigger (SFF) according to an embodiment of the present invention;

[0016] Figure 3B is a block diagram schematically illustrating an alternative SFF according to an embodiment of the present invention;

[0017] Figure 4 is a block diagram schematically illustrating an ARCC according to another embodiment of the present invention;

[0018] Figure 5 is a block diagram schematically illustrating a modified domain-directed mask (DOM) multiplier SCC according to an embodiment of the present invention; and

[0019] Figure 6 FIG. 4 is a flow chart schematically illustrating a method for protecting against power side channel attacks according to an embodiment of the present invention.

[0020] [Explanation of symbols]

[0021] 100, 400: Anti-attack computing circuit (ARCC)

[0022] 102: Operational Circuit

[0023] 104: Operational level

[0024] 106: Gate Controller

[0025] 108: Safety gate timing circuit (SGTC)

[0026] 110,354: Toggle Flip Flop (TFF)

[0027] 112, 304, 358, 514, 518: Delay circuit (DLY)

[0028] 200, 402, 500: Safety combination circuit (SCC)

[0029] 202: Propagation Delay Circuit

[0030] 300, 350, 404: Safety Flip Flop (SFF)

[0031] 302, 352: D-type flip-flop (DFF)

[0032] 306: Inverse AND Gate

[0033] 512, 516, 520: AND gate

[0034] 356: Anti-mutex OR gate

[0035] 502: Multiplier

[0036] 504, 508: Security Gate

[0037] 506, 510: Mutually exclusive OR gate

[0038] 600: Flowchart

[0039] 602,604,606,608,610: Operation DETAILED DESCRIPTION

[0040] A side-channel attack targets any additional side information collected from an electronic device (such as an IC, computer, or smart card) that is related to the basic operation of the algorithm. An example is a power supply side-channel attack on power consumption patterns. By analyzing changes in the device's power consumption, an attacker can infer what operations the device is performing and extract encryption keys or other sensitive data. Another example is an electromagnetic radiation attack.

[0041] Power side-channel attacks can be performed using a variety of techniques, including differential power analysis (DPA), simple power analysis (SPA), and glitch attacks. Electromagnetic side-channel attacks can be performed using, for example, differential electromagnetic analysis (DEMA). The electronic circuits that contain protection against security attacks, including power supply and electromagnetic side-channel attack protection, will be referred to as Attack Resilient Computation Circuits (ARCCs).

[0042] One way to protect against differential power analysis attacks is masking, which makes the electrical activity in the device independent of the secret values ​​being operated on. The secret values ​​are divided into multiple shares. Each share is random when considered individually, and the secret value can only be extracted by combining the shares together. Therefore, operations can be performed on the shares without leaking information about the secret. However, when these shares are combined, power disturbances may occur, resulting in power supply side-channel attacks.

[0043] Embodiments of the present invention disclosed herein provide a method and system for avoiding power disturbances caused by combined share operations by gating the output of an operation stage before the operation is completed. In some embodiments, gating does not include sampling by a clock edge; instead, gating is delayed according to the propagation delay of the corresponding operation stage, thereby reducing the loss of operation speed. In an embodiment, the gating circuit is a Boolean gate, such as an AND gate or an OR gate (but not an exclusive-OR gate (XOR) or an anti-exclusive-NOR gate (XNOR)). In other embodiments, latches or flip-flops clocked by local signals (rather than global clocks) can be used, and in other embodiments, the gating circuit includes tri-state buffers.

[0044] In some embodiments, a security gating timing circuit (SGTC) is configured to generate a gating signal (referred to as a synchronization signal) for an operation stage so as to prevent the operation stage from receiving an output signal of a previous operation stage within a time interval originating from a propagation delay of the previous operation stage, thereby prohibiting signal propagation until the propagation delay of the output in the previous stage is completed. In an exemplary embodiment, the SGTC includes a toggle flip-flop (TFF) that switches according to a clock edge and a group of delay circuits connected in series, each delay circuit adding a delay according to the expected propagation delay of the corresponding operation stage. The output signal of the toggle flip-flop is input to the first delay circuit, and the output signal of each delay circuit is input to the next delay circuit. Then, an anti-exclusive OR gate (XNOR) compares the output signal of the toggle flip-flop with the output signal of each delay circuit and generates a gating signal according to the match.

[0045] In other embodiments, a delay circuit for propagating the synchronization signal is embedded in the operation stage to prevent the propagation of the signal between the operation stages until the propagation is completed. In some embodiments, the secure flip-flops are configured to securely sample the output signal of the operation stage and generate an initial timing signal (hereinafter also referred to as the synchronization signal) for the next operation stage.

[0046] In an embodiment, the propagation of the signal is delayed by a time interval that is less than one system time.

[0047] Therefore, in embodiments, glitch-preventing gates are clocked by gating signals that match operational stage delays, providing an effective power side-channel attack countermeasure while reducing performance loss.

[0048] System Description

[0049] Attack Resilient Computation Circuits (ARCCs) sometimes include countermeasures against power side-channel attacks, including gating of the operation stage to mask the power characteristics of the operation and prevent external extraction of confidential data by observing power disturbances. In the embodiments disclosed herein, the frequency penalty associated with such gating is reduced.

[0050] In some embodiments, a security gating timing circuit (SGTC) is configured to generate a synchronization signal to prevent an operation stage from receiving an input during a time interval from an output of a previous operation stage, the time interval being derived from a maximum propagation delay of the previous stage, thereby avoiding power supply disturbances. In some embodiments, the SGTC is centralized, while in other embodiments, the SGTC is distributed; for example, in an operation stage.

[0051] Figure 1 is a block diagram schematically illustrating an attack-resistant computing circuit (ARCCs) 100 according to an embodiment of the present invention.

[0052] ARCC 100 includes an operation circuit 102, which includes a plurality of operation stages 104 (respectively labeled as operation stage 1 to operation stage N). Each operation stage includes combinational logic for calculating a portion of the operation and sending the partial result to the next operation stage for further calculation. In some embodiments, an operation stage includes an internal multi-share linear section, and a single-share nonlinear output section, which sends the output to the next operation stage. As explained in the above-referenced "Domain-Oriented Masking: Compact Masked Hardware Implementations with Arbitrary Protection Order", in the case of linear functions, domain independence is easily achieved because the linear function only needs to combine the shares in a share domain. This means that the linear function does not need to be gated. However, if the nonlinear function precedes the linear function on the same combinational path, a synchronization signal needs to be provided to accommodate the maximum delay of the linear function in order to gate the nonlinear function.

[0053] To combat power side-channel attacks, the operation stages 104 are separated by gaters 106, which are configured to prohibit data from propagating between the operation stages before the data is ready. For example, the output signal of operation stage 1 will not reach operation stage 2 before operation stage 1 completes the first stage of operation. In some embodiments, gater 106 can be one of an AND gate, a NAND gate, an OR gate, and a NOR gate, but cannot be an XOR gate or an XNOR gate (appropriate logic inversion of the input and / or output may be required depending on the type of gater). In an embodiment, any of gaters 106 can include a tri-state buffer, a flip-flop, or a latch when appropriate logic modifications are used. Gaters 106 are also referred to as security gating circuits (SGCs) hereinafter.

[0054] according to Figure 1 In the exemplary embodiment of FIG. 1 , the gate controller 106 is configured to allow the propagation of the output signals of the operation stages, and the timing thereof is set according to the maximum delay of each operation stage. Therefore, the gating timing penalty is small.

[0055] The attack-resistant operation circuit ARCC 100 includes a centralized timing circuit 108, hereinafter also referred to as a security gate timing circuit (SGTC), which is configured to generate a synchronization signal for timing the gating of the gate controller 106, thereby prohibiting the operation stage from receiving data before the data propagation of the previous operation stage is completed. The SGTC includes a toggle flip-flop (TFF) 110, a delay circuit 112 and an anti-mutually exclusive OR gate (XNOR) 114. The toggle flip-flop 110 is configured to switch according to the clock edge (for example, changing the state according to the rising edge of the clock); the delay circuit 112 is represented as the first stage maximum delay (Stage-1 Max-Delay) to the N-1 stage maximum delay (Stage-N-1Max-Delay), and the anti-mutually exclusive OR gate (XNOR) 114 is used to output a synchronization signal. The clock input to the toggle flip-flop also starts the operation chain in the operation stage 104.

[0056] The delay circuits are connected in series, from the toggle flip-flop 110 to the first delay circuit, all the way to the last delay circuit, and when the toggle flip-flop 110 switches, the state change will propagate through the series of delay stages. When the toggle flip-flop switches, the input pairs of each anti-mutually exclusive OR gate (XNOR) 114 will be different from each other, but after the state change reaches the corresponding delay circuit, the input pairs will have the same value. Therefore, when the operation output is ready, each XNOR gate 114 will generate a synchronization signal to enable the data to propagate through the corresponding gate controller 106 (the combination of the security gate control circuit SGCs 106 and SGTC 108 is collectively referred to as a security circuit).

[0057] Therefore, by connecting multiple delay units in series, whose delays match or exceed the expected maximum delay of the corresponding operation stage, combined with nonlinear logic countermeasures, power supply side channel attacks can be resisted.

[0058] In the above-mentioned text and Figure 1The configuration of ARCC 100 illustrated in FIG. 1 is an example cited only for clarity of concept. Other configurations may be used in alternative embodiments. For example, in some embodiments, the toggle flip-flop (TFF) 110 is replaced by a set-reset flip-flop (SRFF), which is set at the beginning of the operation cycle and reset when its output propagates through the last stage delay; then the anti-mutually exclusive OR gate 114 is replaced by an AND gate. In other embodiments, the input signal of the delay circuit 112 of each stage is connected to the toggle flip-flop 110, and each delay stage is configured to delay the output of the toggle flip-flop by a cumulative delay equal to the maximum delay from the operation circuit 102 to the corresponding gate controller 106.

[0059] Combination and sampling anti-attack calculation ARCCs circuit

[0060] For simplicity, synchronous ARCCs having a single clock source will be referred to below; however, the techniques disclosed herein are not limited to single-clock ARCCs; multiple clock variations and sub-variations may be included in alternative embodiments.

[0061] According to synchronous design methodology, ARCC may consist of combinational circuits separated by sampling circuits. Figure 1 The ARCC 100 illustrated in FIG. 1 and described above is an example ARCC including a single clock stage; in embodiments, an ARCC may include one or more ARCCs 100 , and / or other security elements.

[0062] Combinatorial circuits are called Secure Combinatorial Circuits (SCC) and include side-channel attack countermeasures. The sampling circuits mentioned below (hereinafter referred to as Secure Flip-Flop (SFF)) also include side-channel attack countermeasures. Figure 1 The ARCC 100 described is a combination of a safety combination circuit (SCC) and a safety trigger (SFF), the SFF including a toggle flip-flop (TFF) 110 and a data trigger (not shown) that provides a clock buffer from the previous stage. Other embodiments of the SCC and SFF will be described below, with reference to Figures 2 to 5 It should be noted that SFF is secure only in the sense that the SFF circuitry, including the coupling of SFF circuitry with other circuitry described herein, provides a degree of protection against side-channel attacks.

[0063] In an embodiment, the security circuit is distributed; the SCC includes a signal propagation combinational circuit and a propagation delay circuit that generates a synchronization signal. The propagation delay circuit is configured to simulate the delay of the signal in the combinational circuit. Some or all of the signals in the combinational circuit are gated by elements of the propagation delay circuit to avoid power supply interference (thereby protecting from power supply side channel attacks). In an embodiment, the propagation delay circuit includes a delay that matches the delay of the corresponding combinational circuit signal to reduce (or offset) the degradation of the SCC.

[0064] Figure 2 is a block diagram for schematically illustrating an SCC 200 according to an embodiment of the present invention. The SCC 200 includes k n-bit function input signals (respectively I_1 to I_k), and for each function input signal, there is also a delay indication input signal, marked as IS, to indicate that all corresponding input signals are stable (the delay indication input signal is also called a synchronization signal). In an embodiment, the SCC 200 also includes a j-bit random number input signal to achieve further protection by confusing the operation results of the security combination circuit.

[0065] The SCC 200 also includes a propagation delay circuit 202 configured to match the signal propagation delay in the combinational circuit and generate an output synchronization signal that can be used to gate the signal propagation in the SCC. When the corresponding input signal of the SCC is stable, the synchronization delay indication input signal IS coupled to the input of the propagation delay circuit is triggered (asserted). When the corresponding signal in the combinational circuit is stable, the intermediate output signal of the propagation delay circuit (indicated by a vertical arrow) is asserted. The (usually) final output signal of the propagation delay circuit (indicated by a horizontal arrow) indicates when the output signal O is stable and can be used to connect the SCC circuit in series (as described below, this SCC output signal can be input to other SCCs, or to a sampling circuit).

[0066] Figure 2 The configuration of SCC 200 shown and described above is cited by way of example. Other configurations may be used in alternative embodiments. For example, in some embodiments, there is no random input signal.

[0067] Sampling circuit

[0068] In some embodiments, the SCC is configured to receive an input signal (I) and a corresponding input synchronization signal (input synchronization; IS), and to send an output signal (O) and a corresponding output synchronization signal (output synchronization; OS). The SFF synchronizes the output signal of the SCC with the clock; the output signal O and the output synchronization signal OS can be input to another SCC circuit.

[0069] Figure 3A is a block diagram schematically showing an SFF 300 according to an embodiment of the present invention. The SFF 300 includes a D-type flip-flop (D-Flip-Flop; DFF) 302, which is configured to latch an n-bit input signal (e.g., the output signal of the aforementioned SCC) and forward the latched input signal (e.g., to the input of a subsequent SCC).

[0070] In order to generate an input synchronization signal (IS) corresponding to the output delay and input to the SCC, the SCC 300 further includes a delay circuit (DLY) 304 to delay the clock input signal; and an inverted AND gate 306 to perform an AND operation on the inverted output signal of the delay circuit and the clock input signal to generate an output synchronization signal (OS).

[0071] The delay of the delay circuit 304 is set according to the delay difference between the SFF 302 and the NAND gate 306. Since the clock input signal changes from a low logic level to a high logic level, the NAND gate 306 will output a low logic level until the delay circuit changes to a high logic level. After a delay, the delay circuit will output the conversion result to the NAND gate 306, and the NAND gate 306 will react accordingly and output a high logic level. Therefore, relative to the clock input signal, the OS will be delayed for a period of time, which is set according to the delay of the DFF 302.

[0072] Figure 3B is a block diagram schematically showing another alternative SFF350 in an embodiment of the present invention. DFF352 latches and forwards an n-bit input signal (e.g., input to a subsequent SCC). A TFF354 inverts on a rising clock edge. To generate an OS, SFF350 further includes an anti-exclusive OR (XNOR) gate 356, which outputs a low logic level when the output of the TFF is different from the output of the delay circuit 358. The delay circuit delays the output signal of the TFF for a period of time, and the delay time is set according to the difference between the delay of DFF352 and the combined delay of TFF354 and the anti-exclusive OR (XNOR) gate 356. Therefore, the OS will be delayed relative to the clock input signal for a period of time, which is set according to the delay of DFF352.

[0073] In some embodiments, a delay circuit (not shown) may be added to the output of DFF 352, with the delay derived from delay circuit (DLY) 358, to ensure proper timing at the input of subsequent circuitry (eg, an SCC).

[0074] Figure 3A and Figure 3B The configurations of SFF300 and SFF350 shown in, and described above, are cited only as examples. Other configurations may be used in alternative embodiments. For example, in one embodiment, delay circuit 304 may be replaced by an inverter with appropriate delay (and inverted AND gate (NAND) 306 will have two non-inverting input signals). In another embodiment, delay circuit 358 is coupled to the inverted output signal (Qn) of TFF354, and inverted exclusive OR gate (XNOR) 356 is replaced by exclusive OR gate (XOR).

[0075] Figure 4 is a block diagram schematically showing an ARCC400 in an embodiment of the present invention. ARCC400 includes multiple SCCs402 and SFF404. Each line in the figure represents a multi-share signal and its corresponding synchronization signal. The input signals (I, IS) of multiple cells enter from the left, and the output signals (O, OS) exit from the right. When the delay through two or more SCCs is less than one clock cycle, these SCCs can be directly coupled to each other (i.e., the output signal O and the corresponding output synchronization signal OS of the first SCC are respectively connected to the input signal I and the input synchronization signal IS of the second SCC). However, in some embodiments, the delay from SFF to SFF through all connected SCCs shall not exceed one clock cycle.

[0076] When the input signal of the first SCC is the sampled output signal of the second SCC, an SFF is inserted between the two SCCs. The SFF samples the output signal O of the second SCC at the rising edge of the clock input signal to generate the input signal I of the first SCC, and sends an input synchronization signal IS delayed from the rising edge of the clock to the IS input terminal of the first SCC.

[0077] Figure 4 The configuration of ARCC 400 shown, and the description hereinabove, is merely an example provided for clarity of concept. In alternative embodiments, various SCC and SFF interconnect configurations may be used to meet various computing requirements.

[0078] Figure 5It is a block diagram schematically showing a modified domain-oriented masking (DOM) multiplier SCC 500 in an embodiment of the present invention. SCC 500 includes a Galois field multiplier 502, dual-input AND gates (AND) 512, 516, 520, a security gate GE504, an exclusive OR gate (XOR) 506, a security gate 508 and an exclusive OR gate (XOR) 510, wherein it is assumed that the multiplier 502 is a 1-bit multiplier. The security gate 504 and the security gate 508 can be an AND gate, an OR gate, a latch or any other suitable gate controller (in fact, the security gate 504 and the security gate 508 are a security gate control circuit (SGC), whose operation is similar to Figure 1 The gate controller 106 in FIG.

[0079] The multiplier SCC500 receives input signals x and y as shares Ax and Bx, and shares Ay and By, respectively, and outputs an output signal q as shares Aq and Bq. To map the shares of the input signal to the shares of the output signal, the SCC performs three steps, namely calculation, resharing, and integration.

[0080] In the operation step, multiplier 502 multiplies the items Ax*Ay, Ax*By, Bx*Ay, and Bx*By. In terms of security, the multiplications in the inner-domain (Ax*Ay and Bx*By) are not important in terms of security. However, the cross-domain items (Ax*By, Bx*Ay) have security risks and need to be carefully protected.

[0081] In the re-sharing step, XOR gate 506 adds a new random share Z (gated by safety gate 504) to the cross-domain terms, making them statistically independent of all other values, thus allowing these terms to be added to any domain in any next step. SGC 508 then gates the output signal of XOR gate 510, preventing any power disturbance from propagating through the re-sharing step.

[0082] Finally, in the integration step, XOR gates 510 add the re-shared cross-domain terms to each domain and generate dual-share Aq and Bq output signals.

[0083] The SCC 500 further includes an AND gate 512 configured to generate a first synchronization signal to enable the safety gate 504 only when the share Z is stable; a delay circuit 514; an AND gate 516 configured to generate a second synchronization signal to enable the safety gate 508 only when the output signal of the multiplier 502 is stable; a delay circuit 518; and an AND gate 520 configured to generate a third synchronization signal, denoted as q-stable (qs) when the data on the shares Aq and Bq are stable. In some embodiments, the internal delay of the AND gate 512 is set according to the delay of the share Z; the delay of the delay circuit 514 is set according to the combined delay of the multiplier 502 and the XOR gate 506, and the delay of the delay circuit 518 is set according to the delay of the XOR gate 510.

[0084] Figure 5 The configuration of multiplier SCC500 shown in and described above is cited by way of example. Other configurations may be used in alternative embodiments. For example, in one embodiment, the input signal to enable the safety gate is provided by the safety gate timing circuit 108 ( Figure 1 ) is generated. In other embodiments, more than two shares may be used.

[0085] Figure 6 600 is a flow chart for illustrating a method for protecting against power supply side channel attacks according to an embodiment of the present invention. The flow chart can be executed, for example, by including a propagation delay circuit 202 ( Figure 2 ) is implemented by the safety combination circuit 200.

[0086] The flowchart begins with operation 602 (get initial input signal and timing signal), where the security combination circuit obtains an initial set of input signal groups and an initial timing signal. Next, in the first stage operation operation 604, the security combination circuit securely operates the output signal of the first stage (e.g., performs multiplication of multiple share modules) and delays the timing signal according to the expected maximum delay of the first stage operation (as indicated by the synchronization signal).

[0087] Next, the safety combinational circuit enters operation 606 (block first stage propagation) and blocks the first stage result from propagating until the synchronization signal is triggered. Since the timing signal is delayed according to the delay of the first stage operation, this operation ensures that no power supply disturbance occurs.

[0088] Next, in the next stage operation operation 608, the safety combinational circuit safely operates the output signal of the next stage and delays the timing signal according to the expected maximum delay of the next stage operation. Then, in operation 610 (block the next stage propagation), the safety combinational circuit blocks the result of the next stage from propagating until the synchronization signal is triggered (so that the output signal of the operation stage is stable), thereby avoiding any power supply interference.

[0089] The security combination circuit then repeatedly performs operations 608 and 610 until the operation of the last stage is completed, and then the flowchart ends.

[0090] Figure 6 The configuration of the flowchart 600 shown in and described above is cited as an example only. Other flowcharts may be used in alternative embodiments. For example, in some embodiments, sampling stages may be added to the safety combinational circuit.

[0091] Figures 1 to 6 The configurations of the anti-attack operation circuit 100 and the anti-attack operation circuit 400, the combination operation circuit 102, the security gate timing circuit 108, the security combination circuit 200, the security combination circuit 500, the security trigger 300 and the security trigger 350, and the method of the flowchart 600 shown in the above are only example configurations and flowcharts purely shown for clarifying the concepts. In alternative embodiments, any other suitable configurations and flowcharts may be used. The different subunits of the anti-attack operation circuit 100 may be implemented using suitable hardware, such as one or more application-specific integrated circuits (ASICs) or field-programmable gate arrays (FPGAs).

[0092] The terms logic-high and logic-low (and the derived terms rising edge and falling edge) mentioned above should be interpreted as generic names for opposite logic levels. In embodiments, the voltage level representing the logic-high level may be lower than the voltage level representing the logic-low level. In some embodiments, the logic-high and logic-low levels may be represented by the polarity of the current or by a low current level and a high current level.

[0093] Therefore, it should be understood that the above-mentioned embodiments are cited by way of example, and the present invention is not limited to what has been specifically shown and described above. On the contrary, the scope of the present invention includes the combination and sub-combination of the various features described above, as well as changes and modifications that those skilled in the art will think of after reading the foregoing description and are not disclosed in this document. The documents incorporated by reference into this patent application should be considered as an integral part of this application, unless any term defined in these incorporated documents in a manner that conflicts with the explicit or implicit definition in this specification, only the definition in this specification should be considered.

Claims

1. An anti-attack computing circuit in an integrated circuit, characterized in that: The anti-attack operation circuit comprises: a first computing stage configured to process one or more signals to generate one or more output signals, the first computing stage having a plurality of signal propagation paths; a second operation stage configured to receive and process the output signal of the first operation stage; and A safety circuit is configured to generate a synchronization signal, the synchronization signal being used to indicate that the propagation of the signal in the first operation stage has been completed, and to prohibit the second operation stage from processing the output signal of the first operation stage during a time interval derived from the synchronization signal.

2. The anti-attack operation circuit according to claim 1, characterized in that: The time interval is smaller than one clock cycle of the signal.

3. The anti-attack operation circuit according to claim 1, characterized in that: The safety circuit is configured to mask the output signal of the first computing stage during the time interval to prevent the output signal from reaching the second computing stage.

4. The anti-attack operation circuit according to claim 1, characterized in that: The safety circuit comprises: a safety gated sequential circuit configured to output the synchronization signal when the propagation of the signal in the first operation stage is completed; and A safety gating circuit is configured to gate the output signal of the first operation stage according to the synchronization signal.

5. The anti-attack operation circuit according to claim 4, characterized in that: The security gate control circuit includes a logic gate.

6. The anti-attack operation circuit according to claim 4, characterized in that: The security gate control circuit includes a tri-state buffer.

7. The anti-attack operation circuit according to claim 4, characterized in that: The security gate circuit includes a latch.

8. The anti-attack operation circuit according to claim 4, characterized in that: The safety gate timing circuit is configured to set a time to output the synchronization signal according to a maximum propagation delay of the first operation stage.

9. The anti-attack operation circuit according to claim 1, characterized in that: It further includes a safety trigger, which is coupled between the first operation stage and the second operation stage, and is configured to sample the output signal of the first operation stage according to an output synchronization signal and send an input synchronization signal to the second operation stage.

10. A method for protecting an integrated circuit, characterized in that: This method includes: Processing one or more signals in a first computing stage having a plurality of signal propagation paths to generate one or more output signals; receiving and processing the output signal of the first computing stage in a second computing stage; and A safety circuit is used to generate a synchronization signal indicating that propagation of the signal in the first operation stage has been completed and to prevent the second operation stage from processing the output signal of the first operation stage for a time interval derived from the synchronization signal.

11. The integrated circuit protection method according to claim 10, characterized in that: The time interval is smaller than one clock cycle of the signal.

12. The integrated circuit protection method according to claim 10, characterized in that: The operation of preventing the second computing stage from processing the output signal of the first computing stage includes masking the output signal of the first computing stage during the time interval to prevent the output signal from reaching the second computing stage.

13. The integrated circuit protection method according to claim 10, characterized in that: The operation of preventing the second operation stage from processing the output signal of the first operation stage comprises: After the signal propagation of the first operation stage is completed, outputting the synchronization signal; According to the synchronization signal, the output signal of the first operation stage is gated by a safety gating circuit.

14. The integrated circuit protection method according to claim 13, characterized in that: The security gate control circuit includes a logic gate.

15. The integrated circuit protection method according to claim 13, characterized in that: The security gate control circuit includes a tri-state buffer.

16. The integrated circuit protection method according to claim 13, characterized in that: The security gate circuit includes a latch.

17. The integrated circuit protection method according to claim 13, characterized in that: The operation of outputting the synchronization signal includes setting a time to output the synchronization signal according to a maximum propagation delay of the first operation stage.

18. The integrated circuit protection method according to claim 10, characterized in that: The method further includes sampling the output signal of the first operation stage according to an output synchronization signal through a safety trigger coupled between the first operation stage and the second operation stage, and sending an input synchronization signal to the second operation stage.

Images