Tamper protection

Abstract

A hardware security module device includes a sensor assembly including a sensor and a processing component. The hardware security module also includes a housing including a cover and a base spaced apart from each other in a spacing direction and sandwiching the sensor assembly therebetween. The sensor is configured to trigger the processing component when the cover is moved away from the sensor. The apparatus includes a structure attached to the cover and protruding from the cover toward the base. The structure is configured to strike the sensor assembly upon lateral movement of the cover relative to the base, thereby impeding lateral movement of the cover relative to the base.

Description

TECHNICAL FIELD

[0001] The present invention relates to a device comprising tamper protection, and in particular to a device comprising a sensor for detecting when a cover of the device is removed. BACKGROUND

[0002] Various devices are designed to store sensitive data and perform operations with the sensitive data. For example, a hardware security module (HSM) is a device that securely stores and manages cryptographic keys and performs a set of cryptographic operations, e.g., generating cryptographic keys, performing encryption and decryption, or performing digital signature and verification operations.

[0003] Such devices can comprise mechanisms to resist tampering by malicious third parties. For example, some features of the device provide tamper resistance, and some features of the device provide tamper detection (i.e., triggering an alarm state when tampering is detected).

[0004] There is a need to continually improve the security of such devices. SUMMARY

[0005] Devices such as HSM devices can comprise a sensor for detecting removal of a cover (lid) of the device, which can indicate a tampering attempt. However, such tamper detection can be circumvented by partially sliding down the cover, e.g., if the cover is layered, translating the cover within the plane of the cover away from a position in which the cover closes an opening of a cavity of the device in which the sensor is comprised. To make such circumvention more difficult, the present disclosure provides a device with tamper protection as described herein.

[0006] Generally, it is suggested to attach a structure to the cover that impedes lateral movement of the cover relative to the sensor assembly.

[0007] According to a first aspect, there is provided a device comprising: a sensor assembly comprising a sensor and a processing component; a housing comprising a cover and a base, the cover and the base being spaced apart from each other in a spacing direction and sandwiching the sensor assembly therebetween, wherein the sensor is configured to trigger the processing component when the cover moves away from the sensor; and a structure attached to the cover and protruding from the cover towards the base. The structure is configured to hit the sensor assembly when the cover moves laterally relative to the base, thereby impeding lateral movement of the cover relative to the base.

[0008] Lateral movement can be defined as movement transverse to the spacing direction.

[0009] Each of the lid and the base can have a respective substantially planar opposing surface. That is, the surfaces can extend in parallel, spaced apart planes. Each surface can be transverse to the spacing direction. Optionally, one or both of the lid and the base can have a smaller thickness in the spacing direction than it extends in one or both directions transverse to the spacing direction.

[0010] The structure can comprise a side wall arranged to at least partially surround the sensor assembly transverse to the spacing direction, such that lateral movement of the lid brings the side wall into contact with the sensor assembly. For example, the structure can have a cup or box shape, with the sensor assembly at least partially inside. The structure can comprise at least one bracket connecting the structure to the lid, for example a part of the wall having a surface facing a part of the surface of the lid and adhering to the lid. The bracket element can be provided as an element connecting the side wall, wherein the element is attached to the lid by an adhesive. By attaching the structure to the inside of the lid by an adhesive (rather than, for example, a rivet through the lid), a secure attachment can be provided without exposing the location of the sensor assembly from the outside of the device.

[0011] The lid can comprise a ferrous material, and the sensor can comprise a magnetic sensor. The structure can comprise a non-ferrous material, which can prevent the structure from interfering with a magnetic field due to the magnetic sensor and the lid. In this way, the structure can be used with a lid and magnetic sensor designed without taking the structure into account.

[0012] Alternatively or additionally, the sensor can comprise a mechanical switch (for example, a microswitch) that is pressed by the lid (for example, via the structure).

[0013] The base can be configured to impede lateral movement of the sensor assembly relative to the base.

[0014] One possibility is that the sensor assembly can be attached to the base. For example, the sensor assembly can be attached directly to the base by an adhesive.

[0015] Alternatively or additionally, the device can comprise a second structure attached to the base and protruding from the base towards the lid, the second structure being configured to impinge on the sensor assembly when the base is moved laterally relative to the lid, thereby impeding lateral movement of the base relative to the lid.

[0016] The device can comprise a second structure attached to the base and protruding from the base towards the lid, the second structure being configured to impinge on the sensor assembly when the base is moved laterally relative to the lid, thereby impeding lateral movement of the base relative to the lid.

[0017] The sensor assembly can comprise a second sensor configured to trigger the processing component into an alarm state when the base moves away from the second sensor. The second sensor can comprise a magnetic sensor and / or a mechanical switch. When the processing component is triggered into the alarm state, it can perform a security operation (e.g. delete sensitive data in the processing component and / or send an alarm message to other components of the HSM and / or to a user of the device).

[0018] The sensor assembly can comprise a tamper-evident envelope that at least encloses the processing component and is configured to trigger the processing component upon physical tampering. The tamper-evident envelope can also enclose the sensor. The tamper-evident envelope can comprise a mesh (e.g. comprising metal).

[0019] The sensor assembly can be a unitary unit. That is, the sensor and the processing unit and any other possible components of the sensor assembly can form a single physical unit. The sensor assembly can not be separable into the respective individual parts while continuing to be operable to perform cryptographic operations.

[0020] The device can comprise a main processor connected to the processing component of the sensor assembly and configured to query the processing component (e.g. at start-up and periodically during operation of the device), wherein the processing component is configured to respond to the query using a cryptographic key stored at the processing component (e.g. a key provided to the processing component by the main processor at start-up, before the first query). Thus, the main processor and the processing component operate a challenge / response protocol. The processing component is configured to delete the key in response to being triggered into the alarm state. If the processing component is unable to provide a correct response, the main processor can be configured to determine that tampering has occurred. A third party does not have the cryptographic key, since it is not exposed on the communication channel between the processing component and the main processor during the challenge / response operation, and thus the third party is unable to create a substitute valid response.

[0021] According to a second aspect, there is provided a method of manufacturing one or more devices according to the first aspect. The method comprises determining a position of the sensor assembly within the housing, automatically placing the sensor assembly at the position or automatically marking a position in the housing for placing the sensor assembly, wherein the step of determining comprises a random or pseudo-random process. If the exact position inside the device is not known, it can be more difficult to bypass or attack the sensor assembly. “Automatically” in this context refers to a process that does not involve an action by a human user other than optionally initiating the process (e.g. by issuing a command to a manufacturing apparatus performing the method).

[0022] The step of determining can comprise determining the location from a set of predetermined available locations. For example, the internal device layout can provide a limited number of available locations for placing the sensor components and structures, and the method can comprise randomly (or pseudo-randomly) picking a location from the available locations.

[0023] In general, the method can comprise manufacturing a plurality of devices, wherein the steps of determining a location and automatically placing or automatically marking are repeated for each device of the plurality of devices, such that the location of the sensor component in each device of the plurality of devices is different. In this way, a third party wishing to tamper with the security components finds it difficult to identify which part of the enclosure to attack. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 A schematic diagram of an HSM device is shown;

[0025] Figure 2 A schematic cross-section of a portion of a device with tamper protection is shown;

[0026] Figure 3 A schematic cross-section of a portion of another device with tamper protection is shown;

[0027] Figure 4 A schematic cross-section of a portion of yet another device with tamper protection is shown;

[0028] Figure 5 A schematic diagram of a device with tamper protection is shown; and

[0029] Figure 6 A flow diagram showing some steps of a method of forming one or more devices is shown. DETAILED DESCRIPTION

[0030] Various devices can be designed to store sensitive data and perform operations with the sensitive data. For example, a hardware security module (HSM) is a device that securely stores and manages cryptographic keys and performs a set of cryptographic operations (e.g., generating cryptographic keys, performing encryption and decryption, or performing digital signature and verification operations).

[0031] Figure 1A schematic plan view showing an example of an HSM device 2 is shown. The device 2 comprises a housing 4 for enclosing various hardware components including a main processor 6 (e.g. a CPU), a non-volatile memory 8, a random access memory (RAM) 10, a cryptographic co-processor 12, a power / reset component 14, an input / output component 16, a random number generator 18, a security processor 20 (an example of the aforementioned "processing component") and one or more sensors 22. Various components such as the main processor 6 and the security processor 20 are mounted on a printed circuit board (PCB) 24. The PCB 24 comprises electrical connections 25 for communicatively coupling the various components to one another.

[0032] A user can store sensitive cryptographic material on the HSM. For example, one or more cryptographic application keys are associated with a user of the HSM device. The cryptographic application keys can be securely stored on the HSM. Alternatively, the cryptographic application keys can be encrypted using a master key and stored outside the HSM. The master key, or material that can be used to obtain the master key, is then securely stored inside the HSM. The cryptographic co-processor 12 performs various cryptographic functions (e.g. various standard encryption and decryption algorithms and digital signature algorithms) in hardware. The main processor 6 can offload various operations onto the cryptographic co-processor 12.

[0033] The security processor 20 is configured to detect attempts to tamper with the device. The security processor 20 is configured to communicate with a plurality of sensors 22 located in the HSM. The sensors 22 are configured to monitor physical properties that can be indicative of an attempt to tamper with the HSM. The security processor 11 and the sensors 22 together provide tamper detection. The sensors can include one or more of the following sensors: one or more temperature sensors (e.g. to monitor the temperature of the main processor 6 and / or the PCB 24), one or more voltage sensors and one or more current sensors. The security processor 20 is configured to detect, by monitoring the outputs of these sensors, an indication that the HSM is being tampered with or has been tampered with. If so, the security processor 20 is triggered to enter an alarm state.

[0034] In use, the security processor 20 is configured to communicate with the main processor 6. The security processor 20 provides information indicating whether the security of the hardware security module (HSM) has been compromised. For example, upon being triggered to enter the alarm state, the security processor 20 can send an indication to the main processor 6 that the HSM has been compromised. In response, the main processor 6 is configured to suspend boot-up and delete at least some stored cryptographic data (e.g. unencrypted keys present in the main processor and / or the cryptographic co-processor).

[0035] Furthermore, upon being triggered into the alarm state, the security processor 20 can erase at least some of the encrypted data within it. For example, at start-up, the host processor 6 can provide an encryption key to the security processor 20. Subsequently, during start-up operations and / or periodically thereafter, the host processor 6 queries the security processor 20 in accordance with a challenge / response protocol. The security processor uses the encryption key to generate a response. The security processor 20 is configured to delete the encryption key in response to being triggered into the alarm state. If the processing component is unable to provide a correct response, for example, within a certain time period, the host processor 6 determines that tampering has occurred. A third party does not have the encryption key because the encryption key is not exposed on a communication channel between the processing component and the host processor during the challenge / response operations, and thus the third party is unable to create a substitute valid response.

[0036] Figure 2 A schematic cross-section of a portion of a device 2 with tamper protection according to an embodiment is shown. The same reference numerals are used in different figures to represent similar or equivalent features to aid understanding and are not intended to be limiting of the illustrated embodiments. The device 2 comprises a housing 4 (only a portion of which is shown) which comprises a lid 26 and a base 28. As Figure 2 shown, the lower surface of the lid 26 and the upper surface of the base 28 are substantially planar, oppose each other, and are spaced apart from each other in a spacing direction (which is a vertical direction in Figure 2 the illustrated embodiment). A cavity is defined by the housing between the lid 26 and the base 29. Although Figure 2 not shown in the illustrated embodiment, the housing also comprises walls on either side of the portion of the housing shown (i.e. the exterior, in the left and right side directions respectively) such that the housing substantially completely encloses the volume within the housing. Figure 2 Figure 2 The housing 4 comprises a first sensor 32 and a second sensor 34, and a processing component 36 connected to the sensors 32 and 34. The first sensor 32 and the second sensor 34 are shown as being located on the lid 26 and the base 28 respectively. The processing component 36 is shown as being located on the base 28. The processing component 36 is connected to the first sensor 32 and the second sensor 34 by way of electrical connections 38 and 40 respectively. The electrical connections 38 and 40 pass through the lid 26 and the base 28 respectively.

[0037] The device 2 comprises a sensor assembly 30 which is enclosed by the housing 4 and sandwiched between the lid 26 and the base 28. The sensor assembly 30 comprises a first sensor 32 and a second sensor 34, and a processing component 36 connected to the sensors 32 and 34.

[0038] The processing component 36 can be the security processor 20 of the HSM device 2 described above in relation to Figure 1 the first sensor 32 and the second sensor 34 can be two of the sensors 22 described above in relation to Figure 1 the first sensor 32 and the second sensor 34 can be two of the sensors 22 described above in relation to

[0039] ​The first sensor 32 is configured to detect whether the lid 26 is moved away from the sensor 32 (e.g. whether the lid 26 is lifted from the base 28). For example, the lid 26 can be formed of a ferrous material and the first sensor 32 can be a magnetic sensor that forms a magnetic circuit with the lid 26. When the lid 26 is removed, the circuit is broken and the sensor 32 triggers the processing component 36 into an alarm state, thereby detecting a potential tampering. The second sensor 24 is similarly arranged to detect whether the base 28 is removed and, if so, to trigger the processing component 36 into an alarm state.

[0040] The apparatus further comprises a first structure 40 arranged to hinder lateral movement of the lid 26 relative to the sensor assembly 30. The structure 40 can thus require the lid 26 (or the base 28) to be lifted (i.e. moved in the spacing direction) to open the housing 4 and contact the internal components, which is subsequently detected by the sensor assembly 30. The first structure 40 comprises a side wall 42 connected by a base element 44. The first structure 40 may, for example, have a cup or box shape that partially covers the sensor assembly 30. The first structure 40 is attached to the lid 26 by the base element 44, and the side wall 42 protrudes from the lid 26 towards the base 28 and over a portion of the sensor assembly 30. The first structure 40 can be attached to the lid 26 by an adhesive (e.g. a two-component epoxy), which adheres the base element 44 to the lid 26. The base element 44 thus acts as a support for the side wall 42.

[0041] The side wall 42 can substantially surround the sensor assembly in (e.g. all) directions transverse to the spacing direction. That is, for any direction transverse to the spacing direction, there is a straight line extending in that direction that passes through the sensor assembly 30, and there is one side wall 42 in both directions along that line from the sensor assembly. It will be appreciated that one or both of the side walls can comprise gaps, provided that the gaps are not large enough for the sensor assembly to pass through the gaps. As a limiting case, the first structure 40 can be provided as a plurality of teeth protruding from the lid 26 towards the base 28, and a gap is defined between pairs of adjacent teeth that is narrower than the length of the sensor assembly in the direction of the gap.

[0042] It will be appreciated that, although Figure 2 the cross-sectional view in Fig. 1 is in a first plane that includes the spacing direction, if Figure 2 the cross-sectional view is in a second plane that includes the spacing direction and is transverse to the first plane, then Figure 2 the cross-sectional view will be substantially the same.

[0043] The first structure 40 is arranged to hinder lateral movement of the lid 26 (e.g. towards Figure 2The first structure 40 can prevent the lid 26 from sliding laterally with respect to the spacing direction to contact the interior of the housing 4 without triggering the sensor assembly 30. If the lid 26 is forced to move laterally, the first structure 40 can damage the sensor assembly 30 or otherwise move the sensor assembly 30 relative to the lid 26 and / or the base 28 to cause the first sensor 32 or the second sensor 34 to trigger the processing component 36.

[0044] The device 2 includes a second structure 46 arranged to impede lateral movement of the base 28 relative to the sensor assembly 30. The second structure 46 is arranged to operate relative to the base 28 in the same way as the first structure 40 described above is arranged to operate relative to the lid 26. The second structure 46 is arranged to impact the sensor assembly 30 when the base 28 moves laterally relative to the sensor assembly 30. The second structure 46 includes a sidewall 48 connected by a base element 50. The base element 50 is attached to the base 28, and the sidewall 48 protrudes from the base 28 toward the lid 26 and over a portion of the sensor assembly 30. The second structure 46 can thereby prevent the base 28 from sliding laterally relative to the sensor assembly 30 to contact the interior of the housing 4 without triggering the sensor assembly 30.

[0045] The sensor assembly 30 also includes a tamper-evident envelope 52, which can include a metal mesh arranged to prevent or enable detection of direct physical attacks such as drilling through the housing 4.

[0046] Figure 3 A portion of a device 2 according to another embodiment is shown. Like the embodiments described above with respect to Figure 2 The device 2 includes a housing 4 (only a portion is shown) that includes a lid 26 and a base 28, and a sensor assembly 30 enclosed by the housing 4 and sandwiched between the lid 26 and the base 28. The sensor assembly 30 includes a sensor 32 and a processing component 36 connected to the sensor 32.

[0047] The processing component 36 can be a secure processor 20 of the HSM device 2 described above with respect to Figure 1 or can be a separate processor for providing additional / supplementary tamper protection with such a secure processor 20. Similarly, the sensor 32 can be part of a sensor 22 described above with respect to Figure 1 .

[0048] The sensor 32 is configured to detect whether the lid 26 is moved away from the sensor 32 (e.g., whether the lid 26 is lifted from the base 28). For example, the first sensor 32 can be a magnetic sensor or a switch mechanically pressed by the lid 26 (via the base element 44 of the structure 40).

[0049] The sensor assembly 30 is attached directly to the base 28. For example, the sensor assembly 30 can be attached to the base 28 by an adhesive such as a two-part epoxy.

[0050] Figure 4 A portion of a device 2 according to another embodiment is shown. Like the embodiments described above in relation to Figure 2 and Figure 3 The device 2 comprises a housing 4 (only a portion of which is shown) comprising a lid 26 and a base 28 and a sensor assembly 30 enclosed by the housing 4 and sandwiched between the lid 26 and the base 28. The sensor assembly 30 comprises a first sensor 32 and a second sensor 34 and a processing component 36 connected to the sensors 32 and 34. The sensor assembly 30 further comprises an element 54 fixed to the base 28 and protruding from the base 28 towards the lid 26.

[0051] The processing component 36 can be the secure processor 20 of the HSM device 2 described above in relation to Figure 1 or can be a separate processor for providing additional / supplementary tamper protection with such a secure processor 20. Similarly, the sensors 32 can be part of the sensors 22 described above in relation to Figure 1 .

[0052] The device 2 further comprises a structure 40 arranged to hinder lateral movement of the lid 26 relative to the sensor assembly 30. The structure 40 can thereby require the lid 26 (or the base 28) to be lifted (i.e. moved in the spacing direction) in order to open the housing 4 and access the internal components, which is subsequently detected by the sensor assembly 30. The structure 40 comprises a side wall 42 arranged to hit the element 54 of the sensor assembly 30 when the lid is moved laterally. The structure 40 and the element 54 are arranged together to move the lid away from the sensor assembly 30 when the lid is pushed laterally. The structure 40 and the sensor assembly 30 can thereby prevent the lid 26 from being slid off without triggering the sensor assembly 30.

[0053] Figure 5 A schematic diagram of a device 2 with tamper protection according to an embodiment is shown. The device 2 can be the device 2 described above in relation to any of Figures 1 to 4 The device comprises a housing 4 comprising a lid 26 and a base 28 and enclosing a main processor 6 and a sensor assembly 30 connected to the main processor 6. The sensor assembly 30 is configured to detect when the lid 26 is removed from the device 2. A structure 40 protruding from the lid 26 is arranged to hinder lateral movement of the lid 26 relative to the sensor assembly 30.

[0054] Figure 6A flowchart showing some steps of a method of forming one or more devices as described herein. The method comprises determining a position of a sensor assembly within a housing (step S1). Here, "position" defines a lid position on an inward surface of the lid and a corresponding base position on an inward surface of the base, where the two positions are aligned, spaced apart in a spacing direction, when the lid is in place connected to the base. The determination comprises a random or pseudo-random process. The method further comprises automatically placing the sensor assembly at the position (step S2a) or automatically marking the position in the housing for placing the sensor assembly (step S2b). When the method comprises automatically marking the position, the method comprises a further step of placing the sensor assembly in the marked position (step S3).

[0055] The sensor assembly can be placed at the position by a process that leaves no indication of the position on the outside of the device. It can comprise placing a first structure and a second structure to surround the lid position and the base position, respectively, and fixing (e.g. adhering) the first structure and the second structure to the inward surfaces of the lid and the base, respectively. The lid is then connected to the base, the sensor assembly being at the position and surrounded by the first structure and the second structure. Optionally, the sensor assembly can be adhered to one or both of the lid and the base.

[0056] The steps can be repeated to form a plurality of devices with sensor assemblies at different positions within the housing.

[0057] While certain embodiments have been described herein, these embodiments are presented by way of example only, and are not intended to limit the scope of the claimed invention. Indeed, the novel methods and apparatuses described herein can be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the methods and apparatuses described herein can be made without departing from the scope of the disclosure.

Claims

1. A device comprising: a sensor assembly comprising a sensor and a processing component; a housing comprising a lid and a base, the lid and the base being spaced apart from each other in a spacing direction and sandwiching the sensor assembly therebetween, the base being configured to impede lateral movement of the sensor assembly relative to the base, wherein the sensor is configured to trigger the processing component when the lid moves away from the sensor; a structure attached to the lid and protruding therefrom towards the base, the structure being configured to impinge on the sensor assembly when the lid moves laterally relative to the base, thereby impeding lateral movement of the lid relative to the base.

2. The apparatus of claim 1, wherein, the structure comprises a side wall arranged to at least partially surround the sensor assembly laterally to the spacing direction, such that lateral movement of the lid brings the side wall into contact with the sensor assembly.

3. The apparatus of claim 2, wherein, the structure comprises an element connecting the side wall, wherein the element is attached to the lid by an adhesive.

4. The apparatus of any one of the preceding claims, wherein, the lid comprises a ferrous material and the sensor comprises a magnetic sensor.

5. The apparatus of claim 4, wherein, the structure comprises a non-ferrous material.

6. The apparatus of any of the preceding claims, wherein, the sensor comprises a mechanical switch pressed by the lid.

7. The apparatus of any of the preceding claims, wherein, the sensor assembly is attached to the base.

8. The apparatus of any of the preceding claims, wherein, the sensor assembly comprises a second sensor configured to trigger the processing component into an alarm state when the base moves away from the second sensor.

9. The apparatus of any of the preceding claims, wherein, the device comprises a second structure attached to the base and protruding therefrom towards the lid, the second structure being configured to impinge on the sensor assembly when the base moves laterally relative to the lid, thereby impeding lateral movement of the base relative to the lid.

10. The apparatus of claim 8, wherein, the second structure comprises a side wall arranged to at least partially surround the sensor assembly laterally to the spacing direction, such that lateral movement of the base brings the side wall into contact with the sensor assembly.

11. The apparatus of any of the preceding claims, wherein, the sensor assembly comprises a tamper-evident envelope at least enclosing the processing component and configured to trigger the processing component upon physical destruction.

12. The apparatus of any of the preceding claims, wherein, the sensor assembly is a unitary unit.

13. The device according to any of the preceding claims, further comprising a host processor connected to the processing component of the sensor assembly and configured to query the processing component, wherein, the processing component is configured to respond to a query using an encryption key stored at the processing component, and wherein the processing component is configured to delete the key in response to being triggered.

14. A method of manufacturing one or more devices according to any of the preceding claims, the method comprising: determining a position of the sensor assembly within the housing; automatically placing the sensor assembly at the position or automatically marking a position in the housing for placing the sensor assembly; wherein the step of determining comprises a random or pseudo-random process.

15. The method of claim 14, wherein, the step of determining comprises determining the position from a set of predetermined available positions.

16. The method of claim 14 or 15, wherein, the method comprises manufacturing a plurality of devices and repeating the steps of determining the position and automatically placing or automatically marking for each device of the plurality of devices such that the position of the sensor assembly is different in each device of the plurality of devices.

Images