METHOD FOR PROTECTION AGAINST SIDE CHANNEL ATTACKS

Description

[0001] The invention relates to a method of protection against side-channel attacks on an electronic computer. It also relates to an electronic computer for implementing this method.

[0002] Typically, electronic computers include an information storage medium, such as main memory, and a system-on-a-chip (SoC) that executes instructions stored in this main memory to process data. The data is also usually stored in this main memory. Systems-on-a-chip are more commonly known by the acronym SoC ( "System On Chip" ) . Such a system-on-a-chip typically includes one or more internal cache memories, a central processing unit, and one or more internal buses connecting the internal cache memory(ies) to the central processing unit.

[0003] The central processing unit is better known by the acronym CPU ( "Central Processing Unit" ).

[0004] To protect data transmitted between main memory and the system-on-chip, encryption is a common practice. In this case, the data moved from main memory to the system-on-chip is decrypted at the system-on-chip's input and then transmitted in plain text on the system-on-chip's internal buses.

[0005] In this text, "plaintext" data refers to data that is not protected and is therefore directly usable without first being decrypted or unmasked.

[0006] It is very difficult to read data from the internal cache memory of a system-on-a-chip. However, it has been observed that the values ​​of the plaintext data transmitted on the internal buses of the system-on-a-chip can be obtained quite easily by implementing a side-channel attack ( "Side-channel attack" " in English).

[0007] Prior art is known from US2012 / 297110A1, US2017 / 214523A1, US5859912A and US2019 / 349187A1. None of these documents describes the claimed solution.

[0008] The invention aims to make such side-channel attacks more difficult. It therefore relates to a protection method according to claim 1.

[0009] It also includes an electronic calculator for implementing this process.

[0010] The invention will be better understood upon reading the following description, given solely by way of non-limiting example and made with reference to the drawings in which: there figure 1 is a schematic illustration of the architecture of an electronic computer; the figure 2 is a flowchart of a side-channel attack protection method implemented in the electronic computer of the figure 1 ; there figure 3is a schematic illustration of the architecture of a mask generator implemented in the computer of the figure 1 ; there figure 4 is an illustration of the architecture of a word that travels on buses implemented in the computer of the figure 1 ; there figure 5 is a flowchart of another embodiment of a side-channel attack protection method that can be implemented in the computer of the figure 1 .

[0011] In the remainder of this description, the well-known characteristics and functions of a person skilled in the art are not described in detail.

[0012] In this description, detailed examples of embodiments are first described in Chapter I with reference to the figures. Then, in Chapter II, variations of these embodiments are presented. Finally, the advantages of the different embodiments are introduced in Chapter III. Chapter I: Examples of Implementation Methods

[0013] There figure 1 represents an electronic computer 1 comprising a system 2 on a chip and a set 4 of external components. For example, computer 1 is the computer of a computer, a smartphone, an electronic tablet or similar.

[0014] System 2 includes a main interconnection bus 6 that allows connection of System 2 to the various external components of assembly 4. For this purpose, bus 6 is connected to input / output ports 7 of System 2. Bus 6 typically includes: a data bus on which words are transmitted, and an address bus on which the addresses at which these words are to be read or written are transmitted.

[0015] Subsequently, to simplify the figures, only the data buses are represented.

[0016] By way of illustration, in this example embodiment, assembly 4 comprises the following components, each of which is connected to bus 6: an information storage medium 10, a mass memory 12 such as Flash memory, and a device interface 16 which allows data to be exchanged between the system 2 and one or more devices.

[0017] Bus 6 can also be connected to internal system 2 components. For example, here, bus 6 is connected to a direct memory access controller 14, better known by the acronym DMA ( “Direct Memory Access Controller” ) .

[0018] In this embodiment example, the medium 10 is a volatile main memory in which data to be processed by system 2 are stored, as well as the instructions of one or more processes executed by system 2 to process this data.

[0019] System 2 is a semiconductor chip on which is implemented all the components necessary to execute the instructions stored on the medium 10 in order to process the data also stored on that same medium. Here, only the components of system 2 necessary to understand the invention are shown and described.

[0020] System 2 includes: a central processing unit 20, two first hardware circuits 22 and 24 for protection against side-channel attacks, two internal cache memories 26 and 28, an internal cache memory 30, a second hardware circuit 32 for protection against side-channel attacks, and a cryptographic hardware circuit 34 for encryption and decryption.

[0021] These different components of system 2 are connected to each other via internal data buses and address buses.

[0022] The central unit 20 typically includes: an input / output data interface 42, an instruction loader 44 including a program counter 46, a queue 48 of instructions to be executed, an arithmetic and logic unit 50 capable of executing one after the other the instructions contained in the queue 28, a set 52 of registers, and buses 54 which link together the different above elements of the central unit 20.

[0023] Interface 42 connects the central unit 20 to the protection circuit 22 via an internal data bus 60 to read and write data to the cache memory 26. Typically, interface 42 transfers data between the register set 52 and the cache memory 26.

[0024] Bus 60 allows the transmission, in a single clock cycle, between the central processing unit 20 and the protection circuit 22, of a word Wj whose size Tw is greater than the size TD of a data Dj. In this text, the index j identifies the data Dj. Typically, the size TD is greater than 16 bits, 32 bits, or 64 bits. In this first embodiment, the size TD is equal to 64 bits.

[0025] As illustrated on the figure 4 In this embodiment, the word W j is divided into two successive ranges of bits: a 64-bit PD range that contains the bits encoding the data D j, and a PC range intended to contain clear MC j metadata.

[0026] In this example implementation, the MC metadata j includes an initialization vector iv j, which will be described later. The size T iv of this initialization vector iv j is typically greater than 4 bits, 8 bits, or 16 bits. In this example, the size T iv is 8 bits. Thus, the size T w of the word W j is greater than or equal to 72 bits.

[0027] The loader 44 is connected to the protection circuit 24 via an internal bus 62 to load instructions to be executed from the cache memory 28. More precisely, the loader 44 loads the instruction to which the program counter 46 points. For this purpose, the program counter 46 contains the address of the next instruction to be executed. The loader 44 stores each loaded instruction, one after the other, in the queue 48.

[0028] Bus 62 is identical to bus 60. Thus, the size of the words carried on this bus 62 is equal to T w.

[0029] The arithmetic and logic unit 50 executes instructions from queue 48 one after the other. The set of instructions executable by the arithmetic and logic unit 50 includes, in particular: instructions for loading, for example into one of the registers of set 52, data which is located at a specified address on the medium 10, instructions for writing data, for example currently present in one of the registers of set 52, to a specified address on the medium 10, and instructions for processing data which process the data, for example contained in the set 52 of registers, and which record the result of this processing, for example, also in the set 52 of registers.

[0030] Cache memories 26, 28, and 30 form a two-level cache architecture that accelerates the transfer of data and instructions between the storage medium 10 and the central processing unit 20. The cache memories are ranked by read speed, with the first-level cache being the fastest. Furthermore, cache size generally increases with each level. Thus, the size of the first-level cache is smaller than the size of the second-level cache. The first and second levels of cache memories are usually called «L1» And " L2». Here, caches 26 and 28 are first-level caches, and cache 30 is a second-level cache. In this embodiment, cache 26 is used solely for storing data, while cache 28 is used solely for storing instructions.

[0031] The data and instructions stored on storage medium 10 are recorded in encrypted form. To achieve this, the cryptographic circuit 34 encrypts each piece of data to be written to storage medium 10 before it is placed on bus 6. Conversely, the cryptographic circuit 34 decrypts each piece of data or instruction loaded from storage medium 10 to obtain decrypted data or instructions. Thus, after the cryptographic module 34, the data and instructions that pass through the internal buses of system 2 are not encrypted.

[0032] To achieve this, the cryptographic circuit 34 includes an input / output port 64 connected to port 7 to receive encrypted data or instructions and, alternately, to write encrypted data to bus 6. It also includes an input / output port 66 on which it delivers the decrypted data or instruction and, alternately, receives the plaintext data to be written to bus 6.

[0033] To encrypt and decrypt the data and instructions stored on the medium 10, the cryptographic circuit 34 executes, for example, a predetermined symmetric encryption / decryption algorithm. It uses a secret key k 10 for this purpose. The encryption algorithm used can be a block cipher or a stream cipher, more commonly known by the English term " Stream Cipher. Generally, the cryptographic circuit 34 constructs a data line LD j that contains the cryptogram D j * of the data D j. This data line LD j may also contain other information such as: an authentication MAC code j which allows verification of the integrity and authenticity of the cryptogram D j *, an error detection ECC code Lj which allows verification of the integrity of the MAC code j and the cryptogram D j * and, possibly, to correct the error detected.

[0034] Similarly, each instruction is usually recorded in an instruction line LI j. The structure of such an instruction line is, for example, identical to the structure of the data line LD j except that the cryptogram contained in this instruction line is the cryptogram of the instruction and not the cryptogram of a data item.

[0035] The protection circuits 22, 24, and 32 are designed to prevent side-channel attacks from revealing the values ​​of data and instructions transmitted on the internal buses of system 2, particularly on the internal bus connecting the internal cache memories. To this end, circuits 22, 24, and 32 mask the data and instructions transmitted between memory 30 and cache memories 26 and 28. More specifically, here: Circuit 22 is configured to hide each data written into cache memory 26 by central processing unit 20 and to unhide each data loaded by central processing unit 20 from cache memory 26, circuit 24 is configured to unhide each instruction loaded by central processing unit 20 from cache memory 28, and circuit 32 is configured to hide each data or instruction moved from support 10 to cache memory 30 and to unhide each data moved from cache memory 30 to support 10.

[0036] For this purpose, the protection circuit 22 is interposed between the central processing unit 20 and the cache memory 26, and more specifically, between the interface 42 and the cache memory 26. Thus, all data moved between the central processing unit 20 and the cache memory 26 passes through circuit 22. Here, circuit 22 comprises: an input / output port 70 connected to the end of bus 60 opposite interface 42, and an input / output port 72 connected to an internal bus 74 whose other end is connected to cache memory 26.

[0037] The size of bus 74 is identical to the size of bus 60.

[0038] Circuit 22 includes, in particular, a masking module 76 and a demasking module 78. Module 76 receives, via port 70, the data Dj to be masked, then masks this data to obtain a masked data DjM ...

[0039] Module 78 receives, via port 72, a masked data D j M< placed on bus 74 by cache memory 26. In response, module 78 unmasks this masked data D j M< and places the unmasked data D j on bus 60.

[0040] Although represented in the figure 1 in the form of two distinct blocks, modules 76 and 78 include common circuits and in particular a common circuit to construct the mask M j from the initialization vector iv j.

[0041] The protection circuit 24 is interposed between the central processing unit 20 and the cache memory 28, and more specifically, between the loader 42 and the cache memory 28. Thus, any instruction moved from the cache memory 28 to queue 48 first passes through circuit 24. Here, circuit 24 comprises: an input / output port 80 connected to the end of bus 62 opposite the charger 44, and an input / output port 82 connected to an internal bus 84 whose other end is connected to the cache memory 28.

[0042] The size of bus 84 is identical to the size of bus 62.

[0043] Circuit 24 includes a demasking module 88 identical to the demasking module 78.

[0044] The protection circuit 32 is interposed between port 66 of the cryptographic circuit 34 and the cache memory 30. For this purpose, it comprises: an input / output port 90 connected to the end of an internal bus 92, the other end of which is connected to port 66 of the cryptographic circuit 34, and an input / output port 94 connected to the end of an internal bus 98, the other end of which is connected to the cache memory 30.

[0045] The size of buses 92 and 98 is equal to the size T w.

[0046] The circuit 32 includes a masking module 106 and a demasking module 108 identical, respectively, to the masking module 76 and the demasking module 78.

[0047] On the figure 1 , the internal buses which connect cache memory 30 to cache memories 26 and 28 bear the references 110 and 112 respectively.

[0048] The operation of calculator 1 will now be described with reference to the figure 2 Subsequently, only the steps that protect system 2 against side-channel attacks are described in detail. Otherwise, computer 1 operates normally.

[0049] In particular, the words Wj are moved between storage 10 and caches 26, 28, and 30 in such a way as to maximize the probability that the next word Wj to be loaded by the CPU 20 is already in cache 26 or 28 before the loading of that word Wj is triggered by the execution of a load instruction by the Arithmetic and Logic Unit 50. This speeds up the loading of that data or instruction. If the word Wj cannot be found in cache 26 or 28, the probability that it is in cache 30 is also maximized, again to speed up the loading of that word Wj to the CPU 20. In other words, cache management is organized to minimize the occurrence of a cache miss. A cache miss is more commonly known by the English term " Hide and Seek MissNumerous mechanisms for managing caches 26, 28, and 30 are known. Furthermore, the protection method described below works regardless of the cache management mechanism implemented. Therefore, this particular mechanism for managing caches 26, 28, and 30 is not described in detail.

[0050] Similarly, the recording of encrypted data and instructions on medium 10 works in a known way and is therefore not described in detail.

[0051] Finally, and also in a way that is well known in itself, during the execution of a process, an identifier for that process is generated. This process identifier makes it possible to uniquely identify the process to be executed among the different processes that can be executed by computer 1. Such a process identifier is known by the acronym ASID ( "Address Space Identifier" ) .This process identifier is subsequently called the "ASID". The ASID is typically used to prevent a process from accessing data pages reserved for another process. This ASID is located within a range of bits in the address of the data Dj to be moved between the memory locations of computer 1.

[0052] Initially, during phase 120, a secret key kp is stored in the protection circuits 22, 24, and 32. For example, the key kp is loaded each time the execution of a new process is triggered. Thus, here, the key kp varies depending on the process to be executed. In this example, the size of the key kp is 128 bits.

[0053] Next, during phase 130, the central processing unit 20 executes a process, and for this purpose, instructions and data are moved between the support 10 and the cache memories 26, 28, and 30 and the central processing unit 20. Typically, the loader 44 loads the instructions of the process to be executed one after the other into the queue 48, and then the arithmetic and logic unit 50 executes the instructions loaded into this queue 48. To load an instruction, the loader 44 places the address contained in the program counter 46 onto an address bus. In response, if the instruction to be loaded is already in the cache memory 28, it is immediately placed on the bus 82. Conversely, if the instruction to be loaded is not in the cache memory 28, it is moved to the cache memory 28 before being placed on the bus 84. In this latter case: If the instruction to be loaded is in cache memory 30, it is moved from cache memory 30 to cache memory 28 via bus 112, or if the instruction to be loaded is not in cache memory 30 either, it is successively moved from support 10 to cache memory 30 via bus 6, cryptographic circuit 34 and internal buses 92 and 98, then from cache memory 30 to cache memory 28 via bus 112.

[0054] During its passage through the cryptographic circuit 34, the cryptogram I m * of the instruction I m to be loaded is decrypted, then the plaintext instruction I m is transmitted and placed on bus 92. The index m is an identifier of the instruction I m. Thus, before the cryptographic circuit 34, the instructions are encrypted, while after the cryptographic circuit 34, the instructions are in plaintext.

[0055] In this example, instructions are never moved from the central processing unit 20 to the cache memories 28, 30 and to the support 10.

[0056] If the instruction executed by the central processing unit 20 is a data loading instruction D j, the address @ j of the data D j to be loaded is placed on an address bus. In response, if the data to be loaded is already in cache memory 26, it is immediately placed on bus 74. Conversely, if the data D j to be loaded is not already in cache memory 26, it is moved to cache memory 26 before being placed on bus 74. In this case, as previously described for an instruction I m, there are two possible scenarios depending on whether the data to be loaded is already in cache memory 30 or not.

[0057] If the instruction executed by the central processing unit 20 is an instruction to write data D j to storage 10, the address @ j where this data is to be written is placed on the address bus and the data D j is placed on the bus 60. Typically, the data D j is then first stored in cache memory 26. Next, the cache management mechanism selects, according to predefined rules, the data from cache memory 26 to be moved to cache memory 30 and the data from cache memory 30 to be moved to storage 10. When data is moved from cache memory 26 to cache memory 30, it travels via the internal bus 110. When data is moved from cache memory 30 to storage 10, it travels via the bus 6.

[0058] When a data D j is moved from cache memory 30 to storage 10, it passes through the cryptographic circuit 34. During this passage, the data D j is encrypted and its cryptogram D j* is incorporated into a line LD j. Then, the line LD j is recorded in storage 10 at address @ j.

[0059] In parallel, during a phase 140, circuits 22, 24 and 32 protect the data and instructions moved on the internal buses of system 2 against side-channel attacks.

[0060] To do this, during a step 142, module 76 masks each data D j moved from central unit 20 to cache memory 26. For this purpose, it constructs a new mask M j whose size TM, in number of bits, is equal to the size TD of the data D j.

[0061] More precisely, during operation 144, module 76 generates a new initialization vector iv j. For example, here, the initialization vector iv j is randomly generated. The size T iv of this initialization vector iv j is half the size TD of the data D j to be masked, and preferably eight or sixteen times smaller than the size TD. Here, as previously stated, in this embodiment, the size T iv is equal to 8 bits.

[0062] Next, during operation 146, module 76 produces the new mask Mj from the generated vector ivj. To ensure that the statistical distribution of the values ​​in the produced mask Mj closely approximates the statistical distribution of a uniform law, the mask Mj is further generated from information that varies depending on the process being executed, the value of the data Dj, and / or the address @j of the data Dj. Here, the mask Mj is also generated from: of the key kp, the address @ j of the data D j, and the ASID identifier.

[0063] The address @j and the ASID identifier are obtained from the memory management unit, better known by the acronym MMU ( "Management Memory Unit" ) . The kp key is pre-registered in the protection circuit 22.

[0064] Here, to produce the new mask Mj, a 257-bit block, called the "S" state, is first constructed from the values ​​of the vector ivj, the key kp, the address @j, and the ASID. For example, the bits of the key kp, the vector ivj, the address @j, and the ASID are concatenated to obtain a first block of bits. This first block of bits is augmented by a constant pre-recorded in each of the protection circuits to obtain a second 257-bit block. Finally, the bits of this second block are swapped by implementing a predefined permutation to obtain the S state. This permutation is hard-hardened and therefore executes in a single clock cycle. For example, this hard-hardened permutation is identical to one of the permutations of the DES encryption / decryption algorithm ( "Data Encryption Standard" ) .

[0065] Next, a cryptographic function Fc is applied to state S to maximize the entropy of the resulting mask Mj. Applying the function Fc to state S produces a state SD with higher entropy than state S. State SD is also a 257-bit block.

[0066] To this end, the function F c is designed to propagate a one-bit change in state S. In other words, changing the value of a single bit in state S results in a change in several bits of state SD. For this purpose, the function F c comprises a permutation function p() and a substitution function s(). The function p() swaps bits in state S and, preferably, swaps at least 50% or 60% of the bits in state S. The function s() replaces at least 50% or 70% of the bits in state S with other bits. For example, the function s() includes a pre-recorded lookup table ( "lookup table"(in English) which associates each initial series of m bits with a different series of m bits. The function F c used in this embodiment is represented on the figure 3 On this figure, the symbol " I " Next to a number indicates the size of the data bus crossed out by the symbol " I Thus, the symbol I " next to the number "128" means that the size of the bus crossed by this symbol is equal to 128 bits.

[0067] On the figure 3The state S is represented by a rectangle containing the letter S. The function F c has a first round R 1 which receives the state S as input and generates an intermediate state S 1 as output. The state S 1 is a 257-bit block. The round R 1 is a hardware circuit that performs, among other things, permutations and substitutions of the bits of the state S to obtain the state S 1. For example, here, the round R 1 is identical to a round of the "Subterranean 2.0" cipher algorithm described in the article: J. Daemnen et al.: "The Subterranean 2.0 Cipher Suite", version of March 29, 2019. In particular, the figure 3 This article describes a hardware circuit for implementing this round R1. Round R1 has one input that receives the state S and another input that receives a 33-bit block σ. The block σ is, for example, a predetermined and constant 33-bit block.

[0068] Next, the function Fc includes an absorption circuit "A" that substitutes 128 predetermined bits of the intermediate state S1 with the 128 bits of a data_in block to obtain a new intermediate state S2. In this example implementation, the data_in block is constructed, by applying a predetermined algorithm, from the vector ivj and the address @j before executing the function Fc. For example, the positions of the 128 bits of state S1 to be replaced by the 128 bits of the data_in block are defined by the following relation: POSi = 124k+p < mod(257), where: POS i is the position in block S 1 of the bit to be replaced, i is an integer that varies from 0 to 127, if the index i belongs to the interval [0; 31], p = 0 and k = i, if the index i belongs to the interval [32; 63], p=1 and k= i-32, if the index i belongs to the interval [64; 95], p=2 and k = i-64, and if the index i belongs to the interval [96; 127], p = 3 and k = i-96, the function mod(257) is the modulo function, that is to say the function which returns the remainder of the Euclidean division of 12 4k+p< by 257.

[0069] The bits of the intermediate state S2 are then provided as input to a new round R2 which outputs the state SD. Here, round R2 is identical to round R1.

[0070] After applying the function F c to state S to obtain state SD, the mask M j is obtained by extracting 128 bits, located at predetermined positions, from state SD. The circuit that performs this extraction is designated by the letter E in the figure 3 The circuit E constructs the value of the bit Zi located at position i in the mask Mj using the following relation: Zi = s12(4k+p) + s-12(4k+p), where: the index i varies from 0 to 63, s 12(4k+p) is the value of the bit located at position 12 4k+p< mod(257) in the SD state , s -12(4k+p) is the value of the bit located at position -12 4k+p< mod(257) in the SD state , if the index i belongs to the interval [0; 31], p = 0 and k = i , if the index i belongs to the interval [32; 63], p = 1 and k = i-32, and the symbol "+" denotes the logical operation "OR".

[0071] Once the new mask Mj is constructed, during operation 148, module 76 masks the data Dj with the mask Mj to obtain the masked data DjM<. This operation is defined by the following relation: DjM ... "or exclusive".

[0072] During operation 150, module 76 stores the masked data DjM< in cache memory 26. During this operation, the vector ivj used to construct the mask Mj is also stored in cache memory 26 in association with the masked data DjM. To do this, module 76 generates the word Wj, which contains the masked data DjM in range PD and the vector ivj in range PC. Thus, the word Wj stored in cache memory 26 contains, in addition to the masked data DjM,, the vector ivj. The plaintext data Dj is not stored in memory 26. The mask Mj is also not stored in cache memory 26.

[0073] If, subsequently, the word Wj is moved by the cache management mechanism from cache memory 26 to cache memory 30, then, during step 154, the word Wj stored in cache memory 26 is placed on bus 110. Since this word Wj contains only the masked data DjM ...

[0074] If subsequently, the word W j is moved by the cache memory management mechanism from cache memory 30 to support 10, then the word W j passes successively through the unmasking module 108 and the cryptographic circuit 34.

[0075] During step 160, module 108 unmasks the masked data D jm< before transmitting it to the cryptographic circuit 34.

[0076] For this, during an operation 162, module 108 extracts the vector iv j from the range PC of the word W j.

[0077] Then, during operation 164, module 108 reconstructs the mask M j from: of the key kp, the extracted vector iv j, the address @ j of the data D j, and the ASID identifier.

[0078] Operation 164 is identical to operation 146 except that it is executed by module 108. In particular, the same function F c is used during operation 164.

[0079] Once the mask Mj is reconstructed, during operation 166, module 108 unmasks the masked data DjMi. This operation is defined by the following relation: D j = D j M COR M j .

[0080] During operation 168, module 108 generates a new word W j and places it on bus 92 to transmit it to the cryptographic circuit 34. This new word W j contains the data D j unmasked in the range PD. At this stage, for example, this new word W j does not contain the vector iv j.

[0081] In step 170, the cryptographic circuit 34 encrypts the data D j contained in the received word W j. For example, here, it constructs a data line LD j containing the cryptogram D j * of the data D j.

[0082] During step 172, once the LD j line is built, the cryptographic circuit 34 moves it to the support 10 via the bus 6.

[0083] During step 174, the LD j line is recorded on support 10.

[0084] Conversely, the cache memory management mechanism triggers the movement of a data D j from support 10 to cache memory 30. In this case, during a step 180, the line LD j is transferred, via bus 6, from support 10 to cryptographic circuit 34.

[0085] During step 182, the cryptographic circuit 34 deciphers the cryptogram D j * contained in the line LD j to obtain the data D j in plaintext.

[0086] Then, in step 184, the plaintext data D j is moved from the cryptographic circuit 34 to the protection circuit 32.

[0087] In step 186, the masking module 106 masks the data D j using a new mask M j to obtain the new masked data D j M< . This step 186 is identical to step 142 except that operation 150 is replaced by an operation 188 of recording the word W j containing the masked data D j M< in cache memory 30 and not in cache memory 26.

[0088] Since the word W j contains only the masked data D j M< , when this word W j is moved, via bus 110 from cache memory 30 to cache memory 26, only the masked data D j M< is transmitted on this bus 110. In addition, the vector iv j is also moved at the same time from cache memory 30 to cache memory 26. Therefore, the word W j stored in cache memory 26 contains both the masked data D j M< and the vector iv j which allows the mask M j to be reconstructed.

[0089] In response to the execution by the arithmetic and logic unit 50 of an instruction to read the data Dj, during step 190, module 78 unmasks the hidden data DjM< contained in the word Wj stored in cache memory 26. To do this, module 78 uses the vector ivj contained in the same word Wj as the one containing the hidden data DjM. This step 190 is identical to step 160 except that operation 168 is replaced by an operation 192 during which the word Wj containing the plaintext data Dj is placed on the bus 60 for transmission to the central processing unit 20.

[0090] The movement of an instruction Im from storage 10 to the central processing unit 20 proceeds as described for a data Dj. It is possible to distinguish a word Wm containing the instruction Im from a word Wj containing data based on the address @m of the instruction Im. For example, the address @m contains a bit that indicates that the word Wm contains an instruction. This bit is generated by the memory management unit.

[0091] There figure 5 represents an embodiment of a data protection method in which the data does not appear in plain text on buses 60 and 92. This method is identical to the method of the figure 2 with the following exceptions.

[0092] When moving data D j from cache memory 30 to storage 10, the order of unmasking step 160 and encryption step 170 is reversed. Thus, data D j does not appear in plain text on bus 92. To achieve this, the positions of circuits 32 and 34 are swapped compared to what is shown on the diagram. figure 1In this case, the masked data DjM< is first encrypted by the cryptographic circuit 34 to obtain a masked and encrypted data DjM<*. The word Wj, containing the masked and encrypted data DjM ... exclusive".This is why executing the encryption operation first and then the unmasking operation achieves the same result as executing the unmasking operation first and then the encryption operation.

[0093] Similarly, to prevent the data D j from being transmitted in clear text on bus 60, step 190 is replaced by a step 200 and step 142 is replaced by a step 202.

[0094] Step 200 is identical to step 190 except that unmasking operation 166 is omitted and operation 192 is replaced by operation 204. During operation 204, the masked data D j M< and the reconstructed mask M j are both transmitted to central unit 20.

[0095] Next, during phase 130, the central processing unit 20 performs a process on the masked data D j M< to obtain a processed masked data D j Mt<. This process is the result of the execution of one or more instructions loaded by the loader 44, which modify the masked data D j M<. In parallel, during phase 130, the central processing unit 20 performs the same process on the reconstructed mask M j to obtain a processed mask M jt<.

[0096] In step 202, the central processing unit 20 moves the masked and processed data DjMt< and the processed mask Mjt< into the cache memory 26. It is noted that the mask Mjt< cannot be reconstructed from a vector ivj as was the case for the mask Mj before processing. Therefore, it is not possible to directly store in the cache memory 26 the masked and processed data DjMt< associated with an initialization vector that allows the reconstruction of the mask Mjt<. To circumvent this difficulty, step 202 is identical to step 142 except that an additional unmasking operation 206 is introduced between operations 148 and 150.

[0097] Here, during step 202, module 76 first executes operations 144, 146, and 148 to mask the masked and processed data DjMtj with a new mask Mj constructed using a newly generated vector ivj. A doubly masked data DjMt,Mt is then obtained after operation 148.

[0098] During operation 206, module 76 unmasks the doubly masked data D j Mt,M< with the mask M jt< and obtains the masked data D j M<. Then, operation 150 is executed to store the masked data D j M< and the vector iv j in cache memory 26. Chapter II: Variants: Variants in the production of the M mask :

[0099] Other embodiments are possible for producing the new mask Mj from the vector ivj. For example, the state S can be established differently. In particular, the state S can be established using the vector ivj, the key kp, and only a part or none of the data chosen from the constituted group: of the ASID identifier, of the @j address of the data.

[0100] In another embodiment, if each data point D j is associated with an error-detecting or error-correcting code, the value of this code can be integrated into the state S. Similarly, if the data point D j is associated with a message authentication code better known by the acronym MAC ( "Authentication Code Message" ), at least part of this MAC code is integrated into the S state.

[0101] In another variant, only part of the address @j or only part of the ASID identifier is taken into account when producing the new mask Mj.

[0102] Alternatively, the kp key is not process-specific. For example, this kp key is common to several processes or to all processes that can be executed by system 2.

[0103] In a very simplified variant, the key kp is omitted and is not used to construct the new mask M j.

[0104] In another variant, the previously described method is implemented concurrently with a pointer misuse protection method. For example, this pointer misuse protection method is that described in US20210004456A1. As explained in detail in US20210004456A1, an IP pointer identifier j is associated with a data item D j when it is manipulated using a pointer. For example, this IP identifier j is embedded in the PC range of each word W j containing a data item D j manipulated by a pointer. In this case, this IP identifier j can be used to construct the new mask M j. For example, this IP identifier j is embedded in the state S.

[0105] In another simplified variant, the bit permutation to obtain the S state can be omitted or be different from that defined in the DES encryption algorithm.

[0106] In the function F c, the substitution function s() can be implemented differently. For example, instead of using a predefined lookup table, the series of m bits to be substituted by another series of m bits is calculated rather than pre-recorded.

[0107] The data_in block can be constructed differently. For example, it can be constructed from one or more of the following: the ASID identifier, the kp key, the @j address of the data D j, the iv vector j, or any other metadata associated with the data D j, such as an IP pointer identifier j. Conversely, in a very simplified variant, the data_in block is a constant.

[0108] When the data_in block is constructed from the vector iv j, it is not necessary to construct the state S from the vector iv j. Conversely, when the state S is constructed from the vector iv j, then it is not necessary to construct the data_in block from this vector iv j.

[0109] Other implementations of the cryptographic function F c are possible. For example, in variants, the function F c is a modified version of the AES encryption algorithm ( “Advance Encryption Standard” ). In this modified version, the number of rounds (= "round" (in English) executed is only equal to two or three and therefore much less than the number of rounds usually executed when implementing such a cipher algorithm.

[0110] The function Fc does not need to be an invertible function. Thus, in alternative terms, the function Fc is a hash function. In this case, the number of bits in the SD state can be less than the number of bits in the S state. Variants of vector generation iv j :

[0111] The vector iv j can be generated differently. For example, in a simplified embodiment, a counter is incremented by a predetermined step each time a new vector iv j needs to be generated. The size of this counter is equal to the size T iv. When the maximum value of this counter is reached, its value automatically resets to zero. The value of the new vector iv j is then constructed from the incremented value of this counter. For example, the value of the new vector iv j is equal to the value of this counter.

[0112] The vector iv j can also be generated by performing a random permutation or random substitution of one or more bits of a counter. The vector iv j can also be generated by performing right or left shifts of the bits of this counter.

[0113] The vector iv j can also be taken to be equal to a predetermined selection of bits from one or more of the metadata MC j contained in the PC range. For example, in one embodiment, the PC range contains an integrity label AND j that allows verification of the integrity of the data D j. Such an integrity label is, for example, an error-correcting code or an error-detecting code. In a more complex variant, the AND j label can also be an authentication code such as a MAC (Message Authentication Code). The vector iv j is then equal to a predetermined selection of bits from the AND j label. In this case, the bits of the vector iv j are used to perform two different functions, namely, to produce the mask M j and to verify the integrity of the data D j. This embodiment is advantageous in that it avoids storing the vector iv j and the AND j label separately in the PC range.

[0114] In another variant, if the data line LD j stored in medium 10 contains additional information besides the data cryptogram D j, then the vector iv j can be generated by selecting, in a predetermined way, a subset of the bits of this additional information. For example, if the process of application US20210004456A1 is implemented to construct the line LD j, this line LD j also contains a MAC authentication code j. The vector iv j can then be constructed from a subset of the bits of this MAC code j.

[0115] The vector iv j can also be generated from a part of the bits of the cryptogram D j * of the data D j recorded on the medium 10.

[0116] Module 76 can also generate the vector iv j from the vector iv j-1 used to unmask the last data D j-1 moved from cache memory 26 to central processing unit 20. Variations in the computer architecture:

[0117] Alternatively, the protection circuit 32 is omitted. In this case, the data written by the central unit 20 onto the medium 10 remains masked, even when it is transmitted over the bus 6. In this case, the cryptographic circuit 34 can also be omitted since the data recorded on the medium 10 is masked and therefore already protected.

[0118] Alternatively, the instructions are not hidden within system 2. In this case, the protection circuit 24 is omitted. Thus, in the simplest embodiment, system 2 only includes the protection circuit 22, and the cryptographic circuit 34 is also omitted.

[0119] Other embodiments of the cryptographic module 34 are possible. In particular, other encryption / decryption methods can be implemented.

[0120] Storage location 10 can be any memory higher than the internal first-level caches. Alternatively, storage location 10 can be a lower-level memory such as an L3 or L2 cache. In this case, the protection circuits and the cryptographic circuitry are located upstream of this lower-level memory.

[0121] The number of cache levels can be less than two. In this case, cache level 30 is omitted. The number of cache levels can also be greater than two. For example, an L3 cache can be added.

[0122] Cache memories higher than the L1 level cache memory can be external cache memories implemented outside of the system 2.

[0123] The internal cache memory is not necessarily the lowest-level cache memory, i.e., here the L1 level cache memory. For example, in alternative configurations, the internal cache memory is the L2 level cache memory. In this case, the protection circuits 22 and 24 are interposed between the cache memories 26 and 28 and the cache memory 30. Other variations:

[0124] In alternative versions, each word Wj additionally includes a bit range PM intended to hold metadata MPj that can be masked. For example, this metadata MPj includes an error-correcting code that corrects an error in the data Dj. In this case, the size of the word Wj is equal to the sum of the sizes TD + TMC + TMP, where the sizes TMC and TMP are the sizes of the metadata MCj and MPj, respectively. In this alternative version, the protection circuits are configured to generate a mask Mj whose size allows both the data Dj and the metadata MPj to be masked / unmasked. Thus, in this embodiment, the size TM of the mask Mj is equal to the sum of the sizes TD and TMP. Therefore, in such an embodiment, the metadata MPj is also protected against side-channel attacks in the same way as the data Dj.To obtain a larger mask M j, it suffices, for example, to increase the number of bits extracted from the SD state.

[0125] Several of the variants described above can be combined in the same embodiment. Chapter III: Advantages of the described embodiments:

[0126] Masking the data transmitted on the internal bus of system 2 makes side-channel attacks more difficult because the data is masked, and the mask Mj needed to unmask it cannot be easily reconstructed from only the vector ivj. Furthermore, this mask Mj changes each time the data Dj is loaded into the system 2 caches for the first time. Storing only the vector ivj used to reconstruct the mask Mj in the internal caches, rather than the complete mask Mj, limits the memory space required to store this mask. Thus, the memory space needed to implement this method remains limited.

[0127] Generating the new mask Mj from the address @j of the data Dj to be masked or unmasked increases the variability of the generated masks. This therefore improves protection against side-channel attacks.

[0128] Generating the new mask M j from values ​​of the ASID identifier and / or metadata MP j increases the variability of the mask M j and thus improves protection against side-channel attacks.

[0129] Unmasking the hidden data D j M< just before saving it to storage 10 and then encrypting it limits the memory space used. Indeed, in such a case, it is not necessary to save the vector iv j to storage 10.

[0130] The fact that the data D j is processed by the central processing unit 20 in a masked form increases security because even within this central processing unit 20, the data is protected. Furthermore, this makes side-channel attacks more difficult because the data is masked even on bus 60.

[0131] Unmasking the hidden data DjM< is only possible in response to its reading from cache memory 26 by the central processing unit 20. This allows, using only the protection circuit 22, the written data to be protected against side-channel attacks and ensures the confidentiality of this data when it is subsequently moved to higher-level memories. Indeed, regardless of the higher-level memory location, in such a case, without unmasking, the data is stored there in a masked form.

[0132] Using the composition of at least one permutation p() and at least one substitution s() to generate the mask M j maximizes the entropy of this mask and thus makes side-channel attacks more difficult.

Claims

1. Method for protecting, against side-channel attacks, an electronic computer comprising: - a data storage medium, - a system-on-chip comprising: - an internal cache memory divided into a plurality of words, - a central processing unit able to write a datum to a word of the internal cache memory, - an internal data bus through which transit words moved between the internal cache memory and the data storage medium, the size of this bus being equal to the size of one word of the internal cache memory, this method comprising the following steps: a) protecting (140) a datum contained in a word transiting, through the internal bus, between the internal cache memory and the data storage medium, by executing, for each datum written to the internal cache memory by the central processing unit, the following operations: - operation A): constructing a new mask the size of which, in number of bits, is equal to the number of bits of the datum to be written, then - operation B): masking (148) the datum to be written using the constructed new mask, to obtain a masked datum, then - operation C): storing (150) the masked datum, and not the unmasked datum to be written, in a word of the internal cache memory, then - operation D): when this datum must be moved to the data storage medium, depositing (154), on the internal bus, the complete word containing the masked datum, b) unmasking (160, 190) the masked datum contained in a word, characterized in that: - operation A) of constructing a new mask comprises: - generating (144) a new initialization vector the size of which, in number of bits, is two times smaller than the number of bits of the new datum to be written, then - producing (146) the new mask using the generated new initialization vector and using a secret key and by executing a cryptographic function, - operation C) of storing (150) the masked datum in a word of the internal cache memory comprises storing, in the same word of the internal cache memory, the initialization vector by means of which this masked datum was obtained, and not storing, in the internal cache memory, the produced complete new mask, - unmasking step b) comprises the following operations: - operation E): extracting (162) the initialization vector contained in the word, - operation F): reconstructing (164) the mask the size of which, in number of bits, is equal to the number of bits of the datum to be unmasked using the extracted initialization vector and using the secret key and by executing the same cryptographic function as that used in operation A), then - operation G): unmasking (166) the masked datum using the new mask thus reconstructed, to obtain the unmasked datum.

2. Method according to Claim 1, wherein, in operation A), the new mask is produced (146), in addition, using at least one portion of the physical address of the datum to be written.

3. Method according to either one of the preceding claims, wherein, in operation A), the new mask is produced (146), in addition, using one or more values belonging to the group consisting: - of a value that varies depending on the process in course of execution by the system-on-chip, - of a metadatum contained in the same word as the word that contains the datum to be masked, this metadatum being contained in a range of bits that is distinct from the range of bits of this word containing the datum to be masked, and - of a value coded by bits associated with the address of the datum to be masked, these bits being different from the bits coding the address of the datum to be masked.

4. Method according to any one of the preceding claims, wherein the method comprises: - just before storage of a datum on the data storage medium: - executing step b) (160) to unmask the masked datum contained in the word that has transited through the internal data bus and to obtain thus an unmasked datum, and - encrypting (170) the unmasked datum, to obtain an encrypted datum, then - storing (174), on the data storage medium, this encrypted datum without storing, on this medium, the initialization vector used to unmask this datum, then subsequently - after the encrypted datum has been loaded from the data storage medium and before this datum is moved through the internal data bus: - decrypting (182) the encrypted datum stored on the data storage medium, to obtain a decrypted datum, and - masking (186) the decrypted datum, this masking comprising: - generating (144) a new initialization vector the size of which, in number of bits, is two times smaller than the number of bits of the decrypted datum, then - producing (146) a new mask using the generated new initialization vector, and using the same secret key and by executing the same cryptographic function as those used in step a), then - masking (148) the decrypted datum using the produced new mask, to obtain a masked datum, then - moving, through the internal data bus, a word containing the masked datum and the initialization vector by means of which this masked datum was obtained, then - storing, in the internal cache memory, this moved word containing the masked datum and the initialization vector by means of which this masked datum was obtained.

5. Method according to any one of the preceding claims, wherein the method comprises: - read-out, by the central processing unit, of a datum in a word of the internal cache memory, and - in response to this read-out by the central processing unit: - reconstruction (164) of the mask the size of which, in number of bits, is equal to the number of bits of the datum to be unmasked using the initialization vector contained in the word and using the secret key and by executing the same cryptographic function, then - transmission (204) of the masked datum and of the produced mask to the central processing unit, then - execution (130), by the central processing unit, of a processing operation on the masked datum to obtain a processed masked datum and of the same processing operation on the reconstructed mask to obtain a processed mask, then - execution of protecting step a) on the processed datum, this involving execution, in addition, between operations B) and C), of an operation (206) of unmasking, using the processed mask, the doubly masked processed datum obtained at the end of operation B), to obtain the masked datum stored in operation C).

6. Method according to any one of Claims 1 to 3, wherein the method comprises: - read-out, by the central processing unit, of a datum in a word of the internal cache memory, and - solely in response to this read-out by the central processing unit: - execution of step b) (190) to unmask the masked datum contained in this word, then - transmission of the obtained unmasked datum to the central processing unit.

7. Method according to any one of the preceding claims, wherein the cryptographic function comprises a permutation function and a substitution function.

8. Method according to any one of the preceding claims, wherein operation B) of masking a datum and operation G) of unmasking a masked datum each consist in performing an "Exclusive OR" operation between the datum and the produced mask.

9. Electronic computer for implementing a method according to any one of the preceding claims, this electronic computer comprising: - a data storage medium (10), - a system-on-chip (2) comprising: - an internal cache memory (26, 30) divided into a plurality of words, - a central processing unit (50) able to write a datum to a word of the internal cache memory, - an internal data bus (110) through which transit words moved between the internal cache memory and the data storage medium, the size of this bus being equal to the size of one word of the internal cache memory, - a first hardware module (76) for masking a datum contained in a word transiting, through the internal bus, between the internal cache memory and the data storage medium, this first masking hardware module (76) being configured to execute, for each datum written to the internal cache memory by the central processing unit, the following operations: - operation A): constructing a new mask the size of which, in number of bits, is equal to the number of bits of the datum to be written, then - operation B): masking the datum to be written using the constructed new mask, to obtain a masked datum, then - operation C): storing the masked datum, and not the unmasked datum to be written, in a word of the internal cache memory, then - a first unmasking hardware module (78) able to unmask the masked datum contained in a word, wherein the internal cache memory is configured to, when a datum must be moved to the data storage medium, deposit, on the internal bus, the complete word containing the masked datum, characterized in that: - operation A) of constructing a new mask comprises: - generating a new initialization vector the size of which, in number of bits, is two times smaller than the number of bits of the new datum to be written, then - producing the new mask using the generated new initialization vector and using a secret key and by executing a cryptographic function, - operation C) of storing the masked datum in a word of the internal cache memory comprises storing, in the same word of the internal cache memory, the initialization vector by means of which this masked datum was obtained, and not storing, in the internal cache memory, the produced complete new mask, - the first unmasking hardware module (78) is configured to execute the following operations: - operation E): extracting the initialization vector contained in the word, - operation F): reconstructing the mask the size of which, in number of bits, is equal to the number of bits of the datum to be unmasked using the extracted initialization vector and using the secret key and by executing the same cryptographic function as that used in operation A), then - operation G): unmasking the masked datum using the new mask thus reconstructed, to obtain the unmasked datum.

10. Computer according to Claim 9, wherein the first masking hardware module (76) and the first unmasking hardware module (78) are interposed between the central processing unit (50) and the internal cache memory (26) in order to mask each datum written by the central processing unit to the internal cache memory and to unmask each datum read from the internal cache memory by the central processing unit.

11. Computer according to Claim 10, wherein the computer comprises a second masking hardware module (106) and a second unmasking hardware module (108) that are interposed between the data storage medium and the internal bus (110), the second unmasking hardware module (108) being able to unmask each datum before it is stored in the data storage medium and the second masking hardware module (106) being able to mask each datum read from the data storage medium before it is deposited on the internal bus.