Configurable protection levels against side-channel analysis for processing units

Abstract

Various embodiments of the present disclosure provide a method for managing side-channel emissions of a processing unit based on varying protection levels. Software modules, or sets of instructions to be executed, can come with protection parameter and an urgency parameter that indicate a privacy or level of protection to be used with the software module, and an indication of how urgent the software module is. If a processing unit that executes the software module does not emit enough side channel noise, and the software module is not urgent, the processing unit can wait to execute the software module until the level of protection is met. Alternatively, the processing unit can transfer the software module. Also alternatively, if there is no other processing unit, and the software module is urgent, countermeasure side channel noise can be activated to obscure the side channel emissions of the software module.

Description

CONFIGURABLE PROTECTION LEVELS AGAINST SIDE-CHANNEL ANAL YSIS FOR PROCESSING UNITSTechnical Field

[0001] The present disclosure relates to a method for managing side-channel emissions of a processing unit based on varying protection levels in a computing system.BackgroundSide-Channel Analysis (SCA)

[0002] Side-channel leakage / emission is defined as a non-intended information channel from a device. The side-channel can consist of e.g., power consumption, electromagnetic (EM) emissions, timing, thermal signatures, sound and optical emissions. An attacker can utilize these leakages to extract sensitive information from a device, e.g., to extract a key utilized to encrypt information, or to extract weights of deep-learning models which are run on the device in order to clone them, or to deduce information about the (possibly confidential) training data which was used to train them. While the former is an acute problem at present, the latter might become an issue in the future, when Artificial Intelligence (Al) algorithms will be a natural part of many systems.

[0003] Side-channel attacks work because there can be a correlation between the physical measurements (power consumption, EM emissions, timing, etc.) taken at different points during the computation and the internal state of the processing device. For example, the power consumption can be correlated to the Hamming weight (number of binary ' 1 's) of the current state, or to the Hamming distance between the current and the previous state of the device. Finding this correlation enables the sidechannel attacks to deduce the internal state and then extract the related sensitive information, e.g., the secret key of a crypto algorithm.

[0004] Side-channel attacks can be several orders of magnitude more effective at extracting secrets than the conventional mathematical cryptanalysis and much more practical to mount. They do not require expensive equipment, like invasive physical attacks. Furthermore, with advances in machine learning, more powerful side-channel attacks have emerged. Since machine learning techniques are good at findingcorrelations in raw data, they enable the adversary to bypass many existing countermeasures and break some protected implementations.

[0005] In the past years, many types of side channels have been successfully exploited to break physical implementations of many cryptosystems. Examples include implementations of cryptographic algorithms such as Advanced Encryption Standard (AES) and Post-Quantum Cryptography (PQC)-candidates Saber & Kyber. There have also been reports where side-channel attacks were used to steal intellectual property and reverse-engineer neural networks.

[0006] As it stands today, it often comes down to the software developer to protect software against side-channel leakage. Many contemporary solutions are either only suitable for certain processes or requires the software developer to actively know how to implement the software in a side-channel protected manner.

[0007] The software developer may not have the knowledge to protect against leakage but probably knows what parts of the code handles sensitive data. The hardware designer may have more knowledge on how to protect against leakage but, as it stands today, does not know when the protection is needed.

[0008] Some early attempts have been made to simplify this for the software developer. I.e., instead of requiring the software developer to implement this protection, we suggest that he or she simply mark the sensitive sections in the code and let the hardware designer worry about how the protection should be carried out.CPU and other Processing Units

[0009] The first Central Processing Units (CPU)s were so-called scalar processors that could execute at most one single instruction at once. To improve performance, concepts such as pipelining and so-called superscalar processors appeared commercially in the late 80's. These introduce parallelism in different manners, modern CPUs typically incorporate both techniques. At a high level of abstraction, they partition instruction execution into a few discrete steps:• Fetch (get the instruction from the instruction queue),• Decode (translate the instruction into operations executed by one or multiple processing elements)• Execute (perform the operations in the processing element)• Retire / Write-Back (store the result of the operations performed in the processing elements)

[0010] Each instruction would travel through these steps and the pipelined approach meant that each step would be occupied by a separate instruction.

[0011] Modern processors are much more complex and include both additional steps, parallelism within each step, different processing elements a.k.a. execution units (such as Arithmetic Logic Unit (ALU), Advanced Vector Extensions (AVX), Address Generation Unit (AGU), Load-store units, Floating Point Unit (FPU), etc.) but the concept of fetching, decoding, executing and retiring is very much alive in modern CPU's.

[0012] Every step is now parallelized, so several instructions can be decoded at once in parallel decoder. An instruction may contain several sub-steps, and therefore the instruction may be decoded into several operations, sometimes denoted as microoperations (micro-ops). Each of these defines specific operations to be executed in a certain type of processing element. Another improvement is the so-called Out-of-Order execution, i.e., that instructions may "cut-in-line" if a previous instruction is waiting for data necessary to continue.

[0013] The execution order is determined by a scheduler which, depending on the architecture used is either one central component (sometimes called a unified scheduler), several semi -centralized components; each controlling several groups of processing elements, or decentralized, where each group of processing elements has its own scheduler.Test Vector Leakage Assessment (TVLA)

[0014] While traditional security assurance testing against side channel attacks is based on evaluating the resistance against a wide range of attacks, so called conformance testing has become popular during the last decade, in particular the TVLA methodology. The idea of TVLA is to perform leakage detection and to detect dependencies in the measure traces. This does not automatically mean that the correlation is easily exploitable, it is rather an indication that information may leak. The tests are performed at different sample sizes and the largest sample size for which no correlation is found can be used as an indication of the security level of the implementation.

[0015] On a high level, two sets of traces are measured for the Device-Under-Attack (DUT) and compared using some statistical method of statistical hypothesis testing, typically a Welch's t-test according to the original TVLA proposal, the t-test aims at making a decision if it is likely that the two sets are from the same distribution or not. Traces can be evaluated in either non-specific or specific manner. Non-specific meaning that the evaluation is independent of any intermediate values of the power model assume. Specific meaning that leakage at a particular intermediate point in algorithm is considered, e.g., the first bit out of the first SBox of the first round of AES. Tests are also classified depending on how the input data is created, typically examples are fixed vs. random, semi-fixed vs. random, etc.

[0016] For a processing unit, a non-specific test would be of most relevance to test that certain data processed by the processing unit cannot be detected by the sidechannel leakage. The vendor I manufacturer of the processing unit could additionally test how many and which additional processing elements in the processing unit that is needed and suitable to create enough noise to pass a TVLA test for e.g., 1000, 10000, 100000 and 1000000 traces.Federal Information Processing Standards 104-3 and FIPS 104-2

[0017] The FIPS 140 series specifies requirements on cryptographic modules for computer systems used by non-military government agencies and contractors in the United States.

[0018] The latest revision, FIPS 140-3, aligns the requirements around two ISO / IEC standards ISO / IEC 19790:2012 and ISO / IEC 24759:2017. Together these two standards specify the testing regime for cryptographic modules under FIPS 140-3. In the context of ISO / IEC 19790 and ISO / IEC 24759 SCAs are designated as "non-invasive attacks" and the make provisions for documentation requirements for non-invasive mitigation techniques present and evidence of their effectiveness for all security levels. Level 3 and 4 requires that the module undergo testing using TVLA. The difference between the two levels is primarily the resources the attacker is assumed to have available for an attack. Level 3 tests are performed using 10,000 traces while level 4 uses 100,000 traces.

[0019] Similarly, as described for TLVA, the vendor / manufactures of the processing unit could test how many additional processing elements in the processing unit that is needed to pass level 3 or level 4 requirements.Common Criteria

[0020] Common Criteria (CC) is an international framework for the evaluation of computer systems against a set of security requirements. CC certifications are recognized by nation states that have signed the Common Criteria Recognition Arrangement (CCRA). The CC framework does not directly provide a list of product security requirements that products must conform to. Instead, the CC provides a certification framework that ensures that claims about the security attributes of evaluated products have been independently verified. CC maintains a catalogue of standard security requirements that can be used as evaluation criteria for products.

[0021] Protection Profiles (PP) are implementation independent specifications of security requirements for a class of devices. A PP is typically created by a user (e.g., a nation state) or a "user community" (e.g., industry consortium).

[0022] Evaluation Assurance Levels describes how rigorously security claims should be tested in the evaluation of the target. CC defines seven distinct Evaluation Assurance Levels (EALs) of increasing rigorousness (and cost) ranging from functional testing (EAL 1) to formal verification (EAL 7). SCA testing is required to some extent from EAL 4 and onwards.

[0023] The vendor I manufacturer of the processing unit could test how many and which additional processing elements in the processing unit that is needed and suitable to create enough noise to pass assurance testing for different EALs and for different PP.Related

[0024] International Application No. PCT / IB2022 / 056860 describes a method for side-channel monitoring of a device-under-monitoring (DuM) where an external monitor can determine the state of the DuM by observing the side-channel emissions.

[0025] Apart from the regular "payload side-channel emissions", the disclosed technique adds deterministic noise to create "combined side-channel emissions". The aim is for the authorized monitors to know the deterministic noise and thereby be able to extract the payload side-channel emissions, whilst non-authorized monitors cannot.Furthermore, the deterministic noise must not be repeated between sessions as this may enable unauthorized monitors to determine how to filter it out.

[0026] The monitor may actively check the status of the DuM by observing the combined side-channel emissions. The DuM utilizes a seed and the shared secret to setup generation of session-unique deterministic noise. The seed is shared with the monitor at startup of the DuM. Knowing the seed and the secret, the filtering module removes the deterministic noise before the status module uses the payload side-channel emissions to determine the state of the DuM.

[0027] U.S. Provisional Application Serial No. 63 / 416,197 describes a solution which simplifies the process of creating side-channel protected software for software developers without modifying the actual software. This is done by incorporating hardware-assisted hiding of side channel leakage. The software developer only needs to mark what regions are sensitive to side-channel leakage (e.g., crypto operations). By marking sections with an "ACTIVATE" and "DEACTIVATE", -assisted side channel protection is available without the need for expertise in the field.

[0028] U.S. Provisional Application Serial No. 63 / 416,197 also suggests adding a physical countermeasure component to a processing unit, such as a CPU, with the goal of making it very difficult for an attacker to extract the data being processed.

[0029] The goal of the countermeasure component is to decrease the Signal-to-Noise Ratio (SNR) when performing a leaky instruction. Leaky instruction means that the instruction risks exposing the data it processes through side-channel leakage. The SNR is decreased by simultaneously executing several other instructions in the processing unit. By using a real-looking instruction operating on generated data and thereby distorting the side-channel information, extracting real data becomes a more difficult task for an attacker.

[0030] In U.S. Patent No. 11449642, a method and apparatus are described for an electronic circuit that includes a plurality of processing elements, a register bank, and a control circuit. The processing elements consume power by processing a plurality of operands to generate a plurality of result values. The register bank has a plurality of registers.

[0031] The goal is to use the processing elements to protect against side-channel leakage by using these additional, unused, processing elements to provide noise for the "real process" executing on the electronic circuit.

[0032] To achieve this, the processor picks from incoming operands and instructions and combines these for execution at unused processing elements. The result from this semi-random combination of instructions and operands are discarded after execution.

[0033] There are currently limited possibilities for software developers to protect their software from side-channel leakage without possessing the knowledge of how to protect the software from emitting side-channel information. Furthermore, the leakage is different on different hardware which makes it even more difficult for a software developer to correctly protect the software binaries.

[0034] Side-channel protection, performance and energy efficiency are often diametrically opposed goals of for a software process which ideally would like to fulfill all of these factors.

[0035] U.S. Provisional Application Serial No. 63 / 416,197 addresses this problem by letting the software developer add an instruction which activates additional elements on the CPU. This enables the software developer to protect specific part of the software by adding noise.However, this solution does not handle:• How urgent it is that the instructions in need of protection are executed.• A translation between a protection parameter, potentially corresponding from a legal requirement, and a noise level of the processing unit.• A selection between different countermeasure components.

[0036] U.S. Patent No. 11449642B2 can be seen as a different solution on the problem solved by U.S. Provisional Application Serial No. 63 / 416,197 and neither disclose nor includes a solution to any of the above listed shortcomings and problems. Furthermore, it is unclear how the previous techniques would handle a situation where there are no suitable inbound instructions to activate the inactive processing elements.Summary

[0037] Various embodiments of the present disclosure provide for a method for managing side-channel emissions of a processing unit based on varying protection levels. Software modules, or sets of instructions to be executed, can come with protection parameter and an urgency parameter that indicate a privacy or level of protection to be used with the software module, and an indication of how urgent the software module is. If a processing unit that is scheduled to execute the softwaremodule is not emitting enough side channel noise to satisfy the protection parameters indicated level of protection, and the software module is not urgent, the processing unit can wait to execute the software module until the level of protection is met.Alternatively, the processing unit can indicate not meeting the level of protection to the device which can transfer the software module to another processing unit that may satisfy the level of protection required. Also alternatively, if there is no other processing unit, and the software module is urgent, countermeasure side channel noise can be activated to obscure the side channel emissions of the executed software module. Subsequently, the term side-channel noise will be used to indicate any side-channel emission that can help obfuscate the information in side-channel emissions from another process. It includes emissions from other scheduled computations and does not imply that the process generating the noise necessarily is a dummy process executed with that sole purpose.

[0038] In an embodiment, a method is performed by a device to manage sidechannel emissions of one or more devices, the method comprising: receiving an indication of a protection parameter associated with a software module, wherein the protection parameter is associated with a level of side channel protection for the software module. The method can include based on the protection parameter, determining a fulfillment criterion associated with a level of side channel noise to be generated by the device when executing the software module to comply with the level of side channel protection. The method can include, in response to side channel noise being generated by the device at least meeting the fulfillment criterion, continue executing the software module.

[0039] In an embodiment, the method can include selecting one or more processing units to execute the software module wherein the one or more processing units collectively generate at least a side-channel noise threshold.

[0040] In an embodiment, each processing unit of the one or more processing units comprises at least one processing element, and wherein the selecting one or more processing units further comprises selecting at least one processing element of the one or more processing units.

[0041] In an embodiment, the method can include, in response to a maximum level of side-channel noise capacity capabilities of the selected one or more processing unitsbeing less than the fulfillment criterion, selecting another processing unit from the one or more processing units.

[0042] In an embodiment, the method can include, in response to the selected processing units not being able to generate side-channel noise to meet the fulfillment criterion, providing an instruction to start a dedicated countermeasure processing element to generate side-channel noise during executing of the software module.

[0043] In an embodiment, the method can include, in response to execution of the software module ceasing, providing an instruction to the dedicated countermeasure processing element to cease generating side-channel noise.

[0044] In an embodiment, the method can include, receiving an urgency parameter indicating whether an urgency associated with at least one instruction of a software module exceeds a predetermined urgency level.

[0045] In an embodiment, in response to the urgency associated with the instruction of the software module not exceeding the predetermined urgency level and the side channel noise generated not satisfying the fulfillment criterion, the method can include delaying execution of at least one instruction of the software module until the side channel noise being generated by the processing unit at least matches the fulfillment criterion.

[0046] In an embodiment, delaying execution of the at least one instruction of the software module continues until at least one of the following conditions occur: an expiration of a timer; or an interrupt is triggered; and in response to at least one of the conditions occurring, the method can include increasing the urgency level in the said parameter indicating whether an urgency associated with said at least one instruction of a software module.

[0047] In an embodiment, in response to the urgency associated with the software module exceeding the predetermined urgency level and the side channel noise generated by the processing unit not satisfying the fulfillment criterion, the method can include generating countermeasure side channel noise by one or several previously inactive processing elements executing a set of countermeasure procedures.

[0048] In an embodiment, the countermeasure procedures are generated to execute on one or more processing elements as long as the execution time of the operations to be protected, input data to the countermeasure procedure is either predefined or deterministically derived from the data of the protected instruction, and output data ofthe countermeasure procedure is not committed to memory, or stored at a dedicated memory area.

[0049] In an embodiment, instructions and data associated with the countermeasure procedure are selected based on at least one of a type of instructions of the software module and the level of side channel protection for the software module.

[0050] In an embodiment, the method can include, in response to receiving a new protection parameter that is associated with a lower level of side channel protection for the software module, providing an instruction to cease generation of the countermeasure side channel noise.In an embodiment, the method can include, determining whether side channel noise being generated by the processing unit at least matches the fulfillment criterion at predefined intervals.

[0051] In an embodiment, the predefined intervals are one of predefined periods of time or predefined numbers of instructions to be executed or executed instructions.

[0052] In an embodiment, the determining the fulfillment criterion is based at least in part on a type of processing element of the processing unit, a number of active processing elements, a type of instruction associated with the software module, and an instruction queue associated with the processing unit and other active processing units.

[0053] In an embodiment, the level of side channel protection is based at least in part on a computer security standard.

[0054] In an embodiment, the association between a fulfillment criterion and a level of side channel protection is defined by characterizing the side-channel properties of the processing units, processing elements and dedicated countermeasure processing elements for the device.

[0055] In an embodiment, the method can include receiving the protection parameter before execution of the software module.

[0056] In an embodiment, the method can include receiving at least one protection parameter during execution of the software module.

[0057] In another embodiment, a device can include processing circuitry configured to manage side-channel emissions of one or more devices, wherein the processing circuitry is configured to receive an indication of a protection parameter associated with a software module, wherein the protection parameter is associated with a level of side channel protection for the software module. The processing circuitry can also, based onthe protection parameter, determine a fulfillment criterion associated with a level of side channel noise to be generated by the device when executing the software module to comply with the level of side channel protection. The processing circuitry can also in response to side channel noise being generated by the device at least meeting the fulfillment criterion, execute the software module.

[0058] In an embodiment, a computer program can comprise instructions which, when executed on at least one processor, cause the processor to carry out any of the above methods.

[0059] In another embodiment, a carrier can contain the computer program, wherein the carrier is one of an electronic signal, an optical signal, a radio signal, or a computer readable storage medium.

[0060] Some of the advantages of the present disclosure enable a software developer to specify requirements for software components, to ensure that the protection deployed on the hardware where it executes complies with legal requirements. By letting the software developer specify an urgency parameter, the device can either await execution until the most suitable processing unit is free or when enough noise is generated by the device. This allows the device to save energy on executing noise processes which are not contributing with any value.Brief Description of the Drawings

[0061] The accompanying drawing figures incorporated in and forming a part of this specification illustrate several aspects of the disclosure, and together with the description serve to explain the principles of the disclosure.

[0062] Figure 1 is a schematic block diagram of a device for managing side-channel emissions of a processing unit according to some embodiments of the present disclosure;

[0063] Figure 2 is a flowchart of a method for managing side-channel emissions of a processing unit according to some embodiments of the present disclosure;

[0064] Figure 3 is a flowchart of an alternative method for managing side-channel emissions of a processing unit according to some embodiments of the present disclosure;

[0065] Figure 4 is another flowchart of a method for protecting side-channel emissions of a processing unit according to some embodiments of the present disclosure;

[0066] Figure 5 is a schematic block diagram of a device according to some embodiments of the present disclosure; and

[0067] Figure 6 is a schematic block diagram of the device in a server according to some other embodiments of the present disclosure.Detailed Description

[0068] The embodiments set forth below represent information to enable those skilled in the art to practice the embodiments and illustrate the best mode of practicing the embodiments. Upon reading the following description in light of the accompanying drawing figures, those skilled in the art will understand the concepts of the disclosure and will recognize applications of these concepts not particularly addressed herein. It should be understood that these concepts and applications fall within the scope of the disclosure.

[0069] Various embodiments of the present disclosure provide for a method for managing side-channel emissions of a processing unit based on varying protection levels. Software modules, or sets of instructions to be executed, can come with a protection parameter and an urgency parameter that indicate a privacy or level of protection to be used with the software module, and an indication of how urgent the software module is. If a processing unit that is to execute the software module is not emitting enough side channel noise to satisfy the protection parameters indicated level of protection, and the software module is not urgent, the processing unit can wait to execute the software module until the level of protection is met. Alternatively, the processing unit can indicate not meeting the level of protection to the device which can transfer the software module to another processing unit that may satisfy the level of protection required. Also alternatively, if there is no other processing unit, and the software module is urgent, countermeasure side channel noise can be activated to obscure the side channel emissions of the executed software module.

[0070] Since compute offload / cloud computing is increasing and regulations for software protection is increasing, new methods to ensure proper side-channel protection for sensitive components are required. Disclosed herein is a method whichmakes it possible for the software developer to require a certain level of protection against side-channel leakage on a device.

[0071] When a software component is executed on a processing unit within said device, the software may contain an instruction which indicates a side-channel protection level (SCPL) requirement for a series of instructions, such as a function call. The series of instructions is referred to as a "software module" in this present disclosure. The SCPL may be based on a side-channel protection standard, such as Federal Information Processing Standards (FIPS) 140-3 or Test Vector Leakage Assessment (TVLA). The device translates the protection parameter into a fulfillment criterion, which can contain e.g.:• Specific processing units with higher side-channel protection levels are to be used;• At least X additional processing elements within one or several processing units to be active, in addition to the processing element(s) utilized for the software module.

[0072] The SCPL requirement further contains an urgency parameter which indicates if the software instructions are non-urgent and can await the fulfillment requirement to be met. If non-urgent, the software instructions are put on hold until the fulfillment requirement is met or until a second point in time is reached where the software module can no longer await execution.

[0073] To reach the fulfillment requirement, the device may move processes to processing units with higher protection levels or may indicate to the countermeasure component that X additional process elements must be activated, leading the countermeasure component to create instructions and data for said process elements.

[0074] When the fulfillment requirement has been met, the instructions of the software module is executed.

[0075] Said software module may optionally contain a preamble which indicates the protection levels that it will require during its execution. If the requirements are higher than can be achieved by the device / system, the software process is aborted and an indication that the maximum available protection level and desired protection level are mismatched are logged and / or communicated to the user.

[0076] Some of the advantages of the present disclosure enable a software developer to specify requirements for software components, to ensure that theprotection deployed on the hardware where it executes complies with legal requirements. By letting the software developer specify an urgency parameter, the device can either await execution until the most suitable processing unit is free or when enough noise is generated by the device. This allows the device to save energy on executing noise processes which are not contributing with any value.

[0077] The present disclosure provides for a device or system comprising at least one processing unit, a protection level determination component (PLDC) a countermeasure component. The processing unit running a software component comprising at least one software module. The software component further comprising at least one protection level requirement instruction for a software module. The method includes translating a, possibly standardized, SCPL instruction from a software component into a setup of the hardware which provides adequate side-channel protection for the execution of said software component. The PLDC can be configured to receive a SCPL requirement from a processing unit. The SCPL requirement command can include a protection parameter and an urgency parameter. The protection parameter is translated into a fulfillment criterion. The protection parameter can be based on at least one official standard such as TVLA, FIPS 140-3, or Common Criteria.

[0078] The fulfillment criterion can include at least one of:• A specific processing unit the software module must run at; or• A level of noise needed to be generated by the device when the protection profile is activated. Said level of noise may be determined by having a predefined number of processing elements execution instructions simultaneously with the instructions of the software module.

[0079] The PLDC can be further configured to enable a processing unit (PU) determine if currently generated noise meets a fulfillment criterion.• If the PU is determined to meet the fulfillment criterion, the instructions of the software module are allowed to execute.• If the SCPL is determined to not meet a fulfillment criterion, determine from the received urgency parameter if countermeasure procedure must be taken.• If not urgent, the instructions and operations of the software are put on hold until the fulfillment criterion is met or until a second point in time.

[0080] The countermeasure component can also be configured to receive an increase noise level-command from the PU. The countermeasure component can be configuredto generate instructions for at least one of the idle processing elements, where the number of idle processing elements to activate is defined in an increase noise levelcommand.

[0081] Figure 1 is a schematic block diagram of a device for managing side-channel emissions of a processing unit according to some embodiments of the present disclosure.

[0082] A device 100 can include one or more processing units 102-1 and 102-2 (referred to singularly or jointly as "processing unit 102") that can execute instructions (e.g., the software module) to perform various operations. Each processing unit 102 can include an instruction cache and fetch buffer 110 for storing not yet handled operations for the scheduler and not yet handled opcodes (encoding of instructions) for the decoder 108. The processing unit 102 can also include a decoder 108 for translation of opcode to at least one operation to be performed by the processing unit 102. If opcode is a SCPL requirement instruction, the processing unit (PU) sends an external signal to the PLDC 104. A scheduler 112 is also included that schedules operations to be performed on the processing elements 114. In some embodiments, the scheduler may be placed outside the processing unit 102, controlling several different processing units 102. In other embodiments, several schedulers 112 may be present on the same PU and responsible for different sets of processing elements 114. The processing elements 114-1, 114-2, 114-3 (and etc.) can perform at least one type of operation such as arithmetic operations, floating point operations, hash or crypto operations, writing / reading from storage, etc.

[0083] The PU 102 can also include a countermeasure component 106 that is responsible for generating instructions and / or data to be used by inactive processing elements to create noise and thereby lower the signal-to-noise ratio (SNR) for an adversary observing the side-channel leakage. The countermeasure component 106 can select data or instructions, or create dummy data and instructions for either an inactive processing element 114 to generate, or for a dedicated countermeasure processing element 126 to generate, during a protection phase, side channel emissions to obscure or hide the side channel emissions associated with execution of the software module. The countermeasure component may be standalone component or be a part of another component, such as the decoder (108) or the scheduler (112).

[0084] The PU 102 can also include a criterion evaluation engine 118 that evaluates whether the fulfillment criterion is met for at least the next X clock cycles of the PU 102.

[0085] A PLDC 104 is also provided on each PU 102 that is responsible for determining if a SCPL is met by evaluating the current setup for the software execution and the state of the processing units 102 of the device 100. The PLDC 104 can include a requirement translation engine 116 that translates the SCPL to a fulfillment criterion which is determined to provide the desired protection level against side-channel leakage.

[0086] A processor selector 124 in the PLDC 104 can determine whether to generate use the dedicated countermeasure processing element 126 or an inactive processing element 114 or even an active processing element 114 in executing the supplemental instructions or dummy data / instructions to generate the countermeasure side channel emissions.

[0087] The present disclosure discloses a method that can be generally divided into two phases, an evaluation phase (associated flowchart shown in Figs. 2 and 3) and a protection phase (associated flowchart shown in Fig 4). The evaluation phase further comprising an optional pre-evaluation phase. In some embodiments, the pre-evaluation phase is instead performed prior to the processing unit receiving the software component, e.g., in a cloud environment the tenant ensures that the rented hardware has the means to protect against side-channel analysis according to a specified standard during the renting procedure. It is to be appreciated that in Figures 2-4, steps in the flowchart that are shown in dashed lines are optional.

[0088] Figure 2 is a flowchart of a method for managing side-channel emissions of a processing unit during an evaluation phase according to some embodiments of the present disclosure.

[0089] At step 202, the Operating System (OS) scheduler 130 of the OS 128 optionally detects a preamble containing information on side-channel protection level (SCPL) requirements present in the software component that is loaded from a program 132. The SCPL requirements can be based on the type of instructions associated with the software component or based on the data being handled by the software component, and can be specified by one or more regulatory or standards bodies (e.g., FIPS 140-3, TVLA, etc.).

[0090] At step 204, the OS scheduler 130 optionally sends the preamble to PLDC 104.

[0091] At step 206, PLDC 104 determines if the maximum required SCPL in the preamble is less or equal to the available SCPL that the PU 102-1 is capable of generating. If so, the PLDC 104 may optionally move the execution of the software component to a PU (e.g., PU 102-2) with a higher SCPL than the 1stPU at step 206. If the maximum required SCPL cannot be fulfilled by the any of the PU's 102, the PLDC 104 can either instruct the dedicated countermeasure processing element 126 to execute simultaneously to increase the level of side-channel protection at step 208. Alternatively, the PLDC 104 instructs the 1stPU 102-1 to abort the execution at step 210 and inform the user that hardware is not able to comply with software demands.

[0092] If the PLDC determines that the maximum required SCPL is less or equal to the available SCPL, the PU selector 124 of the PLDC 104 can select, at step 212, from the PUs 102 which can satisfy the required SCPL, a PU 102-1 or 102-2 that can be used to execute the software module. Additionally, the PU selector 124 can select which of the processing elements 114-1, 114-2, or 114-3 (and etc.) can be used by the selected PU 102 to execute the software module. At step 214, after the PLDC 104 has selected a PU 102 or processing element(s) 114 to execute the software, the OS 128 can instruct the PU 102 (e.g., 102-1 or 102-2) to load the software module from program 132. The software module can be one or more instructions that are executed together, and software modules of a software component can be executed sequentially, in parallel, in a predetermined order, or in one of a variety of orders.

[0093] At step 216, PU 102 starts executing instructions belonging to a software module in the software component and at step 218, PU 102 detects the SCPL requirement instruction relating to software module.

[0094] Once the SCPL requirement is detected, the PU 102-1, at step 220, halts further execution of the software module, and sends either the entire SCPL requirement instruction or the decoded requirement field to the PLDC 104. The SCPL requirement instruction can include both the required SCPL, as well as an urgency associated with the software module. The urgency of the software module can be related to how long the execution of the software module, relative to other software modules can be delayed before the software module is to be executed.

[0095] At step 222, the PLDC 104 translates the requirements into a fulfillment criterion using the requirement translation engine 116. The fulfillment criterion can include one or more steps the device 100 can take in order to meet the SCPL requirements, and can include criteria such as a specific processing unit the software module should run on, a level of noise needed to be generated by the device to hide the side channel emissions the processing element(s) 114 executing the instructions, and etc.

[0096] At step 224, the PLDC 104 measures if current setup and / or state of PU 102- l's instruction queues has a suitable maximum SCPL that can meet the fulfillment criterion for executing the software module. If all available PUs 102 have the same SCPL or the optional steps 202-206 were performed, this step may be omitted.

[0097] If the PU 102-1 does not have the required maximum SCPL to meet the fulfillment criterion, but another PU exist with suitable maximum SCPL, the PLDC 104 can initiate a move of the software module to 2ndPU 102-2 and continue with step 204. PLDC 104 instructs the OS to let 2ndPU 102-2 load the software module and to let the 1stPU 102-1 to terminate execution of the software module at step 210. The processes then continues but with the 2ndPU 102-2 instead of the 1stPU 102-1.

[0098] If the required protection is less than the available protection for the 1stPU 102-1 then at step 226, the PLDC 104 translates the requirements into a fulfillment criterion at step 222 using the requirement translation engine 116 and supplies these to 1stPU 102-1 at step 226. The fulfillment criterion specifies a combination of processing elements and I or instructions which should be active I executed in combination with the instructions belonging to the software module. Step 228 ties Fig. 2 together with Fig. 4, i.e., the flow continues in Fig. 4.

[0099] In some embodiments, the PLDC 104 may have pre-configured the PU 102-1 with different fulfillment criterion for different SCPL requirement instruction, meaning that step 224 and 226 and the process may jump directly to protection phase detailed in Figure 4 from step 220.

[0100] Figure 3 provides an alternate embodiment to the evaluation phase.However, in Figure 3, it is assumed that the entire software module has the same SCPL and therefore, there is no need for the 1stPU to detect a SCPL instruction during execution (steps 218-220 in Figure 2). Steps 302, 304, and 306 largely mirror steps 202, 204, and 306 from Figure 2, where based on the SCPL requirements detected inthe preamble and sent to the PLDC 104 by the OS 130, the PLDC 104 can determine at step 306 whether the side channel noise protection that is required is less than what is available. If no, then the PLDC 104 can instruct a dedicated countermeasure processing element to start executing countermeasure operations and data to generate additional side channel noise at step 308, or can stop execution at 310.

[0101] If the PLDC determines however that the maximum required SCPL is less or equal to the available SCPL, the PU selector 124 of the PLDC 104 can select, at step 312, from the PUs 102 which can satisfy the required SCPL, a PU 102-1 or 102-2 that can be used to execute the software module. Additionally, the PU selector 124 can select which of the processing elements 114-1, 114-2, or 114-3 (and etc.) can be used by the selected PU 102 to execute the software module.

[0102] At step 314, after the PLDC 104 has selected a PU 102 or processing element(s) 114 to execute the software, the PLDC can supply a fulfillment criterion to the selected PU (e.g., 102-1). And the OS 130 or PLDC 104 can instruct, at step 316, the PU 102-1 to enable protection based on the fulfillment criterion at step 318. Step 318 ties Fig. 2 together with Fig. 4, i.e., the flow continues in Fig. 4.

[0103] Figure 4 is another flowchart of a method for protecting side-channel emissions of a processing unit during a protection phase according to some embodiments of the present disclosure.

[0104] At step 402, the PU 102-1 (e.g., by the decoder 108) decodes the instructions from the software module into a set of operations, e.g., micro-ops, and at step 404, the PU 102-1 configures the criterion evaluation engine 118 with the fulfillment criterion.

[0105] At step 406, the criterion evaluation engine 118 can determine whether the current setup and / or state of PU's instruction queues meets the requirements defined in fulfillment criterion.

[0106] If the fulfillment criterion has been met, then the process jumps to step 418 where the PU 102-1 continues the execution of the operations of the software module. When / If more SCPL requirements instructions are found in the software component, the process returns to step 218 of evaluation phase.

[0107] If, on the other hand, the fulfillment criterion has not been met, a determination can be made at step 410 whether the operation is urgent, based on the urgency parameter in the SCPL requirements in the software. If the operation is not urgent, the PU 102-1 can halt the execution, at step 422, of the instructions belongingto the software until a second point in time. The second point in time may be determined by a timer or an interrupt. After the timer or the interrupt period has expired, the determination of whether the fulfillment criterion at step 406 is met can be performed again, and the urgency level can optionally be incremented at step 408 from non-urgent to urgent.

[0108] At step 410, if the operation is urgent, the process can proceed to step 412, where the PU 102-1 instructs the countermeasure component 106 to selects at least one inactive processing element 114, in accordance with the specified fulfillment criterion. Countermeasure component 106 can select, at step 412, at least one inactive processing element on at least one PU. For example, the countermeasure component 106 can select an inactive processing element in PU 102-1 (e.g., processing element 114-2 or 114-3, or can select another inactive processing element in a different PU such as PU 102-2. Additionally, countermeasure component 106 can instruct a dedicated countermeasure processing element 126 that is not necessarily associated with the current PU or another PU to execute countermeasure instructions or data.

[0109] At step 414, once countermeasure component 106 selects the inactive processing element in step 312, countermeasure component 106 can also create / select instructions and data at step 416 for said processing elements and start execution of dummy processes to generate countermeasure side channel emissions that can hide or obscure the side channel emissions generated in response to executing the software module.

[0110] At step 418, the PU 102-1 or 102-2 continues the execution of the software module.

[0111] When the PU 102-1 or 102-2 has finished executing the software module or a lower SCPL requirement is received from the PU 102-1 or 102-2, the PLDC 104 can instruct countermeasure component 106 to cease at step 420.

[0112] As the PLDC 104 receives a SCPL requirement level from a PU 102, the PLDC 104 can transform this requirement into a hardware specific, device specific, or processing unit specific fulfillment criterion by a requirement translation engine 116. The requirement may be represented by a binary field where different bit positions have a standardized meaning: xxOl = TVLA up to 1000 traces, xxlO = TVLA up to 10000 traces,xxll = TVLA up to 100000 traces, Olxx = FIPS 140-3, level 2, lOxx = FIPS 140-3, level 3, llxx = FIPS 140-3, level 4

[0113] In one embodiment, the requirement translation engine is a lookup table, where the requirements of the hardware are specified using fixed table entries. As an example, a SCPL requirement for TVLA 100000 traces may state that at least 10 additional processing elements should be active, in addition to the processing element to be protected.

[0114] As another example, a SCPL requirement for FIPS 140-3, level 3 may state that the software module must be run on a specific PU and that all processing elements must be constantly active on said PU.

[0115] In another embodiment, the requirement translation engine 116 additionally receives information about the software module, e.g., what processing elements it will utilize during its execution. This enables the fulfillment criterion to be specialized for the software module. E.g., if the software module will execute an AES encryption, the requirements translation engine 116 may put requirements on specific processing elements being active to meet the fulfillment criteria. If a processing unit has specialized AES instructions, the fulfillment criteria may require that both one or multiple processing elements of the same type must be activated (and implicitly that the second AES capable processing element should execute something with a different key).

[0116] In yet another embodiment, the requirement translation engine 116 still receiving information on specific tasks performed by the software module, it may require that some of the data to be processed by the software module should be used by the processing elements performing the noise. E.g., encrypting the same data with two different keys.

[0117] When the PLDC 104 has determined a hardware specific fulfillment criterion, the criterion evaluation engine 118 must evaluate if the criterion is fulfilled before the instructions of the software module can be allowed to execute.

[0118] The criterion evaluation engine 118 takes at least information from the PU 102-1's defining number of processing elements 114 as input. In some embodiment, the criterion evaluation engine 118 additionally receives the type of processing elements and / or the status of the instruction queues, provided by the scheduler 112.

[0119] In one embodiment, the fulfillment criteria may specify a number of processing elements 114 to be active, apart from the ones, used by the software module. The fulfillment criterion is evaluated on if enough processing elements 114 are active during the next X clock cycles for the PU 102-1.

[0120] In another embodiment, the fulfillment criteria may have specified exact processing elements 114 required to be active, in which case the fulfillment criterion is evaluated on if they are active for the next X clock cycles for the PU(s).

[0121] In some embodiments, the criterion evaluation engine 118 may be implemented using a neural network where the network can be trained on instruction queues and processing elements 114 labeled with the required countermeasure procedure. Training could also be performed using a generative adversarial approach where the generator is trained to produce instruction combinations such that a discriminator consisting of a trained side-channel analysis network only has a random chance of finding correlation with the process and a known secret. Data representing noise of processing elements 114 could either be pre-determined as a minimal level for that element or represented using a training set of side-channel traces of typical instructions running in the processing elements. A neural network trained for this purpose has high performance requirements and may be optimized for specific hardware requirements.

[0122] The countermeasure component 106 in the PU 102 is responsible for lowering the signal-to-noise ratio (SNR) for a potential adversary and it can be implemented as a hardware component, reconfigurable hardware (FPGA) block or as a software process which is controlled by the PLDC 104.

[0123] In an embodiment, the countermeasure component 106 may be implemented as a hardware component and may inject instructions into the fetch buffers of the processing units or alternatively, indicate directly to the components in the PU's, e.g., the decoder or the scheduler, that additional instructions should be generated.

[0124] The countermeasure component 106 is given a task by the PU 102, based on the fulfillment criterion supplied by the PLDC 104 to activate certain processing elements by producing instructions and data which can be executed by said processing elements.

[0125] There are different alternatives on how to implement the software communicating the SCPL requirement to the PLDC 104.

[0126] In one embodiment, the SCPL requirement is an instruction with a specific opcode which is received by the decoder. The level in the SCPL requirement may be given as an operand for such an instruction, e.g., {Opcode: 0x1234, Operand: 0x0001}, i.e., where the opcode indicates "SCPL requirement" and the operand the desired level.

[0127] In some embodiments, such an instruction may also contain a second operand which indicates for how many instructions the SCPL requirement is valid for, e.g., {Opcode: 0x1234, 1st Operand: 0x0001, 2nd: OxOOff}, indicates that the Oxff = 255 upcoming instructions should be protected.

[0128] In some embodiments, the SCPL requirement instruction is complemented with a specific instruction which activates / deactivates the SCPL.

[0129] In some embodiments, the SCPL requirement instruction may be complemented with a flag, e.g., a binary flag which indicates the instructions to be protected. The software can first specify a SCPL and then indicates explicitly which instructions are to be protected by this.

[0130] In some embodiments, there are no specific SPCL requirement instructions, in this embodiment, each instruction can have a "side-channel protected twin". I.e., there is both an instruction for "ADD" and for "SCPL-ADD". This can be implemented as separate opcodes or an additional operand which indicates the level of SCPL.

[0131] In yet another embodiment, there is no SCPL instruction at all, but the software may write a value to a specific memory address which either belongs to the PLDC 104 or alternatively, is continuously monitored by the PLDC 104. The write may indicate which PU 102 the write came from if several PUs 102 are available. Upon detecting an update in the memory, the PLDC 104 informs the relevant PU which configures its criterion evaluation engine with a fulfillment requirement and halts the instructions in the software module until the fulfillment criteria is met.

[0132] In one embodiment the PLDC 104 also evaluates computational instructions sent to a connected GPU. A GPU usually has its own instruction sets, and protection for GPU can therefore be implemented in the same way as described above. However, the GPU may not have a specific decoder but a more general command processor which handles the activation of the SCPL.

[0133] A software-implemented neural network may contain layers of varying sensitivity depending on whether they originate from a transferred publicly available network architecture or if they are the result of complete or finetuned training onproprietary data. For sensitive layers, the PLDC 104 may instruct the GPU to add dummy computations for each parallel execution to ensure that GPU power consumption remains indifferent to the activity in each layer, thereby obfuscating the real number of computations necessary for each layer.

[0134] In one embodiment, the criterion evaluation engine 118 does not only evaluate the fulfillment criteria when the SCPL requirement instruction is received but also continuously until an instruction indicating a lower SCPL is received. In such an embodiment, the software module may be halted in the middle of executing if the fulfillment criterion is no longer met.

[0135] Continuous evaluation requires more resources than a one-time evaluation but in return offers a more fine-grained control of the protection, enabling the protection level up to a precision where it can be determined for every clock cycle.

[0136] In another embodiment, a re-evaluation is performed after X instructions have been executed or after Y clock cycles have passed. This enables a step-by-step evaluation for a larger software module, e.g., the evaluation can be performed after each round for an AES encryption process.

[0137] In one embodiment, the device 100 has a dedicated countermeasure processing element 126 to create noise and lower the SNR for the attacker. This processing element 126 may be controlled by the OS 128 as a standalone component.

[0138] In some embodiments, the dedicated countermeasure processing element 126 can be present within a PU 102 and used by the countermeasure component 106 in the PU 102.

[0139] The techniques disclosed herein are suitable for cloud implementation and the processing units utilized may be distributed over several different devices. In such an embodiment, a PLDC 104 may be placed on each server providing at least one processing unit to the user, or alternatively, a central PLDC which receives information from the respective PU's over a network connection. In other embodiments, a server can include multiple devices (see Figure 5).

[0140] Figure 5 is a schematic block diagram of the device 100 according to some embodiments of the present disclosure. The device 100 from FIG. 1 can include a network interface 506 and a memory 504, in addition to the PU 102 (e.g., a processor). The processors / PUs 102 can be Central Processing Units (CPUs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs), and / or the like,memory 504 can store the software components and software modules before being loaded to the PU 102. The network interface 506 can facilitate communications with other devices. The one or more processors 102 are also referred to herein as processing circuitry.

[0141] Figure 6 is a schematic block diagram of the device 100 in a server 600 according to some other embodiments of the present disclosure. A server can include a plurality of devices (e.g., device 100, 100-2, etc.).

[0142] Any appropriate steps, methods, features, functions, or benefits disclosed herein may be performed through one or more functional units or modules of one or more virtual apparatuses. Each virtual apparatus may comprise a number of these functional units. These functional units may be implemented via processing circuitry, which may include one or more microprocessor or microcontrollers, as well as other digital hardware, which may include Digital Signal Processors (DSPs), special-purpose digital logic, and the like. The processing circuitry may be configured to execute program code stored in memory, which may include one or several types of memory such as Read Only Memory (ROM), Random Access Memory (RAM), cache memory, flash memory devices, optical storage devices, etc. Program code stored in memory includes program instructions for executing one or more telecommunications and / or data communications protocols as well as instructions for carrying out one or more of the techniques described herein. In some implementations, the processing circuitry may be used to cause the respective functional unit to perform corresponding functions according to one or more embodiments of the present disclosure.

[0143] While processes in the figures may show a particular order of operations performed by certain embodiments of the present disclosure, it should be understood that such order is exemplary (e.g., alternative embodiments may perform the operations in a different order, combine certain operations, overlap certain operations, etc.).

[0144] Those skilled in the art will recognize improvements and modifications to the embodiments of the present disclosure. All such improvements and modifications are considered within the scope of the concepts disclosed herein.

Claims

Claims1. A method performed by a device (100) to manage side-channel emissions of one or more devices (100), the method comprising: receiving (204, 220) an indication of a protection parameter associated with a software module, wherein the protection parameter is associated with a level of side channel protection for the software module; based on the protection parameter, determining (222) a fulfillment criterion associated with a level of side channel noise to be generated by the device (100) when executing the software module to comply with the level of side channel protection; in response to side channel noise being generated by the device (100) at least meeting (406) the fulfillment criterion, continue executing (418) the software module.

2. The method of claim 1, further comprising: selecting (212, 312) one or more processing units (102) to execute the software module wherein the one or more processing units collectively generate at least a sidechannel noise threshold.3 The method of claim 2, wherein each processing unit (102) of the one or more processing units comprises at least one processing element (114), and wherein the selecting one or more processing units (102) further comprises selecting at least one processing element (114) of the one or more processing units (102).

4. The method of any of claims 2 to 3, further comprising: in response to a maximum level of side-channel noise capacity capabilities of the selected one or more processing units (102) being less than the fulfillment criterion, selecting (212) another processing unit (102) from the one or more processing units (102).

5. The method of claim 2, further comprising: in response to the selected processing units (102) not being able to generate side-channel noise to meet the fulfillment criterion, providing (208, 308) an instructionto start a dedicated countermeasure processing element (126) to generate side-channel noise during executing of the software module.

6. The method of claim 5, further comprising: in response to execution of the software module ceasing, providing (420) an instruction to the dedicated countermeasure processing element (126) to cease generating side-channel noise.

7. The method of claim 1, further comprising: receiving (220) an urgency parameter indicating whether an urgency associated with at least one instruction of a software module exceeds a predetermined urgency level.

8. The method of claim 7, wherein in response to the urgency associated with the instruction of the software module not exceeding the predetermined urgency level and the side channel noise generated not satisfying the fulfillment criterion, the method further comprises: delaying (422) execution of at least one instruction of the software module until the side channel noise being generated by the processing unit (102) at least matches the fulfillment criterion.

9. The method of claim 8, wherein delaying execution of the at least one instruction of the software module continues until at least one of the following conditions occur: an expiration of a timer; or an interrupt is triggered; and in response to at least one of the conditions occurring, increasing (408) the urgency level in the said parameter indicating whether an urgency associated with said at least one instruction of a software module.

10. The method of claim 7, wherein in response to the urgency associated with the software module exceeding the predetermined urgency level and the side channel noise generated by the processing unit (102) not satisfying the fulfillment criterion, the method further comprises:generating (412, 414, 416) countermeasure side channel noise by one or several previously inactive processing elements (114) executing a set of countermeasure procedures.11 The method of claim 10, wherein the countermeasure procedures are generated to execute on one or more processing elements as long as the execution time of the operations to be protected, input data to the countermeasure procedure is either predefined or deterministically derived from the data of the protected instruction, and output data of the countermeasure procedure is not committed to memory, or stored at a dedicated memory area.

12. The method of any of claims 10 to 11, wherein instructions and data associated with the countermeasure procedure are selected based on at least one of a type of instructions of the software module and the level of side channel protection for the software module.

13. The method of any of claims 10 to 12, further comprising: in response to receiving a new protection parameter that is associated with a lower level of side channel protection for the software module, providing (420) an instruction to cease generation of the countermeasure side channel noise.

14. The method of any of claims 1 to 13, further comprising: determining (224) whether side channel noise being generated by the processing unit (102) at least matches the fulfillment criterion at predefined intervals.

15. The method of claim 14, wherein the predefined intervals are one of predefined periods of time or predefined numbers of instructions to be executed or executed instructions.

16. The method of any of claims 1 to 15, wherein the determining the fulfillment criterion is based at least in part on a type of processing element (114) of the processing unit (102), a number of active processing elements (114), a type ofinstruction associated with the software module, and an instruction queue associated with the processing unit (102) and other active processing units (102).

17. The method of any of claims 1 to 16, wherein the level of side channel protection is based at least in part on a computer security standard.

18. The method of any of claims 1 to 17, wherein the association between a fulfillment criterion and a level of side channel protection is defined by characterizing the side-channel properties of the processing units (102), processing elements (114) and dedicated countermeasure processing elements (126) for the device (100).

19. The method of any of claims 1 to 18, further comprising: receiving (204) the protection parameter before execution of the software module.

20. The method of any of claims 1 to 19, further comprising: receiving (220) at least one protection parameter during execution of the software module.

21. A device (100) comprising processing circuitry configured to manage sidechannel emissions of one or more devices (100), wherein the processing circuitry is configured to: receive (204, 220) an indication of a protection parameter associated with a software module, wherein the protection parameter is associated with a level of side channel protection for the software module; based on the protection parameter, determine (222) a fulfillment criterion associated with a level of side channel noise to be generated by the device (100) when executing the software module to comply with the level of side channel protection; in response to side channel noise being generated by the device (100) at least meeting (406) the fulfillment criterion, execute (418) the software module.

22. The device (100) of claim 21, wherein the processing circuitry is further configured to:select (212, 312) one or more processing units (102) to execute the software module wherein the one or more processing units collectively generate at least a sidechannel noise threshold.

23. The device (100) of claim 22, wherein each processing unit (102) of the one or more processing units (102) comprises at least one processing element (114), and wherein the selecting one or more processing units (102) further comprises selecting at least one processing element (114) of the one or more processing units (102).

24. The device (100) of any of claims 22 to 23, wherein the processing circuitry is further configured to: in response to a maximum level of side-channel noise capacity capabilities of the selected one or more processing units (102) being less than the fulfillment criterion, select (212) another processing unit (102) from the one or more processing units (102).

25. The device (100) of claim 22, wherein the processing circuitry is further configured to: in response to the selected processing units (102) not being able to generate side-channel noise to meet the fulfillment criterion, provide (208, 308) an instruction to start a dedicated countermeasure processing element (126) to generate side-channel noise during executing of the software module.

26. The device (100) of claim 25, wherein the processing circuitry is further configured to: in response to execution of the software module ceasing, provide (420) an instruction to the dedicated countermeasure processing element (126) to cease generating side-channel noise.

27. The device (100) of claim 21, wherein the processing circuitry is further configured to: receive (220) an urgency parameter indicating whether an urgency associated with at least one instruction of a software module exceeds a predetermined urgency level.

28. The device (100) of claim 27, wherein in response to the urgency associated with the instruction of the software module not exceeding the predetermined urgency level and the side channel noise generated not satisfying the fulfillment criterion, the processing circuitry is further configured to: delay (422) execution of at least one instruction of the software module until the side channel noise being generated by the processing unit (102) at least matches the fulfillment criterion.

29. The device (100) of claim 28, wherein the delaying execution of the at least one instruction of the software module continues until at least one of the following conditions occur: an expiration of a timer; or an interrupt is triggered; and in response to at least one of the conditions occurring, the processing circuitry is further configured to increase (408) the urgency level in the said parameter indicating whether an urgency associated with said at least one instruction of a software module.

30. The device (100) of claim 27, wherein in response to the urgency associated with the software module exceeding the predetermined urgency level and the side channel noise generated by the processing unit (102) not satisfying the fulfillment criterion, the processing circuitry is further configured to: generate (412, 414, 416) countermeasure side channel noise by one or several previously inactive processing elements (114) executing a set of countermeasure procedures.

31. The device (100) of claim 30, wherein the countermeasure procedure is generated to execute on one or more processing elements as long as the execution time of the operations to be protected, input data to the countermeasure procedure is either predefined or deterministically derived from the data of the protected instruction, and output data of the countermeasure procedure is not committed to memory, or stored at a dedicated memory area.

32. The device (100) of any of claims 30 to 31, wherein operations and data associated with the countermeasure procedure are selected based on at least one of a type of instructions of the software module and the level of side channel protection for the software module.

33. The device (100) of any of claims 30 to 32, wherein the processing circuitry is further configured to: in response to receiving a new protection parameter that is associated with a lower level of side channel protection for the software module, provide (420) an instruction to cease generation of the countermeasure side channel noise.

34. The device (100) of any of claims 21 to 33, wherein the processing circuitry is further configured to: determine (224) whether side channel noise being generated by the processing unit (102) at least matches the fulfillment criterion at predefined intervals.

35. The device (100) of claim 34, wherein the predefined intervals are one of predefined periods of time or predefined numbers of executed instructions.

36. The device (100) of any of claims 21 to 35, wherein the determining the fulfillment criterion is based at least in part on a type of processing element (114) of the processing unit (102), a number of active processing elements (114), a type of instruction associated with the software module, and an instruction queue associated with the processing unit (102) and other active processing units (102).

37. The device (100) of any of claims 21 to 36, wherein the level of side channel protection is based at least in part on a computer security standard.

38. The device (100) of any of claims 21 to 37, wherein the association between a fulfillment criterion and a level of side channel protection is defined by characterizing the side-channel properties of the processing units (102), processing elements (114) and dedicated countermeasure processing elements (126) for the device (100).

39. The device (100) of any of claims 21 to 38, wherein the processing circuitry is further configured to: receive (204) the protection parameter before execution of the software module.

40. The device (100) of any of claims 21 to 39, wherein the processing circuitry is further configured to: receive (220) at least one protection parameter during execution of the software module.

41. A computer program comprising instructions which, when executed on at least one processor, cause the processor to carry out the method according to any of claims 1 to 20.

42. A carrier containing the computer program of claim 41, wherein the carrier is one of an electronic signal, an optical signal, a radio signal, or a computer readable storage medium.

Images