Method for protection against side-channel attacks

Abstract

Method for protection against side-channel attacks. This method comprises: - the generation (144) of an initialization vector, then - the production (146) of a new mask from the generated initialization vector and a secret key, - the masking (148) of data to be written to an internal cache using the newly constructed mask to obtain masked data, - the storage (150), in the same word of the internal cache, of the masked data and the generated initialization vector, - the unmasking of the masked data comprises: - the extraction (162) of the initialization vector contained in the word, - the reconstruction (164) of the mask from the extracted initialization vector and the secret key, then - the unmasking (166) of the masked data using the newly reconstructed mask. Fig. 2

Description

Title of the invention: Method for protection against side-channel attacks

[0001] The invention relates to a method of protection against side-channel attacks on an electronic computer. It also relates to an electronic computer for implementing this method.

[0002] Typically, electronic computers include an information storage medium, such as main memory, and a system-on-chip that executes instructions stored in this main memory to process data. The data is also generally stored in this main memory. Systems-on-chips are more commonly known by the acronym SOC (System-on-Chip). Such a system-on-chip generally includes one or more internal cache memories, a central processing unit, and one or more internal buses connecting the internal cache memory(ies) to the central processing unit.

[0003] The central processing unit is better known by the acronym CPU (“Central Processing Unit”).

[0004] To protect data transmitted between main memory and the system-on-chip, it is known to encrypt it. In this case, the data moved from main memory to the system-on-chip is decrypted at the input of the system-on-chip and then transmitted in clear text on the internal buses of the system-on-chip.

[0005] In this text, "plain text" means data that is not protected and is therefore directly usable without first being decrypted or unmasked.

[0006] It is very difficult to read data from the internal cache memory of a system-on-a-chip. On the other hand, it has been observed that the values ​​of the plaintext data that pass over the internal buses of the system-on-a-chip can be obtained quite easily by implementing a side-channel attack.

[0007] The invention aims to make such side-channel attacks more difficult. It therefore relates to a method for protecting an electronic computer comprising side-channel attacks.

[0008] - an information storage medium,

[0009] - a system-on-a-chip comprising:

[0010] - an internal cache memory divided into several words,

[0011] - a central processing unit capable of writing data into a memory word internal cache,

[0012] - an internal data bus through which the displaced words are transmitted between the internal cache memory and the information storage medium, the size of this bus being equal to the size of a word in the internal cache memory,

[0013] This process comprises the following steps:

[0014] a) the protection of data contained in a word which passes, via the internal bus, between the internal cache memory and the information storage medium, by executing, for each piece of data written into the internal cache memory by the central processing unit, the following operations:

[0015] - operation A): the construction of a new mask whose size, in number of bits, is equal to the number of bits of data to be written, then

[0016] - operation B): masking the data to be written using the new mask constructed to obtain hidden data, then

[0017] - operation C): recording the hidden data, and not the data to write unmasked, in a word from the internal cache memory then

[0018] - operation D): when this data needs to be moved to the storage medium information, the deposit on the internal bus of the complete word containing the masked data,

[0019] b) the unmasking of the masked data contained in a word,

[0020] in which:

[0021] - Operation A) of constructing a new mask comprises:

[0022] - the generation of a new initialization vector whose size, in number of bits, is half the number of bits of the new data to be written, then

[0023] - the production of the new mask from the newly generated initialization vector and a secret key, and by executing a cryptographic function,

[0024] - the operation C) of recording the hidden data in a memory word internal cache, includes the recording, in the same word of the internal cache memory, of the initialization vector using which this masked data was obtained, and the absence of recording in the internal cache memory of the new full mask produced,

[0025] - step b) of unmasking comprises the following operations:

[0026] - operation E): extraction of the initialization vector contained in the word,

[0027] - operation F): the reconstruction of the mask whose size, in number of bits, is equal to the number of bits of the data to be unmasked from the extracted initialization vector and the secret key, and by executing the same cryptographic function as that used in operation A), then

[0028] - operation G): unmasking the masked data using the new mask thus reconstructed to obtain the unmasked data.

[0029] Embodiments of this process may include one or more of the following features:

[0030] 1) During operation A), the production of the new mask is carried out, in addition, to starting from at least part of the physical address of the data to be written.

[0031] 2) During operation A), the production of the new mask is carried out, in addition, at starting from one or more of the values ​​belonging to the group formed:

[0032] - of a value that varies depending on the process being executed by the system on chip,

[0033] - of metadata contained in the same word as that which contains the data to to hide, this metadata being contained in a bit range distinct from the bit range of this word containing the data to be hidden, and

[0034] - of a value encoded by bits associated with the address of the data to be masked, these bits being different from the bits encoding the address of the data to be masked.

[0035] 3) The process comprises:

[0036] - just before recording data on the information storage medium:

[0037] - the execution of step b) to unmask the masked data contained in the word which was transmitted via the internal data bus, thus obtaining unmasked data, and

[0038] - the encryption of the unmasked data, to obtain encrypted data, then

[0039] - the recording, on the information storage medium, of this encrypted data without saving on this medium the initialization vector used to unmask this data, and then later

[0040] - after loading the encrypted data from the storage medium information and before this data is moved via the internal data bus:

[0041] - decrypting the encrypted data recorded on the storage medium of information, to obtain decrypted data, and

[0042] - masking the decrypted data, this masking comprising:

[0043] - the generation of a new initialization vector whose size, in number of bits, is half the number of bits in the decrypted data, then

[0044] - the production of a new mask from the new initialization vector generated from the same secret key and executing the same cryptographic function as those used in step a), then

[0045] - masking the decrypted data using the new mask produced for obtain hidden data, then

[0046] - the movement, via the internal data bus, of a word containing the hidden data and the initialization vector by which this hidden data was obtained, then

[0047] - the recording, in the internal cache memory, of this displaced word containing the hidden data and the initialization vector by which this hidden data was obtained.

[0048] 4) The process comprises:

[0049] - the reading, by the central processing unit, of data in a word of the internal cache memory, and

[0050] - in response to this reading by the central processing unit:

[0051] - the reconstruction of the mask whose size, in number of bits, is equal to the number of bits of the data to be unmasked from the initialization vector contained in the word and the secret key, and by executing the same cryptographic function, then

[0052] - the transmission of the masked data and the produced mask to the central processing unit of treatment, then

[0053] - the execution, by the central processing unit, of a process on the masked data to obtain masked processed data and the same processing on the reconstructed mask to obtain a processed mask, then

[0054] - the execution of step a) of protection for the processed data by executing, in addition, between operations B) and C), an unmasking operation, using the processed mask, of the doubly masked processed data obtained at the end of operation B) to obtain the masked data recorded during operation C).

[0055] 5) The process comprises:

[0056] - the reading, by the central processing unit, of data in a word of the internal cache memory, and,

[0057] - only in response to this reading by the central processing unit:

[0058] - the execution of step b) to unmask the hidden data contained in this word, Then

[0059] - the transmission of the unmasked data obtained to the central processing unit.

[0060] 6) The cryptographic function includes a permutation function and a substitution function.

[0061] 7) Operation B) of masking data and operation G) of unmasking data Each masked data consists of performing an "Exclusive OR" operation between the data and the produced mask.

[0062] The invention also relates to an electronic computer for implementing the above method, this electronic computer comprising:

[0063] - an information storage medium,

[0064] - a system-on-a-chip comprising:

[0065] - an internal cache memory divided into several words,

[0066] - a central processing unit capable of writing data into a memory word internal cache,

[0067] - an internal data bus through which the displaced words are transmitted between the internal cache memory and the information storage medium, the size of this bus being equal to the size of a word in the internal cache memory,

[0068] - a first hardware module for masking data contained in a word which data transits, via the internal bus, between the internal cache memory and the information storage medium. This first hardware masking module is configured to execute the following operations for each piece of data written into the internal cache memory by the central processing unit:

[0069] - operation A): the construction of a new mask whose size, in number of bits, is equal to the number of bits of data to be written, then

[0070] - operation B): masking the data to be written using the new mask constructed to obtain hidden data, then

[0071] - operation C): recording the hidden data, and not the data to write unmasked, in a word from the internal cache memory then

[0072] - a first hardware unmasking module capable of unmasking the masked data contained in a word,

[0073] in which the internal cache memory is configured so that, when data needs to be moved to the information storage medium, it places the complete word containing the masked data onto the internal bus,

[0074] in which:

[0075] - Operation A) of constructing a new mask comprises:

[0076] - the generation of a new initialization vector whose size, in number of bits, is half the number of bits of the new data to be written, then

[0077] - the production of the new mask from the newly generated initialization vector and a secret key, and by executing a cryptographic function,

[0078] - the operation C) of recording the hidden data in a memory word internal cache, includes the recording, in the same word of the internal cache memory, of the initialization vector using which this masked data was obtained, and the absence of recording in the internal cache memory of the new full mask produced,

[0079] - the first hardware unmasking module is configured to run the The following operations:

[0080] - operation E): extraction of the initialization vector contained in the word,

[0081] - operation F): the reconstruction of the mask whose size, in number of bits, is equal to the number of bits of the data to be unmasked from the extracted initialization vector and the secret key, and by executing the same cryptographic function as that used in operation A), then

[0082] - operation G): unmasking the masked data using the new mask thus reconstructed to obtain the unmasked data.

[0083] Advantageously, the first hardware masking module and the first module Unmasking hardware is interposed between the central processing unit and the internal cache memory to mask each piece of data written by the central processing unit into the internal cache memory and to unmask each piece of data read from the internal cache memory by the central processing unit.

[0084] Preferably, the computer includes a second hardware masking module and a second hardware unmasking module interposed between the information storage medium and the internal bus, the second hardware unmasking module being capable of unmasking each data before it is recorded in the information storage medium and the second hardware masking module being capable of masking each data read in the information storage medium before it is deposited on the internal bus.

[0085] It also relates to an electronic calculator for the implementation of this process.

[0086] The invention will be better understood upon reading the following description, given solely by way of non-limiting example and made with reference to the drawings in which:

[0087] - Fig. 1 is a schematic illustration of the architecture of an electronic computer tronics;

[0088] - [Fig. 2] is a flowchart of a method for protection against attacks by auxiliary channels implemented in the electronic calculator of the [Fig.l];

[0089] - [Fig. 3] is a schematic illustration of the architecture of a generator masks implemented in the calculator of [Fig.1];

[0090] - [Fig. 4] is an illustration of the architecture of a word that circulates on buses implemented in the calculator of [Fig.1];

[0091] - [Fig. 5] is a flowchart of another embodiment of a process of side-channel attack protection that can be implemented in the computer of [Fig.1].

[0092] In the remainder of this description, the well-known characteristics and functions of a person skilled in the art are not described in detail.

[0093] In this description, detailed examples of embodiments are first described in Chapter I with reference to the figures. Then, in Chapter II, variants of these embodiments are presented. Finally, the advantages of the different embodiments are introduced in Chapter III.

[0094] Chapter I: Examples of embodiments

[0095] Figure 1 represents an electronic computer 1 comprising a system 2 on a chip and a set 4 of external components. For example, the computer 1 is the computer of a computer, a smartphone, an electronic tablet, or the like.

[0096] System 2 includes a main interconnection bus 6 which allows connection system 2 to the various external components of assembly 4. For this purpose, bus 6 is connected to input / output ports 7 of system 2. Bus 6 typically includes

[0097] - a data bus on which words are transmitted, and

[0098] - an address bus on which are transmitted the addresses to which these words must to be read or written.

[0099] Subsequently, to simplify the figures, only the data buses are shown.

[0100] By way of illustration, in this example embodiment, assembly 4 comprises the following components, each of which is connected to bus 6:

[0101] - an information storage medium 10,

[0102] - a mass storage device such as a Flash memory, and

[0103] - a device interface 16 that allows data exchange between the system 2 and one or more peripherals.

[0104] Bus 6 can also be connected to internal components of system 2. As an illustration, here, bus 6 is connected to a direct memory access controller 14, better known by the acronym DMA (“Direct Memory Access Controller”).

[0105] In this embodiment example, the support 10 is a volatile main memory in which data to be processed by system 2 are stored, as well as the instructions of one or more processes executed by system 2 to process this data.

[0106] System 2 is a semiconductor chip on which is implemented all the components necessary to execute the instructions stored on the medium 10 in order to process the data also stored on that same medium. Here, only the components of system 2 necessary to understand the invention are shown and described.

[0107] System 2 comprises:

[0108] - a central processing unit 20,

[0109] - two first hardware circuits 22 and 24 for protection against attacks by auxiliary channels,

[0110] - two internal cache memories 26 and 28,

[0111] - an internal cache memory of 30,

[0112] - a second hardware circuit 32 for protection against channel attacks auxiliaries, and

[0113] - a cryptographic hardware circuit 34 for encryption and decryption.

[0114] These different components of system 2 are connected to each other via internal data buses and address buses.

[0115] The central unit 20 typically comprises:

[0116] - a data input / output interface 42,

[0117] - an instruction loader 44 comprising a program counter 46,

[0118] - a queue 48 of instructions to be executed,

[0119] - an arithmetic and logic unit 50 capable of executing one after the other the ins instructions contained in queue 28,

[0120] - a set of 52 registers, and

[0121] - buses 54 which connect the various above elements of the central unit 20.

[0122] The interface 42 connects the central unit 20 to the protection circuit 22 via an internal data bus 60 to read and write data to the cache memory 26. Typically, the interface 42 transfers data between the register set 52 and the cache memory 26.

[0123] Bus 60 allows the transmission, in a single clock cycle, between the central processing unit 20 and the protection circuit 22, of a word Wj whose size Tw is greater than the size TD of a data Dj. In this text, the index j identifies the data Dj. Typically, the size Td is greater than 16 bits, 32 bits, or 64 bits. In this first embodiment, the size TD is equal to 64 bits.

[0124] As illustrated in [Fig.4], in this embodiment, the word Wj is divided into two successive ranges of bits:

[0125] - a 64-bit PD range that contains the bits encoding the data Dj, and

[0126] - a PC range intended to contain MCj metadata in plain text.

[0127] In this embodiment, the MCj metadata includes, in particular, an initialization vector ivj, which will be described later. The size Tiv of this initialization vector ivj is typically greater than 4 bits, 8 bits, or 16 bits. In this example, the size Tiv is 8 bits. Thus, the size Tw of the word Wj is greater than or equal to 72 bits.

[0128] The loader 44 is connected to the protection circuit 24 via an internal bus 62 to load instructions to be executed from the cache memory 28. More precisely, the loader 44 loads the instruction to which the program counter 46 points. For this purpose, the program counter 46 contains the address of the next instruction to be executed. The loader 44 records each loaded instruction, one after the other, in the queue 48.

[0129] Bus 62 is identical to bus 60. Thus, the size of the words carried on this bus 62 is equal to Tw.

[0130] The arithmetic and logic unit 50 executes instructions contained in queue 48 one after the other. The set of instructions executable by the arithmetic and logic unit 50 includes, in particular:

[0131] - load instructions, for example into one of the registers of the set 52, of data that is located at a specified address on the medium 10,

[0132] - instructions for writing data, for example currently present in one of the registers of set 52, at a specified address on medium 10, and

[0133] - data processing instructions that process data, for example contained in the set of 52 registers, and which record the result of this processing, for example, also in the set of 52 registers.

[0134] The cache memories 26, 28, and 30 form a two-level cache memory architecture that accelerates the transfer of data and instructions between the storage medium 10 and the central processing unit 20. The cache memories are ranked by read speed, with the first-level cache memory being the fastest. Furthermore, the size of the cache memories generally increases with the cache level. Thus, the size of the first-level cache memory is smaller than the size of the second-level cache memory. The first and second levels of cache memories are usually referred to as "L1" and "L2." Here, cache memories 26 and 28 are first-level cache memories, and cache memory 30 is a second-level cache memory. In this embodiment, cache memory 26 is used solely for storing data, while cache memory 28 is used solely for storing instructions.

[0135] The data and instructions stored on the medium 10 are recorded in encrypted form. To this end, the cryptographic circuit 34 encrypts each piece of data to be written to the medium 10 before it is placed on the bus 6. Conversely, the cryptographic circuit 34 decrypts each piece of data or instruction loaded from the medium 10 to obtain decrypted data or a decrypted instruction. Thus, after the cryptographic module 34, the data and instructions that pass through the internal buses of the system 2 are not encrypted.

[0136] For this purpose, the cryptographic circuit 34 includes an input / output port 64 connected to port 7 to receive encrypted data or instructions and, alternately, to deposit encrypted data onto bus 6. It also includes an input / output port 66 on which it delivers the decrypted data or instruction and, alternately, receives the plaintext data to be deposited onto bus 6.

[0137] To encrypt and decrypt the data and instructions stored on the medium 10, the cryptographic circuit 34 executes, for example, a predetermined symmetric encryption / decryption algorithm. It uses a secret key ki0 for this purpose. The encryption algorithm used can be a block cipher or a stream cipher. Generally, the cryptographic circuit 34 constructs a data line LDj containing the cryptogram Dj* of the data Dj. This data line LDj can also contain other information such as:

[0138] - an MAQ authentication code that allows verification of integrity and authenticity of the cryptogram Dj*,

[0139] - an ECCLj error detection code that allows verification of the integrity of the MAQ code and of the cryptogram Dj* and, if necessary, to correct the detected error.

[0140] Similarly, each instruction is generally recorded in an instruction line Llj. The structure of such an instruction line is, for example, identical to the structure of the data line LDj except that the cryptogram contained in this instruction line is the cryptogram of the instruction and not the cryptogram of a data element.

[0141] The protection circuits 22, 24, and 32 are designed to prevent a side-channel attack from revealing the values ​​of data and instructions transmitted on the internal buses of system 2, and in particular on the internal bus that connects the internal cache memories. To this end, circuits 22, 24, and 32 mask the data and instructions transmitted between memory 30 and cache memories 26 and 28. More specifically, here:

[0142] - Circuit 22 is configured to mask each piece of data written to memory cache 26 by the central processing unit 20 and to unmask each piece of data loaded by the central processing unit 20 from cache memory 26,

[0143] - Circuit 24 is configured to unmask each instruction loaded by the unit central 20 from cache memory 28, and

[0144] - Circuit 32 is configured to hide each data or instruction moved from the support 10 to cache memory 30 and to unmask each data moved from cache memory 30 to support 10.

[0145] To this end, the protection circuit 22 is interposed between the central processing unit 20 and the cache memory 26, and more specifically, between the interface 42 and the cache memory 26. Thus, all data moved between the central processing unit 20 and the cache memory 26 passes through the circuit 22. Here, the circuit 22 comprises:

[0146] - an input / output port 70 connected to the end of bus 60 opposite interface 42, And

[0147] - an input / output port 72 connected to an internal bus 74, the other end of which is connected to cache memory 26.

[0148] The size of bus 74 is identical to the size of bus 60.

[0149] The circuit 22 includes, in particular, a masking module 76 and a demasking module 78. Module 76 receives, via port 70, the data Dj to be masked, then masks this data to obtain a masked data DjM, and places the masked data DjM on bus 74 so that it is stored in cache memory 26. To this end, module 76 is capable of constructing a new mask Mj for each new data Dj to be masked.

[0150] Module 78 receives, via port 72, masked data DjM deposited on bus 74 by cache memory 26. In response, module 78 unmasks this masked data DjM and deposits the unmasked data Dj on bus 60.

[0151] Although represented in [Fig.1] as two separate blocks, modules 76 and 78 have common circuits and in particular a common circuit for constructing the mask Mj from the initialization vector ivj.

[0152] The protection circuit 24 is interposed between the central processing unit 20 and the cache memory 28, and more specifically, between the loader 42 and the cache memory 28. Thus, any instruction moved from the cache memory 28 to queue 48 first passes through circuit 24. Here, circuit 24 comprises:

[0153] - an input / output port 80 connected to the end of bus 62 opposite the charger 44, And

[0154] - an input / output port 82 connected to an internal bus 84, the other end of which is connected to cache memory 28.

[0155] The size of bus 84 is identical to the size of bus 62.

[0156] The circuit 24 includes a demasking module 88 identical to the demasking module 78.

[0157] The protection circuit 32 is interposed between port 66 of the cryptographic circuit 34 and the cache memory 30. For this purpose, it comprises:

[0158] - an input / output port 90 connected to the end of an internal bus 92, the other one end is connected to port 66 of cryptographic circuit 34, and

[0159] - an input / output port 94 connected to the end of an internal bus 98, the other end is connected to cache memory 30.

[0160] The size of buses 92 and 98 is equal to the size Tw.

[0161] The circuit 32 includes a masking module 106 and a demasking module 108 identical, respectively, to the masking module 76 and the demasking module 78.

[0162] In [Fig.1], the internal buses which connect the cache memory 30 to the cache memories 26 and 28 bear, respectively, the references 110 and 112.

[0163] The operation of computer 1 will now be described with reference to [Fig. 2]. Subsequently, only the steps that protect system 2 against side-channel attacks are described in detail. Otherwise, computer 1 operates in the usual manner.

[0164] In particular, the words Wj are moved between the support 10 and the cache memories 26, 28, and 30 so as to maximize the probability that the next word Wj to be loaded by the central processing unit 20 is already in the cache memory 26 or 28 before the loading of that word Wj is triggered by the execution by the arithmetic and logic unit 50 of a load instruction. This speeds up the loading of that data or instruction. If the word Wj cannot be found in the In cache memory 26 or 28, the probability that it is located in cache memory 30 is also maximized, again to accelerate the loading of this word Wj to the central processing unit 20. In other words, cache management is organized to minimize the occurrence of a cache miss. A cache miss is more commonly known as a "cache miss." Many mechanisms for managing caches 26, 28, and 30 are known. Furthermore, the protection method described below works regardless of the cache management mechanism implemented. Thus, this mechanism for managing caches 26, 28, and 30 is not described in detail.

[0165] Similarly, the recording of encrypted data and instructions on the medium 10 works in a known manner and is therefore not described in detail.

[0166] Finally, and also in a manner known per se, during the execution of a process, an identifier for that process is generated. This process identifier uniquely identifies the process to be executed among the various processes that can be executed by computer 1. Such a process identifier is known by the acronym ASID (Address Space Identifier). Hereafter, this process identifier is therefore referred to as the "ASID identifier." The ASID identifier is usually used to prevent a process from accessing data pages reserved for another process. This ASID identifier is located within a range of bits in the address of the data Dj to be moved between the memories of computer 1.

[0167] Initially, during a phase 120, a secret key kp is stored in the protection circuits 22, 24, and 32. For example, the key kp is loaded each time the execution of a new process is triggered. Thus, here, the key kp varies depending on the process to be executed. In this example, the size of the key kp is 128 bits.

[0168] Then, during a phase 130, the central processing unit 20 executes a process and, for this purpose, instructions and data are moved between the support 10 and the cache memories 26, 28, and 30 and the central processing unit 20. Typically, the loader 44 loads the instructions of the process to be executed one after the other into the queue 48, and then the arithmetic and logic unit 50 executes the instructions loaded into this queue 48. To load an instruction, the loader 44 places the address contained in the program counter 46 onto an address bus. In response, if the instruction to be loaded is already in the cache memory 28, it is immediately placed on the bus 82. Conversely, if the instruction to be loaded is not in the cache memory 28, it is moved to the cache memory 28 before being placed on the bus 84. In the latter case:

[0169] - if the instruction to be loaded is in cache memory 30, it is moved from the cache memory 30 to cache memory 28 via bus 112, or

[0170] - if the instruction to be loaded is also not found in cache memory 30, it is successively moved from support 10 to cache memory 30 via bus 6, cryptographic circuit 34 and internal buses 92 and 98, then from cache memory 30 to cache memory 28 via bus 112.

[0171] During its passage through the cryptographic circuit 34, the cryptogram Im* of the instruction Im to be loaded is decrypted, then the plaintext instruction Im is transmitted and placed on bus 92. The index m is an identifier of the instruction Im. Thus, before the cryptographic circuit 34, the instructions are encrypted, while after the cryptographic circuit 34, the instructions are in plaintext.

[0172] In this example, instructions are never moved from the central processing unit 20 to the cache memories 28, 30 and to the support 10.

[0173] If the instruction executed by the central processing unit 20 is a data loading instruction Dj, the address @j of the data Dj to be loaded is placed on an address bus. In response, if the data to be loaded is already in cache memory 26, it is immediately placed on bus 74. Conversely, if the data Dj to be loaded is not already in cache memory 26, it is moved to cache memory 26 before being placed on bus 74. In this case, as previously described for an instruction Im, there are two possible scenarios depending on whether the data to be loaded is already in cache memory 30 or not.

[0174] If the instruction executed by the central processing unit 20 is an instruction to write data Dj to storage 10, the address @j where this data is to be written is placed on the address bus and the data Dj is placed on the bus 60. Typically, the data Dj is then first stored in cache memory 26. Then, the cache management mechanism selects, according to predefined rules, the data from cache memory 26 to be moved to cache memory 30 and the data from cache memory 30 to be moved to storage 10. When data is moved from cache memory 26 to cache memory 30, it travels via the internal bus 110. When data is moved from cache memory 30 to storage 10, it travels via bus 6.

[0175] When a data Dj is moved from cache memory 30 to storage 10, it passes through the cryptographic circuit 34. During this passage, the data Dj is encrypted and its cryptogram Dj* is incorporated into a line LDj. Then, the line LDj is recorded in storage 10 at address @j.

[0176] In parallel, during a phase 140, circuits 22, 24 and 32 protect the data and instructions moved on the internal buses of system 2 against side-channel attacks.

[0177] To this end, in step 142, module 76 masks each piece of data Dj moved from the central processing unit 20 to the cache memory 26. For this purpose, it constructs a new mask Mj whose size TM, in number of bits, is equal to the size TD of the data Dj.

[0178] More precisely, during an operation 144, module 76 generates a new initialization vector ivj. For example, here, the initialization vector ivj is randomly generated. The size Tiv of this initialization vector ivj is half the size Td of the data Dj to be masked, and preferably eight or sixteen times smaller than the size TD. Here, as previously indicated, in this embodiment, the size Tiv is equal to 8 bits.

[0179] Then, during operation 146, module 76 produces the new mask Mj from the generated vector ivj. To ensure that the statistical distribution of the values ​​in the produced mask Mj approximates the statistical distribution of a uniform law as closely as possible, the mask Mj is further produced here from information that varies depending on the process being executed, the value of the data Dj, and / or the address @j of the data Dj. Here, the mask Mj is also produced from:

[0180] - of the kp key,

[0181] - from the address @j of the data Dj, and

[0182] - of the ASID identifier.

[0183] The address @j and the ASID identifier are obtained from the memory management unit, better known by the acronym MMU ('Management Memory Unit'). The key kp is pre-registered in the protection circuit 22.

[0184] Here, to produce the new mask Mj, a 257-bit block, called state "S", is first constructed from the values ​​of the ivj5 vector of the key kp, the address @j, and the ASID. For example, the bits of the key kp, the ivj5 vector of the address @j, and the ASID are concatenated to obtain a first block of bits. This first block of bits is augmented by a constant pre-recorded in each of the protection circuits to obtain a second 257-bit block. Finally, the bits of this second block are swapped by implementing a predefined permutation to obtain state S. This permutation is hard-hardened and therefore executes in a single clock cycle. For example, this hard-hardened permutation is identical to one of the permutations of the DES (Data Encryption Standard) encryption / decryption algorithm.

[0185] Next, a cryptographic function Fc is applied to state S to maximize the entropy of the resulting mask Mj. Applying the function Fc to state S produces a state SD with higher entropy than state S. State SD is also a 257-bit block.

[0186] To this end, the function Fc is designed to propagate a one-bit change in state S. In other words, changing the value of a single bit in state S results in a change in several bits in state SD. For this purpose, the function Fc comprises a permutation function p() and a substitution function s(). The function p() swaps bits in state S and, preferably, swaps at least 50% or 60% of the bits in state S. The function s() replaces at least 50% or 70% of the bits in state S with other bits. For example, to achieve this, the function s() includes a pre-recorded lookup table that associates each initial set of m bits with a different set of m bits. The function Fc used in this embodiment is shown in [Fig. 3]. In this figure, the symbol " / " next to a number denotes the size of the data bus crossed by the symbol " / ". Thus, the symbol " / " next to the number "128" means that the size of the bus crossed by this symbol is equal to 128 bits.

[0187] In [Fig. 3], state S is represented by a rectangle containing the letter S. The function Fc has a first round Ri that receives state S as input and generates an intermediate state Sp as output. State Si is a 257-bit block. Round Ri is a hardware circuit that performs, among other things, permutations and substitutions of bits in state S to obtain state Si. For example, here, round Ri is identical to a round of the "Subterranean 2.0" cipher algorithm described in the article: J. Daemnen et al.: "The Subterranean 2.0 Cipher Suite," version of March 29, 2019. In particular, [Fig. 3] of this article describes a hardware circuit for implementing this round Rb. Round Ri has an input that receives state S and an input that receives a 33-bit block o. Block o is, for example, a predetermined and constant 33-bit block.

[0188] Next, the function Fc includes an absorption circuit "A" which substitutes the 128 predetermined bits of the intermediate state Si with the 128 bits of a data_in block to obtain a new intermediate state S2. In this example embodiment, the data_in block is constructed, by applying a predetermined algorithm, from the vector ivj and the address @j before executing the function Fc. For example, the positions of the 128 bits of the state Si to be replaced by the 128 bits of the data_in block are defined by the following relation: POS; = 124k+p mod(257), where:

[0189] - POSi is the position in the Si block of the bit to be replaced,

[0190] - i is an integer that varies from 0 to 127,

[0191] - if the index i belongs to the interval [0; 31], p = 0 and k = i,

[0192] - if the index i belongs to the interval [32; 63], p=l and k= i-32,

[0193] - if the index i belongs to the interval [64; 95], p=2 and k = i-64, and

[0194] - if the index i belongs to the interval [96; 127], p = 3 and k = i-96,

[0195] - the function mod(257) is the modulo function, that is, the function that returns the remainder of the Euclidean division of 124k+p by 257.

[0196] The bits of the intermediate state S2 are then provided as input to a new round R2 which outputs the state SD. Here, round R2 is identical to round Rb

[0197] After applying the function Fc to the S state to obtain the SD state, the mask Mj is obtained by extracting 128 bits, located at predetermined positions, from the SD state. The circuit that performs this extraction is designated by the letter E in [Fig. 3]. The Circuit E constructs the value of bit Z; located at position i in mask Mj using the following relation: Z; = s12(4k+P) + s |2(4k+P)- where:

[0198] - the index i varies from 0 to 63,

[0199] - Si2(4k+P) is the value of the bit located at position 124k+p mod(257) in the SD state,

[0200] - s_i2(4k+P) is the value of the bit located at position -124k+p mod(257) in the SD state,

[0201] - if the index i belongs to the interval [0; 31], p = 0 and k = i,

[0202] - if the index i belongs to the interval [32; 63], p = 1 and k = i-32, and

[0203] - the symbol "+" denotes the logical operation "OR".

[0204] Once the new mask Mj is constructed, during an operation 148, module 76 masks the data Dj with the mask Mj to obtain the masked data DjM. This operation is defined by the following relation: DjM = Dj XOR Mj, where the XOR symbol denotes the logical "exclusive or" operation.

[0205] During operation 150, module 76 stores the masked data DjM in cache memory 26. During this operation, the vector ivj used to construct the mask Mj is also stored in cache memory 26 in association with the masked data DjM. To do this, module 76 generates the word Wj, which contains the masked data DjM in the PD range and the vector ivj in the PC range. Thus, the word Wj stored in cache memory 26 contains, in addition to the masked data DjM, the vector ivj. The plaintext data Dj is not stored in memory 26. The mask Mj is also not stored in cache memory 26.

[0206] If, subsequently, the word Wj is moved by the cache management mechanism from cache memory 26 to cache memory 30, then, during step 154, the word Wj stored in cache memory 26 is placed on bus 110. Since this word Wj contains only the masked data DjM, only this masked data DjM is transmitted on bus 110. Furthermore, the masked data DjM is moved along with the vector ivj. Therefore, the word Wj stored in cache memory 30 contains only the masked data DjM and the vector ivj, and not the plaintext data Dj and the complete mask Mj.

[0207] If subsequently, the word Wj is moved by the cache memory management mechanism from cache memory 30 to support 10, then the word Wj passes successively through the unmasking module 108 and the cryptographic circuit 34.

[0208] During a step 160, module 108 unmasks the masked data DjM before transmitting it to the cryptographic circuit 34.

[0209] For this purpose, during an operation 162, module 108 extracts the vector ivj from the PC range of the word Wj.

[0210] Then, during operation 164, module 108 reconstructs the mask Mj from:

[0211] - the key kp,

[0212] - of the extracted vector ivj,

[0213] - from the address @j of the data Dj, and

[0214] - of the ASID identifier.

[0215] Operation 164 is identical to operation 146 except that it is executed by module 108. In particular, the same function Fc is used during operation 164.

[0216] Once the mask Mj is reconstructed, during an operation 166, the module 108 unmasks the masked data DjM. This operation is defined by the following relation: Dj = DjM XOR Mj.

[0217] During operation 168, module 108 generates a new word Wj and places it on bus 92 for transmission to the cryptographic circuit 34. This new word Wj contains the data Dj unmasked in the PD range. At this stage, for example, this new word Wj does not contain the vector ivj.

[0218] During a step 170, the cryptographic circuit 34 encrypts the data Dj contained in the received word Wj. For example, here, it constructs a data line LDj containing the cryptogram Dj* of the data Dj.

[0219] During a step 172, once the LDj line has been constructed, the cryptographic circuit 34 moves it to the support 10 via the bus 6.

[0220] During step 174, the LDj line is recorded on support 10.

[0221] Conversely, the cache memory management mechanism triggers the movement of a data Dj from support 10 to cache memory 30. In this case, during a step 180, the line LDj is transferred, via bus 6, from support 10 to cryptographic circuit 34.

[0222] During a step 182, the cryptographic circuit 34 decrypts the cryptogram Dj* contained in the line LDj to obtain the data Dj in plaintext.

[0223] Then, in a step 184, the plaintext data Dj is moved from the cryptographic circuit 34 to the protection circuit 32.

[0224] In step 186, the masking module 106 masks the data Dj using a new mask Mj to obtain the new masked data DjM. This step 186 is identical to step 142 except that operation 150 is replaced by an operation 188 of recording the word Wj containing the masked data DjM in cache memory 30 and not in cache memory 26.

[0225] Since the word Wj contains only the masked data DjM, when this word Wj is moved, via bus 110 from cache memory 30 to cache memory 26, only the masked data DjM passes over this bus 110. In addition, the vector ivj is also moved at the same time from cache memory 30 to cache memory 26. Therefore, the word Wj stored in cache memory 26 contains both the masked data DjM and the vector ivj which allows the mask Mj to be reconstructed.

[0226] In response to the execution by the arithmetic and logic unit 50 of an instruction to read the data Dj, during a step 190, the module 78 unmasks the data The masked data DjM is contained in the word Wj stored in cache memory 26. To do this, module 78 uses the vector ivj contained in the same word Wj as the one containing the masked data DjM. This step 190 is identical to step 160 except that operation 168 is replaced by an operation 192 during which the word Wj containing the plaintext data Dj is placed on bus 60 for transmission to the central processing unit 20.

[0227] Moving an instruction Im from storage 10 to the central processing unit 20 is done as described for a data Dj. A word Wm containing the instruction Im can be distinguished from a word Wj containing data based on the address @m of the instruction Im. For example, the address @m contains a bit indicating that the word Wm contains an instruction. This bit is generated by the memory management unit.

[0228] Figure 5 represents an embodiment of a data protection method in which the data does not appear in plain text on buses 60 and 92. This method is identical to the method of Figure 2 except for the following differences.

[0229] When moving a data Dj from cache memory 30 to storage 10, the order of the unmasking step 160 and the encryption step 170 is reversed. Thus, the data Dj does not appear in plaintext on bus 92. To achieve this, the positions of circuits 32 and 34 are swapped compared to what is shown in [Fig. 1]. In this case, the masked data DjM is first encrypted by the cryptographic circuit 34 to obtain a masked and encrypted data DjM*. The word Wj containing the masked and encrypted data DjM* and the vector ivj is then placed on bus 92 to be transmitted to circuit 32. Next, module 108 unmasks the masked and encrypted data DjM* to obtain the cryptogram Dj*. For this, for example, the encryption / decryption algorithm implemented by the cryptographic circuit 34 is a stream encryption / decryption algorithm ("stream ciffer" in English).Such an algorithm generates a ciphertext of bits from the key ki0 and then combines this ciphertext with the data to be encrypted to obtain the data's cryptogram. The operation of combining the ciphertext and the plaintext is an "exclusive OR" operation. This is why executing the encryption operation first and then the decryption operation yields the same result as executing the decryption operation first and then the encryption operation.

[0230] Similarly, to prevent the data Dj from being transmitted in clear text on bus 60, step 190 is replaced by step 200 and step 142 is replaced by step 202.

[0231] Step 200 is identical to step 190 except that unmasking operation 166 is omitted and operation 192 is replaced by operation 204. During operation 204, the masked data DjM and the reconstructed mask Mj are both transmitted to the central unit 20.

[0232] Next, during phase 130, the central unit 20 performs a processing operation on the data masked data DjM is processed to obtain masked data DjMt. This processing results from the execution of one or more instructions loaded by loader 44, which modify the masked data DjM. In parallel, during phase 130, the central processing unit 20 executes the same processing on the reconstructed mask Mj to obtain a processed mask M / .

[0233] During step 202, the central processing unit 20 moves the masked and processed data DjMt and the processed mask M / into the cache memory 26. It is noted that the mask M / cannot be reconstructed from a vector ivj as was the case for the mask Mj before processing. Therefore, it is not possible to directly store in the cache memory 26 the masked and processed data DjMt associated with an initialization vector that allows the reconstruction of the mask Mj'. To circumvent this difficulty, step 202 is identical to step 142 except that an additional unmasking operation 206 is introduced between operations 148 and 150.

[0234] Here, during step 202, module 76 first executes operations 144, 146, and 148 to mask the masked and processed data DjMt with a new mask Mj constructed using a newly generated vector ivj. A doubly masked data DjMtM is then obtained as a result of operation 148.

[0235] During operation 206, module 76 unmasks the doubly masked data Dj MtM with the mask Mj' and obtains the masked data DjM. Then, operation 150 is executed to save the masked data DjM and the vector ivj in cache memory 26.

[0236] Chapter II: Variants:

[0237] Variants in the production of mask M; :

[0238] Other embodiments are possible for producing the new mask Mj from the vector ivj. For example, state S can be established differently. In particular, state S can be established using the vector ivj5, the key kp, and only a part or none of the data chosen from the group constituted:

[0239] - of the ASID identifier,

[0240] - of the @j address of the data.

[0241] In another embodiment, if each data Dj is associated with an error detector or error corrector code, the value of this code can be integrated into the state S. Similarly, if the data Dj is associated with a message authentication code better known by the acronym MAC (“Message Authentication Code”), at least a part of this MAC code is integrated into the state S.

[0242] In another variant, only part of the address @j or only part of the ASID identifier is taken into account when producing the new mask Mj.

[0243] Alternatively, the kp key is not process-specific. For example, this kp key is common to several processes or to all processes that may be executed by system 2.

[0244] In a very simplified variant, the kp key is omitted and is not used to construct the new mask Mj.

[0245] In another embodiment, what has been previously described is implemented concurrently with a method for protection against pointer misuse. For example, this method for protection against pointer misuse is that described in US20210004456A1. As explained in detail in US20210004456A1, a pointer identifier IPj is associated with a piece of data Dj when it is manipulated using a pointer. For example, to this end, this IPj identifier is embedded in the PC range of each word Wj containing a piece of data Dj manipulated by a pointer. In this case, this IPj identifier can be used to construct the new mask Mj. For example, this IPj identifier is embedded in the state S.

[0246] In another simplified variant, the permutation of bits to obtain the state S may be omitted or be different from that defined in the DES encryption algorithm.

[0247] In the function Fc, the substitution function s() can be implemented differently. For example, instead of using a predefined lookup table, the series of m bits to be substituted by another series of m bits is calculated and not pre-recorded.

[0248] The data_in block can be constructed differently. For example, it can be constructed from one or more of the following: the ASID identifier, the kp key, the @j address of the data Dj, the ivj vector, or any other metadata associated with the data Dj, such as an IPj pointer identifier. Conversely, in a very simplified variant, the data_in block is a constant.

[0249] When the data_in block is constructed from the vector ivj5, it is not necessary to construct the state S from the vector ivj. Conversely, when the state S is constructed from the vector ivj5, then it is not necessary to construct the data_in block from this vector ivj.

[0250] Other embodiments of the cryptographic function Fc are possible. For example, in variants, the function Fc is a modified version of the AES (Advanced Encryption Standard) encryption algorithm. In this modified version, the number of rounds executed is only two or three and therefore much lower than the number of rounds usually executed when implementing such an encryption algorithm.

[0251] The function Fc need not be an invertible function. Thus, in variants, the function Fc is a hash function. In this case, the number of bits in the SD state can be less than the number of bits in the S state.

[0252] Variants of the generation of the vector ivi_;

[0253] The vector ivj can be generated differently. For example, in a rea ​​mode In a simplified version, a counter is incremented by a predetermined step each time a new ivj vector needs to be generated. The size of this counter is equal to the size Tiv. When the maximum value of this counter is reached, its value automatically resets to zero. The value of the new ivj vector is then constructed from the incremented value of this counter. For example, the value of the new ivj vector is equal to the value of this counter.

[0254] The vector ivj can also be generated by performing a random permutation or random substitution of one or more of the bits of a counter. The vector ivj can also be generated by performing right or left shifts of the bits of this counter.

[0255] The vector ivj can also be taken to be equal to a predetermined selection of bits from one or more of the MQ metadata contained in the PC range. For example, in one embodiment, the PC range contains an integrity label ETj that allows the integrity of the data Dj to be verified. Such an integrity label is, for example, an error-correcting code or an error-detecting code. In a more complex variant, the label ETj can also be an authentication code such as a MAC (Message Authentication Code). The vector ivj is then equal to a predetermined selection of bits from the label ETj. In this case, the bits of the vector ivj are used to perform two different functions, namely, to produce the mask Mj and to verify the integrity of the data Dj. This embodiment is advantageous in that it avoids storing the vector ivj and the label ETj separately in the PC range.

[0256] In another embodiment, if the data line LDj stored in the medium 10 contains additional information besides the cryptogram of the data Dj, then the vector ivj can be generated by selecting, in a predetermined manner, a subset of the bits of this additional information. For example, if the process of application US20210004456A1 is implemented to construct the line LDj, this line LDj also contains an authentication code MACj. The vector ivj can then be constructed from a subset of the bits of this MACj code.

[0257] The vector ivj can also be generated from a part of the bits of the cryptogram Dj* of the data Dj recorded on the medium 10.

[0258] Module 76 can also generate the vector ivj from the vector ivj i used to unmask the last data D, । moved from cache memory 26 to central processing unit 20.

[0259] Variants of the computer architecture:

[0260] In alternative configurations, the protection circuit 32 is omitted. In this case, the data written by the central unit 20 onto the medium 10 remains masked, including when it is transmitted over the bus 6. In this case, the cryptographic circuit 34 can also be omitted since the data recorded on the medium 10 is masked and therefore already protected.

[0261] In alternative versions, the instructions are not masked within system 2. In this case, the protection circuit 24 is omitted. Thus, in the simplest embodiment, system 2 comprises only the protection circuit 22 and the cryptographic circuit 34 is also omitted.

[0262] Other embodiments of the cryptographic module 34 are possible. In particular, other encryption / decryption methods can be implemented.

[0263] The medium 10 can be any memory of a higher rank than the internal first-level cache memories. Thus, alternatively, the medium 10 is a lower-rank memory such as an L3 or L2 level cache memory. In this case, the protection circuits and the cryptographic circuit are placed upstream of this lower-rank memory than the main memory.

[0264] The number of cache memory levels may be less than two. In this case, cache 30 is omitted. The number of cache memory levels may also be greater than two. For example, an L3 cache may be added.

[0265] Cache memories higher than the L1 level cache memory can be external cache memories implemented outside of system 2.

[0266] The internal cache memory is not necessarily the lowest level cache memory, i.e. here the LL level cache memory. For example, in variants, the internal cache memory is the L2 level cache memory. In this case, the protection circuits 22 and 24 are interposed between the cache memories 26 and 28 and the cache memory 30.

[0267] Other variants:

[0268] In alternative versions, each word Wj additionally includes a PM range of bits intended to hold MPj metadata that can be masked. For example, this MPj metadata includes an error-correcting code that corrects an error in the Dj data. In this case, the size of the word Wj is equal to the sum of the sizes Td + TMC + TMP, where the sizes TMC and TMP are the sizes of the MQ and MPj metadata, respectively. In this alternative version, the protection circuits are configured to generate a mask Mj whose size allows both the Dj data and the MPj metadata to be masked / unmasked. Thus, in this embodiment, the size TM of the mask Mj is equal to the sum of the TD and TMP sizes. Therefore, in such an embodiment, the MPj metadata is also protected against side-channel attacks in the same way as the Dj data.To obtain a larger mask Mj, it is sufficient, for example, to increase the number of bits extracted from the state S. D*

[0269] Several of the variants described above can be combined in the same embodiment.

[0270] Chapter III: Advantages of the embodiments described:

[0271] Masking the data transmitted on the internal bus of system 2 makes side-channel attacks more difficult because the data is masked, and the mask Mj needed to unmask it cannot be easily reconstructed from the vector ivj alone. Furthermore, this mask Mj changes each time the data Dj is loaded into the caches of system 2 for the first time. Storing only the vector ivj used to reconstruct the mask Mj in the internal caches, and not the complete mask Mj, limits the memory space required to store this mask Mj. Thus, the memory space needed to implement this method remains limited.

[0272] Generating the new mask Mj from the address @j of the data Dj to be masked or unmasked increases the variability of the masks produced. This therefore improves protection against side-channel attacks.

[0273] Producing the new mask Mj in addition from values ​​of the ASID identifier and / or MPj metadata increases the variability of the mask Mj and thus improves protection against side-channel attacks.

[0274] Unmasking the masked data DjM just before saving it to storage 10 and then encrypting it limits the memory space used. Indeed, in such a case, it is not necessary to save the vector ivj to storage 10.

[0275] The fact that the Dj data is processed by the central processing unit 20 in masked form increases security because even within this central processing unit 20, the data is protected. Furthermore, this makes side-channel attacks more difficult because the data is masked even on bus 60.

[0276] Unmasking the masked data DjM only in response to its reading from cache memory 26 by the central processing unit 20 allows, using only the protection circuit 22, the written data to be protected against side-channel attacks and ensures the confidentiality of this data when it is subsequently moved to higher-level memories. Indeed, regardless of the higher-level memory, in such a case, in the absence of unmasking, the data is stored there in masked form.

[0277] Using the composition of at least one permutation p() and at least one substitution s() to generate the mask Mj maximizes the entropy of this mask and thus makes side-channel attacks more difficult.

Claims

Demands

1. A method for protecting an electronic computer comprising: - an information storage medium, - a system-on-a-chip comprising: - an internal cache memory divided into several words, - a central processing unit capable of writing data into a word of the internal cache memory, - an internal data bus through which words are moved between the internal cache memory and the information storage medium, the size of this bus being equal to the size of a word in the internal cache memory, this process comprising the following steps: a) the protection (140) of data contained in a word which passes, via the internal bus, between the internal cache memory and the information storage medium, by executing, for each piece of data written into the internal cache memory by the central processing unit, the following operations: - Operation A): constructing a new mask whose size, in number of bits, is equal to the number of bits of the data to be written, then - Operation B): masking (148) the data to be written using the newly constructed mask to obtain masked data, then - Operation C): storing (150) the masked data, and not the unmasked data to be written, in a word of the internal cache memory, then - operation D): when this data needs to be moved to the information storage medium, the deposit (154) onto the internal bus of the complete word containing the masked data, b) the unmasking (160, 190) of the masked data contained in a word, characterized in that: - Operation A) of constructing a new mask includes: - the generation (144) of a new initialization vector whose size, in number of bits, is half the number of bits of the new data to be written, then - the production (146) of the new mask from the newly generated initialization vector and a secret key and by executing a function

2.

3.

4. cryptographic, - operation C) of recording (150) the masked data in a word of the internal cache memory, includes recording, in that same word of the internal cache memory, the initialization vector by means of which this masked data was obtained and the absence of recording in the internal cache memory of the new full mask produced, - Step b) of unmasking includes the following operations: - operation E): the extraction (162) of the initialization vector contained in the word, - operation F): the reconstruction (164) of the mask whose size, in number of bits, is equal to the number of bits of the data to be unmasked from the extracted initialization vector and the secret key and by executing the same cryptographic function as that used during operation A), then - operation G): unmasking (166) the masked data using the newly reconstructed mask to obtain the unmasked data. A method according to claim 1, wherein, during operation A), the production (146) of the new mask is also carried out from at least a part of the physical address of the data to be written. A method according to any one of the preceding claims, wherein, during operation A), the production (146) of the new mask is carried out, in addition, from one or more of the values ​​belonging to the group constituted: - a value that varies depending on the process being executed by the system-on-chip, - metadata contained in the same word as the one containing the data to be masked, this metadata being contained in a bit range distinct from the bit range of that word containing the data to be masked, and - a value coded by bits associated with the address of the data to be hidden, these bits being different from the bits encoding the address of the data to be hidden. A method according to any one of the preceding claims, wherein the method comprises: - just before data is saved to the information storage medium: - execution of step b) (160) to unmask the hidden data

5. contained in the word that passed through the internal data bus, thus obtaining unmasked data, and - the encryption (170) of the unmasked data, to obtain encrypted data, then - the recording (174), on the information storage medium, of this encrypted data without recording on this medium the initialization vector used to unmask this data, and then subsequently - after loading the encrypted data from the information storage medium and before moving this data via the internal data bus: - the decryption (182) of the encrypted data recorded on the information storage medium, to obtain decrypted data, and - the masking (186) of the decrypted data, this masking comprising: - the generation (144) of a new initialization vector whose size, in number of bits, is half the number of bits of the decrypted data, then - the production (146) of a new mask from the newly generated initialization vector and from the same secret key and by executing the same cryptographic function as those used in step a), then - masking (148) the decrypted data using the new mask produced to obtain masked data, then - the movement, via the internal data bus, of a word containing the masked data and the initialization vector by which this masked data was obtained, then - the recording, in the internal cache memory, of this moved word containing the masked data and the initialization vector with which this masked data was obtained. A method according to any one of the preceding claims, wherein the method comprises: - the reading, by the central processing unit, of data from a word in the internal cache memory, and - in response to this reading by the central processing unit: - the reconstruction (164) of the mask whose size, in number of bits, is equal to the number of bits of the data to be unmasked from the initialization vector contained in the word and the secret key and by executing the same cryptographic function, then - the transmission (204) of the masked data and the produced mask to the central processing unit, then - the execution (130), by the central processing unit, of a process on the masked data to obtain masked processed data and of the same process on the reconstructed mask to obtain a processed mask, then - the execution of step a) of protection for the processed data by executing, in addition, between operations B) and C), an operation (206) of unmasking, using the processed mask, of the doubly masked processed data obtained at the end of operation B) to obtain the masked data recorded during operation C).

6. A method according to any one of claims 1 to 3, wherein the method comprises: - reading, by the central processing unit, data in a word of the internal cache memory, and, - only in response to this reading by the central processing unit - the execution of step b) (190) to unmask the masked data contained in this word, and then - the transmission of the unmasked data obtained to the central processing unit.

7. A method according to any one of the preceding claims, wherein the cryptographic function comprises a permutation function and a substitution function.

8. A method according to any one of the preceding claims, wherein operation B) of masking data and operation G) of unmasking masked data each consists of performing an "Exclusive OR" operation between the data and the produced mask.

9. An electronic computer for implementing a method according to any one of the preceding claims, this electronic computer comprising: - an information storage medium (10), - a system (2) on a chip comprising: - an internal cache memory (26, 30) divided into several words, - a central processing unit (50) capable of writing data into a word of the internal cache memory, - an internal data bus (110) through which words are moved between the internal cache memory and the information storage medium, the size of this bus being equal to the size of a word of the internal cache memory, - a first hardware module (76) for masking data contained in a word which passes, via the internal bus, between the internal cache memory and the information storage medium, this first hardware module (76) for masking being configured to execute, for each piece of data written into the internal cache memory by the central processing unit, the following operations: - Operation A): constructing a new mask whose size, in number of bits, is equal to the number of bits of the data to be written, then - Operation B): masking the data to be written using the newly constructed mask to obtain masked data, then - operation C): the recording of the masked data, and not the unmasked data to be written, in a word of the internal cache memory, then - a first hardware unmasking module (78) capable of unmasking the masked data contained in a word, in which the internal cache memory is configured to, when data needs to be moved to the information storage medium, place the complete word containing the masked data onto the internal bus, characterized in that: - Operation A) of constructing a new mask includes: - the generation of a new initialization vector whose size, in number of bits, is half the number of bits of the new data to be written, then - the production of the new mask from the newly generated initialization vector and a secret key, and by executing a cryptographic function, - Operation C) of recording the masked data in a word of the internal cache memory, includes recording, in that same word of the internal cache memory, the initialization vector by which this masked data was obtained and the absence of recording in the internal cache memory of the new complete mask produced, - The first hardware unmasking module (78) is configured to perform the following operations: - operation E): extraction of the initialization vector contained in the word, - operation F): reconstruction of the mask whose size, in number of bits, is equal to the number of bits of the data to be unmasked, from the extracted initialization vector and the secret key, and by executing the same cryptographic function as that used in operation A), then - operation G): unmasking the masked data using the newly reconstructed mask to obtain the unmasked data.

10. Calculator according to claim 9, wherein the first hardware masking module (76) and the first hardware unmasking module (78) are interposed between the central processing unit (50) and the internal cache memory (26) to mask each data written by the central processing unit into the internal cache memory and to unmask each data read from the internal cache memory by the central processing unit.

11. Computer according to claim 10, wherein the computer comprises a second hardware masking module (106) and a second hardware unmasking module (108) interposed between the information storage medium and the internal bus (110), the second hardware unmasking module (108) being capable of unmasking each data before it is recorded in the information storage medium and the second hardware masking module (106) being capable of masking each data read in the information storage medium before it is deposited on the internal bus.

Images