Method for determining the arithmetic integrity sum of a data sequence, associated electronic device and computer program

Abstract

A method for determining an arithmetic integrity sum of a first sequence (C) of at least one first data point, the arithmetic integrity sum being formed of k bits and the value of each first data point being equal to the result of applying an arithmetic operation between a second data point selected from a second sequence (A) of at least one second data point and a third data point selected from a third sequence (B) of at least one third data point, said method comprising a step of determining the arithmetic integrity sum from an integrity sum of the second sequence (A) and an integrity sum of the third sequence (B) by calculating the arithmetic integrity sum as follows: . Figure for the abstract: Fig. 2.

Description

Title of the invention: Method for determining an arithmetic integrity sum of a data sequence, associated electronic device and computer program

[0001] The present invention relates to a method for determining an arithmetic integrity sum, as well as an associated computer program and electronic device.

[0002] Secure electronic devices are designed to make any intrusion into their operation almost impossible, but it is preferable to check that the calculations they perform, in particular arithmetic calculations, are complete, i.e. not altered.

[0003] A first solution consists of verifying the absence of fault in a calculation by repeating the calculation and comparing the results obtained for each iteration.

[0004] A second solution consists of verifying the absence of fault in a calculation, by seeking to find the initial data by applying an inverse algorithm.

[0005] However, these solutions double the calculation time and require doubling the implementation, in particular to protect against double fault attacks which inject the same error, which consumes memory of the electronic device.

[0006] To overcome these drawbacks, the present invention proposes, according to a first aspect, a method for determining an arithmetic integrity sum Tc of a first sequence of at least one first data item, the arithmetic integrity sum Tc being formed of a predetermined number of bits k and the value of each first data item being equal to the result of the application of an arithmetic operation * between a second data item selected in a second sequence of at least one second data item and a third data item selected in a third sequence of at least one third data item, the second selected data item and the third selected data item each having the same rank in the second and third sequences as the first data item concerned, said method being implemented within an electronic device and comprising the following step: - determination of the arithmetic integrity sum Tc from an integrity sum TA of the second sequence and an integrity sum TB of the third sequence by calculating the arithmetic integrity sum Tc as follows: Tc = ( ( (Ta - L ) * ( Tb - L ) ) + L) mod N • and in which - the arithmetic operation is an addition or a subtraction or a multiplication, - L is an initialization data, and - N is a prime number whose value is between 2k 1 and 2k.

[0007] The method according to the first aspect may also comprise the following optional features, taken alone or in combination whenever technically possible.

[0008] The predetermined number of bits k is strictly less than the size of each data item of the first sequence, the second sequence and the third sequence.

[0009] The predetermined number of bits k is strictly greater than 3.

[0010] The initialization data has a non-zero value.

[0011] The method further comprises the following steps: - determination of a new integrity sum Sc of the first sequence from at least one first data item of the first sequence, - comparison of the new integrity sum Sc of the first sequence with the arithmetic integrity sum T c of the first sequence, and if the value of the new integrity sum Sc of the first sequence is different from the value of the arithmetic integrity sum T c of the first sequence, implementation of a security treatment.

[0012] In a first embodiment: - the first sequence, the second sequence and the third sequence have the same length n strictly greater than 1, - the integrity sum TA of the second sequence is equal to the sum of the initialization data L and a result of the application of the arithmetic operation * between n first corrected integrity sums TC^j, ..., TCeach first corrected integrity sum having a value as follows: for all p ranging from 1 to n, TCnwd N where T^p is an integrity sum of the second data of rank p in the second sequence and J is an initialization data of the second data of rank p, and - the integrity sum TB of the third sequence is equal to the sum of the initialization data L and a result of applying the arithmetic operation * between n second corrected integrity sums TCB\, ..., TCq^, each second corrected integrity sum having a value as follows: for all p ranging from 1 to n, TCÿp- (T Bp- JBp) mod N where T bp is an integrity sum of the third data of rank p in the third sequence and JBp is an initialization data of the third data of rank p.

[0013] Other advantageous and non-limiting characteristics of the method according to this first embodiment, taken individually or in all technically possible combinations, are the following: the method further comprises a step of determining the integrity sum T'a of the second sequence by reading a memory of the electronic device or by calculation from the integrity sums of the second data and the initialization data associated with said second data, typically by applying the arithmetic operation * between the n first corrected integrity sums TC^, ..., TC^, each first corrected integrity sum being calculated as follows: for all p ranging from 1 to n, TC^p = (T^p- J ^.p) mod N; the method further comprises a step of determining the integrity sum 7g of the third sequence by reading a memory of the electronic device or by calculation from the integrity sums of the third data and the initialization data associated with said third data, typically by applying the arithmetic operation * between the n second corrected integrity sums TC^ ..., TCgM, each second corrected integrity sum being calculated as follows: for any p ranging from 1 to n, T \ . ; TCBp = (rBp - JBpj mod A each integrity sum of a second data has a value as follows: for all p ranging from 1 to ”, y = (ap+J jy where is the second data of rank p in the second sequence, and each integrity sum of a third data has a value as follows: for all p ranging from 1 to n,TB = (b +J ) mod N where is 'a third data of rank p in the third sequence; the method further comprises a step of determining each integrity sum of a second data item, preferably by reading a memory of the electronic device, or by calculation from the second data item and the associated initialization data item as follows: for any p ranging from 1 to n, T a# = (Ap + J a,J tmd N ' the method further comprises a step of determining each integrity sum of a third data item, preferably by reading a memory of the electronic device or by calculating from the third data item and the associated initialization data item as follows: for any p ranging from 1 to n, TBp = {Bp + JB^ mod N; the method further comprises the following steps: • determination of the “first corrected integrity sums TC^[, • determination of a first other integrity sum UA of the second sequence equal to the sum of the initialization data L and a result of the application of another arithmetic operation between the first n corrected integrity sums TC..., TCAjv then • determination of a second other integrity sum VA of the second sequence equal to the sum of the initialization data L and a result of the application of the arithmetic operation * between the first n corrected integrity sums TC..., TCA / r • comparison of the second other integrity sum VA of the second sequence with the integrity sum TA of the second sequence, and if the value of the second other integrity sum VA of the second sequence is different from the value of the integrity sum TA of the second sequence, implementing a security processing, and the other arithmetic operation is an operation different from the arithmetic operation * among addition, subtraction and multiplication; the second other integrity sum of the second sequence is formed of k bits and the first other integrity sum of the second sequence is formed of k' bits, k' being a non-zero positive integer which can have the same value as k; the method further comprises the following steps: • determination of n third corrected integrity sums TCc± TCc„ each third corrected integrity sum having a value as follows: for all p ranging from 1 to n, T Ce p = ( Te p - Jc ) mod N where T is an integrity sum of the first data of rank p in the first sequence and JCp is an initialization data of the first data of rank p, • determination of a first other integrity sum Uc of the first sequence equal to the sum of the initialization data L and a result of the application of a new arithmetic operation between the n third corrected integrity sums TC..., Then • determination of a second other integrity sum Vc of the first sequence equal to the sum of the initialization data L and of a result of the application of the arithmetic operation * between the n third corrected integrity sums TCçn, • comparison of the second other integrity sum Vc of the first sequence with the arithmetic integrity sum Tc of the first sequence, and if the value of the second other integrity sum Vc of the first sequence is different from the value of the arithmetic integrity sum Tc of the first sequence, implementing a security processing, and the new arithmetic operation is an operation different from the arithmetic operation * among addition, subtraction and multiplication; the second other integrity sum of the first sequence is formed of k bits and the first other integrity sum of the first sequence is formed of k” bits, k” being a non-zero positive integer which can have the same value as k and / or k'; the first data are the coefficients of a first polynomial, the second data are the coefficients of a second polynomial and the third data are coefficients of a third polynomial; the step of determining a new integrity sum Sc is by calculating the new integrity sum Sc by summing the initialization data L and a result of applying the arithmetic operation * between n third corrected integrity sums TCqi, ..., TCCn, each third corrected integrity sum having a value as follows: for all p ranging from 1 to n, j,£, _ jj °ù Tc.p is an integrity sum of the first data of rank p in the first sequence and JCp is an initialization data of the first data of rank p; the step of determining a new integrity sum Sc further comprises calculating each integrity sum of a first data item as mod N where Cp is the first data of rank p in the first sequence.

[0014] In a second embodiment: - the first sequence, the second sequence and the third sequence have the same length n equal to 1, and - the integrity sum TA of the second sequence has a value as follows: = (A] + Z.) mod N °where is the second data in the second sequence, and follows: for all p ranging from 1 to n, + jc j - the integrity sum TB of the third sequence has a value as follows: mod N °ù ®t is the third data in the third sequence.

[0015] An advantageous and non-limiting characteristic of the method according to this second embodiment, taken individually or according to all technically possible combinations, is the following: - the step of determining a new integrity sum Sc calculates the new integrity sum Sc as follows: $ _ mod where Ci is the first data in the first sequence.

[0016] The invention also proposes, according to a second aspect, a computer program comprising instructions executable by a processor and adapted for the implementation of a method for determining an arithmetic integrity sum of a first sequence of at least one first data item as defined previously, when these instructions are executed by the processor.

[0017] The invention also proposes, according to a third aspect, an electronic device comprising means adapted for implementing a method for determining an arithmetic integrity sum as defined previously.

[0018] This electronic device can be configured to implement each of the embodiment possibilities envisaged for the method of determining an arithmetic integrity sum of a first sequence of at least one first data item as defined previously.

[0019] Other characteristics and advantages of the present invention will emerge from the description given below, with reference to the appended figures which illustrate exemplary embodiments thereof which are not in any limiting nature.

[0020] In the figures:

[0021] [Fig.l] schematically represents the main elements of an electronic entity within which the invention is implemented;

[0022] [Fig.2] represents examples of data sequences;

[0023] [Fig.3] represents in the form of a flowchart the main stages of a process of determination of an arithmetic integrity sum of a sequence of at least one data item according to a first mode of implementation of the invention;

[0024] [Fig.4] represents in the form of a flowchart the main stages of a process of determination of an arithmetic integrity sum of a sequence of at least one data item according to a second mode of implementation of the invention.

[0025] Unless otherwise indicated, elements common or similar to several figures bear the same reference signs and have identical or similar characteristics, so that these common elements are generally not described again for the sake of simplicity.

[0026] In the context of the present description, qualifiers “first”, “second”, “third”, “fourth” or “fifth” are only indicative to distinguish elements which they qualify, but do not imply an order between them.

[0027] [Fig.l] schematically represents an electronic device 2 comprising a processor 4 (for example a microprocessor), a storage module 6, a RAM 8 and a communication module 10.

[0028] The RAM 8 and the storage module 6 are each linked to the processor 4 so that the processor 4 can read or write data in the storage module 6 and / or the RAM 8.

[0029] The storage module 6 stores computer program instructions, some of which are designed to implement a method for determining an arithmetic integrity sum such as at least one of those described with reference to FIGS. 3 and 4, when these instructions are executed by the processor 4.

[0030] The storage module 6 is for example a hard disk or a non-volatile memory, possibly rewritable, for example of the EEPROM type (for "Electrically Erasable and Programmable Read-Only Memory" according to the commonly used English term).

[0031] The RAM 8 can for its part store at least some of the elements (in particular the integrity sums, the arithmetic integrity sums and / or the corrected integrity sums) manipulated during the various processing operations carried out during at least one of the methods described below.

[0032] In the remainder of the description, memory is any one of the storage module 6 and the RAM 8.

[0033] The electronic device 2 also comprises one or more blocks (not shown).

[0034] According to a first example, the electronic device 2 comprises a block for determining an arithmetic integrity sum.

[0035] According to a second example, the device further comprises a block for initializing integrity sums of second data and / or a block for initializing integrity sums of third data.

[0036] According to a third example, the device further comprises a block for determining an integrity sum of a second sequence and / or a block for determining an integrity sum of a third sequence.

[0037] According to a fourth example, the device further comprises a block for determining first corrected integrity sums, a block for determining a first other integrity sum of a second sequence, a block for determining a second other integrity sum of the second sequence and a block for comparing the second other integrity sum of the second sequence.

[0038] According to a fifth example, the device further comprises a block for determining third corrected integrity sums, a block for determining a first other integrity sum of a first sequence, a block for determining a second other integrity sum of the first sequence and a block for comparing the second other integrity sum of the first sequence.

[0039] According to a sixth example, the electronic device 2 comprises a block for determining a new integrity sum and a block for comparing the new integrity sum.

[0040] These blocks can in practice be realized by a combination of hardware elements and software elements.

[0041] Each block has a functionality described in the methods according to the invention and set out below. Thus, for each block, the electronic device 2 stores, for example, software instructions executable by the processor 4 of the electronic device 2 in order to use a hardware element (for example a communication interface or a memory) and thus implement the functionality offered by the block.

[0042] According to one possible embodiment, the computer program instructions stored in the storage module 6 have for example been received (typically from a remote computer) during an operating phase of the electronic device 2 prior to the methods described with reference to FIGS. 3 and 4.

[0043] The communication module 10 is connected to the processor 4 so as to allow the processor 4 to receive data from another electronic device (not shown) and / or to transmit data to another electronic device (not shown). In certain embodiments, the processor 4 can thus receive a data item m from the other electronic device and / or transmit other data, for example the first sequence of at least one first data item described with reference to FIGS. 2 to 4, to the other electronic entity.

[0044] Each figure among figures 3 and 4 represents a method for determining an arithmetic integrity sum in accordance with the invention.

[0045] Each of these methods is here implemented by the electronic device 2 (due to the execution of the computer program instructions stored in the storage module 6 as indicated above) and aims to calculate an arithmetic checksum, that is to say an arithmetic integrity sum, resistant to fault attacks and making it possible to effectively verify the integrity of an arithmetic calculation.

[0046] [Fig.2] represents examples of data sequences, typically examples of sequences A, B, C, D and E of data which can be the object and / or the result of an arithmetic calculation, typically of the arithmetic calculation whose integrity is to be ensured.

[0047] Thus, each of the methods described with reference to figures 3 and 4, aims to determine an arithmetic integrity sum resistant to fault attacks, of a first sequence C of at least one first data item C^ ..., Cn, the arithmetic integrity sum being formed of a predetermined number of bits k and the value of each first data item being equal to the result of the application of an arithmetic operation * between a second data item selected in a second sequence A of at least one second data item Ab ..., An and a third data item selected in a third sequence B of at least one third data item Bb ..., Bn, the second selected data item and the third selected data item each having the same rank in the second and third sequences A, B as the first data item concerned.

[0048] In other words, for any rank p ranging from 1 to n, Cp = Bp.

[0049] The number of bits k is a non-zero positive integer.

[0050] The number of bits k is preferably strictly greater than 3 and strictly less than the size of each data of the first, second and third sequences.

[0051] Furthermore, each of the methods described with reference to FIGS. 3 and 4 makes it possible to determine another arithmetic integrity sum of a fourth data sequence D of at least one fourth data Dx, D„, the other arithmetic integrity sum being formed of u bits.

[0052] The value of each fourth data item is equal to the result of applying the arithmetic operation * according to a first example, or another arithmetic operation 0 according to a second example, between a second selected data item from the second sequence A and a fifth selected data item from a fifth sequence E of at least one fifth data item E^, .... In, the second selected data item and the fifth selected data item each having the same rank in the second and fifth sequences as the fourth data item concerned.

[0053] In other words, in the first example for any rank p ranging from 1 to n, Dp = Ap* Ep^ and in the second example for any rank p ranging from 1 to n, Dp- Ap° Ep.

[0054] The value of each fourth data item is equal to the result of applying the arithmetic operation * according to a third example, or of a new arithmetic operation according to a fourth example, between a first selected data item from the first sequence C and a fifth selected data item from the fifth sequence E of at least one fifth data item E^ ..., En, the first selected data item and the fifth selected data item each having the same rank in the first and fifth sequences as the fourth data item concerned.

[0055] In other words, in the third example for any rank p ranging from 1 to n, Dp = Cp * Ep, and in the fourth example for any rank p ranging from 1 to n, Dp = Cp - Ep.

[0056] For example, the number u has the same value as the number k, typically for the first and third examples described above.

[0057] For the third and fourth examples, the number u is preferably strictly greater than 3 and strictly less than the size of each data item of the first, fourth and fifth sequences.

[0058] For the first and second examples, the number u is preferably strictly greater than 3 and strictly less than the size of each data item of the second, fourth and fifth sequences.

[0059] The number of data in a sequence is also called the length of said sequence.

[0060] In the examples illustrated [Fig.2], the sequences A, B, C, D and E have the same length n.

[0061] The length n is a positive integer with a non-zero value.

[0062] The arithmetic operation * is typically an addition or a subtraction or a multiplication.

[0063] The other arithmetic operation 0 is typically a different operation from the arithmetic operation * among addition, subtraction and multiplication.

[0064] The new arithmetic operation is typically a different operation from the arithmetic operation * among addition, subtraction, and multiplication. The new arithmetic operation may be the same operation as the other arithmetic operation 0.

[0065] According to a particular example, the length n is an integer strictly greater than 1 and the first data are coefficients of a first polynomial, the second data are coefficients of a second polynomial and the third data are coefficients of a third polynomial.

[0066] Thus, the arithmetic operation, and / or the other arithmetic operation, and / or the new arithmetic operation, of the method can be a multiplication and be used to apply a multiplication to NTT transformations of polynomials (“Number-theoretic transform” according to the commonly used English term).

[0067] [Fig.3] shows the main steps of a method for determining an arithmetic integrity sum of a sequence of at least one data item according to a first mode of implementation of the invention.

[0068] More precisely, the method of figure 3 aims to determine an arithmetic integrity sum Tc, resistant to fault attacks, of the first sequence C of n first data Cj, ..., C„, the arithmetic integrity sum Tc being formed of a predetermined number of bits k and the value of each first data being equal to the result of the application of an arithmetic operation * between a second data selected in a second sequence A of n second data j}nQ^ jy where JAp is an initialization data of the A* P / Ah ..., An and a third data item selected in a third sequence B of n third data items Bv .. ■, Bn, the second selected data item and the third selected data item each having the same rank in the second and third sequences A, B as the first data item concerned.

[0069] The length n is here an integer strictly greater than 1.

[0070] According to a step of initializing integrity sums of the second data (step E2), the processor 4 determines for each second data item Ap of rank p in the second sequence A, p ranging from 1 to n, an integrity sum T\p having a value as follows: _ 1 Ap~ second data of rank p and A is a prime number whose value is between 2k 1 and 2k.

[0071] As a reminder, k is the number of bits that form the arithmetic integrity sum Tc.

[0072] According to a first example, the method can determine for each second data item, the associated integrity sum by reading a memory of the electronic device 2.

[0073] According to a second example, the method can determine for each second data item, the associated integrity sum by calculation from the second data item and the associated initialization data item as follows: for any p ranging from 1 to n, Ta,p = mod N'

[0074] Thus, the method allows good diffusion of errors, that is to say a significant modification of the integrity sum T4 p for a small modification of the value of the second associated data Ap.

[0075] Preferably, the initialization data J\p have non-zero values.

[0076] The initialization data J^p can be determined by the processor 4, for example by reading a memory of the electronic device 2 or by random drawing or by incrementing a counter, possibly during a step of the method not shown and prior to this step of initializing integrity sums of the second data (step E2).

[0077] A non-zero value for the initialization data JAp of the second data Ap of rank p, makes it possible to avoid attacks by which the attacker sets to 0 the integrity sum T\p of the second data of rank p and said second data Ap of rank P-

[0078] Furthermore, the use of different values ​​for the initialization data of second data of different ranks makes it possible to detect permutations of these second data.

[0079] The method also comprises a step of initializing integrity sums of the third data (step E4) during which the processor 4 determines for each third data Bp of rank p in the third sequence B, p ranging from 1 to n, an integrity sum T having a value as follows ■ j'B —{ÿ j ) 2V J is an initialization data of the third data of rank p.

[0080] Thus, the method allows good diffusion of errors, i.e. a significant modification, of the integrity sum TBp for a small modification of the value of the third associated data Bp.

[0081] Preferably, the initialization data JBp have non-zero values.

[0082] The initialization data JBp can be determined by the processor 4, for example by reading a memory of the electronic device 2 or by random drawing or by incrementing a counter, possibly during a step not shown and prior to this step of initializing integrity sums of the third data (step E4).

[0083] A non-zero value for the initialization data JBp of the third data Bp of rank p makes it possible to avoid attacks by which the attacker sets to 0 the integrity sum TBp of the third data of rank p and said third data Bp of rank P-

[0084] Furthermore, the use of different values ​​for the initialization data of third data of different ranks makes it possible to detect permutations of these third data.

[0085] According to a first example, the method can determine for each third data item, the associated integrity sum by reading a memory of the electronic device 2.

[0086] According to a second example, the method can determine for each third data item, the associated integrity sum by calculation from the third data item and the associated initialization data item as follows: for any p ranging from 1 to n, TB.p = {bp + JB^ mod N'

[0087] The method then comprises a step of determining an integrity sum of the second sequence A (step E6) having a value equal to the sum of an initialization data L and a result of the application of the arithmetic operation * between n first corrected integrity sums TC..., TC^, each first corrected integrity sum having a value as follows: for all p ranging from 1 to n, TC\p = (TAp-J^modN-

[0088] According to a first example, the method can determine the integrity sum TA of the second sequence, by reading a memory of the electronic device 2.

[0089] According to a second example, the method can determine the integrity sum TA of the second sequence by calculation from the integrity sums of the second data and the initialization data associated with said second data, typically by applying the arithmetic operation * between the n first corrected integrity sums TCAi, ..., TC An, each first corrected integrity sum being calculated as follows: for all p ranging from 1 to n, TC^p = (T^p-JAp)modN-

[0090] The method then comprises a step of determining an integrity sum of the third sequence B (step E8) having a value equal to the sum of the initialization data L and a result of the application of the arithmetic operation * between n second corrected integrity sums TCBA, ..., TCBn, each second corrected integrity sum having a value as follows: for any p ranging from 1 to n, ^=(^-¼) mod N'

[0091] According to a first example, the method can determine the integrity sum TB of the third sequence, by reading a memory of the electronic device 2.

[0092] According to a second example, the method can determine the integrity sum TB of the third sequence by calculation from the integrity sums of the third data and the initialization data associated with said third data, typically by applying the arithmetic operation * between the n second corrected integrity sums TCBA, ..., TCBjv each second corrected integrity sum being calculated as follows: for all p ranging from 1 to n, r \ j *t- tcBp = VBp - JBp] mod N

[0093] The method then comprises a step of determining the arithmetic integrity sum Tc (step E10), during which the processor 4 determines the arithmetic integrity sum Tc from the integrity sum TA of the second sequence A and the integrity sum TB of the third sequence B by calculating the arithmetic integrity sum Tc as follows: TC = ({(TA-L)\TB-L^ + ^

[0094] The prime number N whose value is between 2k 1 and 2k allows good diffusion of errors, that is to say a significant modification of the arithmetic integrity sum Tc for a small modification of at least one integrity sum among the integrity sum TA of the second sequence A and the integrity sum TB of the third sequence B.

[0095] The method thus calculates an arithmetic integrity sum which has better resistance to fault attacks.

[0096] According to one example, the initialization data L has a non-zero value.

[0097] The initialization data L can be determined by the processor 4, for example by reading a memory of the electronic device 2 or by random drawing, possibly during a step of the method not shown and prior to this step of determining the arithmetic integrity sum Tc (step E10).

[0098] The non-zero value of the initialization data L makes it possible to avoid attacks by which the attacker sets to 0 at least one integrity sum among the integrity sum TA of the second sequence A and the integrity sum TB of the third sequence B, and the data of the corresponding data sequence.

[0099] The method then comprises a step of determining a new integrity sum Sc of the first sequence C (step E12), during which the processor 4 determines a new integrity sum Sc of the first sequence C from the at least one first data item Cj, ..., C„, of the first sequence C.

[0100] According to a particular implementation, the step of determining a new integrity sum Sc calculates the new integrity sum Sc by summing the initialization data L and a result of the application of the arithmetic operation * between n third corrected integrity sums ..., TCçn, each third corrected integrity sum having a value as follows: for all p ranging from 1 to n, TC —(TJ j mod N ^Cp is an integrity sum of the first data of rank p Cp in the first sequence C and JCp is an initialization data of said first data of rank p.

[0101] In this particular implementation, the step of determining a new integrity sum Sc may further comprise calculating each third corrected integrity sum as follows: for any p ranging from 1 to n, TCc.p = (TCp-Jc J mod N

[0102] In this particular implementation, the step of determining a new integrity sum Sc may also comprise the calculation of each integrity sum of a third data item as follows: for any p ranging from 1 to n, Tc,P = (Cp + Jap) mod N'

[0103] The method then comprises a step of comparing the new integrity sum Sc (step E14), in which the processor 4 compares the new integrity sum Sc of the first sequence C with the arithmetic integrity sum T c of the first sequence C, and implements a security processing if the value of the new integrity sum Sc of the first sequence is different from the value of the arithmetic integrity sum T c of the first sequence.

[0104] The method thus effectively verifies the integrity of the arithmetic calculation with a checksum resistant to fault attacks.

[0105] In a first particular mode of implementation, the security processing comprises an incrementation of a counter.

[0106] In a second particular mode of implementation, the security processing comprises sending to another electronic device, typically using the communication module 10, an indicator, for example the counter, said indicator being representative of the occurrence of an error during the arithmetic calculation.

[0107] In a third particular mode of implementation, the security processing blocks the execution of a functionality by the processor 4, typically a new execution of arithmetic calculation and / or a new execution of the method for determining an arithmetic integrity sum and / or the execution of the following steps of said method.

[0108] In a fourth particular mode of implementation, the security processing modifies the result of the execution of the arithmetic calculation, typically the security processing modifies at least a first data item Q, ..., C„, of the first sequence C.

[0109] The method described here, with reference to [Fig.3], can continue with the following additional steps (steps E1 10 to E140).

[0110] Thus, the method can then comprise a step of determining the first n corrected integrity sums TC^[, ..., TC^ (step E1 10), typically by calculating each first corrected integrity sum as follows: for any p ranging from 1 to n, TCA.^T^-J^modN-

[0111] This step of determining the first n corrected integrity sums TC ..., TC^ can also include the calculation for any p ranging from 1 to n, of the integrity sum of the second data of rank p as follows:

[0112] The method then comprises a step of determining a first other integrity sum UA of the second sequence (step E120), in which the processor 4 determines a first other integrity sum UA of the second sequence A equal to the sum of the initialization data L and a result of the application of another arithmetic operation between the n first corrected integrity sums TCA i, ..., TC^.

[0113] The other arithmetic operation is typically one other than the arithmetic operation * among addition, subtraction, and multiplication.

[0114] The method then comprises a step of determining a second other integrity sum VA of the second sequence (step E130), in which the processor 4 determines a second other integrity sum VA of the second sequence A, U' = (Ap + Ja.p) mod N- equal to the sum of the initialization data L and a result of the application of the arithmetic operation * between the first n corrected integrity sums TC^, TC^.

[0115] The method then comprises a step of comparing the second other integrity sum Va of the second sequence with the integrity sum TA of the second sequence (step E140), during which the processor 4 implements a security processing if the value of the second other integrity sum VA of the second sequence is different from the value of the integrity sum TA of the second sequence.

[0116] Typically, the second other integrity sum of the second sequence is formed of k bits and the first other integrity sum of the second sequence is formed of k' bits, the number k' being a non-zero positive integer which can have the same value as the number k.

[0117] The security processing can be implemented according to one of the particular modes described in the step of comparing the new integrity sum Sc (step E14).

[0118] The security processing implemented here may be in a particular mode different from that implemented for the security processing of the step of comparing the new integrity sum Sc (step El4).

[0119] The security processing can be implemented according to another particular mode in which the security processing modifies the second sequence A, typically at least a second data item of the second sequence A.

[0120] These additional steps (steps E1 10 to E140) make it possible to continue the method securely with a step of determining another arithmetic integrity sum Ud of a fourth data sequence D of n fourth data, the other arithmetic integrity sum Ud being formed of k' bits such that Ud = ( ( (JA - L ) 0 ( Te - L ) ) + L) mod N where ° is another arithmetic operation and the value of each fourth data is equal to the result of the application of the other arithmetic operation n between a second data item selected from the second sequence (A) of n second data items and a fifth data item selected from a fifth sequence (E) of n fifth data items fa ), the second data item selected and the fifth selected data each having the same rank in the second and fifth sequences as the fourth data concerned.

[0121] The number k' of bits is preferably strictly greater than 3 and strictly less than the size of each data item of the second, fourth and fifth sequences.

[0122] The method described here, with reference to [Fig.3], can also continue with the following other complementary steps (steps E210 to E240).

[0123] Thus, the method can then comprise a step of determining the n third corrected integrity sums TCq}, ..., TCqm (step E210), typically by calculating each third corrected integrity sum as follows: for any p ranging from 1 to n, TCc,p= (Tcj,-JCp) mod N.

[0124] This step of determining the n third corrected integrity sums TC^, TCCn can also include the calculation for any p ranging from 1 to n, of the integrity sum of the first data of rank p as follows: + jj

[0125] The method then comprises a step of determining a first other integrity sum Uc of the first sequence (step E220), in which the processor 4 determines a first other integrity sum Uc of the first sequence C equal to the sum of the initialization data L and a result of the application of a new arithmetic operation between the n third corrected integrity sums TCc^...,TCCn.

[0126] The new arithmetic operation is typically a different operation from the arithmetic operation * among addition, subtraction and multiplication.

[0127] The new arithmetic operation may be the same operation as the other arithmetic operation.

[0128] The method then comprises a step of determining a second other integrity sum of the first sequence (step E230), in which the processor 4 determines a second other integrity sum Vc of the first sequence equal to the sum of the initialization data L and a result of the application of the arithmetic operation * between the n third corrected integrity sums TCç ], ..., TC(jn.

[0129] The method then comprises a step of comparing the second other integrity sum of the first sequence with the arithmetic integrity sum Tc of the first sequence (step E240), during which the processor 4 implements a security processing if the value of the second other integrity sum Vc of the first sequence is different from the value of the arithmetic integrity sum Tc of the first sequence.

[0130] Typically, the second other integrity sum of the first sequence is formed of k bits and the first other integrity sum of the first sequence is formed of k” bits, the number k” being a non-zero positive integer which can have the same value as the number k and / or the number k'.

[0131] The security processing can be implemented according to one of the particular modes described in the step of comparing the new integrity sum Sc (step E14) and in the step of comparing the second other integrity sum of the second sequence to the integrity sum TA of the second sequence (step E140).

[0132] The security processing implemented here may be in a particular mode different from that implemented for the security processing of the step of comparing the new integrity sum Sc (step E14) and / or the step of comparing the second other integrity sum VA of the second sequence to the integrity sum TA of the second sequence (step E140).

[0133] These other complementary steps (steps E210 to E240) make it possible to continue the method in a secure manner with a step of determining another arithmetic integrity sum U d of a fourth data sequence D of n fourth data, the other arithmetic integrity sum Ud being formed of bits such that Vd-{( (Tc -L) ■ (Te-L)) + L) rnod N where is the new arithmetic operation and the value of each fourth data is equal to the result of the application of the new arithmetic operation between a first data item selected from the first sequence C of n first data items and a fifth data item selected from a fifth sequence E of n fifth data items Eb E„, the first data item selected and the fifth data item selected each having the same rank in the first and fifth sequences as the fourth data item concerned.

[0134] The number k' ' is preferably strictly greater than 3 and strictly less than the size of each data item of the first, fourth and fifth sequences.

[0135] A person skilled in the art will understand that the steps of this method can be executed in other orders, to the extent that each step has the elements (for example the integrity sums, the arithmetic integrity sums and / or the corrected integrity sums) necessary for its execution.

[0136] According to a first example, the step of initializing integrity sums of the third data (step E4) can be executed before the step of initializing integrity sums of the second data (step E2).

[0137] According to a second example, the step of determining an integrity sum of the third sequence B (step E8) can be executed before the step of determining an integrity sum of the second sequence A (step E6).

[0138] According to a third example, the step of determining an integrity sum of the second sequence A (step E6) can be executed after the step of initializing integrity sums of the second data (step E2) and before the step of initializing integrity sums of the third data (step E4).

[0139] According to a fourth example, the step of determining an integrity sum of the third sequence B (step E8) can be executed after the step of initializing integrity sums of the third data (step E4) and before the step of initializing integrity sums of the second data (step E2).

[0140] According to a fifth example, the step of determining a new integrity sum Sc of the first sequence C (step E12) can be executed before the step of determining the arithmetic integrity sum Tc (step E10) or the step of determining an integrity sum of the third sequence B (step E8) or the step of determining an integrity sum of the second sequence A (step E6) or the step of initializing integrity sums of the third data (step E4) or the step of initializing integrity sums of the second data (step E2).

[0141] According to a sixth example, the other complementary steps (steps E210 to E240) can be executed before the complementary steps (steps E110 to E140).

[0142] A person skilled in the art will also understand that steps of this method may be omitted to the extent that the other steps have the elements (for example, the integrity sums, the arithmetic integrity sums and / or the corrected integrity sums) necessary for their execution.

[0143] According to a first example, the step of initializing integrity sums of the second data (step E2) can be omitted when the step of determining an integrity sum of the second sequence A (step E6) is by reading from a memory of the electronic device 2 said integrity sum of the second sequence A.

[0144] According to a second example, the step of initializing integrity sums of the third data (step E4) can be omitted when the step of determining an integrity sum of the third sequence B (step E8) is by reading from a memory of the electronic device 2 of said integrity sum of the third sequence B.

[0145] According to a third example, the step of determining a new integrity sum Sc of the first sequence C (step E12) and the step of comparing the new integrity sum Sc (step E14) may be omitted, in particular when the method comprises the complementary steps (steps E110 to E140) and / or the other complementary steps (steps E210 to E240).

[0146] It will be noted that the method described here may not include the complementary steps (steps E110 to E140) and / or the other complementary steps (steps E210 to E240).

[0147] Thus, according to a fourth example, the method for determining an arithmetic integrity sum ends at the step of determining a new integrity sum Sc of the first sequence C (step E12) or at the step of comparing the new integrity sum Sc (step E14).

[0148] According to a fifth example, the method continues with the other complementary steps (steps E210 to E240) after the step of determining the arithmetic integrity sum Tc (step E10) or the step of determining a new integrity sum Sc of the first sequence C (step E12) or the comparison step of the new integrity sum Sc (step E14), and the method does not include the additional steps (steps E1 10 to E140).

[0149] According to a sixth example, the method continues with the complementary steps (steps E110 to E140) after the step of determining the arithmetic integrity sum TV (step E10) or the step of determining a new integrity sum Sc of the first sequence C (step E12) or the step of comparing the new integrity sum Sc (step E14), and the method does not include the other complementary steps (steps E210 to E240).

[0150] [Fig.4] represents in the form of a flowchart the main steps of a method for determining an arithmetic integrity sum of a sequence of at least one data item according to a second mode of implementation of the invention.

[0151] More precisely, like the method of Figure 3, the method of Figure 4 aims to determine an arithmetic integrity sum Tc, resistant to fault attacks, of the first sequence C of n first data ..., C„, the arithmetic integrity sum Tc being formed of a predetermined number of bits k and the value of each first data being equal to the result of the application of an arithmetic operation * between a second data selected in a second sequence A of n second data Ah ..., An and a third data selected in a third sequence B of n third data B], . ■., Bn, the second selected data and the third selected data each having the same rank in the second and third sequences A, B as the first data concerned.

[0152] However, the length n is here equal to 1.

[0153] According to a step of determining an integrity sum of the second sequence A (step E502), the processor 4 determines an integrity sum TA of the second sequence A having a value as follows: + where N is a number first whose value is between 2k 1 and 2k, L is an initialization data and Ai is the second data in the second sequence.

[0154] As a reminder, k is the number of bits that form the arithmetic integrity sum Tc.

[0155] According to a first example, the method can determine the integrity sum TA of the second sequence by reading a memory of the electronic device 2.

[0156] According to a second example, the method can determine the integrity sum TA of the second sequence by calculation from the second data A{ and the initialization data as follows: y _ + mod N'

[0157] The prime number N whose value is between 2k 1 and 2k allows good diffusion of errors, that is to say a significant modification of the integrity sum TA of the second sequence for a small modification of the value of the second associated data A].

[0158] Preferably, the initialization data L has a non-zero value. The initialization data L can be determined by the processor 4, for example by reading a memory of the electronic device 2 or by random drawing, possibly during a step of the method not shown and prior to this step of determining an integrity sum of the second sequence A (step E502).

[0159] A non-zero value for the initialization data L makes it possible to avoid attacks by which the attacker sets the integrity sum TA of the second sequence and the second data to 0.

[0160] The method then comprises a step of determining an integrity sum of the third sequence B (step E504), during which the processor 4 determines an integrity sum TB of the third sequence B having a value as follows: Tb^+ L) mod N °ù is the third data in the third sequence.

[0161] According to a first example, the method can determine the integrity sum T b of the third sequence by reading a memory of the electronic device 2.

[0162] According to a second example, the method can determine the integrity sum TB of the third sequence by calculation from the third data and the initialization data as follows: ^ = (*1 + L) mod N-

[0163] As for the step of determining the integrity sum of the second sequence A (step E502), the prime number N whose value is between 2k 1 and 2k allows good diffusion of errors, that is to say a significant modification of the integrity sum TB of the third sequence for a small modification of the value of the third associated data B^.

[0164] A non-zero value for the initialization data L makes it possible to avoid attacks by which the attacker sets the integrity sum TB of the third sequence and said third data to 0.

[0165] The method then performs a step of determining the arithmetic integrity sum Tc (step E510), a step of determining a new integrity sum Sc of the first sequence C (step E512) and a step of comparing the new integrity sum Sc (step E514), in a manner identical respectively to the step of determining the arithmetic integrity sum Tc (step E10), the step of determining a new integrity sum Sc of the first sequence C (step E12) and the step of comparing the new integrity sum Sc (step E14) described for the method according to the first embodiment of the invention.

[0166] A person skilled in the art will understand that the steps of this method can be executed in other orders to the extent that each step has the elements (for example the integrity sums, the arithmetic integrity sums and / or the corrected integrity sums) necessary for its execution.

[0167] According to a first example, the step of determining an integrity sum of the third sequence B (step E504) can be executed before the step of determining an integrity sum of the second sequence A (step E502).

[0168] According to a second example, the step of determining a new integrity sum Sc of the first sequence C (step E512) can be executed before the step of determining the arithmetic integrity sum Tc (step E510) or the step of determining an integrity sum of the third sequence B (step E504) or the step of determining an integrity sum of the second sequence A (step E502).

[0169] A person skilled in the art will also understand that steps of this method may be omitted to the extent that the other steps have the elements (for example, the integrity sums, the arithmetic integrity sums and / or the corrected integrity sums) necessary for their execution.

[0170] According to one example, the step of determining a new integrity sum Sc of the first sequence C (step E512) and the step of comparing the new integrity sum Sc (step E514) may be omitted.

[0171] With the method according to the first mode of implementation (illustrated with figure 3) or according to the second mode of implementation (illustrated with figure 4), the electronic device 2 has an arithmetic integrity sum Te resistant to fault attacks, of the first sequence (C) of n first data £).

[0172] The method thus makes it possible to efficiently verify the integrity of an arithmetic calculation.

[0173] This integrity sum can be compared to a new integrity sum Sc of the first sequence, determined from the at least one first data item ..., C„ of the first sequence C (typically as described above for the step of determining a new integrity sum Sc of the first sequence C and the step of comparing the new integrity sum Sc), and / or be used to determine another arithmetic integrity sum of a fourth data sequence D of at least one fourth data item Dn (typically such that described in the third and fourth examples with reference to [Fig.2]).

[0174] A person skilled in the art will understand that the embodiments, variations, and various features described above may be combined with each other in various combinations to the extent that they are not incompatible or mutually exclusive.

Claims

Claims

1. Method for determining an arithmetic integrity sum Tc of a first sequence (C) of at least one first data item (Cj C„^ 'the arithmetic integrity sum Tc being formed of a predetermined number of bits k and the value of each first data item being equal to the result of the application of an arithmetic operation * between a second data item selected in a second sequence (A) of at least one second data item and a third data item selected in a third sequence (B) of at least one third data item Çÿ 'the second selected data item and the third selected data item each having the same rank in the second and third sequences (A, B) as the first data item concerned, said method being implemented within an electronic device and comprising the following step: - determination (E10, E510) of the arithmetic integrity sum Tc,from an integrity sum TA of the second sequence (A) and an integrity sum TB of the third sequence (B) by calculating the arithmetic integrity sum Tc as follows: Tc = ( ( {TA - L ) * ( TB - L ) ) + L) mod N • and in which - the arithmetic operation is an addition or a subtraction or a multiplication, - L is an initialization data, and - V is a prime number whose value is between 2k 1 and 2k.,

2. A method of determining an arithmetic integrity sum according to claim 1, wherein the initialization data has a non-zero value.

3. Method for determining an arithmetic integrity sum according to any one of the preceding claims, in which - the first sequence (C), the second sequence (A) and the third sequence (B) have the same length n strictly greater than 1, - the integrity sum TA of the second sequence is equal to the sum of the initialization data L and a result of the application of the arithmetic operation * between ” first corrected integrity sums TC..., TCeach first sum corrected integrity sum having a value as follows: for all p from 1 to TC^p = {T ^p- JAp ) nwd N where T Ap is an integrity sum of the second data of rank p in the second sequence and J^p is an initialization data of the second data of rank p, and - the integrity sum Tp of the third sequence is equal to the sum of the initialization data L and a result of applying the arithmetic operation * between 11 second corrected integrity sums TCg\, TCg#, each second corrected integrity sum having a value as follows: for all p from 1 to n, TCgp — (T gp - Jb,p ) fnod N where Tg p is an integrity sum of the third data of rank p in the third sequence and J gp is an initialization data of the third data of rank p.

4. A method for determining an arithmetic integrity sum according to claim 3, wherein - each integrity sum of a second data item has a value as follows: for any p ranging from 1 to n, + where Ap is the second data item of rank p in the second sequence, - each integrity sum of a third data item has a value as follows: for any p ranging from 1 to n, — ^B+J j N where Bp is the third data item of rank p in the third sequence.

5. Method for determining an arithmetic integrity sum according to one of claims 3 or 4, further comprising the steps: - determining (El 10) the first n corrected integrity sums TC TC - determining (El20) a first other integrity sum UA of the second sequence equal to the sum of the initialization data L and a result of the application of another arithmetic operation between the first n corrected integrity sums TCTC then - determining (E130) a second other integrity sum Va of the second sequence equal to the sum of the initialization data L and a result of the application of the operation arithmetic * between the first n corrected integrity sums ..., TC - Comparison (El40) of the second other integrity sum VA of the second sequence to the integrity sum TA of the second sequence, and if the value of the second other integrity sum VA of the second sequence is different from the value of the integrity sum TA of the second sequence, implementation of a security treatment, and in which the other arithmetic operation is an operation different from the arithmetic operation * among addition, subtraction and multiplication.

6. Method for determining an arithmetic integrity sum according to one of claims 3 to 5, further comprising the following steps: - determining (E210) n third corrected integrity sums TCe \ ..., TCçn, each third corrected integrity sum having a value as follows: for all p ranging from 1 to n, TCcp = (Tep - Jcp) mod N where Tcp is an integrity sum of the first data item of rank p in the first sequence and JCp is an initialization data item of the first data item of rank p, - determining (E220) a first other integrity sum Uc of the first sequence equal to the sum of the initialization data item L and a result of the application of a new arithmetic operation between the n third corrected integrity sums TCCi, ..., TCCjV then - determination (E230) of a second other integrity sum Vc of the first sequence equal to the sum of the initialization data L and a result of the application of the arithmetic operation * between the n third corrected integrity sums tcca, ...,TCCn, - comparison (E240) of the second other integrity sum of the first sequence with the arithmetic integrity sum Tc of the first sequence, and if the value of the second other integrity sum Vc of the first sequence is different from the value of the arithmetic integrity sum Tc of the first sequence, implementation of a security processing,. and wherein the new arithmetic operation is a different operation from the arithmetic operation * among addition, subtraction and multiplication.

7. A method for determining an arithmetic integrity sum according to one of claims 3 to 6, wherein the first data are the coefficients of a first polynomial, the second data are the coefficients of a second polynomial and the third data are coefficients of a third polynomial.

8. Method for determining an arithmetic integrity sum according to any one of claims 1 to 2, wherein - the first sequence, the second sequence and the third sequence have the same length n equal to 1, and - the integrity sum TA of the second sequence has a value as follows: y _ + y] mod N where A! is the second data in the second sequence, and - the integrity sum TB of the third sequence has a value as follows: y — (B+L} mod N °where ^test the third data in the third sequence.

9. Method for determining an arithmetic integrity sum according to any one of the preceding claims, the method further comprising the following steps: - determining (El2, E512) a new integrity sum Sc of the first sequence from the at least one first data item (Cj C„^ of the first sequence, - comparing (E14, E514) the new integrity sum Sc of the first sequence with the arithmetic integrity sum T c of the first sequence, and if the value of the new integrity sum Sc of the first sequence is different from the value of the arithmetic integrity sum Tc of the first sequence, implementing a security processing.

10. Computer program comprising instructions executable by a processor (2) and adapted to implement a method according to any one of claims 1 to 9 when these instructions are executed by the processor (2).

11. Electronic device comprising means adapted for implementing a method for determining an arithmetic integrity sum according to any one of claims 1 to 9.

Images