Method for secure execution of instructions - Patents.com

Abstract

The invention relates to a method for secure execution of a first instruction by a processor of an electronic system, the electronic system comprising at least one memory configured to be coupled to a processor, the processor comprising an execution unit comprising processor registers (103) and a load and store unit (104a), the method comprising: - fetching (S1) the first instruction in an execution pipeline of the processor, - determining (S2) whether the first instruction to be executed is a load instruction to be protected for loading protected data and associated security information from the at least one memory to the processor register or a store instruction to be protected for storing protected data and associated security information from the processor register to the at least one memory, -When the first instruction to be executed is a load instruction to be protected or a store instruction to be protected, the method includes sequentially executing by the processor at least a first operation (S4), a second operation (S5), and a third operation (S6): when the first instruction is a load instruction to be protected, the first operation is a load operation for loading the protected data from the at least one memory to the load and store unit, the second operation is a load operation for loading the security information associated with the protected data from the at least one memory to the load and store unit, and the third operation is a write operation for copying the protected data and the associated security information from the load and store unit to a processor register; when the first instruction is a store instruction to be protected, the first operation is a write operation for copying the protected data and the associated security information from a processor register to the load and store unit, the second operation is a store operation for storing the copied protected data from the load and store unit to the at least one memory, and the third operation is a store operation for storing the copied and associated security information from the load and store unit to the at least one memory, and the security information associated with the protected data is data enabling the protected data to be converted into plain data and / or integrity data enabling the integrity of the protected data to be verified.

Description

[Technical field]

[0001] The present invention relates to the field of securing software execution on an electronic device against attacks, and more particularly to a method for securing the execution of instructions by a processor of an electronic device. [Background technology]

[0002] Electronic devices are now widely used to store data that must be protected against any unauthorized access by an attacker: personal data such as identity information, biometric data, banking information, secret data such as cryptographic keys, etc. Therefore, security measures are usually applied to such data to mitigate any unauthorized reading or modification. Such data may be encrypted; their integrity may be increased by storing security information such as signatures, checksums, or hash values.

[0003] To use such data, the CPU of the electronic device storing the data would read the data in memory prior to any subsequent use by an instruction executed by the CPU. The data would then be transferred over a bus from the memory of the electronic device to an internal register of the CPU, and then used by the CPU to perform that instruction.

[0004] During such manipulation of data, an attacker may perform side-channel attacks that allow him to gain knowledge of sensitive information processed by the CPU, such as cryptographic keys, from electromagnetic leakage or power consumption from the CPU. An attacker may also perform fault injection attacks to induce malfunction of the electronic device and obtain information about the data from this degraded state. Therefore, to prevent such attacks, countermeasures applied to sensitive data should be applied as widely as possible on the execution chain, and not only during storage of the data in the memory of the electronic device. Countermeasures should be applied in memory interfaces, buses, CPU caches, and internal registers up to the execution stage where the CPU can work with protected data.

[0005] Problems arise from the impact such measures have on the data size induced by the security information accompanying the protected data: integrity check information, mask data, etc. As a result, in order to make existing electronic devices capable of storing and handling such security information together with the protected data up to the CPU, the hardware design of such electronic devices usually has to be adapted, for example by increasing the data word size in the memory by increasing the data bus width. Such modifications have a large impact on existing designs, both in terms of hardware cost and performance, not to mention the required engineering and testing effort.

[0006] As a result, a need exists for a method that enables secure execution of instructions by a CPU by increasing the protection of sensitive data manipulated by the instructions against fault attacks or side-channel analysis, while having a smaller impact on the architecture of the electronic device in which this execution occurs. Summary of the Invention [Means for solving the problem]

[0007] For this reason, and according to a first aspect, the invention therefore relates to a method for secure execution of a first instruction by a processor of an electronic system, said electronic system comprising at least one memory configured to be coupled to a processor, said processor comprising an execution unit comprising processor registers and a load and store unit, said method comprising: a) fetching the first instruction in an execution pipeline of a processor; b) determining whether the first instruction to be executed is a load instruction to be protected for loading protected data and associated security information from the at least one memory to a processor register or a store instruction to be protected for storing protected data and associated security information from a processor register to the at least one memory; c) when the first instruction to be executed is a protected load instruction or a protected store instruction, sequentially executing, by the processor, at least a first operation, a second operation, and a third operation. Includes: when the first instruction is a load instruction to be protected, the first operation is a load operation for loading the protected data from the at least one memory to the load and store unit, the second operation is a load operation for loading the security information associated with the protected data from the at least one memory to the load and store unit, and the third operation is a write operation for copying the protected data and the associated security information from the load and store unit to a processor register; when the first instruction is a store instruction to be protected, the first operation is a write operation for copying the protected data and the associated security information from a processor register to the load and store unit, the second operation is a store operation for storing the copied protected data from the load and store unit to the at least one memory, and the third operation is a store operation for storing the copied associated security information from the load and store unit to the at least one memory; The security information associated with protected data is data allowing to convert the protected data into plain data and / or integrity data allowing to verify the integrity of the protected data.

[0008] Such a method allows for increasing the security of the execution of the first instruction by allowing for maintaining the data in a masked / encrypted form and / or performing an integrity check on the data from the memory of the electronic system to the processor registers of the processor. The method allows for doing so without further requirements on the size of the bus connecting the memory and the processor by using separate operations for copying the data and its associated security information.

[0009] The security information associated with data may be mask data, encryption keys or integrity data in redundant data, checksums, minimum values, and / or maximum values ​​of the protected data.

[0010] The method according to a first aspect may include, when the first instruction is a load instruction to be protected, performing a security check of the data loaded by the first operation using associated security information loaded by the second operation after the first and second operations are executed by the processor.

[0011] By doing so, any tampering with the data between reading the data in the memory of the electronic system and their copies in the processor can be detected before the data is requested from the processor registers.

[0012] A method according to a first aspect includes, when a processor comprises a secure execution unit or a secure coprocessor that performs at least step c. described above, and the electronic system comprises a requester that executes a second instruction, the method comprising, when access to the copied data in a processor register is requested by the second instruction, the following steps that are executed by the secure execution unit or the secure coprocessor: - determining whether the requester is secure; - if the requester is determined to be secure, transferring the requested data and the associated security information to the requester and executing the second instructions by the requester based on the transferred data and the transferred associated security information; - if the requester is determined to be insecure, processing the requested data by a secure execution unit or a secure coprocessor by converting the requested data to plain data and / or verifying the integrity of the requested data using security information associated with the requested data stored in a processor register, forwarding the processed data to the requester, and executing the second instruction by the requester based on the processed data. Includes.

[0013] Such a method allows extending protection of the data up to the requester, if the requester is secure; detecting any tampering with the data before execution of the second instruction; and simultaneously providing unmasked / decrypted data to the requester, if the requester is not secure and cannot handle masked / encrypted data.

[0014] According to a first embodiment, determining whether the first instruction is a load instruction to be protected or a store instruction to be protected includes determining whether an opcode of the instruction corresponds to a protected instruction or an unprotected instruction.

[0015] According to a second embodiment, determining whether the first instruction is a load instruction to be protected or a store instruction to be protected includes determining whether the first instruction to be executed includes predetermined metadata.

[0016] According to a third embodiment, determining whether the first instruction is a load instruction to be protected or a store instruction to be protected includes verifying a value stored in a security configuration register of the processor.

[0017] By doing so, protection of load and store instructions can be selectively activated for only some load and store instructions.

[0018] According to a second aspect, the present invention relates to a computer program product directly loadable into the memory of at least one computer, comprising software code instructions for performing the steps of the method according to the first aspect of the invention, when said product is executed on a computer.

[0019] According to a third aspect, the present invention relates to an electronic system comprising a processor configured to perform the steps of the method according to the first aspect of the invention.

[0020] To the accomplishment of the foregoing and related ends, the one or more embodiments comprise the features hereinafter fully described and particularly pointed out in the claims.

[0021] The following description and the annexed drawings set forth in detail certain illustrative aspects and indicative of but a few of the various ways in which the principles of the embodiments may be employed therein. Other advantageous and novel features will become apparent from the following detailed description when considered in conjunction with the drawings, and the disclosed embodiments are intended to include all such aspects and their equivalents. [Brief description of the drawings]

[0022] [Figure 1] 1 is a schematic diagram of an electronic system according to the present invention. [Figure 2a] 2 is a schematic diagram of a method for secure execution of a load instruction by an electronic system according to an embodiment of the present invention. [Figure 2b] 2 is a schematic diagram of a method for secure execution of a store instruction by an electronic system according to an embodiment of the present invention. [Figure 3a] 4 is a schematic diagram of steps according to a method for providing a requester access to protected data stored in a processor register of an execution unit. [Figure 3b] 4 is a schematic diagram of steps according to a method for providing a requester access to protected data stored in a processor register of an execution unit. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] According to a first aspect, the invention relates to a method for secure execution of a first instruction by a processor (101) of an electronic system (100).

[0024] Such an electronic system 100 comprises a processor 101 for the execution of a code including a first instruction, as shown in Fig. 1. The processor comprises a program counter PC 102, a processor register 103, and an execution unit 104, which may include a load and store unit LSU 104a and an arithmetic and logical unit ALU 104b. The processor may also include further internal memories 105, such as cache memories, and one or more coprocessors 106 (secure or not), located, for example, on the same die or on the same PCB as the processor. The electronic system also comprises at least one memory, such as a non-volatile memory 107, a RAM memory 108, and / or a ROM memory 109, for storing further data including instructions of the code and data used as instruction operands and associated security information. These three types of data may be stored in a single memory or in separate memories.

[0025] The electronic system 100 may further include a communication interface 110 by which the electronic system 100 may be connected to a network. Such an interface may be a wireless interface connected to an antenna and may be used to connect the electronic system 100 to various forms of wireless networks, for example, a wide area network, a WiFi network, or a mobile telephone network. Alternatively, such an interface may be a wired interface, such as an Ethernet interface. The electronic system 100 may also include input / output means 111 for providing an interface to a user of the first device, such as one or more screens, loudspeakers, a mouse, a tactile surface, a keyboard, etc.

[0026] Such an electronic system may be, for example, a tamper-proof smart card, a personal computer, a server, or a smartphone.

[0027] When the first instruction is an instruction that manipulates data, such as a load or store instruction, the data shall be accompanied by security information to ensure secure execution of the first instruction and prevent any reading or manipulation of the data by an attacker. For example, the data may be masked or encrypted, and the security information associated with the data may be the mask data or a cryptographic key that allows converting the protected data into plain data by unmasking or decrypting the protected data. The security information may also be integrity data that allows checking the integrity of the data, such as a checksum or hash value of the data, redundant data, minimum and / or maximum value, to which the data is associated. The security information may also be a color tag as described in European Patent Application No. 20306400.1, filed November 18, 2020.

[0028] When a first instruction transmits such protected data associated with such security information between the processor and at least one memory of the electronic system, the first main idea of ​​the invention is to sequentially perform at least two operations to separately copy the data themselves and the security information associated therewith when executing this first instruction. By doing so, such security information is not only present in a memory outside the processor. The data can also be accompanied by their security information in the internal memory and registers of the processor, which makes it possible to apply data protection such as masking of the data inside the processor and to perform security checks such as integrity checks on the data when they are stored in the processor. In order to copy the data and their associated security information in a single operation, the width of the bus connecting the memory and the processor of the electronic system would have to be expanded to accommodate the security information. By using a separate operation to copy the security information, the size of the bus can remain standard and no expansion of the bus width is required.

[0029] A second main idea of ​​the invention is to use the load and store unit LSU 104a as a temporary buffer between the processor register 103 of the processor and at least one memory 107, 108, 109 of the electronic system located outside the processor. As an example, in case of a load instruction of data from a memory to a processor register of the processor, it makes it possible to perform operations on the data, such as unmasking the data, decrypting the data or checking the integrity of the data, after the transfer of the data from the memory to the LSU of the processor, but before the copying of the data in the processor register of the processor.

[0030] The following sections explain in detail the steps of a method for secure execution of a first instruction by an electronic system according to the invention. The case of a load instruction is illustrated in Fig. 2a and the case of a store instruction is illustrated in Fig. 2b. Such a secure execution can be performed by a secure execution unit 104 or by a secure coprocessor 106 of the processor 101. Figs. 2a and 2b correspond to the case where such execution is performed by a secure coprocessor.

[0031] In a first step S1, the processor fetches a first instruction from the memory 107, 108, 109 of the electronic system which stores the code to be executed in the execution pipeline of the processor 101.

[0032] In a second step S2, the processor determines whether the first instruction to be executed is an instruction for copying data between one or more memories and the processor and whether it should be protected against unauthorized manipulation of such data. More precisely, in this step the processor determines whether the first instruction to be executed is one of the two following instructions: A load instruction to be protected for loading the protected data and associated security information from at least one memory into a processor register 103. a store instruction to be protected for storing the protected data and associated security information from the processor register 103 to at least one memory; The method determines whether the

[0033] The protection of the execution of the first instruction may be activated by several means, which are not mutually exclusive.

[0034] The instructions to be protected may be identified by a particular opcode that has been added to the processor's instruction set. In such a case, in a second step, the processor may determine whether the first instruction should be protected by determining whether the opcode of the instruction corresponds to a protected or unprotected instruction.

[0035] The instructions to be protected may also be identified by a particular metadata or combination of metadata embedded within the instruction, in which case, in a second step, the processor may determine whether the first instruction to be executed should be protected by determining whether the first instruction includes such predetermined metadata.

[0036] Protection of the execution of an instruction may also be activated independently of the instruction itself, for example by setting a register of the processor to a predefined value. In such a case, in a second step, the processor may determine whether the first instruction should be protected by verifying a value stored in a security configuration register of the processor.

[0037] Protection may also be permanently activated for any instruction fetched into the processor without the need to take any action. In such a case, any load or store instruction fetched into the processor is considered to be protected.

[0038] At this stage, when the first instruction is not a load or store instruction, or when the first instruction is a load or store instruction but is not identified as to be protected, as will be further described below, the first instruction may be executed by the processor as described in the technical state.

[0039] However, if it is determined in the second step S2 that the first instruction to be executed is a protected load instruction or a protected store instruction, the following steps are performed in accordance with the method of the present invention.

[0040] In a third step S3, when a first instruction to be protected is to be executed by the secure coprocessor 106, the processor offloads the first instruction from its execution pipeline to the execution pipeline of the secure coprocessor. This offloading is optional, since the processor may have the first instruction executed by a secure execution unit in its own execution units 104. In the following sections, we consider the first instruction to be executed by a secure component of the processor: the secure execution unit of the processor or the secure coprocessor, if any.

[0041] Thereafter, to execute the first instruction, the processor 101 sequentially executes at least a first operation in a fourth step S4, a second operation in a fifth step S5, and a third operation in a sixth step S6.

[0042] When the first instruction is a load instruction to be protected, the protected data and the associated security information are loaded separately into the load and store unit LSU 104a: in a fourth step S4, the first operation is a load operation to load the protected data from the memory storing it into the load and store unit; in a fifth step S5, the second operation is a load operation to load the security information associated with these data from the memory storing it into the load and store unit (LSU) 104a. After these two operations are executed, both the protected data and the associated security information are stored in the LSU, despite the fact that the size of the bus connecting the memory and the LSU is probably smaller than the accumulated size of the data and the security information. Then, in a sixth step S6, the third operation is a write operation to copy the loaded protected data and the associated security information from the load and store unit to the processor register 103. These three operations may be executed in different orders; for example, the security information may be loaded before the protected data.

[0043] The first instruction may also be a store instruction to be protected. For example, a previous instruction may have generated output data and associated security information, both of which were temporarily stored in the processor register 103 of the processor. In such a case, the protected data and associated security information are first obtained in the LSU 104a: in a fourth step S4, the first operation is a write operation for copying the protected data and associated security information from the processor register to the load and store unit. After that, the protected data and associated security information may be stored separately from the load and store unit LSU to at least one memory 107, 108, 109: in a fifth step S5, the second operation is a store operation for storing the copied and protected data from the load and store unit to the memory; in a sixth step S6, the third operation is a store operation for storing the copied and associated security information from the load and store unit of said processor to the memory. These three operations may be performed in different orders; for example, the security information may be stored before the protected data.

[0044] The sections above describing the execution of the first, second, and third operations refer to copying data to or from a processor register. Depending on the size of the register, the size of the data being copied, and, if copying from a register, the location of the data within the processor register, these operations may involve one or several processor registers.

[0045] When the first instruction is a load instruction to be protected, loading the protected data and associated security information in the LSU allows to perform actions on these data after their transmission on the bus between the memory of the electronic system and the processor and before storing it in the processor register. Thus, after the first and second operations are executed by the processor in the fourth and fifth steps S4, S5, during the checking step S61, the processor can perform a security check of the data loaded by the first operation using the associated security information loaded by the second operation. The processor can, for example, check the integrity of the data before copying it to the processor register to verify that the data was not modified by a fault attack during the execution of the fourth and fifth steps. If this security check fails, the processor can perform various actions such as activating countermeasures, issuing an alert, preventing the checked data from being copied to the processor register, deleting the checked data or moving it to an isolated memory zone, resetting the electronic system, etc.

[0046] When the first instruction is a load instruction, the protected data and associated security information are loaded into a processor register of the processor by a secure execution unit or a secure coprocessor. After execution of these load operations, these data may be requested by another circuit of the electronic system, hereafter referred to as a "requester", to execute a subsequent instruction, hereafter referred to as a second instruction. Such a requester of data may be, for example, the execution unit 104 of the processor, the coprocessor 106 of the processor, or another processor or coprocessor of the electronic system. The behavior of the secure execution unit or secure coprocessor may in such a case depend on whether the requester of data is considered secure or not, as shown in Figures 3a and 3b. On these figures, the requester is shown as being external to the processor, although as discussed above the requester may be included in the processor.

[0047] In a seventh step S7 it is determined whether the requester is secure.

[0048] If the requester is secure, the requester extends the secure boundary including the electronic system memory and the secure execution unit or secure coprocessor, and the data can remain as is: if the data in the LSU and processor registers is masked / encrypted, it remains masked / encrypted and with the security information of the data for later unmasking / decryption and / or verification of the data integrity. As a result, as shown in FIG. 3a, once the requester is determined to be secure, the processor can transfer the requested data and associated security information to the requester in an eighth step S8, and the requester can execute a second instruction based on the transferred data and the transferred associated security information. For example, when such masking is XOR and the second instruction is compatible with XOR (e.g., another XOR), the requester may be able to process the masked data and may not need to unmask the masked data to perform the second instruction.

[0049] Conversely, if the requester is not secure as shown in Fig. 3b, the security chain ends at the processor register. As a result, once the requester is determined to be not secure, the secure execution unit or secure coprocessor may process the requested data in an eighth step S8, for example by converting the requested data into plain data by unmasking or decrypting the requested data and / or verifying the integrity of the requested data using the security information associated with the requested data stored in the processor register. After this processing is successfully performed, the secure execution unit or secure coprocessor may forward the processed data to the requester.

[0050] In a ninth step S9, the requestor may execute a second instruction based on the processed data and then store the result in a processor register.

[0051] According to a second aspect, the invention relates to a computer program product directly loadable into the memory of at least one computer, comprising software code instructions for carrying out the steps of the method described above, when said product is executed on a computer.

[0052] In addition to these features, the computer program according to the second aspect of the invention may be configured to perform or include any other feature described above.

[0053] Thus, the electronic systems and methods presented herein enable increasing the security of the execution of a first instruction by enabling data to be maintained in a masked form and / or integrity checks to be performed on the data from a memory of the electronic system to a processor register of the processor. The electronic systems and methods can do so without further requirements on the size of the bus connecting the memory and the processor by using separate instructions to copy the data and its associated security information.

Claims

1. A method for secure execution of a first instruction by a processor (101) of an electronic system (100), comprising: The electronic system comprises at least one memory (107, 108, 109) configured to be coupled to a processor, the processor comprising processor registers (103) and an execution unit (104) comprising a load and store unit (104a); The method comprises: a) fetching (S1) the first instruction in an execution pipeline of a processor; b) determining (S2) whether the first instruction to be executed is a load instruction to be protected for loading protected data and associated security information from the at least one memory to a processor register, or a store instruction to be protected for storing protected data and associated security information from a processor register to the at least one memory; c) when the first instruction to be executed is a protected load instruction or a protected store instruction, sequentially executing, by the processor, at least a first operation (S4), a second operation (S5), and a third operation (S6). Including, when the first instruction is a load instruction to be protected, the first operation is a load operation for loading the protected data from the at least one memory to the load and store unit, the second operation is a load operation for loading the security information associated with the protected data from the at least one memory to the load and store unit, and the third operation is a write operation for copying the protected data and the associated security information from the load and store unit to a processor register; when the first instruction is a store instruction to be protected, the first operation is a write operation for copying the protected data and the associated security information from a processor register to the load and store unit, the second operation is a store operation for storing the copied protected data from the load and store unit to the at least one memory, and the third operation is a store operation for storing the copied associated security information from the load and store unit to the at least one memory; 11. A method according to claim 10, wherein the security information associated with protected data is data enabling the protected data to be converted into plain data and / or integrity data enabling the integrity of the protected data to be verified.

2. The method of claim 1 , wherein the security information is mask data, a cryptographic key or integrity data in redundancy data, a checksum, a minimum value, and / or a maximum value of the protected data.

3. 3. The method of claim 1, further comprising: when the first instruction is a load instruction to be protected, after the first and second operations are executed by a processor, performing a security check on the data loaded by the first operation using associated security information loaded by the second operation.

4. The processor (101) comprises a secure execution unit (104) or a secure coprocessor (106) for performing at least step c. of claim 1, and the electronic system comprises a requester for executing a second instruction, the method comprising, when access to the copied data in a processor register (103) is requested by the second instruction, executing, by the secure execution unit or coprocessor: determining whether the requester is secure (S7); if the requester is determined to be secure, transferring the requested data and the associated security information to the requester, and executing the second instructions by the requester based on the transferred data and the transferred associated security information (S8); if the requester is determined to be insecure, processing the requested data by a secure execution unit or a secure coprocessor by converting the requested data to the plain data and / or verifying the integrity of the requested data using security information associated with the requested data stored in a processor register, forwarding the processed data to the requester, and executing the second instruction by the requester based on the processed data. The method according to any one of claims 1 to 3, comprising:

5. 5. The method of claim 1, wherein determining (S2) whether the first instruction is a load instruction to be protected or a store instruction to be protected comprises determining whether an opcode of the instruction corresponds to a protected or unprotected instruction.

6. 5. The method of claim 1, wherein determining (S2) whether the first instruction is a load instruction to be protected or a store instruction to be protected comprises determining whether the first instruction to be executed includes predetermined metadata.

7. 5. The method of claim 1, wherein determining (S2) whether the first instruction is a load instruction to be protected or a store instruction to be protected comprises verifying a value stored in a security configuration register of the processor.

8. A computer program product directly loadable into the memory of at least one computer, comprising software code instructions for performing the steps according to any one of claims 1 to 7, when said product is executed on a computer.

9. An electronic system (100) comprising a processor (101) configured to perform the steps of any one of claims 1 to 7.

Images