Side-channel tolerant memory operation

Abstract

In some embodiments, the method includes accessing a buffer including one or more sets of bits, generating a random sequence of values, generating a sequence of indexes from the random sequence of values ​​that represents an order for accessing a plurality of particular sets of bits of the buffer, in response to determining that an index of the sequence of indexes corresponds to a location in the buffer, accessing a set of the plurality of particular sets of bits of the buffer at an index in the order of the sequence of indexes, and performing one or more memory operations on the set of the one or more sets of bits after accessing the set.

Description

Technical Field

[0001] This specification generally relates to memory operations that achieve similar purposes as, for example, memcpy, memcmp, and memset, which are resistant to fault attacks and power attacks and generally platform-independent.

Background Art

[0002] Compilers and C programmers alike use three basic memory operations: memcpy (to move bytes), memset (usually to clear memory), and memcmp (primarily to compare memory regions and evaluate equality of memory regions). However, the implementations of these operations (provided by most compilers) can be vulnerable to power analysis, among other hacking or tampering methods. Generally, power analysis may include techniques for closely examining the power consumption of a device when it performs operations or calculations, especially cryptographic algorithms. Performing these executions requires a certain amount of computing power, which can lead to unique power consumption patterns. By measuring the power consumption of a device when it performs an execution, an attacker can infer information involved in the execution (e.g., a secret key in the case of a cryptographic algorithm). The attacker can use the information to break encryption or access protected data. Similar analysis can be performed by monitoring the computing time based on the input provided to the device. Timing or power leakage may inform the attacker of underlying information.

[0003] For example, the `memcpy` and `memcmp` functions manipulate memory in an orderly manner at the byte level, making them susceptible to power attacks using the Hamming weight (HW) model. The `memcmp` function could potentially leak the size of the largest prefix shared by two buffers. While the `memset` function doesn't generally leak much data, it writes long strings of zeros, meaning it could have an easily perceptible power signature that an attacker could use as a timing source.

[0004] Despite being a well-known issue that cryptographic code attempts to address over time, memcmp leaks can still result in memory information being leaked and, as described, remain vulnerable to power analysis among other known attack methods in the art. While various solutions exist, they generally rely on assumptions about how the hardware operates and how a particular compiler behaves. Generally, there are no mitigations designed to be platform-independent, i.e., reusable across platforms. Existing solutions also often make the use of volatile memory manipulation, a significant optimization barrier, far more powerful and potentially less efficient than it may actually be needed. [Overview of the project]

[0005] One innovative aspect of the subject matter described herein is embodied in a manner that includes accessing a buffer containing one or more bit sets, generating a random sequence of multiple values, generating a sequence of multiple indices from the random sequence of multiple values ​​that represent an order for accessing multiple specific bit sets of the buffer, accessing one of the multiple specific bit sets of the buffer at one index in the order of the sequence of multiple indices in response to determining that one index in the sequence of multiple indices corresponds to one location in the buffer, and, after accessing one set, performing one or more memory operations on one of the one or more bit sets.

[0006] This aspect and other embodiments of other aspects include corresponding systems, devices, and computer programs encoded on a computer storage device and configured to perform actions of the Method. One such embodiment is a non-temporary computer-readable medium storing one or more instructions executable by a computer system for performing actions of the Method. Further such embodiments are embodied in a system including one or more processors and a machine-readable medium interoperably coupled with the one or more processors and storing one or more instructions that, when executed by the one or more processors, perform actions of the Method. A system of one or more computers can be configured in this way by software, firmware, hardware, or a combination thereof installed on the system that causes the system to perform actions while in operation. One or more computer programs can be configured in this way by having instructions that, when executed by a data processing device, cause the device to perform actions.

[0007] The above and other embodiments may each include one or more of the following features, either individually or in combination. For example, in some embodiments, generating a random sequence of multiple values ​​includes obtaining one value from entropy delivery hardware and generating multiple values ​​from a number generator using that one value from the entropy delivery hardware as a start key.

[0008] In some embodiments, the action includes providing one or more requirements to a number generator, where one or more requirements include one or more values ​​representing a portion of a buffer.

[0009] In some embodiments, generating a sequence of indices representing an order for accessing multiple specific sets of one or more bit sets of a buffer from a random sequence of multiple values ​​involves adding one value from the random sequence of multiple values ​​to a memory offset value corresponding to the buffer's starting storage location.

[0010] In some embodiments, performing one or more memory operations includes copying bits to or from a buffer. In some embodiments, performing one or more memory operations includes resetting bits in a buffer to random bits or zero bits. In some embodiments, performing one or more memory operations includes comparing bits in a buffer to bits in a second buffer.

[0011] In some embodiments, the action includes accessing a second buffer containing one or more sets of bits, and accessing a second set of bits in the second buffer in the order of a sequence of multiple indices.

[0012] In some embodiments, accessing one set of several specific bit sets of a buffer at one index in the sequence of several indices includes accessing a portion of the buffer corresponding to the index, which includes one set of several specific bit sets.

[0013] In some embodiments, determining that one index in a sequence of multiple indices corresponds to one location in a buffer includes determining that one index in a sequence of multiple indices corresponds to one set of specific bits in a buffer.

[0014] In some embodiments, the action includes determining that the second index of a sequence of multiple indices does not correspond to one or more bits of the buffer, and, based on the determination that the second index of a sequence of multiple indices does not correspond to one or more bits of the buffer, accessing one or more bits and performing a decoy operation on one or more bits.

[0015] A favorable embodiment may include one or more of the following features: The technique described can enable memory operations on a processing device without disclosing enough information for a hacker or other user to obtain sensitive information. The technique described can ensure that when the same input data is processed multiple times (for example, to prevent power analysis as described in this book), a given input data is processed in no particular order with respect to the input bits, resulting in the generation of different power traces. The technique described may include a random number engine that generates an index of the bit set to be processed. The random number engine can generate a sufficient index so that all bits of the input data are processed, but some of the input data can be processed multiple times, and some data not included in the input data, such as decoy data, can be processed for the index generated by the random number engine that is not included in the input data. This form of obfuscation can effectively deter hacking attacks while maintaining processing efficiency (unlike, for example, more intensive security measures involving volatile memory operations).

[0016] Details of one or more embodiments of the present invention are described in the accompanying drawings and the following description. Other features and advantages will become apparent from the description, drawings, and claims. [Brief explanation of the drawing]

[0017] [Figure 1] This figure shows an example of a hacking device that can access sensitive data being processed by a processing device that uses unprotected memory operations. [Figure 2] This figure shows an example of a system for tolerant memory manipulation. [Figure 3A] This flowchart shows an example of a process for tolerant memory manipulation. [Figure 3B] This flowchart illustrates an example of a process for data-copying memory-tolerant operations. [Figure 4] This flowchart shows an example of a computing system used for tolerant memory operations. [Modes for carrying out the invention]

[0018] Similar reference symbols and designations in various drawings refer to the same elements. First, Figure 1 illustrates the problems associated with existing memory operations. Next, techniques proposed to mitigate these problems, in particular, are shown and explained with reference to Figures 2-4. In general, conventional embodiments of computer memory operations (memcpy, memset, or memcmp), as shown in Figure 1, can potentially expose information that a hacker can interpret to reconstruct the secret data or other sensitive data being processed. The techniques described with reference to Figures 2-4 help mitigate this information leakage.

[0019] Figure 1 shows an example of a hacking device 114 accessing sensitive data 106 being processed by a processing device 102 that uses unprotected memory operations. The processing device 102 may include one or more processors configured to perform operations on an unprotected processing engine 104. The unprotected processing engine 104 can perform processes of unprotected memory operations, such as memcpy, memset, or conventional embodiments of memcmp.

[0020] The processing sensor 110, which is communicatively connected to the hacking device 114, senses the operation of the processing device 102, for example, through electromagnetic radiation, magnetic fields, power, etc., emitted by the processing device 102. The processing sensor 110 generates sensor data 112, which may include data representing the amount of electromagnetic radiation emitted from the processing device 102 over time, particularly when the processing device 102 is processing secret data 106, the secret data 106 may be secret as an encryption key or may be highly confidential personal data.

[0021] The hacking device 114 acquires sensor data 112 generated by the processing sensor 110 and provides the sensor data 112 to the hacking engine 116. The hacking engine 116 may include one or more hardware processors programmed with computer-readable instructions to receive the sensor data 112 and process the sensor data 112 to generate secret information. The hacking device 114 can monitor the processing device 102 over a period of time and collect sensor data for multiple processing executions of the processing device 102. The hacking engine 116 of the hacking device 114 can generate secret data 118, which is represented as a bit value 120. This secret data may be the same as or a sufficiently similar copy of secret data 106. In some embodiments, multiple processing executions are used to determine how different inputs affect a given power analysis or timing analysis that can be used (e.g., by a trained machine learning model) to generate a copy or a sufficiently similar copy of secret data 106. Over time, the hacking engine 116 becomes capable of generating secret data 118, which is an exact copy of secret data 106, thereby exposing confidential information or cryptographic keys, and consequently disabling cryptographic security.

[0022] Figure 1 illustrates how an unprotected process could potentially leak information used by a hacking device to determine the sensitive information being processed. Figures 2–4 show, in particular, the techniques proposed to mitigate this problem.

[0023] FIG. 2 is a diagram showing an example of a system 200 for resistant memory operations. The system 200 includes an operation device 202 that modifies data stored in a memory storage 204 so as to prevent information leakage to a hacking device such as the hacking device 114 of FIG. 1. The system 200 includes a memory storage 204, such as hardware configured to store bits. The memory storage 204 can include one or more connected devices. The memory storage 204 may be included in the hardware of the operation device 202 or may be included in the hardware of a device communicatively connected to the operation device 202. Elements such as the memory storage 204 and the operation device 202 can exchange information using one or more wired or wireless connections.

[0024] The operation device 202 operates a splitting engine 210, a random number engine 214 (also called a number generator or a random number generator), and an operation engine 220. The splitting engine 210 splits data from a buffer 206 of the memory storage 204. The random number engine 214 generates a sequence of random numbers, that is, pseudo-random numbers 216 (also called a random sequence of multiple values). The operation engine 220 uses the random number 216 as an index to act on the split bits determined by the splitting engine 210. The operations can include copying bits, resetting bits (e.g., to 0 or another value), or comparing bits (e.g., determining whether a sequence of 0s and 1s is equal to another sequence of 0s and 1s).

[0025] In some embodiments, the operation device 202 accesses one or more other buffers stored in the memory storage 204. For example, the operation device 202 can access the buffer 206 to reset, copy, or compare the bits 208 of the buffer 206. In an example where the bit 208 is compared with other bits in another buffer, the operation device 202 can access the other buffer. Similar to the buffer 206, the operation device 202 can compare elements of two or more buffers using a plurality of indexes generated based on the random number engine 214. For example, when comparing buffers, bit strings can be obtained from two or more buffers being compared using the same random numbers of the sequence generated by the random number engine 214. Parts of the buffer can be compared in this way until all parts of the buffer have been accessed and compared. In some embodiments, the operation engine 220 uses an XOR operation to determine whether two or more entire buffers are the same or different based on a plurality of comparisons of parts of two or more buffers.

[0026] In some embodiments, the random number engine 214 generates an index representing a location within the buffer 206. For example, the operation engine 220 can obtain the random number 216 and directly use the random number 216 to act on the corresponding location within the buffer 206. In some embodiments, the random number engine 214 generates an index representing a value. For example, the operation engine 220 can generate an index using the value of the random number 216, such as the value 218, to generate a memory location identifier. The value may be an offset value from a given start position within the memory of the buffer 206.

[0027] Generally, the random number engine 214 is configured to generate values ​​that can be used to cover all indices in a given buffer. The random number engine 214 is configured to generate values ​​outside the length corresponding to a given buffer. For example, buffer 206 may contain 16,000 bits, corresponding to 500 sets of 32 bits. The sets of 32 bits can be referenced, among other things, using index values ​​such as 0-499 or 1-500. The random number engine 214 can generate values ​​between the minimum and maximum indices (e.g., 0-499), and values ​​outside these boundaries. The out-of-bounds values ​​can be used to obfuscate any self-proclaimed hacking system by adding random processing noise to the processing of the manipulation device 202. Values ​​corresponding to out-of-bounds indices in a given buffer may initiate a decoy process by the manipulation device 202, which would be detected by a hacker's power analysis or timing analysis, potentially increasing the error in any subsequent hacker prediction of the secret information. Similarly, a given buffer can be processed once all processes have been handled, but the order is not necessarily predetermined and may change in subsequent processing rounds of the same buffer or the same input data. In this way, the power or timing profile of the operating device 202, as perceived by the hacking device (e.g., hacking device 114), may change even for the same input, thereby further obfuscating it and preventing the self-proclaimed hacking system from attempting to obtain sensitive information.

[0028] The following describes exemplary cases of copying, resetting, and comparing bits using System 200 shown in Figure 2. Further explanations can be found in the included pseudocode.

[0029] Memory copy operation In the example copy case, the operating device 202 retrieves buffer 206 containing bits 208 from memory storage 204 and determines one or more portions of buffer 206. The operating device 202 may duplicate one or more bits of buffer 206 to another storage location, or it may duplicate one or more bits from another storage location to buffer 206. The partitioning engine 210 can determine one or more sets of bits 212, for example, 212A to 212C. A bit set can include a word, for example, a 32-bit set.

[0030] The random number engine 214 generates a sequence of random values ​​216. An example sequence is shown in 218 as "892, 2, 142567, 8853, ..., 116". The operation engine 220 takes the value 216 and performs an operation on a portion of buffer 206. In this example, the operation involves copying bits from buffer 206 to another location. This other location may be another buffer accessed from memory storage 204 or another memory storage device connected to operation device 202.

[0031] The operation engine 220 determines a first index based on the first value of value 216. The operation engine 220 uses the first index to act on a first portion of buffer 206. In this example, the first value is 892. The operation engine 220 performs operation (892)222 on the portion of buffer 206 corresponding to the value 892. This portion may be the 892nd index of buffer 206, or the 892nd bit of buffer 206, or some other value generated based on the value 892. Since the value 892 corresponds to a location in buffer 206, the actual operation is performed by the operation engine 220 and is not a decoy operation.

[0032] The operation engine 220 determines the second index. The operation engine 220 performs operation (2)224 on the portion of buffer 206 corresponding to the value 2. Similar to the value 892, the portion corresponding to the value 2 may be the second index in buffer 206, the second bit in buffer 206, or some other value generated based on the value 2. Since the value 2 corresponds to a location in buffer 206, the actual operation is performed by the operation engine 220 and is not a decoy operation.

[0033] The operation engine 220 determines the third index. The operation engine 220 performs a decoy operation (142567) 226 on the portion of buffer 206 corresponding to the value 142567. Similar to the values ​​892 and 2 above, the portion corresponding to the value 142567 may be the 142567th index of buffer 206, or the 142567th bit of buffer 206, or some other value generated based on the value 142567.

[0034] Unlike values ​​892 and 2, which correspond to locations within buffer 206, value 142567 does not correspond to a location within buffer 206. Consequently, the operation engine 220 performs a decoy operation. Compared to operations 222 and 224, the decoy operation (142567) 226 may be random and may occupy processing power by the operation device 202 without performing an actual memory copy action (e.g., copying data from the source buffer to the destination buffer). For example, in this scenario, the operation device 202 may, among other possible decoy operations, access data outside buffer 206 and copy existing data to the same location, or access unused memory and shift bits by one or more bits in memory.

[0035] Memory reset operation In the exemplary case of a memory reset, the central elements of accessing a given buffer (e.g., buffer 206) may be the same as those described for a copy operation. Instead of copying from source to destination, the operation engine 220 can reset one or more portions of buffer 206 to 0 or other randomized values ​​using values ​​generated by the random number engine 214. A similar index can be generated for a particular portion of buffer 206. The operation engine 220 can access portions of the buffer using the index generated from the random values ​​216 generated by the random number engine 214.

[0036] For operations within a buffer (e.g., operations 222 or 224), the operation engine 220 may reset the corresponding portion of the buffer to 0 or other randomized values. For example, the operation engine 220 may determine a first index based on the value 892, as described for the copy operation. Operation (892) may include resetting one or more bits at the location in buffer 206 corresponding to the value 892, instead of a copy operation (where buffer 206 may be either the source or the destination) that includes a copy from source to destination.

[0037] A similar reset operation can be performed by the operation engine 220 for operation 224. In the case of decoy operation 226, the operation engine 220 can perform a decoy operation (for example, resetting a value to the same value or moving bits by a specified value in an unused memory location). In this way, power consumption or data leakage due to execution time by the operation device 202 can be reduced for memory reset operations.

[0038] Memory comparison operation In the exemplary case of comparison, the preliminary steps for a given access to a buffer (e.g., buffer 206) may be similar to those for copy and reset operations. However, the operations performed by the operation engine 220 may be different. In some embodiments, the operation device 202 accesses a second buffer for comparison with buffer 206. The splitting engine 210 can determine one or more sets of bits for both buffer 206 and the other buffer for comparison with buffer 206. Although two buffers are described, the same operations can be applied to more than two buffers to compare more than two buffers.

[0039] The random number engine 214 can generate random values ​​(e.g., value 216) used by the operation engine 220. In a comparison operation, the operation engine 220 can access values ​​in both buffer 206 and the buffer being compared with buffer 206. For example, the operation engine 220 can access a portion of buffer 206 corresponding to the value 892 from value 216 and compare it to the number of bits at the location corresponding to the same value 892 in the other buffer being compared. If the values ​​do not match the values ​​in buffer 206 or the buffer being compared, the operation engine 220 can generate a result equivalent to the comparison matching result. In some embodiments, the XOR method is used by the operation engine 220 to determine whether one or more portions of two or more buffers are the same. The result of a comparison operation based on a value generated by the random number engine 214 outside the boundaries of buffer 206 or the buffer being compared may be 0 in the case of XOR. The operation engine 220 can store all the results of the XOR operation between a portion of buffer 206 and a portion of one or more buffers being compared. If the OR operation performed by the operation engine 220 on all stored XOR results is equal to 0, the operation engine 220 stores, displays, and provides to subsequent operations the result that the two or more buffers are the same. By ensuring that the decoy operation provides an XOR result of 0, the comparison system 200 can ensure that the decoy operation fulfills its obfuscation purpose without affecting the fundamental comparison of the two or more buffers.

[0040] In some embodiments, the operation engine 220 performs an operation on a portion determined using a series of random values ​​216. The operation may include any of the copy, reset, or compare operations described herein. In some embodiments, the operation engine 220 performs one or more operations in parallel. For example, the operation engine 220 may include two or more processors that process one or more buffers corresponding to portions of values ​​generated by the random number engine 214. In an exemplary case, two processors of the operation engine 220 can each receive half of the value 216, for example, from index 0 up to the length of the value 216 divided by 2 to the first processor (i.e., the total number of processors), and then receive the subsequent value and the corresponding portion to be processed to the subsequent processor.

[0041] Figure 3A is a flowchart showing an example of process 300A for tolerant memory operation. Process 300 can be performed by one or more electronic systems, such as system 200 in Figure 2. The operation of process 300A is described below for illustrative purposes only. The operation of process 300A can be performed by any suitable device or system, such as any suitable data processing device. The operation of process 300A can also be implemented as instructions stored on a computer-readable medium that may be non-temporary. The execution of the instructions causes one or more data processing devices to perform the operation of process 300A.

[0042] Process 300A includes accessing a buffer containing one or more sets of bits (302A). For example, as illustrated with reference to Figure 2, the operating device 202 accesses buffer 206 from memory storage 204. Memory storage 204 may be communicatively connected to the operating device 202 or it may be included in the hardware of the operating device 202. The operating device 202 can read and write values ​​from buffer 206.

[0043] Process 300A includes generating a random sequence of multiple values ​​(304A). For example, as illustrated with reference to Figure 2, the random number engine 214 generates the value 216. The random number engine 214 can use a pseudo-random number generation algorithm in which all values ​​can be represented as indices of data in buffer 206 or as indices of data not in buffer 206. Using modulo functions and probing methods (e.g., linear probing, quadratic probing with a secret key offset, among other probing methods), the random number engine 214 can generate the value 216 which can be used to generate a sequence of multiple indices, all data in buffer 206 being manipulated at least once, but possibly multiple times, and the operations may include decoy operations that do not act on the data in buffer 206 but help improve security by obfuscating power or timing operations of the operating device 202.

[0044] In some embodiments, generating a random sequence of multiple values ​​involves obtaining values ​​from entropy-delivering hardware. For example, process 300A may include obtaining values ​​from entropy-delivering hardware and generating values ​​from a number generator using the values ​​from the entropy-delivering hardware as a starting key. The entropy-delivering hardware may include certain hardware elements configured to take one or more input value random number requests and generate random numbers based on the input values ​​or requests. In some embodiments, the entropy-delivering hardware generates random numbers using the variance of physical phenomena. For example, variance in fan noise, hard disk drives, mouse clicks or movements, among others, can be used as input for the entropy-delivering hardware to generate one or more random numbers (e.g., at least one random number as a starting key to generate a random sequence of multiple values). The starting key can be used (e.g., by the random number engine 214) as a starting value for a method of probing subsequent values ​​for a random sequence of multiple values ​​or for other pseudo-random number generation. Pseudorandom generation can be configured to generate at least once a value corresponding to every index in the buffer (for example, using modulo operators, quadratic calculations, etc.).

[0045] In some embodiments, process 300A includes providing one or more requirements to a number generator, the one or more requirements including one or more values ​​representing a portion of a buffer. For example, the manipulator device 202 may provide one or more requirements to the random number engine 214 or the manipulator engine 220. The one or more requirements may include the size of one or more buffers (e.g., buffer 206 among other buffers). The size can be used for one or more modulo operations to determine the index used for operations performed by the manipulator engine 220. For example, the modulo value can be used to constrain the number of indices generated by the manipulator engine 220 based on random numbers generated by the random number engine 214 to a region in buffer 206 containing data, or buffer 206 and other parts of buffer 206 or other buffers containing data, enabling decoy operations on those other parts.

[0046] Process 300A includes generating a sequence of multiple indices that represent an order for accessing multiple specific sets of bits in the buffer (306A). For example, as illustrated with reference to Figure 2, the operation engine 220 can determine one or more indices using a value 216 generated by the random number engine 214. The operation engine 220 can generate indices using the value 216 as an offset from a given value (e.g., a starting offset in the storage location of buffer 206), among other index generation algorithms.

[0047] In some embodiments, a sequence of multiple indices may be equal to a random number generated by a random number generator. For example, the random number engine 214 may be configured to output a value that can be directly used as an index by the operation engine 220 (e.g., by the operation device 202). The index may include a location in memory corresponding to the buffer 206.

[0048] Process 300A involves accessing one set of several specific bit sets of the buffer by one index in the sequence of multiple indices (308A). For example, as illustrated with reference to Figure 2, each index of the multiple indices generated by the operation engine 220 may correspond to a particular portion of buffer 206, or a portion of data not present in buffer 206, or other values ​​that do not represent data in buffer 206. For indices corresponding to portions of data in buffer 206, the operation engine 220 can access those portions at the time indicated by the sequence of indices generated based on the sequence of random values ​​216. For other indices, the operation engine 220 may access data not present in buffer 206 (e.g., unused data adjacent to buffer 206 or in other memory storage), or it may not access data but perform a decoy operation.

[0049] As explained, only a few indices may correspond to the data in buffer 206. Before accessing or performing an operation, the operation device 202 can determine whether to perform a decoy operation or an actual memory operation based on one or more known values ​​of the corresponding indices and the indices corresponding to buffer 206. The operation device 202 can also attempt to access buffer 206 using the indices, and if unsuccessful, can determine that the indices do not correspond to the data in buffer 206. Information on which indices are acceptable can also be determined without attempting to access buffer 206 with a given index by determining the size of buffer 206 and the number of bits corresponding to each index (for example, in a 1600-bit buffer containing 50 words, where each word has a corresponding index, indices outside of 0-49 or 1-50 (or the corresponding range to which the memory location offset is applied) can be determined not to correspond to the data in buffer 206).

[0050] In some embodiments, accessing one set of several specific bit sets in a buffer using one index in a sequence of multiple indices is done in response to determining that one index in the sequence of multiple indices corresponds to a location in the buffer. For example, if the operating device 202 determines that a given index does not correspond to a location in buffer 206, the operating device 202 may perform a decoy operation as described. If the operating device 202 determines that a given index corresponds to a location in buffer 206, the operating device 202 may perform a memory operation (e.g., copy, reset, or compare).

[0051] Process 300A, after accessing a set, includes performing one or more memory operations on one of the sets of bits (310A). For example, as illustrated with reference to Figure 2, the operation engine 220 may perform operations 222, 224, and 226, where operation 226 is a decoy operation based on a corresponding random value that produces an index that does not correspond to the data in buffer 206. However, to a hacker observing the computation of operation device 202, decoy operation 226 may look similar to operations 222 and 224, thereby partially obfuscating the operations of operation device 202. Operations 222 and 224 may include copying bits to or from buffer 206, comparing bits in buffer 206 to bits in one or more other buffers, or resetting one or more bits in buffer 206. Operations 222 and 224 may each include acting on specific parts of buffer 206 corresponding to indices generated based on the random values ​​"892" and "2". The random value 216 is shown for illustrative purposes only and can generally be any value.

[0052] In some embodiments, a decoy operation may include copying or comparing already copied or compared elements of one or more buffers. For example, for a given index not associated with a portion of buffer 206, the operation engine 220 may perform a decoy operation such as copying or comparing already copied or compared elements of buffer 206 or other buffers (e.g., buffers being compared with buffer 206). For a reset operation, the decoy operation may include resetting already reset portions of buffer 206 or other buffers. When the generated index is repeated (e.g., representing the same portion of buffer 206 or other buffers), the operation engine 220 may perform operations such as copying, resetting, or comparing already copied, reset, or compared elements of one or more buffers. Generally, this can be useful in obfuscating the power profile or timing profile of the operations performed by the operation device 202.

[0053] The following are example code snippets that may be used to implement the techniques described in this book.

[0054] These functions can be used to traverse the buffer in a random order, thwarting conventional power analysis attacks among other attacks, and to make the dense behavior of calls to these functions appear as if the functions have minimal dependence on the power usage input. --- sw / device / lib / base / hardened_memory.c | 178 +++++++++++++++++++++++++++ sw / device / lib / base / hardened_memory.h | 88 +++++++++++++ sw / device / lib / base / meson.build | 12++ 3 files changed, 278 insertions(+) create mode 100644 sw / device / lib / base / hardened_memory.c create mode 100644 sw / device / lib / base / hardened_memory.h diff --git a / sw / device / lib / base / hardened_memory.c b / sw / device / lib / base / hardened_memory.c new file mode 100644 index 000000000..8b44a6893 --- / dev / null +++ b / sw / device / lib / base / hardened_memory.c @@ -0,0 +1,178 @@ +#include "sw / device / lib / base / hardened_memory.h" + +#include "sw / device / lib / base / memory.h" +#include "sw / device / lib / base / random_order.h" + + / / NOTE: The three hardened_mem* functions have similar contents, but the parts that are shared between them are commented only in `memcpy()`. +void hardened_memcpy(uint32_t *restrict dest, const uint32_t *restrict src, + size_t word_len) { + random_order_t order; + random_order_init(&order, word_len); + + size_t count = 0; + size_t expected_count = random_order_len(&order); + + / / Immediately convert `src` and `dest` to addresses, which erases their provenance and causes their addresses to be exposed (in the provenance sense). + uintptr_t src_addr = (uintptr_t)src; + uintptr_t dest_addr = (uintptr_t)dest; + + / / `decoys` can be a small stack array that is filled with uninitialized memory. It is scratch space for us to do "extra" operations, when the the number of iteration indices the chosen random order is different from `words`. + / / + / / These extra operations also introduce noise that an attacker must do work to filter, such as by applying side-channel analysis to obtain an address trace. + uint32_t decoys[8]; + uintptr_t decoy_addr = (uintptr_t)&decoys; + + / / We can launder `count`, so that the SW.LOOP-COMPLETION check is not deleted by the compiler. + for (; count < expected_count; count = launderw(count)) { + / / The order values themselves are in units of words, but we need `idx` to be in units of bytes. + / / The value obtained from `advance()` is laundered, to prevent implementation details from leaking across procedures. + size_t idx = launderw(random_order_advance(&order)) * sizeof(uint32_t); + + / / Prevent the compiler from reordering the loop; this can ensure a happens-before among indices consistent with `order`. + barrierw(idx); + + / / Compute putative offsets into `src`, `dest`, and `decoys`. Some of these may go off the end of `src` and `dest`, but, in some cases, they may not be cast to pointers. (Note that casting out-of-range can address to pointers is UB.) + uintptr_t srcp = src_addr + idx; + uintptr_t destp = dest_addr + idx; + uintptr_t decoy1 = decoy_addr + (idx & 7); + uintptr_t decoy2 = decoy_addr + ((idx + 4) & 7); + + / / Branchlessly select whether to do a "real" copy or a decoy copy, depending on whether we've gone off the end of the array or not. + / / Pretty much everything can be laundered: we can launder `idx`for obvious reasons, and can launder the result of the select, so that the compiler does not delete resulting loads and stores. This is similar to having used `volatile uint32_t *`. + void *src = (void *)launderw( + ct_cmovw(ct_sltuw(launderw(idx), word_len), srcp, decoy1)); + void *dest = (void *)launderw( + ct_cmovw(ct_sltuw(launderw(idx), word_len), destp, decoy2)); + + / / Perform the copy, without performing a typed dereference operation. + write_32(read_32(src), dest); +} + + / / No need to launder here; it's the final use of `count`, which has been laundered above. This ensures that we have traversed the entire random order sequence. CHECK(count == expected_count); +} + + / / TODO: This needs to be wired up. +static uint32_t random_word(void) { return 0xcaffe17e;} + +void hardened_memshred(uint32_t *dest, size_t word_len) { + random_order_t order; + random_order_init(&order, word_len); + + size_t count = 0; + size_t expected_count = random_order_len(&order); + + uintptr_t data_addr = (uintptr_t)dest; + + uint32_t decoys[8]; + uintptr_t decoy_addr = (uintptr_t)&decoys; + + for (; count < expected_count; count = launderw(count)) { + size_t idx = launderw(random_order_advance(&order)) * 4; + barrierw(idx); + + uintptr_t datap = data_addr + idx; + uintptr_t decoy = decoy_addr + (idx & 7); + + void *data = (void *)launderw( + ct_cmovw(ct_sltuw(launderw(idx), word_len), datap, decoy)); + + / / Write a freshly-generated random word to `*data`. + write_32(random_word(), data); +} + + / / CHECK(count == expected_count); +} + +hardened_bool_t hardened_memeq(const uint32_t *lhs, const uint32_t *rhs, + size_t word_len) { + random_order_t order; + random_order_init(&order, word_len); + + size_t count = 0; + size_t expected_count = random_order_len(&order); + + uintptr_t a_addr = (uintptr_t)lhs; + uintptr_t b_addr = (uintptr_t)rhs; + + / / `decoys` can be filled with equal values this time around. It should be filled with values with a Hamming weight of around 16, which is the most common hamming weight among 32-bit words. + uint32_t decoys = { + 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, + 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, +}; + uintptr_t decoy_addr = (uintptr_t)&decoys; + + uint32_t zeros = 0; + uint32_t ones = UINT32_MAX; + + / / The loop is almost token-for-token the one above, but the copy is replaced with something else. + for (; count < expected_count; count = launderw(count)) { + size_t idx = launderw(random_order_advance(&order)) * 4; + barrierw(idx); + + uintptr_t ap = a_addr + idx; + uintptr_t bp = b_addr + idx; + uintptr_t decoy1 = decoy_addr + (idx & 7); + uintptr_t decoy2 = decoy_addr + ((idx + 4) & 7); + + void *av = (void *)launderw( + ct_cmovw(ct_sltuw(launderw(idx), word_len), ap, decoy1)); + void *bv = (void *)launderw( + ct_cmovw(ct_sltuw(launderw(idx), word_len), bp, decoy2)); + + uint32_t a = read_32(av); + uint32_t b = read_32(bv); + + / / Launder one of the operands, so that the compiler cannot cache the result of the xor for use in the next operation. + / / + / / We launder `zeroes` so that compiler cannot learn that `zeroes` has strictly more bits set at the end of the loop. + zeros = launder32(zeros) | (launder32(a) ^ b); + + / / Same as above. The compiler can cache the value of `a[offset]`, but it has no chance to strength-reduce this operation. + ones = launder32(ones) & (launder32(a) ^ ~b); +} + + / / NOTE(moidx): shuffled_memcmp from #6924 has a better method to ensure that all the addresses where traversed. + + / / CHECK(count == expected_count); + if (launder32(zeros) == 0) { + / / CHECK(launder(ones) == UINT32_MAX); + return kHardenedBoolTrue; +} + + / / Optional? CHECK(launder(ones) != UINT32_MAX); + return kHardenedBoolFalse; +} diff --git a / sw / device / lib / base / hardened_memory.h b / sw / device / lib / base / hardened_memory.h new file mode 100644 index 000000000..b45d13d6b --- / dev / null +++ b / sw / device / lib / base / hardened_memory.h @@ -0,0 +1,88 @@ +#ifndef OPENTITAN_SW_DEVICE_LIB_BASE_HARDENED_MEMORY_H_ +#define OPENTITAN_SW_DEVICE_LIB_BASE_HARDENED_MEMORY_H_ + + / ** + * @file + * @brief Hardened memory operations for constant power buffer manipulation. + * / + +#include <stddef.h> +#include <stdint.h> + +#include "sw / device / lib / base / hardened.h" + +#ifdef __cplusplus [[ID=,44]]+extern "C" { +#endif / / __cplusplus Memory copy operation + / ** + * Copies 32-bit words between non-overlapping regions. + * Unlike `memcpy()`, this function has important differences: + * - It may be slower than non-secured memory operations, since it mitigates power-analysis attacks. + * - It can performs operations on 32-bit words, among other sizes. It can also perform operations on bytes. + * - It can return void. + * + * For the example code, input pointers *MUST* be 32-bit aligned, although they do not need to actually point to memory declared as `uint32_t` per the C aliasing rules. However, other sizes of bits can be used by varying the expected size of bits in the above sample code. + * Internally, this function is careful to not dereference its operands directly, and instead uses dedicated load / store intrinsics. + * + * @param dest The destination of the copy. + * @param src The source of the copy. + * @param word_len The number of words to copy. + * / +void hardened_memcpy(uint32_t *restrict dest, const uint32_t *restrict src, + size_t word_len); Memory setting operation + / ** + * Fills a 32-bit aligned region of memory with random data. + * + * Unlike `memset()`, this function has important differences: + * - It can be slower than unsecured memory operations, since it mitigates power-analysis attacks. + * - It performs operations on 32-bit words, rather than bytes but this size can change depending on implementations of the above sample code. + * - The sample code does not allow for fill value to be specified but other implementations of the sample code may include the ability to obtain a fill value and use that for memory setting. + * - It returns void. + * + * For the example code, input pointers *MUST* be 32-bit aligned, although they do not need to actually point to memory declared as `uint32_t` per the C aliasing rules. However, other sizes of bits can be used by varying the expected size of bits in the above sample code. + * Internally, this function is careful to not dereference its operands directly, and instead uses dedicated load / store intrinsics. + * + * @param dest The destination of the set. + * @param word_len The number of words to write. + * / +void hardened_memset(uint32_t *dest, uint32_t value, size_t word_len); + Memory comparison operation + / ** + * Compare two potentially-overlapping 32-bit aligned regions of memory for + * equality. + * + * Unlike `memcmp()`, this function has important differences: + * - It is significantly slower, since it mitigates power-analysis attacks. + * - It performs operations on 32-bit words, rather than bytes but this size can change depending on implementations of the above sample code. + * - It only computes equality, not lexicographic ordering, which would be even slower. Some implementations can include this feature. + * - It returns a `hardened_bool_t`. + * + * For the example code, input pointers *MUST* be 32-bit aligned, although they do not need to actually point to memory declared as `uint32_t` per the C aliasing rules. However, other sizes of bits can be used by varying the expected size of bits in the above sample code. + * Internally, this function is careful to not dereference its operands directly, and instead uses dedicated load / store intrinsics. + * + * @param lhs The first buffer to compare. + * @param rhs The second buffer to compare. + * @param word_len The number of words to write. + * / +hardened_bool_t hardened_memeq(const uint32_t *lhs, const uint32_t *rhs, + size_t word_len); + +#ifdef ____cplusplus +} / / extern "C" +#endif / / __cplusplus + This specification generally describes memory operations that can be implemented as computer programs on one or more computers located in one or more locations.

[0055] This specification defines three memory operations. These operations are resilient to failures and power attacks and, at best, portable to new platforms, while achieving purposes similar to memcpy, memcmp, and memset.

[0056] In some embodiments, the memory operations described in this document have the following signatures.

[0057] void hardened_memcpy(uint32_t* dest, const uint32_t* src, size_t words); hardened_bool_t hardened_memeq(const uint32_t* a, const uint32_* b, size_t words); void hardened_memshred(uint32_t* dest, size_t words); Some exemplary features of several embodiments of the signature described above are described below.

[0058] hardened_memcpy and hardened_memshred return voids here, not pointers.

[0059] The arguments for the three memory operations can include pointers to a buffer of 32-bit aligned words.

[0060] The length of the three memory operations can be expressed in words rather than bytes. `fixed_memeq` can include comparisons for equality, rather than lexicographical order.

[0061] Harddened_memshred can fill the destination with random data.

[0062] Some primitives of embodiments of these operations are described below. The operations described can be performed by the system 200 shown in Figure 2, which includes an operating device 202.

[0063] In this specification, value barriers, denoted as launder(x), act as barriers to what information the compiler can learn about "x". This prevents the compiler from learning that the value is zero or from monotonically incrementing, thereby suppressing undesirable sorting or code folding optimizations.

[0064] In this specification, the purity barrier, referred to as barrier(x), functions as a barrier against compiler side effect analysis. The compiler must assume that the current value of "x" is externally observed for all other barrier(x) calls. This prevents certain undesirable sorting optimizations.

[0065] Selection for a certain period of time. Given integers a, b, c, and d of word size, "a > b? c : d" and "a == b? c : d" can be calculated without using branch instructions.

[0066] A pseudo-random iterative sequence (PRIS) generator such as the random number engine 214 described with reference to FIG. 2. Given a value N, the generator can output a pseudo-random sequence of integers s(i) of length M >= N such that for all 0 <= n < N, there is at least one j and thus s(j) = n. The sequence visits all the numbers from 0 to N at least once and may visit other numbers in some cases. In the example of FIG. 2, all the numbers from 0 to N can include all the bit sets included in the buffer 206.

[0067] Pseudo-random uniform bit generator. An exemplary flowchart for implementing hardened-memcpy is included in FIG. 3B and will be further described below. Additional details of this hardened function and other hardened functions are described and shown by referring to the section of the pseudo-code included in this book.

[0068] To implement hardened_memcpy, first, a PRIS is created using a word of N=#. An array of padding words of 2^k (k is relatively small, for example, k = 3) is also allocated on the stack. After obtaining the addresses of the input pointers dest and src, an exemplary PRIS can be generated in pseudo-code like C as follows.

[0069] seq s = make_sequence(words); Next, the length of the sequence is obtained and laundered to prevent loop optimization considering the known relationship between "word" and "length" specific to the PRIS generator algorithm (i.e., "length = word * 2"). An example of pseudo-code like C is shown below.

[0070] size_t length = launder(s.length()); size_t i; uint32_t decoys[DECOY_N]; The loop index "i" is cleaned to prevent a given compiler, such as the compiler for the operating device 202 shown in Figure 2, from realizing that the loop is a monotonous loop. An example of pseudocode in C-like language is shown below.

[0071] for (i = 0;i < length;i = launder(i + 1)) { In this specification, the index referred to as idx is then obtained and cleaned to conceal the internals of the sequence algorithm as described above. Since barrier() cannot be reordered, the barrier() function is then executed on idx to ensure that the iterative steps are performed in the exact order specified. An example of pseudocode in C-like language is shown below.

[0072] size_t idx = launder(s.next()); Barrier (idx); Next, in the example of a memory copy operation, we choose without branching whether to perform an actual copy of src to dest or a decoy copy depending on whether idx exceeds the size of the sequence. An example of pseudocode similar to C is shown below.

[0073] uint32_t* from = idx <= words ? &src[idx] : &decoys[idx % DECOY_N]; uint32_t* to = idx <= words ? &dest[idx] : &decoys[(idx * 3) % DECOY_N]; Word-sized loading / storing can be used to widen the width of Hamming weight (HW) model distributions by performing a copy without performing typed dereferencing operations. An example of pseudocode in C-like language is shown below.

[0074] *to = *from; } As a fault injection protection measure, verification is then performed to confirm that the loop has actually completed.

[0075] The index `idx` is cleaned to prevent the compiler from identifying `idx` as equal to the length in the abstract computer model. An example of pseudocode in C-like language is shown below.

[0076] CHECK(launder(idx) == length); Hardened_memshred is identical to hardened-memory, except that the above *from calculation is replaced with a call to a uniform bit generator, resulting in a random 32-bit integer or a set of zeros.

[0077] `hardened_memeq` is a variation of the conventional fixed-time memory comparison. An example of pseudocode in C-like language is shown below.

[0078] seq s = make_sequence(words); size_t length = launder(s.length()); size_t i; uint32_t zeros = 0;uint32_t ones = ~0; Here, the decoys must all have the same value, such as high-weight constants that are not prominent in Hamming weight analysis. An example of pseudocode in C-like language is shown below.

[0079] uint32_t decoys[DECOY_N] = {kHighWeight, ...}; for (i = 0;i < length;i = launder(i + 1)) { size_t idx = launder(s.next()); Barrier (idx); uint32_t* ap = idx <= words ? &src[idx] : &decoys[idx % DECOY_N]; uint32_t* bp = idx <= words ? &dest[idx] : &decoys[(idx * 3) % DECOY_N]; uint32_t a = *ap; uint32_t b = *bp; Next, (i) the OR of all XORs of a and b, and (ii) the AND of all XNORs are accumulated. If the two buffers are equal, they will both be exactly zero and all 1 at the end of the loop. If they are not equal, neither will be zero or all 1. The remaining two possibilities (one equal to the expected value and the other not) are less likely conditions that can be used to attempt and detect tampering. An example of pseudocode in C-like language is shown below.

[0080] zeros = launder(zeros) | (launder(a) ^ b); ones = launder(ones) & (launder(a) ^ ~b); } In addition to checking whether the loop has completed, the aforementioned properties of variables zero and one can be used to perform additional checks to catch tampering. An example of pseudocode in C-like language is shown below.

[0081] CHECK(launder(i) == length); if (zeros != 0) { CHECK(ones != -1); return false; else { CHECK(ones== -1); return true; This specification uses the term “configured” in relation to systems and computer program components. A system of one or more computers configured to perform a particular operation or action means that the system has software, firmware, hardware, or a combination thereof installed on it that causes the system to perform an operation or action while in operation. A system of one or more computer programs configured to perform a particular operation or action means that one or more programs, when executed by a data processing device, contain instructions that cause the device to perform an operation or action.

[0082] The subject matter and functional embodiments described herein can be implemented in digital electronic circuits, tangibly embodied computer software or firmware, computer hardware, including structures disclosed herein and their structural equivalents, or one or more combinations thereof. Embodiments of the subject matter described herein can be implemented as one or more modules of computer programs, i.e., computer program instructions encoded on a tangible non-temporary storage medium for execution by a data processing device or for controlling the operation of a data processing device. The computer storage medium may be a machine-readable storage device, a machine-readable storage board, a random or serial access memory device, or one or more combinations thereof. Alternatively or further, the program instructions can be encoded in artificially generated propagating signals, such as mechanically generated electrical signals, optical signals, or electromagnetic signals, which are generated to encode information for transmission to a suitable receiver device for execution by a data processing device.

[0083] The term "data processing device" refers to data processing hardware and encompasses all types of devices, machines, and equipment for processing data, including, for example, programmable processors, computers, or multiple processors or computers. A device may be, or further may be, a special-purpose logic circuit, such as an FPGA (Field-Programmable Gate Array) or ASIC (Application-Specific Integrated Circuit). In addition to hardware, a device may optionally include code that creates the execution environment for computer programs, such as processor firmware, protocol stacks, database management systems, operating systems, or code that constitutes one or more of these.

[0084] Computer programs, which may be called or described as programs, software, software applications, apps, modules, software modules, scripts, or code, can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as standalone programs or as modules, components, subroutines, or other units suitable for use in a computing environment. A program may, but does not have to be, a file in a file system. A program may be part of a file that holds one or more scripts stored in a markup language document, a single file dedicated to the program of interest, or multiple collaborative files, such as a file that holds one or more modules, subprograms, or parts of code. A computer program can be deployed to run on one computer or on multiple computers located in one location or distributed across multiple locations and interconnected by a data communication network.

[0085] In this specification, the term “engine” is used broadly to refer to a software-based system, subsystem, or process programmed to perform one or more specific functions. Generally, an engine is implemented as one or more software modules or components and installed on one or more computers in one or more locations. In some cases, one or more computers are dedicated to a particular engine, while in other cases, multiple engines may be installed and run on the same one or more computers. In some embodiments, an engine includes one or more processors that may be exclusively assigned to that engine or shared with other engines.

[0086] The processes and logic flows described herein can be performed by one or more programmable computers executing one or more computer programs to act on input data and produce outputs, thereby performing their functions. Alternatively, the processes and logic flows can be performed by special-purpose logic circuits, such as FPGAs or ASICs, or by a combination of special-purpose logic circuits and one or more programmed computers.

[0087] A computer suitable for running computer programs can be based on a general-purpose or dedicated microprocessor, or both, or any other type of central processing unit. Generally, the central processing unit receives instructions and data from read-only memory, random-access memory, or both. The basic elements of a computer are the central processing unit for executing and running instructions, and one or more memory devices for storing instructions and data. The central processing unit and memory can be complemented or incorporated by dedicated logic circuits. Generally, a computer also includes one or more mass storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, or is operablely coupled to them for receiving data from them, transferring data to them, or both. However, such devices are not necessary for a computer. Furthermore, to give some examples, a computer can be embedded in other devices, such as mobile phones, personal digital assistants (PDAs), mobile audio or video players, game consoles, Global Positioning System (GPS) receivers, or portable storage devices, such as Universal Serial Bus (USB) flash drives.

[0088] Computer-readable media suitable for storing computer program instructions and data include, for example, semiconductor memory devices such as EPROMs, EEPROMs, and flash memory devices, magnetic disks such as internal hard disks or removable disks, magneto-optical disks, and CD-ROMs and DVD-ROM disks, and all forms of non-volatile memory, media, and memory devices.

[0089] To interact with the user, embodiments of the subject matter described herein can be implemented in a computer having a display device for displaying information to the user, such as a CRT (cathode ray tube) or LCD (liquid crystal screen) monitor, and a keyboard and pointing device, such as a mouse or trackball, through which the user can input to the computer. Other types of devices can also be used to provide interaction with the user. For example, the feedback provided to the user may be any form of sensory feedback, such as visual feedback, auditory feedback, or haptic feedback, and input from the user may be received in any form, such as acoustic input, voice input, or haptic input. Furthermore, the computer can interact with the user by sending and receiving documents to and from the device used by the user, for example, by sending a web page to a web browser on the user's device in response to a request received from a web browser. The computer can also interact with the user by sending text messages or other forms of messages to a personal device, such as a smartphone running a messaging application, and receiving a response message from the user in return.

[0090] Embodiments of the subject matter described herein can be implemented in a computing system including, for example, a backend component as a data server, or a computing system including a middleware component, for example, an application server, or a frontend component, for example, a client computer having a graphical user interface, a web browser, or an application that allows a user to interact with embodiments of the subject matter described herein, or in a computing system including any combination of one or more such backend, middleware, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication, for example, a communication network. Examples of communication networks include local area networks (LANs), wide area networks (WANs), for example, the Internet.

[0091] A computing system can include a client and a server. The client and server are generally geographically distant from each other and typically interact through a communication network. The client-server relationship arises from computer programs running on each computer that have a client-server relationship with each other. In some embodiments, the server sends data, such as an HTML page, to a user device for the purpose of displaying data to a user interacting with a device acting as a client and receiving user input from that user. Data generated on the user device, such as the results of user interactions, can be received by the server from the device.

[0092] While this specification includes details of many specific embodiments, these should not be construed as limiting the scope of any invention or claimable scope, but rather as descriptions of features that may be specific to a particular embodiment of a particular invention. Certain features described herein in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features of the invention described in the context of a single embodiment may be implemented separately or in any preferred subcombination in multiple embodiments. Furthermore, features may be described above as functioning in a particular combination, and even if initially claimed as such, one or more features from the claimed combination may be removed from the combination, and the claimed combination may cover a subcombination or a variation of a subcombination.

[0093] Similarly, while the drawings show operations in a specific order and the claims describe operations in a specific order, this should not be understood as requiring that such operations be performed in a specific or sequential order shown, or that all shown operations be performed, in order to obtain the desired results. In certain situations, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the embodiments described above should not be understood as requiring such separation in all embodiments, and the described program components and systems can generally be integrated into a single software product or packaged into multiple software products.

[0094] Specific embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. For example, the desired results can still be obtained by performing the actions described in the claims in a different order. As an example, the process shown in the accompanying drawings does not necessarily require that the actions be performed in a specific or sequential order shown in order to obtain the desired results. In some cases, multitasking and parallel processing may be advantageous.

[0095] Figure 4 shows an example of a computing system used for tolerant memory operations. The computing system includes a computing device 400 and a mobile computing device 450 that can be used to implement the techniques described herein. For example, one or more components of system 100 may be a computer system that implements an example of the computing device 400 or the mobile computing device 450, for example, an operating device 202, a device that accesses information from the operating device 202, or a storage unit (e.g., memory storage 204) that accesses or stores information about operations performed by the operating device 202.

[0096] Computing device 400 is intended to represent various forms of digital computers, including laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. Mobile computing device 450 is intended to represent various forms of mobile devices, including personal digital assistants, cellular phones, smartphones, mobile embedded wireless systems, wireless diagnostic computing devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are intended to be illustrative only and not to be limiting.

[0097] The computing device 400 includes a processor 402, memory 404, a storage device 406, a high-speed interface 408 connected to memory 404 and several high-speed expansion ports 410, and a low-speed interface 412 connected to a low-speed expansion port 414 and the storage device 406. Each of the processor 402, memory 404, storage device 406, high-speed interface 408, high-speed expansion ports 410, and low-speed interface 412 is interconnected using various buses and may be mounted on a common motherboard or in other ways as needed. The processor 402 can process instructions for execution within the computing device 400, including instructions for displaying graphical information of a GUI on an external input / output device such as a display 416 coupled to the high-speed interface 408, which is stored in memory 404 or the storage device 406. In other embodiments, multiple processors and / or multiple buses may be used as needed, along with multiple memories and memory types. Furthermore, multiple computing devices may be connected, with each device providing a portion of the operation (e.g., as a server bank, a group of blade servers, or a multiprocessor system). In some embodiments, the processor 402 is a single-threaded processor. In some embodiments, the processor 402 is a multi-threaded processor. In some embodiments, the processor 402 is a quantum computer.

[0098] Memory 404 stores information within the computing device 400. In some embodiments, memory 404 is a volatile memory unit. In some embodiments, memory 404 is a non-volatile memory unit. Memory 404 may also be another form of computer-readable medium, such as a magnetic disk or an optical disk.

[0099] The storage device 406 can provide high-capacity storage to the computing device 400. In some embodiments, the storage device 406 is or can include computer-readable media such as a floppy disk device, hard disk device, optical disk device, or tape device, flash memory or other similar solid-state memory device, or storage area network, or other configuration devices. Instructions can be stored in an information carrier. When executed by one or more processing devices (e.g., processor 402), the instructions perform one or more methods such as those described above. Instructions can also be stored in one or more storage devices (e.g., memory 404, storage device 406, or memory on processor 402) such as computer-readable or machine-readable media. The high-speed interface 408 manages bandwidth-intensive operations for the computing device 400, while the low-speed interface 412 manages less bandwidth-intensive operations. Such function assignments are merely examples. In some embodiments, the high-speed interface 408 is coupled to memory 404, a display 416 (e.g., via a graphics processor or accelerator), and a high-speed expansion port 410 that can accept various expansion cards (not shown). In embodiments, the low-speed interface 412 is coupled to a storage device 406 and a low-speed expansion port 414. The low-speed expansion port 414 may include various communication ports (e.g., USB, Bluetooth®, Ethernet®, Wireless Ethernet) and may be coupled to one or more input / output devices such as a keyboard, pointing device, scanner, or network devices such as a switch or router, for example, via a network adapter.

[0100] The computing device 400 can be implemented in many different forms, as shown in the figure. For example, the computing device 400 may be implemented as a standard server 420, or it may be implemented multiple times in a group of such servers. Furthermore, the computing device 400 may be implemented in a personal computer such as a laptop computer 422. Alternatively, the computing device 400 may be implemented as part of a rack server system 424. Instead, the components of the computing device 400 may be combined with other components of a mobile device, such as a mobile computing device 450. Each of such devices may include one or more computing devices 400 and mobile computing devices 450, and the entire system may consist of multiple computing devices communicating with each other.

[0101] The mobile computing device 450 includes, among other components, a processor 452, memory 464, input / output devices such as a display 454, a communication interface 466, and a transceiver 468. The mobile computing device 450 may also provide additional storage by comprising a storage device such as a microdrive or other device. Each of the processor 452, memory 464, display 454, communication interface 466, and transceiver 468 is interconnected using various buses, and some of the components may be mounted on a common motherboard or in other ways as needed.

[0102] The processor 452 can execute instructions within the mobile computing device 450, including instructions stored in memory 464. The processor 452 may be implemented as a chipset of a chip that includes multiple separate analog processors and a digital processor. The processor 452 may provide applications run by the mobile computing device 450 and wireless communication by the mobile computing device 450 for the cooperation of other components of the mobile computing device 450, such as controlling the user interface.

[0103] The processor 452 may communicate with the user via a control interface 458 and a display interface 456 coupled to the display 454. The display 454 may be, for example, a TFT LCD (thin-film transistor liquid crystal display) display or an OLED (organic light-emitting diode) display, or other suitable display technology. The display interface 456 may include suitable circuitry for driving the display 454 to present graphic information and other information to the user. The control interface 458 may receive commands from the user and translate the commands for submission to the processor 452. Furthermore, an external interface 462 may provide communication with the processor 452 to enable short-range communication of the mobile computing device 450 with other devices. In some embodiments, the external interface 462 may provide, for example, wired communication, and in other embodiments, it may provide wireless communication, and multiple interfaces may be used.

[0104] Memory 464 stores information within the mobile computing device 450. Memory 464 can be implemented as one or more computer-readable media, volatile memory units, and non-volatile memory units. Extended memory 474 is also provided to the mobile computing device 450 and may be connected to the mobile computing device 450 via an extended interface 472, which may include, for example, a SIMM (Single In-Line Memory Module) card interface. Extended memory 474 may provide additional storage space to the mobile computing device 450 or store applications or other information for the mobile computing device 450. Specifically, extended memory 474 may include instructions that perform or supplement the above-described operations and may include secure information. For example, extended memory 474 may be provided as a security module for the mobile computing device 450 and may be programmed with instructions that enable secure use of the mobile computing device 450. Furthermore, secure applications may be provided via a SIMM card along with additional information, such as placing identification information on the SIMM card in a hack-proof manner.

[0105] The memory may include, for example, flash memory and / or NVRAM memory (non-volatile random access memory), as described below. In some embodiments, instructions are stored in an information carrier so that when an instruction is executed by one or more processing devices (e.g., processor 452), it performs one or more methods, such as those described above. Instructions may also be stored in one or more storage devices, such as one or more computer-readable or machine-readable media (e.g., memory 464, extended memory 474, or memory on processor 452). In some embodiments, instructions can be received as signals propagated, for example, via transceiver 468 or external interface 462.

[0106] The mobile computing device 450 may communicate wirelessly through a communication interface 466, which may in some cases include digital signal processing circuits. The communication interface 466 may provide communication under various modes or protocols, including, among others, GSM® voice calling (Global System for Mobile Communications), SMS (Short Message Service), EMS (Extended Message Service), or MMS messaging (Multimedia Messaging Service), CDMA (Code Division Multiple Access), TDMA (Time Division Multiple Access), PDC (Personal Digital Cellular), WCDMA® (Wideband Code Division Multiple Access), CDMA2000, or GPRS (General Packet Radio Service), LTE, 5G / 6G cellular, etc. Such communication may be carried out, for example, via a transceiver 468 using radio frequencies. Furthermore, short-range communication may be performed, for example, using Bluetooth, WiFi, or other such transceivers (not shown). Furthermore, the GPS (Global Positioning System) receiver module 470 may provide the mobile computing device 450 with additional radio data related to navigation and location, which may be used as needed by applications running on the mobile computing device 450.

[0107] The mobile computing device 450 may also perform voice communication using an audio codec 460 that can receive speech information from the user and convert it into usable digital information. The audio codec 460 may also similarly generate audible sounds for the user, for example, through a speaker in the handset of the mobile computing device 450. Such sounds may include sounds from voice telephone calls, recorded sounds (e.g., voice messages, music files, etc.), or sounds generated by applications running on the mobile computing device 450.

[0108] The mobile computing device 450 can be implemented in many different forms, as shown in the figure. For example, the mobile computing device 450 can be implemented as a mobile phone 480. The mobile computing device 450 can also be implemented as part of a smartphone 482, a personal digital assistant, or other similar mobile device.

[0109] Several embodiments have been described. Nevertheless, it is understood that various modifications can be made without departing from the spirit and scope of this disclosure. For example, the various forms of flows shown above can be used with steps rearranged, added, or deleted.

[0110] All embodiments of this specification and the functional operations described herein can be implemented in computer software, firmware, or hardware, or one or more combinations thereof, including digital electronic circuits or the structures disclosed herein and their structural equivalents. Embodiments of the present invention can be implemented as one or more computer program products, such as one or more modules of computer program instructions encoded on a computer-readable medium for execution by a data processing device or for controlling the operation of a data processing device. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a memory device, or a composition that generates a machine-readable propagating signal, or one or more combinations thereof.

[0111] The term “data processing device” encompasses all devices, machines, and equipment for processing data, including, for example, a programmable processor, a computer, or multiple processors or computers. In addition to hardware, a device may also include code that constitutes the execution environment for the computer program in question, such as processor firmware, a protocol stack, a database management system, an operating system, or one or more combinations thereof. A propagating signal is a signal generated to encode information for transmission to a suitable receiver device, such as a mechanically generated electrical signal, an optical signal, or an electromagnetic signal, which is an artificially generated signal.

[0112] A computer program (also known as a program, software, software application, script, or code) can be written in any form of programming language, including compiled or interpreted languages, and can be deployed in any form, including as a standalone program or as modules, components, subroutines, or other units suitable for use in a computing environment. A computer program is not necessarily equivalent to a file in a file system. A program can be stored in a single file dedicated to it, as part of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), or in multiple coordinated files (e.g., a file that stores one or more modules, subprograms, or parts of code). A computer program can be deployed to run on one computer, or on multiple computers located in one location or distributed across multiple locations and interconnected by a communication network.

[0113] The processes and logic flows described herein can be performed by one or more programmable processors executing one or more computer programs to act on input data and produce outputs, thereby performing their functions. Process and logic flows can also be performed by special-purpose logic circuits, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits), and devices can also be implemented as special-purpose logic circuits.

[0114] A processor suitable for executing a computer program includes, for example, both general-purpose and special-purpose processors, and one or more processors of any type of digital computer. Generally, a processor receives instructions and data from read-only memory, random-access memory, or both. The basic elements of a computer are a processor for executing instructions, and one or more memory devices for storing instructions and data. Generally, a computer also includes one or more mass storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, or is operablely coupled to them for receiving data from them, transferring data to them, or both. However, such devices are not necessary for a computer. Furthermore, to give some examples, a computer can be embedded in other devices, such as tablet computers, mobile phones, personal digital assistants (PDAs), mobile audio players, and Global Positioning System (GPS) receivers. Computer-readable media suitable for storing computer program instructions and data include, for example, all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices), magnetic disks (e.g., internal hard disks or removable disks), magneto-optical disks, and CD-ROM and DVD-ROM disks. Processors and memory may be complemented by or incorporated into dedicated logic circuits.

[0115] To provide user interaction, embodiments of the present invention can be implemented in a computer having a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal screen) monitor), and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can input to the computer. Other types of devices can also be used to provide user interaction. For example, the feedback provided to the user may be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback, and input from the user may be received in any form, such as acoustic input, voice input, or tactile input.

[0116] Embodiments of the present invention can be implemented in a computing system that includes, for example, a backend component as a data server, or a middleware component, such as an application server, or a frontend component, such as a client computer having a graphical user interface or web browser on which a user can interact with embodiments of the present invention, or any combination of one or more such backend, middleware, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication, such as a communication network. Examples of communication networks include local area networks ("LANs"), wide area networks ("WANs"), and, for example, the Internet.

[0117] A computing system can include clients and servers. Clients and servers are generally far apart from each other and typically interact through a communication network. The client-server relationship arises from computer programs running on each computer that have a client-server relationship with each other.

[0118] While this specification contains many details, these should not be construed as limiting the scope of the invention or the scope of the claims, but rather as descriptions of features specific to particular embodiments of the invention. Certain features described herein in the context of individual embodiments can also be implemented in combination in a single embodiment. Conversely, various features of the invention described in the context of a single embodiment can also be implemented separately or in any preferred subcombinations in multiple embodiments. Furthermore, features may be described above as functioning in a particular combination, and even if initially claimed as such, one or more features from the claimed combination may be removed from the combination, and the claimed combination may cover subcombinations or variations of subcombinations.

[0119] Similarly, while operations are shown in a specific order in the drawings, this should not be understood as requiring that such operations be performed in a specific or sequential order shown, or that all shown operations be performed, in order to obtain the desired results. In certain situations, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system components in the embodiments described above should not be understood as requiring such separation in all embodiments, and the described program components and systems should be understood as generally being able to be integrated into a single software product or packaged into multiple software products.

[0120] In each example where an HTML file is mentioned, other file types or formats may be substituted. For example, an HTML file could be replaced with XML, JSON, plain text, or other types of files. Furthermore, where a table or hash table is mentioned, other data structures (such as spreadsheets, relational databases, or structured files) may be used.

[0121] Specific embodiments of the present invention have been described. Other embodiments are within the scope of the following claims. For example, the desired results can still be obtained by performing the steps described in the claims in a different order.

Claims

1. It is a method, Accessing a buffer containing one or more bit sets, To generate a random sequence of multiple values, From the random sequence of the plurality of values, generate a sequence of indices that represent an order for accessing a plurality of specific bit sets of the buffer, In response to determining that one index in the sequence of multiple indices corresponds to one location in the buffer, the one index in the order of the sequence of multiple indices accesses one set of the multiple specific bit sets in the buffer, After accessing the aforementioned set, one or more memory operations are performed on the aforementioned set of the aforementioned set of specific bits. Methods that include...

2. Generating a random sequence of the aforementioned multiple values ​​is Obtaining a single value from entropy delivery hardware, Using the one value from the entropy delivery hardware as a start key, multiple values ​​are generated from the number generator. The method according to claim 1, including the method described in claim 1.

3. The method of claim 2, further comprising providing one or more requirements to the number generator, wherein the one or more requirements include one or more values ​​representing a portion of the buffer.

4. Generating a sequence of multiple indices representing the order for accessing one or more specific sets of bits in the buffer from a random sequence of the multiple values ​​is: Adding one of the random sequences of the aforementioned multiple values ​​to the memory offset value corresponding to the starting storage location of the buffer. The method according to claim 1, including the method described in claim 1.

5. Performing one or more memory operations is Copying bits to or from the buffer. The method according to claim 1, including the method described in claim 1.

6. Performing one or more memory operations is Resetting the bits in the buffer to random bits or 0 bits. The method according to claim 1, including the method described in claim 1.

7. Performing one or more memory operations is Comparing the bits of the first buffer with the bits of the second buffer. The method according to claim 1, including the method described in claim 1.

8. Accessing the second buffer which contains one or more bit sets, Accessing the second bit set of the second buffer in the order of the sequence of the plurality of indices The method according to claim 7, further comprising:

9. Accessing one of the specific bit sets of the buffer by one index in the sequence of the plurality of indices is: The method according to claim 1, comprising accessing a portion of the buffer corresponding to one of the indexes, wherein the portion includes one of the set of a plurality of specific bit sets.

10. Determining that one of the sequences of multiple indices corresponds to one location in the buffer means The method according to claim 1, comprising determining that one index among the sequence of multiple indices corresponds to one set among the multiple specific bit sets of the buffer.

11. The second index of the sequence of the aforementioned multiple indices is determined not to correspond to one or more bits of the buffer, Based on the determination that the second index of the sequence of multiple indices does not correspond to one or more bits of the buffer, one or more bits are accessed and a decoy operation is performed on the one or more bits. The method according to claim 1, including the method described in claim 1.

12. The method according to claim 11, wherein the decoy operation includes one or more of copying an existing memory value to the same storage location, or moving one or more unused bits within memory.

13. A program that, when executed by a computer system, stores instructions causing the computer system to perform the method according to any one of claims 1 to 12.

14. It is a system, One or more processors, A system comprising one or more processors and a machine-readable medium interoperably coupled thereto, wherein the machine-readable medium stores instructions causing the one or more processors to perform the method according to any one of claims 1 to 12.

Images