Fault tolerance using redundant blocks

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for fault tolerant processes. One of the methods includes generating, using a data input, a set of inputs, wherein each input in the set of inputs is identical and wherein the set of inputs includes at least two inputs; generating, using a cryptographic function and for each input in the set of inputs, a respective output; computing an error detection value for each generated output; determining that (i) the generated outputs do not match or (ii) the error detection values do not match; and in response to determining that (i) the generated outputs do not match or (ii) the error detection values do not match, generating an error indicative of a fault in operation of the cryptographic function.

Description

[0001] FAULT TOLERANCE USING REDUNDANT BLOCKS

[0002] BACKGROUND

[0003] By inducing faults in the operation of a processor, malicious entities can access hidden or protected information, such as private cryptographic keys or other personal information. Faults can be induced by subjecting a processor to various environmental conditions, such as high temperature, electromagnetic pulses, variable power supply, among others. By monitoring the output of the processor while controlling environmental conditions, a malicious entity can deduce hidden instructions or internal states of data, potentially compromising the security of the underlying computing.

[0004] SUMMARY

[0005] In general, one innovative aspect of the subject matter described in this specification can be embodied in methods that include the actions of generating, using a data input, a set of inputs, where each input in the set of inputs is identical and where the set of inputs includes at least two inputs; generating, using a cryptographic function and for each input in the set of inputs, a respective output; computing an error detection value for each generated output; determining that (i) the generated outputs do not match or (ii) the error detection values do not match; and in response to determining that (i) the generated outputs do not match or (ii) the error detection values do not match, generating an error indicative of a fault in operation of the cryptographic function. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

[0006] The foregoing and other embodiments can each optionally include one or more of the following features, alone or in combination. In particular, one embodiment includes all the following features in combination. Feature 1: The actions include, in response to determining that (i) the generated outputs do not match or (ii) the error detection values do not match, stopping execution of one or more processes. Feature 2: The actions include generating, using a first portion of an integrated circuit, the respective outputs; and determining, using a second portion of the integrated circuit different than the first portion, that (i) the generated outputs do not match or (ii) the error detection values do not match. Feature 3: The Actions include determining whether the generated outputs match and determining whether the error detection values match, where determining whether the generated outputs match is performed as a test separate from determining whether the error detection values match. Feature 4: The actions include generating the set of inputs from obtained input data, where the obtained input data includes an error detection value; and in response to verifying the error detection value of the obtained input data, generating the set of inputs. Feature 5: The actions include generating the set of inputs from obtained input data, where the obtained input data includes output from a linear subfunction of a function, and where the function includes (i) the linear subfunction and (ii) the cryptographic function. Feature 6: The actions include identifying the cryptographic function as a nonlinear subfunction of the function that includes the linear subfunction; in response to identifying the cryptographic function as the non-linear subfunction of the function that includes the linear subfunction, generating an initial set of inputs; and in response to determining that (i) an initial set of generated outputs match and (ii) an initial set of error detection values match, providing at least one of the initial set of generated outputs for the function. Feature 7: The non-linear subfunction includes a non-linear byte substitution step. Feature 8: The actions include generating additional two identical inputs from additional obtained input data, where (i) the additional obtained input data includes output from each linear subfunction of the function and (ii) the function includes at least two linear subfunctions. Feature 9: Generating a respective output for each input in the set of inputs includes generating the outputs in parallel processes. Feature 10: Generating a respective output for each input in the set of inputs includes generating the outputs in serial processes. Feature 1 1 : The error detection value for each generated output is a Cyclic Redundancy Check (CRC).

[0007] The technology described in this specification can be implemented so as to realize one or more of the following advantages. For example, by using redundant, or duplicative operations, to improve fault tolerance for only a subset of functions, techniques described can reduce runtime and reduce processing requirements, such as required area on a computer processing chip. In some cases, redundant operations can be used only for functions where other fault tolerant methods, cannot be used — e.g., within an algorithm including linear and nonlinear functions, fault tolerance can be improved (i) by using checksums for the linear functions and (ii) redundant operations as described in this document for the nonlinear functions because, at least in some cases, checksums cannot be used with nonlinear functions — e.g., consider two numbers A and B, and their checksums, Achk and Bchk; adding A and B together, along with their checksums, produces (A+Achk) + (B+Bchk) = Output chk; the Output, A + B, can be recovered by subtracting Achk and Bchk from Output chk, Output chk - Achk - Bchk = Output, because addition is a linear function; however, with a nonlinear operation, such as multiplication, hash generation, among others, Output can be unrecoverable using Output chk and Achk and Bchk, for example, with A * B = Output and (A+Achk)*(B+Bchk) = Output chk, using Achk and Bchk to tr and obtain Output, such as Output_chk / (Achk*Bchk), does not return the value of Output where Output = A * B.

[0008] Redundant operations can improve fault tolerance for nonlinear functions. Redundant operations can be performed in series, in parallel, or as a combination of these to help optimize processing area, power consumption, or runtime. For example, redundant operations can be performed in series to reduce the number of distinct processors (and / or number of different processing threads) required on a chip. Redundant operations can be performed in parallel to decrease runtime when sufficient distinct processors (and / or processing threads) are available on a chip. Dynamic allocation of operations can be performed to help optimize processing area, power consumption, or runtime, e.g., in response to detecting a frequency of an operation to perform redundantly for fault tolerance.

[0009] The details of one or more embodiments of the subject matter of this specification are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the subject matter will become apparent from the description, the drawings, and the claims.

[0010] BRIEF DESCRIPTION OF THE DRAWINGS

[0011] FIG. 1A shows an example of a fault injection process used to obtain a secret.

[0012] FIG. IB shows an example of a first process for improved fault tolerance using redundant blocks.

[0013] FIG. 2 shows an example of a second process for improved fault tolerance using redundant blocks.

[0014] FIG. 3 shows an example use case as a third process for improved fault tolerance using redundant blocks.

[0015] FIG. 4 is a flowchart of an example process for fault tolerance using redundant blocks.

[0016] FIG. 5 is a diagram illustrating an example of a computing system used for fault tolerant processing.

[0017] Like reference numbers and designations in the various drawings indicate like elements. DETAILED DESCRIPTION

[0018] FIG. 1A shows an example of a fault injection process 100 used to obtain a secret 112. The fault injection process 100 can be detected and prevented using techniques described in this document including in subsequent figures. In the fault injection process 100, a device 102 is processing data. A fault injector 104 is used to inject a fault into the processes of the device 102. Faults can be injected in various ways, e g., by varying power supply to the device 102, sending disrupting RF or magnetic signals, heating a processor, among others. By varying the fault injected, the fault injection process 100 can generate multiple outputs, e.g., first output 106 and second output 108. The first output 106 and the second output 108 can then be analyzed, e.g., by an output analyzer 110. The output analyzer 110 can use the first output 106 and the second output 108, together with data indicating faults injected by the fault injector 104, to identify the secret 112. In general, the secret 112 can include some insights of the processing performed by the device 102 — e.g., a private key, algorithm processes, protected information, among others.

[0019] By using techniques described in this document, fault injection can be identified and prevented. Because a fault injection is unlikely to affect subsequent or simultaneous processes in the same way, performing operations redundantly, as described in the disclosed techniques, can be used to identify7when a fault has been injected into processing. Techniques can improve on mere redundancy by performing redundant operations only for a subset of operations for which other fault tolerant methods are inapplicable. For example, the techniques can be applied only to nonlinear functions of an algorithm that includes both linear and nonlinear functions.

[0020] FIG. IB shows an example of a first process 150 for improved fault tolerance using redundant blocks. The first process 150, and subsequent processes, can be performed in hardware or using software. In some implementations, each element of a process is performed by a specific circuit element on an embedded circuit. For example, operations shown in the first process 150 can be implemented using NAND / NOR logic. In some cases, memory circuits, such as Flip-flop, Latch, among others, can be used as memory storage elements in hardware.

[0021] The first process 150 includes obtaining input P 152. The input P 152 can include plaintext or other types of input. Obtaining input P 152 can include reading one or more values from one or more memory devices — e.g., memory devices storing results from one or more other data processing operations. The first process 150 includes performing redundant operations for improved security. For example, the input P 152 is processed using a function F, in element 154 and 156, to compute Cl and C2. In some cases, computing Cl and C2 can occur in parallel. Parallel operation can be achieved using separate elements, operating in parallel, on an electrical processing circuit.

[0022] In some cases, redundant operations, such as operations of items 154 and 156, can be performed in series. For example, operations, such as those of items 154 and 156, can be performed by a same set of one or more circuit elements or can be performed in software.

[0023] In some cases, an implementing computer system can identify, based on use of a function using the first process 150, whether to process redundant blocks in parallel or in series. For example, for more frequent operations using the first process 150, an implementing system can identify a frequency of operations satisfy ing a threshold and, in response, configure redundant operations to be performed in parallel — e.g., if multiple processing elements are available for parallel processing. In this way, frequent operations can be run in parallel.

[0024] In some cases, an implementing system can identify infrequent operations that use the first process 150, such as operations that are called below a threshold number of times within a period of time, and can, in response, operate redundant operations, such as items 154 and 156, in series. Runtime of operations can be reduced while also optimizing processing area. For example, chip architecture can be limited in the amount of circuit elements that can fit within a given chip. For a chip implementing techniques described in this document, it can in some cases be more optimal to reduce required circuit elements, or the area of a chip element, and therefore not process actions in parallel but in series. In some cases, additional circuit elements can be used, using more chip area, to enable parallel processing.

[0025] In some cases, Cl and C2 include hash values. For example, the function F can be a hashing algorithm that uses input P 152 as a generating key. In some cases, the function F has no specific countermeasures — e.g., to prevent against fault injection. The first process 150 can be used to offer such protection for such functions that do not include fault injection protection. In cases where repeated generation of output is required — e.g., generating hash values in a Merkle tree, for digital signatures, or other use cases — parallel processing can be used to significantly decrease runtime of the improved security offered by redundancy. The first process 150 includes computing error detection values. For example, the first process 150 can include computing checksum values in items 158 and 160. Like operations in items 154 and 156, the computing of checksums can be performed as a redundant process. The redundant processing can help prevent fault injection by bad actors exposing or otherwise disabling a system. As referred to herein, the term checksum can mean, broadly, any error detection value, such as cyclic redundancy check (CRC) or checksums

[0026] The first process 150 includes checks to ensure against fault injection. Checks to ensure against fault injection can occur in series or in parallel. For example, the first process 150 includes a first check 162 and a second check 166. In the first check 162, the generated Cl and C2, which are the outputs of the function F. are compared. If Cl and C2 do not match, an implementing system can generate an error 164 indicative of a fault in operation of the function F — e.g., a cryptographic function. In some cases, a partial match can be treated as a mismatch, e.g., in response to determining a partial match or mismatch, the first process 150 can include generating an error indicative of a fault in operation.

[0027] In the second check 166, generated error detection values — e.g., error detection values of C 1 and C2 — are compared. If the generated error detection values do not match, an implementing system can generate an error 168 indicative of a fault in operation of the error detection generation process. In some implementations, the first check 162 and the second check 166 are performed in series. For example, by performing the first check 162 and the second check 166 in series, a fault bypassing the system would generally require two faults applied at two different points in time. In some cases, performing checks in series can help ensure against faults on a storage of checksums or other values within the independent branches of the redundant operations.

[0028] FIG. 2 shows an example of a second process 200 for improved fault tolerance using redundant blocks. The second process 200 can be performed, like the first process 150, as a means for providing fault tolerance for functions called within data processes.

[0029] The second process 200 includes obtaining input P CKS(P) 202. A system implementing the second process 200 can obtain the input P CKS(P) 202 by reading one or more values in memory from one or more prior operations performed by the system or communicably connected system. In this case, the input P CKS(P) 202 includes an error detection value — e.g., a checksum value. By including a checksum with the input, the input P CKS(P) 202 can help prevent faults injected into the input for the process — e.g., because a fault injected would be unlikely to alter the values of bits of both P and CKS(P) such that a recomputed checksum would match CKS(P).

[0030] The second process 200 includes a first input check. As discussed herein, redundant operations, such as the first input check, can be performed in parallel or in series — e.g., depending on an identified frequency of operation. For example, the first input check can include recomputing an error detection value for the input P CKS(P) 202. In item 204 and 206, the second process 200 can include recomputing a checksum of P and comparing it to the checksum of P included in the input P CKS(P) 202. If the recomputed checksum matches the checksum stored in input P CKS(P) 202, processing can continue. If not, the process 200 can include generating an error indication, e.g., 208 or 210. The error indications can indicate that there was a fault in the initial data duplication and recomputing of checksum — e.g., a bad actor disturbed an implementing system or adjusted an environment to cause the operations of 204 to not match the operations of 206. In some cases, the error indications can indicate if the stored P or CKS(P) has been tampered with.

[0031] The second process 200 includes redundant operations for fault tolerance. Similar to the first process 150, the second process 200 generates a result using a function. In this case, the function is represented as H. Redundant operations can include (i) a generation of output from the function H — e.g., C 1 and C2 in items 212 and 214 — and (ii) a generation of checksums in items 216 and 218.

[0032] The second process 200 includes additional output checks. For example, the second process 200 includes checking the redundant output of the function H in item 220 and the redundant output of the checksums of the output of the function H in item 224. If an implementing system identifies that either does not match, the system can generate an error — e.g., 222 or 226 — indicative of a fault in operation.

[0033] In some implementations, the second process 200 is used within algorithms that require repeated calls to a particular subfunction, such as a cryptographic function. For example, the function H can be a cry ptographic function operating within an algorithm, such as a Merkle tree generation algorithm. Using operations of processes described in this document, efficiency and fault tolerance in the generation of said tree, or other repeated operations, can be improved.

[0034] One example use case is using Sphincs+ / SLH-DSA. Sphincs+ includes generating hash signatures for digital signing. Hash signatures can be stored in a Merkle tree. The algorithm for Sphincs+ requires repeated calls to a hash function. For this use case, the first process 150 or the second process 200 can be used to increase fault tolerance while improving efficiency. For example, only one or more nonlinear functions of the algorithm can be used as a function (e.g., function F of the first process 150 or function H of the second process 200). This is because nonlinear functions typically cannot use passed- through checksums to ensure against fault tolerances — e.g., because nonlinear functions do not have a property by which checksums combined with the inputs of the nonlinear function can be removed from a corresponding checksum output to reproduce the nonlinear function output, as described in this document. Nonlinear functions, such as cryptographic functions can be identified, e.g., by an implementing system. The nonlinear functions can then be made fault tolerant using operations as discussed in reference to the processes described in this document. These techniques improve efficiency compared to simply duplicating all operations — e.g.. of generating a Merkle tree or other use case. Instead, only operations of nonlinear functions can be duplicating — e.g., using techniques described in reference to FIG. IB and FIG. 2.

[0035] FIG. 3 shows an example use case as a third process 300 for improved fault tolerance using redundant blocks. A Feistel structure is shown in the third process 300 to help illustrate the processes described in this document. Other structures or process architectures can use the processes described.

[0036] The third process 300 shows how the first or second processes shown in FIG. IB and FIG. 2. respectively, can be used within an algorithm to increase fault tolerance. The example of FIG. 3 shows a Feistel structure but other structures or algorithms can be made similarly fault tolerant. In general, nonlinear subfunctions can be identified. The nonlinear subfunctions can then be used as the function F or function H, in the first process 150 or second process 200, respectively. The first process 150 or second process 200 can, in effect, be substituted for an original operation of a nonlinear function, such as a function F 308 shown in FIG. 3 — e.g., to help improve fault tolerance while ensuring more optimal processing area usage and runtime reductions compared to mere duplication of entire algorithms.

[0037] The third process 300 can use first input data 302 to generate output data 314 and 316. The third process 300 can include linear and nonlinear subfunctions. The third process 300 is configured as a Feistel structure. Elements of the third process 300 can be configured in hardware or software — e.g., hardware elements of a computer chip. In some implementations, the third process 300 is configured using hardware elements, such as NAND / NOR logic gates, among others. Advantageous implementations can include verifying linear functions of the third process 300 using checksums and verifying nonlinear functions of the third process 300 using fault tolerance methods described in this document. In this way, efficiency of operation can be improved. For example, by using redundant operations for ensuring against faults for only the nonlinear functions, techniques described in this document can reduce required processing area or memory compared to techniques that duplicate the entire function being performed by the third process 300.

[0038] The third process 300 includes obtaining the first input data 302. The first input data 302 can include plaintext or other types of data. The first input data 302 can include a checksum for checking an element of the first input data 302.

[0039] The third process 300 includes splitting the first input data 302 into left data 304 and right data 306 — e.g., splitting “ABCD1234” into “ABCD” and “1234’’. The left data 304 and right data 306 can include checksum values — e.g., where checksum values can be computed using the respective left or right data. In some cases, intermediate checksum values, such as checksum values for the first input data 302 and for the left data 304 and right data 306, can help protect against faults prior to performing subsequent operations in the third process 300.

[0040] The third process 300 includes performing operations of the function F 308. In some cases, the function F 308 can be called repeatedly. Repeated calls can further improve an efficiency of duplicating only some of the subfunctions of the third process 300. In some cases, the function F 308 is a cryptographic function. The function F 308 can use additional input K 310, such as a cry ptographic key. In some cases, the function F 308 can be computed twice, e.g., in parallel or in series. The Feistel structure of the third process 300 can be used for block ciphers and can be constructed to use the same function for enciphering and deciphering.

[0041] The function F 308 can include one or more nonlinear functions. The function F 308 can be an instance of the first or second processes shown in FIG. IB and FIG. 2, respectively. Whereas checksums are used for other operations performed in FIG. 3, as discussed in this document, such checksums may not be suitable for nonlinear functions such as the function F 308. In this case, the techniques described can be used to help ensure fault tolerance for the function F 308.

[0042] The third process 300 includes performing operations of a function X 312. The function X 312 can perform an XOR operation using an output of the function F 308 and left data 304 — e.g., an XOR operation between the output of the function F 308 and the left data 304, an XOR operation between the left data 304 and right data 306, among others. In some cases, the function X 312 generates an XOR result between the left data 304 and right data 306 using checksums of the left data 304 and right data 306. The third process 300 includes updating values of the left data 304 and right data 306 to the new left data 314 and the new right data 316. In some cases, the updated left and right data can be used as input data for another round of processing of operations described in FIG. 3.

[0043] FIG. 4 is a flowchart of an example process 400 for fault tolerance using redundant blocks. For convenience, the process 400 will be described as being performed by a system of one or more computers, located in one or more locations, and programmed appropriately in accordance with this specification. For example, a system configured to perform any of processes 150, 200, or 300 can similarly be configured to perform the process 400. Such a system can include one or more elements within an integrated circuit configured to perform operations described.

[0044] The process 400 includes generating, using a data input, a set of inputs (402). For example, each input in the set of inputs can be identical. The set of inputs can include at least two inputs. In the first process 150, the data input can include input P 152. In the second process 200, the data input can include input P CKS(P) 202.

[0045] The process 400 includes generating, using a cryptographic function and for each input in the set of inputs, a respective output (404). For example, in the first process 150, generating respective output can include computing Cl and C2 in elements 154 and 156, respectively. In the second process 200, generating respective output can include computing Cl and C2 in items 212 and 214, respectively.

[0046] The process 400 includes computing an error detection value for each generated output (406). For example, in the first process 150, computing an error detection value can include computing checksums in items 158 and 160. In the second process 200, computing an error detection value can include computing checksums in items 216 and 218.

[0047] The process 400 includes determining that (i) the generated outputs do not match or (ii) the checksums do not match (408). For example, in the first process 150, determining the generated outputs do not match can include performing the first check 162 and determining the checksums do not match can include performing the second check 166. In the second process 200, determining the generated outputs do not match can include checking the redundant output of the function H in item 220 and determining the checksums do not match can include checking the redundant output of the checksums of the output of the function H in item 224. The process 400 includes, in response to determining that (i) the generated outputs do not match or (ii) the checksums do not match, generating an error indicative of a fault in operation of the cryptographic function (410). For example, the first process 150 and the second process 200 can include generating error indicators based on checking performed — e.g., errors 164, 168, 222, and 226, respectively.

[0048] FIG. 5 is a diagram illustrating an example of a computing system used for fault tolerant processing. The computing system includes computing device 500 and a mobile computing device 550 that can be used to implement the techniques described herein. For example, the computing device 500 or the mobile computing device 550 can perform operations described in reference to FIG. IB, FIG. 2, FIG. 3, and FIG. 4.

[0049] The computing device 500 is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The mobile computing device 550 is intended to represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smart-phones, mobile embedded radio systems, radio diagnostic computing devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to be limiting.

[0050] The computing device 500 includes a processor 502, a memory 504, a storage device 506. a high-speed interface 508 connecting to the memory 504 and multiple highspeed expansion ports 510, and a low-speed interface 512 connecting to a low-speed expansion port 514 and the storage device 506. Each of the processor 502, the memory 504, the storage device 506, the high-speed interface 508, the high-speed expansion ports 510, and the low-speed interface 512, are interconnected using various busses, and maybe mounted on a common motherboard or in other manners as appropriate. The processor 502 can process instructions for execution within the computing device 500, including instructions stored in the memory- 504 or on the storage device 506 to display graphical information for a GUI on an external input / output device, such as a display 516 coupled to the high-speed interface 508. In other implementations, multiple processors and / or multiple buses may be used, as appropriate, along with multiple memories and types of memory. In addition, multiple computing devices may be connected, with each device providing portions of the operations (e.g., as a server bank, a group of blade servers, or a multi-processor system). In some implementations, the processor 502 is a single threaded processor. In some implementations, the processor 502 is a multi-threaded processor. In some implementations, the processor 502 is a quantum computer.

[0051] The memory 504 stores information within the computing device 500. In some implementations, the memory 504 is a volatile memory unit or units. In some implementations, the memory7504 is anon-volatile memory unit or units. The memory 504 may also be another form of computer-readable medium, such as a magnetic or optical disk.

[0052] The storage device 506 is capable of providing mass storage for the computing device 500. In some implementations, the storage device 506 may be or include a computer-readable medium, such as a floppy disk device, a hard disk device, an optical disk device, or a tape device, a flash memory or other similar solid-state memory device, or an array of devices, including devices in a storage area network or other configurations. Instructions can be stored in an information carrier. The instructions, when executed by one or more processing devices (for example, processor 502), perform one or more methods, such as those described above. The instructions can also be stored by one or more storage devices such as computer- or machine readable mediums (for example, the memory 504, the storage device 506, or memory on the processor 502). The high-speed interface 508 manages bandwidth-intensive operations for the computing device 500, while the low-speed interface 512 manages lower bandwidth-intensive operations. Such allocation of functions is an example only. In some implementations, the high speed interface 508 is coupled to the memory7504, the display 516 (e.g., through a graphics processor or accelerator), and to the high-speed expansion ports 510, which may accept various expansion cards (not shown). In the implementation, the low -speed interface 512 is coupled to the storage device 506 and the low-speed expansion port 514. The low-speed expansion port 514, which may include various communication ports (e.g., USB, Bluetooth, Ethernet, wireless Ethernet) may7be coupled to one or more input / output devices, such as a keyboard, a pointing device, a scanner, or a networking device such as a switch or router, e.g., through a network adapter.

[0053] The computing device 500 may be implemented in a number of different forms, as shown in the figure. For example, it may be implemented as a standard server 520, or multiple times in a group of such servers. In addition, it may be implemented in a personal computer such as a laptop computer 522. It may also be implemented as part of a rack server system 524. Alternatively, components from the computing device 500 may be combined with other components in a mobile device, such as a mobile computing device 550. Each of such devices may include one or more of the computing device 500 and the mobile computing device 550. and an entire system may be made up of multiple computing devices communicating with each other.

[0054] The mobile computing device 550 includes a processor 552, a memory 564, an input / output device such as a display 554, a communication interface 566, and a transceiver 568, among other components. The mobile computing device 550 may also be provided with a storage device, such as a micro-drive or other device, to provide additional storage. Each of the processor 552, the memory 564, the display 554, the communication interface 566, and the transceiver 568, are interconnected using various buses, and several of the components may be mounted on a common motherboard or in other manners as appropriate.

[0055] The processor 552 can execute instructions within the mobile computing device 550, including instructions stored in the memory 564. The processor 552 may be implemented as a chipset of chips that include separate and multiple analog and digital processors. The processor 552 may provide, for example, for coordination of the other components of the mobile computing device 550, such as control of user interfaces, applications run by the mobile computing device 550, and wireless communication by the mobile computing device 550.

[0056] The processor 552 may communicate with a user through a control interface 558 and a display interface 556 coupled to the display 554. The display 554 may be, for example, a TFT (Thin-Film-Transistor Liquid Cry stal Display) display or an OLED (Organic Light Emitting Diode) display, or other appropriate display technology7. The display interface 556 may include appropriate circuitry' for driving the display 554 to present graphical and other information to a user. The control interface 558 may receive commands from a user and convert them for submission to the processor 552. In addition, an external interface 562 may provide communication with the processor 552, so as to enable near area communication of the mobile computing device 550 with other devices. The external interface 562 may provide, for example, for wired communication in some implementations, or for wireless communication in other implementations, and multiple interfaces may also be used.

[0057] The memory7564 stores information within the mobile computing device 550. The memory' 564 can be implemented as one or more of a computer-readable medium or media, a volatile memory unit or units, or a non-volatile memory unit or units. An expansion memory 574 may also be provided and connected to the mobile computing device 550 through an expansion interface 572, which may include, for example, a SIMM (Single In Line Memory Module) card interface. The expansion memory 574 may provide extra storage space for the mobile computing device 550, or may also store applications or other information for the mobile computing device 550. Specifically, the expansion memory 574 may include instructions to carry7out or supplement the processes described above, and may include secure information also. Thus, for example, the expansion memory 574 may be provide as a security module for the mobile computing device 550, and may be programmed with instructions that permit secure use of the mobile computing device 550. In addition, secure applications may be provided via the SIMM cards, along with additional information, such as placing identifying information on the SIMM card in a non-hackable manner.

[0058] The memory may include, for example, flash memory' and / or NVRAM memory (nonvolatile random access memory'), as discussed below. In some implementations, instructions are stored in an information carrier such that the instructions, when executed by one or more processing devices (for example, processor 552), perform one or more methods, such as those described above. The instructions can also be stored by one or more storage devices, such as one or more computer- or machine-readable mediums (for example, the memory7564, the expansion memory7574, or memory7on the processor 552). In some implementations, the instructions can be received in a propagated signal, for example, over the transceiver 568 or the external interface 562.

[0059] The mobile computing device 550 may communicate wirelessly through the communication interface 566, which may include digital signal processing circuitry' in some cases. The communication interface 566 may provide for communications under various modes or protocols, such as GSM voice calls (Global System for Mobile communications), SMS (Short Message Service), EMS (Enhanced Messaging Service), or MMS messaging (Multimedia Messaging Service), CDMA (code division multiple access), TDMA (time division multiple access), PDC (Personal Digital Cellular), WCDMA (Wideband Code Division Multiple Access), CDMA2000, or GPRS (General Packet Radio Service). LTE. 5G / 6G cellular, among others. Such communication may occur, for example, through the transceiver 568 using a radio frequency. In addition, short-range communication may occur, such as using a Bluetooth, Wi-Fi, or other such transceiver (not shown). In addition, a GPS (Global Positioning System) receiver module 570 may provide additional navigation- and location-related wireless data to the mobile computing device 550, which may be used as appropriate by applications running on the mobile computing device 550.

[0060] The mobile computing device 550 may also communicate audibly using an audio codec 560, which may receive spoken information from a user and convert it to usable digital information. The audio codec 560 may likewise generate audible sound for a user, such as through a speaker, e.g., in a handset of the mobile computing device 550. Such sound may include sound from voice telephone calls, may include recorded sound (e.g., voice messages, music files, among others) and may also include sound generated by applications operating on the mobile computing device 550.

[0061] The mobile computing device 550 may be implemented in a number of different forms, as shown in the figure. For example, it may be implemented as a cellular telephone 580. It may also be implemented as part of a smart-phone 582, personal digital assistant, or other similar mobile device.

[0062] The subject matter and the actions and operations described in this specification can be implemented in digital electronic circuitry, in tangibly-embodied computer software or firmware, in computer hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. The subject matter and the actions and operations described in this specification can be implemented as or in one or more computer programs, e.g., one or more modules of computer program instructions, encoded on a computer program carrier, for execution by, or to control the operation of, data processing apparatus. The carrier can be a tangible non-transitory computer storage medium. Alternatively or in addition, the carrier can be an artificially-generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal, that is generated to encode information for transmission to suitable receiver apparatus for execution by a data processing apparatus. The computer storage medium can be or be part of a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of one or more of them. A computer storage medium is not a propagated signal.

[0063] The term "data processing apparatus7’ encompasses all kinds of apparatus, devices, and machines for processing data, including by way of example a programmable processor, a computer, or multiple processors or computers. Data processing apparatus can include special-purpose logic circuitry, e.g., an FPGA (field programmable gate array), an ASIC (application-specific integrated circuit), or a GPU (graphics processing unit). The apparatus can also include, in addition to hardware, code that creates an execution environment for computer programs, e.g., code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them.

[0064] In general, use of “or” can refer to “and / or.” When providing a list of two or more items, the conjunction “or” can indicate any one of the items, any combination of a subset of the items, or all items in combination.

[0065] A computer program can be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages; and it can be deployed in any form, including as a stand-alone program, e.g., as an app, or as a module, component, engine, subroutine, or other unit suitable for executing in a computing environment, which environment may include one or more computers interconnected by a data communication network in one or more locations.

[0066] A computer program may, but need not, correspond to a file in a file system. A computer program can be stored in a portion of a file that holds other programs or data, e.g., one or more scripts stored in a markup language document, in a single file dedicated to the program in question, or in multiple coordinated files, e.g., files that store one or more modules, sub-programs, or portions of code.

[0067] The processes and logic flows described in this specification can be performed by one or more computers executing one or more computer programs to perform operations by operating on input data and generating output. The processes and logic flows can also be performed by special -purpose logic circuitry, e.g., an FPGA, an ASIC, or a GPU, or by a combination of special-purpose logic circuitry7and one or more programmed computers.

[0068] Computers suitable for the execution of a computer program can be based on general or special-purpose microprocessors or both, or any other kind of central processing unit. Generally, a central processing unit will receive instructions and data from a read-only memory or a random access memory or both. The essential elements of a computer are a central processing unit for executing instructions and one or more memory7devices for storing instructions and data. The central processing unit and the memory7can be supplemented by, or incorporated in, special-purpose logic circuitry.

[0069] Generally, a computer will also include, or be operatively^ coupled to, one or more mass storage devices, and be configured to receive data from or transfer data to the mass storage devices. The mass storage devices can be, for example, magnetic, magneto-optical, or optical disks, or solid state drives. However, a computer need not have such devices. Moreover, a computer can be embedded in another device, e.g., a mobile telephone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a Global Positioning System (GPS) receiver, or a portable storage device, e.g., a universal serial bus (USB) flash drive, to name just a few.

[0070] To provide for interaction with a user, the subject matter described in this specification can be implemented on one or more computers having, or configured to communicate with, a display device, e g., a LCD (liquid crystal display) monitor, or a virtual -reality (VR) or augmented-reality (AR) display, for displaying information to the user, and an input device by which the user can provide input to the computer, e.g., a keyboard and a pointing device, e.g., a mouse, a trackball or touchpad. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback and responses provided to the user can be any form of sensory feedback, e.g., visual, auditory, speech, or tactile feedback or responses; and input from the user can be received in any form, including acoustic, speech, tactile, or eye tracking input, including touch motion or gestures, or kinetic motion or gestures or orientation motion or gestures. In addition, a computer can interact with a user by sending documents to and receiving documents from a device that is used by the user; for example, by sending web pages to a web browser on a user’s device in response to requests received from the web browser, or by interacting with an app running on a user device, e.g., a smartphone or electronic tablet. Also, a computer can interact with a user by sending text messages or other forms of message to a personal device, e.g., a smartphone that is running a messaging application, and receiving responsive messages from the user in return.

[0071] This specification uses the term “configured to” in connection with systems, apparatus, and computer program components. That a system of one or more computers is configured to perform particular operations or actions means that the system has installed on it software, firmware, hardware, or a combination of them that in operation cause the system to perform the operations or actions. That one or more computer programs is configured to perform particular operations or actions means that the one or more programs include instructions that, when executed by data processing apparatus, cause the apparatus to perform the operations or actions. That special-purpose logic circuitry is configured to perform particular operations or actions means that the circuitry has electronic logic that performs the operations or actions.

[0072] While this specification contains many specific implementation details, these should not be construed as limitations on the scope of what is being claimed, which is defined by the claims themselves, but rather as descriptions of features that may be specific to particular embodiments of particular inventions. Certain features that are described in this specification in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination. Moreover, although features may be described above as acting in certain combinations and even initially be claimed as such, one or more features from a claimed combination can in some cases be excised from the combination, and the claim may be directed to a subcombination or variation of a subcombination.

[0073] Similarly, while operations are depicted in the drawings and recited in the claims in a particular order, this by itself should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Moreover, the separation of various system modules and components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0074] Particular embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. For example, the actions recited in the claims can be performed in a different order and still achieve desirable results. As one example, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some cases, multitasking and parallel processing may be advantageous.

[0075] What is claimed is:

Claims

CLAIMS1. A method comprising: generating, using a data input, a set of inputs, wherein each input in the set of inputs is identical and wherein the set of inputs includes at least two inputs; generating, using a cryptographic function and for each input in the set of inputs, a respective output; computing an error detection value for each generated output; determining that (i) the generated outputs do not match or (ii) the error detection values do not match; and in response to determining that (i) the generated outputs do not match or (ii) the error detection values do not match, generating an error indicative of a fault in operation of the cryptographic function.

2. The method of claim 1. comprising: in response to determining that (i) the generated outputs do not match or (ii) the error detection values do not match, stopping execution of one or more processes.

3. The method of claim 1, comprising: generating, using a first portion of an integrated circuit, the respective outputs; and determining, using a second portion of the integrated circuit different than the first portion, that (i) the generated outputs do not match or (ii) the error detection values do not match.

4. The method of claim 1, further comprising determining whether the generated outputs match and determining whether the error detection values match, wherein determining whether the generated outputs match is performed as a test separate from determining whether the error detection values match.

5. The method of claim 1, comprising: generating the set of inputs from obtained input data, wherein the obtained input data includes an error detection value; and in response to verifying the error detection value of the obtained input data, generating the set of inputs.

6. The method of claim 1. comprising: generating the set of inputs from obtained input data, wherein the obtained input data includes output from a linear subfunction of a function, and wherein the function includes (i) the linear subfunction and (ii) the cryptographic function.

7. The method of claim 6. comprising: identifying the cryptographic function as a non-linear subfunction of the function that includes the linear subfunction; in response to identifying the cryptographic function as the non-linear subfunction of the function that includes the linear subfunction, generating an initial set of inputs; and in response to determining that (i) an initial set of generated outputs match and (ii) an initial set of error detection values match, providing at least one of the initial set of generated outputs for the function.

8. The method of claim 7, wherein the non-linear subfunction includes a nonlinear byte substitution step.

9. The method of claim 6, comprising: generating additional two identical inputs from additional obtained input data, wherein (i) the additional obtained input data includes output from each linear subfunction of the function and (ii) the function includes at least two linear subfunctions.

10. The method of claim 1. wherein generating a respective output for each input in the set of inputs comprises: generating the outputs in parallel processes.

11. The method of claim 1. wherein generating a respective output for each input in the set of inputs comprises: generating the outputs in serial processes.

12. The method of claim 1, wherein the error detection value for each generated output is a Cyclic Redundancy Check (CRC).

13. A system comprising one or more computers and one or more storage devices on which are stored instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising: generating, using a data input, a set of inputs, wherein each input in the set of inputs is identical and wherein the set of inputs includes at least two inputs; generating, using a cryptographic function and for each input in the set of inputs, a respective output; computing an error detection value for each generated output; determining that (i) the generated outputs do not match or (ii) the error detection values do not match; and in response to determining that (i) the generated outputs do not match or (ii) the error detection values do not match, generating an error indicative of a fault in operation of the cry ptographic function.

14. The system of claim 13, wherein the operations comprise: in response to determining that (i) the generated outputs do not match or (ii) the error detection values do not match, stopping execution of one or more processes.

15. The system of claim 13, wherein the operations comprise: generating, using a first portion of an integrated circuit, the respective outputs; and determining, using a second portion of the integrated circuit different than the first portion, that (i) the generated outputs do not match or (ii) the error detection values do not match.

16. The system of claim 13, wherein the operations further comprise determining whether the generated outputs match and determining whether the error detection values match, wherein determining whether the generated outputs match is performed as a test separate from determining whether the error detection values match.

17. The system of claim 13, wherein the operations comprise: generating the set of inputs from obtained input data, wherein the obtained input data includes an error detection value; and in response to verifying the error detection value of the obtained input data, generating the set of inputs.

18. The system of claim 13, wherein the operations comprise: generating the set of inputs from obtained input data, wherein the obtained input data includes output from a linear subfunction of a function, and wherein the function includes (i) the linear subfunction and (ii) the cry ptographic function.

19. The system of claim 18, wherein the operations comprise: identifying the cryptographic function as a non-linear subfunction of the function that includes the linear subfunction; in response to identifying the cryptographic function as the non-linear subfunction of the function that includes the linear subfunction, generating an initial set of inputs; and in response to determining that (i) an initial set of generated outputs match and (ii) an initial set of error detection values match, providing at least one of the initial set of generated outputs for the function.

20. One or more computer storage media encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform operations comprising: generating, using a data input, a set of inputs, wherein each input in the set of inputs is identical and wherein the set of inputs includes at least two inputs; generating, using a cryptographic function and for each input in the set of inputs, a respective output; computing an error detection value for each generated output; determining that (i) the generated outputs do not match or (ii) the error detection values do not match; and in response to determining that (i) the generated outputs do not match or (ii) the error detection values do not match, generating an error indicative of a fault in operation of the cryptographic function.

Images