CPU Masking Mechanism for Side-Channel Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Embedded central processing units (CPUs) are susceptible to side-channel attacks during cryptographic operations, particularly Differential Power Analysis (DPA), where attackers can retrieve secret keys by analyzing power consumption patterns, and existing masking techniques require significant external memory resources and incur high overhead.
Innovation Solution
The solution involves dynamically generating masked data shares within the CPU boundary and using multiple memory channels for secure data exchange, where each mask value is uniquely associated with a memory channel, allowing for secure writing and reading of data without leaking information, and the masks can be dynamically updated to prevent data leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If masking techniques are used to protect against side-channel attacks, then security against Differential Power_analysis is improved, but external memory resources and overhead increase significantly
Solution Approach 1:
The data is divided into multiple shares (e.g., two shares for second-order masking) that are stored separately in external memory. Each share individually reveals no information about the original data, and only when combined do they reconstruct the plaintext. This segmentation prevents side-channel attacks while managing memory resources through structured storage.
Solution Approach 2:
The masking scheme dynamically changes parameters such as the mask values and share combinations based on the memory channel being accessed. By varying the masking parameters according to the access pattern, the system maintains security without requiring proportional increases in external memory resources.
2Reliability
If masking techniques are used to protect against side-channel attacks, then security against Differential Power_analysis is improved, but system overhead increases significantly
Solution Approach 1:
The CPU performs the unmasking operation itself when reading data from external memory, rather than relying on external unmasking logic. The processor combines the retrieved shares internally to reconstruct the plaintext, eliminating the need for additional external unmasking circuitry and reducing overall system overhead.
Solution Approach 2:
The masking and unmasking mechanism is integrated into the existing CPU architecture and memory access pathways, allowing the same hardware structures to serve both normal computation and secure cryptographic operations. This multi-functionality reduces the need for dedicated security hardware and lowers system overhead.
3Reliability
If multiple memory channels are used for secure data exchange, then data leakage prevention is improved, but memory system complexity increases
Solution Approach 1:
Each memory channel is assigned a specific masking parameter or share identifier, creating local differentiation in how data is protected across channels. This local quality approach ensures that access through different channels inherently provides different security properties, preventing leakage while maintaining a relatively simple overall memory architecture.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Aspects of the present disclosure calculate masked data shares dynamically inside the CPU boundary, and use a plurality of memory channels to write the masked data shares to an external memory location and/or to read the data shares from that external memory location. Each dynamically generated mask value is uniquely associated with a corresponding memory channel during writing data to the external memory. The modified masked data is unmasked or remasked during a subsequent read operation.