Cryptographic Program Protection via Dependency Graph Masking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing countermeasures for cryptographic devices are insufficient in protecting against side-channel attacks, which exploit physically observable parameters to recover secret data, and do not provide full security against such threats.
Innovation Solution
A cryptographic computing device and method that compiles cryptographic programs to create a masked graph of dependencies by applying a masking scheme to variables, determining independent instructions, and randomly permuting their execution order, using a compiler to produce a protected executable program code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing countermeasures (dummy instructions, random timing shifts, instruction randomization) are applied to protect against side-channel attacks, then some security protection is provided, but the protection is insufficient and does not provide full security
Solution Approach 1:
The patent segments the cryptographic program into multiple independent instruction sets that can be executed in different orders. By dividing the program into separate instruction sets (first instruction set, second instruction set, etc.), each containing operations on masked variables, the system achieves finer-grained control over execution patterns, making side-channel analysis more difficult while maintaining security
Solution Approach 2:
The patent introduces dynamic execution ordering where the processor can execute instruction sets in different sequences based on randomization. The execution order of instruction sets is dynamically changed rather than fixed, creating variability in power consumption patterns and timing characteristics that side-channel attacks rely upon, thereby enhancing security without requiring overly complex static protection mechanisms
2Reliability
If masking variables and permuting instruction execution order are applied to protect against side-channel attacks, then security against information extraction is improved, but the complexity of the cryptographic program increases
Solution Approach 1:
The patent introduces masked variables as intermediary elements between the original cryptographic variables and the execution units. These masked variables (e.g., x' = x ⊕ mask, y' = y ⊕ mask) serve as mediators that carry the cryptographic data while obscuring it with random masks, preventing direct observation of secret information through side-channels without affecting the computational correctness
Solution Approach 2:
The patent changes the parameters of variable representation by introducing multiple mask values (first mask, second mask, third mask) that can be applied to variables. By varying these mask parameters and applying them differently to different variables and instruction sets, the system creates multiple possible execution traces that are indistinguishable to attackers, enhancing security while managing program complexity through systematic parameter transformation
Data Source
AI summary
There is provided a device for protecting a cryptographic program implemented in a cryptographic computing device, the cryptographic computing device includes one or more processors, the cryptographic program comprising instructions and being associated with an initial execution order of the instructions. The device comprises a compiler to compile the cryptographic program, which provides an intermediate representation of the cryptographic program comprising instructions and variables used to execute the instructions. The device is configured to: determine a graph of dependencies comprising nodes and edges, each node of the graph representing an instruction of the intermediary representation, and each edge of the graph representing a variable of the intermediary representation; mask the graph of dependencies by replacing each variable of the graph of dependencies with a masked variable, the processing unit determining the masked variable by applying a masking scheme to the variable, which provides a masked graph of dependencies; determine at least a set of independent instructions using the masked graph of dependencies; determine an execution order for each set of independent instructions from the initial execution order, the execution order representing the order of execution of the set of independent instructions by at least one of the one or more processors.