Electronic Device Security Testing Against Combined Side-Channel and Fault Injection Attacks

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Digital signature methods, such as RSA-CRT, are vulnerable to attacks combining side-channel and fault injection attacks, making it difficult to detect and prevent security breaches effectively.

Innovation Solution

A method is introduced that tests the security of electronic devices by signing messages with modified errors and analyzing physical measurements to detect correlations, using the Chinese Remainder Theorem for recombining intermediate values and verifying signatures with public exponents, while incorporating confusion mechanisms to prevent attacks. This method includes steps to determine correlation coefficients and solve polynomial equations to identify potential faults, utilizing the LLL algorithm for error estimation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If digital signature methods like RSA-CRT are implemented with traditional countermeasures, then protection against simple fault injection attacks is improved, but vulnerability to combined side-channel and fault injection attacks increases

Engineering Contradiction:
Improveprotection against fault injection attacksVSAvoidvulnerability to combined attacks
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary action by introducing confusion mechanisms before the cryptographic operation. Random values are generated and mixed with intermediate values during the modular exponentiation process, establishing a protective layer that prevents attackers from establishing correlations between physical measurements and secret data, even when fault injection is subsequently applied.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent implements parameter changes by dynamically modifying the computational parameters during execution. Random values are added to intermediate values, and the computational path is changed based on these random parameters. This makes the relationship between input, intermediate values, and output unpredictable, thereby preventing side-channel analysis even in the presence of fault injection.

Inventive Principle:
Principle #35Parameter changes

2Difficulty of detecting and measuring

If verification steps are added to detect faults, then detection capability is improved, but processing time and complexity increase

Engineering Contradiction:
Improvedetection capabilityVSAvoidprocessing time
Core Design Contradiction:
Difficulty of detecting and measuringVSLoss of time

Solution Approach 1:

The patent merges the verification function with the normal cryptographic operation. The confusion mechanism is integrated into the modular exponentiation process itself, so that the same computational path serves both the cryptographic function and the security verification. This eliminates the need for separate verification steps, maintaining processing speed while enhancing detection capability.

Inventive Principle:
Principle #5Merging (Combining)

Solution Approach 2:

The system performs self-verification through the confusion mechanism. The random values and their associated computations create inherent checks within the cryptographic process itself. If a fault injection occurs, the confusion mechanism naturally prevents the attacker from deriving meaningful information, providing self-protection without requiring external verification resources.

Inventive Principle:
Principle #25Self-service

3Reliability

If confusion mechanisms are integrated into cryptographic processing, then security against combined attacks is improved, but device complexity increases

Engineering Contradiction:
Improvesecurity against combined attacksVSAvoidimplementation complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies segmentation by dividing the modular exponentiation process into distinct computational stages. Random values are introduced at specific intermediate points in the computation, creating segmented protection zones. This modular approach to confusion allows the mechanism to be implemented by adding discrete functional blocks to the existing cryptographic architecture, rather than requiring complete redesign.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The confusion mechanism is designed to be universal and multi-functional. The same random value generation and mixing process provides protection against multiple types of attacks (side-channel analysis, fault injection, and their combinations) simultaneously. This multi-functionality reduces the need for separate protection mechanisms for different attack vectors, thereby limiting the increase in overall device complexity.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP2706455B8Method for testing the security of an electronic device against an attack, and electronic device implementing countermeasures
Publication Date: 2015.09.09 OBERTHUR TECH SA

AI summary

A security testing method is proposed for an electronic device against a combination of a side-channel attack and a fault injection attack which is implemented during the execution of a cryptographic processing method comprising a step of signing a message from at least one secret parameter, said signing step implementing a recombination of at least two intermediate values ​​according to the Chinese remainder theorem, and a step of verifying said signature from at least one public exponent.The test method is remarkable in that it includes: - a step of transmitting a plurality of messages to be signed by said electronic device; - a step of disrupting each message, including modifying said message by introducing an identical error for each message, before executing a step of determining one of the intermediate values; - a step of analyzing physical measurements obtained during said step of verifying said signature as a function of said message to be signed, said identical error for each message and a supposition of a value of a part of said at least one secret parameter.