ECC Scalar Multiplication Hardening for Vehicle Security Chips

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing ECC anti-attack methods for vehicle security chips are vulnerable to SPA attacks combined with safe-error fault injection attacks and fail to meet the circuit fault detection rate required by the ISO26262 functional safety standard.

Innovation Solution

An ECC anti-attack method that adjusts scalar multiplication operations by performing point operation decompositions on subsequent loops when all bits in a current loop are 0, ensuring each loop performs both point multiplication and addition operations, maintaining efficiency while resisting attacks and meeting safety standards.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If conventional ECC scalar multiplication is used, then computational efficiency is improved, but the system becomes vulnerable to SPA attacks combined with safe-error fault injection attacks

Engineering Contradiction:
Improvecomputational efficiencyVSAvoidattack resistance
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The scalar multiplication operation is segmented into multiple loops, where each loop processes a portion of the scalar bits. This segmentation allows the system to perform point operation decompositions at specific loop boundaries, creating detectable checkpoints that prevent fault injection attacks while maintaining overall computational efficiency through the structured breakdown of the cryptographic operation.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The system performs preliminary point operation decompositions before executing the main scalar multiplication loops. By pre-processing and decomposing point operations in advance, the system establishes a secure computational framework that resists attacks while preserving the efficiency of the main cryptographic operation. This preliminary action ensures that when loops are executed, the underlying mathematical structure is already secured against manipulation.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If point operation decomposition is performed to resist attacks, then security is improved, but computational overhead increases

Engineering Contradiction:
Improveattack resistanceVSAvoidcomputational overhead
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

Instead of applying point operation decompositions uniformly across all computational steps, the system applies them locally at specific loop boundaries where scalar bits transition. This localized application of decomposition reduces overall computational overhead while maintaining security at critical checkpoints. The decomposition is performed only where necessary to detect faults, rather than continuously throughout the entire scalar multiplication process.

Inventive Principle:
Principle #3Local quality

Solution Approach 2:

The system dynamically adjusts the application of point operation decompositions based on the actual values of scalar bits being processed. When scalar bits indicate potential vulnerability points, the system activates decompositions; otherwise, it proceeds with standard efficient computation. This parameter-driven approach balances security requirements with computational efficiency, applying overhead only when security conditions demand it.

Inventive Principle:
Principle #35Parameter changes

3Reliability

If consistent operation time is maintained across loops, then SPA attack resistance is improved, but fault detection capability deteriorates

Engineering Contradiction:
ImproveSPA attack resistanceVSAvoidfault detection capability
Core Design Contradiction:
ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The system maintains continuous useful cryptographic action throughout the scalar multiplication process by ensuring that point operation decompositions are seamlessly integrated into the loop structure. Each loop maintains consistent operational characteristics that resist SPA attacks, while the continuous nature of the decomposition ensures that no gaps or anomalies are introduced that would mask fault injection attacks. The useful cryptographic work continues uninterrupted while providing inherent security and detectability.

Inventive Principle:
Principle #20Continuity of useful action

Solution Approach 2:

The system incorporates feedback mechanisms where the results of point operation decompositions are used to verify the correctness of intermediate computational steps. By feeding back the decomposed operation results into the main scalar multiplication flow, the system can detect faults that occur during computation. This feedback loop ensures that consistent operation time for SPA resistance does not prevent fault detection, as anomalies will propagate through the feedback and be identified.

Inventive Principle:
Principle #23Feedback

Data Source

PatentEP4708052A1ECC Anti-attack method and apparatus suitable for automobile security chip, device, and medium
Publication Date: 2026.03.11 CHINA RESOURCES MICROELECTRONICS HLDG LTD
  • EP4708052A1 patent drawingFigure 1~2
  • EP4708052A1 patent drawingFigure 3
  • EP4708052A1 patent drawing

AI summary

The present invention provides an ECC anti-attack method and apparatus suitable for an automobile security chip, a device, and a medium. According to the present invention, by adjusting points accumulated in a scalar average decomposition method, an operational operation in each cycle is the same, that is, point double and point addition are performed in each cycle, so that the differences in branch operation time and power consumption between the cycles in the operation process can be eliminated, sensitive information cannot be identified by means of a power consumption attack, and the problem of being unable to meeting high fault error detection rate required by the ISO 26262 function security standard of the automobile chip due to the use of a pseudo-operation manner is also avoided.