ECC Scalar Multiplication Hardening for Vehicle Security Chips
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ECC anti-attack methods for vehicle security chips are vulnerable to SPA attacks combined with safe-error fault injection attacks and fail to meet the circuit fault detection rate required by the ISO26262 functional safety standard.
Innovation Solution
An ECC anti-attack method that adjusts scalar multiplication operations by performing point operation decompositions on subsequent loops when all bits in a current loop are 0, ensuring each loop performs both point multiplication and addition operations, maintaining efficiency while resisting attacks and meeting safety standards.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional ECC scalar multiplication is used, then computational efficiency is improved, but the system becomes vulnerable to SPA attacks combined with safe-error fault injection attacks
Solution Approach 1:
The scalar multiplication operation is segmented into multiple loops, where each loop processes a portion of the scalar bits. This segmentation allows the system to perform point operation decompositions at specific loop boundaries, creating detectable checkpoints that prevent fault injection attacks while maintaining overall computational efficiency through the structured breakdown of the cryptographic operation.
Solution Approach 2:
The system performs preliminary point operation decompositions before executing the main scalar multiplication loops. By pre-processing and decomposing point operations in advance, the system establishes a secure computational framework that resists attacks while preserving the efficiency of the main cryptographic operation. This preliminary action ensures that when loops are executed, the underlying mathematical structure is already secured against manipulation.
2Reliability
If point operation decomposition is performed to resist attacks, then security is improved, but computational overhead increases
Solution Approach 1:
Instead of applying point operation decompositions uniformly across all computational steps, the system applies them locally at specific loop boundaries where scalar bits transition. This localized application of decomposition reduces overall computational overhead while maintaining security at critical checkpoints. The decomposition is performed only where necessary to detect faults, rather than continuously throughout the entire scalar multiplication process.
Solution Approach 2:
The system dynamically adjusts the application of point operation decompositions based on the actual values of scalar bits being processed. When scalar bits indicate potential vulnerability points, the system activates decompositions; otherwise, it proceeds with standard efficient computation. This parameter-driven approach balances security requirements with computational efficiency, applying overhead only when security conditions demand it.
3Reliability
If consistent operation time is maintained across loops, then SPA attack resistance is improved, but fault detection capability deteriorates
Solution Approach 1:
The system maintains continuous useful cryptographic action throughout the scalar multiplication process by ensuring that point operation decompositions are seamlessly integrated into the loop structure. Each loop maintains consistent operational characteristics that resist SPA attacks, while the continuous nature of the decomposition ensures that no gaps or anomalies are introduced that would mask fault injection attacks. The useful cryptographic work continues uninterrupted while providing inherent security and detectability.
Solution Approach 2:
The system incorporates feedback mechanisms where the results of point operation decompositions are used to verify the correctness of intermediate computational steps. By feeding back the decomposed operation results into the main scalar multiplication flow, the system can detect faults that occur during computation. This feedback loop ensures that consistent operation time for SPA resistance does not prevent fault detection, as anomalies will propagate through the feedback and be identified.
Data Source
Figure 1~2
Figure 3
AI summary
The present invention provides an ECC anti-attack method and apparatus suitable for an automobile security chip, a device, and a medium. According to the present invention, by adjusting points accumulated in a scalar average decomposition method, an operational operation in each cycle is the same, that is, point double and point addition are performed in each cycle, so that the differences in branch operation time and power consumption between the cycles in the operation process can be eliminated, sensitive information cannot be identified by means of a power consumption attack, and the problem of being unable to meeting high fault error detection rate required by the ISO 26262 function security standard of the automobile chip due to the use of a pseudo-operation manner is also avoided.