Microarchitecture Timing Obscuration via Dummy Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure computing systems are vulnerable to side channel attacks and fault injection attacks due to the repeated reuse of security information assets, which can compromise the security of computing devices by allowing attackers to determine the timing of sensitive operations and extract cryptographic keys.
Innovation Solution
Implementing a microarchitecture that executes security operations and general operations in a manner that obscures timing by adding dummy cycles and performing operations in parallel, using common instruction formats and computation modules to make it difficult for attackers to distinguish between security and general operations, and incorporating correctness checks to detect perturbations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security operations are executed using dedicated computation modules, then security operations can be performed efficiently, but timing patterns become predictable and vulnerable to side channel attacks
Solution Approach 1:
The patent merges security operations and general operations into a unified execution model where both types of operations are executed by the same computation modules. This consolidation eliminates predictable timing patterns associated with dedicated security modules, as the execution timeline now includes interleaved dummy operations that mask the actual security operation timing.
Solution Approach 2:
The patent changes the execution parameter by introducing variable timing through dummy operations. Instead of fixed timing for security operations, the system now executes dummy operations with varying durations and frequencies, thereby altering the temporal parameters of operation execution to prevent timing analysis attacks.
2Object-affected harmful factors
If dummy operations are executed in parallel with security operations, then timing obscuration is achieved, but device complexity increases
Solution Approach 1:
The patent applies universality by designing computation modules that can execute both security operations and dummy operations without requiring separate dedicated hardware. The same computation modules perform multiple functions - executing real security operations when needed and executing dummy operations for masking, thereby achieving timing obscuration without proportionally increasing hardware complexity.
Solution Approach 2:
The patent uses copying by creating dummy operations that replicate the computational characteristics of security operations. These dummy operations are copies in terms of their execution profile - they consume similar resources, take similar time, and activate the same computation modules, thereby creating indistinguishable timing patterns that mask the actual security operations.
3Productivity
If computation modules execute both security and general operations, then resource utilization improves, but distinguishing between operation types becomes difficult
Solution Approach 1:
The patent introduces dummy operations as intermediaries between security operations and the external observer. These dummy operations act as mediators that fill the temporal gaps and mask the transitions between different operation types, making it difficult to detect whether a given computation module activation corresponds to a security operation or a general operation.
Solution Approach 2:
The patent applies homogeneity by making the execution patterns of security operations and general operations appear identical through the use of dummy operations. Both operation types now follow the same execution template - activation of computation modules with similar timing characteristics, resource consumption patterns, and output profiles - thereby rendering them indistinguishable to external observers.
Data Source
AI summary
Systems and techniques are provided for providing microarchitectures for secure computing systems. For example, a process can include obtaining a first instruction associated with a security operation, and, based on the first instruction associated with the security operation, executing, by first one or more computation modules of a plurality of computation modules, the security operation and executing, by second one or more computation modules of the plurality of computation modules, first one or more dummy operations in parallel with the security operation. The process includes obtaining a second instruction associated with a general operation and based on the second instruction associated with the general operation, executing, by third one or more computation modules of the plurality of computation modules, the general operation and executing, by fourth one or more computation modules of the plurality of computation modules, second one or more dummy operations in parallel with executing the general operation.