DE102014000328A1 - Method for securing a functional process in a microprocessor system - Google Patents

Abstract

The invention relates to a method for securing a functional process in a microprocessor system with a microprocessor and at least one crypto-coprocessor, in which a functional process for executing a predetermined task is performed on the microprocessor (14), simultaneously with the functional process on at least one crypto-co-processor a backup process is performed (12) in which a calculation with known target output data is performed with fixed input data, the actual output data actually obtained by the backup process being compared with the target output data (16), and in case the actual output data and the target output data do not match, inadequate safety in the execution of the functional process is closed and an error routine is executed (20).

Description

The invention relates to a method for securing a functional process in a microprocessor system comprising a microprocessor and at least one crypto co-processor. The invention also relates to a microprocessor system with such a method implemented therein and to a data carrier having such a microprocessor system.

The differential error analysis (referred to below as DFA, differential fault analysis) represents a method that has been known for some time, with which, for example, the secret key of a cryptographic calculation can be determined. During a cryptographic calculation, a so-called DFA attack on the microprocessor is carried out by, for example, applying a voltage spike or a flash of light to the microprocessor. Since microprocessors can be impaired in their function by electromagnetic interference, it is possible to induce errors in the calculation of the microprocessor by means of such a DFA attack, from which the secret key can be determined.

Even beyond the field of cryptographic computations, a DFA attack on a microprocessor system can cause the microprocessor to exploit exploitable errors in the execution of a functional process. In this case, each process performed in the microprocessor which fulfills a desired task to be performed, for example executes a read command or carries out a calculation, is referred to as a function process in the context of this description. For example, if a DFA attack on the microprocessor occurs during the calculation of a memory address for a memory access, it may happen that an incorrect memory address is calculated due to the DFA attack and an access to actually locked memory areas is forced.

The hitherto known countermeasures implemented in hardware and software can not completely detect and fend off DFA attacks on chip cards and their operating systems. In particular, the light detectors of the hardware have mostly proven to be only weakly effective.

Software built-in countermeasures to detect DFA attacks usually cost a lot of performance and / or disk space and require a lot of development effort, so widespread use of these countermeasures is often not possible.

An example of a security measure implemented in software is in the document EP 1 569 118 B1 described. There, for the reliable calculation of a result value, for example a memory address in a memory area of a microprocessor system, the microprocessor carries out a first calculation of the result value and additionally a second calculation of the result value separate from the first calculation. The results of the first and second calculations are compared with each other and the calculated result value is rejected as being erroneous if the first and second calculation results do not match.

Based on this, the present invention seeks to provide a method of the type mentioned, which avoids the disadvantages of the prior art. In particular, the method should be easy to implement, act as globally as possible, require little storage space and have a possibly small influence on the performance of the microprocessor system.

This object is solved by the features of the independent claims. Further developments of the invention are the subject of the dependent claims.

• – wird auf dem Mikroprozessor ein Funktionsprozess zur Abarbeitung einer vorbestimmten Aufgabe durchgeführt,
• – wird gleichzeitig mit dem Funktionsprozess auf zumindest einem Krypto-Koprozessor ein Sicherungsprozess durchgeführt, bei dem mit festen Eingangsdaten eine Berechnung mit bekannten Soll-Ausgangsdaten durchgeführt wird,
• – werden die von dem Sicherungsprozess als Ergebnis tatsächlich erhaltenen Ist-Ausgangsdaten mit den Soll-Ausgangsdaten verglichen, und
• – wird im Fall, dass die Ist-Ausgangsdaten und die Soll-Ausgangsdaten nicht übereinstimmen, auf unzureichende Sicherheit bei der Durchführung des Funktionsprozesses geschlossen und eine Fehlerroutine abgearbeitet oder zumindest veranlasst.

The inventive method for securing a functional process is based on a microprocessor system with a microprocessor and at least one crypto-co-processor. there

• A functional process is carried out on the microprocessor for the execution of a predetermined task,
• A securing process is carried out simultaneously with the functional process on at least one crypto coprocessor, in which a calculation with known nominal output data is carried out with fixed input data,
• The actual output data actually obtained by the backup process as a result are compared with the target output data, and
• - Is in the case that the actual output data and the target output data do not match, concluded inadequate security in the performance of the functional process and executed a fault routine, or at least arranged.

In principle, in the backup process (and also during the functional process), input data is processed into output data. Since the backup process performs a predetermined calculation with fixed input data, the result obtained in error-free calculation is known in advance. If an attack occurs during the execution of the functional process, for example a DFA attack on the microprocessor, there is a certain probability that this attack will also affect the security process of the crypto co-processor influenced and leads there to a faulty calculation and thus to deviating actual output data. The backup process thus has the function of a DFA attack sensor for the functional process. As explained in more detail below, the detection rate of DFA attacks on the microprocessor can thus be increased with comparatively little effort.

In order to minimize performance losses due to the backup process, the crypto co-processor on which the backup process is performed is advantageously operated at a lower clock frequency than the microprocessor. Preferably, the crypto-coprocessor is operated by a factor of 2 or more, more preferably by a factor of 5 or more, more preferably by a factor of about 10 or more. Typically, the crypto-coprocessor operates at such a slower clock frequency that typically a few thousand clock cycles of the microprocessor are covered by a single execution of the backup process on the crypto co-processor.

In an advantageous embodiment, it is further provided that the crypto-coprocessor is operated with a randomly controlled variable clock frequency, whereby specifically an additional variation in the current signature of the microprocessor system can be generated.

Upon completion of the backup process, another backup process is advantageously started. This further save process may re-execute the same calculation with the same input data, or may also perform another predetermined calculation with other fixed input data, as described in more detail below. Advantageously, each time another backup process is started until the functional process ends and the crypto-co-processor is stopped. In this way, the functional process is safeguarded throughout its duration.

In an advantageous development of the invention, a set of calculations is specified, each with fixed input data and known desired output data, and a calculation from this group is performed in each backup process. The selection of the calculation to be carried out in a security process can take place according to a predetermined scheme or at random. The calculations and / or the input data may be partly the same or all different. Furthermore, the calculations can also be carried out with different operand lengths and / or with different calculation methods.

The fixed input data and the desired output data may optionally be loaded into the crypto co-processor at the beginning of the backup process, in particular registers associated with the crypto co-processor. However, in some embodiments, for example, when certain memory areas are to be backed up by the backup process, it is recommended that the fixed input data and / or the target output data be read by the crypto co-processor from one or more predetermined memory areas. Advantageously, a group of input data and desired output data is provided, which are distributed over a plurality of memory areas and used alternately in order to increase the coverage.

According to an advantageous development of the invention, one or more additional safety measure (s) are additionally performed against a DFA attack on the functional process. The further security measures can be implemented in hardware and / or software.

Preferably, the functional process is stopped in the error routine and brought the microprocessor in a secure state.

If the microprocessor system has more than one crypto coprocessor, then the coprocessor performing the backup process can change. For example, if a particular functional process requires a first crypto co-processor, such as to perform RSA encryption, the backup process to secure that functional process is performed on a second crypto-co-processor. A subsequent backup process for another functional process, however, can be performed again on the first crypto-co-processor.

The invention also includes a microprocessor system having a microprocessor and at least one crypto-coprocessor, with a method of the type described above. The invention further includes a data carrier, in particular a chip card or a chip module, having a microprocessor system of the type described therein.

The invention will be explained in more detail by means of embodiments with reference to the figure. 1 shows a flowchart for illustrating a method according to the invention for securing a functional process in a microprocessor system.

The invention will be explained using the example of a smart card, the smart card controller by a microprocessor system with a Microprocessor and at least one crypto-co-processor is formed.

To complicate the optical localization of the individual components of the microprocessor system, large parts of the logic, including in particular the microprocessor, buses, registers, MMU / MPU and the coprocessors, are housed in a so-called glue logic. In this logic logic, the individual structural elements, in particular the gates and lines of the components of the microprocessor system, are not arranged as blocks spatially separated according to functionality, but are rather strongly mixed. Such an arrangement complicates the localization of a particular component within the glue logic and causes even a local attack on a particular component, for example, with a focused laser beam, usually also detected and influenced other components. The structure width in modern chip card controllers is in fact only a few 10 nm, while a laser beam used for a DFA attack has a beam diameter of a few micrometers and therefore, in addition to the attacked component, transistors or gates usually also detect other components.

Based on this observation, in 1 Illustrated hedging two processes simultaneously executed on different hardware components of the microprocessor system, namely on the one hand on the microprocessor, a functional process that performs a desired task to be performed, and on the other hand, on at least one crypto co-processor of the system, a backup process that performs a predetermined calculation with fixed input data. Since the type of calculation and the input data are already established prior to the execution of the calculation, the desired output data obtained with error-free calculation are also known in advance.

Specifically, in the embodiment of the figure in an initialization step 10 set the input data X for the predetermined calculation f by the crypto co-processor. With the definition of the input data X, the target output data Y _soll = f (X) are also known and, like the input data, are present in a memory area.

The input data X and the target output data Y _soll are loaded into the crypto coprocessor and the backup process is started (step 12 ). At the same time as a step 14 the functional process, such as a read command, performed on the microprocessor.

In the backup process, the crypto co-processor now performs the predetermined calculation with the input data X and thereby obtains actual actual output data Y _is ← f (X).

At the end of calculation of the crypto coprocessor initiates an interrupt service routine in which the actual output data Y _{is to} the target output data Y are compared (step 16 ). If the actual output data Y _is the desired output data Y _will agree it is clear from the backup process does not indicate a made attack. The service routine restarts the calculation of the backup process (step 18 ), wherein the input data X and the target output data Y _should be in the simplest case still in the registers of the crypto co-processor. The sequence of steps 14 . 16 and 18 is repeated until the functional process ends and the crypto co-processor is stopped (step 26 ).

If the actual output data Y _is not _to the desired output data Y match, it shall be presumed that the difference is due to an attempted attack on the microprocessor and that the safety of the process function is not guaranteed. It becomes an error handling step 20 in which, for example, the functional process is stopped (step 22 ) and the chip card and the microprocessor are brought into a secure state (step 24 ).

If no deviations have occurred in the backup process until the end of the functional process, it is assumed that the functional process could be performed safely. In step 26 the functional process ends and the computation of the crypto coprocessor is terminated. Of course, the described steps can be carried out again for a subsequent, further functional process.

In addition to the protection described here, additional additional safeguards against a DFA attack on the functional process can be taken. For example, it may be provided, for example, to run a crypto-algorithm twice, to compare the results and, in the case of matching result values, to conclude the absence of an attack and to accept the result while discarding the results in the event of mismatch. Since the known security measures do not provide complete security, even if the further security measures have not detected an attack, there is a certain probability that the calculation of the security process described above is disturbed by an attack and a different actual result Y _ist . The backup process further increases the detection rate of DFA attacks.

A particular advantage of the described hedging method is that the functional process can remain largely unchanged. It is only necessary to load the input data X into the crypto co-processor at the beginning of the functional process and to stop the crypto co-processor at the end of the functional process. The desired output data Y _soll can also be loaded into the crypto co-processor or stored in an external memory area. The implementation of the backup process is therefore simple and can be the same for all functional processes that should be secured in this way. This also results in a small additional memory requirement for the inventive fuse.

Another advantage is the low performance losses due to the backup process. It is true that interrupts triggered by the backup process occur during the execution of the function process, but their runtime can be kept short, because usually only a comparison of setpoint and actual output data and a restart of the backup process is required. In this case, input data X and possibly also the desired output data Y _{soll may} even be located in the registers of the crypto co-processor.

The performance losses can also be minimized by operating the crypto-coprocessor with the lowest possible clock frequency during execution of the backup process. A single calculation in the crypto co-processor can thus cover several thousand clock cycles of the microprocessor. In addition, a long-lasting arithmetic operation can be defined for the backup process, for example a modulo calculation with a large operand length of, for example, 1024 bits, 2048 bits or more.

A further advantage of the described protection is that the current signature of the functional process is changed by the parallel running backup process and the interrupts, which on the one hand increases the protection against SPA / DPA attacks (SPA = DPA attacks) and, on the other hand, also complicates the triggering of DFA attacks on characteristics of the current signature of the microprocessor system.

In order to generate a particularly large variation of the current signature, a group of calculations f ₁ , f ₂ ,... F _{n can also be} provided with fixed input data X ₁ , X ₂ ,... X _n and known desired output data Y _{1, should} , Y _{2, should} , ... Y _{n, should be} given, where Y _{1, soll} = f ₁ (X ₁ ), Y _{2, soll} = f ₂ (X ₂ ), ..., Y _{n, soll} = f _n (X _n ) applies. The calculations f ₁ , f ₂ , ... f _n and / or the input data X ₁ , X ₂ , ... X _n can all be different. In each backup process, a computation k is then performed from this group, Y _{k, is} ← f _k (X _k ), where the selection of the computation k to be performed in the save process can be done according to a predetermined scheme or randomly. In addition to different input data and / or different calculation methods, different operand lengths can be used to make the temporal and quantitative change of the current signature even more pronounced.

Another possibility for the targeted generation of additional variation in the current signature is to operate the crypto-co-processor with a randomly controlled, variable clock frequency.

The described protection method protects against attacks on glue logic areas, since an attack interferes with the calculation in the backup process described here and generally results in an actual result Y _ist deviating from the target result Y _soll .

However, the protection method is often effective even in microprocessor systems without glue logic, so with optically strictly separated function blocks, as a light attack can lead to voltage drops or voltage spikes, which also affect remote circuit parts and therefore can also produce a different result in the calculation of the backup process , In addition to light attacks, there are also other, anyway global, DFA attack methods, such as voltage glitches, which always act on remote circuit components.

Furthermore, with the described safeguarding method, not only attacks on logic areas but also attacks on memory areas can be detected, provided that the input data and / or the desired output data are distributed over these areas. For this purpose, the input data and the desired output data are advantageously not loaded once in the registers of the crypto co-processor at the beginning of the functional process, but are only referenced via pointers. The crypto co-processor then reads the input data or the desired output data directly from the referenced memory areas at the beginning or during the predetermined calculation. Again, it is useful to provide a set of multiple input data and target output data that are spread across multiple memory areas and used alternately to increase coverage.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• EP 1569118 B1 [0006]

Claims (11)

Method for protecting a functional process in a microprocessor system with a microprocessor and at least one crypto-coprocessor, in which On the microprocessor a functional process is carried out for the execution of a predetermined task, A securing process is carried out simultaneously with the functional process on at least one crypto coprocessor, in which a calculation with known nominal output data is carried out with fixed input data, The actual output data actually obtained from the backup process is compared with the desired output data, and - In the event that the actual output data and the target output data do not match, inferior security in the execution of the functional process is closed and an error routine is initiated or executed. A method according to claim 1, characterized in that the crypto-coprocessor on which the backup process is performed is operated at a lower clock frequency than the microprocessor, preferably by a factor of 2 or more, more preferably by a factor of 5 or more, more preferably by a factor of 10 or more lower clock frequency. A method according to claim 1 or 2, characterized in that the crypto-coprocessor is operated with a random variable frequency clock. Method according to at least one of claims 1 to 3, characterized in that after completion of the backup process another backup process is started. Method according to at least one of Claims 1 to 4, characterized in that a group of calculations is respectively preset with fixed input data and known desired output data, and a calculation from this group is carried out in each backup process, the selection of those to be performed in a backup process Calculation according to a predetermined scheme or done randomly. A method according to claim 5, characterized in that the calculations of the group are performed with different operand lengths and / or with different computational methods. Method according to at least one of Claims 1 to 6, characterized in that the fixed input data and / or the desired output data are read by the crypto co-processor from one or more predetermined memory areas. Method according to at least one of claims 1 to 7, characterized in that in addition at least one further safety measure against a simple or differential fault analysis attack on the functional process is performed. Method according to at least one of claims 1 to 8, characterized in that in the error routine of the functional process is stopped and preferably the microprocessor is brought into a secure state. Microprocessor system comprising a microprocessor and at least one crypto-co-processor, having a method implemented therein according to one of Claims 1 to 9. Data carrier, in particular chip card or chip module, with a microprocessor system arranged therein according to claim 10.

Images