DE19539700C1 - Security chip for data protection - Google Patents

Abstract

The invention relates to a security chip (SC) which is disconnected from application hardware (AHW) and only connected to the application hardware (AHW) by way of a data interface (DS) and a command interface (BS). The security chip (SC) has its own processor (P) and a plurality (VZ) of independent algorithm modules (AMi) for carrying out symmetric encryption algorithms (SV) and/ or asymmetric encryption algorithms (AV), all components of the security chip (SC) being connected via a bus (IB) inside the chip. The methods for encryption management and for cryptographic user data processing are carried out together on the security chip (SC), and consequently the security features of said chip (SC) are considerably improved in relation to known arrangements.

Description

To maintain the security of communication relationships, for example of data communication or voice communication nication, cryptographic algorithms become encrypted selection of the actual communication data. Ver Different algorithms are used, for example, to secure the Integrity, confidentiality or authenticity of the transmitted data or the communication partner.

So security chips are needed that the cryptogra phical procedures and protocols for various information Carry out technical applications.

They are special Si designed for individual applications Security modules known, for example a security module for secure fax transmissions (Siemens, data backup mo dul DSM-Fax, secure fax transmissions, Siemens area security technology) or also for the encryption of telephone calls speak (Siemens, DSM-Voice-Telephoning in Confidence, you mens area security technology; Luis Cypher, LC-1 The digita le voice encryptor for tap-proof telephone calls).

Furthermore, there are special ones for asymmetrical crypto algorithms developed chip card controllers and coprocessors known (IS-Aktuell, Products / Systems, pp. 7-17 to 7-18, April 1993, 1993).

Other security chips are known, either the symmetric crypto-algorithm is supported by hardware is performed, but the asymmetric crypto-algorithm only is supported by the software, or vice versa (L. Gold berg, New Encryption strategy uses hardware and software to protect data on public networks, Electronic Design, pp. 39-40,  March 1995; G. Eberhard, Two New Crypto Products from Siemens: the SLE44C200 chip card controller and the coprocessor SLE44CP2, processors for asymmetric algorithms, IS- Aktuell, pp. 7-17 - 7-18, April 1993).

These known security modules have the disadvantage that that they only turned on very specific applications are restricted. Above all, there is either only one asymmetry trical algorithm, both of which are directly hardware-supported expire for data encryption on a single Si security chip provided or only a symmetrical data ver encryption on a chip.

This limitation leads to a further disadvantage of previous solutions that security-critical information in a computer which performs the encryption algorithms partly still via an unsecured bus of the rake unit is transferred, for example in the key ver administration of cryptographic keys and the transmission of User data and thus be intercepted by an attacker can.

The invention is therefore based on the problem of being secure heitschip specify the disadvantages mentioned above avoids.

The problem is solved by the security chip according to Patentan spell 1 solved.

The security chip is complete of the application hardware uncoupled and only via a data interface and a loading faulty interface "responsive". Since the security chip own processor, an on-chip bus on which the Application hardware can not access, as well as differ che algorithm modules with which the most diverse security security services based on asymmetrical and symmetrical Algorithms performed are safe  Heitschip universally applicable and does not provide any security safety-relevant information to the application hardware.

This allows the application hardware and application software goods could be loaded, configured and adapted as required, without that the security of the various crypto functions that performed with the algorithm modules, at risk is.

Through the further development of the security chip according to Patentan saying 5 it is possible to attack the security chip recognize and possibly also with a Deletion of all data to respond.

The further development of the security chip according to claim 6 realizes an extension of the algorithm modules by more Security services and thus extends the applicability of the Security chips.

Further developments of the invention result from the dependent Claims.

A preferred embodiment of the invention is in the Drawings shown and will be described in more detail below ben.

Show it

Fig. 1 is a sketch that describes a possible arrangement of the safety chip;

Figure 2 is a block diagram that writes possible algorithm modules.

Fig. 3 is an arrangement which shows the structure of a secure Zeitge bermoduls.

Referring to Figs. 1 to 3, the invention is further tert erläu.

In Fig. 1 an arrangement of a security chip SC is provided.

The security chip SC has at least the following components on:

• a processor P,
• - A variety of VZ from independent algorithm modules AMi to carry out encryption algorithms,
• a memory SP,
• - A data interface DS, which depends on the performance of the Processor P is independent
• - A secure command interface BS that either in one on-chip data bus DB or directly into the processor P ge leads is
• - The on-chip data bus DB, over which the large number of VZ independent algorithm modules AMi with the data interface place DS is coupled, and
• - An on-chip bus IB, with which all components except the data interface DS are coupled.

By decoupling the data interface DS from the chi internal bus IB is no longer the encryption performance depending on the processor P. In addition, the chipinter NEN data from the on-chip bus IB not from an unrelated added third parties in particular to the data interface DS cannot be bugged or manipulated.

Furthermore, the security chip SC can have the following components exhibit:

• - a timer module ZM,
• - A sensor module SM and
• - an actuator module AKM.

These components are also ge with the chip-internal bus IB couples.

For communication between the individual components, that is for sequence control, a wide variety of communicati protocols, of course, independently of that of egg ner application hardware AHW used communication prototype koll, can be used.

The data interface DS and the command interface BS are the only access points for the application hardware AHW on the security chip SC.

In another way, the AHW application hardware does not have one Possibility on the security chip SC and thus also on the security-relevant data contained in the security chip SC used and / or stored to access.

By decoupling the security chip SC from it It is "outside world" for an unauthorized third party, ie one Attackers, no longer possible, security-relevant data ir of any kind from the security chip SC.

The processor P can be any processor with a ge suitable speed, which can be derived directly from the requirements changes in the planned application.

The AMi algorithm modules are independent modules, of which each specifically for a cryptographic protocol or procedure is "responsible". These include, for example Procedures or protocols for encryption and decryption selection of user data, for integrity protection, or for digital signature (signature) or hash value formation understand. The index i identifies each algorithm module AMi clearly. It is any natural number in the Be ranges from 1 to n. Here n is the number of different ones  algorithm module implemented on the SC security chip le AMi.

Possible exemplary embodiments for the algorithm modules AMi are explained below.

An algorithm module AMi is, for example, a module that specifically for performing a cryptographic symmetri The SV method, for example the Data Encription Stan dard procedure (DES procedure) is provided. The module can also be designed so that the DES method with un different key lengths, for example that too Triple DES procedure can perform. More symmetrical cryptographic procedures SV can learn in further Al gorithm modules AMi.

In a further exemplary embodiment, it is provided in the AMi algorithm modules also use asymmetric cryptography cal algorithms to perform AV. Examples of asymmetry Any cryptographic cryptographic algorithms AV are well known long known, for example the RSA method.

This symmetric encryption described above algorithms SV and asymmetric cryptographic algo rithmen AV can be used separately or together in un different AMi algorithm modules on the security chip SC can be provided.

Several AMi algorithm modules of the same type can also be used to carry out the same procedure on the Si be provided security chip SC, for example, to increase the performance of the SC security chip. This can e.g. Belly be provided in such a way that an algorithm module AMi for processing an incoming data stream and another res algorithm module AMi of the same design for processing egg nes outgoing data stream is provided.  

The AMi algorithm modules are used, among other things, for encryption Selection of user data, which via the data interface DS in Plain text from the application hardware AHW on a chipinter a data bus DB and with any one of the application hardware AHW via the command interface BS specified encryption method, through which also the used algorithm module AMi from the multitude of VZ the independent dependent algorithm module AMi is selected, encrypted will.

The encrypted in the respective algorithm module AMi User data are again via the on-chip data bus DB and the data interface DS, now in encrypted form the application hardware AHW transferred.

Via the command interface BS is used by the application hardware AHW the security chip SC the parameters of each current encryption request for the user data known given. This can be, for example, the Ver encryption algorithm, the key length, or the like Parameters that are necessary for the encryption of user data his. Furthermore, the application hardware AHW about the command interface BS the method, for example encryption of user data.

The processor P controls the administrative processes for the Ver encryption of data in the security chip SC and also of the cryptographic protocols described below.

However, processor P does not necessarily transport the encrypted, decrypted or with cryptographi processed user data. These become nasty chichlich, if not transported by the processor P, over transported the on-chip data bus DB and what a Another advantage of the security chip SC is that the Ver key performance SC is not dependent on the processor P.  

In addition, by decoupling the on-chip data bus ses DS from the on-chip bus IB ensures that the in ternal data that is transported via the on-chip bus IB are not listened to at the data interface DS or ma be nipulated.

This leads to a significant improvement in safety known properties of the SC security chip security modules, as security-relevant data such as for example, cryptography used for encryption c key can no longer be intercepted by unauthorized persons nen.

Both non-encrypted and also data that is used to implement crypto algorithms between must be saved, for example Intermediate key in procedures based on the principle of ex Partial key exchange work or intermediate keys used in the DES process.

Additional algorithm modules AMi can be provided for Implementation of various security services, for example as from known authentication protocols or Implementation of procedures for key exchange or for Key generation of cryptographic keys.

The SM sensor module detects physical attacks the security chip SC detected, possibly evaluated and reported to the processor P via the on-chip bus IB.

In the actuator module AKM on the instruction of the processor P Steps taken to ward off sensor module SM detected attacks. These security measures can Example of deleting everything in memory at that time SP stored data.  

The timer module ZM has at least the following components on:

• - a SIO timer interface,
• a timer controller ZC,
• - A counter circuit ZS, the counter circuit ZS min at least has:
• a data buffer DB,
• a real time counter RZ,
• - a clock adaptation TA, and
• - A counter switch CLOSE.

The ZM timer module, for example, performs autonomous tasks to provide timestamps. The timestamp who other applications via the ZIO timer interface of the security chip SC provided.

The timer controller ZC controls the drain fe of the ZM timer module.

The ZIO timer interface provides the bus interface of the timer module ZM to the on-chip bus IB ZIO timer interface is primarily needed to communication with external controllers, in the case of the Si security chips SC with the processor P to handle.

Connections are therefore provided for controlling the sequence of the cryptographic communication protocol, i.e. for tax purposes communication with other controllers, i.e. with the Processor P. Furthermore, a connection is provided via which the timer module ZM manipulation attempts by the Sensor module SM were detected, reported, for. B. Manipulations on the beat. Further connections are planned to exchange the data of the timer module ZM, i.e. one absolute or relative time by the timer module ZM is determined.  

In the timer module ZM itself, no crypto Algorithms performed. For the handling of Authentifi cation protocols and other security functions the other intended modules of the security chip SC constantly. The processor P must decide and monitor who in which way via the timer interface ZIO on the ZM timer module may access.

The timer controller ZC controls the time encoder interface ZIO and the counter circuit ZS. also the timer controller ZC receives via the timers interface ZIO logical commands from processor P.

The logic commands of the processor P are from the Zeitge Overcontroller ZC interprets and in the internal control of the timer module ZM implemented. The timer thus monitors overcontroller ZC the functional sequence of the entire module. It thus represents the control unit of the timer module missing with which the timer controller ZC the expiry of The timing module ZM influences, for example, the following Features include:

• - Setting the time of the ZM timer module (date, time, Synchronization mechanism);
• - Transfer of loaded clock parameters into the current clock function;
• - Reading out the time of the timer module ZM;
• - Define calendar functions (monthly rhythm, view leap years, take summer time into account, etc.);
• - Setting clock reset functions, i.e. determining whether a Reset at an ordered time or at any time Time should take place;
• - Starting and stopping the ZM timer module;
• - Parameterizing the clock adaptation TA, i.e. defining the Pa parameters required for clock adaptation TA;  
• - parameterization of the resolution accuracy of the timer module, that is, the setting whether the timer module ZM the Time in seconds, in milliseconds or in microseconds should measure;
• - Parameterization of the transmission format of the time of the day ZM encoder module;
• - Reading out status information via the timer module ZM;
• - Parameterization of the counting mode, i.e. whether binary or modulo ge should be counted;
• - Switching a test mode for the timer module on and off ZM.

In addition, data is generated by the timer controller ZC handle control and a functional access control leads. In this context, this includes, for example understand:

• - Access to the ZM timer module is only permitted after ei successful verification of a PIN;
• - Access is only allowed after successful authentication tion;
• - Access is only permitted for reading;
• - Access is only permitted in writing.

The counting circuit ZS of the timer module ZM has, as in vo described, among other things, the real-time counter RZ.

The real-time counter RZ is a counting circuit that comes from kaska dated modulo meters. Cascading and Synchronization of the real-time counter RZ can take into account the peculiarities of time jumps, for example caused by summer time or leap years, etc., ge happen. For some cryptographic applications, one is "Relative" time count, i.e. H. a monotonously counting bi sufficient length counter according to the required Time to continue provided.  

The clock adaptation TA serves to generate a suitable one Time base for time measurement with the ZM timer module external clock supply, as is the case today usual chip cards is the case.

The data buffer DB is used to store data in the ZM timer module are required.

It is also advantageous if the algorithm modules AMi are designed so that the key management directly in Hardware is supported. This is especially the case with schnel len key changes between different encryption data streams have significant performance advantages. This is from of particular importance in the field of packet-oriented telephoto communication or data connections or for application Sharing systems or multimedia applications, for example in a local area network (LAN) where there are many packets transferred to different communication partners and un must be processed differently cryptographically.

Claims (7)

1. security chip (SC),

• - in which the security chip (SC) is only coupled to an application hardware (AHW) via a data interface (DS) and a command interface (BS),
• - in which a processor (P) is provided,
• - In which a plurality (VZ) of independent Algorithmenmo modules (AMi, i = 1.. n) is provided for performing encryption algorithms, the independent algorithm modules (AMi) via a chip-internal bus (IB) with the processor (P) are coupled and are coupled to the data interface (DS) via an on-chip data bus (DB), and
• - In which a memory (SP) is provided, which is coupled to the internal chi bus (IB).

2. Security chip (SC) according to claim 1, in which at least an algorithm module (AMi) of the plurality (VZ) of the algorithms module (AMi) is intended to perform symmetrical Encryption algorithms (SV). 3. Security chip (SC) according to claim 1 or 2, in which the min at least one algorithm module (AMi) of the multitude (VZ) of Al gorithmenmodule (AMi) is provided for performing asymmetrical trical encryption algorithms (AV). 4. Security chip (SC) according to one of claims 1 to 3, which is provided a timer module (ZM) that leaves one absolute time and / or a reliable relative time determined and made available. 5. Security chip (SC) according to one of claims 1 to 4, at which a sensor module (SM) and / or an actuator module (AKM) is provided for detection and attacks on the Si security chip (SC) and / or to carry out security  measures in the event of detected attacks on the security chip (SC). 6. Security chip (SC) according to one of claims 1 to 5, at which further modules are provided for the implementation of further Security services. 7. Security chip (SC) according to one of claims 1 to 6, at which the algorithm modules (AMi) are designed such that key management is supported directly in hardware.