EP1346271A1

EP1346271A1 - Method for making secure a logical or mathematical operator in a microprocessor-based electronic module

Info

Publication number: EP1346271A1
Application number: EP01989651A
Authority: EP
Inventors: Nicolas Giraud; Abraham Brolh; Patrice Hameau
Original assignee: CP8 Technologies SA
Current assignee: CP8 Technologies SA
Priority date: 2000-12-21
Filing date: 2001-12-20
Publication date: 2003-09-24
Also published as: WO2002050641A1; AU2002228116A1; FR2818772A1; MXPA03005710A; CN100470438C; CN1488091A

Abstract

The invention concerns a method for making secure a logical or mathematical operator, in the present case the XOR operator, usable in executing a programme in a microprocessor-based electronic module. The invention is characterised in that the execution of the XOR operator is replaced by the execution (CAL-XORSEC (i)) of a sequence (Si) of operations having as final result a result identical to the result of the XOR function. The sequence of operations (Si), in the present case, consisting of elementary operations based on AND, OR, and NOT, is selected from a set of eight equivalent sequences (S1 to S8) after determining (CAL-NDO) a serial number NDO = i based on parameters of the programme and/or a random parameter R supplied by a pseudo-random number generator (24).

Description

METHOD FOR SECURING A LOGICAL OR MATHEMATIC OPERATOR IN AN ELECTRONIC MODULE WITH MICROPROCESSOR

The present invention relates to securing on-board systems comprising one or more electronic modules incorporating at least one microprocessor,

10 a ROM type memory containing at least one program to be executed and input / output means for communicating with the outside. Some modules also include other accessory circuits such as RAM, EEPROM for more sophisticated applications and are

15 also known are the name of microcontrollers.

Such modules are most often produced in the form of a monolithic integrated electronic circuit, or chip. These modules can be used

On the one hand as such once physically protected and mounted for example on a portable object such as a smart card, microcircuit card or the like which can be used in various fields, in particular the field of bank and / or commercial cards, mobile radiotelephony,

25 pay television, health and transport, and on the other hand in other on-board systems ranging for example from relatively simple systems, such as sensors and switches, to more complex systems such as industrial controllers,

30 multi-switches and other electronically controlled sub-assemblies and devices up to complete electronically controlled industrial systems.

The proliferation of applications in everyday life

35 smart cards and other embedded systems and the generalization of their use in certain fields, such as bank cards, health cards or pay TV made it necessary to introduce secure procedures, for example cryptographic procedures and / or data scrambling procedures, for example data passing over the bus internal of the microcontroller. These security procedures relate in particular to user authentication, authentication of the transaction and its validity, maintenance of data confidentiality, encryption / decryption of data.

If the fraudulent use of smart cards is not a new phenomenon, the increase in the volume and value of smart card transactions has led fraudsters to use increasingly sophisticated methods and means. In particular, short and targeted radiation attacks on the chip have the effect of modifying the data and / or the codes passing from the ROM to the microprocessor on the internal bus, resulting in the non-execution or irregular execution of certain parts of the code, for example the execution of inoperative instructions in place of one or more security operations.

It turns out that the precise location of the position of a given sensitive operation (for example relating to encryption and / or decryption) in a program encoded in a ROM memory makes it possible to better target the attack and to increase in a way significant the nuisance power of the latter. To carry out this localization, fraudsters use the so-called SPA method (in English Simple Power Analysis) which consists in recording the current consumption at certain points of the microcontroller. The SPA method can be supplemented by the DPA method (in English Differential Power Analysis) based on the comparative analysis of signals. From this point from sight it sometimes happens that the execution of certain programmed operations (such as the XOR [OR exclusive] operation frequently used in encryption / decryption) reveals a "signature" sufficiently characteristic to allow the identification of the operation in question and by following its localization in the program.

The present invention aims to secure certain vulnerable operations in a program, in particular logical or mathematical operators or similar functional circuits by making their identifications more difficult, even much more difficult.

To this end the invention provides a method for securing a logical or mathematical operator or a similar functional circuit usable in the execution of a program in an electronic microprocessor module, the method being characterized in that the execution of said operator is replaced by the execution of a sequence of replacement operations having the final result identical to the result of the function of said operator.

Thus the signature very characteristic of a complex operator, such as the operator XOR, is replaced by the signal of a sequence of operations often less complex, but not necessarily, for example of a sequence of elementary operations of signatures neighbors or identical little characterized, the identification of the operator being thus made more difficult.

According to a preferred embodiment of the method according to the invention, the sequence of replacement operations is chosen each time the operator is protected, from a set of equivalent sequences. Thus the difficulty of identification is further increased by the multiple changes in the replacement sequence of operations of the operator to be protected during the execution of the same program. Advantageously, all of the sequences include at least four equivalent sequences and preferably eight equivalent sequences, which makes it even more difficult to identify the sequence as the operator sought by fraudsters.

According to a first variant of the invention, the sequence number as a whole of the chosen sequence is determined as a function of certain parameters of the program being executed and / or of a random parameter advantageously obtained from a generator of pseudo-random numbers. This sequence scrambling mechanism proves to be very effective when the operator to be secured is repeated several times in a program such as, for example, the XOR operator in an encryption / decryption processing.

According to a second variant of the invention (not exclusive of the first variant), the sequences of operations of the same set all have the same execution time. Advantageously, certain sequences include at least one non-operative instruction intended to introduce a delay time in the execution of the sequences concerned. In particular, the non-operative instruction is chosen from non-operative instructions with respect to the microprocessor or from instructions normally operative but rendered ineffective by their positions in the sequence of operations. This mechanism of standardizing the execution times of sequences makes their distinctions with each other even more difficult. According to a first application of the method according to the invention, the operator to be secured is a logical operator, by way of nonlimiting example the logical operator XOR (or exclusive OR). Advantageously at least one sequence of replacement operations is composed from elementary logical operators. For example at least one sequence of operations is composed from the basic logical operators AND (or AND), OR (or OR) and NOT (or NO).

The invention also relates, as regards the securing of the operator XOR, the sets of sequences of replacement operations SI to S8 and S'1 to S '8 given below: SI = (x OR y) AND NOT (x AND y)

52 = (x OR y) AND (NOT x OR NOT y)

53 = NOT (NOT x AND NOT y) AND NOT (x AND y)

54 = NOT (NOT x AND NOT y) AND (NOT X OR NOT y)

55 = NOT (NOT (x OR y) OR (x AND y)) S6 = NOT ((NOT x AND NOT y) OR (x AND y))

57 = NOT ((NOT x AND NOT y) OR NOT (NOT x OR NOT y))

58 = NOT (NOT (x OR y) OR NOT (NOT x OR NOT y)) and with replacement operation sequences of the same execution time: S'1 = (x OR NOP y OR y) -AND NOP NOT (x AND NOP y AND y) S '2 = (x OR y NOP OR y) AND NOP (NOT x OR NOP NOT y) S'3 = NOT (NOT X AND NOP NOT y) AND NOT (x AND y AND y) S'4 = NOT (NOT x AND NOP NOT y) AND (NOT x OR NOT y) S'5 = NO (NOT (x NOP OR y OR y) OR (x NOP AND y AND y)) S'6 = NOT ((NOT x AND NOT y NOP) OR (x AND y NOP AND y)) S'7 = NOT ((NOT x AND NOT y) OR NOT (NOT x OR NOT y)) S'8 = NOT (NOT (x OR y OR y) OR NOT (NOT x OR NOT y)) in which the NOP instruction corresponds to a non-operative instruction with respect to the microprocessor. According to other applications of the method according to the invention, the operator to be secured is a mathematical operator such as a half-adder, an adder, a subtractor or a multiplier, or a functional circuit similar to a logical or mathematical operator, such as a combinational circuit, in particular a multiplexer and / or a demultiplexer, an encoder and / or a decoder, a generator and / or parity detector or a comparator.

In particular, according to a second application of the method according to the invention, the operator is the mathematical operator of the “multiplication by two” obtained by shifting to the left of a bit with zero setting of the least significant bit, the notation in C ANSI of this operator writing (X << 1).

The invention also relates, with regard to securing the operator (X << 1), the following replacement sequences S''l to S '' 4 equivalent: S '' 1 = (x ADD x )

S '' 2 = (x AND FOh) ADD x ADD (x AND OFh)

S '' 3 = (NOT ((NOT x) ADD (NOT x))) SUB 1

S "4 = (y ADD x) SUB (y SUB x), in which the operator ADD is the standard addition operator on one byte, the instruction SUB is the standard subtraction operator on one byte and the suffix "h" indicates a hexadecimal value.

The invention also relates to an electronic module with secure operator and comprising at least one microprocessor and a program to be executed comprising at least one logical or mathematical operator or a similar functional circuit to be secured, the module being characterized in that it comprises means to replace the execution of the operator by the execution of a sequence of operations resulting in a result identical to the result of the operator's function.

Advantageously, the electronic module according to the invention comprises means for selecting the sequence of operations each time the operator is called from among a set of equivalent sequences. According to a very interesting variant, the module includes computer processing means for determining the order number in the whole of the sequence chosen as a function of certain parameters of the program being executed and / or of a random parameter generated by a pseudo-random number generator.

The invention also relates to an electronic module with a secure operator and comprising at least one microprocessor and a program to be executed comprising at least one logical or mathematical operator or a similar circuit to be secured, characterized in that it comprises the material means and / or software for implementing the method according to the invention presented above.

The invention also relates to an on-board system or a microcircuit card comprising an electronic module with a secure operator as defined above in its various variants.

Other objects, advantages and characteristics of the invention will appear on reading the description which follows of the implementation of the method according to the invention applied to securing the operator XOR and of an embodiment of an electronic microprocessor module according to the invention given by way of nonlimiting example with reference to the attached drawings in which: FIG. 1 shows a schematic representation of an embodiment of an electronic module with microprocessor and secure XOR operator according to the invention; and FIG. 2 shows a schematic representation of the equivalent execution of the operator XOR implementing the method according to the invention in the module of FIG. 1.

The monolithic electronic module 10 with microprocessor illustrated in FIG. 1 according to the present invention and described by way of nonlimiting example generally comprises a microprocessor or central processing unit CPU 11 connected bidirectionally by an internal bus 12 to a memory RAM 14, ROM ROM 16, EEPROM 18 and I / O I / O interface 20. The module 10 also includes a TIMER timer 22 with automatic reset (optional option) and a pseudo-random number generator GNPA 24 connected to the internal bus 12.

Are implemented in ROM 16 actual application programs such as for example bank card transaction applications or health card transaction applications which for reasons of confidentiality and security include encryption / decryption subroutines, operator authentication or transaction validation in which the XOR operator is frequently present, in particular to perform byte by byte comparisons.

With regard to the execution of the operator XOR, this very commonly used operator is generally part of the set of arithmetic instructions with two operands (OPl and 0P2) of the central unit CPU or microprocessor 11. In the embodiment described here, the means for implementing the method for securing the operator XOR are mainly software in the form of a routine for calculating secure XOR (or XORSEC routine) presented diagrammatically in FIG. 2. Thus at each call of the instruction XOR (OP1, OP2) the program is diverted with the two operands OP1 and OP2 towards the routine XORSEC which will be executed in place of the instruction XOR, it being understood that the execution of the routine XORSEC performs a function equivalent to that of the original XOR instruction.

According to the main characteristic of the invention, the execution of the XOR instruction is replaced in the XORSEC routine by the execution of a sequence of operations, in this case but not necessarily operations of a lower degree of complexity as for example elementary operations, having for final result a result identical to the result of the function of the operator XOR (condition easily verified among others by truth tables with identical outputs).

By way of nonlimiting examples, a set of eight sequences SI to S8 equivalent to the instruction XOR is given below:

51 = (x OR y) AND NOT (x AND y)

52 = (x OR y) AND (NOT x OR NOT y)

53 = NOT (NOT x AND NOT y) AND NOT (x AND y) S4 = NOT (NOT x AND NOT y) AND (NOT x OR NOT y)

55 = NO (NOT (x OR y) OR (x AND y))

56 = NOT ((NOT x AND NOT y) OR (x AND y))

57 = NOT ((NOT x AND NOT y) OR NOT (NOT x OR NOT y))

58 = NOT (NOT (x OR y) OR NOT (NOT x OR NOT y)) It will be noted that all these sequences Si to S8 are based on the use of at least two of the three elementary logic instructions AND (or AND), NOT (or NOT) and OR (or OR) and have the same output from the table of truth only for the XOR instruction.

Using the classic presentation of truth tables with two inputs x, y and one output s, we can write for the operators XOR, AND and OR and for the sequence S5 (chosen by way of nonlimiting example) the four tables of following truths:

XOR AND OR x y s i [XOR) x y s ι [AND) x y s (OR)

0 0 0 0 0 0 0 0 0

0 1 1 0 1 0 0 1 1

1 0 1 1 0 0 1 0 1

1 1 0 1 1 1 1 1 1

and for S5 = NOT (NOT (x OR y) OR (x AND y)) with A = (x OR y), B = NOT A, C = (x AND y) D = (NOT (x OR y) OR (x AND y) = B OR C, and S (S5) = E = NOT D

x y A B C D E

0 0 0 1 0 1 0

0 1 1 0 0 0 1

1 0 1 0 0 0 1

1 1 1 0 1 1 0

We thus verify that s (S5) = E is identical to s (XOR)

It will be noted that the sequence S5 automatically chosen to replace the operator XOR consists of five elementary operations whose signature will be very different from the operator XOR. The simplest variant for implementing the method according to the invention is thus produced. According to an optional feature of the invention, but very advantageous, used in the embodiment described here, the sequence of replacement operations is determined each time the XOR operator is called from among the set of equivalent sequences, in this case the set ES constituted by the eight sequences S1 to S8 given above. Thus the difficulty of identifying the operator XOR is further increased by the multiple changes in the sequence of operations replacing the operator XOR during the execution of the program, the sequences SI to S8 likely to be used. all with different signatures.

According to another optional feature of the invention, but also very advantageous, used in the embodiment described here, the sequence number NDO = i (i ranging from 1 to 8) as a whole (SI to S8) of the sequence If chosen to be executed is determined according to certain parameters of the program being executed and / or a random parameter. Advantageously, said random parameter is obtained from a generator of pseudo-random numbers. This sequence scrambling mechanism making the sequence actually chosen to replace the XOR operator random at each call is very effective, especially in an encryption / decryption processing when the XOR operator is called several times in the program.

Thus as illustrated in FIG. 2, the XORSEC routine comprises four main processing phases, namely in the order of execution:

- an IN-XORSEC input or initialization phase, with in particular the memorization of the program counter values, and of the operands OP1 and OP2, - a CAL-NDO phase of determination by the calculation of the sequence number NDO = i (i ranging from 1 to 8) of the sequence of operations Si to be executed in replacement of the instruction XOR with connection to the subroutine CAL-XORSEC (i) corresponding and present in the CAL-XORSEC set of the eight CAL-XORSEC (1) to CAL- XORSEC (8) subroutines,

- a phase CAL-XORSEC (i) of execution of the subroutine CAL-XORSEC (i) by logical calculation with the operands OPl and OP2 of the sequence of operations If selected by the phase CAL_NDO,

- an OUT-XORSEC phase of return to the main program for resumption of its execution and transfer of the results of the CAL-XORSEC phase (i) equivalent to the calculation of an XOR between the two operands OP1 and OP2.

It will be noted that for the CAL-NDO phase, the random GNPA generator 24 supplies on request a random byte R used as a calculation parameter alone or with other parameters extracted from the values of the operands OP1 and OP2, the calculation having as final result a byte F (R). From this byte, using, for example, an operation of the NOD = i = F (R) AND 07h type, extract the three least significant bits to obtain the binary value of NOD = i (from 000 to 111 or OOh at 07h), number order of the Si sequence to execute. It should be noted that the value of the sequence number is a sensitive datum of the algorithm considered.

Finally, the XORSEC routine presents another still improved variant with regard to the difficulty of identification in which the set of replacement sequences consists of sequences of the same duration of execution (and therefore more difficult to distinguish). . To do this, certain sequences include at least one non-operative instruction intended to introduce a delay time in the execution of the sequences concerned. In particular, the non-operative instruction is chosen from non-operative instructions with respect to the microprocessor or from instructions normally operative but rendered ineffective by their positions in the sequence of operations.

If we consider that the elementary operations AND, OR and NOT have substantially equal execution times (for example 4 cycle times of the clock of the central unit CPU 11), as for the “white” operation nonoperative NOP, the set ES of sequences SI to S8 is modified into a new set of standardized sequences with 9 operations ES 'written as a nonlimiting example as follows (and in which the added operations appear in bold):

S'1 = (x OR NOP y OR y) AND NOP NOT (x AND NOP y AND y)

S '2 = (x OR y NOP OR y) AND NOP (NOT x OR NOP NOT y)

S '3 = NOT (NOT x AND NOP NOT y) AND NOT (x AND y AND y) S'4 = NOT (NOT x AND NOP NOT y) AND (NOT x OR NOT y)

S'5 = NOT (NOT (x NOP OR y OR y) OR (x NOP AND y AND y)) S'6 = NOT ((NOT x AND NOT y NOP) OR (x AND y NOP AND y)) S '7 = NOT ((NOT x AND NOT y) OR NOT (NOT x OR NOT y)) S'8 = NOT (NOT (x OR y OR y) OR NOT (NOT x OR NOT y))

For example, for the sequence S'5:

S'5 = NOT (NOT (x NOP OR y OR y) OR (x NOP AND y AND y)) with x '= x NOP, A = (x' OR y), A ^# = A OR y, B = NOT A ', C = (x' AND y), C = C AND y, D = B OR C and s (S "5) = E = NOT D

We can write the truth table of the sequence S'5 which also checks s (S'5) ≈ s (XOR)

S '5 x y x' A A 'B C c D E

0 0 0 0 0 1 0 0 1 0 0 1 0 1 1 0 0 0 0 1 1

1 0 1 1 1 0 0 0 0 1 1

1 1 1 1 1 0 1 1 1 0

It will be noted that for sequences with nine elementary operations the machine time remains very reasonable.

The invention is not limited to its application to the securing of logical operators but is also applicable to the securing of mathematical operators such as half-adders, adders, subtractors and multipliers or of functional circuits similar to logical or mathematical operators, such as combinational circuits, in particular multiplexers and / or demultiplexers, coders and / or decoders, generators and / or parity detectors or comparators.

For example, according to another application of the method according to the invention, the operator to be secured is the mathematical operator of the “multiplication by two” obtained by shifting a bit to the left with the least significant bit set to zero. In C ANSI notation, this operator is also designated (X << 1).

Thus each time the operator is called (X << 1), its execution will be replaced by the execution of a sequence of operations chosen from the following equivalent sequences: S '' 1 = (x ADD x)

S '' 2 = (x AND FOh) ADD x ADD (x AND OFh)

S "3 = (NOT ((NOT x) ADD (NOT x))) SUB 1

S "4 = (y ADD x) SUB (y SUB x), in which the operator ADD is the standard addition operator on one byte, the instruction SUB is the standard subtraction operator on one byte and the suffix "h" indicates a hexadecimal value. In general, the choice of the equivalent sequence S''i and its implementation are carried out in a similar manner, sometimes identical, to what has been described in detail above for the operator XOR.

It will also be noted that without departing from the scope of the invention, the smart card accommodating the electronic module with secure operator according to the invention can be replaced by any other on-board system.

An embodiment of the invention is now presented in its implementation by means of an electronic module. The method for securing a logical or mathematical operator or a similar functional circuit usable in the execution of a program in an electronic module comprising a microprocessor and a memory, is characterized in that the execution of said operator by the microprocessor is replaced by the execution of a sequence of replacement operations resulting in a result identical to the result of the function of said operator, said result being stored in the memory. The electronic module with secure operator and comprising at least a microprocessor and a memory, and the memory storing a program to be executed comprising at least one logical or mathematical operator or a similar functional circuit to be secured, is characterized in that it comprises means to replace the execution of the operator by means of the microprocessor by the execution of a sequence of operations having as final result a result identical to the result of the function of the operator, said result being stored in the memory.

Claims

CLAIMS:

1. Method for securing a logical or mathematical operator or a similar functional circuit usable in the execution of a program in an electronic module (10) with microprocessor, the method being characterized in that the execution of said operator is replaced by the execution of a sequence of replacement operations resulting in a result identical to the result of the function of said operator.

2. Method according to claim 1 characterized in that said sequence of replacement operations is chosen each time said operator is called from a set of equivalent sequences.

3. Method according to claim 2 characterized in that the sequence number in said set of the chosen sequence is determined as a function of certain parameters of the running program and / or of a random parameter obtained from a pseudo-random number generator (24).

4. Method according to claim 2 characterized in that certain sequences comprise at least one non-operative instruction intended to introduce a delay time in the execution of the sequences concerned, said non-operative instruction being chosen from non-operative instructions vis with respect to the microprocessor (11) or among instructions normally operative but rendered ineffective by their positions in the sequence of operations.

5. Method according to claim 2 characterized in that at least one sequence of replacement operations is composed from elementary logical operators.

6. Method according to claim 5 characterized in that at least one sequence of replacement operations is composed from elementary logical operators AND or AND, OR or OR and NOT or NO.

7. Electronic module (10) comprising at least one microprocessor (11) and a program to be executed comprising at least one logical or mathematical operator or a similar functional circuit to be secured, the module being characterized in that it includes means for replacing the execution of said operator by the execution of a sequence of operations having as final result a result identical to the result of the function of said operator.

8. Electronic module (10) according to claim 7 characterized in that it comprises means for selecting said sequence of operations on each call of said operator from a set of equivalent sequences.

9. Electronic module (10) according to claim 8 characterized in that it includes computer processing means for determining the sequence number in said set of the sequence chosen as a function of certain parameters of the program being executed and / or a random parameter generated by a pseudo-random number generator (24).

10. On-board system characterized in that it comprises an electronic module (10) according to claim 7.