EP2212824A2

EP2212824A2 - Verification of data read in memory

Info

Publication number: EP2212824A2
Application number: EP08857341A
Authority: EP
Inventors: Fabrice Romain; Jean-Louis Modave
Original assignee: Proton World International NV; STMicroelectronics SA
Current assignee: Proton World International NV; STMicroelectronics SA
Priority date: 2007-11-19
Filing date: 2008-11-18
Publication date: 2010-08-04
Also published as: WO2009071791A2; US8775697B2; US20100325320A1; FR2923923A1; WO2009071791A3; FR2923923B1

Abstract

The invention relates to a method and a circuit for verifying data transferred between a circuit (21) and a processing unit (11), in which: the data originating from the circuit travels through a first temporary storage element (23) having a size representing an integer multiple of the size of data liable to be presented subsequently on a bus (27) of the processing unit; an address provided by the processing unit (11) destined for the circuit is stored temporarily in a second element (22); and the content of the first element is compared with a current data item (CDATA) originating from the circuit, at least when said data item corresponds to an address of a data item already present in this first element.

Description

CHECKING DATA IN MEMORY

Field of the invention

The present invention generally relates to electronic circuits and, more particularly, circuits containing a digital data processing unit capable of processing data contained in one or more memories internal or external to the circuit.

The present invention applies more particularly to the verification of the integrity (of the absence of modification) of information transferred between a memory and a processing unit.

Presentation of the prior art

In many applications, it is desirable to ensure that data transferred between a memory and a processing unit are not modified either during their transfer on the communication buses, or during their temporary storage between their source memory and the processing unit. Such modifications can be accidental or voluntary. A voluntary modification comes, for example, from a so-called fault injection attack which consists in introducing a disturbance in the operation of the electronic circuit

(for example by intervening on its power supply) so as to modify the states of the data on the transfer buses or in memories. Such fault injections can, for example, modify the progress of a program, modify data accessed by this program, etc. and may lead to, for example, accepting false authentication, introducing a parasitic program (virus), hacking a key or cryptographic algorithm, etc.

To counter such attacks are known hardware solutions of physically detect the mea ^¬ proval of origin (light, heat, in POWER SUPPLY current, etc.) or make redundant calculations. These hardware solutions are expensive at the surface of the integrated circuit.

There are also known software solutions which consist, for example, in verifying that the program has gone through certain steps, in repeatedly reading data successively and comparing them to each other. All these solutions have a cost in performance and in particular in speed of execution of the program.

An accidental modification of the program flow may come from a noisy environment (for example, a microcontroller in an industrial environment or in a vehicle) and result in undesirable malfunctions. Summary of the invention

The present invention aims to overcome all or part of the disadvantages of known data integrity control solutions read in a circuit external to a processing unit, whether or not integrated with this unit.

An object is more particularly a solution applicable to a memory integrated in the same circuit as the processing unit. Another object is more particularly an effective solution against fault injection attacks.

Another object is not to degrade the performance of the circuit because of the verification performed.

Another object is a transparent solution for the program running on the processing unit. To achieve all or part of these and other objects, there is provided a method of verifying data transferred between a circuit and a processing unit, wherein: the data from the circuit passes through a first temporary storage element having a size multiple of the size of data that can then be presented on a bus of the processing unit; an address provided by the processing unit for the circuit is stored temporarily in a second element; and the content of the first element is compared with current data from the circuit, at least when it corresponds to an address of data already present in this first element.

According to an embodiment of the present invention, all the data presented on the bus of the processing unit and contained in the first element are compared with the current data extracted from the peripheral element from the stored address. in the second element.

According to an embodiment of the present inven ^¬, when a current address is presented by the processing unit, it is compared with the address contained in the second element and, in case of identity between the two addresses, the data contained in the first element is supplied to the bus of the processing unit.

According to an embodiment of the present invention, if there is no identity between the address provided by the processing unit and that contained in the second element, the current address is stored in the second element and the content of the first element is replaced by the data provided by the circuit according to the current address, in parallel with the provision of a part of this data to the processing unit. There is also provided a method for detecting a fault injection in an electronic circuit, in which data transferred between a memory and a processing unit of the circuit are verified by the implementation of the verification method, an absence of identity between the contents of the first element and the current data triggering an exception processing.

There is also provided an electronic circuit including at least one processing unit, and having an interface circuit between address and data buses of the processing unit and address and data buses for at least one data processing unit. a peripheral circuit to this unit, said interface circuit comprising: at least a first temporary storage element having a size multiple to that of data transiting on the data bus of the processing unit; a second storage element temporarily storing an address provided by the processing unit to the peripheral circuit; and means for carrying out the verification process of data transferred between the peripheral circuit and the processing unit.

According to one embodiment of the present invention, the peripheral circuit is a memory. Brief description of the drawings

These and other objects, features, and advantages will be set forth in detail in the following non-limiting description of particular embodiments in connection with the accompanying figures in which: FIG. 1 shows a chip card of the type to which the present invention applies by way of example; FIG. 2 is a block diagram of an exemplary electronic circuit architecture of the type to which the present invention applies by way of example; Fig. 3 is a functional block diagram of an embodiment of an interface between a processing unit and a memory; and FIG. 4 is a flowchart illustrating an embodiment of a method for verifying the integrity of the read data.

The same elements have been designated by the same references to the different figures. Detailed Description For the sake of clarity, only the steps and elements that are useful for understanding the invention have been shown and will be described. In particular, the main functions of the processing units and programs processed by these units have not been exposed, the invention being compatible with any electronic circuit provided with a processing unit. Similarly, the nature of the verified data has not been detailed, the invention being again compatible with any data, whether instructions (operating codes, operands or arguments) or variables. Furthermore the invention will be more particularly described with reference to an example of application to the protection of data against possible attacks by injec ^¬ faults in a circuit integrating the processing unit and memories in which are read the data, but it applies more generally to any accidental malfunction. In particular, for an operation of a microcontroller in a noisy environment, the invention is also of interest if the memories are external to the circuit integrating the processing unit.

FIG. 1 very schematically shows a smart card 1 of the type to which the present invention applies by way of example. Such a card is for example constituted by a support 2 made of plastic in which is reported a chip 10 of electronic circuit capable of communicating with the outside by means of contacts 3 or at least elements (not shown) d transmission / reception without contact. The circuit 10 of the card contains a processing unit capable of executing programs stored in memories generally contained in the circuit 10 or in other circuits carried by the card. FIG. 2 is a block diagram of an embodiment of an electronic circuit 10. This circuit comprises a central processing unit 11 (CPU) capable of executing programs contained in one or more memories. In this example, the circuit 10 includes a non-volatile non-programmable memory 12 (ROM), a non-volatile reprogrammable memory 13 (EEPROM) and a random access memory 14 (RAM). One or more data, address and control buses 15 serve as a communication medium between the various components of the circuit 10 and with an input / output interface 16 (I / O) for communication with or without contact with the device. outside. Most often, the circuit 10 has other functions (block 17, FCT) depending on the application. This is, for example, dedicated cryptographic computing cells for implementing encryption and decryption algorithms. In the embodiment shown in FIG. 2, the circuit 10 further comprises a circuit 20 (CHECK) interface between the central unit and the memories to check the absence of modification of the data between several readings in the memory. In the example shown, the circuit 20 is interposed between the bus 15 and the unit 11 so that it verifies the data read in all the memories. As a variant, this treatment may concern only a part of the memories.

FIG. 3 is a functional block diagram of an embodiment of an interface 20 for controlling the data transferred between a memory 21 (MEM) and the processing unit 11 (CPU). The memory 21 is for example one of the memories 12, 13 or 14 of the circuit 10 of Figure 2. More generally, the memory 21 may be constituted by any data storage circuit, integrated or not with the processing unit (for example, a buffer of a peripheral circuit integrated in the processing unit, a mass memory external to the circuit integrating the processing unit, etc.).

The circuit 20 includes a storage element 22

(ADD BUFF) temporary storage of the addresses provided by the processing unit 11. The element 22 taken, for example, under the control of a block 221 of switches, an address on an address bus 26 of the unit 11. A selector 222 is interposed between this bus 26 and an address bus input 151 of the memory 21. The circuit 20 also includes an element 23 (DATA BUFF) for temporary storage of the data extracted from the data bus. 21. This element 23 samples, for example under the control of a block 231 of switches, the data presented at the output 212 of the data bus 152 of the memory 21. As an alternative to the switches 221 and 231, the same function of loading on control of the addresses and data in the respective elements 22 and 23 (for example registers) can be obtained by masking or not the clock fronts which control the copying of the bits in flip-flops forming the elements 22 and 23. According to this mode of realization, the el 23 has a size corresponding to the size of the data in the memory and to twice the size of the data used by the processing unit 11. In other words, the memory reading granulaπte 21 (the size of its words) is twice as large as the size of the data bus 27 of the processing unit 11.

For example, the element 23 is a 16-bit register for an 8-bit processing unit or a 32-bit register for a 16-bit unit, and so on. As a result, the data bus 152 between the memory 21 and the circuit 20 is double compared to the data bus 27 between the processing unit 11 and the circuit 20. A first selector 232 receives the bus 152 and selects one half of the data. data. A second selector 233 receives the output of the selector 232 and the output of a third selector 234 separating the content of the element 23 in two. The selector 233 provides a data word (half memory word) on the bus 27. Preferably, the elements 22 and 23 are physically located as close as possible to the ports 111 and 112 of the unit 21 to the buses 26 and 27.

The circuit 20 further comprises two comparators 24 and 25 (COMP), respectively the address provided by the processing unit with respect to the address contained in the element 22, and the data present on the bus 152 by to that contained in Element 23.

A state machine 28 (SM) controls the selectors 222, 232, 233 and 234 according to the result provided by the comparator 24, as well as the blocks 221, 231, thus the writing in the registers 22 and 23. Comparator 25 provides a result to, for example, unit 11 or another element of the system to enable it to take any appropriate action when a change in data is detected.

Functionally, the verification of the data by the comparator 25 is performed following a reading in the element 23 by comparing all of the content of the element 23 to that present on the bus 152. It takes advantage of the fact that in most cases, the words read in a single cycle in the memories are larger than the words that can be introduced per cycle in the processing unit. This makes it possible, in particular, to perform the verification of the data in the background in the memory interface 20.

It also takes advantage of the fact that, in most cases, the loading of the data (programs, constants, variables, etc.) between a memory and a processing unit takes place on consecutive addresses. Consequently, the second part of the data checked in the plan contains in most cases, in the second part, that which the treatment unit actually requests at the next cycle.

Figure 4 illustrates an embodiment of the verification process in the form of a flowchart. This flowchart corresponds to the processing performed by the circuit 20 of FIG.

The registers 22 and 23 are initialized (block 31, INIT), for example, during an activation of the circuit 20, or during a reset of the processing unit 11. The initialization consists in emptying (address 0) the address register 22 or to store there an arbitrary address, and to place, in the data register 23, the data contained in the memory at the address carried by the register 22. Thereafter, whenever the the processing unit calls (block 32, CADD) a datum in the memory 21 by supplying an address on its bus 111, the verification process is carried out hereinafter.

We begin (block 33, CADD = ADD BUFF?) By comparing the contents of the address register 22 with the current address CADD provided by the processing unit 11. In case of identity between the two addresses (output Y of block 33), this means that the corresponding data item is already present in the data register 23. For example, this is the case when it is the second called byte of a 16 bit word read in the memory. that the previous step performed by the processing unit consis ^¬ was to read the first byte of this 16-bit word. The corresponding byte P (DATA BUFF) of the register 23 is then supplied (block 34) on the bus 27 to the processing unit as data DATA.

In the same cycle, the contents of the data register 23 are compared with the current data presented by the memory 21 on the bus 152 (block 35, DATA BUFF = MEM (ADD BUFF)?) Following the address provided by the register This comparison makes it possible to verify that the data which was supplied to the processing unit 11 and which was present in the register 23 during a preceding reading cycle was not modified compared to the current cycle. It is therefore an integrity check of the data extracted from the memory 21 and a check of absence of disturbance by injection of fault. In case of inconsistency between the two data (output N of block 35), this triggers an exception processing FAIL. Such a treatment consists, for example, in a blocking of the electronic circuit 10 or in any other countermeasures adapted to fault injection. In case of validated integrity of the data

(Y output of block 35), the process continues normally and, from the point of view of the interface 20, it means to wait for a new CADD address (block 32) called by the processing unit 11. In the case where the current address is not identical to that contained in the register 22 (output N of the block 33), this means that it is necessary to reload data in the register 23. The contents of the address register 22 is then replaced by the current CADD address provided by the processing unit (block 36, ADD BUFF = CADD). Then, the contents of the data register 23 are loaded by the current data provided by the memory 21 (DATA BUFF = CDATA). In parallel, the memory interface provides the processing unit 11 with one of the two words extracted from the memory 21 (block 38, DATA = P (CDATA)). For the implementation of the above embodiments, a temporary storage element 23 is used, the size of which corresponds to twice the size of the data bus of the processing unit concerned. Any other factor representing an integer multiple of the bus size may be provided. One advantage is that the operation of the interface is transparent for the program executed by the unit 11 and does not take time on its execution.

Another advantage is that the described mechanism is particularly effective against fault injection attacks.

Another advantage is that the hardware cost of the implementation is only a few additional logical elements in the memory interface.

The fact that the data is provided to the processing unit despite the verification (blocks 34 and 38 in parallel with verification 35) is in practice not troublesome. Indeed, even if the error is detected only a few cycles after the data has been used by the processing unit, the unit has in practice not had the time to endanger the security of the system.

Particular embodiments of the present invention have been described. Various variations and modifications will be apparent to those skilled in the art. In particular, the practical implementation of the invention is within the abilities of those skilled in the art from the functional indications given above, in particular with regard to the synchronization of exchanges between the processing unit 11 and the interface 20 and the interpretation, by the processing unit 11, of the comparisons made. Furthermore, although the invention has been described in relation to a memory integrated in the electronic circuit, it more generally applies to a verification of data presented at the input of a processing unit, that these data come from a memory or any other circuit (for example any device) to the extent that these data are then, even in this device, usually contained in a memory.

Moreover, the addresses provided by the unit 11 will undergo various conversions (for example, virtual address into a physical address) without this modifies the operation, provided that the two compared addresses (compa ^¬ tor block 24 or 33) both are taken before or after conversion. Similarly, the data may undergo various treatments between the memory 21 and the unit 11 (e.g., decryption) provided that the two compared data ^(¬ compa rator 25 or block 35) are mutually consistent.

Claims

A method of verifying data transferred between a circuit (21) and a processing unit (11), characterized in that: the data from the circuit passes through a first temporary storage element (23) having a size representing a multiple Suspected whole of the data size to be ^¬ patible then presented on a bus (27) of the processing unit; an address supplied by the processing unit (11) to the circuit is stored temporarily in a second element (22); and the content of the first element is compared with a current data (CDATA) from the circuit, at least when it corresponds to an address of a datum already present in this first element.

2. Method according to claim 1, in which all the data presented on the bus (27) of the processing unit (11) and contained in the first element (23) are compared with the current data (CDATA) extracted from the peripheral element from the address stored in the second element.

The method according to claim 1 or 2, wherein when a current address (ADD) is presented by the processing unit (11), it is compared with the address contained in the second element (22) and, in case of identity between the two addresses, the data contained in the first element (23) is supplied to the bus (27) of the processing unit.

4. The method according to claim 3, wherein in case of absence of identity between the address provided by the processing unit (11) and that contained in the second element (22), the current address is stored in the second element and the content of the first element (23) is replaced by the data provided by the circuit (21) according to the current address, in parallel to providing some of this data to the processing unit.

5. Method for detecting a fault injection in an electronic circuit (10), characterized in that data transferred between a memory (21) and a processing unit (11) of the circuit are verified by the implementation of the Method according to any one of claims 1 to 4, a lack of identity between the content of the first element (23) and the current data (CDATA) triggering an exception processing.

An electronic circuit (10) including at least one processing unit (11), characterized in that it comprises an interface circuit (20) between data (27) and data bus (27) of the processing unit and address (151) and data buses (152) for at least one circuit (21) peripheral to that unit, said interface circuit comprising: at least a first temporary storage element (23); ) having a size representing an integer multiple of data passing over the data bus of the processing unit; a second temporary storage element (22) for storing an address provided by the processing unit to the peripheral circuit; and means for carrying out the method according to any one of claims 1 to 4.

7. Circuit according to claim 6, wherein the peripheral circuit (21) is a memory (12, 13, 14).