JP2001268071A - Anti-tamper encryption device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an anti-tamper encryption device having the enhanced recurity by disenabling the analysis of contents even when fluctuation pattern of operating power of the encryption device is observed. SOLUTION: An encryption arithmetic circuit 1 consists of an FPGA/PLD on an SRAM/flash memory basis. A circuit storage means 3 stores a plurality of configuration data that indicate the same function with different internal operations. A circuit update means 2 reads the configuration data in prescribed timing and writes the data to the encryption arithmetic circuit 1. Since the internal operation differs from each other according to the configuration data, a fluctuation pattern of the operation power differs from each other according to the configuration data. Even when the fluctuation of power consumption is observed, it is difficult to estimate the internal encryption processing so as to enhance the anti-tamper performance.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a tamper-resistant encryption device, and more particularly to a tamper-resistant encryption device capable of dynamically changing the circuit configuration of a cryptographic operation circuit.

[0002]

2. Description of the Related Art A conventional cryptographic circuit has a fixed circuit configuration.
PA (Differential Power Analysis: a cryptographic circuit attack method that obtains secret data by observing fluctuations in power consumption and estimating internal cryptographic processing) can analyze the contents of internal computations. In order to avoid this, the processing is changed by rewriting the program or the microprogram, or the operation is performed by switching a plurality of circuits.

[0003]

However, in the above-mentioned conventional encryption circuit, it takes a long time to rewrite the program and the DP
The attack could not be effectively dealt with, and the encryption process could not be performed at high speed. Further, when a plurality of circuits are used, the circuit scale becomes large, and it is not possible to reduce the size and weight at low cost. As described above, the conventional encryption circuit has a problem that it is not possible to efficiently prevent a DPA attack and enhance security.

An object of the present invention is to solve the above-mentioned conventional problems and to improve security without lowering the performance of a cryptographic circuit.

[0005]

In order to solve the above-mentioned problems, according to the present invention, a tamper-resistant encryption device is provided with a reconfigurable arithmetic circuit and a plurality of configurations having the same function but different internal operations. A circuit data storage means for holding data and a circuit updating means for writing configuration data to the arithmetic circuit are provided. With such a configuration, the internal operation changes even with the same operation, and a DPA attack becomes difficult, so that the security of the encryption circuit can be improved.

[0006]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiments of the present invention will be described below in detail with reference to FIGS.

(First Embodiment) In a first embodiment of the present invention, configuration data of an FPGA / PLD circuit for executing a cryptographic operation can be selectively exchanged from a plurality of candidates of the same function. It is a tamper-resistant encryption device.

FIG. 1 is a functional block diagram of the tamper-resistant encryption device according to the first embodiment of the present invention. In FIG. 1, a cryptographic operation circuit 1 is a circuit configured to perform an encryption operation and a decryption operation, and is configured by a device capable of reconfiguring the circuit. Devices that can reconfigure circuits are not antifuses that can be configured only once, but SRAM / flash memory-based FPGAs / Ps that can be rewritten many times.
LD. For example, Xilinx or Altera products are used. The circuit updating means 2 is means for writing the configuration data into the cryptographic operation circuit. The circuit storage unit 3 is a storage unit that stores configuration data.

The operation of the tamper-resistant encryption device according to the first embodiment of the present invention configured as described above will be described. As the configuration data of the cryptographic operation circuit 1, a plurality of cryptographic circuit configuration data can be selectively exchanged. Although each cryptographic circuit returns the same output result for the same data input, since the internal operation is designed differently, the fluctuation pattern of power consumption during operation is different.

A plurality of configuration data having the same function but different internal operations are prepared in advance.
For example, configuration data in which placement and wiring rules are variously changed such as speed (delay) priority / size priority is prepared. Further, for example, a plurality of configuration data having different arithmetic methods, such as a leftward / rightward binary expansion method in a power-residue calculation, is created. In this way,
Create multiple configuration data for circuits with the same function but different internal operations.

[0011] The plurality of configuration data are stored in the circuit storage device 3. The configuration data to be stocked in the circuit storage device 3 is replaced periodically or as needed.

In response to an arbitrary trigger, the circuit updating means 2
Select one of the configuration data,
Reconfigure. This reconfigured circuit has the same function, but due to differences in circuit wiring delays and arithmetic methods, even when processing the same data,
A difference occurs in the power consumption fluctuation pattern. Therefore, it is possible to prevent the internal operation from being analyzed by observing the power consumption, and the tamper resistance against the DPA attack is improved.

In a cryptographic operation circuit having a configuration in which a known variable can be freely input from the outside to an operation circuit for processing a secret variable such as a secret key, the fluctuation pattern and the secret are observed by observing the power consumption fluctuation pattern. You can know the correlation with the variables. Therefore, such a circuit is likely to be a target of a DPA attack. However, as described above, by updating the arithmetic circuit configuration, the correlation between the arithmetic circuit and the secret variable cannot be observed through fluctuations in power consumption. That is, it is possible to protect not only the operation circuit used for encryption but also a secret variable when performing the encryption operation.

As described above, according to the first embodiment of the present invention, the tamper-resistant encryption device is connected to the FP that executes the cryptographic operation.
Since the configuration data of the GA / PLD circuit can be selectively exchanged from a plurality of candidates of the same function, the tamper resistance against a DPA attack is improved.

(Second Embodiment) A second embodiment of the present invention is a tamper-resistant encryption device that creates configuration data based on circuit specification data.

FIG. 2 is a functional block diagram of a tamper-resistant encryption device according to a second embodiment of the present invention. The basic configuration of the second embodiment is the same as that of the first embodiment. The second embodiment differs from the first embodiment in that a circuit generation unit and a specification storage unit are provided. In FIG. 2, a circuit generating means 4 is means for generating configuration data from circuit specification data. The specification storage means 5 is a memory for holding circuit specification data.

The operation of the tamper-resistant encryption device according to the second embodiment of the present invention configured as described above will be described. Various types of configuration data are created from the same HDL or bit data after logic synthesis through processes such as logic synthesis and placement and routing using various parameters. The parameters used for the logic synthesis and the placement and routing are added to the HDL and the bit data after the logic synthesis, and are called “circuit specification data”.

Circuit specification data such as HDL and data after logic synthesis is stored in the specification storage means 5 in advance. The circuit generation means 4 performs from logic synthesis to configuration data creation according to the circuit specification data read from the specification storage means 5. The created configuration data is stored in the circuit storage unit 3.

Configuration data can be externally input to the circuit storage means 3. Conversely, configuration data may not be provided outside the encryption chip. Instead of holding the circuit specification data in the specification storage means 5, the circuit specification data can be inputted from outside. However, in order to keep the arithmetic circuit used for cryptographic processing secret,
It is better not to have an external input, which has higher tamper resistance.

As described above, in the second embodiment of the present invention, the tamper-resistant encryption device is configured to create the configuration data based on the circuit specification data. Can be generated.

(Third Embodiment) In a third embodiment of the present invention, data in the middle of an operation is saved, configuration data is written in an arithmetic circuit in the middle of the operation, and data in the middle of the operation is restored. It is a tamper-resistant encryption device that continues the operation.

FIG. 3 is a functional block diagram of a tamper-resistant encryption device according to a third embodiment of the present invention. The basic configuration of the third embodiment is the same as that of the second embodiment. The third embodiment is different from the second embodiment in that a save / restore means and an event detection means are provided. In FIG. 3, the save / restore means 6 is a means for saving / restoring data that is being calculated. Event detection means 7
Is a means for detecting various events such as breaks in computation.

The operation of the tamper-resistant encryption device according to the third embodiment of the present invention configured as described above will be described. The event detecting means 7 detects a break in the calculation based on the number of calculation steps and the number of processing bits. The circuit updating means 2 receives the event detection signal and saves the calculation result in the middle of the cryptographic operation circuit 1 to the memory of the saving and restoring means 6. The arithmetic circuit is rewritten by the circuit updating means 2 in the middle of the cryptographic operation, and the cryptographic operation circuit 1 is reconfigured. Thereafter, the data in the middle of the operation is restored from the memory of the save / restore means 6, and the operation is restarted. Since the operation is continued with the same data, only the operation circuit having the same intermediate result can be used.

A specific example of the reconfiguration speed at which the arithmetic circuit is rewritten during the arithmetic operation will be described. In the modular exponentiation arithmetic circuit, the size of the configuration data (HEX file) is 480 KB. Converting this to binary results in about 240KB. It is 1925Kbit in bit conversion. When this is written with 33MHz PCI clock, 1925Kb
it / 33MHz = 58.3msec. Also, when using a high-speed PROM (for example, Xilinx's XC1800 family), up to 500
Because it is Mbit / sec, (1925kbit / 1024) /500×1000=3.76m
sec.

On the other hand, the operation speed is determined by the Xilinx FPGA (XC408
5XL), when the clock is 27 MHz, one exponentiation remainder operation takes 2-3 seconds. Therefore, since the operation time is much longer, there is no possibility that the operation speed is greatly reduced by rewriting the circuit during the operation.

As described above, in the third embodiment of the present invention, the tamper-resistant encryption device saves data in the middle of calculation, writes configuration data in the calculation circuit in the middle of calculation, and stores the data in the middle of calculation. Since the configuration is such that restoration is performed and the calculation is continued, analysis by DPA becomes more difficult.

(Fourth Embodiment) A fourth embodiment of the present invention relates to a tamper-resistant encryption device that writes configuration data to an arithmetic circuit in response to detection of a tamper attack, a timing signal, or power-on. is there.

FIG. 4 is a functional block diagram of a tamper-resistant encryption device according to a fourth embodiment of the present invention. The basic configuration of the fourth embodiment is the same as that of the third embodiment. The fourth embodiment differs from the third embodiment in that a tamper detecting means and a timer are provided.
In FIG. 4, a tamper detecting means 8 is a means for detecting a tamper attack. The timer 9 is a circuit that outputs a periodic timing signal.

The operation of the tamper-resistant cryptographic device according to the fourth embodiment of the present invention configured as described above will be described. As a reconfiguration trigger, an output signal of a timer, a battery replacement detection signal, a power-on detection signal, a tamper detection signal, and the like are used.

When the timer 9 generates a periodic timing signal and the event detecting means 7 detects a break in the operation, a reconfiguration trigger is activated. The timer 9 may generate a random timing signal. Reconfiguration is also performed when the tamper detector 8 detects battery replacement or power-on. This is because a tamper attack often involves turning on the power again.

In particular, the tamper detecting means 8 detects a change in the power supply voltage to detect that a tamper attack has occurred. This is because a tamper attack is often performed by a method in which power supply impedance is increased to make it easier to observe fluctuations in power supply voltage. Conversely, the tamper detection means 8 selects and removes configuration data having a large fluctuation in power supply voltage, and retains only configuration data having a small fluctuation in power supply voltage, thereby improving tamper resistance.

As described above, in the fourth embodiment of the present invention, the tamper-resistant encryption device is configured to write the configuration data into the arithmetic circuit in response to the detection of a tamper attack, a timing signal, or power-on. So, DP
It is almost impossible to observe the same signal at A.

[0033]

As is apparent from the above description, in the present invention, the tamper-resistant encryption device holds a reconfigurable arithmetic circuit and a plurality of configuration data which are functionally the same and have different internal operations. Since the configuration includes circuit data storage means and circuit update means for writing configuration data to the arithmetic circuit, D
An effect is obtained that PA becomes difficult, tamper resistance increases, and security of the encryption circuit improves.

[Brief description of the drawings]

FIG. 1 is a functional block diagram of a tamper-resistant encryption device according to a first embodiment of the present invention;

FIG. 2 is a functional block diagram of a tamper-resistant encryption device according to a second embodiment of the present invention;

FIG. 3 is a functional block diagram of a tamper-resistant encryption device according to a third embodiment of the present invention;

FIG. 4 is a functional block diagram of a tamper-resistant encryption device according to a fourth embodiment of the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Cryptographic operation circuit 2 Circuit updating means 3 Circuit storing means 4 Circuit generating means 5 Specification storing means 6 Evacuation and restoring means 7 Event detecting means 8 Tamper detecting means 9 Timer

Claims (4)

[Claims] 1. A reconfigurable arithmetic circuit, circuit data storage means for storing a plurality of configuration data for configuring a circuit having the same function and different internal operations, and performing the arithmetic operation on the configuration data A tamper-resistant encryption device, comprising: a circuit updating means for writing to a circuit. 2. The tamper-resistant encryption device according to claim 1, further comprising circuit generation means for generating the configuration data based on circuit specification data. 3. The arithmetic circuit is provided with means for saving and restoring intermediate data during the operation, and the circuit updating means is provided with configuration data of a circuit capable of continuing the arithmetic operation with the intermediate data in the arithmetic circuit during the operation. 2. A tamper-resistant encryption device according to claim 1, further comprising means for writing a password. 4. A tamper detecting means for detecting a tamper attack and outputting a tamper detection signal, a timer for outputting a timing signal at regular time intervals or at random, and a timer for outputting the tamper detection signal, the timing signal and the power-on signal. An event detection unit that outputs an event detection signal in accordance with at least one of the circuit units; and the circuit updating unit includes a unit that writes updated circuit data to the arithmetic circuit in response to the event detection signal. The tamper-resistant encryption device according to claim 1.