JP2010068135A - Fraudulent operation detection circuit, apparatus having the same, and fraudulent operation detection method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a fraudulent operation detection circuit capable of highly accurately detecting a fraudulent operation to an apparatus which controls the performance state of an algorithm by a state value and strengthening security, to provide an apparatus having the fraudulent operation detection circuit, and to provide a fraudulent operation detection method. <P>SOLUTION: The fraudulent operation detection circuit 10 includes a change condition rule output means 13 for outputting the change condition rule of the state value, a state value generation means 11 for successively generating the state value on the basis of the change condition rule, a state value storage means 12 for storing the state value, and a state value comparison and determination means 14 for comparing the state values before transition of the state value and after the transition and determining abnormal processing when the transition of the state value is not according to the change condition rule. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an unauthorized operation detection circuit, an apparatus provided with an unauthorized operation detection circuit, and an unauthorized operation detection method, and more particularly, an unauthorized operation for detecting an unauthorized operation on a device that manages an execution state of an algorithm by a state value. The present invention relates to a detection circuit, an apparatus including an unauthorized operation detection circuit, and an unauthorized operation detection method.

  For example, an example of a device that manages the execution state of an algorithm by a state value is a smart card (IC card) equipped with an arbitrary encryption function. Some smart cards equipped with a conventional encryption function use a tamper resistant technique for preventing an attack called a fault attack against a secret key inside a cryptographic processor.

  Encryption methods are roughly classified into common key encryption methods and public key encryption methods. The common key cryptosystem uses the same key (secret key) for encryption and decryption, and keeps the security by making this secret key information unknown to a third party other than the sender and receiver. It is. Public key cryptography is a scheme that uses different keys for encryption and decryption, and instead of publicly disclosing the key for encryption (public key), the key (secret key) for decrypting the ciphertext is used. Security is kept by using confidential information only for the recipient.

  One technology in the field of cryptography is called attack technology. The attack technique is a technique for estimating a secret key from available information such as ciphertext, and there are various techniques. These attack techniques are roughly classified into two types.

  One attack technique is called a theoretical attack, and is an attack method for obtaining a secret key from the relationship between input data and output data of a cryptographic algorithm. This attack method is characterized by success without depending on the implementation form of the cryptographic algorithm to be attacked.

  Another attack technique is called an implementation attack, which can be obtained by applying physical stress to a device that implements a cryptographic algorithm, not just the relationship between input data and output data. This is a technique for estimating a secret key by using information observed from a device other than error information and input / output data. The success or failure of this attack method depends on the implementation form of the cryptographic algorithm.

  Even if a cryptographic algorithm is safe against a theoretical attack, many cases are known to be vulnerable to an implementation attack, and countermeasure technology that realizes the security against the implementation attack is a big issue. The countermeasure technique against the mounting attack is called a tamper-proof technique.

  Implementation attacks are roughly classified into two types: fault attacks and side channel attacks. A fault attack is an output of cryptographic processing when an error occurs intentionally with respect to the internal data value of a cryptographic processor (cryptographic device) circuit installed in a smart card, etc., and normal cryptographic processing. This is a method for estimating a secret key stored in the circuit using difference information from the output result.

  The side channel attack is a method for estimating a secret key using information leaked from a device such as power consumption, electromagnetic waves, and processing time. Among these, the method using power consumption is the most well-known side channel attack and is called a power analysis attack. The power analysis attack can estimate the secret key from the power consumption waveform.

Next, an RSA encryption calculation method will be described. In the RSA cipher decryption process, a process called exponential residue calculation process is performed. The exponent remainder operation is a process of calculating plaintext v by v = a ^d (mod n) for secret key d, ciphertext a, and modulus n. In general, the bit length of the secret key d in RSA encryption is 1024 bits or more. For this reason, when the d-th power operation is executed by a simple method, approximately 2 ¹⁰²⁴ multiplications are required, and it is impossible to calculate within a realistic time.

A binary method is conventionally known as an algorithm for efficiently performing this d-power operation (see, for example, Non-Patent Document 1). By using this binary method, the number of operations required for d-th power is from 2 ¹⁰²⁴ times to a constant multiple of 1024 (this constant is a value of 1.5 or less), and an efficient operation can be realized.

The secret key d is a u-bit value, and its binary representation is expressed as d = (d _u−1 , d _u−2 ,..., D ₀ ) ₂ . Here, d _i represents an individual bit value of d. FIG. 1 is an explanatory diagram showing an algorithm for exponential residue calculation using a binary method. FIG. 2 is an explanatory diagram showing an outline of the binary method processing. In the algorithm of FIG. 1, the bit value d _i of d is checked in the order of i = u−1 to i = 0. If the result of this check is d _i = 1, both two multiplications and multiplications are performed. If the result of the check is d _i = 0, only two multiplications are performed. By repeating this process from i = u−1 to i = 0, the binary method calculates v = a ^d (mod n). That is, the binary method, the value of the key bit d _i, 2 multiplications, execution pattern multiplication, is characterized in that are directly linked.

  A fault attack is an abnormal output that is generated as a result of causing a fault in the data value inside the cryptographic device by applying stress such as overvoltage, abnormal clock, high temperature, laser, etc. to the semiconductor. This is an attack that uses the value to decrypt the secret key stored in the encryption device. FIG. 3 is an explanatory diagram showing an outline of the fault attack.

  In particular, a stress application method using a laser is known as a highly accurate method capable of generating a fault accurately in 1-bit units and generating a fault as intended by an attacker.

  A typical fault attack is described in Non-Patent Document 2, for example. Here, an outline of a fault attack against the RSA cipher will be described.

  The RSA cipher is a cipher that uses a composite number n that satisfies n = p × q for prime numbers p and q. The security of the RSA cipher is based on the assumption that it is difficult to obtain primes p and q from n by prime factorization. However, p and q are large integers of 512-bit or more and n is 1024-bit or more. That is, if the attacker succeeds in obtaining the prime numbers p and q from the composite number n, the RSA cipher can be decrypted.

  The purpose of the fault attack on the RSA cipher is to obtain a prime number p. If the prime number p can be obtained, q can also be easily obtained by division. Therefore, if the attacker can obtain either p or q, the RSA cipher can be deciphered.

  In the fault attack on the RSA cipher, p is deciphered by using two of a normal output value and an abnormal output value when a fault is generated. After obtaining a normal output value, the attacker generates a fault during the execution of the calculation process in the power-residue calculation of (mod q) described later.

As a result, while obtaining a case of normal processing ^{_{m q = c q dq (mod}} q), in the case of fault occurrence calculated value is an abnormal value, obtaining a _q 'm satisfy _q ≠ m _q' for m (If m ' _q is not equal to m _q , the attack succeeds at any value.) As a result of the final calculation using _m'q , the attacker obtains an output m '. The attacker obtains p = GCD (m′−m, n) by calculating GCD (m′−n, n) using the normal output m and the output m ′ when the fault occurs. GCD (a, b) is a function for calculating the greatest common divisor of integers a and b.

The reason for this attack is that the difference between the correct value of m and the value of m 'is an integer multiple of p by calculating m', which will be described later, using an abnormal m ' _q. This is because m′−m = kp, and as a result, CD (m′−m, n) = GCD (kp, pq) = p can be obtained.

Input: c (ciphertext)
dp (secret key satisfying dp = d mod (p-1) for secret key d)
dq (secret key satisfying dq = d mod (q-1) for secret key d)
p (prime number p satisfying n = p × q)
q (prime number q satisfying n = p × q)
u (integer that satisfies u = q ^-1 (mod p))
Output: m (plain text)
Here, e is a public key for encryption, d is a decryption private key, and satisfies ed = 1 mod (p−1) (q−1).

* Normal processing
1.c _p = c mod p, c _q = c mod q
2. Calculate m _p = c _p ^dp (mod p).

3. Calculate m _q = c _q ^dq (mod q).

_{4. m = ((m q -} m p) × u (mod q)) calculate × p + m _p
5. Output m * Processing when a fault occurs
1.c _p = c mod p, c _q = c mod q
^2.m _p = c _p ^dp (mod p)
^{_{3. m q = c q dq (}} mod q) fault occurs during computation, instead m _'q output (m _q' of m _q ≠ m _q)
4.Calculate m = ((m ' _q -m _p ) × u (mod q)) × p + m _p
5. Output m ′ The fault attack described above is an attack in which a prime number p, which is a secret key for decrypting the RSA cipher, is obtained by comparing a normal output value with an output value when the fault occurs. Here, a fault attack that can obtain the secret key d by observing the power waveform at the time of fault occurrence will be described (for example, see Non-Patent Document 3).

FIG. 4 is an explanatory diagram showing an RSA encryption algorithm having tamper resistance to power analysis based on RSA encryption using the binary method. A 4-bit value 1 shown on the left side of FIG. 4 is a value representing an execution state of the RSA encryption algorithm, and is hereinafter referred to as a “state value”. In the RSA encryption algorithm of FIG. 4, (0000) ₂ , (0001) ₂ ,..., (1001) ₂ are state values. The state value is a value used for managing the execution state of the calculation in an apparatus that executes not only the RSA encryption process of FIG. 4 but also all the encryption processes.

The RSA encryption algorithm shown in FIG. 4 has an input ciphertext c, a secret key d = (d _u−1 , d _u−2 ,..., D ₀ ) ₂ and a modulus n, and plaintext m = c ^d (mod This algorithm calculates n) and has a tamper resistance function (tamper resistance) that prevents the secret key d from being leaked by power analysis. Here, the tamper resistance function will be described with reference to FIG.

FIG. 5 is an image diagram showing a power consumption waveform in the case of d = (10100...) ₂ in the apparatus in which the RSA encryption algorithm of FIG. 4 is implemented. _{5, d = (d u-1} , d u-2, ..., d 0) with respect to _2, processes the i = u-1 below, ..., 1,0 Shi Kurikae each This is the waveform when executed.

d _i = 1: After two multiplications indicated by R ₀ = R ₀ × R ₀ , a multiplication indicated by R ₀ = R ₀ × R ₁ is executed.

d _i = 0: A double multiplication represented by R ₀ = R ₀ × R ₀ is executed.

That is, FIG. 5 according to the bit value of d _i, 2 types of multiplication with R ₀ = R ₀ × R ₀ and R ₀ = R ₀ × R ₁ is running. If it can be identified by the power consumption waveform types of these multiplications, it can determine the bit value of d _i, the secret key d can be decoded. However, the above identification is difficult for the RSA encryption algorithm of FIG. This is because R ₀ and R ₁ are always random values that are updated by the initial values given by the random numbers r ₁ and r ₂ as described in the state values (0001) ₂ and (0010) ₂ in FIG. Because.

In other words, the two types of multiplication of R ₀ = R ₀ × R ₀ and R ₀ = R ₀ × R ₁ are both (random number) × (random number) multiplications. As shown in FIG. 5, it is difficult to identify with the power consumption waveform. That is, the power analysis for the RSA encryption algorithm of FIG. 4 is difficult. Thus, the device that executes the RSA encryption algorithm of FIG. 4 is safe for power analysis.

  Conventionally, there is an attack method that can invalidate the resistance to power analysis by performing a fault attack on the RSA encryption algorithm of FIG. 4 (see, for example, Non-Patent Document 3). The basic idea of an attack method that can invalidate the resistance to power analysis by performing a fault attack against the RSA encryption algorithm is to force a partial change of the state value by performing a fault attack, and to perform power analysis. The processing necessary for the countermeasure function is skipped and the countermeasure function is invalidated.

FIG. 6 is an explanatory diagram showing a method for invalidating the power analysis countermeasure function by the fault attack. As shown in FIG. 6, the execution state is basically managed by transition of state values. In normal processing, this state value transitions while increasing one by one as (0000) ₂ → (0001) ₂ → (0010) ₂ → (0011) ₂ . The RSA encryption algorithm is processed according to the order.

In contrast to the processing of the RSA encryption algorithm shown in FIG. 6, the fault attack forcibly changes the value of the state value so that (0000) ₂ → (0010) ₂ → (0011) ₂ . (in the example of FIG. 6 (0001) ₂₎ part of the state value can be forcibly skip. Such highly accurate fault generation can be realized by a stress application method using a laser. In this way, by forcibly skipping the state value (0001) ₂ by a fault attack with respect to the processing of the RSA encryption algorithm of FIG. 6, the process of writing a random number to R ₀ is skipped, so the value of R ₀ The initial value is 0.

In the RSA encryption algorithm of FIG. 4 and FIG. 6, writing random numbers to R ₀ is an important condition for ensuring the tamper resistance function, and the tamper resistance function is invalidated by skipping this process. The result of this skipping, indicating the power consumption waveform when the value of R ₀ becomes 0 in Fig. FIG. 7 is an image diagram showing a power consumption waveform in the case of d = (10100...) ₂ in an apparatus that implements the RSA encryption algorithm with the state value (0001) ₂ skipped in FIG.

In FIG. 7, two types of multiplications R ₀ = R ₀ × R ₀ and R ₀ = R ₀ × R ₁ occur. In the power consumption waveform of FIG. 5, these two types of multiplication are both (random number) × (random number). However, in the power consumption waveform of FIG. 7, since the value of R ₀ is zero due to the occurrence of a fault, the following multiplications are respectively performed.

R ₀ × R ₀ : 0 × 0
R ₀ × R ₁ : 0 × (random number)
That is, R ₀ × R ₀ is a multiplication in which both inputs are zero. R ₀ × R ₁ is multiplication one input is zero. Due to the nature of multiplication, it is known that the power consumption waveform of multiplication with 0 as an input has a special shape. Such a special waveform may further change depending on whether one or two zeros are input. That is, a waveform with one input of 0 and a waveform with two inputs are characteristic. Therefore, as shown in FIG. 7, the multiplication of R ₀ × R _{0 and} the multiplication of R ₀ × R ₁ can be distinguished by the shape of the power consumption waveform. By identifying these power consumption waveforms, the bit value of d can be identified as it is, so that the secret key d can be deciphered as d = (10100 ..) ₂ from the power consumption waveform of FIG.

  The countermeasure technique for preventing the attack method which can invalidate the tolerance with respect to an electric power analysis by performing a fault attack with respect to the RSA encryption algorithm mentioned above conventionally exists (for example, refer patent document 1). This is a countermeasure method based on “fault detection” that checks the internal state of the circuit and detects the occurrence of a fault.

  By using fault detection, even when a fault occurs, it is possible to implement an appropriate defense method such as stopping the processing of the encryption device or stopping data output. Therefore, the fault detection technique is an important technique for countermeasures against faults.

  The basic idea of conventional fall detection is to install an external counter of the state value outside the cryptographic device, and increase this counter each time the state value transitions. By checking periodically whether or not there is a correct transition of the state value, it is checked. In other words, the basic idea of conventional fall detection is to indirectly check whether or not the state value transition is performed correctly using an external counter.

  FIG. 8 is an explanatory diagram showing the fault detection method. In FIG. 8, a unit that realizes individual processing in the apparatus is described as a “controlled section”. One status value corresponds to each controlled section. In order to check the transition of the state value, the fault detection method of FIG. 8 is provided with an external counter ZZ.

  In the first “starting section”, the counter ZZ is initialized to ZZ = 0. The value of ZZ increases by 1 for each controlled section completed (ZZ = ZZ + 1). Since it consists of N controlled sections, if the execution path that executes all N controlled sections without conditional branching is executed normally without skipping a state due to a fault attack, the value of the counter ZZ is N It is expected that

  Also, even if not all controlled sections are executed due to conditional branching, the number of controlled sections that were not executed due to conditional branching is added to ZZ, so when executed normally without skipping a state due to a fault attack, The value of counter ZZ is expected to be N.

  For example, when the conditional branch is performed after the process of the controlled section 1 is completed, the remaining N−1 controlled sections are not executed. In this case, N−1 is added to ZZ at the time of conditional branching. The same applies to conditional branches at the end of other controlled sections.

As a result, the final value of the counter ZZ is expected to be N when the execution is normally performed without skipping the state due to the fault attack in all execution paths. That is, in the fault detection method of FIG. 8, it is possible to detect whether or not a fault has occurred by finally checking whether or not the value of the counter ZZ is N. This detection process is performed in the “Fault detection: ZZ = N?” Process corresponding to the last state sm _{+ 1} . If the value of ZZ is N, it is determined that the fault detection method of FIG. 8 is a normal process in which no fault is generated. If the value of ZZ is other than N, it is determined that a fault has occurred.

For example, as shown in “Execution path 4” of the program in FIG. 8, if “controlled section 1” is skipped due to a fault attack, one processing of ZZ = ZZ + 1 is skipped. Since the final value of ZZ in the detection process is ZZ = N−1, which is not the originally expected value of N, it can be detected that a fault has occurred.
JP 2005-509936 A Alfred J. Menezes et al. "HANDBOOK OF APPLIED CRYPTOGRAPHY" (CRC press), page 615, algorithm 14.79 (http://www.cacr.math.uwaterloo.ca/hac/about/chap14.pdf) D. Boneh, RA DeMillo, RJ Lipton, "On the Importance of Checking Cryptographic Protocols for Faults", Eurocrypt'97, pp.37-51, 1997. (Benoit Feix and Louis Marcel, "Passive and Active Combined Attacks", 2007 Workshop on Fault Diagnosis and Tolerance in Cryptography, FDTC 2007)

  A fault attack can be detected by using the known technique of FIG. However, although this fault detection method can detect a basic fault attack, there is a problem that the fault detection function is invalidated when a more advanced fault attack is performed. In the following, problems of the conventional fault detection method will be described.

  FIG. 9 is an explanatory diagram showing basic problems of the fault detection method. As described above, in the conventional fault detection method, an external counter of the state value is added outside the encryption device, and the presence or absence of the fault is detected by checking the consistency of the counter value. Due to this basic mechanism, the conventional fault detection method has the following three properties (P1) to (P3).

      (P1) The conventional fault detection method requires two mechanisms, a mechanism for increasing the counter and a mechanism for checking the counter, as the mechanism for detecting the fault, and the fault detection is successful only after the counter is checked. That is, in the conventional fault detection method, the timing at which fault detection is possible is limited.

      (P2) In the conventional fault detection method, fault detection cannot be executed in other states because fault detection is executed for the first time while the counter is being checked.

      (P3) The conventional fault detection method cannot execute fault detection for all state transitions.

Due to the property shown in (P3), the conventional fault detection method cannot perform fault detection for advanced fault attacks. As shown in FIG. 9, the state where fault detection is possible is only the last “Fault detection: ZZ = N?”, That is, the state sm _{+ 1} . In other states, fault detection cannot be performed. Therefore, the conventional fault detection method has a problem that the real-time property of the fault detection is lost. Due to this problem, the conventional fault detection method is invalidated against a fault attack in which the fault detection mechanism is advanced.

  Further, as described above, the conventional fault detection method is divided into a state where the fault can be detected and a state where it cannot be detected because the fault detection does not have real-time characteristics. Considering the property of being divided into two states, that is, a state where fault detection is possible and a state where it is impossible, a mechanism for invalidating fault detection is as shown in FIG.

FIG. 10 is an explanatory diagram showing a fault attack that invalidates fault detection. An attacker able to skip the state s ₁ to generate a fault, to perform the skip in order to obtain the secret key. However, in this state, the consistency of the counter ZZ is lost and the occurrence of a fault is detected. Therefore, in order to avoid this, the fault attack of FIG. 10 avoids the detection of the fault occurrence by skipping the state sm _{+ 1} that is the fault detection state again.

  Therefore, the fault attack of FIG. 10 performs the advanced fault attack that generates two faults, a skip that is generated to obtain a secret key and a skip that is used to avoid fault detection. Can be disabled. That is, the conventional fault detection method is effective for a fault in which the fault generation shown in FIG. 8 is performed once, but is ineffective in a fault attack in which the fault generation shown in FIG. 10 is performed twice.

  As described above, since the conventional fault detection method has no real-time fault detection, it is effective for a fault attack that generates a fault once, but is ineffective for a fault attack that generates a fault twice.

  One embodiment of the present invention has been made in view of the above points. An unauthorized operation detection circuit capable of highly accurately detecting an unauthorized operation on an apparatus that manages an execution state of an algorithm by a state value and enhancing security. An object of the present invention is to provide an apparatus including an unauthorized operation detection circuit and an unauthorized operation detection method.

  In order to solve the above-described problem, an embodiment of the present invention is an unauthorized operation detection circuit that detects an unauthorized operation to a device that manages the execution state of an algorithm by a state value, and the condition value change condition in normal processing A change condition rule output means for outputting a rule, a state value generation means for sequentially generating the state values based on the change condition rule output from the change condition rule output means, and the state value generation means generated by the state value generation means Compare the state value storage means for storing the state value with the state value stored in the state value storage means as the state value before transition, and the state value generated by the state value generation means as the state value after transition And a state value comparison / determination unit that determines that the process is abnormal if the transition of the state value does not conform to the change condition rule output from the change condition rule output unit. That.

  In addition, what applied the component, the expression, or arbitrary combinations of the component of one Embodiment of this invention to a method, an apparatus, a system, a computer program, a recording medium, a data structure, etc. is also effective as an aspect of this invention. .

  As described above, according to an embodiment of the present invention, an unauthorized operation detection circuit and an unauthorized operation detection that can detect an unauthorized operation on a device that manages the execution state of an algorithm based on a state value with high accuracy and can enhance security. An apparatus including a circuit and an unauthorized operation detection method can be provided.

  Next, the best mode for carrying out the present invention will be described based on the following embodiments with reference to the drawings. In this embodiment, a smart card (IC card) equipped with an arbitrary encryption function will be described as an example of an apparatus that manages the execution state of an algorithm based on a state value. Good.

  First, the cause of the problem of the conventional fault detection method is that the fault detection does not have real-time characteristics. Therefore, the conventional fault detection method is that the fault detection can be invalidated by skipping the fault detection state itself. In addition, the reason that conventional fault detection does not have real-time characteristics is that fault detection cannot be performed for all state transitions.

  In this embodiment, in order to solve the above-described problem in the conventional fault detection method, a means for performing fault detection for all state transitions is provided. The problem of the conventional fault detection method was that the state value transition and the fault detection counter were separate, so it was not possible to directly detect the occurrence of the fault of the state value, and the real-time property of the fault detection was lost. It seems that there is.

  In order to solve this problem, in this embodiment, state value transition and fault detection are integrated. By integrating state value transitions and fault detection, this embodiment enables fault detection for all state transitions and provides means for ensuring real-time fault detection.

  Here, the basic idea of the present embodiment will be described. FIG. 11 is an explanatory diagram showing transition of a conventional state value that is vulnerable to a fault attack. FIG. 12 is an explanatory diagram showing the transition of state values in this embodiment.

Since the fault detection method shown in FIG. 11 does not place restrictions on the change of the state value, the state value can be changed from an arbitrary value to an arbitrary value. Therefore, even when a state value transition that is not possible such as (0000) ₂ → (0010) ₂ occurs, the conventional fault detection method cannot detect the occurrence of the fault.

On the other hand, the fault detection method of this embodiment shown in FIG. 12 always provides a certain constraint condition for the transition of normal state values. FIG. 12 is an example in which a constraint condition that the bit value of the state value always changes only 1-bit by normal state value transition is provided. Therefore, if a transition of a 2-bit state value that does not satisfy the constraint condition (0000) ₂ → (0011) ₂ occurs, the fault detection method of this embodiment can detect the fault occurrence.

  FIG. 13 is an explanatory diagram illustrating a conventional state value transition and a state value transition according to the present embodiment in a normal case where no fault occurs. The upper part of FIG. 13 represents a conventional state value transition. The lower part of FIG. 13 shows the transition of the state value of this embodiment.

  As shown in the upper part of FIG. 13, the transition of the conventional state value increases by +1 when there is no branch, and decreases by the number of returned states when there is a branch. That is, since the law of state value transition in a normal case without a fault is not constant, it is difficult to determine whether the state value transition is normal or abnormal by a simple method.

  On the other hand, as shown in the lower part of FIG. 13, the transition of the state value of this embodiment has a common rule that the state value always changes by 1-bit value regardless of the presence or absence of branching. Therefore, if it is a state transition according to this rule, it can be determined as a normal transition without a fault, and if it is a state transition not following this rule, it can be determined as an abnormal transition with a fault. Therefore, the fault detection method of this embodiment performs fault detection by using a simple inspection circuit (check function circuit) that states whether the transition of the state value is always a 1-bit value change or not. Can do.

  FIG. 14 is a block diagram of an example of a fault detection circuit according to this embodiment. The fault detection circuit 10 in FIG. 14 is used as a state machine, for example. The fault detection circuit 10 in FIG. 14 includes a state value generation circuit 11, a state value register 12, a change condition rule circuit 13, and a state value comparison circuit 14.

  The state value generation circuit 11 determines the state value after the transition. The state value register 12 stores the current state value. The change condition rule circuit 13 determines a change condition rule for state values in normal processing without a fault attack. The state value comparison circuit 14 determines whether or not the state value transition is normal.

  The state value generation circuit 11 and the state value register 12 are commonly used circuits. The change condition rule circuit 13 and the state value comparison circuit 14 are check function circuits. The output of the state value register 12 represents the current state value. The input of the state value register 12 represents the next state value.

  That is, by comparing the input and output of the state value register 12, it is possible to compare the state values before and after the transition. The change condition rule circuit 13 and the state value comparison circuit 14 operate as a fault detection check function circuit by comparing the state values before and after the transition. The state value comparison circuit 14 compares the input and output of the state value register 12 to detect whether or not a fault has occurred.

  Whether or not a fault has occurred is detected by the state value comparison circuit 14 based on whether or not the relationship between the input and output of the state value register 12 is in accordance with the change condition rule given by the change condition rule circuit 13. When the relationship between the input and output of the state value register 12 is in accordance with the change condition rule given by the change condition rule circuit 13, the state value comparison circuit 14 determines that the process is normal with no fault occurrence, and follows the change condition rule. If not, it is determined that the fault is an abnormal process.

  When the change condition rule given by the change condition rule circuit 13 is “1-bit value change”, the fault detection circuit shown in the lower part of FIG. 12 or FIG. 13 is obtained. If it is determined that the process is an abnormal process in which a fault has occurred, the state value comparison circuit 14 notifies an external circuit (for example, a CPU) that the fault has been detected by a fault detection output.

  Here, a configuration of a conventional fault detection circuit is shown in FIG. 15 for comparison of circuits necessary for realizing the fault detection function. FIG. 15 is a block diagram of an example of a conventional fault detection circuit. The fault detection circuit of FIG. 15 includes a state value generation circuit 21, a state value register 22, a fault detection counter control circuit 23, a fault detection counter 24, and a fault detection counter check circuit 25. The state value generation circuit 21 determines the state value after the transition. The state value register 22 stores the current state value.

  The state value generation circuit 21 and the state value register 22 are commonly used circuits. The fault detection counter control circuit 23 and the fault detection counter 24 are counter function circuits. The fault detection counter check circuit 25 is a check function circuit.

  When the state value transition is determined by the state value generation circuit 21, the fault detection counter control circuit 23 operates the value of the fault detection counter 24. The value of the fault detection counter 24 corresponds to the value of the counter ZZ in FIGS.

  Similarly to the counter ZZ in FIGS. 8 to 10, the fault detection counter control circuit 23 performs various operations on the fault detection counter 24 according to the presence / absence of the branch of the state value and the branch timing. The fault detection counter control circuit 23 determines the operation of the fault detection counter 24 according to the transition of the state value.

  The fault detection counter check circuit 25 performs fault detection. The fault detection counter check circuit 25 checks whether the value of the fault detection counter 24 is the expected value after the operation of the fault detection counter control circuit 23 by the fault detection counter control circuit 23 is repeated several times. By checking, it is determined whether or not a fault has occurred.

  Note that the processing of the fault detection counter check circuit 25 for checking whether the value of the fault detection counter 24 is the expected value or not is whether or not ZZ = N for the counter ZZ in FIGS. This corresponds to the process of making a determination.

  If the value of the fault detection counter 24 is a normal value as expected, the fault detection counter check circuit 25 determines that the process is normal without occurrence of a fault. If the value is not normal as expected, the fault is detected. Judged as abnormal processing that occurred. When it is determined that a fault has occurred, the fault detection counter check circuit 25 notifies an external circuit that the occurrence of the fault has been detected by a fault detection output.

  The conventional fault detection circuit does not integrate state value transition and fault detection, but indirectly detects the fault. Therefore, the counter function circuit that counts the state value transition and the count value of the state value transition are Both a check function circuit and a check function circuit that check whether the value is as expected are required.

  On the other hand, since the fault detection circuit 10 of the present invention integrates state value transition and fault detection, as shown in FIG. 14, only the check function circuit may be added. A fault detection function with a small circuit can be realized.

  The fault detection circuit 10 of FIG. 14 can be further improved in security by adding improvements. Here, the improvement which improves the security of the fault detection circuit 10 of FIG. 14 is demonstrated. FIG. 16 is an explanatory diagram showing skipping of state values that cannot be detected by the fault detection circuit of FIG.

The fault detection circuit 10 of FIG. 14 represents an example of state value transition when the change condition rule is “1-bit value change”. Cryptographic device implementing the RSA encryption algorithm shown in FIG. 6 as the skip state value in order to obtain the secret key, it can detect the fault occurrence be performed _{(0000) 2 → (0011)} 2 ... fault attack So it is safe. However, the fault detection circuit 10 of FIG. 14 cannot detect skipping of some state values. This is because the fault detection circuit 10 in FIG. 14 does not determine that a fault has occurred if the state value transitions within the range of the change condition rule (constraint condition).

Figure 16 is changed condition rule for an example of "1-bit value change", the state value is changed by 1-bit value _{(0000) 2 → (0010)} 2 and _{(0000) 2 → (0100)} 2 of This means that a fault attack cannot be detected. As described above, the fault detection circuit 10 of this embodiment has a fault detection omission that cannot be detected with respect to the skipping of some state values. Even if this fault detection omission is present, the cryptographic apparatus in which the RSA cryptographic algorithm shown in FIG. 6 is implemented can prevent the secret key from being decrypted by the fault attack.

In order to obtain a secret key from an encryption device that implements the RSA encryption algorithm shown in FIG. 6, the random number write to R ₀ is skipped, but the random number write to R ₁ is not skipped. is necessary. Because R ₀ × R ₀ , R ₀ × R ₁ both become 0 × 0 by skipping random number writing of both R ₀ and R ₁ , these are completely the same operation, and the power consumption waveform This is because it becomes impossible to identify by means of. In other words, the skip of the state value for obtaining the secret key for the device in which the RSA encryption algorithm shown in FIG. 6 is implemented is limited to (0000) ₂ → (0011) ₂ .

  Therefore, the fault detection circuit 10 of this embodiment shown in FIG. 14 has a fault detection omission, but when applied to an encryption device that implements the RSA encryption algorithm shown in FIG. 6, the secret key is decrypted even if the fault occurs successfully. It is safe because you can't.

  Therefore, the fault detection circuit 10 of the present embodiment investigates a known attack method (Known Attack) at the stage of developing a cryptographic device, covers in advance the skip patterns of state values that can decrypt the secret key, and this By verifying the possibility of leakage of the secret key related to such fault detection leakage, it is possible to construct a state value transition in which the secret key cannot be decrypted.

  For a known attack method (Known Attack), the use of the fault detection circuit 10 of this embodiment shown in FIG. 14 can prevent the secret key from being decrypted by the fault attack. However, the fault detection failure of the fault detection circuit 10 of this embodiment shown in FIG. 14 can realize protection against a known attack method, but leaves a possibility that the secret key can be decrypted against an unknown attack method (Unknown Attack). .

For example, in the example shown in FIG. 16, (0000) ₂ → (0010) ₂ and (0000) ₂ → (0100) ₂ can be skipped. If the attack technique evolves in the future, these skips are used. This is because there is still a possibility of successful decryption of the secret key. Therefore, the fault detection circuit 10 of FIG. 14 is improved so that not only a known attack but also an unknown attack that may occur in the future can be realized.

  FIG. 17 is an explanatory diagram showing a solution to the fault detection omission that the fault detection circuit of this embodiment shown in FIG. 14 has. The upper part of FIG. 17 represents an example of transition of state values when the change condition rule is “1-bit value change” in the fault detection circuit 10 of the present embodiment shown in FIG. The lower part of FIG. 17 represents a transition example of state values when the change condition rule is “3-bit value change” in the fault detection circuit 10 of the present embodiment shown in FIG.

In both the upper and lower stages of FIG. 17, (0000) ₂ → (0011) ₂ (upper stage) or (0000) is used as a skip of the state value for obtaining the secret key from the encryption device that implements the algorithm shown in FIG. ) ₂ → (1010) _{2 If} you try to perform a fault attack (bottom), it is safe because the fault can be detected.

  However, the fault detection circuit 10 of FIG. 14 is not a complete method that can detect all skips of state values, and cannot detect skips of some state values. This is because the fault detection circuit 10 shown in FIG. 14 does not determine that a fault has occurred if the state value transitions within the range of the constraint condition.

For example, in the upper part of FIG. 17, since the skip of (0000) ₂ → (0010) ₂ and (0000) ₂ → (0100) ₂ is a 1-bit value change, the occurrence of a fault cannot be detected. In the lower part of FIG. 17, the occurrence of a fault cannot be detected because (0000) ₂ → (1110) ₂ is skipped and (0000) ₂ → (1011) ₂ is a 3-bit value change.

  As described above, the method of the present embodiment shown in FIG. 14 can skip a part of state value transitions, and the state value of a fixed pattern is changed according to the state value change condition rule as shown in FIG. Skipping is possible.

For example, in the upper part of FIG. 17, (0000) ₂ → (0010) ₂ and (0000) ₂ → (0100) ₂ , that is, two patterns can be skipped. Similarly, two patterns (0000) ₂ → (1110) ₂ and (0000) ₂ → (1011) ₂ can be skipped in the lower part of FIG.

  In other words, it is understood that the skipping of the state value that was possible in the change condition rule for one state value is impossible in the change condition rule for the other state value. Therefore, by preparing a plurality of state value change condition rules and selecting which change condition rule to use based on a random number generated inside the fault detection circuit 10, the fault detection circuit 10 is a state value that causes fault detection omission. This makes it possible for an attacker to identify the skip pattern and improve safety.

  FIG. 18 is a configuration diagram of another example of the fault detection circuit according to this embodiment. The fault detection circuit 10A shown in FIG. 18 has a configuration including state value generation circuits 11A to 11C, a state value register 12, change condition rule circuits 13A to 13C, a state value comparison circuit 14, a selector 15, and a selector 16.

  The state value generation circuits 11A to 11C determine the state value after the transition. The state value register 12 stores the current state value. The change condition rule circuits 13A to 13C determine a change condition rule for state values in normal processing without a fault attack. The state value comparison circuit 14 determines whether or not the state value transition is normal. The selector 15 inputs any one of the outputs of the state value generation circuits 11A to 11C to the state value register 12 and the state value comparison circuit 14 based on the random number. Further, the selector 16 inputs any one of the outputs of the change condition rule circuits 13A to 13C to the state value comparison circuit 14 based on the random number.

  The selector 15 and the selector 16 work together based on random numbers, and when the output of the state value generation circuit 11A is selected, the output of the change condition rule circuit 13A is selected, and when the output of the state value generation circuit 11B is selected, the change condition When the output of the rule circuit 13B is selected and the output of the state value generation circuit 11C is selected, the output of the change condition rule circuit 13C is selected.

  The state value comparison circuit 14 compares the input and output of the state value register 12 to detect whether or not a fault has occurred. Whether the state value comparison circuit 14 detects the occurrence of a fault depends on whether the relationship between the input and the output of the state value register 12 is in accordance with a change condition rule given by any one of the change condition rule circuits 13A to 13C. Done.

  The state value comparison circuit 14 generates a fault when the relationship between the input and output of the state value register 12 is in accordance with a change condition rule given by any one of the change condition rule circuits 13A to 13C via the selector 16. It is determined that there is no normal process, and if the change condition rule is not followed, it is determined that the process is an abnormal process in which a fault has occurred.

  The process of selecting any one of the outputs of the state value generation circuits 11A to 11C by the selector 15 and the process of selecting any one of the outputs of the change condition rule circuits 13A to 13C by the selector 16 are faults. This is executed as an initialization process of the first cycle in which the detection circuit 10A operates.

  In the fault detection circuit 10A of FIG. 18, the change condition rule given by the change condition rule circuit 13A is “1-bit value change”, and the change condition rule given by the change condition rule circuit 13B is “2-bit value change”. In this example, the change condition rule given by the change condition rule circuit 13C is “3-bit value change”. Further, in the fault detection circuit 10A of FIG. 18, the state value generation circuit 11A determines the state value after the transition based on the change condition rule “1-bit value change”, and the state value generation circuit 11B has the change condition rule “2”. The state value after transition is determined based on “-bit value change”, and the state value generation circuit 11C determines the state value after transition based on the change condition rule “3-bit value change”.

  Compared with the fault detection circuit 10 of FIG. 14, the fault detection circuit 10A includes a random number input, three state value generation circuits 11A to 11C, three change condition rule circuits 13A to 13C, a selector 15, and a selector 16. However, by selecting one change condition rule from among three random numbers, the fault detection failure probability “1” in the fault circuit 10 of FIG. 14 can be reduced to “1/3”. .

  The probability of fault detection omission being “1/3” means that the probability of fault detection is “1” to “1/3”. In general, an encryption device equipped with a fault detection circuit is suitable so that an attacker cannot perform a fault attack again by a secret key data erasure process, an encryption device usage stop process, etc., once fault detection has succeeded. Take corrective action.

  Therefore, the attacker cannot decrypt the secret key by repeatedly trying the fault attack many times. The fault detection circuit 10A of FIG. 18 can protect a known attack with a probability “1”, and can also protect against an unknown attack with a probability “1” − “1/3”. This probability can be closer to “1” as the number of change condition rules is increased, and is more secure. In the fault detection circuit 10A of FIG. 18, three examples of change condition rules are shown, but other numerical values may be used as long as they are plural.

  The characteristics of the circuit without fault detection, the conventional fault detection circuit, the fault detection circuit 10 of FIG. 14, and the fault detection circuit of FIG. 18 are as shown in FIG. FIG. 19 is a comparative diagram comparing the features of a circuit without fault detection, a conventional fault detection circuit, the fault detection circuit 10 of FIG. 14, and the fault detection circuit 10A of FIG.

  The fault detection circuit 10 shown in FIG. 14 of this embodiment and the fault detection circuit 10A shown in FIG. 18 have the merit that they have the real-time property of fault detection that the conventional fault detection circuit does not have.

  Further, the fault detection circuit 10 shown in FIG. 14 of the present embodiment and the fault detection circuit 10A shown in FIG. 18 perform the fault generation once for a known attack, and both the two-time execution methods. Thus, leakage of the secret key can be prevented. Further, the fault detection circuit 10A shown in FIG. 18 of the present embodiment can prevent the secret key from leaking even when an attack technique evolves in the future and an unknown attack is discovered.

  Also, the conventional fault detection circuit needs both a counter function and a check function in order to realize fault detection. On the other hand, the fault detection circuit 10 shown in FIG. 14 of this embodiment and the fault detection circuit 10A shown in FIG. 18 can realize fault detection only by the check function.

  FIG. 20 is a block diagram of an example of a smart card chip equipped with fault attack countermeasure hardware. The smart card chip 100 includes a CPU 101, a ROM 102, a communication circuit 103, an external interface 104, fault attack countermeasure hardware 105, a RAM 106, a clock generation circuit 107, and a power supply circuit 108.

  In FIG. 20, fault attack countermeasure hardware 105 corresponds to the fault detection circuit 10 or 10A of the present embodiment. When detecting the occurrence of a fault as described above, the fault attack countermeasure hardware 105 outputs a fault detection signal (interrupt signal) to the CPU 101 via the bus. When the CPU 101 receives the fault detection signal, the CPU 101 executes appropriate countermeasures such that the attacker cannot make a fault attack again by the secret key data erasure processing, the encryption device use stop processing, and the like.

  The fault detection circuit 10 or 10A according to the present embodiment is a countermeasure technique for preventing a secret key from being estimated by a fault attack on an arbitrary encryption algorithm such as an RSA encryption algorithm or an AES encryption algorithm. By applying the fault detection circuit 10 or 10A of the present embodiment, the cryptographic device can have high tamper resistance.

  FIG. 21 is an explanatory diagram showing an example of application of the present embodiment to the common key cryptosystem. A typical common key encryption algorithm is published by Advanced Encryption Standard (AES) as Federal Information Standards (FIPS) FIPS 197 (reference: http://csrc.nist.gov/publications/fips/ fips197 / fips-197.pdf).

  FIG. 21 shows the transition of state values when the fault detection circuit 10 shown in FIG. 14 is used for the AES encryption processing described in FIG. 5 on page 15 of this document. In FIG. 21, 13 state values are expressed in 4-bit. The state value change condition rule is a 1-bit value change. As long as the transition is normal, the state value always changes 1-bit.

  The state value comparison circuit 14 of the fault detection circuit 10 of the present embodiment compares values before and after the transition of the state value, and determines that no fault has occurred if the 1-bit value changes, and otherwise If it is a change, it is determined that a fault has occurred.

  FIG. 22 is an explanatory diagram of another example showing the application of this embodiment to the common key cryptosystem. In FIG. 22, two or more condition value change condition rules are required. In FIG. 22, “1-bit value change” is used as the first change condition rule, and “3-bit value change” is used as the second change condition rule. As an initialization process before executing the common key encryption algorithm of FIG. 22, the fault detection circuit 10A of the present embodiment selects the first change condition rule or the second change condition rule by a random number.

  The state value comparison circuit 14 of the fault detection circuit 10A of the present embodiment compares the state value before and after the transition according to the selected first or second change condition rule. When the first change condition rule is selected, the state value comparison circuit 14 of the fault detection circuit 10A determines that no fault has occurred if the 1-bit value changes, and if the change is not the case, the fault is detected. It is determined that it has occurred.

  When the second change condition rule is selected, the state value comparison circuit 14 of the fault detection circuit 10A determines that no fault has occurred if the 3-bit value is changed, and if the change is other than that, the fault is detected. It is determined that it has occurred.

  FIG. 23 is an explanatory diagram showing an example of application of this embodiment to the public key cryptosystem. An RSA encryption method is known as a typical public key encryption algorithm. The RSA cipher is a public key cipher that performs processing by repeating a modular multiplication operation.

The RSA cipher uses Montgomery to calculate REDC (A, B, N) = A × B × R ^-1 (mod N) for integers A, B, and modulus N as a method for efficiently executing the modular multiplication. A method called modular multiplication is generally known. Here, R is a constant with respect to the bit length x of N, is given by R = 2 ^x.

  Various methods are known for processing Montgomery modular multiplication, one of which is literature: Kouichi Itoh, Masahiko Takenaka, Naoya Torii, Syouji Temma, and Yasushi Kurihara, "Fast Implementation of Public-Key Cryptography on a The method of DSP TMS320C6201 ", CHES '99, LNCS 1717, pages 61-72 is known.

  FIG. 23 shows transition of state values when the fault detection circuit 10 shown in FIG. 14 is used for the Montgomery multiplication remainder described in page 65 and Algorithm 4 of this document. In FIG. 23, a numerical value of 1024-bit or more used in RSA encryption is expressed by arranging g variables in w-bit units. w is generally a value smaller than 1024, such as w = 16, 32, 64. By repeating w-bit partial multiplication, a modular multiplication operation of 1024-bit or more is performed.

  In FIG. 23, 17 state values are expressed by 5-bits. The state value change condition rule is a 1-bit value change. As long as any state transition is a normal transition, the state value always changes 1-bit. The state value comparison circuit 14 of the fault detection circuit 10 of the present embodiment compares values before and after the transition of the state value, and determines that no fault has occurred if the 1-bit value changes, and otherwise If it is a change, it is determined that a fault has occurred.

  Examples 1 and 2 are examples of the common key cryptosystem, and the pattern of conditional branching is a simple loop of a for statement and a very simple structure. On the other hand, in the embodiment of the public key cryptosystem shown in FIG. 23, the pattern of conditional branching is more complicated, and a double loop based on a for statement and a conditional branch based on an if statement are combined. As the conditional branch pattern becomes complicated, it becomes more difficult to construct a state value transition pattern.

To solve the difficulty, the auxiliary means but is required, the insertion of which is one "NOP" state conditional branch 23 ((11001) ₂ - (10001) ₂ of state values ). “NOP” indicates a state in which no processing is performed. “NOP” is a redundant process because it does not perform any process, but is an auxiliary means that can be used to construct a transition pattern under the restriction of the transition condition of the state value.

  FIG. 24 is an explanatory diagram showing an example in which “NOP” insertion is necessary when the transition condition of the state value is a 1-bit value change. When the change condition rule of the state value is 1-bit value change, as shown in FIG. 22, when the following processing is performed using the state values A, B, and C, a NOP is set between the state values B and C. Need to be inserted.

A if (cond) then {
B treatment 1}
C treatment 2
When the change condition rule is a 1-bit value change, it is considered that the state value A → B → C is changed. If the number of '1' included in state value A is expressed as k, the number of '1' in state value B will either increase or decrease by one due to the restrictions of the state change rule. 1 or k + 1. Similarly, when the state value B transits to the state value C, the number of “1” is k−2, k, or k + 2.

  As described above, when the change condition rule is a 1-bit value change, the transition of the state value A → B → C can be realized. However, when the A → C transition is performed, the number of “1” is changed from k to k−2, k, k + 2. In other words, when the transition from A to C is performed, regardless of the value of k, the state value only changes 2-bit value or 0-bit value, and realizes 1-bit value change. Can not. In order to solve this problem, when the change condition rule is a 1-bit value change, the following processing in which NOP is inserted between the state values B and C is performed.

A if (cond) then {
B Treatment 1
C NOP}
D Processing 2
When NOP is inserted between state values B and C, and the change condition rule is 1-bit value change, state value C changes to D in the transition of state value A → B → C → D The number of '1's at the time of transition can be set to k-1 or k + 1. At this time, the transition of the state value A → D is a 1-bit value change. That is, both the transition of the state value A → B → C → D and the transition of the state value A → D can be realized under the restriction of 1-bit value change. Here, auxiliary means that can be used to construct a transition pattern of state values including insertion of NOP are listed below.

-Insertion of NOP FIG. 24 shows an example of conditional branching, but it can also be applied to loop branching.

-Increasing the bit length of the state value By expanding the bit length of the state value, the degree of freedom of selection of the state value is widened, and the construction of the transition pattern of the state value becomes easy. For example, when 15 state values are given, the minimum bit length for expressing it is 4-bit. By expressing 15 state values with a bit length larger than 4-bit, It is easy to construct a transition pattern of state values.

・ Creation of templates Pre-calculate templates for constructing state values according to basic flow control types such as single loop, double loop, conditional branch, etc. Build the value. By creating various templates according to the number of states in the loop and the number of states of conditional branches, it is possible to handle various processes.

  FIG. 25 is an explanatory diagram of another example showing application of this embodiment to the public key cryptosystem. In FIG. 25, two or more condition value change condition rules are required. In FIG. 25, “1-bit value change” is used as the first change condition rule, and “3-bit value change” is used as the second change condition rule. As an initialization process before executing the public key encryption algorithm of FIG. 25, the fault detection circuit 10A of the present embodiment selects the first change condition rule or the second change condition rule by a random number.

  The state value comparison circuit 14 of the fault detection circuit 10A of the present embodiment compares the state value before and after the transition according to the selected first or second change condition rule. When the first change condition rule is selected, the state value comparison circuit 14 of the fault detection circuit 10A determines that no fault has occurred if the 1-bit value changes, and if the change is not the case, the fault is detected. It is determined that it has occurred.

  When the second change condition rule is selected, the state value comparison circuit 14 of the fault detection circuit 10A determines that no fault has occurred if the 3-bit value is changed, and if the change is other than that, the fault is detected. It is determined that it has occurred.

(effect)
The effect of the present embodiment is as shown in the comparison diagram of FIG. The present embodiment has a real-time property of fault detection that the conventional fault detection circuit does not have. For known attacks, it is possible to prevent leakage of the secret key for both the method of executing the fault occurrence once and the method of executing the fault twice. Even if an attack technique evolves in the future and an unknown attack is discovered, the fault detection circuit 10A of FIG. 18 can prevent leakage of the secret key.

  Also, the conventional fault detection circuit needs both a counter function and a check function in order to realize fault detection. On the other hand, the fault detection circuit 10 shown in FIG. 14 of this embodiment and the fault detection circuit 10A shown in FIG. 18 can realize fault detection only by the check function.

The present invention may have the following configurations as described below.
(Appendix 1)
An unauthorized operation detection circuit that detects an unauthorized operation on a device that manages an execution state of an algorithm by a state value,
Change condition rule output means for outputting a change condition rule of state values in normal processing;
State value generation means for sequentially generating the state values based on the change condition rules output from the change condition rule output means;
State value storage means for storing the state value generated by the state value generation means;
The state value stored in the state value storage means is compared as the state value before transition, the state value generated by the state value generation means is compared as the state value after transition, and the transition of the state value is the change condition. An unauthorized operation detection circuit comprising: a state value comparison determination unit that determines that the process is abnormal if the change condition rule output from the rule output unit is not followed.
(Appendix 2)
The unauthorized operation detection circuit according to appendix 1, wherein the change condition rule output means outputs one change condition rule from a plurality of types of change condition rules of state values in normal processing.
(Appendix 3)
The change condition rule output means outputs the number of bits to be changed between the state value before the transition and the state value after the transition as the change condition rule of the state value in normal processing. circuit.
(Appendix 4)
The change condition rule output means is a bit to be changed between the state value before transition and the state value after transition for each of the plurality of types of change condition rules as a plurality of types of change condition rules of the state value in normal processing. The unauthorized operation detection circuit according to appendix 2, which outputs a different number.
(Appendix 5)
A device including an unauthorized operation detection circuit that detects an unauthorized operation to a device that manages an execution state of an algorithm by a state value,
Change condition rule output means for outputting a change condition rule of state values in normal processing;
State value generation means for sequentially generating the state values based on the change condition rules output from the change condition rule output means;
State value storage means for storing the state value generated by the state value generation means;
The state value stored in the state value storage means is compared as the state value before transition, the state value generated by the state value generation means is compared as the state value after transition, and the transition of the state value is the change condition. An apparatus having state value comparison and determination means for determining that the process is abnormal if the change condition rule output from the rule output means is not followed.
(Appendix 6)
An unauthorized operation detection method of an unauthorized operation detection circuit that detects an unauthorized operation on a device that manages an execution state of an algorithm by a state value,
A change condition rule output means for outputting a change condition rule for a state value in normal processing;
A state value generating unit that sequentially generates the state value based on the change condition rule output from the change condition rule output unit;
A state value storing means for storing the state value generated by the state value generating means;
The state value comparison / determination unit compares the state value stored in the state value storage unit as the state value before the transition, and compares the state value generated by the state value generation unit as the state value after the transition. A fraudulent operation detection method comprising: a state value comparison determination step that determines that the value transition is an abnormal process if it does not conform to the change condition rule output from the change condition rule output means.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

It is explanatory drawing which shows the algorithm of the exponent remainder operation using the binary method. It is explanatory drawing which shows the process outline | summary of a binary method. It is explanatory drawing which shows the outline | summary of a fault attack. It is explanatory drawing which shows the RSA encryption algorithm which has the tamper resistance to the power analysis based on the RSA encryption using a binary method. FIG. 5 is an image diagram showing a power consumption waveform in a case where d = (10100...) ₂ in the apparatus in which the RSA encryption algorithm of FIG. 4 is implemented. It is explanatory drawing showing the method of invalidating the countermeasure function of the power analysis by fault attack. FIG. 7 is an image diagram showing a power consumption waveform in the case of d = (10100...) ₂ in an apparatus that implements the RSA encryption algorithm that skips state value (0001) ₂ in FIG. It is explanatory drawing showing the fault detection method. It is explanatory drawing showing the basic problem of the fault detection method. It is explanatory drawing showing the fault attack which invalidates fault detection. It is explanatory drawing showing the transition of the conventional state value vulnerable to a fault attack. It is explanatory drawing showing the transition of the state value of a present Example. It is explanatory drawing showing the transition of the conventional state value in the case of normal without a fault occurrence, and the transition of the state value of a present Example. It is a block diagram of an example of the fault detection circuit by a present Example. It is a block diagram of an example of the conventional fault detection circuit. It is explanatory drawing showing the skip of the state value which cannot be detected by the fault detection circuit of FIG. It is explanatory drawing showing the solution method of the fault detection omission which the fault detection circuit of a present Example shown in FIG. 14 has. It is a block diagram of the other example of the fault detection circuit by a present Example. FIG. 19 is a comparison diagram comparing features of a circuit without fault detection, a conventional fault detection circuit, the fault detection circuit 10 of FIG. 14, and the fault detection circuit 10 </ b> A of FIG. 18. It is a block diagram of an example of the smart card chip which mounts fault attack countermeasure hardware. It is explanatory drawing of an example showing application of the present Example to a common key encryption system. It is explanatory drawing of the other example showing application of the present Example to a common key encryption system. It is explanatory drawing of an example showing application of the present Example to a public key encryption system. FIG. 10 is an explanatory diagram showing an example in which this “NOP” insertion is necessary when the transition condition of the state value is a 1-bit value change. It is explanatory drawing of the other example showing application of the present Example to a public key encryption system.

Explanation of symbols

1 4-bit value (status value)
10, 10A Fault detection circuit 11, 11A to 11C, 21 State value generation circuit 12, 22 State value register 13, 13A to 13C Change condition rule circuit 14 State value comparison circuit 15, 16 Selector 23 Fault detection counter control circuit 24 Fault Counter for detection 25 Counter check circuit for fault detection 100 Smart card chip 101 CPU
102 ROM
103 Communication Circuit 104 External Interface 105 Fault Attack Countermeasure Hardware 106 RAM
107 clock generation circuit 108 power supply circuit

Claims (6)

An unauthorized operation detection circuit that detects an unauthorized operation on a device that manages an execution state of an algorithm by a state value,
Change condition rule output means for outputting a change condition rule of state values in normal processing;
State value generation means for sequentially generating the state values based on the change condition rules output from the change condition rule output means;
State value storage means for storing the state value generated by the state value generation means;
The state value stored in the state value storage means is compared as the state value before transition, the state value generated by the state value generation means is compared as the state value after transition, and the transition of the state value is the change condition. An unauthorized operation detection circuit comprising: a state value comparison determination unit that determines that the process is abnormal if the change condition rule output from the rule output unit is not followed.   2. The unauthorized operation detection circuit according to claim 1, wherein the change condition rule output means outputs one change condition rule from a plurality of types of change condition rules of state values in normal processing.   The unauthorized operation according to claim 1 or 2, wherein the change condition rule output means outputs the number of bits to be changed between the state value before the transition and the state value after the transition as a state value change condition rule in normal processing. Detection circuit.   The change condition rule output means is a bit that should be changed between the state value before transition and the state value after transition for each of the plurality of types of change condition rules as a plurality of types of change condition rules of state values in normal processing. The unauthorized operation detection circuit according to claim 2, wherein the number is different and output. A device including an unauthorized operation detection circuit that detects an unauthorized operation to a device that manages an execution state of an algorithm by a state value,
Change condition rule output means for outputting a change condition rule of state values in normal processing;
State value generation means for sequentially generating the state values based on the change condition rules output from the change condition rule output means;
State value storage means for storing the state value generated by the state value generation means;
The state value stored in the state value storage means is compared as the state value before transition, the state value generated by the state value generation means is compared as the state value after transition, and the transition of the state value is the change condition. An apparatus having state value comparison and determination means for determining that the process is abnormal if the change condition rule output from the rule output means is not followed. An unauthorized operation detection method of an unauthorized operation detection circuit that detects an unauthorized operation on a device that manages an execution state of an algorithm by a state value,
A change condition rule output means for outputting a change condition rule for a state value in normal processing;
A state value generating unit that sequentially generates the state value based on the change condition rule output from the change condition rule output unit;
A state value storing means for storing the state value generated by the state value generating means;
The state value comparison / determination unit compares the state value stored in the state value storage unit as the state value before the transition, and compares the state value generated by the state value generation unit as the state value after the transition. A fraudulent operation detection method comprising: a state value comparison determination step that determines that the value transition is an abnormal process if it does not conform to the change condition rule output from the change condition rule output means.

Images