JP2018169694A - Security device having tamper resistance against failure utilization attack - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a security device which is configured such that a memory position where a computer program for conducting a secret operation is mounted is changed every time the secret operation is conducted.SOLUTION: A security device 1 includes: a nonvolatile memory (ROM122) which stores a secret operation module executable code 100 for conducting a secret operation; and a secret operation control unit 101 which determines at random a memory position for arranging the secret operation module executable code 100 among the memory allowing read and write of data, when call of the secret operation module executable code 100 is received from superordinate software 11, loads the secret operation module executable code 100 stored in the nonvolatile memory to the memory position, then executes the secret operation module executable code 100 loaded to the memory position, and transfers the execution result of the secret operation module executable code 100 loaded to the memory position to the superordinate software 11.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a security device in which a secret operation module that performs a secret operation processing using secret data, such as cryptographic operation using an encryption key, and more particularly, to improve the tamper resistance of the secret operation module against a failure use attack. Regarding technology.

  A security device that performs a secret calculation process, which is a calculation process that uses secret data that is kept secret outside, such as a cryptographic operation using a secret key, stores secret data used in the secret calculation process, such as a cryptographic key used in the cryptographic calculation, in a secret manner. To do. Normally, the secret data stored in the security device cannot be read from the outside, but various attack methods have been proposed for illegally reading the secret data stored in the security device.

  As described in Non-Patent Document 1, an attack method for illegally reading out secret data stored in a security device includes a destructive attack that requires destruction of an IC chip (Integrated Circuit) mounted on the security device, and security. It can be classified as a non-destructive attack that does not require the destruction of the IC chip mounted on the device. Furthermore, the non-destructive attack includes a side channel attack that observes the side channel of the security device that can be observed from the outside, and an intentional error. It can be classified as a failure-use attack that occurs during cryptographic operations. The side channel attack is one of the important threats to the security device, but the present invention targets a failure use attack that is one of non-destructive attacks.

  A failure-use attack, which is one of the non-destructive attacks, is an operation that applies an external stimulus, which is not possible, to the security device that is performing the confidential calculation process, causing an intentional calculation error in the security device. This is an attack method that attempts to read stored secret data illegally. External stimuli that are not usually possible include pulsed power supply noise, clock signals whose frequency is not rated, electromagnetic waves, and laser irradiation.

  As a countermeasure against a failure-use attack that is one of non-destructive attacks, Patent Document 1 describes that it is recommended to perform two or more calculations of the same process or to verify the process by back calculation. In the invention according to the present invention, when the verification is performed by performing the reverse operation of the cryptographic operation, which is one of the typical secret operations, the encryption key finally used in the reverse operation of the cryptographic operation is the encryption key used first in the initial operation. Verify whether it matches.

Japanese Patent No. 5483838

“Survey and Research on“ Security Evaluation of System LSI ”for FY2003 Security Evaluation Technology”, March 31, 2004, Electronic Commerce Safety Technology Research Association

  However, even if the above measures are implemented, a memory location where a computer program that performs a secret operation such as a cryptographic operation is identified and a laser beam or the like is irradiated to the identified memory location. If triggered once, it is possible to estimate secret data (for example, encryption key) used for the secret calculation.

  Therefore, an object of the present invention is to provide a security device configured such that a memory location where an executable code of a module that performs a secret operation such as a cryptographic operation is arranged is changed for each secret operation.

  The present invention that solves the above-described problems includes a non-volatile memory that stores an executable code of a secret calculation module that performs a secret calculation process using secret data, and a high-level software that provides a user with a security function. When a call to the executable code is received, a memory location in which the executable code of the secret calculation module is arranged is randomly determined from the data readable / writable memory, and the secret calculation module stored in the nonvolatile memory is stored. After the executable code is loaded into the memory location, the executable code of the secret computation module loaded into the memory location is executed, and the execution result of the executable code of the secret computation module loaded into the memory location is It is equipped with a secret calculation control unit that is handed over to software. It is a security device that.

  Furthermore, the second invention is characterized in that, in the security device described in the first invention, the secret operation processing performed by the secret operation module is an encryption operation processing using an encryption key as the secret data.

  Furthermore, a third invention is the security device according to the first or second invention, wherein a check code is added to an executable code of the secret operation module stored in a nonvolatile memory, and the secret operation control unit Check the check code calculated from the executable code of the secret operation module loaded in the memory location and the check code added to the executable code of the secret operation module stored in the non-volatile memory, If the verification fails, an error code is delivered to the upper software.

  According to the security device of the present invention, the secret operation control unit of the security device performs the secret operation processing using the secret data in order to randomly determine the memory location where the executable code of the secret operation module is loaded. The memory location of the executable code is different every time the secret calculation process is performed. If the memory location of the executable code of the cipher operation module is different for each cipher operation, the attacker cannot perform a failure use attack that specifies the memory location of the cipher operation module. Can be prevented from leaking outside.

The figure explaining the structure of a security device. The figure explaining the hardware with which a security device is provided. The figure explaining operation | movement of a secrecy calculation control part. The figure explaining the memory state of a security device. The figure explaining the form of a security device.

  From here, preferred embodiments of the present invention will be described. The following description is not intended to limit the technical scope of the present invention, but is provided to aid understanding.

  FIG. 1 is a diagram illustrating the configuration of the security device 1 according to the present embodiment. The security device 1 according to the present embodiment includes hardware 12, an operating system 10 (OS: Operating System), and upper software 11 in order from the lower layer.

  FIG. 2 is a diagram illustrating the hardware 12 included in the security device 1 according to the present embodiment. As illustrated in FIG. 2, the security device 1 according to this embodiment includes, as hardware 12, an I / O 125 that inputs and outputs data, a CPU 120 (Central Processing Unit) that performs various operations, and an electrically rewritable device. In addition to RAM 121 (Random Access Memory), which is a volatile memory, ROM 122 (Read-Only Memory), which is an electrically rewritable nonvolatile memory, and NVM 123 (Non-volatile memory), which is an electrically rewritable nonvolatile memory As a coprocessor, a cryptographic operation circuit 124 specialized for the cryptographic operation function is provided.

  The host software 11 provided in the security device 1 according to the present embodiment is a computer program for providing a user with a security function using a secret calculation process using secret data, and specifically, is an application or middleware. The security function provided to the user by the upper software 11 may be arbitrary. For example, message encryption / decryption, digital signature generation / authentication, and user authentication can be considered as security functions using cryptographic operations. In the present embodiment, the upper software 11 is mounted on a nonvolatile memory (here, ROM 122 or NVM 123) included in the security device 1.

  The OS 10 included in the security device 1 according to the present embodiment is software that controls execution of a computer program inside the security device 1. In this embodiment, the OS 10 provides a secret calculation module executable code 100 that performs a secret calculation process using secret data, and a secret that provides a function for the upper software 11 to use the secret calculation module executable code 100. In this embodiment, the OS 10 is mounted on a ROM 122 that is one of nonvolatile memories included in the security device 1.

  The executable code 100 of the secret operation module means a code that can be interpreted and executed by the CPU 120. In this embodiment, the OS 10 is mounted on the ROM 122, and therefore the executable code 100 of the secret operation module included in the OS 10 is also a security. The check code is added to the executable code 100 of the secret operation module, which is mounted on the ROM 122 which is one of the nonvolatile memories of the device 1. Note that the executable code 100 of the secret operation module can be mounted not on the ROM 122 but on the NVM 123.

  The contents of the secret calculation process performed by the executable code 100 of the secret calculation module may be arbitrary, but in this embodiment, the executable code 100 of the secret calculation module uses the cryptographic calculation circuit 124 to perform a cryptographic operation according to a predetermined algorithm. Execute the process. Examples of encryption algorithms include DES (Data Encryption Standard), AES (Advanced Encryption Standard), and public key encryption.

  The secret calculation control unit 101 included in the OS 10 is a function realized by a computer program that operates the CPU 120, and provides an API (Application Programming Interface) for using the executable code 100 of the secret calculation module to the upper software 11. When the call of the executable code 100 of the secret operation module is received from the upper software 11, the executable code 100 of the secret operation module is executed so that the tamper resistance against the failure use attack is enhanced.

  FIG. 3 is a diagram for explaining the operation of the confidential calculation control unit 101 according to the present embodiment. When the API provided by the secret operation control unit 101 according to the present embodiment is used to receive a call to the executable code 100 of the secret operation module 100 from the upper software 11 (S1), the secret operation control unit 101 A process of randomly determining a memory position for loading the executable code 100 of the secret operation module from the data readable / writable memory of the device 1 is performed (S2). As described with reference to FIG. 2, the security device 1 according to the present embodiment includes the RAM 121 and the NVM 123 as data readable / writable memories. Therefore, the secret calculation control unit 101 according to the present embodiment includes a secret calculation module. One of the RAM 121 and the NVM 123 is randomly determined as a memory for loading the executable code 100, and a size corresponding to the executable code 100 of the secret operation module is selected from the randomly determined memory free area. By determining the region at random, the memory location for loading the executable code 100 of the secret operation module is determined at random. Note that random numbers are generally used when determining memory randomly.

  Next, the secret calculation control unit 101 according to the present embodiment executes a process of loading the secret calculation module executable code 100 (not including the check code) into the memory location determined in S2 (S3). In this embodiment, since the executable code 100 of the secret operation module is stored in the ROM 122, the executable code 100 of the secret operation module stored in the ROM 122 is loaded into the memory location determined in S2. Become.

  Next, the secret calculation control unit 101 according to the present embodiment executes a process of executing the executable code 100 of the secret calculation module loaded in the memory location determined in S2 (S4). For example, the cipher operation control unit 101 executes the executable code 100 of the cipher operation module loaded in the memory location determined in S2 by calling the head address of the memory location determined in S2.

  When the execution of the executable code 100 of the secret operation module loaded in the memory location determined in S2 is completed, the secret operation control unit 101 according to the present embodiment can execute the secret operation module loaded in the memory location determined in S2. The check code calculated from the code 100 and the check code added to the executable code 100 of the secret calculation module stored in the non-volatile memory (in this case, the ROM 122) are collated to actually perform the cryptographic calculation. A process of verifying the validity of the executable code 100 of the secret operation module, that is, the validity of the executable code 100 of the secret operation module loaded in the memory location determined in S2 is executed (S5). By verifying the validity of the executable code 100 of the secret operation module loaded in the memory location determined in S2, the contents of the executable code 100 of the secret operation module loaded in the memory location determined in S2 due to the failure use attack It can be determined whether or not there has been a change. If the validity verification fails, the error code is delivered to the upper software 11 so that the cryptographic operation result is not delivered to the attacker even if a failure use attack is performed. Although the check code may be arbitrary, for example, when the check code is a checksum, the executable code 100 of the secret calculation module is regarded as a data string, and the sum of each column is used to determine the executable code 100 of the secret calculation module. A checksum can be calculated.

  The secret calculation control unit 101 according to the present embodiment branches the process based on the validity verification result of the executable code 100 of the secret calculation module (S6). When the validity verification of the executable code 100 of the secret calculation module is successful, the secret calculation control unit 101 matches the executable code 100 of the secret calculation module loaded in the memory location determined in S2 with that stored in the ROM 122. That is, it is determined that the failure use attack has not been executed, and the encryption operation result obtained by executing the executable code 100 of the encryption operation module loaded in the memory location determined in S2 is executed by the encryption operation module. The execution result of the possible code 100 is set (S7a). If the verification result of the check code added to the executable code 100 of the secret calculation module fails, the secret calculation control unit 101 reads the executable code 100 of the secret calculation module loaded in the memory location determined in S2. It is determined that there is a possibility that a failure use attack has been executed, that is, it does not match that stored in the ROM 122, and an error code indicating that the execution of the secret operation module has failed is executed. An execution result is set (S7b).

  Next, after executing the process of erasing the executable code 100 of the secret calculation module loaded in the memory location determined in S2 (S8), the secret calculation control unit 101 according to the present embodiment can execute the secret calculation module. The execution result of the code 100 is transferred to the upper software 11 (S9), and the procedure illustrated in FIG.

  FIG. 4 is a diagram for explaining the memory state of the security device 1. FIG. 4A shows the state of the memory before receiving the call of the executable code 100 of the secret operation module, and the execution of the secret operation module before receiving the call of the executable code 100 of the secret operation module from the upper software 11. The executable code 100 of the secret operation module is not loaded in either the RAM 121 or the NVM 123, which is an electrically rewritable memory, with the executable code 100 stored only in the ROM 122. FIG. 4B shows a state when the RAM 121 is determined in the memory for loading the executable code 100 of the secret calculation module, and the secret calculation control unit 101 loads the executable code 100 of the secret calculation module into the RAM 121. As a result, the executable code 100 of the secret operation module is stored in the RAM 121 in addition to the ROM 122. A check code (CC: Check Code) is added to the executable code 100 of the secret calculation module stored in the ROM 122, but the check code is added to the executable code 100 of the secret calculation module stored in the RAM 121. Is not added. FIG. 4C shows a state when the NVM 123 is determined in the memory for loading the executable code 100 of the secret calculation module, and the secret calculation control unit 101 places the executable code 100 of the secret calculation module in the NVM 123. As a result, the executable code 100 of the secret operation module is stored in the NVM 123 in addition to the ROM 122. Note that a check code is added to the executable code 100 of the secret calculation module stored in the ROM 122, but no check code is added to the executable code 100 of the secret calculation module stored in the NVM 123. When the secret operation module is terminated in the state of FIG. 4B or 4C, the executable code 100 of the secret operation module loaded into the RAM 121 or the NVM 123 is loaded with the executable code 100 of the secret operation module. The memory is deleted and the state returns to the state of FIG.

  By executing the procedure shown in FIG. 3 by the secret calculation control unit 101 according to the present embodiment, the memory location where the executable code 100 of the secret calculation module is arranged differs for each secret calculation. If the memory location of the executable code 100 of the secret operation module that actually performs the cryptographic operation is different for each secret operation, the attacker cannot specify the memory location of the executable code 100 of the secret operation module. It is possible to prevent the same malfunction from being repeatedly induced and prevent the encryption key used for the cryptographic operation from leaking outside the security device 1.

  Finally, a specific form of the security device 1 according to the present embodiment will be described. FIG. 5 is a diagram for explaining the form of the security device 1. The specific form of the security device 1 according to the present embodiment is arbitrary. For example, the security device 1 according to the present embodiment is illustrated in the IC card 1a illustrated in FIG. 5A or illustrated in FIG. 5B. The token can be used for the Internet bank token 1b, and can also be applied to the USB key 1c having the large-capacity memory shown in FIG.

DESCRIPTION OF SYMBOLS 1 Security device 10 Operating system 100 Executable code of secret calculation module 101 Secret calculation control part 11 Upper software 12 Hardware 121 RAM
122 ROM
123 NVM

Claims (3)

A non-volatile memory storing executable code of a secret operation module that performs secret operation processing using secret data;
When the executable code of the secret operation module is called from the upper software that provides the security function to the user, the memory location where the executable code of the secret operation module is arranged is randomly selected from the data readable / writable memory. After the executable code of the cipher operation module stored in the non-volatile memory is loaded to the memory location, the executable code of the cipher operation module loaded to the memory location is executed and loaded to the memory location A secret computation control unit that delivers an execution result of the executable code of the secret computation module to the upper software;
A security device characterized by comprising.   2. The security device according to claim 1, wherein the secret calculation processing performed by the secret calculation module is cryptographic calculation processing using an encryption key as the secret data. A check code is added to the executable code of the secret calculation module stored in the nonvolatile memory, and the secret calculation control unit includes a check code calculated from the executable code of the secret calculation module loaded in the memory location, and a nonvolatile code The check code added to the executable code of the secret operation module stored in the memory is verified, and if the check code verification fails, the error code is delivered to the upper software. The security device according to claim 2.

Images