JP6228354B2 - Unauthorized operation detection circuit, device provided with unauthorized operation detection circuit, and unauthorized operation detection method - Google Patents

Description

  The present invention relates to an unauthorized operation detection circuit, an apparatus including an unauthorized operation detection circuit, and an unauthorized operation detection method.

  As an example of a device that manages the execution state of an algorithm based on a state value, a smart card equipped with an encryption function is known. The smart card is sometimes called a chip card (Chip Card) or an IC card (ICC: Integrated Circuit Card). Some smart cards equipped with a cryptographic function use a tamper resistant technique for preventing attacks on a secret key inside a cryptographic circuit.

  Encryption methods can be broadly classified into common key encryption methods and public key encryption methods. The common key cryptosystem uses the same secret key for encryption and decryption, and keeps the security by making the secret key secret information unknown to a third party other than the sender and the receiver. On the other hand, the public key cryptosystem uses a different key for encryption and decryption, and instead of publicly disclosing the public key for performing encryption, only the receiver receives the secret key for decrypting the ciphertext. Keep it safe by keeping it confidential.

  For these encryption methods, there are various attack methods for estimating a secret key from available information such as ciphertext. These attack methods can be broadly divided into theoretical attacks and implementation attacks. In the theoretical attack, a secret key is obtained from the relationship between input data and output data of a cryptographic algorithm. The theoretical attack may succeed without depending on the implementation form of the cryptographic algorithm to be attacked. On the other hand, the implementation attack is not only related to the relationship between input data and output data, but also to error information and input / output data obtained by applying physical stress to the device. The secret key is estimated by using information observed from. The success or failure of the implementation attack depends on the implementation form of the cryptographic algorithm.

  Even if a cryptographic algorithm can be secured against a theoretical attack, it may be vulnerable to an implementation attack, and a cryptographic algorithm that can guarantee the security against the implementation attack is desired. Countermeasures against mounting attacks are also called tamper-proof technology.

  Implementation attacks can be broadly classified into fault attacks and side channel attacks. A fault attack is a difference between the output result of cryptographic processing when an intentional abnormality is generated with respect to the internal data value of the cryptographic circuit installed in a smart card or other device, and the output result of normal cryptographic processing. Using the information, a secret key stored in the cryptographic circuit is estimated. On the other hand, in the side channel attack, a secret key is estimated using information leaked from the device such as power consumption, electromagnetic waves, and processing time. In the side channel attack, a method using power consumption is best known, and it is also called a power analysis attack. In the power analysis attack, a secret key is estimated from the power consumption waveform of the device.

JP 2005-509936 A Special table 2009-500710 gazette JP 2010-68135 A

Alfred J. Menezes et al., "HANDBOOK OF APPLIED CRYPTOGRAPHY" (CRC press), p.615, Algorithm 14.79 (http://www.cacr.math.uwaterloo.ca/hac/about/chap14.pdf) D. Boneh, R. A. DeMillo, R. J. Lipton, "On the Importance of Checking Cryptographic Protocols for Faults", Eurocrypt '97, pp. 37-51, 1997 Benoit Feix and Louis Marcel, "Passive and Active Combined Attacks", 2007 Workshop on Fault Diagnosis and Tolerance in Cryptography, FDTC 2007 http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf Kouichi Itoh, Masahiko Takenaka, Naoya Torii, Syouji Temma, and Yasushi Kurihara, "Fast Implementation of Public-Key Cryptography on a DSP TMS320C6201", CHES '99, LNCS 1717, pp.61-72

  A device equipped with a conventional encryption circuit may be vulnerable to an implementation attack even if it can maintain security against a theoretical attack.

  Therefore, an object of the present invention is to provide an unauthorized operation detection circuit, an apparatus including an unauthorized operation detection circuit, and an unauthorized operation detection method that can improve tamper resistance against mounting attacks.

According to one aspect of the present invention, a change condition rule output circuit that outputs a plurality of different state value change condition rules, and a state value after state transition for a current state value is generated according to the plurality of change condition rules. A state value generation circuit, and a state value after the state transition generated according to one change condition rule among the state values after the state transition generated by the state value generation circuit according to the plurality of change condition rules, among the plurality of change conditions rules that are outputted from the change condition rule output circuit, and said one change condition rules, a selection unit for selectively outputting, based on a random number, is input on the basis of the operation start input the stores the current state value, and the state value storing unit for storing a state value after the state transition selected output from the selecting unit then is inputted, an output from the state value storage unit The one change condition rule in which the current state value is compared with the state value after the state transition that is input next to the state value storage unit, and the state transition is selected and output from the selection unit If not, a state value comparison circuit that detects an unauthorized operation and outputs a detection signal is provided, and the change condition rule is an unauthorized operation detection circuit that is a rule that uses a value change of the same fixed number of bits.

According to one aspect of the present invention, a communication circuit that communicates with an external device to receive an operation start input, a processor, and an unauthorized operation detection circuit are provided, and the unauthorized operation detection circuit includes a plurality of different state values. A change condition rule output circuit that outputs a change condition rule, a state value generation circuit that generates a state value after state transition with respect to a current state value according to the plurality of change condition rules, and the state value according to the plurality of change condition rules Of the state values after the state transition generated by the generation circuit, the state value after the state transition generated according to one change condition rule and the plurality of change condition rules output from the change condition rule output circuit. among them, the said one change condition rules, a selection unit for selectively outputting, based on the random number, if the stores the current state values input based on the operation start input co In, then the state value storing unit for storing entered, the stored current state value and the state value output from said state value storage state value after the state transition selected output from the selector The state value after the next state transition input to the unit is compared, and if the state transition does not comply with the one change condition rule selected and output from the selection unit, an unauthorized operation is detected and a detection signal is output. It includes a state value comparison circuit for outputting to said processor, said plurality of variation condition rule is a rule to use a value change in the same fixed number of bits device is provided.

According to one aspect of the present invention, the state value generation circuit generates a state value after the state transition with respect to the current state value according to a plurality of change condition rules, and the state after the state transition generated according to one change condition rule value, and the one change condition rule, and selecting the output from the selecting unit based on a random number, the stores the current state value inputted to the state value storage unit based on the calculated start input, Next , the state value after the state transition selected and output from the selection unit is input and stored; the current state value output from the state value storage unit; and the state value storage unit A step of comparing an input state value after the state transition with a state value comparison circuit, detecting an unauthorized operation when the state transition does not comply with the one change condition rule, and outputting a detection signal. The unauthorized operation detection method is a rule that is executed by the above-described method, and the plurality of change condition rules are different from each other and use value changes of the same fixed number of bits.

  According to the disclosed unauthorized operation detection circuit, the device including the unauthorized operation detection circuit, and the unauthorized operation detection method, it is possible to improve tamper resistance against an implementation attack.

It is a figure explaining the algorithm of the exponent remainder calculation using the binary method. It is a figure explaining the process of a binary method. It is a figure explaining a fault attack. It is a figure explaining the RSA encryption algorithm which has tamper resistance to the power analysis based on RSA encryption using a binary method. FIG. 5 is a diagram showing a power consumption waveform when d = (10100...) ₂ in the apparatus in which the RSA encryption algorithm of FIG. 4 is implemented. It is a figure explaining the method of invalidating the countermeasure function of the power analysis by a fault attack. Is a diagram showing a power waveform when the d = (10100 ...) ₂ in the state value (0001) ₂ device that implements the RSA encryption algorithm skips in FIG. It is a block diagram which shows an example of the unauthorized operation detection circuit in one Example of this invention. It is a figure which shows an example of the dynamic change of the power consumption seen as a side channel in the unauthorized operation detection circuit of FIG. It is a block diagram which shows the structure of an example of the smart card carrying the mounting attack countermeasure hardware in an Example. It is a flowchart explaining an example of the unauthorized operation detection method in an Example. It is a figure explaining an example which applied the Example to the common key encryption system. It is a figure explaining an example which applied the Example to the public key encryption system. It is a figure explaining the example which needs NOP insertion.

  In the disclosed unauthorized operation detection circuit, the device including the unauthorized operation detection circuit, and the unauthorized operation detection method, the change condition rule of the state value is output from the change condition rule output circuit, and the current state value according to the plurality of change condition rules is output. A state value after the state transition is generated by the state value generation circuit, and is generated from the selection unit according to one change condition rule among the state values after the state transition generated by the state value generation circuit according to a plurality of change condition rules. Of the plurality of change condition rules output from the state value after the state transition and the change condition rule output circuit, the one change condition rule is selectively output based on a random number. The state value storage unit stores the current state value based on the calculation start input, and stores the state value after the state transition selected and output from the selection unit. The state value comparison circuit compares the state value after the state transition with the current state value based on the input / output of the state value storage unit, and if the state transition does not comply with the one change condition rule selected and output from the selection unit, it is illegal. Detects an operation and outputs a detection signal. Although the plurality of change condition rules are different from each other, they are rules using value changes of the same fixed number of bits.

  Embodiments of the disclosed unauthorized operation detection circuit, the device including the unauthorized operation detection circuit, and the unauthorized operation detection method will be described below with reference to the drawings.

First, RSA encryption will be described. In the decryption process of the RSA cipher, exponent remainder calculation is performed. In the exponent remainder calculation, plaintext v is calculated by v = a ^d (mod n) for secret key d, ciphertext a, and modulus n. Generally, the bit length of the secret key d in RSA encryption is 1024 bits or more. For this reason, if the d-th power operation is executed by a simple method, about 2 ¹⁰²⁴ multiplications are required, and it is difficult to complete the calculation within a realistic time.

A binary method is known as an algorithm for efficiently performing this d-power operation (see, for example, Non-Patent Document 1). By using the binary method, the number of operations required for the d-th power operation is from 2 ¹⁰²⁴ times to a constant multiple of 1024 (this constant is a value of 1.5 or less), and an efficient operation can be realized.

The secret key d is a u-bit value, and its binary representation is expressed as d = (d _u−1 , d _u−2 ,..., D ₀ ) ₂ . Here, d _i represents an individual bit value of d. FIG. 1 is a diagram for explaining an algorithm for exponential residue calculation using the binary method, and FIG. 2 is a diagram for explaining processing of the binary method. In the algorithm of FIG. 1, the bit value d _i of the secret key d is checked in the order from i = u−1 to i = 0. If the result of this check is d _i = 1, both two multiplications and multiplications are performed. If the result of the check is d _i = 0, only two multiplications are performed. By repeating such processing from i = u−1 to i = 0, the binary method calculates v = a ^d (mod n). That is, in the binary method, the value of bit d _i of the secret key d, 2 multiplications, and the execution pattern multiplication are linked directly.

  FIG. 3 is a diagram for explaining a fault attack. In particular, the stress application method using a laser can accurately generate a fault in units of 1 bit (hereinafter referred to as 1-bit), and can generate a fault as intended by an attacker. A typical fault attack is described in Non-Patent Document 2, for example. For convenience of explanation, an outline of a fault attack against the RSA cipher will be described.

  The RSA encryption uses a composite number n that satisfies n = p × q for prime numbers p and q. The security of the RSA cipher is based on the assumption that it is difficult to obtain primes p and q from n by prime factorization. However, p and q are large integers of 512-bit or more and n is 1024-bit or more. That is, if the attacker succeeds in obtaining the prime numbers p and q from the composite number n, the RSA cipher is decrypted.

  The purpose of the fault attack on the RSA cipher is to obtain a prime number p. If the prime number p can be obtained, q can also be easily obtained by division. Therefore, if the attacker can obtain either p or q, the RSA cipher is decrypted.

  In the fault attack on the RSA cipher, p is deciphered by using two of a normal output value and an abnormal output value when a fault is generated. After obtaining a normal output value, the attacker generates a fault during the execution of the calculation process in the power-residue calculation of (mod q) described later.

As a result, while obtaining a case of normal processing ^{_{m q = c q dq (mod}} q), in the case of fault occurrence calculated value is an abnormal value, obtaining a _q 'm satisfy _q ≠ m _q' for m (If m ' _q is not equal to m _q , the attack succeeds at any value.) As a result of the final calculation using _m'q , the attacker obtains an output m '. The attacker obtains p = GCD (m′−m, n) by calculating GCD (m′−n, n) using the normal output m and the output m ′ when the fault occurs. GCD (a, b) is a function for calculating the greatest common divisor of integers a and b.

The reason for this attack is that the calculation of m 'described later using an abnormal m' _q makes the difference between the correct m value and m 'value an integral multiple of p, that is, the integer k. On the other hand, since m′−m = kp, CD (m′−m, n) = GCD (kp, pq) = p can be obtained as a result.

Input: c (ciphertext)
dp (secret key satisfying dp = d mod (p-1) for secret key d)
dq (secret key satisfying dq = d mod (q-1) for secret key d)
p (prime number p satisfying n = p × q)
q (prime number q satisfying n = p × q)
u (integer that satisfies u = q ^-1 (mod p))
Output: m (plain text)
However, e is a public key for encryption, d is a private key for decryption, and satisfies ed = 1 mod (p−1) (q−1).

* Normal processing
1.c _p = c mod p, c _q = c mod q
2.Calculate m _p = c _p ^dp (mod p)
3.Calculate m _q = c _q ^dq (mod q)
4.Calculate m = ((m _q -m _p ) × u (mod q)) × p + m _p
5. Output m * Processing when a fault occurs
1.c _p = c mod p, c _q = c mod q
^2.m _p = c _p ^dp (mod p)
^{_{3. m q = c q dq (}} mod q) fault occurs during computation, instead m _'q output (m _q' of m _q ≠ m _q)
4.Calculate m = ((m ' _q -m _p ) × u (mod q)) × p + m _p
5. Output m ′ In the fault attack as described above, a prime number p, which is a secret key for decrypting the RSA cipher, is obtained by comparing the normal output value and the output value at the time of occurrence of the fault. Here, for convenience of explanation, a fault attack for obtaining the secret key d by observing the power waveform at the time of fault occurrence will be described.

FIG. 4 is a diagram for explaining an RSA encryption algorithm having tamper resistance to power analysis based on RSA encryption using the binary method. A 4-bit value 1 shown on the left side of FIG. 4 is a value representing an execution state of the RSA encryption algorithm, and is hereinafter referred to as a “state value”. In the RSA encryption algorithm of FIG. 4, (0000) ₂ , (0001) ₂ ,..., (1001) ₂ are state values. The state value is used not only for the RSA encryption process of FIG. 4 but also for managing the execution state of the operation in the apparatus that executes the encryption process.

The RSA encryption algorithm shown in FIG. 4 has an input ciphertext c, a secret key d = (d _u−1 , d _u−2 ,..., D ₀ ) ₂ , and a modulus n, and plaintext m = c ^d (mod It has a tamper resistance function (or tamper resistance) that calculates n) and prevents the secret key d from being leaked by power analysis. This tamper resistance function will be described with reference to FIG.

FIG. 5 is a diagram showing a power consumption waveform in the case where d = (10100...) ₂ in the apparatus in which the RSA encryption algorithm of FIG. 4 is implemented. In FIG. 5, for d = (d _u-1 , d _u-2 , ..., d ₀ ) ₂ , the following processing is repeated for each of i = u-1, ..., 1,0. This is the waveform when executed.

d _i = 1: After two multiplications indicated by R ₀ = R ₀ × R ₀ , a multiplication indicated by R ₀ = R ₀ × R ₁ is executed.

d _i = 0: A double multiplication represented by R ₀ = R ₀ × R ₀ is executed.

That is, according to the bit value of d _i in FIG. 5, two multiplication with R ₀ = R ₀ × R ₀ and R ₀ = R ₀ × R ₁ is running. If these multiplication types can be identified by the power consumption waveform, the bit value of d _i can be determined and the secret key d is decrypted. However, the above identification is difficult for the RSA encryption algorithm of FIG. This is because R ₀ and R ₁ are always random values that are updated by initial values given by random numbers r ₁ and r ₂ as described in state values (0001) ₂ and (0010) ₂ in FIG. Because there is.

In other words, the two types of multiplication of R ₀ = R ₀ × R ₀ and R ₀ = R ₀ × R ₁ are both (random number) × (random number) multiplications. As shown in FIG. 5, it is difficult to identify with the power consumption waveform. Thus, power analysis for the RSA encryption algorithm of FIG. 4 is difficult. Therefore, the device that executes the RSA encryption algorithm of FIG. 4 is safe for power analysis.

  There is also an attack method that can invalidate resistance to power analysis by performing a fault attack on the RSA encryption algorithm of FIG. 4 (see, for example, Non-Patent Document 3). In the attack method that can invalidate the resistance to power analysis by performing a fault attack against the RSA encryption algorithm, a part of the state value is forcibly changed by performing a fault attack, and measures against power analysis Skip the processing required for the function and disable the countermeasure function.

FIG. 6 is a diagram for explaining a method of invalidating a countermeasure function for power analysis by a fault attack. As shown in FIG. 6, the execution state is basically managed by state transition of state values. In normal processing, this state value transitions while increasing one by one as (0000) ₂ → (0001) ₂ → (0010) ₂ → (0011) ₂ . The RSA encryption algorithm is processed in order.

In contrast to the processing of the RSA encryption algorithm shown in FIG. 6, the fault attack forcibly changes the value of the state value, for example, (0000) ₂ → (0010) ₂ → (0011) ₂ . Some state values ((0001) _{2 in} the example of FIG. 6) are forcibly skipped. Such highly accurate fault generation can be realized by a stress application method using a laser. In this way, by forcibly skipping the state value (0001) ₂ by a fault attack with respect to the processing of the RSA encryption algorithm of FIG. 6, the process of writing a random number to R ₀ is skipped, so the value of R ₀ The initial value is 0.

In the RSA encryption algorithm of FIGS. 4 and 6, random number writing to R ₀ is an important condition for ensuring the tamper resistant function, and this tamper resistant function is invalidated by skipping this process. FIG. 7 shows a power consumption waveform when the value of R ₀ becomes 0 as a result of skipping such processing. FIG. 7 is a diagram showing a power consumption waveform in the case of d = (10100...) ₂ in an apparatus that implements the RSA encryption algorithm in which the state value (0001) ₂ of FIG. 6 is skipped.

In the example of FIG. 7, two types of multiplications R ₀ = R ₀ × R ₀ and R ₀ = R ₀ × R ₁ occur. In the power consumption waveform of FIG. 5, these two types of multiplication are both (random number) × (random number). However, in the power consumption waveform of FIG. 7, since the value of R ₀ is zero due to the occurrence of a fault, the following multiplications are respectively performed.

R ₀ × R ₀ : 0 × 0
R ₀ × R ₁ : 0 × (random number)
That is, R ₀ × R ₀ is a multiplication in which both inputs are zero. R ₀ × R ₁ is a multiplication in which one of the inputs is zero. Due to the nature of multiplication, it is known that the power consumption waveform of multiplication with 0 as an input has a special shape. Such a special waveform may further change depending on whether one or two zeros are input. That is, a waveform having one input of 0 and a waveform having two inputs are characteristic. Therefore, as shown in FIG. 7, the multiplication of R ₀ × R _{0 and} the multiplication of R ₀ × R ₁ can be identified by the shape of the power consumption waveform. Since the bit value of d can be identified as it is by identifying these power consumption waveforms, the secret key d is deciphered as d = (10100 ..) ₂ from the power consumption waveform of FIG.

  A countermeasure technique for preventing an attack method that can invalidate resistance to power analysis by performing a fault attack on the RSA encryption algorithm has been proposed (see, for example, Patent Document 1). This countermeasure technique is a countermeasure method based on fault detection that checks the internal state of a circuit and detects whether or not a fault has occurred. By using fault detection, even when a fault occurs, it is possible to implement an appropriate defense method such as stopping processing of the encryption device or stopping data output.

  In the conventional fault detection, an external counter of the state value is installed outside the cryptographic device, and this counter is incremented every time the state value transitions, and whether this counter value is as expected. Checking whether the state transition of the state value is correct is performed periodically. That is, in the conventional fault detection, whether or not the state transition of the state value is correctly performed is indirectly checked using an external counter. However, although such a fault detection method can detect a basic fault attack, if a more advanced fault attack is performed, the fault detection function is invalidated. In other words, such a fault detection method is effective for a fault attack that generates a fault once, because it does not have real-time fault detection, but is ineffective for a fault attack that generates a fault twice. is there.

  Thus, there has been proposed an unauthorized operation detection circuit that makes fault detection effective for all state transitions by integrating state transitions and fault detection of state values, and ensures real-time fault detection (for example, Patent Documents). 3). In this proposed unauthorized operation detection circuit, a plurality of state value change condition rules are prepared, and an attacker can select which change condition rule to use by a random number generated inside the unauthorized operation detection circuit. The safety is improved by making it impossible to specify the skip pattern of the state value that causes fault detection failure. When three kinds of change condition rules are used, the first, second, and third change condition rules have different numbers of bits, for example, 1 bit, 2 bits, and 3 bits, respectively. According to the proposed unauthorized operation detection circuit, a fault detection signal is output when a state transition that does not conform to the change condition rule is detected, which is effective against a fault attack. However, if the fault detection signal is classified by gain, the maximum value of the fault detection signal gain, for example, does not change within the same change condition rule, but changes greatly between different change condition rules. Rules may be deciphered. In other words, this proposed unauthorized operation detection circuit is a tamper-resistant technology against fault attacks, and a side channel attack in which change condition rules are deciphered from analysis of dynamic changes in power consumption of the unauthorized operation detection circuit that appears as a side channel. Is vulnerable.

FIG. 8 is a block diagram showing an example of the unauthorized operation detection circuit in one embodiment of the present invention.
The unauthorized operation detection circuit 30 shown in FIG. 8 includes a state value generation circuit 11 having state value tables 11A to 11C, a state value register 12, change condition rule output circuits 13A to 13C, a state value comparison circuit 14, a selector 15, and a selector. 16 The unauthorized operation detection circuit 30 is an example of a state machine having a fault detection circuit function.

  The state value register 12 forms a state value storage unit that stores the current state value based on an operation start input from the outside. The state value generation circuit 11 determines the state value after the state transition based on the current state value stored in the state value register 12, that is, the output of the state value register 12, using the state value tables 11A to 11C. To do. The change condition rule output circuits 13A to 13C define state value change condition rules Type-A to Type-C during normal processing when there is no fault attack. The change condition rules Type-A, Type-B, and Type-C are different rules. The state value comparison circuit 14 determines whether or not the state value state transition is normal, and outputs a fault detection signal when a fault attack is detected from the state value state transition abnormality. The selector 15 selects and outputs one of the three state values after the state transition with respect to the current state value generated using the state value tables 11A to 11C of the state value generating circuit 11 based on a random number input from the outside. And input to the state value register 12 and the state value comparison circuit 14. The state value tables 11A to 11C include data necessary for generating state values after state transitions according to the change condition rules Type-A to Type-C for the current state values (that is, the change condition rule Type-A ~ Type-C data). The selector 16 selects and outputs one of the change condition rule output circuits 13 </ b> A to 13 </ b> C based on a random number input from the outside and inputs the selected output to the state value comparison circuit 14. Needless to say, the random number may be generated in the unauthorized operation detection circuit 30.

  The selector 15 and the selector 16 form a selection unit that is linked based on random number input. When the output of the state value after the state transition generated using the state value table 11A according to the change condition rule Type-A is selected, the selection unit selects the change condition rule Type-A of the change condition rule output circuit 13A. When the output is selected and the output of the state value after the state transition generated using the state value table 11B according to the change condition rule Type-B is selected, the change condition rule Type-B of the change condition rule output circuit 13B When the output of the state value after the state transition generated using the state value table 11C according to the change condition rule Type-C is selected, the change condition rule Type- of the change condition rule output circuit 13C is selected. Operates so that the C output is selected.

The state value comparison circuit 14 compares the output (that is, the current state value) of the state value register 12 and the input (that is, the state value after the state transition with respect to the current state value generated by the state value generation circuit 11). Thus, the presence / absence of a fault is detected based on the change condition rule output from the selector 16 (the same as the change condition rule used in the state value generation circuit 11). Specifically, the state value comparator circuit 14, the relationship between the input and the output of the state value register 12, based on whether 1-bit change der Luke not in accordance with the change condition rule that is outputted from the selector 16 Detects the occurrence of faults.

State value comparator circuit 14, the relationship between the output and input of the state value register 12, if it follows the change condition rule applied via selector 16, it determines that the normal processing without fault occurs. On the other hand, the relationship between the output and input of the state value register 12, if not in accordance with the change condition rules applied through selector 16, it is determined that the state value comparator circuit 14 is generated abnormal processing of fault Outputs a fault detection signal.

  It should be noted that the process of selecting the output of the state value generated using any one of the state value tables 11A to 11C of the state value generation circuit 11 by the selector 15 and the change condition rule output circuits 13A to 13C of the selector 16 are performed. The process for selecting any one of the outputs is determined by an initialization process based on the first calculation start input in which the unauthorized operation detection circuit 30 operates.

  In the example shown in FIG. 8, the change condition rule given by the change condition rule output circuit 13A is Type-A of 1-bit value change, and the change condition rule given by the change condition rule output circuit 13B is Type of 1-bit value change. -B, and the change condition rule given by the change condition rule output circuit 13C is Type-C of 1-bit value change. In the unauthorized operation detection circuit 30, the state value table 11A determines the state value after the transition based on the change condition rule Type-A, and the state value table 11B determines the state after the transition based on the change condition rule Type-B. The value is determined, and the state value table 11C determines the state value after the transition based on the change condition rule Type-C.

FIG. 9 is a diagram illustrating an example of a dynamic change in power consumption that appears as a side channel in the unauthorized operation detection circuit 30 in FIG. 8. In FIG. 9, the vertical axis indicates the power consumption of the unauthorized operation detection circuit 30 in arbitrary units, and the horizontal axis indicates time in arbitrary units. In this example, the change condition rule given by the change condition rule output circuit 13A is Type-A of 1-bit value change of the power consumption waveform 26A, and the change condition rule given by the change condition rule output circuit 13B is that of the power consumption waveform 26B. The change condition rule given by the change condition rule output circuit 13C is Type-C of the 1-bit value change of the power consumption waveform 26C. As can be seen from FIG. 9, the dynamic change (for example, the change in the maximum value) of the power consumption of the unauthorized operation detection circuit 30 is the power consumption waveform 26 </ b> A even when different change condition rule output circuits 13 </ b> A to 13 </ b> C are used. , 26B, 26C, it can be seen that it cannot be confirmed.

The unauthorized operation detection circuit 30 uses the three state value tables 11A to 11C to generate three state values after the state transition with respect to the current state value, and the three change condition rule output circuits 13A to 13A. 13C, but one change condition rule selected based on a random number from the three change condition rules Type-A to Type-C is always a value change of the same fixed bit number (in this example, 1-bit Value change) .

  In the unauthorized operation detection circuit 30 in FIG. 8, the number of different change condition rules is three, but there are no particular limitations as long as there are a plurality of different change condition rules. Different change condition rules may be rules that use a value change of the same fixed bit number, and are not limited to rules that use a 1-bit value change. Note that when using a change condition rule that uses a 1-bit value change, the circuit configuration is relatively simple and consumes less power than when using a change condition rule that uses a 2-bit or greater value change. It can be kept relatively low.

According to the unauthorized operation detection circuit 30 of FIG. 8, even if an attacker performs an attack that repeatedly tries a fault attack, the secret key cannot be decrypted. The unauthorized operation detection circuit 30 defends against a known attack by changing the 1-bit value of the state value, and further prevents the unknown attack (or evolved attack) by changing the 1-bit value of the state value. By protecting it, it is possible to prevent leakage of the private key. Enough to increase the number of change condition rule Ru using 1-bit value changes in the state value becomes more secure against attacks.

  FIG. 10 is a block diagram showing a configuration of an example of a smart card equipped with mounting attack countermeasure hardware in the present embodiment. The smart card 100 is an example of a device including an unauthorized operation detection circuit. A smart card 100 shown in FIG. 10 includes a CPU (Central Processing Unit) 101 as an example of a processor, a ROM (Read Only Memory) 102 as an example of a storage unit, a communication circuit 103, an external interface circuit 104, and mounting attack countermeasure hardware. An unauthorized operation detection circuit 105 as an example, a RAM (Random Access Memory) 106 as an example of a storage unit, a clock generation circuit 107, a power supply circuit 108, and a bus 109. The bus 109 connects the CPU 101, ROM 102, communication circuit 103, unauthorized operation detection circuit 105, and RAM 106.

  The CPU 101 controls the entire smart card 100, and in this example, has a function of generating random numbers by a well-known method. The ROM 102 stores programs executed by the CPU 101 and various data. The communication circuit 103 communicates with an external device (not shown) via the external interface circuit 104 by at least one of wired and wireless communication methods, and receives various requests including an operation start input from the external device, for example.

  Whether the random number is generated in the unauthorized operation detection circuit 105 or generated in a circuit unit other than the CPU 101 and the unauthorized operation detection circuit 105 in the smart card 100, the random number is generated outside the smart card 100 to detect the unauthorized operation. It may be input to the circuit 105.

  10, the unauthorized operation detection circuit 105 corresponds to the unauthorized operation detection circuit 30 shown in FIG. 8 is input from the CPU 101 to the unauthorized operation detection circuit 105, for example, and the calculation start input illustrated in FIG. 8 is input from the communication circuit 103 to the unauthorized operation detection circuit 105, for example. The calculation start input may be input from the communication circuit 103 to the unauthorized operation detection circuit 105 via the CPU 101, for example. The unauthorized operation detection circuit 105 outputs a fault detection signal (or interrupt signal) to the CPU 101 via the bus 109 when detecting the unauthorized operation as described above. When the CPU 101 receives the fault detection signal, the CPU 101 executes a secret key data erasure process, a cryptographic device use stop process, and the like, and takes appropriate measures so that the attacker does not succeed even after a further implementation attack. A known measure can be adopted as such an appropriate measure.

  The unauthorized operation detection circuit 105 prevents a secret key from being estimated by an attacker due to a fault attack and a side channel attack on an arbitrary encryption algorithm such as an RSA encryption algorithm and an AES (Advanced Encryption Standard) encryption algorithm. Since the smart card 100 includes the unauthorized operation detection circuit 105, high tamper resistance can be realized.

  The RAM 106 temporarily stores various data including intermediate data for operations executed by the CPU 101 and provides a work area for the CPU 101. The clock generation circuit 107 generates a clock to be supplied to each unit that requires a clock in the smart card 100, as indicated by a broken line in FIG. In this example, the clock is supplied to the CPU 101, ROM 102, communication circuit 103, external interface circuit 104, unauthorized operation detection circuit 105, and RAM 106. The clock generation circuit 107 may be configured to generate a clock based on a signal, a clock, or the like supplied from an external device via the external interface circuit 104. The power supply circuit 108 supplies a power supply voltage to each part in the smart card 100 that requires the power supply voltage. The power supply circuit 108 may be configured to output a power supply voltage based on a signal supplied from an external device via the external interface circuit 104. When the smart card 100 is, for example, a contactless IC card, the power supply circuit 108 converts a radio wave generated by an external device such as a card reader / writer received by the antenna of the external interface circuit 104 into power and outputs a power supply voltage. It may be. The external interface circuit 104 may include a terminal. In FIG. 10, for convenience of explanation, illustration of a power supply line of a power supply voltage supplied by the power supply circuit 108 is omitted.

  Next, an example of the unauthorized operation detection method in the present embodiment will be described with reference to FIG. FIG. 11 is a flowchart for explaining an example of the unauthorized operation detection method according to this embodiment. In FIG. 11, when the unauthorized operation detection process of the unauthorized operation detection circuit 30 (or unauthorized operation detection circuit 105) is started in step S1, the calculation start input from the communication circuit 103 is read in step S2, and the encryption process is started. To do. After step S2, fault detection and attack countermeasure processing are performed in step S3. Step S3 includes steps S31 to S38.

  In step S31, a random number input from the CPU 101 is read. In step S32, one of the change condition rules Type-A to Type-C is selected based on the random number input, and the outputs of the selectors 15 and 16 are selected according to the selected change condition rule. . Thereby, when the change condition rule Type-A is selected, in step S33A, the state value after the state transition with respect to the current state value is determined (or generated) based on the state value table 11A. When the change condition rule Type-B is selected, in step S33B, the state value after the state transition with respect to the current state value is determined based on the state value table 11B. When the change condition rule Type-C is selected, in step S33C, the state value after the state transition with respect to the current state value is determined based on the state value table 11C. The output of the state value generation circuit 11 selected by the selector 15 is input to the state value register 12, and the change condition rule defined by any one of the change condition rule output circuits 13A to 13C selected by the selector 16 is the state value. It is input to the comparison circuit 14.

In step S34, the state value after the transition output from the selector 15 is written in the state value register 12 as the next state value. As will be described later, if the current state value is written in the state value register 12, the state value after the transition is written in the state value register 12 as the next current state value. In the conversion processing, the state value register 12 stores the state value after the transition as the current state value based on the calculation start input. In step S35, the state value generation circuit 11 is accompanied by a 1-bit value change according to the change condition rule output from the selector 16 with respect to the output of the state value register 12 (ie, the current state value). A state value representing the execution state of the cryptographic operation (cryptographic algorithm) of the started cryptographic process is generated . Thus, the state value generation circuit 11 stores the data necessary to generate the state value after the state transition in accordance with the change condition rule that is outputted from the selector 16, using a corresponding state value table 1- The state value after the state transition accompanied by the bit value change is generated and output through the selector 15 as the next state value. In step S36, the state value comparison circuit 14 outputs the state value register 12 (that is, the current state value before the state transition) and the input (that is, the state transition for the current state value generated by the state value generation circuit 11). By comparing the subsequent state value), it is determined whether or not the relationship between the output of the state value register 12 and the input is a 1-bit value change according to the change condition rule output from the selector 16. If the decision result in the step S36 is NO, in a step S37, the state value comparison circuit 14 detects the occurrence of a fault from the abnormality of the state transition from the current state value before the state transition to the state value after the state transition and detects the fault. A detection signal is output.

On the other hand, if the decision result in the step S36 is YES, in a step S38, the next state value written in the state value register 12 is written as the next current state value. In step S39, it is determined whether or not to end the above-described cryptographic operation. If the determination result is NO, the process returns to step S34. If the decision result in the step S39 is YES, in a step S4, it is determined whether or not the calculation for the preset number of calculations has been completed for one change condition rule, and the process is determined to be NO. Returns to step S31. If the decision result in the step S4 is YES, the process is normally ended in a step S5.

  FIG. 12 is a diagram for explaining an example in which the above embodiment is applied to a common key cryptosystem. As a typical common key encryption algorithm, AES (Advanced Encryption Standard) is published as Federal Information Standards (FIPS) FIPS 197 (see, for example, Non-Patent Document 4).

  FIG. 12 shows the state transition of the state value when the unauthorized operation detection circuit 30 (or 105) is used for the AES encryption process described in FIG. In FIG. 12, 13 state values are expressed in 4-bit. Since the change condition rule of the state value is a 1-bit value change, the state value always changes 1-bit as long as it is a normal state transition.

  Also in this example, the state value comparison circuit 14 of the unauthorized operation detection circuit 30 compares the state value before and after the state transition, and the 1-bit value according to the change condition rule selected by the selector 16. If there is a change in, it is determined that no fault has occurred, and if it is any other change, it is determined that a fault has occurred and a fault signal is output.

FIG. 13 is a diagram for explaining an example in which the above embodiment is applied to a public key cryptosystem. RSA encryption is known as a typical public key encryption algorithm. The RSA cipher is a public key cipher that performs processing by repeating a modular multiplication operation. The RSA cipher calculates REDC (A, B, N) = A × B × R ⁻¹ (mod N) for integers A, B and modulus N as a method for efficiently executing the modular multiplication. The method of Montgomery multiplication remainder is generally known. Here, R is constant with respect to the bit length x of N, is given by R = 2 ^x. Various methods are known as Montgomery modular multiplication processing algorithms (see, for example, Non-Patent Document 5).

  FIG. 13 shows the state transition of the state value when the unauthorized operation detection circuit 30 (or 105) is used for the Montgomery multiplication remainder described in page 65, Algorithm 4 of Non-Patent Document 5. In FIG. 13, numerical values of 1024-bit or more used in RSA encryption are expressed by arranging g variables in units of w-bit. w is generally a value smaller than 1024, such as w = 16, 32, 64. By repeating w-bit partial multiplication, a modular multiplication operation of 1024-bit or more is performed. In FIG. 13, 17 state values are expressed in 5-bit. Since the change condition rule of the state value is a 1-bit value change, the state value always changes 1-bit as long as it is a normal state transition.

  Also in this example, the state value comparison circuit 14 of the unauthorized operation detection circuit 30 compares the state value before and after the state transition, and the 1-bit value according to the change condition rule selected by the selector 16. If there is a change in, it is determined that no fault has occurred, and if it is any other change, it is determined that a fault has occurred and a fault signal is output.

  The example of FIG. 12 is an application example of the common key cryptosystem, and the conditional branch pattern has a very simple structure such as a single loop by a for statement. On the other hand, in the application example of the public key cryptosystem shown in FIG. 13, the pattern of conditional branching is more complicated, and a double loop by a for sentence and a conditional branch by an if sentence are combined. Complicated conditional branch patterns make it more difficult to construct state transition patterns of state values.

In order to solve the difficulty of this state transition pattern, an auxiliary means is required. In the example of FIG. 13, the insertion of a NOP (No OPeration) state, which is one of them, is conditional branch ((11001) ₂ -(10001) ₂ state value). NOP refers to a state in which no processing is performed. NOP is a redundant process because it does not perform any process, but it is an auxiliary means that can be used to construct a transition pattern under the restrictions of the state transition condition of the state value.

  FIG. 14 is a diagram illustrating an example in which this NOP insertion is necessary when the state transition condition of the state value is a 1-bit value change. When the state value change condition rule is a 1-bit value change, it is necessary to insert a NOP between the state values B and C when the following processing is performed using the state values A, B, and C.

A if (cond) then {
B treatment 1}
C treatment 2
When the change condition rule is a 1-bit value change, it is considered to perform a state transition of state values A → B → C. If the number of “1” included in the state value A is represented by k, the number of “1” is either increased or decreased by 1 in the state value B due to the restriction of the change condition rule. Or it becomes k + 1. Similarly, when the state value B transits to the state value C, the number of “1” is k−2, k, or k + 2.

  As described above, when the change condition rule is a 1-bit value change, it is possible to realize a state transition of state values A → B → C. However, as shown in FIG. 14A, when the state transition of A → C is performed, the number of “1” is changed from k to k−2, k, k + 2. In other words, when A → C state transition is performed, regardless of the value of k, the state value only changes in 2-bit value or 0-bit value, and changes in 1-bit value. Cannot be realized.

  Therefore, for example, when a change condition rule is set to 1-bit value change in order to realize a 1-bit value change even when A → C state transition is performed, the state value as shown in FIG. The following processing in which NOP is inserted between B and C is performed.

A if (cond) then {
B Treatment 1
C NOP}
D Processing 2
When the change condition rule is 1-bit value change by inserting NOP between the state values B and D , the state value C to D in the state transition of the state value A → B → C → D The number of “1” when transitioning to can be set to k−1 or k + 1. At this time, the state transition of the state value A → D is a 1-bit value change. That is, the state transition of the state value A → B → C → D and the state transition of the state value A → D can both be realized under the constraint of a 1-bit value change.

  As described above, auxiliary means that can be used to construct a state transition pattern of state values including insertion of NOP will be described below. Although FIG. 14 shows an example related to conditional branching, it can also be applied to loop branching.

  For example, by expanding the bit length of the state value, the degree of freedom in selecting the state value is widened, and the state transition pattern of the state value can be easily constructed. For example, when 15 state values are given, the minimum bit length for expressing it is 4-bit. By expressing 15 state values with a bit length larger than 4-bit, It is easy to construct a state transition pattern of state values.

  Also, pre-calculate templates for constructing state values according to basic flow control types such as single loop, double loop, conditional branch, etc., and use these templates to construct state values. You may make it do. In this case, it is possible to cope with various processes by creating various templates according to the number of states in the loop and the number of states in the conditional branch.

The following supplementary notes are further disclosed with respect to the embodiments including the above examples.
(Appendix 1)
A plurality of change condition rule output circuits for outputting a plurality of different condition value change condition rules,
A state value generation circuit for generating a state value after state transition with respect to a current state value according to the plurality of change condition rules;
Of the state values after the state transition generated by the state value generation circuit according to the plurality of change condition rules, the state value after the state transition generated according to any one change condition rule, and the change condition rule output circuit A selection unit that selects and outputs the arbitrary one change condition rule among the plurality of change condition rules output from a random number;
A state value storage unit that stores the current state value based on a calculation start input and stores the state value after the state transition that is selected and output from the selection unit;
The state value after the state transition is compared with the current state value based on the input / output of the state value storage unit, and it is illegal if the state transition does not comply with the arbitrary change condition rule selected and output from the selection unit A state value comparison circuit that detects an operation and outputs a detection signal is provided.
The unauthorized operation detection circuit, wherein the plurality of change condition rules are rules using value changes of the same fixed number of bits.
(Appendix 2)
The unauthorized operation detection circuit according to appendix 1, wherein each of the plurality of change condition rules is a rule using a 1-bit value change.
(Appendix 3)
The state value generation circuit has a plurality of state value tables storing data necessary to generate a state value after state transition according to the plurality of change condition rules for the current state value,
The selection unit selects and outputs one of a plurality of state values after the state transition with respect to the current state value generated using the plurality of state value tables based on the random number input, and the state value storage unit And the tampering detection circuit according to claim 1 or 2, further comprising a selector for input to the state value comparison circuit.
(Appendix 4)
A communication circuit that communicates with an external device and receives an operation start input;
A processor;
Equipped with an unauthorized operation detection circuit,
The unauthorized operation detection circuit is
A plurality of change condition rule output circuits for outputting a plurality of different condition value change condition rules,
A state value generation circuit for generating a state value after state transition with respect to a current state value according to the plurality of change condition rules;
Of the state values after the state transition generated by the state value generation circuit according to the plurality of change condition rules, the state value after the state transition generated according to any one change condition rule, and the change condition rule output circuit A selection unit that selects and outputs the arbitrary one change condition rule among the plurality of change condition rules output from a random number;
A state value storage unit that stores the current state value based on the calculation start input and stores the state value after the state transition that is selected and output from the selection unit;
The state value after the state transition is compared with the current state value based on the input / output of the state value storage unit, and it is illegal if the state transition does not comply with the arbitrary change condition rule selected and output from the selection unit A state value comparison circuit that detects an operation and outputs a detection signal to the processor;
The plurality of change condition rules are rules using value changes of the same fixed bit number.
(Appendix 5)
The apparatus according to claim 4, wherein each of the plurality of change condition rules is a rule using a 1-bit value change.
(Appendix 6)
The state value generation circuit has a plurality of state value tables storing data necessary to generate a state value after state transition according to the plurality of change condition rules for the current state value,
The selection unit selects and outputs one of a plurality of state values after state transition with respect to the current state value generated using the plurality of state value tables based on the random number input, and stores the state value And the selector for inputting to the state value comparison circuit.
(Appendix 7)
An external interface circuit including an antenna;
The communication circuit communicates with the external device through the external interface circuit by a wireless communication method,
The apparatus according to any one of appendices 4 to 6, wherein the apparatus forms a smart card.
(Appendix 8)
The apparatus according to any one of appendices 4 to 7, wherein the random number is generated in the apparatus.
(Appendix 9)
The apparatus according to claim 8, wherein the random number is generated in the unauthorized operation detection circuit.
(Appendix 10)
The apparatus according to claim 8, wherein the random number is generated by the processor.
(Appendix 11)
The apparatus according to claim 8, wherein the random number is generated outside the unauthorized operation detection circuit.
(Appendix 12)
The state value generation circuit generates a state value after the state transition with respect to the current state value according to the plurality of change condition rules, the state value after the state transition generated according to any one change condition rule, and the arbitrary one Selecting and outputting the change condition rule from the selection unit based on a random number;
Storing the current state value in the state value storage unit based on the calculation start input, and storing the state value after the state transition selected and output from the selection unit;
Based on the input / output of the state value storage unit, the state value after the state transition and the current state value are compared by a state value comparison circuit, and an unauthorized operation is detected if the state transition does not comply with the one change condition rule And executing the step of outputting the detection signal in the unauthorized operation detection circuit,
The method for detecting an unauthorized operation, wherein the plurality of change condition rules are rules different from each other and use a value change of the same fixed number of bits.
(Appendix 13)
The unauthorized operation detection method according to appendix 12, wherein each of the plurality of change condition rules is a rule using a 1-bit value change.
(Appendix 14)
In the state value generation circuit, after the state transition with respect to the current state value using a plurality of state value tables storing data necessary for generating a state value after the state transition according to the plurality of change condition rules 14. The unauthorized operation detection method according to appendix 12 or 13, wherein the state value is generated.
(Appendix 15)
Reading the calculation start input from a communication circuit of a smart card having the unauthorized operation detection circuit;
The unauthorized operation detection method according to any one of appendices 12 to 14, wherein the unauthorized operation detection circuit further executes a step of reading the random number from a processor of the smart card.

  As described above, the disclosed unauthorized operation detection circuit, the device including the unauthorized operation detection circuit, and the unauthorized operation detection method have been described by the embodiments. However, the present invention is not limited to the above embodiments, and is within the scope of the present invention. Needless to say, various modifications and improvements are possible.

11 state value generation circuits 11A to 11C state value table 12 state value registers 13A to 13C change condition rule output circuit 14 state value comparison circuits 15 and 16 selector 100 smart card 101 CPU
102 ROM
103 Communication Circuit 104 External Interface Circuit 105 Unauthorized Operation Detection Circuit 106 RAM
107 clock generation circuit 108 power supply circuit 109 bus

Claims (5)

A plurality of change condition rule output circuits for outputting a plurality of different condition value change condition rules,
A state value generation circuit for generating a state value after state transition with respect to a current state value according to the plurality of change condition rules;
Of the state values after the state transition generated by the state value generation circuit according to the plurality of change condition rules, the state value after the state transition generated according to one change condition rule, and the change condition rule output circuit of the outputted plurality of change condition rule, and the one change condition rules, a selection unit for selectively outputting, based on a random number,
Stores the current state values input based on the operation start input, the state value storing unit for storing a state value after the state transition selected output from the selecting unit then is inputted,
The current state value output from the state value storage unit is compared with the state value after the state transition input next to the state value storage unit, and the state transition is selected and output from the selection unit. A state value comparison circuit for detecting an unauthorized operation and outputting a detection signal if not complying with the one change condition rule;
The unauthorized operation detection circuit, wherein the plurality of change condition rules are rules using value changes of the same fixed number of bits.   The unauthorized operation detection circuit according to claim 1, wherein each of the plurality of change condition rules is a rule using a 1-bit value change. The state value generation circuit has a plurality of state value tables storing data necessary to generate a state value after state transition according to the plurality of change condition rules for the current state value,
The selection unit selectively outputs one of a plurality of state values after the state transition with respect to the current state value generated using the plurality of state value tables based on the random number , and the state value storage unit and The unauthorized operation detection circuit according to claim 1, further comprising a selector that inputs to the state value comparison circuit. A communication circuit that communicates with an external device and receives an operation start input;
A processor;
Equipped with an unauthorized operation detection circuit,
The unauthorized operation detection circuit is
A plurality of change condition rule output circuits for outputting a plurality of different condition value change condition rules,
A state value generation circuit for generating a state value after state transition with respect to a current state value according to the plurality of change condition rules;
Of the state values after the state transition generated by the state value generation circuit according to the plurality of change condition rules, the state value after the state transition generated according to one change condition rule, and the change condition rule output circuit of the outputted plurality of change condition rule, and the one change condition rules, a selection unit for selectively outputting, based on a random number,
Stores the current state values input based on the operation start input, the state value storing unit for storing are then enter the state value after the state transition selected output from the selecting unit,
The current state value output from the state value storage unit is compared with the state value after the state transition input next to the state value storage unit, and the state transition is selected and output from the selection unit. A state value comparison circuit that detects an unauthorized operation and does not comply with the one change condition rule and outputs a detection signal to the processor;
The plurality of change condition rules are rules using value changes of the same fixed bit number. The state value generation circuit generates a state value after the state transition for the current state value according to a plurality of change condition rules, the state value after the state transition generated according to one change condition rule, and the one change condition the rules, and selecting the output from the selecting unit based on a random number,
Stores the current state value inputted to the state value storage unit based on the calculated start input, and storing the state value after the state transition selected output from the selecting unit then is inputted,
Compares the status value after the state transition is input to the next to the state value storage unit and the current state value output from said state value storage unit in a state value comparison circuit, a state transition is said one If the change condition rule is not followed, the unauthorized operation detection circuit executes a step of detecting the unauthorized operation and outputting a detection signal,
The method for detecting an unauthorized operation, wherein the plurality of change condition rules are rules different from each other and use a value change of the same fixed number of bits.

Images