Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
  • G06F7/58—Random or pseudo-random number generators
  • G06F7/582—Pseudo-random number generators
  • G06F7/584—Pseudo-random number generators using finite field arithmetic, e.g. using a linear feedback shift register
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
  • G06F21/82—Protecting input, output or interconnection devices
  • G06F21/85—Protecting input, output or interconnection devices interconnection devices, e.g. bus-connected or in-line devices
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
  • G06F21/12—Protecting executable software
  • G06F21/121—Restricting unauthorised execution of programs
  • G06F21/123—Restricting unauthorised execution of programs by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global positioning systems [GPS] devices
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/60—Protecting data
  • G06F21/602—Providing cryptographic facilities or services
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F9/00—Arrangements for program control, e.g. control units
  • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
  • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
  • G06F9/30098—Register arrangements
  • G06F9/3012—Organisation of register space, e.g. banked or distributed register file
  • G06F9/30134—Register stacks; shift registers
• • G—PHYSICS
  • G09—EDUCATION; CRYPTOGRAPHY; DISPLAY; ADVERTISING; SEALS
  • G09C—CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY
  • G09C1/00—Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2207/00—Indexing scheme relating to methods or arrangements for processing data by operating upon the order or content of the data handled
  • G06F2207/72—Indexing scheme relating to groups G06F7/72 - G06F7/729
  • G06F2207/7219—Countermeasures against side channel or fault attacks

Definitions

• the invention relates to a microprocessor arrangement with a microprocessor and a peripheral unit, which are connected to one another via a data bus.
• Cryptographic units are provided at the end connections of the bus.
• Microprocessor arrangements in which the data traffic running over data buses is encrypted cryptographically, are used in security-critical applications.
• microprocessor arrangements serve as control circuits for mobile data carrier cards, so-called chip cards.
• Personalized data, monetary values or access authorizations are stored in the data memory of the microprocessor arrangements and are queried by a reading device, which subsequently unlocks a functional unit protected against unauthorized access.
• Security-relevant data is stored in encrypted form in the data memory.
• a decoding device is connected in the data path between the memory and the CPU, so that the decrypted original data can be processed in the CPU.
• the end and encryption processes are processed in two stages. Accordingly, a decryption and decryption subunit is arranged on the side of the memory and the respective peripheral units and on the side of the CPU.
• the object of the present invention is to provide a microprocessor arrangement whose security against unauthorized eavesdropping on chip-internal processes is increased. According to the invention, this object is achieved by a microprocessor arrangement comprising: a central processing unit and at least one peripheral unit which are connected to one another via a data bus; a first cryptographic unit arranged in the peripheral unit and connected to the data bus; a second cryptographic unit, which is arranged in the central processing unit and is connected to the data bus, and a random generator for generating a sequence of data values, which is coupled to the first and the second cryptographic unit for feeding in the data values, the cryptographic operation of the first and second cryptographic units can be controlled as a function of the data values generated by the random number generator.
• the data traffic output by a functional unit of the microprocessor arrangement on the data bus is encrypted and decrypted again at the entrance to the receiving unit.
• the encryption and decryption operation is controlled by a random generator, so that the respective operating state of the encryption / decryption method cannot be predicted deterministically. This increases the security of the data traffic processed over the data bus. Therefore, additional mechanical measures that protect the bus lines from needle attacks are no longer necessary.
• the random control of the encryption / decryption method results in a correspondingly random current profile, so that it is not possible to listen to the data traffic via the bus in this way.
• the invention can be used in any microprocessor system in which the central processing unit (CPU) exchanges data and addresses with peripheral units including memory via a bus.
• the arrangement can be constructed discretely or integrated monolithically on one only semiconductor chip, so-called microcontroller.
• the random numbers for controlling the decryption / decryption are expediently supplied to the respective units in isochronous fashion.
• a clock line is provided which connects all encryption / decryption units with one another.
• these units are connected to one another by a line on which the random numbers are forwarded.
• a corresponding protection for the multitude of the other data lines of the bus is omitted.
• a encryption / decryption unit expediently contains a shift register with feedback, which is controlled by the commemorated clock signal and the serially fed random number.
• the output side provided by the shift register The data word provided is logically linked to the data word to be output on the bus or received by the bus, for example via an exclusive OR link.
• the return ⁇ coupling of the shift register is preferably linear.
• the invention is explained in more detail below on the basis of the exemplary embodiment shown in the drawing.
• the figure shows a schematic representation of a CPU, a memory and a further peripheral unit, which are monolithically integrated on a microcontroller.
• the microcontroller shown in the figure comprises a central processing unit or CPU 1, a memory 2 and a peripheral unit 3.
• the peripheral unit 3 can be an input / output circuit block, for example. All components of the microcontroller are integrated on a single silicon chip.
• the CPU 1 takes over the data control and computing functions, the memory unit 2 contains data that are stored in a volatile or non-volatile manner, and the peripheral unit 3 serves the dedicated function assigned to it.
• the microcontroller contains further functional units.
• the data exchange between the units mentioned takes place via a data bus 4.
• the data bus comprises a large number of lines on which the data are transmitted in parallel.
• the bus also contains corresponding control lines for controlling the data transmission.
• a cryptographic unit 11, 21, 31 is arranged at the input and output of the units 1, 2, 3 facing the data bus. The via the data bus to the l eweili- ge unit input or output data stream is the assigned cryptographic unit is decrypted or encrypted.
• CPU 1 requests a data word from memory 2.
• the data word is read from the corresponding memory cells of the memory 2 and temporarily stored in a register 211.
• the data word is encrypted by the internal circuits of the cryptographic unit 21 and output on the bus 4.
• the cryptographic unit 11 of the CPU 1 receives this data word in order to decrypt it and to store it temporarily in the register 111. Only the encrypted date is available during the transfer of the data word on the bus 4 from the memory 2 to the CPU 1.
• the encryption and decryption in the units 21 and 11 is carried out as a function of a random number, which is provided by a random generator 6, the output of which is connected to the units 21, 11 via a line 5.
• the random number is fed in isochronously in both units 21, 11 by means of a clock CLK fed via a line 7 into both devices 21, 11.
• the random generator 5 generates a (pseudo) random sequence of bits, which are made available to the cryptographic units 21, 11 in synchronism with the clock CLK.
• the data security of the data value transmitted via the bus 4 is increased against unauthorized tapping.
• the synchronous control ensures that encryption and decryption steps in the sending or receiving unit are complementary to one another in the same time interval. Because of the randomness of the encryption appears on the bus despite repetitive data to be transmitted a different bit pattern.
• the current profile of the chip which is relatively easy to measure from the outside due to the relatively high unloaded capacitive loads of the bus, appears uncorrelated and random over time. The current profile cannot therefore be used in a readout attempt to identify any characteristic switching states of the microcontroller.
• lines 5 and 7 are covered with an additional layer, the lines of which are destroyed and become unusable when removed.
• All three shown encryption / decryption units 11, 21, 31 are correspondingly constructed accordingly.
• Unit 11 is explained in more detail by way of example.
• the register 111 is used to temporarily store the data word to be received or output by the CPU.
• a logical link is applied to each of the data lines of the bus.
• the logic operations are exclusive-OR operations 112, 113, 114, 115.
• Each of the exclusive-OR gates is connected to one of the inputs and the output in one of the lines of the data bus; the other of the inputs is connected to an output of a shift register 116, which is fed back, for example, linearly.
• the shift register 116 is on the input side with the clock line 7 and the random numbers leading line switches 5 be ⁇ .
• the random number generated by the random number generator 6 is supplied via line 5 to the serial shift smoothly coupled ⁇ register 116, the clock control of the clock CLK is carried out.
• the feedback of the shift register 116 ensures that a different data word is available at its output connections in each time cycle, which data word is sent via the exclusive-OR gates 112,... 115 to the bus 4 that is to be output on the bus 4 the data word to be received is logically linked.
• the shift registers are initialized with the same value.
• the data words transmitted via the bus 4 are encrypted at the sending and receiving locations or are complementarily decrypted accordingly.
• the encryption and decryption are symmetrical to each other. In principle, it is sufficient if the shift register 116 is not fed back. The protection is increased by the feedback. Linear feedback based on a primitive polynomial is suitable for feedback. Depending on the parallelism, the corresponding number of bits from the shift register is used for encryption. On the sending and receiving sides, the encryption / decryption is performed isochronously by the same random number. The transmission plays no role because of the symmetrical encryption.
• circuit complexity for providing the random numbers and the clock as well as the circuit complexity for the linear feedback-shift register, the input / output register and the exclusive OR gate is acceptable. Security against unauthorized eavesdropping on the bus Data values carried as well as an unauthorized measurement of the current profile is significantly increased in terms of the additional effort.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Software Systems (AREA)
• General Physics & Mathematics (AREA)
• Physics & Mathematics (AREA)
• Computer Security & Cryptography (AREA)
• General Engineering & Computer Science (AREA)
• Computer Hardware Design (AREA)
• Bioethics (AREA)
• General Health & Medical Sciences (AREA)
• Health & Medical Sciences (AREA)
• Radar, Positioning & Navigation (AREA)
• Remote Sensing (AREA)
• Multimedia (AREA)
• Technology Law (AREA)
• Computational Mathematics (AREA)
• Mathematical Analysis (AREA)
• Mathematical Optimization (AREA)
• Pure & Applied Mathematics (AREA)
• Storage Device Security (AREA)
• Microcomputers (AREA)
• Compression, Expansion, Code Conversion, And Decoders (AREA)

Priority Applications (8)

Applications Claiming Priority (2)

Related Child Applications (1)

Publications (2)

Family

ID=8239520

Family Applications (1)

Country Status (12)

Cited By (9)

Families Citing this family (23)

Family Cites Families (23)

• 2000
  • 2000-11-30 DE DE50015839T patent/DE50015839D1/de not_active Expired - Lifetime
  • 2000-11-30 RU RU2002117437/09A patent/RU2251726C2/ru not_active IP Right Cessation
  • 2000-11-30 CN CNB008165696A patent/CN1168011C/zh not_active Expired - Fee Related
  • 2000-11-30 EP EP00983200A patent/EP1234239B1/de not_active Expired - Lifetime
  • 2000-11-30 JP JP2001541944A patent/JP3866105B2/ja not_active Expired - Fee Related
  • 2000-11-30 WO PCT/EP2000/012065 patent/WO2001040950A2/de not_active Ceased
  • 2000-11-30 UA UA2002054477A patent/UA72944C2/uk unknown
  • 2000-11-30 MX MXPA02005352A patent/MXPA02005352A/es active IP Right Grant
  • 2000-11-30 KR KR10-2002-7007024A patent/KR100490114B1/ko not_active Expired - Lifetime
  • 2000-11-30 BR BR0015907-7A patent/BR0015907A/pt not_active IP Right Cessation
  • 2000-11-30 AT AT00983200T patent/ATE454670T1/de not_active IP Right Cessation
• 2002
  • 2002-06-03 US US10/160,967 patent/US7036017B2/en not_active Expired - Lifetime

Also Published As

Similar Documents

Legal Events