WO2008096076A2

WO2008096076A2 - Secured electronic systems, securing methods and uses of such systems

Info

Publication number: WO2008096076A2
Application number: PCT/FR2007/002152
Authority: WO
Inventors: Patrice Hameaux; Guillaume Phan; Cédric MESNIL; Axelle Apvrille
Original assignee: Trusted, Logic
Priority date: 2006-12-22
Filing date: 2007-12-21
Publication date: 2008-08-14
Also published as: FR2910658B1; JP2010514039A; FR2910658A1; EP2104893A2; BRPI0721042A2; WO2008096076A3

Abstract

The invention relates to an electronic system including a processor and a computer data storage memory, to a securing method, and to the use of such a system. The system of the invention is characterised in that it further comprises a module for allocating physical writing addresses of such data in the memory, said module being capable of allocating said addresses according to a variant-diversified heuristic. The invention can particularly be used for securing onboard systems made in series against hardware or software attacks.

Description

SECURE ELECTRONIC SYSTEMS, METHODS OF SECURING AND USES OF SUCH SYSTEMS

The invention relates to embedded electronic systems including a processor and a computer data storage memory, security methods and uses of such systems. The systems of the invention are more particularly portable on-board systems manufactured in large series of identical systems. These include, for example, smart cards, including subscriber identification modules (SIMs), or electronic platforms for mobile phones or other small electronic devices.

The electronic systems of the state of the art and, in particular, the on-board electronic systems, are likely to be attacked both at the software level and at the hardware level.

Known software attacks are extremely varied and involve, for example, viruses, malicious code injections, memory overflow methods, or disassembly techniques. These attacks regularly make one of the magazines specialized in computer science. They are, for the most part, relatively simple to code. In addition, their implementation costs are generally reduced, which explains their profusion. Of course, these attacks are the subject of the development of a multitude of protection systems, often themselves software, sometimes hardware, and whose effectiveness is variable.

The hardware attacks are, for their part, much less varied than the software attacks. They are also more difficult to implement and generally require the implementation of expensive equipment. These include, for example, attacks by analyzing the power consumption of the systems, by analysis variations of electromagnetic radiation, by injection of faults, or attacks proceeding by cloning. Physical attacks are formidable in terms of security and, in some cases, they are not known to be fully effective, but rather a succession of imperfect relief processes. Thus, in the case of simple or differential attacks proceeding by analyzing the current consumed by the microcontroller of a smart card, voltage, temperature, noise source or address or data bus sensors are used. duplicated. However, none of these solutions is perfect, even though each of them is expensive at the silicon level and has a negative impact on the overall performance of the system.

Software and hardware attacks, when they are immediately reproducible on a large scale, are the cause of considerable harm to the designers of embedded electronic systems. Their consequences are likely to be disastrous, both financially and in terms of the image of the said designers.

In view of the above, a problem to be solved by the invention is to provide an electronic system, which has increased security against software and hardware attacks, including increased security against the reproducibility of such attacks, likely to be carried out on a large scale. The solution of the invention to this problem has for its first object an electronic system provided with a processor and a computer data storage memory, characterized in that it comprises a module for allocating physical write addresses. such data in said memory, said module being able to allocate said addresses according to a heuristic diversified by a variant. In addition, its second object is a method of securing an electronic system provided with a processor and a computer data storage memory, characterized in that said system comprises a physical address allocation module of writing such data in said memory and in that said module allocates said addresses according to a heuristic diversified by a variant.

Finally, its third object is to use a method as defined above for securing an electronic system against software and hardware attacks.

Thus, an attacker can not in any case expect to find computer data in a specific physical location within the memory of a secure system according to the invention. It must take into account that the location of these targeted data is different on each system, even if it is a system of an identical model. However, with regard to hardware attacks, the physical location of the data to be protected is important information, both to target an attack on silicon, but also to determine the consequences of taking these data into account during the attack. system operation, the electromagnetic signature of the use of a data generally dependent on its physical position in silicon. Similarly, with respect to software attacks, the location of the data to be protected is also important because, depending on this location, an attacker does not have access to the same data on the stack, on the heap, or is not in executable space.

Advantageously: the system further comprises a data access management module contained in the memory and said access management module is correlated to the allocation module; - the system is produced in series of identical systems; - the variant is a data unique to each system of a series of identical systems; the variant is a chip identifier; - the variant is a variable datum in the system; the variant is the current value of a monotone counter or the current time of a clock internal to the system or provided by an external clock signal; the variant is random or pseudo-random; - the variant is not modifiable in the system or the integrity of the variant is protected; - the variant is encrypted content in the system; the address allocation heuristic is further varied according to one or a plurality of behavioral factors of the system; - behavioral factors are states of the life cycle of the system; - the behavioral factors are derived from external information transmitted to the system; the address allocation heuristic is varied by a variant only in one or a plurality of specific persistent or transient states of the system; the address allocation heuristic is computed from a deterministic algorithm dependent on the variant; the algorithm is a one-way function; the system manipulates logical addresses and in that, for access to the physical addresses, the access management module uses an address table or a variant-dependent algorithm; - the system is embedded; and - the memory is a persistent memory of the system.

The invention will be better understood on reading the following description of non-limiting embodiments, in which FIG. 1 is a schematic representation of a system according to the invention.

The secure systems according to the invention are electronic systems, for example of the embedded type, provided with a processor and a computer data storage memory. Such systems are in particular portable systems manufactured in large series such as smart cards, including subscriber identification modules (SIMs), or such as electronic platforms for mobile phones or other electronic devices of reduced size. The processor is a microprocessor or a microcontroller. The storage memory is advantageously a read-only (ROM) persistent memory, for example of the PROM (programmable) type, NVRAM (non-volatile random access memory) for example of the EEPROM (electrically erasable programmable) or Flash type, or else, optionally, a random access memory (RAM), for example SRAM (static) or DRAM (dynamic).

The systems according to the invention also comprise a module for allocating the write addresses of the computer data in the storage memory. This module is invoked whenever it is necessary to allocate a memory area, and consequently one or more physical addresses, for writing new data, that is to say for programming the memory. This module is a hardware or software entity. It is correlated to a memory access management module intended to manage the accesses, in particular for reading the written data, and whose physical locations in the memory have been allocated by the allocation module. This memory access management module makes it possible, where appropriate, to associate the logical locations of the data with their physical locations. Like the allocation module, the memory access management module forms a hardware or software entity. In the case where it forms a physical entity, it is the MMU

(memory management unit). In the case where it forms a software entity, it is a software algorithm. In the remainder of the present disclosure of the invention, the assembly formed by the memory allocation module and the memory management module, as shown diagrammatically in FIG. 1, is called MAA (memory access and memory allocation module). ). According to the invention, for writing computer data in a storage memory, the MAA is able to allocate addresses and, in particular, physical addresses of this memory, according to a heuristic diversified by a variant. The allocation heuristic applies to pages or memory areas that belong to a specific process, or to all pages in the memory. It is therefore a local allocation or a global allocation. The allocated addresses are actually physical addresses corresponding to physical locations in persistent memory of the system according to the invention. These are not logical addresses. As a result, unlike the security elements that appear to have been implemented in some versions of the Windows ™ Vista ™ operating environment / operating system for personal computers and not for portable embedded systems, the system according to the invention makes it possible to only to complicate software attacks, but also, and especially, large-scale physical attacks. In addition, the system allows protection of the data itself and, not only, as in the aforementioned version of the Windows ™ environment, the execution of programs against attacks by stack overflow.

The variant is a variable datum of a system considered with respect to other identical systems of the same series and / or a variable datum in the same system considered, over time. Here, identical systems are understood to mean systems which have comparable characteristics and functionalities and intended for similar uses, for example the same model of a mobile phone platform.

In a first example, the variant is a unique data to the system, including a chip identifier. The memory allocation heuristic is then specific of a system considered in a series of identical systems.

In a second example, the variant is the current value of a monotone counter or the current time of a clock internal to the system or provided by an external clock signal. In this case, the allocation heuristic varies over time for the same system.

In a third example, the variant is a random or pseudo-random number generated by the system, preferably according to a secure algorithm. This number can be generated once and for all in a system considered or generated at different times. In the case where it is generated once and for all, the memory allocation heuristic will then be different in identical systems of the same series but it will always be identical in the same system. In the case where this number is not generated once and for all in a given system, the memory allocation heuristic will vary in this system over time. Of course, the variant according to the invention may be a complex variable data function of several unit variants. It may be, for example, a variable data function of both a chip identifier according to the first example above and a clock signal according to the second example above.

In practice, the degree of security of a system according to the invention is proportional to the variability of the variant, especially when faced with the risk of cloning of this system. Thus, if each copy of a series of systems can be identified by a unique identifier, this identifier can effectively be used alone as a variant. However, this choice has the disadvantage of being, to a certain extent, predictable. Also, variants with greater variability, such as random or pseudo-random numbers, will be favorably selected or combined. These variants present the advantage of not being predictable, which significantly increases the degree of security of the systems according to the invention.

According to the invention, the variant is advantageously secured in the system. In some embodiments, it is non-modifiable or integrity protected. In other embodiments, it is made confidential.

In the case where the variant is unmodifiable or protected in integrity, it is entered in the ROM of the system during its production, or else in programmable memory type PROM or EPROM write once, or in a programmable memory of type with multiple writes. In this latter embodiment, it is then checked in integrity at each memory access or on certain occasions.

In the case where the variant is made confidential, it is advantageously encrypted in the system and kept secret by it, or else transmitted to the system through a secure channel preserving confidentiality and kept secret.

In addition, according to the invention, and as is schematized in FIG. 1, for writing computer data in a storage memory, the MAA is able to allocate physical addresses of this memory according to a diversified heuristic according to factors behavioral characteristics of the system, these factors defining different behaviors of the MAA: behavior 1, behavior 2, ..., behavior n. In a first example, the behavioral factors are known internal conditions of the systems. Thus, the memory allocation heuristic used by the MAA may or may not involve a variant depending on whether the system is in a specific state. This specific state can be a persistent state of the system. It is then in particular, a specific state of the life cycle of the system such as a customization phase, a phase of production or normal use of the system, for example in a degraded or non-functional state, a threshold state or a debugging state. This specific state may be a transient state of the system. This is for example the opening of a secure section of a program implemented by the system or critical phases of its operation such as restarting or shutdown. In a second example, the behavioral factors are derived from external information transmitted to the systems. Thus, the memory allocation heuristic used by the MAA may or may not involve the variant when this is explicitly requested by an external user of the system - man or machine - through indications transmitted to the system.

In a third example, the behavioral factors derive from the type of memory concerned by the allocation. Thus, the memory allocation heuristic used by the MAA may or may not involve the variant depending on the type of programmable memory targeted by the allocation.

Finally, in a fourth example, the behavioral factors are temporal data. Thus, the memory allocation heuristic used by the MAA may or may not involve the next variant whether or not one is at a specific time in time.

The following exemplary embodiments relate to the heuristics implemented by the MAA, for the writing of data diversified by a variant and, possibly, by behavioral factors, and for access to said written data.

In a first exemplary embodiment, the MAA uses a memory allocation heuristic where the physical address of the next memory block to be allocated is calculated from a deterministic algorithm dependent on a variant. We then have a function that associates with logical address and given variant, one and the same physical address of allocation. For the sake of the security of the system, it may be interesting to use, as an algorithm, a function called "one-way", that is to say a function of which it is deemed very difficult, in the current state knowledge, to calculate the input values from the output values. By making this choice, it makes it very difficult to calculate a logical address from a physical address. This, coupled with the unpredictability of the variant, makes it possible to prevent an attacker having carried out a hardware attack on a first system, to calculate the corresponding logical address, then to recalculate the corresponding physical address on a second identical system which he would know the variant.

In a second exemplary embodiment, the heuristic for allocating the physical addresses of the memory blocks for storing the data is diversified by a variant and according to a behavioral factor. In a so-called normal operating mode of the system, the MAA implements a traditional allocation heuristic, which is not diversified by a variant. However, in transient operating modes of the system, the MAA implements a heuristic diversified by a variant according to which the MAA performs a reworking of all or part of the memory blocks previously allocated, and according to an algorithm dependent on this variant. After these revisions, the MAA switches back to normal mode. Thus, the performance of the system is absolutely not degraded in the normal operating mode. Performance is degraded only in the transient state that is of course triggered at times in which system performance is not required. Furthermore, it will be noted that, in this second exemplary embodiment, the reworking of the blocks can be performed on memory blocks by size groups. fixed or variable and that it is likely to be limited to subsets of the programmable memory.

In the case where, as in the previous examples, the systems according to the invention manipulate logical addresses, the MAA then accesses, for the translation of these logical addresses into physical addresses, an address table, or implements a variant-dependent algorithm, or else, uses a combination of such a table and such an algorithm. The use of an address table does not significantly degrade the performance of the system. However, this table requires memory resources. On the other hand, the use of an algorithm is likely to significantly degrade system performance, since a computation is necessary each time it is necessary to convert a logical address into a physical address. Nevertheless, the implementation of this algorithm does not require or little additional memory space.

Note also that it is not necessary that the variant is preserved. For example, in the case where the variant is variable such as, in particular, the case of a variant formed of a random number generated several times or if necessary, and in the case where an address table is maintained, then the variant is simply disposable. The address of the address table may itself depend on an initial variant or another variant which, it will be retained.

Regarding the security aspects, it appears that the systems according to the invention are secured against the reproducibility of hardware attacks by simple analysis of the power consumption (SPA) of the system or by electromagnetic analysis. Indeed, the power consumption of a given system is generally a function of the physical address of the data to be accessed. However, the invention makes it possible to vary the physical address of the same information on two identical systems. Attacks, which could be carried out on systems identical to a first system will be as difficult to conduct as the first system attacked, which is not the case for systems of the state of the art.

In addition, it appears that the invention harms the reproducibility of attacks proceeding by time analysis (timing attacks). Indeed, the access time to a given physical address is normally dependent on the physical address to access. However, this physical address varies from one system to another identical system. Also, the access time to the same information varies from one system to another and the attack is not reproducible.

Moreover, the invention impairs the reproducibility of visualization-based or physical modification-based attacks, in particular using a laser or carrying out chemical etching. Indeed, for these attacks to be carried out, it is necessary to identify the physical locations to attack. However, the invention makes it possible to vary the spatial location of the same information on two identical systems. The implementation of this identification is thus more difficult.

The invention is detrimental to the reproducibility of fault injection attacks. These attacks consist in operating systems under particular conditions, for example, at low frequencies, at high temperatures, or by means of a desynchronized clock, or else to operate these systems after a physical damage generated in particular by a laser, then to analyze the behavior of the material under these conditions. If, under the chosen conditions, the current consumption or the access time to a data vary on two identical systems according to the invention, it is necessary to inject a different fault on each system. In addition, the temporal synchronization of these attacks being very often based on an electromagnetic analysis itself disturbed by the invention, the difficulty of reproducing the attack is further increased. The invention is detrimental to attempts at cloning. In fact, when the variant is written in non-modifiable memory or of the write-once type and has a sufficient degree of variability, the content of a first system can not, in this case, be correctly interpreted by the MAA of a second system, making all copy of the contents of the first system on the second useless system.

Finally, the invention complicates software attacks that exploit particular memory configurations. For example, a virus that uses a stack overflow with a specific coding will not have the same data in the stack and it will be much more complicated for it to be grafted to a program by directly accessing the memory, the position of that last being variable from one copy to another of the system.

Claims

An electronic system provided with a processor and a computer data storage memory, characterized in that it further comprises a module for allocating physical addresses for writing such data in said memory, said module being capable of allocating said addresses according to a heuristic diversified by a variant.

2. System according to claim 1, characterized in that it further comprises a data access management module contained in the memory and in that said access management module is correlated to the allocation module.

3. System according to one of claims 1 or 2, characterized in that it is produced in series of identical systems.

4. System according to claim 3, in that the variant is a datum unique to each system in a series of identical systems.

5. System according to claim 4, characterized in that the variant is a chip identifier.

6. System according to one of claims 1, 2 or 3, characterized in that the variant is a variable data in the system.

7. System according to claim 6, characterized in that the variant is the current value of a monotone counter or the current time of a clock internal to the system or provided by an external clock signal.

8. System according to one of claims 4 or 6, characterized in that the variant is random or pseudo-random.

9. System according to one of the preceding claims, characterized in that the variant is not modifiable in the system or the integrity of the variant is protected.

10. System according to one of the preceding claims, characterized in that the variant is encrypted content in the system.

11. System according to one of the preceding claims, characterized in that the address allocation heuristic is further diversified according to one or a plurality of behavioral factors of the system.

12. System according to claim 11, characterized in that the behavioral factors are states of the life cycle of the system.

13. System according to one of claims 11 or 12, characterized in that the behavioral factors are derived from external information transmitted to the system.

System according to one of the preceding claims, characterized in that the address allocation heuristic is diversified by a variant only in one or a plurality of specific persistent or transient states of the system.

15. System according to one of the preceding claims, characterized in that the address allocation heuristic is calculated from a deterministic algorithm dependent on the variant.

16. System according to claim 15, characterized in that this algorithm is a one-way function.

17. System according to one of the preceding claims, characterized in that it manipulates logical addresses and in that, for access to physical addresses, the access management module uses an address table or a dependent algorithm. of the variant.

18. System according to one of the preceding claims, characterized in that it is embedded.

19. System according to one of the preceding claims, characterized in that the memory is a persistent memory of the system.

20. A method for securing an electronic system provided with a processor and a computer data storage memory, characterized in that said system comprises a module for allocating physical addresses for writing such data in said memory. and in that said module allocates said addresses according to a heuristic diversified by a variant.

21. Use of a method according to claim 20 for securing an electronic system according to one of claims 1 to 19 against software and hardware attacks.

22. Use according to claim 21, characterized in that the attack is an attack proceeding by cloning.