WO2020181002A1 - Side-channel-attack-resistant memory access on embedded central processing units - Google Patents

Side-channel-attack-resistant memory access on embedded central processing units Download PDF

Info

Publication number
WO2020181002A1
WO2020181002A1 PCT/US2020/021019 US2020021019W WO2020181002A1 WO 2020181002 A1 WO2020181002 A1 WO 2020181002A1 US 2020021019 W US2020021019 W US 2020021019W WO 2020181002 A1 WO2020181002 A1 WO 2020181002A1
Authority
WO
WIPO (PCT)
Prior art keywords
memory
input data
cpu
mask
memory location
Prior art date
Application number
PCT/US2020/021019
Other languages
French (fr)
Inventor
Elke De Mulder
Michael Hutter
Samatha GUMMALLA
Original Assignee
Cryptography Research, Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Cryptography Research, Inc. filed Critical Cryptography Research, Inc.
Priority to CN202080018517.7A priority Critical patent/CN113518988A/en
Priority to US17/435,360 priority patent/US11914870B2/en
Priority to EP20766823.7A priority patent/EP3935543A4/en
Publication of WO2020181002A1 publication Critical patent/WO2020181002A1/en

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/75Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information by inhibiting the analysis of circuitry or operation
    • G06F21/755Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information by inhibiting the analysis of circuitry or operation with measures against power attack
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601Interfaces specially adapted for storage systems
    • G06F3/0602Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/062Securing storage systems
    • G06F3/0623Securing storage systems in relation to content
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G06F21/79Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in semiconductor storage media, e.g. directly-addressable memories
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601Interfaces specially adapted for storage systems
    • G06F3/0628Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0655Vertical data movement, i.e. input-output transfer; data movement between one or more hosts and one or more storage devices
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601Interfaces specially adapted for storage systems
    • G06F3/0668Interfaces specially adapted for storage systems adopting a particular infrastructure
    • G06F3/0671In-line storage system
    • G06F3/0673Single storage device
    • G06F3/0679Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]

Definitions

  • FIG. l is a block diagram of the components of an embedded central processing unit (CPU) in accordance with some embodiments.
  • CPU central processing unit
  • FIG. 2 is an example implementation of mask generation for side-channel attack resistant cryptographic operation, in accordance with embodiments of the present disclosure.
  • FIG. 3 is a flow diagram of an example method to write data to an external memory location, in accordance with some embodiments of the present disclosure.
  • FIG. 4 is a flow diagram of an example method to read data from an external memory location, in accordance with some embodiments of the present disclosure.
  • FIGs. 5A and 5B illustrate performance improvement against side-channel attack achieved by embodiments of the present disclosure.
  • FIG. 6 illustrates a block diagram of a sample computer system in which some embodiments of the disclosure may operate.
  • aspects of the present disclosure are directed to secure exchange of masked data between an embedded central processing unit (CPU) and an external memory during
  • An integrated circuit having the embedded CPU may perform a cryptographic operation that may result in susceptibility of the integrated circuit to a side- channel analysis (SCA) attack where an attacker (e.g., an unauthorized entity) may obtain information as the cryptographic operation is performed.
  • SCA side- channel analysis
  • An example of a side-channel attack includes, but is not limited to, Differential Power Analysis (DPA) where the attacker who seeks to obtain a secret key used in the cryptographic operation may study the differences in power profile (i.e., power consumption patterns) of the integrated circuit as the cryptographic operation is performed.
  • DPA Differential Power Analysis
  • An attacker may be an unauthorized entity that may obtain the input (e.g., the secret key) to the cryptographic operation by analyzing power profile measurements of the integrated circuit over a period of time.
  • the attacker may be able to retrieve the secret key that is used to encrypt the plaintext to the ciphertext by observing the power profile of the integrated circuit as the cryptographic operation is performed to encrypt the plaintext into the ciphertext.
  • the attacker may uncover a cryptographic (e.g., secret or private) key that is used to encrypt the plaintext as the cryptographic operation is performed by the integrated circuit.
  • a key part of protecting embedded CPUs during a cryptographic operation is to protect the communication path from the CPU to the external memory (e.g., static Random Access Memory (SRAM) or other types of memory outside of the CPU) and vice versa.
  • One way to protect the communication path is to use a masking technique to obfuscate the original data during CPU to memory communication.
  • Masking may be implemented by Boolean or arithmetic techniques, both of which require splitting up the masked data into two or more shares. Each share is then independent of the original data and can be processed and stored individually without leaking information in side-channels. If the masked data is loaded to the CPU from external memory, the shares can be re-combined to reveal the original data again. This solution, however, incurs high overhead, because more external memory resource is required to store the two or more shares.
  • aspects of the present disclosure address the above and other deficiencies by calculating masked data shares dynamically inside the CPU boundary (i.e., a trust boundary within which possibility of data leakage is minimal), and using a plurality of memory channels to write the masked data shares to an external memory location and/or to read the data shares from that external memory location.
  • Each dynamically generated mask value is uniquely associated with a corresponding memory channel during writing data to the external memory.
  • the modified masked data is unmasked during a subsequent read operation, and the unmasked data can be remasked again with a new mask, if necessary.
  • “dynamically” means substantially at the same time or without a perceptible delay (“on-the-fly”). In the context of computer operations,“dynamically” may mean during the running of a computer operation without interrupting the flow of the operation.
  • Boolean operations such as exclusive OR (XOR)
  • XOR exclusive OR
  • Boolean operations are shown as examples of masking techniques, though the scope of the disclosure is not limited to just Boolean masking. For example, pure arithmetic operation or a combination of Boolean and arithmetic operations, with appropriate mask conversions as necessary, is within the scope of this disclosure.
  • Advantages of the disclosed approach include prevention of data value leakage and/or data update/overwrite leakage inside the external memory and on the memory bus.
  • the approach is also secure against microarchitecture-specific leaks (e.g., share cross-domain leaks, combination leaks, etc.).
  • An additional advantage of the approach disclosed herein is that the approach is agnostic of memory technology.
  • the methods are equally applicable to FPGA Block RAM, ASIC RAM macro cells, registers and any other type of memory technology. Furthermore, there is no significant impact on latency of the CPU performance, while the overall
  • Fig. 1 illustrates an example CPU including a masked output generator module, in accordance with some aspects of the present disclosure.
  • the CPU 100 may include internal memory (not shown) and various components/modules 110-160 used for cryptographic operations. Examples of such cryptographic operations include, but are not limited to, generating a digital signature to authenticate an integrated circuit containing an embedded CPU. Specific examples of types of cryptographic operations may be based on, but are not limited to, Secure Hash Algorithm (SHA)-l, SHA-2, Advanced Encryption Standard (AES), Data Encryption Standard (DES), etc.
  • SHA Secure Hash Algorithm
  • AES Advanced Encryption Standard
  • DES Data Encryption Standard
  • the CPU 100 may include, among other things, an input data receiving module 110, a random number generator module 120, a memory channel selector module 130, an external memory address module 140, a masked data generator module 150 and a data unmasking module 160.
  • the functionality of one or more of the modules may be combined or divided.
  • the masked data generator module 150 and data unmasking module 160 may be implemented by or in processing logic that may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, integrated circuit, hardware of a device, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof.
  • the input data receiving module 110 may receive shares corresponding to an input data value.
  • the input data value may already be masked with an initial mask.
  • an underlying secret input data value‘d’ may be already masked by combining the value‘d’ with an initial mask‘ml’.
  • the combination of the value‘d’ with the mask ml may be the first share (d Q ml).
  • the mask value ml itself may be the second share.
  • Additional random numbers generated by the random number generator module 120 may be added to the secret value‘d’ already masked with the first mask value‘ml’ within the CPU boundary, as further elaborated with reference to Fig. 2.
  • the external memory address module 140 can maintain a table of memory addresses (e.g., all memory addresses) corresponding to the various memory locations in the external memory 240 shown in Fig. 2. Each memory location may be
  • the memory channel selector module 130 can select which memory channel is to be used to write data into a specific memory location with a specific memory address.
  • the mask generator module 150 can be used to dynamically calculate a masked value to generate masked data (d Q m2) sent to the input data port 242 to be written into the external memory 240.
  • the data unmasking module 160 can read the masked data (d Q m2) from the output data port 238 of the external memory 240, and retrieve original data‘d’ within the CPU boundary.
  • Fig. 2 details an example implementation of dynamically generating channel-specific mask values (m2) within the CPU boundary (shown by the dashed line 212 for writing to external memory 240) by the mask generation sub-component 218 (whose function may be performed by the masked data generator module 150 in Fig. 1).
  • the mask generation sub component 218 can receive the address (mem address 210) of the memory location where masked data is to be written.
  • the mask generation sub-component 218 can also receive information from the multiplexer 246 about what memory channel is to be used to write data.
  • Fig. 2 details an example implementation of dynamically generating channel-specific mask values (m2) within the CPU boundary (shown by the dashed line 212 for writing to external memory 240) by the mask generation sub-component 218 (whose function may be performed by the masked data generator module 150 in Fig. 1).
  • the mask generation sub component 218 can receive the address (mem address 210) of the memory location where masked data is to be written.
  • each channel is associated with a unique seed value (seed 1, seed 2, seed 3 and seed 4) stored in the corresponding registers 220, 222, 224 and 226.
  • seed 1, seed 2, seed 3 and seed 4 stored in the corresponding registers 220, 222, 224 and 226.
  • a corresponding mask value is calculated for each of the channels.
  • the seed values can be generated by a random number generator within the CPU boundary to make it difficult for a side-channel attack, as knowing only the memory address is not sufficient to reveal the mask value.
  • the channels can be reseeded, i.e. the seed values may be refreshed periodically or randomly. Reseeding can happen at different rates to improve the security of the implementation (e.g., key schedule v. crypto primitive, or CBC state v. internal crypto primitive state).
  • the memory channel switch method described here is an efficient way to achieve a high level of security with less frequent reseeding.
  • the dynamically generated mask value‘m2’ shown in Fig. 2 does not necessarily indicate mask value calculated for channel 2, but represents mask value calculated for whichever channel is selected.
  • the embodiment illustrated in Fig. 2 also shows that the side-channel resistance mode (e.g., the DPAmode) can be turned on or off using a dedicated Instruction Set Extension (ISE) or a Control Status Register (CSR) sending a signal 244 to the multiplexer 248 and multiplexer 250.
  • ISE Instruction Set Extension
  • CSR Control Status Register
  • the dynamically generated mask value m2 can be combined with the first masked share (d Q ml) of the input data by an XOR operation 252, the result of which (d Q ml Q m2) can be saved in register 232.
  • Another XOR operation 256 involving the result saved at 232 and the other input share ml (saved at register 234) can generate the dynamically modified masked data (d Q m2) that is sent to the input data port 242 of the external memory 240 to be written at the targeted memory location.
  • the target memory location can be addressed by the selected memory channel (which is not a physical channel) associated with calculated mask value m2.
  • an additional mask (m3) is generated within the CPU boundary to eventually retrieve the original secret value‘d’ which is masked with m2 during writing.
  • the additional mask value m3 is not channel specific, but rather a random value generated within the CPU boundary.
  • the dynamically generated channel-specific mask value m2 can be combined with m3.
  • the two shares of the XOR operation 254 (m3 Q m2) can be saved in register 228 and m3 itself can be saved in register 230. Knowing m3 enables the unmasking of the modified masked data (d Q m2).
  • saved modified masked data (d Q m2) can be accessed from output data port 238 of the external memory 240, and an XOR operation 258 can be performed to generate shares (d Q m3) and m3.
  • d Q m3 shares
  • m3 shares
  • Fig. 3 is a flow diagram of an example method 300 to perform a SCA-resistant data transfer between a CPU and an external memory during writing.
  • the method 300 may be performed by processing logic that may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, integrated circuit, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof.
  • the method 300 may be performed by the components of CPU 100 shown in Fig. 1.
  • method 300 begins at block 310, where input data is received at the CPU.
  • the input data is to be masked and written at an external memory location.
  • Input data may be received at the input data receiving module 110 of the CPU 100, shown in Fig. 1.
  • Input data may be already masked.
  • input data may be received in the form of a plurality of shares for further cryptographic operations. For example, in Fig. 2, the two input shares that are received are (d Q ml) and ml, where ml is an initial mask. Input data can be further masked before writing.
  • a mask value is dynamically generated within the CPU boundary.
  • the dynamically generated mask value m2 can be uniquely associated with the memory channel that is currently being used to address the memory location where the modified input data is to be written. As described above, m2 can be calculated as a function of the memory address and a unique seed value for the selected channel.
  • the seed value can be a random number that may be generated by the random number generator module 120. In an alternative embodiment, the random number may also be stored within an internal memory (not shown in Fig. 1) within the CPU.
  • the input data is modified with the dynamically generated mask value m2. This can be performed by the masked data generator module 150 in Fig. 1. In Fig. 2, this operation is shown as the XOR operation 256.
  • the modified input data is stored in the external memory location.
  • the modified input data can be communicated to the input data port 242 shown in Fig. 2. Note that during the sequence of operations performed within the CPU boundary, each of the intermediate values or any combination of intermediate values is statistically independent of the underlying secret value. Therefore, no direct-value leak is expected. Additionally, because the mask value m2 is dynamically generated based on which memory channel is currently being used, the modified masked value that is communicated outside of the CPU boundary 212 to the external memory 240 also keeps changing, thereby preventing possibility of information leakage during communication.
  • Fig. 4 is a flow diagram of an example method 400 to perform a SCA-resistant data transfer between an external memory and a CPU during reading.
  • the method 400 may be performed by processing logic that may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, integrated circuit, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof.
  • the method 300 may be performed by module 160 of CPU 100 shown in Fig. 1.
  • method 400 begins at block 410, where the saved modified input data (e.g., data masked with the dynamically generated mask value m2) is read from the external memory location.
  • the saved modified input data e.g., data masked with the dynamically generated mask value m2
  • the input data is retrieved by unmasking the modified input data.
  • the unmasking operation is shown as the XOR operation 258.
  • the additional mask m3 generated within the CPU boundary and combined with the dynamically generated mask m2 by the XOR operation 254 helps removing m2during XOR operation 258.
  • the output of the XOR operation 258 may be in the form of a plurality of data shares (e.g., one share is (d Q m3) and the other share is m3).
  • the shares can be used within the CPU boundary for further cryptographic operations.
  • Figs. 5A-5B compare the performance of side-channels when the DPA protection scheme is off versus when the DPA protection scheme is off, according to some embodiments.
  • the side-channels are marked a, b, c, ..., 1, m, n.
  • Fig. 5 A shows 1.5 million power traces collected from unprotected (i.e. DPA protection off) side channels, showing prominent leakage from several channels.
  • Fig. 5B shows 3 million power traces collected from protected (i.e. DPA protection on) side channels, showing leakage from only a few expected channels.
  • the DPA protection scheme may be turned on or off by the command 244 sent to multiplexers 248 and 250.
  • Fig. 6 illustrates an example machine of a computer system 600 within which a set of instructions, for causing the machine to perform any one or more of the methodologies discussed herein, may be executed.
  • the machine may be connected (e.g., networked) to other machines in a LAN, an intranet, an extranet, and/or the Internet.
  • the machine may operate in the capacity of a server or a client machine in client-server network environment, as a peer machine in a peer-to-peer (or distributed) network environment, or as a server or a client machine in a cloud computing infrastructure or environment.
  • the machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a cellular telephone, a web appliance, a server, a network router, a switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine.
  • PC personal computer
  • PDA Personal Digital Assistant
  • STB set-top box
  • STB set-top box
  • a Personal Digital Assistant PDA
  • a cellular telephone a web appliance
  • server a server
  • network router a network router
  • switch or bridge any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine.
  • machine shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.
  • the example computer system 600 includes a processing device 602, a main memory 604 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM), etc.), a static memory 606 (e.g., flash memory, static random access memory (SRAM), etc.), and a data storage device 618, which communicate with each other via a bus 630.
  • processing device 602 may be an embedded CPU 100 in Fig. 1, and memory 606 may be external memory 240 shown in Fig. 2.
  • Processing device 602 represents one or more general-purpose processing devices such as a microprocessor, a central processing unit, or the like. More particularly, the processing device may be complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or processor implementing other instruction sets, or processors implementing a combination of instruction sets. Processing device 602 may also be one or more special-purpose processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), network processor, or the like. The processing device 602 is configured to execute instructions 626 for performing the operations and steps discussed herein.
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • DSP digital signal processor
  • the computer system 600 may further include a network interface device 608 to communicate over the network 620.
  • the computer system 600 also may include a video display unit 610 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device 612 (e.g., a keyboard), a cursor control device 614 (e.g., a mouse), a graphics processing unit 622, a signal generation device 616 (e.g., a speaker), graphics processing unit 622, video processing unit 628, and audio processing unit 632.
  • a video display unit 610 e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)
  • an alphanumeric input device 612 e.g., a keyboard
  • a cursor control device 614 e.g., a mouse
  • graphics processing unit 622 e.g., a graphics processing unit 622
  • the data storage device 618 may include a machine-readable storage medium 624 (also known as a computer-readable medium) on which is stored one or more sets of instructions or software 626 embodying any one or more of the methodologies or functions described herein.
  • the instructions 626 may also reside, completely or at least partially, within the main memory 604 and/or within the processing device 602 during execution thereof by the computer system 600, the main memory 604 and the processing device 602 also constituting machine-readable storage media.
  • the instructions 626 include instructions to implement functionality corresponding to a masked output generator module 160 of Fig. 1. While the machine-readable storage medium 624 is shown in an example implementation to be a single medium, the term“machine-readable storage medium” should be taken to include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more sets of instructions. The term“machine-readable storage medium” shall also be taken to include any medium that is capable of storing or encoding a set of instructions for execution by the machine and that cause the machine to perform any one or more of the methodologies of the present disclosure. The term“machine-readable storage medium” shall accordingly be taken to include, but not be limited to, solid-state memories, optical media and magnetic media.
  • the present disclosure also relates to an apparatus for performing the operations herein.
  • This apparatus may be specially constructed for the intended purposes, or it may comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer.
  • a computer program may be stored in a computer readable storage medium, such as, but not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, each coupled to a computer system bus.
  • the present disclosure may be provided as a computer program product, or software, that may include a machine-readable medium having stored thereon instructions, which may be used to program a computer system (or other electronic devices) to perform a process according to the present disclosure.
  • a machine-readable medium includes any mechanism for storing information in a form readable by a machine (e.g., a computer).
  • a machine- readable (e.g., computer-readable) medium includes a machine (e.g., a computer) readable storage medium such as a read only memory (“ROM”), random access memory (“RAM”), magnetic disk storage media, optical storage media, flash memory devices, etc.

Abstract

Aspects of the present disclosure calculate masked data shares dynamically inside the CPU boundary, and use a plurality of memory channels to write the masked data shares to an external memory location and/or to read the data shares from that external memory location. Each dynamically generated mask value is uniquely associated with a corresponding memory channel during writing data to the external memory. The modified masked data is unmasked or remasked during a subsequent read operation.

Description

SIDE-CHANNEL- ATTACK-RESISTANT MEMORY ACCESS ON EMBEDDED
CENTRAL PROCESSING UNITS
BRIEF DESCRIPTION OF THE DRAWINGS
[0001] The present disclosure will be understood more fully from the detailed description given below and from the accompanying drawings of various implementations of the disclosure.
[0002] FIG. l is a block diagram of the components of an embedded central processing unit (CPU) in accordance with some embodiments.
[0003] FIG. 2 is an example implementation of mask generation for side-channel attack resistant cryptographic operation, in accordance with embodiments of the present disclosure.
[0004] FIG. 3 is a flow diagram of an example method to write data to an external memory location, in accordance with some embodiments of the present disclosure.
[0005] FIG. 4 is a flow diagram of an example method to read data from an external memory location, in accordance with some embodiments of the present disclosure.
[0006] FIGs. 5A and 5B illustrate performance improvement against side-channel attack achieved by embodiments of the present disclosure.
[0007] FIG. 6 illustrates a block diagram of a sample computer system in which some embodiments of the disclosure may operate.
DETAILED DESCRIPTION
[0008] Aspects of the present disclosure are directed to secure exchange of masked data between an embedded central processing unit (CPU) and an external memory during
cryptographic operations. An integrated circuit having the embedded CPU may perform a cryptographic operation that may result in susceptibility of the integrated circuit to a side- channel analysis (SCA) attack where an attacker (e.g., an unauthorized entity) may obtain information as the cryptographic operation is performed. An example of a side-channel attack includes, but is not limited to, Differential Power Analysis (DPA) where the attacker who seeks to obtain a secret key used in the cryptographic operation may study the differences in power profile (i.e., power consumption patterns) of the integrated circuit as the cryptographic operation is performed. An attacker may be an unauthorized entity that may obtain the input (e.g., the secret key) to the cryptographic operation by analyzing power profile measurements of the integrated circuit over a period of time. Accordingly, when the sender transmits a ciphertext to a receiver by encrypting plaintext via a cryptographic operation, the attacker may be able to retrieve the secret key that is used to encrypt the plaintext to the ciphertext by observing the power profile of the integrated circuit as the cryptographic operation is performed to encrypt the plaintext into the ciphertext. For example, the attacker may uncover a cryptographic (e.g., secret or private) key that is used to encrypt the plaintext as the cryptographic operation is performed by the integrated circuit.
[0009] A key part of protecting embedded CPUs during a cryptographic operation is to protect the communication path from the CPU to the external memory (e.g., static Random Access Memory (SRAM) or other types of memory outside of the CPU) and vice versa. One way to protect the communication path is to use a masking technique to obfuscate the original data during CPU to memory communication. Masking may be implemented by Boolean or arithmetic techniques, both of which require splitting up the masked data into two or more shares. Each share is then independent of the original data and can be processed and stored individually without leaking information in side-channels. If the masked data is loaded to the CPU from external memory, the shares can be re-combined to reveal the original data again. This solution, however, incurs high overhead, because more external memory resource is required to store the two or more shares.
[0010] Aspects of the present disclosure address the above and other deficiencies by calculating masked data shares dynamically inside the CPU boundary (i.e., a trust boundary within which possibility of data leakage is minimal), and using a plurality of memory channels to write the masked data shares to an external memory location and/or to read the data shares from that external memory location. Each dynamically generated mask value is uniquely associated with a corresponding memory channel during writing data to the external memory. The modified masked data is unmasked during a subsequent read operation, and the unmasked data can be remasked again with a new mask, if necessary.
[0011] Note that in the specification,“dynamically” means substantially at the same time or without a perceptible delay (“on-the-fly”). In the context of computer operations,“dynamically” may mean during the running of a computer operation without interrupting the flow of the operation. Additionally, in this disclosure, Boolean operations (such as exclusive OR (XOR)) are shown as examples of masking techniques, though the scope of the disclosure is not limited to just Boolean masking. For example, pure arithmetic operation or a combination of Boolean and arithmetic operations, with appropriate mask conversions as necessary, is within the scope of this disclosure.
[0012] Advantages of the disclosed approach include prevention of data value leakage and/or data update/overwrite leakage inside the external memory and on the memory bus. The approach is also secure against microarchitecture-specific leaks (e.g., share cross-domain leaks, combination leaks, etc.).
[0013] An additional advantage of the approach disclosed herein is that the approach is agnostic of memory technology. For example, the methods are equally applicable to FPGA Block RAM, ASIC RAM macro cells, registers and any other type of memory technology. Furthermore, there is no significant impact on latency of the CPU performance, while the overall
implementation cost decreases because of zero overhead on external memory resource.
[0014] Fig. 1 illustrates an example CPU including a masked output generator module, in accordance with some aspects of the present disclosure. The CPU 100 may include internal memory (not shown) and various components/modules 110-160 used for cryptographic operations. Examples of such cryptographic operations include, but are not limited to, generating a digital signature to authenticate an integrated circuit containing an embedded CPU. Specific examples of types of cryptographic operations may be based on, but are not limited to, Secure Hash Algorithm (SHA)-l, SHA-2, Advanced Encryption Standard (AES), Data Encryption Standard (DES), etc.
[0015] As shown in Fig. 1, the CPU 100 may include, among other things, an input data receiving module 110, a random number generator module 120, a memory channel selector module 130, an external memory address module 140, a masked data generator module 150 and a data unmasking module 160. In alternative embodiments, the functionality of one or more of the modules may be combined or divided. The masked data generator module 150 and data unmasking module 160 may be implemented by or in processing logic that may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, integrated circuit, hardware of a device, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof.
[0016] The input data receiving module 110 may receive shares corresponding to an input data value. Note that the input data value may already be masked with an initial mask. For example, an underlying secret input data value‘d’ may be already masked by combining the value‘d’ with an initial mask‘ml’. The combination of the value‘d’ with the mask ml may be the first share (d Q ml). The mask value ml itself may be the second share. Additional random numbers generated by the random number generator module 120 may be added to the secret value‘d’ already masked with the first mask value‘ml’ within the CPU boundary, as further elaborated with reference to Fig. 2. The external memory address module 140 can maintain a table of memory addresses (e.g., all memory addresses) corresponding to the various memory locations in the external memory 240 shown in Fig. 2. Each memory location may be
addressable by a plurality of memory channels. The memory channel selector module 130 can select which memory channel is to be used to write data into a specific memory location with a specific memory address. The mask generator module 150 can be used to dynamically calculate a masked value to generate masked data (d Q m2) sent to the input data port 242 to be written into the external memory 240. The data unmasking module 160 can read the masked data (d Q m2) from the output data port 238 of the external memory 240, and retrieve original data‘d’ within the CPU boundary.
[0017] Fig. 2 details an example implementation of dynamically generating channel-specific mask values (m2) within the CPU boundary (shown by the dashed line 212 for writing to external memory 240) by the mask generation sub-component 218 (whose function may be performed by the masked data generator module 150 in Fig. 1). The mask generation sub component 218 can receive the address (mem address 210) of the memory location where masked data is to be written. The mask generation sub-component 218 can also receive information from the multiplexer 246 about what memory channel is to be used to write data. In the example illustrated in Fig. 2, four memory channels (0, 1, 2, 3) are shown that can be processed by the multiplexer 246 based on the channel select command 216, though any arbitrary number of channels may be used. Each channel is associated with a unique seed value (seed 1, seed 2, seed 3 and seed 4) stored in the corresponding registers 220, 222, 224 and 226. A corresponding mask value is calculated for each of the channels.
[0018] The mask value can be a function‘f of the known memory address (communicated via address port 236) and the unique seed value, i.e., maski = f (memory address, seedi), where is the index of each of the plurality of memory channels corresponding to the memory address associated with a specific memory location. The seed values can be generated by a random number generator within the CPU boundary to make it difficult for a side-channel attack, as knowing only the memory address is not sufficient to reveal the mask value. The channels can be reseeded, i.e. the seed values may be refreshed periodically or randomly. Reseeding can happen at different rates to improve the security of the implementation (e.g., key schedule v. crypto primitive, or CBC state v. internal crypto primitive state). The memory channel switch method described here is an efficient way to achieve a high level of security with less frequent reseeding. Note that the dynamically generated mask value‘m2’ shown in Fig. 2 does not necessarily indicate mask value calculated for channel 2, but represents mask value calculated for whichever channel is selected.
[0019] The embodiment illustrated in Fig. 2 also shows that the side-channel resistance mode (e.g., the DPAmode) can be turned on or off using a dedicated Instruction Set Extension (ISE) or a Control Status Register (CSR) sending a signal 244 to the multiplexer 248 and multiplexer 250. When DPA mode is on, the dynamically generated mask value m2 can be used for subsequent XOR operations 252 and 254.
[0020] When the DPA mode is on, the dynamically generated mask value m2 can be combined with the first masked share (d Q ml) of the input data by an XOR operation 252, the result of which (d Q ml Q m2) can be saved in register 232. Another XOR operation 256 involving the result saved at 232 and the other input share ml (saved at register 234) can generate the dynamically modified masked data (d Q m2) that is sent to the input data port 242 of the external memory 240 to be written at the targeted memory location. The target memory location can be addressed by the selected memory channel (which is not a physical channel) associated with calculated mask value m2.
[0021] In the embodiment shown in Fig. 2, an additional mask (m3) is generated within the CPU boundary to eventually retrieve the original secret value‘d’ which is masked with m2 during writing. In some implementations, the additional mask value m3 is not channel specific, but rather a random value generated within the CPU boundary. At XOR operation 254, when the DPAmode is on at multiplexer 248, the dynamically generated channel-specific mask value m2 can be combined with m3. The two shares of the XOR operation 254 (m3 Q m2) can be saved in register 228 and m3 itself can be saved in register 230. Knowing m3 enables the unmasking of the modified masked data (d Q m2).
[0022] For reading operations within the CPU boundary (indicated by dashed line 214), saved modified masked data (d Q m2) can be accessed from output data port 238 of the external memory 240, and an XOR operation 258 can be performed to generate shares (d Q m3) and m3. Thus, the original value of d can be retrieved.
[0023] Fig. 3 is a flow diagram of an example method 300 to perform a SCA-resistant data transfer between a CPU and an external memory during writing. The method 300 may be performed by processing logic that may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, integrated circuit, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof. In some embodiments, the method 300 may be performed by the components of CPU 100 shown in Fig. 1.
[0024] Referring back to Fig. 3, method 300 begins at block 310, where input data is received at the CPU. The input data is to be masked and written at an external memory location. Input data may be received at the input data receiving module 110 of the CPU 100, shown in Fig. 1. Input data may be already masked. Also, input data may be received in the form of a plurality of shares for further cryptographic operations. For example, in Fig. 2, the two input shares that are received are (d Q ml) and ml, where ml is an initial mask. Input data can be further masked before writing.
[0025] At block 320, a mask value is dynamically generated within the CPU boundary. The dynamically generated mask value m2 can be uniquely associated with the memory channel that is currently being used to address the memory location where the modified input data is to be written. As described above, m2 can be calculated as a function of the memory address and a unique seed value for the selected channel. The seed value can be a random number that may be generated by the random number generator module 120. In an alternative embodiment, the random number may also be stored within an internal memory (not shown in Fig. 1) within the CPU.
[0026] At block 330, the input data is modified with the dynamically generated mask value m2. This can be performed by the masked data generator module 150 in Fig. 1. In Fig. 2, this operation is shown as the XOR operation 256.
[0027] At block 340, the modified input data is stored in the external memory location. The modified input data can be communicated to the input data port 242 shown in Fig. 2. Note that during the sequence of operations performed within the CPU boundary, each of the intermediate values or any combination of intermediate values is statistically independent of the underlying secret value. Therefore, no direct-value leak is expected. Additionally, because the mask value m2 is dynamically generated based on which memory channel is currently being used, the modified masked value that is communicated outside of the CPU boundary 212 to the external memory 240 also keeps changing, thereby preventing possibility of information leakage during communication.
[0028] Fig. 4 is a flow diagram of an example method 400 to perform a SCA-resistant data transfer between an external memory and a CPU during reading. The method 400 may be performed by processing logic that may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, integrated circuit, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof. In some embodiments, the method 300 may be performed by module 160 of CPU 100 shown in Fig. 1.
[0029] Referring back to Fig. 4, method 400 begins at block 410, where the saved modified input data (e.g., data masked with the dynamically generated mask value m2) is read from the external memory location.
[0030] At block 420, the input data is retrieved by unmasking the modified input data. In the example embodiment illustrated in Fig. 2, the unmasking operation is shown as the XOR operation 258. The additional mask m3 generated within the CPU boundary and combined with the dynamically generated mask m2 by the XOR operation 254 helps removing m2during XOR operation 258. The output of the XOR operation 258 may be in the form of a plurality of data shares (e.g., one share is (d Q m3) and the other share is m3). The shares can be used within the CPU boundary for further cryptographic operations.
[0031] Note that though not shown in Fig. 4, the unmasking operations may be replaced by the remasking of the revealed data (or data shares) with another mask. [0032] Persons skilled in the art will understand that although the flow diagrams in Figs. 3 and 4 show a particular sequence or order, unless otherwise specified, the order of the processes can be modified. Thus, the illustrated embodiments should be understood only as examples, and the illustrated processes can be performed in a different order, and some processes can be performed in parallel. Additionally, one or more processes can be omitted in various
embodiments. Thus, not all processes are required in every embodiment. Other process flows are possible.
[0033] Figs. 5A-5B compare the performance of side-channels when the DPA protection scheme is off versus when the DPA protection scheme is off, according to some embodiments. The side-channels are marked a, b, c, ..., 1, m, n. Fig. 5 A shows 1.5 million power traces collected from unprotected (i.e. DPA protection off) side channels, showing prominent leakage from several channels. Fig. 5B shows 3 million power traces collected from protected (i.e. DPA protection on) side channels, showing leakage from only a few expected channels. As shown in Fig. 2, the DPA protection scheme may be turned on or off by the command 244 sent to multiplexers 248 and 250.
[0034] Fig. 6 illustrates an example machine of a computer system 600 within which a set of instructions, for causing the machine to perform any one or more of the methodologies discussed herein, may be executed. In alternative implementations, the machine may be connected (e.g., networked) to other machines in a LAN, an intranet, an extranet, and/or the Internet. The machine may operate in the capacity of a server or a client machine in client-server network environment, as a peer machine in a peer-to-peer (or distributed) network environment, or as a server or a client machine in a cloud computing infrastructure or environment.
[0035] The machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a cellular telephone, a web appliance, a server, a network router, a switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while a single machine is illustrated, the term“machine” shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.
[0036] The example computer system 600 includes a processing device 602, a main memory 604 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM), etc.), a static memory 606 (e.g., flash memory, static random access memory (SRAM), etc.), and a data storage device 618, which communicate with each other via a bus 630. In one implementation, processing device 602 may be an embedded CPU 100 in Fig. 1, and memory 606 may be external memory 240 shown in Fig. 2.
[0037] Processing device 602 represents one or more general-purpose processing devices such as a microprocessor, a central processing unit, or the like. More particularly, the processing device may be complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or processor implementing other instruction sets, or processors implementing a combination of instruction sets. Processing device 602 may also be one or more special-purpose processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), network processor, or the like. The processing device 602 is configured to execute instructions 626 for performing the operations and steps discussed herein.
[0038] The computer system 600 may further include a network interface device 608 to communicate over the network 620. The computer system 600 also may include a video display unit 610 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device 612 (e.g., a keyboard), a cursor control device 614 (e.g., a mouse), a graphics processing unit 622, a signal generation device 616 (e.g., a speaker), graphics processing unit 622, video processing unit 628, and audio processing unit 632.
[0039] The data storage device 618 may include a machine-readable storage medium 624 (also known as a computer-readable medium) on which is stored one or more sets of instructions or software 626 embodying any one or more of the methodologies or functions described herein. The instructions 626 may also reside, completely or at least partially, within the main memory 604 and/or within the processing device 602 during execution thereof by the computer system 600, the main memory 604 and the processing device 602 also constituting machine-readable storage media.
[0040] In one implementation, the instructions 626 include instructions to implement functionality corresponding to a masked output generator module 160 of Fig. 1. While the machine-readable storage medium 624 is shown in an example implementation to be a single medium, the term“machine-readable storage medium” should be taken to include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more sets of instructions. The term“machine-readable storage medium” shall also be taken to include any medium that is capable of storing or encoding a set of instructions for execution by the machine and that cause the machine to perform any one or more of the methodologies of the present disclosure. The term“machine-readable storage medium” shall accordingly be taken to include, but not be limited to, solid-state memories, optical media and magnetic media.
[0041] Some portions of the preceding detailed descriptions have been presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the ways used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of operations leading to a desired result. The operations are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like.
[0042] It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the above discussion, it is appreciated that throughout the description, discussions utilizing terms such as "identifying" or “determining” or "executing" or“performing” or“collecting” or“creating” or“sending” or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage devices.
[0043] The present disclosure also relates to an apparatus for performing the operations herein. This apparatus may be specially constructed for the intended purposes, or it may comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a computer readable storage medium, such as, but not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, each coupled to a computer system bus.
[0044] The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Various general purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct a more specialized apparatus to perform the method. The structure for a variety of these systems will appear as set forth in the description below. In addition, the present disclosure is not described with reference to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of the disclosure as described herein.
[0045] The present disclosure may be provided as a computer program product, or software, that may include a machine-readable medium having stored thereon instructions, which may be used to program a computer system (or other electronic devices) to perform a process according to the present disclosure. A machine-readable medium includes any mechanism for storing information in a form readable by a machine (e.g., a computer). For example, a machine- readable (e.g., computer-readable) medium includes a machine (e.g., a computer) readable storage medium such as a read only memory (“ROM”), random access memory (“RAM”), magnetic disk storage media, optical storage media, flash memory devices, etc.
[0046] In the foregoing specification, implementations of the disclosure have been described with reference to specific example implementations thereof. It will be evident that various modifications may be made thereto without departing from the broader spirit and scope of implementations of the disclosure as set forth in the following claims. The specification and drawings are, accordingly, to be regarded in an illustrative sense rather than a restrictive sense.

Claims

CLAIMS What is claimed is:
1. A computer-implemented method comprising:
receiving, at a central processing unit (CPU), input data that is to be masked and written at a memory location within an external memory coupled to the CPU, wherein the memory location is addressable by a plurality of memory channels;
dynamically generating, within a boundary of the CPU, a mask value uniquely associated with a memory channel of the plurality of memory channels that is currently being used to address the memory location; and
prior to writing at the memory location within the external memory, modifying, within the boundary of the CPU, the input data by masking the input data with the dynamically generated mask value.
2. The method of claim 1, wherein dynamically generating a mask value comprises:
calculating a plurality of mask values, each mask value of the plurality of mask values being uniquely associated with a respective memory channel, wherein each mask value is a function of a memory address of the memory location and a unique seed value corresponding to the respective memory channel.
3. The method of claim 2, wherein the unique seed value is randomly generated to make the respective memory channel protected against an attack based on differential power analysis (DPA).
4. The method of claim 2, wherein the unique seed value is refreshed periodically for reseeding the respective memory channel.
5. The method of claim 2, wherein the function is a pseudo-random function (PRF).
6. The method of claim 5, wherein the function is implemented using a cryptographic primitive.
7. The method of claim 6, wherein the cryptographic primitive comprises at least one of a block cipher, a stream cipher, or a hash function.
8. The method of claim 2, wherein the function generates a diffused output that is used as a mask value.
9. The method of claim 1, further comprising:
storing the modified input data at the memory location within the external memory.
10. The method of claim 9, further comprising:
reading the stored modified input data from the memory location within the external memory.
11. The method of claim 10, further comprising:
retrieving, within the boundary of the CPU, the input data by unmasking the modified input data.
12. The method of claim 10, further comprising:
remasking, within the boundary of the CPU, the modified input data with an additional mask.
13. The method of claim 12, wherein the additional mask is generated by a pseudo-random number generator (PRNG).
14. The method of claim 1, wherein a memory channel can dynamically access a plurality of memory addresses.
15. The method of claim 1, wherein the input data and the modified input data comprise a plurality of shares suitable for cryptographic operations.
16. The method of claim 15, wherein the cryptographic operations comprise Boolean operations, arithmetic operations or a combination of Boolean and arithmetic operations.
17. The method of claim 1, wherein the input data comprises original data that has already been masked by an initial mask.
18. A system comprising:
an external memory; and
a CPU, operatively coupled with the external memory, to:
receive input data that is to be masked and written at a memory location within the external memory, wherein the memory location is addressable by a plurality of memory channels;
dynamically generate, within a boundary of the CPU, a mask value uniquely associated with a memory channel of the plurality of memory channels that is currently being used to address the memory location; and prior to writing at the memory location within the external memory, modify, within the boundary of the CPU, the input data by masking the input data with the dynamically generated mask value.
19. The system of claim 18, wherein the CPU is further to:
retrieve, within the boundary of the CPU, the input data by unmasking the modified input data.
20. The system of claim 18, wherein the CPU is further to:
after reading the modified input data from the memory location within the external memory,
remask, within the boundary of the CPU, the modified input data with an additional mask.
PCT/US2020/021019 2019-03-05 2020-03-04 Side-channel-attack-resistant memory access on embedded central processing units WO2020181002A1 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CN202080018517.7A CN113518988A (en) 2019-03-05 2020-03-04 Side channel attack resistant memory access on embedded central processing unit
US17/435,360 US11914870B2 (en) 2019-03-05 2020-03-04 Side-channel-attack-resistant memory access on embedded central processing units
EP20766823.7A EP3935543A4 (en) 2019-03-05 2020-03-04 Side-channel-attack-resistant memory access on embedded central processing units

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US201962814169P 2019-03-05 2019-03-05
US62/814,169 2019-03-05

Publications (1)

Publication Number Publication Date
WO2020181002A1 true WO2020181002A1 (en) 2020-09-10

Family

ID=72337967

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2020/021019 WO2020181002A1 (en) 2019-03-05 2020-03-04 Side-channel-attack-resistant memory access on embedded central processing units

Country Status (4)

Country Link
US (1) US11914870B2 (en)
EP (1) EP3935543A4 (en)
CN (1) CN113518988A (en)
WO (1) WO2020181002A1 (en)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11843597B2 (en) * 2016-05-18 2023-12-12 Vercrio, Inc. Automated scalable identity-proofing and authentication process
US11604740B2 (en) * 2020-12-01 2023-03-14 Capital One Services, Llc Obfuscating cryptographic material in memory

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2438972A (en) 2006-06-07 2007-12-12 Samsung Electronics Co Ltd Encrypting data using an address associated with the data
US20130145177A1 (en) 2011-12-06 2013-06-06 Honeywell International Inc. Memory location specific data encryption key
US20150082435A1 (en) * 2012-04-25 2015-03-19 Inside Secure Cyclic redundancy check method with protection from side-channel attacks
US20160127123A1 (en) 2014-10-31 2016-05-05 Combined Conditional Access Development And Support, Llc Systems And Methods For Dynamic Data Masking
US20170288855A1 (en) * 2016-04-01 2017-10-05 Intel Corporation Power side-channel attack resistant advanced encryption standard accelerator processor

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH02254496A (en) * 1989-03-29 1990-10-15 Yamaha Corp Musical sound generating device
CN100507878C (en) * 2005-11-30 2009-07-01 株式会社东芝 Access control apparatus, access control method, memory access control device, and memory access control method
JP4643479B2 (en) * 2006-03-22 2011-03-02 株式会社東芝 ACCESS CONTROL DEVICE, ACCESS CONTROL SYSTEM, PROCESSOR, ACCESS CONTROL METHOD, AND MEMORY ACCESS CONTROL METHOD
US8051467B2 (en) * 2008-08-26 2011-11-01 Atmel Corporation Secure information processing
JP5483777B2 (en) * 2009-09-29 2014-05-07 ザムテック・リミテッド Communication system, method and device for restricting encryption key retrieval
US8732430B2 (en) * 2011-03-22 2014-05-20 Oracle International Corporation Method and apparatus for using unused bits in a memory pointer
CN104583961B (en) * 2012-08-14 2017-12-01 英派尔科技开发有限公司 Side-channel attack based on software prevents
US8843791B2 (en) * 2013-02-05 2014-09-23 Freescale Semiconductor, Inc. Memory error management system
EP3230921B1 (en) * 2014-12-08 2022-02-23 Cryptography Research, Inc. Multiplicative masking for cryptographic operations
US20160269175A1 (en) * 2015-03-09 2016-09-15 Qualcomm Incorporated Cryptographic cipher with finite subfield lookup tables for use in masked operations
US10121013B2 (en) * 2015-05-07 2018-11-06 Samsung Electronics Co., Ltd. XOR-based scrambler/descrambler for SSD communication protocols
US9910611B2 (en) * 2015-05-29 2018-03-06 Intel Corporation Access control for memory protection key architecture
US9785373B2 (en) * 2015-11-25 2017-10-10 International Business Machines Corporation Optimizing fine grained context addressability in highly dimensional environments using TCAM hybrid memory and storage architectures
EP3424175B1 (en) * 2016-03-03 2024-02-21 Cryptography Research, Inc. Converting a boolean masked value to an arithmetically masked value for cryptographic operations
US10936236B2 (en) * 2017-04-12 2021-03-02 Yazaki Corporation Rewriting system, rewriting device and computer
US11579881B2 (en) * 2017-06-29 2023-02-14 Intel Corporation Instructions for vector operations with constant values

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2438972A (en) 2006-06-07 2007-12-12 Samsung Electronics Co Ltd Encrypting data using an address associated with the data
US20130145177A1 (en) 2011-12-06 2013-06-06 Honeywell International Inc. Memory location specific data encryption key
US20150082435A1 (en) * 2012-04-25 2015-03-19 Inside Secure Cyclic redundancy check method with protection from side-channel attacks
US20160127123A1 (en) 2014-10-31 2016-05-05 Combined Conditional Access Development And Support, Llc Systems And Methods For Dynamic Data Masking
US20170288855A1 (en) * 2016-04-01 2017-10-05 Intel Corporation Power side-channel attack resistant advanced encryption standard accelerator processor

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3935543A4

Also Published As

Publication number Publication date
EP3935543A4 (en) 2022-05-11
US11914870B2 (en) 2024-02-27
EP3935543A1 (en) 2022-01-12
US20220147251A1 (en) 2022-05-12
CN113518988A (en) 2021-10-19

Similar Documents

Publication Publication Date Title
US11251935B2 (en) Multiplicative blinding for cryptographic operations
US20230379133A1 (en) Multiplicative masking for cryptographic operations
US8036379B2 (en) Cryptographic processing
US11863670B2 (en) Efficient side-channel-attack-resistant memory encryptor based on key update
US11728967B2 (en) Dynamic masking
CN110825672A (en) High performance autonomous hardware engine for online cryptographic processing
US10615959B2 (en) Memory device, host device, and memory system
Wang et al. Toward scalable fully homomorphic encryption through light trusted computing assistance
Rebeiro et al. Timing channels in cryptography: a micro-architectural perspective
US11914870B2 (en) Side-channel-attack-resistant memory access on embedded central processing units
US11463236B2 (en) Programmable block cipher with masked inputs
CN106462701B (en) Performing cryptographic data processing operations in a manner that is resistant to external monitoring attacks
Hu et al. Taming energy cost of disk encryption software on data-intensive mobile devices
US10333699B1 (en) Generating a pseudorandom number based on a portion of shares used in a cryptographic operation
US11303436B2 (en) Cryptographic operations employing non-linear share encoding for protecting from external monitoring attacks
Hammood et al. RC4 stream cipher with a random initial state
Fanfakh et al. Simultaneous encryption and authentication of messages over GPUs
US11924320B2 (en) Devices and methods for protecting cryptographic programs
Harini et al. Vulnerability analysis of FPGA through side-channel attacks in cloud
Zheng et al. An ultrafast cryptographically secure pseudorandom number generator
Damjanović et al. Tweakable parallel OFB mode of operation with delayed thread synchronization
US20220191004A1 (en) Functions with a pre-charge operation and an evaluation operation
Badhwar The future state of data security
Wang et al. HT2ML: An efficient hybrid framework for privacy-preserving Machine Learning using HE and TEE
Hafsa et al. A lightweight and robust block cipher algorithm for real-time applications

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20766823

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2020766823

Country of ref document: EP

Effective date: 20211005