Abstract:
Embodiments of the invention prevent unauthorized access to electronic systems by providing an enclosure with improved intrusion detection around sensitive areas of a secured electronic system. Certain embodiments eliminate the need for constant battery power and yet provide uninterrupted high-security supervision at the device perimeter such that even following a power down event it is possible to determine whether a device has been tampered with, so that appropriate action can be taken. This is especially useful in applications in which batteries are not acceptable.

Description:
CROSS REFERENCE TO RELATED PATENT APPLICATIONS 
       [0001]    This application is related to and claims the benefit of U.S. Provisional Application No. 62/058556, titled “Tamper Detection Systems and Methods for Industrial &amp; Metering Devices not Requiring a Battery,” filed Oct. 1, 2014, listing inventors Yann Yves Rene Loisel, Frank Lhermet, and Alain-Christophe Rollet, which application is hereby incorporated herein by reference in its entirety. 
     
    
     BACKGROUND 
       [0002]    A. Technical Field 
         [0003]    The present invention generally relates to secure systems, and more particularly, to systems, devices, and methods of detecting tampering in electronic systems to prevent unauthorized access to sensitive data. 
         [0004]    B. Background of the Invention 
         [0005]    Secured electronic systems such as banking terminals protect valuable assets and encrypted sensitive data within a trusted environment to prevent unwanted access or inspection by potential attackers. Typical countermeasures against intruders who tamper with physical devices to gain access to secured sensitive data involve the implementation of a security perimeter around sensitive areas of the device. High-security physical protection includes the application of electric meshes and switches that aid in the detection of tampering attempts and raise a flag to signal the likelihood of an intrusion. Once an intrusion is detected, the secured system may, for example, erase its decryption keys and other sensitive information stored in usually stored in memory devices within a computer system to prevent capture of secret information by adversaries. 
         [0006]    Efficient security measures against physical tampering require 24/7 protection that constantly monitors the physical device that contains the sensitive information, i.e., the device must always remain in a power-on condition to prevent the possibility of unauthorized access during times when power is cut off. Alternatively, non-critical parts of the device may be turned off, while an energy source (e.g., a battery) provides sufficient energy to the device to maintain the security monitoring system in operating condition to continue to protect the most critical components and alert external devices, for example by sending an alarm, in order to ensure a desired level of protection. Thus, even if the secure device itself is completely powered down, the monitoring system remains permanently active and in control of the physical integrity of the device. 
         [0007]    Security monitoring systems containing protective electric meshes and other active parts are electrically operated and designed to detect any interruptions or modifications in the characteristic of a reference signal, such as a voltage or resistance value, as an indicator of a potential act of physical tampering. Battery power is generally sufficient to additionally monitor environmental conditions, such as temperature and vibrations resulting from shock events, to further increase system security. Especially, hardware security modules (HSMs) that require very high security for key storage and data rely on battery power to perform 24/7 monitoring, such that even in a power outage situation a battery-backed security monitoring system is in place that controls the security of the physical perimeter of the device and ensures that sensitive data is not accessed without authorization, recorded, or otherwise tampered with. Payment terminals and other devices containing secure microcontrollers use battery-backed security monitoring systems that have an average battery lifetime of about 7 years. This is appropriate in most instances as HSMs are generally obsolete and replaced within that time period, such that the battery lifetime exceeds the actual operating time of the device in the field. 
         [0008]    However, devices with rather long lifetimes, such as smart meters are expected to operate in the field for 30 years or more and practically without requiring any maintenance or, at least, with as little maintenance as possible. Given that even the most advanced batteries have a less than 10-year lifetime, this shortcoming renders protection of these devices ineffective once their batteries require replacement and power must be interrupted for a certain period of time to perform maintenance work. Similarly, for industrial devices that are located in remote places, such as oil or gas pipelines that are designed to operate as no-maintenance devices, replacing batteries in the field is not a viable solution due to the extremely high maintenance and support cost and, more importantly, security issues associated with powering down and opening a secure device that is intended to remain unopened. 
         [0009]    Currently, no practical solutions exist to ensure around-the-clock protection for high-security and long-life devices. Once the device is shut down, it is exposed and there is no security at all. Attackers may access the device, perform circuit modifications without being detected, and after the device is powered back up there is no information to indicate that the device has been invaded and manipulated in the meantime. The most sophisticated attackers may not even attempt to retrieve secrets during the power off stage, but instead, take the opportunity to install some electronic malicious code (e.g., a Trojan Horse) into the device, such that when the power is turned back on, the modifications that the attacker has performed can be used to intercept data and expose valuable assets (e.g., record and extract passwords) without leaving a trace that can be easily detected from a remote location. 
         [0010]    Therefore, what is needed are tools that provide uninterrupted high-security supervision at the device perimeter, such that even following a power down event, it is possible to determine whether the device has been tampered with, so that appropriate action can be taken. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0011]    Reference will be made to embodiments of the invention, examples of which may be illustrated in the accompanying figures. These figures are intended to be illustrative, not limiting. Although the invention is generally described in the context of these embodiments, it should be understood that this is not intended to limit the scope of the invention to these particular embodiments. 
           [0012]      FIG. 1  shows a prior art tamper detection system for providing device security. 
           [0013]      FIG. 2  is an exemplary block diagram of a system to provide tamper detection and prevent unauthorized access to secure electronic systems, according to various embodiments of the invention. 
           [0014]      FIG. 3  is an exemplary block diagram of an apparatus to provide tamper detection and prevent unauthorized access to secure electronic systems, according to various embodiments of the invention. 
           [0015]      FIG. 4  is a flowchart of an illustrative process process to provide tamper detection and prevent unauthorized access to secure electronic systems, in accordance with various embodiments of the invention. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0016]    In the following description, for the purpose of explanation, specific details are set forth in order to provide an understanding of the invention. It will be apparent, however, to one skilled in the art that the invention can be practiced without these details. One skilled in the art will recognize that embodiments of the present invention, described below, may be performed in a variety of ways and using a variety of means. Those skilled in the art will also recognize that additional modifications, applications, and embodiments are within the scope thereof, as are additional fields in which the invention may provide utility. Accordingly, the embodiments described below are illustrative of specific embodiments of the invention and are meant to avoid obscuring the invention. 
         [0017]    Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure, characteristic, or function described in connection with the embodiment is included in at least one embodiment of the invention. The appearance of the phrase “in one embodiment,” “in an embodiment,” or the like in various places in the specification are not necessarily referring to the same embodiment. 
         [0018]    Furthermore, connections between components or between method steps in the figures are not restricted to connections that are affected directly. Instead, connections illustrated in the figures between components or method steps may be modified or otherwise changed through the addition thereto of intermediary components or method steps, without departing from the teachings of the present invention. 
         [0019]    In this document the terms “mesh, mesh envelope, and mesh circuit” are used interchangeably as are the terms “key, secret key, and secret,” and “secure chip and smart card.” The term “secure device” includes secure microcontrollers, secure storage devices, and other secure elements recognized by one of skilled in the art. 
         [0020]      FIG. 1  shows a prior art tamper detection system to provide device security. System  100  is an electronic device designed to hold embedded assets, such as secret keys, e.g., for data encryption or decryption. System  100  comprises FPGA  102  and NAND  106 . FPGA  102  is an example of generic microcontroller that is connected to volatile or non-volatile memory NAND  106  via a synchronous serial data link, such as a Serial Peripheral Interface, here, quad SPI  104 . FPGA  102  is also connected to an additional communication channel, such as an internet port, USB, serial, 12C, or various peripheral devices. 
         [0021]    In operation, FPGA  102  plays a major role in system  100 . In addition to handling the embedded assets, FPGA  102  is designed to run applications of various sizes. NAND  106  receives decrypted executable code from FPGA  102  through quad SPI  104  for the purpose of performing computation or executing an application. In order to decrypt the code using a secret key, FPGA  102  uses an internal key from a storage location, for example, by using eFuse or similar technology. However, the safety measures employed by eFuse technology are not considered sufficiently secure to protect the key that remains within the FPGA  102  for the purpose of decrypting data or code received from NAND  106 . While FPGA  102  is designed to handle some secret data, in practice, developers usually are limited in their choice of a particular device for a specific technology and purpose. The engineering design selection is primarily based on electrical performance rather than the invariable security features of FPGA  102 . Once the eFuse key is known, attackers are able to decrypt everything in system  100 . Therefore, absent a secure protection envelope, FPGA  102  cannot be considered a highly secure component of system  100  and should not be used to protect high-value secrets from theft. 
         [0022]    In addition, sensitive information is handled in plain text format within device  100  itself. The decryption key is exposed in the path between the storage location of the key and FPGA  102 , such there is no active protection that would allow the key to be delivered under trustworthy conditions to ensure that motivated attackers cannot capture it to access the sensitive data. 
         [0023]    Assuming, a security mesh were to be used to protect FPGA  102 , as is the approach in some existing architectures, the integrity of the electrical mesh would still not be guaranteed, because the mesh that aids in security monitoring will be dependent on battery power to continually protect system  100 . In other words, once system  100  is inactive and no longer supplied with battery power, it is exposed to potential attackers who may open the device and, for example, manipulate system  100  to enable eavesdropping once power is restored. 
         [0024]    Therefore, to provide adequate protection with a higher level of confidence than at the parts level, it would be desirable to have a system and method to effectively protect against tampering attempts in a power-off stage and ensure secure transfer of sensitive data during regular operation. 
         [0025]      FIG. 2  is an exemplary block diagram of a system to provide tamper detection and prevent unauthorized access to electronic systems, according to various embodiments of the invention. System  200  comprises FPGA  202 , NAND  206 , smart card  208 , and mesh  210 . FPGA  202  is representative of any circuit or microcontroller connected, e.g., via quad SPI  204 , to volatile and non-volatile memory represented by NAND  206 . FPGA  202  may be connected to additional communication channels and devices (not shown). Smart card  208  represents a secure environment that provides relatively higher protection than FPGA  202  eFuse technology. Smart card  208  is considered inaccessible due to the high level of confidence its design provides in terms of security. 
         [0026]    In one embodiment, FPGA  202  uses a secret encryption/decryption key that may be stored in memory, for example, internal to smart card  208  to decrypt code located in external memory, e.g., in non-volatile NAND flash  206 , which may store code for some larger application, such as an operating system, that previously has been encrypted using the secret key held by smart card  206 . In one embodiment, a separate key within FPGA  202  itself may be used to run a relatively smaller non-sensitive code that does not contain any secrets. Smart card  208  is a secure device that typically requires no additional protection from unwanted access to secret data and the decryption key it holds. However, in a power-on condition, since the secret key is transmitted from smart card  208  to FPGA  202  in an unencrypted format, path  209  between smart card  208  and FPGA  202  is vulnerable to attack leaving information about the key exposed in the electrical connection and, thus, path  209  should be protected. As discussed in more detail below, meaningful protection can be accomplished by using an electric mesh  210  that covers both FPGA  202  and smart card  208  to protect transfer path  209 , thereby, creating a highly secure area of protected system  200 . 
         [0027]    Mesh  210  represents an envelope-like environment that is in close proximity to or entirely surrounds FPGA  202 , smart card  208 , and any other sensitive circuit component. To further increase security, mesh  210  may be implemented in multi-layer configuration. In one embodiment, only portions of system  200  that contain to-be-protected sensitive circuit elements are wrapped by the envelope of mesh  210 , which simplifies the design and reduces manufacturing costs. In one embodiment, mesh  210  represents a function that is designed to make it extremely difficult to reverse-engineer its configuration. Mesh  210  may be implemented as an electrical circuit capable of direct or indirect communication with FPGA  210  and smart card  208 . 
         [0028]    In operation, FPGA  202  is connected to protective mesh  210  and, at a power up condition, provides a value to mesh  210 . FPGA  202  or smart card  208  sends a query signal into mesh  210 , and depending on the result of the signal, system  200  detects whether mesh  210  has been modified as a result of an attempt to tamper with system  200 . The query signal may be a dynamic, random signal that is sent through the wires of mesh  210  to check their validity. If the response received from mesh  210  is valid, system  200  is ready to initiate its routine processes. After FPGA  202  receives from smart card  208  the correct secret key that can decrypt the encrypted code in external non-volatile NAND flash  206 , FPGA  202  can proceed with executing decrypted code, etc. 
         [0029]    In the event of tampering, however, the circuit characteristics of mesh  210  will be sufficiently different so as to indicate an electrical change when compared to the original, pre-attack condition of mesh  210 , which serves as a reference point. By causing a different signal than the expected reference signal, modified mesh  210  allows for the detection of unauthorized access, for example, during a power down event where an attack on system  200  is most likely to occur. Additional protection is provided by alerting system  200  of any tampering event on mesh  210 , thereby, significantly increasing the security of system  200 . 
         [0030]    In one embodiment, different or random patterns are employed for mesh  210  for each system  200  by taking advantage of, or even reinforce, intrinsic variations in the manufacturing process of mesh  210  based on printed electronics in order to obtain individualized mesh circuits with unique electrical characteristics. As a result, even if one device is stolen for the purpose of studying and reengineering its design, attackers&#39; efforts will be rendered useless by the uniqueness of each mesh circuit  210 , further increasing system security. 
         [0031]    In one embodiment, in a power-off condition, only smart card  208 , i.e., a highly secure environment that is considered impenetrable is used to store and sufficiently protect the smart card decryption key making the key inaccessible to potential intruders. The key and sensitive data are not exposed at all. In addition, any tampering with protective mesh  210  can be detected when power is turned back on, such that smart card  208  releases secrets only after verification that path  209  is secure, i.e., after verifying that mesh  210  has not been modified or tampered with during the power off session. 
         [0032]    Smart card  208  may be directly connected to mesh  210  so that it can directly verify the integrity of mesh  210  and, in effect, act as a boot controller for FPGA  202 . In this embodiment, verification by smart card  208  is a prerequisite to starting up FPGA  202  and smart card  208  releasing decryption key to FPGA  202 . In one embodiment, smart card  208  is connected to mesh  210  via FPGA  202  and releases secrets after a request by FPGA  202  accompanied by a verification of the integrity of mesh  210 . One skilled in the art, will appreciate that other, more complex topologies of connecting mesh  210  and smart card  208  may be employed without deviating from the scope of the invention. In either case, since smart card  208  transmits the secret key to FPGA  202  only under secure conditions, embodiments of system  200  ensure that no secret is accessible to attackers at any moment in time and that the security of system  200  has not been compromised. 
         [0033]      FIG. 3  is an exemplary block diagram of an apparatus to provide tamper detection and prevent unauthorized access to electronic systems, according to various embodiments of the invention. For clarity, components similar to those shown in  FIG. 2  are labeled in a similar manner. As shown in  FIG. 3 , apparatus  300  comprises FPGA  302 , smart card  308 , and Linear Feedback Shift Register (LFSR)  310 . In one embodiment, FPGA  302  acts as a conduit between smart card  208  and mesh  210  to facilitate a simpler connection between smart card  208  and mesh  210  than a direct connection. Smart card  306  is any highly secure device that comprises a secure element capable of storing a secret key and may be implemented as a chip that contains secrets and sensitive data used during regular operation when apparatus  300  is powered on. Smart card  306  typically has very limited computational power and is not used for extensive computations or the to execute larger applications. Instead, smart card  306  is mainly used to handle and store the secret data. LFSR  310  is an electrical circuit that physically surrounds, at least partially, FPGA  302  and smart card  308 . In one embodiment, LFSR  310  comprises printed transistors having logical functions such that LFSR  310  can be viewed as an electronic network whose electrical characteristic, in particular its transfer function, depends on its physical structure and method of fabrication. Once the input to LFSR  310  is known, its output will be a specific value that depends on both LFSR  310  itself and the input value. 
         [0034]    LFSR  310  may be constructed, for example, from conductive silver-carbon ink that is printed on a support surface made from PET, polyamid, or any other suitable electric insulator material or dielectric. The conductive but relatively fragile ink wire frame will be partially destroyed and cease to properly operate once it is physically tampered with. At the least, the electrical characteristics of LFSR  310  will be modified to such as degree that its circuit response will change sufficiently to be detected. In one embodiment, LFSR  310  is intentionally designed to exploit existing manufacturing variations in the generation of a random values during a validation process by making it impossible to compute or guess the electrical characteristic and network response of LFSR  310 . Constructing LFSR  310  different from one device to another frustrates re-engineering efforts of LFSR  310  and attempts by high-level attackers to use the knowledge gained from one device on a second device, in effect, creating a secret design. 
         [0035]    In operation, prior to using the decryption key stored in smart card  308 , FPGA  302  may initially use its own eFuse key stored internal to FPGA  302 , for example, in order to execute a small code during its booting process in power-on condition. The code causes FPGA  302  to send to smart card  306  a request for the decryption key. However, to increase the confidence level prior to validating the request, in one embodiment, smart card  306  does not rely on this request alone. Rather, smart card  306  initiates a validation process of the request by responding with its own request for an input challenge value from FPGA  302 , which may be an internally generated random value that cannot be easily guessed. In one embodiment, LFSR  310  is designed to receive the input challenge value from FPGA  302 , perform a mathematical operation or a computation based on the challenge, and return an appropriate result. In this regard, LFSR  310  can be viewed as a secret function. Since potential attackers cannot anticipate the exact challenge that smart card  306  will send to LFSR  310 , it will be virtually impossible to ascertain or re-compute the expected result. 
         [0036]    Even in the unlikely event that LFSR  310  itself is successfully reverse engineered at the physical level (i.e., the transistor level) by analyzing the structure without unfolding or physically flattening LFSR  310 , which would likely destroy its configuration, the uniqueness of the random sequences generated as a challenge by smart card  306  at each start-up make the combination of the input challenge and its response non-discoverable. 
         [0037]    Once FPGA  302  retrieves the result, for example in form of a circuit response to the input challenge, and forwards the result to smart card  306 , smart card  306  can then re-compute the result using a relatively simple function in order to verify that the result matches the challenge that smart card  306  previously generated. In one embodiment, smart card  306  compares its internally generated value to the value provided by LFSR  310  via FPGA  302 , and if smart card  306  successfully verifies the expected result, it concludes that LFSR  310  has not been modified, replaced, or otherwise tampered with, providing high confidence that apparatus  300  operates in a power-on and safe condition. Finally, smart card  306  may send the key to FPGA  302  for decryption of data stored on some internal or external memory and for FPGA  302  to proceed to operate as intended by loading and executing various applications. 
         [0038]    In the event that the function returned by LFSR  310  does not provide the correct result and the value that LFSR  302  computes is unacceptable to smart card  306 , smart card  306  will interpret this as an indication of a physical penetration of LFSR  302  or a tampering attack on apparatus  300  that likely occurred during the previous power off event. Smart card  306  may then take appropriate action, which may include the refusal to transmit the key in plain text to FPGA  302  in order to prevent a boot process or similar action. Additional or alternative countermeasures in the event of a lack in confidence that apparatus  300  has not been compromised may include sending an alarm to the firmware in order to identify the intrusion, permanently erasing secret keys, and performing a different routine in order to protect the overall system. 
         [0039]      FIG. 4  is a flowchart of an exemplary process to provide tamper detection and prevent unauthorized access to electronic systems, according to various embodiments of the invention. The process to provide tamper detection begins at step  402  when a microcontroller, such as an FPGA, sends to a smart card a request for a decryption key for code that is stored in some internal or external memory. At step  404 , the smart card receives the request and initiates validation of the request by responding with its own request for a challenge value. At step  406 , the FPGA sends the challenge to an envelope circuit, e.g., an LFSR. At step  408 , the LFSR answers by outputting a circuit response. At step  410 , the FPGA forwards the result to the smart card. Finally, at step  412 , once the smart card verifies the result, i.e., that it is the expected result matching the challenge, indicating that that circuit has not been modified or replaced, the smart card sends the key to the FPGA, so that the FPGA can decrypt the code and run the application. 
         [0040]    In one embodiment, the smart card is used as a boot controller to power up the FPGA. The smart card itself performs a validation of the challenge value sent to the envelope circuit and releases the decryption key to the FPGA only after successful validation. 
         [0041]    It will be appreciated by those skilled in the art that fewer or additional steps may be incorporated with the steps illustrated herein without departing from the scope of the invention. No particular order is implied by the arrangement of blocks within the flowchart or the description herein. 
         [0042]    It will be further appreciated that the preceding examples and embodiments are exemplary and are for the purposes of clarity and understanding and not limiting to the scope of the present invention. It is intended that all permutations, enhancements, equivalents, combinations, and improvements thereto that are apparent to those skilled in the art, upon a reading of the specification and a study of the drawings, are included within the scope of the present invention. It is therefore intended that the claims include all such modifications, permutations, and equivalents as fall within the true spirit and scope of the present invention.