Patent Publication Number: US-10771236-B2

Title: Defending against a side-channel information attack in a data storage device

Description:
SUMMARY 
     Various embodiments of the present disclosure are generally directed to a data storage device configured to defend against a side-channel information attack, such as a differential power analysis (DPA) attack. 
     In some embodiments, a programmable processor executes programming in a memory to perform a cryptographic function upon user data associated with a host command received from a host device. The cryptographic function involves multiple logical computations to arrive at an output value responsive to an input value over a time interval. 
     During the time interval, the programmable processor is repetitively interrupted by a plurality of interrupt calls respectively selected responsive to a first series of random numbers and resumes operation by a corresponding plurality of function return calls respectively selected responsive to a second series of random numbers. Each of the interrupt calls causes the programmable processor to temporarily suspend the multiple logical computations and perform at least one non-cryptographic function. 
     These and other features which characterize various embodiments of the present disclosure can be understood in view of the following detailed discussion and the accompanying drawings. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a functional block representation of a data storage system which operates in accordance with various embodiments of the present disclosure. 
         FIG. 2  shows a data storage device as in  FIG. 1  configured as a solid state drive (SSD) with solid-state non-volatile NAND flash memory cells to store data in accordance with some embodiments. 
         FIG. 3  shows a cryptographic algorithm block configured to carry out a cryptographic function upon input plaintext to form output cyphertext in some embodiments. 
         FIG. 4  shows a sequence of cryptographic functions that may be carried out in succession to effect the cryptographic algorithm of  FIG. 3 . 
         FIG. 5  is a functional block diagram of a system configured to carry out a differential power analysis (DPA) attack upon the data storage device of  FIG. 2 . 
         FIG. 6  is a graphical representation of exemplary data that may be recovered using the DPA attack equipment of  FIG. 5  in some embodiments. 
         FIG. 7  is a functional block diagram of operational circuits of the data storage device of  FIG. 2  configured in accordance with some embodiments to defeat the DPA attack equipment of  FIG. 5  in some embodiments. 
         FIG. 8  is a flow chart for a cryptographic processing routine illustrative of steps carried out by various embodiments to protect against DPA attacks such as illustrated in  FIGS. 5-6 . 
         FIG. 9  is a timing diagram illustrative of a process flow obtained by the execution of the routine of  FIG. 8 . 
         FIG. 10  is a graphical representation of exemplary data that may be recovered using the DPA attack equipment of  FIG. 5  resulting from the cryptographic processing routine of  FIG. 8 . 
     
    
    
     DETAILED DESCRIPTION 
     The present application is generally directed to data management in a data storage device, and more particularly to a method and apparatus for defending against a side-channel attack upon the data storage device, including but not limited to a differential power analysis (DPA) attack. 
     Data security schemes are used to reduce or eliminate unwanted access to data by unauthorized users of digital data storage systems. Data security schemes can employ a variety of security techniques in an effort to protect data. Some data security schemes employ cryptographic processes whereby data are processed, or encrypted, using a selected cryptographic algorithm to encode data in such a way that the underlying data cannot be easily recovered by an attacker. A wide variety of cryptographic functions are known in the art. 
     Cryptographic systems are generally operable to protect the underlying data from discovery. Even so, so-called side-channel attacks are often used by motivated attackers to glean side channels, or separate information streams, from a system that can ultimately reveal important information about the system, up to and including decoding of the data protected by the cryptographic algorithm. Side-channel attacks can take a variety of forms. 
     One common example of a side-channel attack involves monitoring a video channel of compressed data from a video source over time. If a camera or other data collection device captures video frames of a particular viewpoint and compresses the video data prior to transmission, the monitoring of a video stream of such data can indicate the presence (or absence) of a significant change in the viewpoint accessed by the camera. This is based on the recognition that highly compressed video data schemes tend to transmit successive frames of data with only the differences that were detected from one frame to the next. 
     If no significant changes have been detected in the field of view, the amount of transmitted data (and correspondingly, the amount of power or data packet size) should remain at a relatively low and constant value. On the other hand, a sudden increase in the amount of data transmitted would tend to indicate a significant change in the field of view has taken place, even if the underlying content of the visual content remained encrypted and undiscoverable. 
     Another well-known side-channel attack is sometimes referred to as a differential power analysis (DPA) attack. In a DPA context, an attacking party monitors differences in power consumption by an integrated circuit (IC) configured to carry out cryptographic functions. By comparing the power consumed by the IC in response to different input values, over time the attacker may be able to correlate certain inputs to different power consumption outputs. Given enough time, the attacker may be able to discern, from the information leaking from this side-channel path, the underlying cryptographic function that is being employed to encrypt the data, various encryption keys that are being used, and so on. Even if the underlying data cannot be retrieved, DPA attacks can still provide valuable information to an attacker regarding the construction and operation of the system. 
     Accordingly, various embodiments of the present disclosure are generally directed to a method and apparatus for configuring a data storage device to defeat or otherwise inhibit the effectiveness of a side-channel informational attack carried out upon a data storage device, including but not limited to a differential power analysis (DPA) attack. 
     As explained below, some embodiments generally involve using programming in a memory executed by a programmable processor to perform a cryptographic function involving multiple logical computations to arrive at an output value responsive to an input value over a time interval. 
     The cryptographic function is periodically interrupted over this time interval. The timing of these interrupts is based on a first series of random numbers. The duration of each of these interrupts is determined by a second series of random numbers. During each interrupted state, the processor executes one or more non-cryptographic functions (e.g., functions not related to the resolution of the cryptographic function). This disrupts the starting and ending points of the cryptographic function, as well as the power consumed by the processor during the execution of the cryptographic function, thereby increasing the difficulty of discerning the underlying cryptographic function during a side-channel attack. 
     These and other features and advantages of various embodiments can be understood beginning with a review of  FIG. 1  which provides a generalized functional block diagram of a data storage device  100 . The data storage device  100  includes a controller circuit  102  and a memory module  104 . The controller circuit  102  is a hardware-based or programmable processor that provides top level control of the device  100 . The memory module  104  comprises non-volatile memory such as but not limited to rotatable memory and/or solid-state memory. 
     The data storage device  100  can take any number of forms including a hard disc drive (HDD), a solid-state drive (SSD), a hybrid drive, an optical drive, a thumb drive, a memory card, integrated memory within an electronic device such as a computer, tablet, smart phone, appliance, work station, server, etc. The controller functionality can be incorporated directly into the memory module as desired. 
       FIG. 2  depicts aspects of a data storage device  110  generally similar to the data storage device  100  of  FIG. 1 . The device  110  is characterized as a solid state drive (SSD), although this is merely for purposes of illustration and is not limiting. 
     An SSD controller  112  generally corresponds to the controller circuit  102  of  FIG. 1  and may be realized as a hardware circuit and/or a programmable processor with associated programming stored in local SSD controller memory (MEM)  114 . An interface (I/F) circuit  116  coordinates transfers of commands and data between the SSD  110  and a host device. A buffer memory  118  may constitute volatile local buffer memory such as DRAM and/or SRAM to temporarily store user data during data transfer operations. 
     A read/write/erase (R/W/E) circuit  120  has the requisite functionality to carry out read, write (programming) and erasure functions upon a NAND flash memory array  122 . The R/W/E circuit  120  and NAND flash memory array  124  may be incorporated in the memory module  104  of  FIG. 1 . The memory array  122  may include two dimensional (2D) or three dimensional (3D) NAND flash memory cells. The memory array  122  may further comprise individual flash memory cells configured as single level cells (SLCs), multi-level cells (MLCs), three-level cells (TLCs), etc. 
     A power control circuit block is denoted at  124 . The power control circuit block  124  is operative to supply appropriate rail voltages (e.g., 3.3V, etc.) to the various circuits of the SSD  110  during powered operation. The power control circuit block  124  may receive input power from an external source, such as through the host interface, or may operate to convert input power from a locally supplied source such as battery power, an external AC power source, etc. 
       FIG. 3  shows a cryptographic algorithm block  130  which forms a portion of the SSD  110 , such as but not limited to the SSD controller  112 . The block  130  generally operates to transform input data (e.g., plaintext), into output data (e.g., ciphertext). This transformation is carried out using a selected cryptographic transform in accordance with one or more input parameters, such as an encryption key. Other input parameters can be used such as seed values, counter values, data addresses, etc. The process is symmetric so that the originally encrypted data (e.g., converted from plaintext to ciphertext) can be subsequently decrypted (e.g., converted from ciphertext to plaintext). While these processes are respectively referred to as encryption and decryption, as used herein the term encryption will cover both for simplicity. 
     It is contemplated that input user data supplied by the host device may be subjected to one or more levels of encryption to provide encrypted data that are stored by the NAND flash memory  122 . The plaintext data represented in  FIG. 3  may be in the form of unencrypted data, or may be data that have been previously encrypted by an upstream encryption process. Generally, a cryptographic function as defined herein is a function that is configured to increase the entropy of an input set of data toward the purpose of enhancing data security. 
     Substantially any cryptographic function can be used by the block  130  to transform the input data (e.g., plaintext or ciphertext) to provide the output data (e.g., ciphertext or plaintext), including but not limited to AES algorithms, hash functions, public/private key encryption algorithms, cipher block chaining (CBC) encryption algorithms, XTS mode (XOR/Encrypt/XOR based encryption with ciphertext stealing algorithms, etc. 
       FIG. 4  shows a simplified functional block representation of the operation of the cryptographic algorithm block  130  of  FIG. 3 , broken up into a sequence of individual function blocks  140  that represent a series of combinatorial functions (FCN( 1 ) to FCN( 4 )) that are successively carried out to perform the overall function of block  130 . It will be appreciated that the specific number and type of functions will depend upon the form of the underlying cryptographic algorithm of block  130 . Nevertheless, from  FIG. 4  it can be seen that, for a given cryptographic algorithm, there will be a defined sequence of operations (e.g., addition, multiplication, data shifts, etc.) that are sequentially employed to generate the output ciphertext irrespective of the value of the input plaintext. 
     This functional arrangement of the operation of block  130  is necessary to ensure that, whatever sequence of transformations have been applied to a given set of input data, such operations are both repeatable and reversible. A cryptographic function needs to be repeatable in such a way that, for a given input value (plaintext), the same output value (ciphertext) is produced each time, or is otherwise obtainable from the output value. A cryptographic function needs to be reversible in such a way that, for a given set of encrypted ciphertext, the originally presented input data can be extracted and returned. 
     It follows that substantially all cryptographic algorithms may be susceptible to one or more types of side-channel attacks to detect information that leaks from the system. This is true even if steps are taken to protect the particular sequence carried out by the cryptographic algorithm, as well as the various inputs (e.g., encryption keys, seed values, etc.). Of particular interest to the present discussion are differential power analysis (DPA) attacks, which can be used to disclose important information to an attacker which, in some cases, may enable the attacker to not only discern the type of encryption used, but can also reveal particular state values as well such as the individual encryption keys, seed values, etc. that were used in the encryption process. The various techniques disclosed herein, however, are suitable to protect against other forms of side-channel attacks as well. 
       FIG. 5  shows an evaluation system  150  used by an attacker to obtain information regarding the cryptographic algorithm utilized by block  130  in  FIG. 3 . It is presumed that the attacker has obtained physical custody and control of the SSD  110  and can access various circuits of the device, including the power control circuit block  124  of  FIG. 2 . 
     A differential power analysis (DPA) tester device  152  accesses the power control circuit block to observe the power drawn by the SSD  110  or individual circuits thereof (e.g., the SSD controller  112 ) during operation. In at least some cases, the tester device  152  operates as particular inputs are supplied to the cryptographic algorithm block  130 . Even if the tester  152  merely observes operation of the device  110  without being able to expressly enforce certain inputs, valuable information can still be collected over time with regard to the operation of the circuit. This output information can be collected by an output device  154 , which may include a visual display feature (e.g., a computer monitor, etc.). 
       FIG. 6  is a simplified DPA analysis diagram showing various DPA response curves  160 ,  170  and  180  that are obtained by the system  150  of  FIG. 5 . It will be appreciated that other forms of DPA data may be recovered, and that the waveforms are highly simplified (e.g., filtered) to facilitate the present discussion. Each of the respective curves  160 ,  170  and  180  capture power levels drawn by a selected circuit (e.g., the SSD controller  112 ) over a selected period of time for different inputs. It is contemplated that the waveforms show operation of the circuit to carry out the cryptographic algorithm of block  130  of  FIG. 3 . 
     As shown by the respective curves, there are periods of high power consumption, such as depicted by pulses  162  and  164  in curve  160 , and periods of low power consumption, such as depicted by region  166  in curve  160 . Curve  170  and  180  have similar features although of different magnitudes. Each of these respective areas roughly correlate in time with different starting and ending periods indicated by time indicies T 1 -T 4 . 
     Given sufficient time, resolution and input variability, a motivated attacking party may be able to discern, from these and similar waveforms, the underlying processing carried out by the circuit. For example, certain types of operations, such as multiplication, involving logical is may require more current draw than the same operations involving logical 0s. Even if the attacking party is not able to fully “break” the encryption code in use, valuable information can be gleaned from the ability to correlate the circuit response based on different inputs. 
     Accordingly,  FIG. 7  shows a defensive circuit  200  of the SSD  110  useful in defeating side-channel attacks and analyses as described by  FIGS. 5 and 6 . The circuit  200  may represent programming utilized by the SSD controller  112 , or may form some other aspect of the SSD  110 . It is contemplated that the various elements are implemented via one or more programmable processors utilizing associated programming instructions in memory, but the circuit  200  can additionally or alternatively be implemented using hardware circuitry as desired. The circuit  200  is initiated during each cryptographic processing operation carried out by the cryptographic algorithm block  130  of  FIG. 3  to encrypt or decrypt user data, as well as during other suitable times of the operation of block  130 . 
     To explain the operation of the circuit  200 , reference is initially made to a first random number generator (RNG  1 )  202 . The RNG  1  circuit  202  can take a variety of forms, including a table of previously generated random numbers, an entropy source and entropy extraction circuit, a cryptographic function, a ring oscillator circuit, etc. Generally, the RNG  1  circuit  202  is configured to output random or pseudo-random numbers over a selected range that approach truly random numbers. 
     The random numbers are contemplated as comprising multi-bit random values which are in turn selected, as required, by a first random number selection circuit (RNSC  1 )  204 . It is contemplated that the RNSC  1  circuit  204  will select a different random number each time the circuit  204  operates. In some cases, predetermined scripts of random numbers may be selected, so long as sufficient entropy is present to not enable the protection, as described below, to be detected, predicted, compensated and defeated. 
     Each selected random number is loaded to a first timer circuit (TC  1 )  206 , which initiates a count to mark a selected time interval having a duration corresponding to the selected random number. In some cases, the TC  1  circuit  206  may be a countdown timer so that the muti-bit random number initializes the timer, which proceeds to count down to 0 or some other final value at a suitable clock rate. Other forms of timer circuit can be used, so long as the circuit initiates a variable elapsed amount of time corresponding to the input selected random number. 
     At the conclusion of the time interval, the TC  1  circuit  206  provides an input to an interrupt generator circuit  208 , which in turn sends an interrupt to a cryptographic function circuit  210 . It is contemplated that the cryptographic function circuit  210  corresponds to the cryptographic algorithm block  130  and is carrying out, but has not yet completed, the execution of a selected cryptographic function upon input (plaintext) data when the interrupt is reached. When the interrupt is reached, the processor temporarily stops further operation of the cryptographic function, and as required stores various state variables and other data values to enable the processor to resume where it left off once the interrupt condition has been completed. 
     The interrupt may be characterized as a non-cryptographic function call (NC FCN Call). A single signal or multiple signals may be issued to effect this outcome. As shown by  FIG. 7 , the interrupt signals a second random number selection circuit (RNSC  2 )  212  to select a second random number from a second random number generator circuit (RNG  2 )  214 . In some cases, both of the random number generator circuits may be realized as a common circuit, or two separate sources of random numbers may be used as desired. 
     The RNSC  2  circuit  212  initiates a second timer circuit (TC  2 )  216  to initiate a second time interval responsive to the input random number from the RNSC  2  circuit. As before, the TC  2  circuit  216  may be a countdown timer that measures an elapsed period of time corresponding to the magnitude of the second input random number. Once this second interval of time is completed, a signal is output by the TC  2  circuit  216  to a return generator  218 , which provides a function return (RET) signal to the cryptographic function circuit  210 . Receipt of the return signal causes the cryptographic function circuit  210  to resume execution of the selected cryptographic function. 
     During the second elapsed period of time during which the cryptographic function circuit  210  is in an interrupted state, in preferred embodiments the circuit does not sit idle, but rather, initiates and performs a so-called non-cryptographic function, as indicated by block  220 . As used herein, the term “non-cryptographic function” refers to an operation that does not advance solution of the selected cryptographic function, but otherwise does involve some functional operation by block  210 . One reason for this is to disguise the power requirements associated with the selected cryptographic function; for example, having the circuit  220  merely sit idly may allow a motivated attacker to identify and discount any drops in power utilization during the interrupt periods. 
     Accordingly, the non-cryptographic function carried out during the interrupt period may in fact be a separate cryptographic function such as an encryption function that relies on other data, the results of which are discarded at the end of the interrupt period (or used for another data set). Other functions may include multiplication operations, division operations, addition, or other logical operations on any available data values, including but not limited to the random numbers available from RNG  1  and RNG  2   202 ,  214 . In still further embodiments, the non-cryptographic function may be the execution of a pending command or request associated with a different data set. 
     In some embodiments, the same non-cryptographic function is selected and executed during each interrupt period. In other embodiments, different functions with different power consumption profiles are available in a pool of such functions, as indicated by circuit block  222 . These different functions may be selected as required including by a third random number selection circuit (RNSC  3 )  224 , which may receive another random number from the RNG  2  circuit  214  (or other source). In this way, a randomly selected non-cryptographic function may be selected for execution during each interrupt period. 
     Once the interrupt period is completed and the cryptographic function circuit  210  resumes the calculations involved in the execution of the selected cryptographic algorithm, the return signal operates as a selection signal to the RNSC  1  circuit  204  to select a new random number from the RNG  1  circuit  202  and to reinitialize the TC  1  circuit  206 . In this way, the foregoing process of periodic interrupts and returns is continued a succession of times until the cryptographic function circuit  210  has completed the processing of the associated data. 
       FIG. 8  shows a flow chart for a cryptographic processing routine  230  illustrative of the foregoing steps. As before, it is contemplated albeit not required that the various steps are carried out by a programmable processor of the SSD controller  112  ( FIG. 2 ). The various steps are merely exemplary and may be appended, modified, carried out in a different order, etc. 
     At step  232 , a host command is received to transfer user data between the host device and the SSD  110 . The host command may take the form of a write command in which input user data received from the host device are to be encrypted prior to storage in the NAND flash memory array  122 . Alternatively, the host command may take the form of a read command in which previously stored and encrypted user data are subsequently retrieved, decrypted, and returned to the host device. Other forms of host commands may be received as well that initiate operation of the encryption/decryption functions of the SSD. 
     At step  234 , a selected cryptographic function is initiated upon selected user data associated with the host command. It is contemplated that the full execution of the cryptographic function will take place over a relatively short period of time. Nevertheless, the remaining steps shown in  FIG. 8  will be carried out multiple times prior to the conclusion of the execution of the cryptographic function. 
     A first random number is selected at step  236  for an interrupt (INT) timer, such as the TC  1  circuit  206  of  FIG. 7 . The timer is initiated at step  238  to count out an elapsed time interval corresponding to the first random number. Decision step  240  indicates passage of this elapsed time interval. 
     At the conclusion of the elapsed time interval, the cryptographic function of step  234  is temporarily interrupted and a selected non-cryptographic function is called and initiated, step  242 . A second random number is selected at step  244  for a return call (RC) interval, which is initiated at step  246  and monitored by step  248 . Once completed, a function return is signaled at step  250  and the system resumes processing at step  234 . 
     A timing diagram is represented at  260  in  FIG. 9  to illustrate operation of the routine  230  of  FIG. 8 . A sequence of cryptographic function (CF) blocks  262  and non-cryptographic function (NCF) blocks  264  are shown. Each is of variable length, providing different interrupt and return times during the cryptographic processing. 
       FIG. 10  shows a corresponding sequence of DPA curves  270 ,  280  and  290  generally illustrative of DPA results that may be observed through the operation of the routine of  FIG. 8 . As before with the curves in  FIG. 6 , each curve includes pulses such as  272 ,  274  in curve  270  and troughs such as  276  in curve  270 . The shapes and timing alignments are significantly different, however, as denoted by time indices T 1 -T 4 . These shifts in wave shape and timing reduce the ability of an attacking party from gleaning useful information in a side-channel attack. 
     While various embodiments have been directed to a data storage device such as an SSD, such is merely exemplary and is not limiting. The various embodiments can be readily adapted to substantially any environment in which cryptographic processing is applied to reduce leakage of side-channel information in a communication channel of a data storage device. 
     As used herein, the term “random numbers” and the like will be understood consistent with the foregoing discussion to describe “true” random numbers, numbers that are essentially indistinguishable from true random numbers, and pseudo-random numbers. 
     It is to be understood that even though numerous characteristics and advantages of various embodiments of the present disclosure have been set forth in the foregoing description, this description is illustrative only, and changes may be made in detail, especially in matters of structure and arrangements of parts within the principles of the present disclosure to the full extent indicated by the broad general meaning of the terms wherein the appended claims are expressed.