Patent Description:
Duplication is well known approach to detect errors in digital circuits. It is widely used in safety devices to detect failures and in security devices to detect fault attacks. In the duplication approach, the original circuit is duplicated, the same inputs are applied to both original and duplicate circuits, and their outputs are compared for error detection. Optionally, inputs to the duplicate circuit may be delayed in comparison to the original circuit, and the comparison of the outputs is then also delayed. A big advantage of the duplication approach is that all errors in one of the circuits are detected. However, if the same error occurs in the original circuit as well as in the duplicate circuit, then the error cannot be not detected because both the circuits implement the same erroneous outputs. The probability of such an error is relatively low in the case of safety devices. It can be different for security devices because attackers can proactively try to exploit this known vulnerability of the duplication. The original circuit and the duplicate circuit are fully identical and will appear to be very similar in the layout. This fact may be used by attackers to identify locations to inject the same error in the original and duplicate circuits that then cannot be detected. The article titled "<NPL> discloses the implementation and characterisation of an AES accelerator embedding security features against physical attacks. In particular the design of an embedded cryptographic accelerator is described as well as the countermeasures that can be used to increase the resistance of the embedded cryptographic accelerators against physical attacks and ways and methods to evaluate the efficiency of such countermeasures are also disclosed.

A summary of various exemplary embodiments is presented below. Some simplifications and omissions may be made in the following summary, which is intended to highlight and introduce some aspects of the various exemplary embodiments, but not to limit the scope of the invention. Detailed descriptions of an exemplary embodiment adequate to allow those of ordinary skill in the art to make and use the inventive concepts will follow in later sections.

Various embodiments relate to a circuit system, including: an original circuit; a dual circuit, wherein the dual circuit is a dual of the original circuit; an input inverter connected to the dual circuit, wherein the input inverter inverts system inputs; an output inverter connected to one of the original circuit and the dual circuit, wherein the output inverter is configured to invert the output of the connected original circuit or dual circuit; a comparator configured to receive and compare the output of the output inverter and the output of one of the original circuit and the dual circuit not connected to the output inverter, wherein the comparator is configured to indicate an error when the received outputs are not identical and to indicate no error when the received outputs are identical, an input delay element connected to the input of one of the original circuit or the dual circuit; and an output delay element connected to the output of the other of the dual circuit or the original circuit.

Thus, in a first alternative, the input delay element is connected to the input of the original circuit; and the output delay element is connected to the output of the dual circuit.

In a second alternative, the input delay element is connected to the input of the dual circuit; and the output delay element is connected to the output of the original circuit.

Various embodiments are described, wherein the original circuit is a combinatorial logic circuit with a plurality of logic gates and the dual circuit has a plurality of dual logic gates corresponding to the plurality logic gates in the original circuit.

Various embodiments are described, wherein the original circuit includes a first and second sub-circuit connected by a first register, the dual circuit includes a first and second dual sub-circuit connected by a second register, the first and second dual sub-circuits are duals of the first and second sub-circuit, the first and second registers are configured to receive a reset signal, and one of the first and second resisters uses flip-flops with asynchronous reset and the other register uses flip-flops with asynchronous set.

Various embodiments are described, wherein the output inverter is connected to the original circuit.

Various embodiments are described, wherein the output inverter is connected to the dual circuit.

Further various embodiments relate to a system, wherein the system is a secure system.

Various examples are described, further including an input delay element connected to the input of the original circuit; and an output delay element connected to the output of the dual circuit.

Various examples are described, further including an input delay element connected to the input of the dual circuit; and an output delay element connected to the output of the original circuit.

Various embodiments are described, wherein the secure system is one of a secure processor, secure memory, cryptographic system, and secure controller.

Various examples are described, wherein the original circuit is a combinatorial logic circuit with a plurality of logic gates and the dual circuit has a plurality of dual logic gates corresponding to the plurality logic gates in the original circuit.

Various examples are described, wherein the original circuit includes a first and second sub-circuit connected by a first register, the dual circuit includes a first and second dual sub-circuit connected by a second register, the first and second dual sub-circuits are duals of the first and second sub-circuit, the first and second registers receives a reset signal, and one of the first and second resisters uses flip-flops with asynchronous reset and the other register uses flip-flops with asynchronous set.

Various examples are described, wherein the output inverter is connected to the original circuit.

Various examples are described, wherein the output inverter is connected to the dual circuit.

To facilitate understanding, identical reference numerals have been used to designate elements having substantially the same or similar structure and/or substantially the same or similar function.

The description and drawings illustrate the principles of the invention. It will thus be appreciated that those skilled in the art will be able to devise various arrangements that, although not explicitly described or shown herein, embody the principles of the invention and are included within its scope. Furthermore, all examples recited herein are principally intended expressly to be for pedagogical purposes to aid the reader in understanding the principles of the invention and the concepts contributed by the inventor(s) to furthering the art and are to be construed as being without limitation to such specifically recited examples and conditions. Additionally, the term, "or," as used herein, refers to a non-exclusive or (i.e., and/or), unless otherwise indicated (e.g., "or else" or "or in the alternative").

Embodiments are described where the duplicate circuit is implemented in a different way than the original circuit to make detecting the location of the identical positions in the duplicate circuits more difficult. As a result it is more difficult for the attacker to inject faults into the same locations of the different circuits to create an undetectable error. For this purpose, the duplicate circuit may be implemented as a dual circuit, i.e., a circuit that produces inverted outputs if inverted inputs are applied to it. The dual circuit is not identical to the original circuit and will look different in the layout. In addition, injection of an error into the dual circuit must be done in an inverted way as compared to the original circuit. For example, if injecting an error into the original circuit, a signal must be changed from <NUM> to <NUM>, then to inject an error into the dual circuit, the corresponding dual signal must be changed from <NUM> to <NUM>.

<FIG> illustrates the basic principle of error detection by duplication. The system <NUM> includes the original circuit <NUM> and a duplicate of the original circuit <NUM>. The same inputs are applied to the original circuit <NUM> and the duplicate circuit <NUM>. A comparator <NUM> compares the outputs of the original circuit <NUM> and the duplicate circuit <NUM>. If the outputs do not match, the comparator <NUM> outputs a signal indicating an error, otherwise the output signal of the comparator <NUM> indicates no error.

In other embodiments, the system <NUM> may include delay circuits <NUM> and <NUM>. The delay circuit <NUM> delays the input before it enters the duplicate circuit <NUM>, hence the output of the duplicate circuit <NUM> is delayed. The delay circuit <NUM> delays the output of the original circuit <NUM> before it is input into the comparator <NUM>. This allows the two signals input into the comparator <NUM> to be time aligned so that a proper comparison can be made between the outputs of the original circuit <NUM> and the duplicate circuit <NUM>. Because the inputs propagate through the original circuit <NUM> and <NUM> at different times, it is harder for an attacker to coordinate the attack on specific portions of the circuits. It is also possible for the delay circuits <NUM>, <NUM> to be located at the input to the original circuit <NUM> and the output of the duplicate circuit <NUM> instead, as this will have the same effect.

<FIG> provides a detailed diagram of system with a duplicate circuit with three inputs and two outputs. The system <NUM> includes original circuit <NUM>, duplicate circuit <NUM>, and comparator <NUM>. The original circuit <NUM> includes AND gate <NUM>, XOR gate <NUM>, AND gate <NUM>, OR gate <NUM>, and XOR gate <NUM> connected as shown. The original circuit <NUM> receives three inputs i1, i2, and i3 and produces two outputs o1 and o2. The duplicate circuit <NUM> is identical to the original circuit <NUM> and includes AND gate <NUM>, XOR gate <NUM>, AND gate <NUM>, OR gate <NUM>, and XOR gate <NUM> connected as shown. The comparator <NUM> receives the two outputs from the original circuit <NUM> and the two outputs from the duplicate circuit <NUM> and compares the first outputs o1 and the second outputs o2. The comparator will output an error signal if the two sets of outputs do not match, otherwise the comparator <NUM> outputs a signal indicating no error if the two sets of outputs do match.

In <FIG> if an attacker wants to attack the system <NUM> without detection an error needs to be injected into both circuits in the same place at the same time. In an example, the input is <NUM>, and the correct output is <NUM>. For example, if the output of the AND gate <NUM> is a <NUM> (when the input is <NUM>) and instead the attacker forces an output of the gate <NUM> to be <NUM>, the output will be <NUM>. Then the comparator <NUM> in the original circuit <NUM> will indicate an error because the duplicate circuit <NUM> will output the correct and different output value of <NUM>. If the attacker locates the AND gate <NUM> in the duplicate circuit <NUM>, and then if the attacker forces the output of the AND gate <NUM> to <NUM> instead of <NUM>, then the comparator <NUM> will not detect the error, because both the original circuit <NUM> and the duplicate circuit <NUM> will produce the same incorrect output of <NUM>.

The duplication approach may detect all errors in one of the circuits. However, the same error in the original and duplicate circuits, as demonstrated in <FIG>, cannot be detected. This is known vulnerability of the duplication approach. The attackers can try to exploit it, i.e., try to inject the same errors in both the circuits. To do this, they need to find corresponding positions in the original circuit <NUM> and the duplicate circuit <NUM>. Because the original circuit <NUM> and the duplicate circuit <NUM> are fully identical to each other, the positions may be identified relatively easy by looking at layout of the original circuit <NUM> and duplicate circuit <NUM>, because it may be assumed that the layouts of the circuits will be very similar.

In order to obfuscate the location of the positions where the same errors may be injected, the duplicate circuit may be implemented in a different way from the original circuit. This may be done by having the duplicate circuit be the dual or the original circuit. <FIG> illustrates a system <NUM> that includes an original circuit <NUM> and a dual of the original circuit <NUM>. The dual circuit <NUM> receives inverted inputs X (where X is input to the original circuit <NUM>) and produces an inverted output Y (where Y is the output to the original circuit <NUM>). The input X is inverted by the inverter <NUM>. The output of the original circuit <NUM> is inverted by inverter <NUM>. The comparator <NUM> then compares the inverted output from the inverter <NUM> and the output (which is also inverted) from the dual circuit <NUM>. The inverter <NUM> may invert either the output of the original circuit <NUM> or the dual circuit <NUM> before the comparison. In either case either outputs Y or Y are being compared at the comparator <NUM>.

<FIG> illustrates a detailed circuit diagram of a system with an original circuit <NUM> and its dual circuit <NUM> with three inputs and two outputs. The system <NUM> includes original circuit <NUM>, dual circuit <NUM>, inverters <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and comparator <NUM>. The original circuit <NUM> includes AND gate <NUM>, XOR gate <NUM>, AND gate <NUM>, OR gate <NUM>, and XOR gate <NUM> connected as shown. The original circuit <NUM> receives three inputs i1, i2, and i3 and produces two outputs o1 and o2. In order to generate the dual circuit, AND gates are replaced by OR gates, OR gates are replaced by AND gates, XOR gates are replaced by XNOR gates, XNOR gates are replaced by XOR gates, buffers are replaced by inverters, inverters are replaced by buffers, and any other type of original gates are replaced by their dual gates. Accordingly, the dual circuit <NUM> is obtained from the original circuit <NUM> by performing the following substitutions: AND gate <NUM> is replaced by OR gate <NUM>; XOR gate <NUM> is replaced by XNOR gate <NUM>; AND gate <NUM> is replace by OR gate <NUM>; OR gate <NUM> is replaced by AND gate <NUM>; and XOR gated <NUM> is replaced by XNOR gate <NUM>.

The inverters <NUM>, <NUM>, <NUM> are shown as inverting the inputs i1, i2, i3 received by the dual circuit <NUM>. The inverters <NUM>, <NUM> invert outputs o1, o2 of the dual circuit. Likewise, the inverters <NUM>, <NUM> may instead invert the outputs of the original circuit <NUM>. The comparator <NUM> receives the two outputs from the original circuit <NUM> and the two inverted outputs from the duplicate circuit <NUM> and inverters <NUM>, <NUM> and compares the outputs respectively. The comparator will output an error signal if the two sets of outputs do not match, otherwise the comparator <NUM> outputs a signal indicating no error if the two sets of out do match.

In <FIG> if an attacker wants to attack the system <NUM> without detection an error needs to be injected into both circuits in equivalent places at the same time. In an example, the input is <NUM> and the correct output is <NUM>. For example, if the output of the AND gate <NUM> is a <NUM> and instead the attacker forces an output of the AND gate <NUM> to be <NUM>, the output will be <NUM>, and then the comparator <NUM> in the original circuit <NUM> will indicate an error because the dual circuit <NUM> will output <NUM> will be inverted to <NUM> which is different from the output of the original circuit <NUM>.

Now if the attacker locates the dual OR gate <NUM> in the dual circuit <NUM>, and then if the attacker forces the output of the OR gate <NUM> to <NUM>, there is no change in the output because in the dual circuit <NUM> the output of the OR gate <NUM> is already <NUM>. Accordingly, the comparator <NUM> will detect the error, because the output of the original circuit <NUM> and the inverted output of the dual circuit <NUM> will be different.

In order for the attacker to cause an undetectable error, they would need to identify the dual element in the dual circuit and know to invert the error value (e.g., a <NUM> -> <NUM> change in the original circuit would become a <NUM> -> <NUM> change in the dual circuit) from the original circuit. As the dual circuit would have a different layout, optically or visually identifying the dual circuit elements will become difficult for an attacker. Thus, identifying the dual circuit element and inverting the forced error becomes difficult for an attacker and provides improved resistance to attacks.

The circuits in the above examples contain only combinatorial logic. <FIG> illustrates an example where the original circuit includes sequential logic (i.e., registers). The system <NUM> in <FIG> is similar to the system of <FIG>, but instead the original circuit <NUM> includes sub-circuits <NUM>, <NUM>, <NUM>, which are implemented as combinatorial logic, and register stages <NUM>, <NUM> between the sub-circuits. The dual circuit <NUM> is derived from the original circuit <NUM> as follows: gates in the combinatorial sub-circuits <NUM>, <NUM>, <NUM> of the original circuit <NUM> are replaced by their dual gates as previously described, i.e., AND gates by OR gates, XOR gates by XNOR gates etc.; and registers of the original circuit are replaced by registers which have inverted reset inputs (that is flip-flops with asynchronous reset are replaced by flip-flops with asynchronous set, and vice versa), so that after reset they will contain inverted values in comparison to the values in the registers in the original circuit.

As previously discussed, delays may also be used to further make it difficult for the attacker effectively attack the operation of the original circuit without detection. Accordingly, variations of the systems are possible regarding the location of the inverters and the delay elements (if used) in order to implement the detection of errors in the original circuit. The use of the dual architecture obscures the architecture of the dual circuit as compared to the original circuit. This makes it harder for an attacker to identify the dual circuit as corresponding to the original circuit and to determine the location of the dual circuit elements corresponding to elements in the original circuit. Further, the fact that the logic is inverted in the dual circuit is another factor that the attacker would have to comprehend and then counter. Accordingly, the embodiments described herein improve the security of the system in resisting attacks.

The embodiments described herein may be implemented in various types of secure circuits including, for example, processors, storage, controllers, cryptographic systems, etc. Further, these embodiments may be implemented in various types of safety devices including, for example, automotive devices, medical devices, etc. The embodiments described herein will improve the ability of secure systems to resist hardware attacks by attackers.

Claim 1:
A circuit system (<NUM>), comprising:
an original circuit (<NUM>);
a dual circuit (<NUM>), wherein the dual circuit is a dual of the original circuit;
an input inverter (<NUM>) connected to the dual circuit, wherein the input inverter inverts system inputs;
an output inverter (<NUM>) connected to one of the original circuit and the dual circuit, wherein the output inverter is configured to invert the output of the connected original circuit or dual circuit; and
a comparator (<NUM>) configured to receive and compare the output of the output inverter and the output of one of the original circuit and the dual circuit not connected to the output inverter, wherein the comparator is configured to indicate an error when the received outputs are not identical and to indicate no error when the received outputs are identical, characterised in that the circuit system further comprises
an input delay element connected to the input of one of the original circuit (<NUM>) or the dual circuit (<NUM>); and
an output delay element connected to the output of the other of the dual circuit (<NUM>) or the original circuit (<NUM>).