Patent Description:
<FIG> shows a block diagram of an exemplary digital processing system <NUM>, such as a micro-controller.

In the example considered, the processing system <NUM> comprises a microprocessor <NUM>, usually the Central Processing Unit (CPU), programmed via software instructions. Usually, the software executed by the microprocessor <NUM> is stored in a non-volatile program memory <NUM>, such as a Flash memory or EEPROM. Thus, the memory <NUM> is configured to store the firmware of the processing unit <NUM>, wherein the firmware includes the software instructions to be executed by the microprocessor <NUM>. Generally, the non-volatile memory <NUM> may also be used to store other data, such as configuration data, e.g., calibration data. The microprocessor <NUM> usually has associated also a volatile memory 104b, such as a Random-Access-Memory (RAM). For example, the memory 104b may be used to store temporary data.

As shown in <FIG>, usually the communication with the memories <NUM> and/or 104b is performed via one or more memory controllers <NUM>. The memory controller(s) <NUM> may be integrated in the microprocessor <NUM> or connected to the microprocessor <NUM> via a communication channel, such as a system bus of the processing system <NUM>. Similarly, the memories <NUM> and/or 104b may be integrated with the microprocessor <NUM> in a single integrated circuit, or the memories <NUM> and/or 104b may be in the form of a separate integrated circuit and connected to the microprocessor <NUM>, e.g., via the traces of a printed circuit board.

In the example considered, the microprocessor <NUM> may have associated one or more (hardware) resources/peripherals <NUM> selected from the group of:.

Accordingly, the digital processing system <NUM> may support different functionalities. For example, the behavior of the microprocessor <NUM> is determined by the firmware stored in the memory <NUM>, e.g., the software instructions to be executed by a microprocessor <NUM> of a micro-controller <NUM>. Thus, by installing a different firmware, the same hardware (micro-controller) can be used for different applications.

<FIG> shows a typical operation of the software executed by the microprocessor <NUM>.

Specifically, after a start step <NUM>, the microprocessor <NUM> executes at a step <NUM> one or more software instructions, e.g., in the form of a software subroutine, which generate a given result RES. For example, for this purpose, the microprocessor may execute one or more processing operations and/or interact with one or more peripherals <NUM>. For example, the result RES may indicate that a password verification was successful or the result of a cryptographic operation.

At a step <NUM>, the microprocessor <NUM> may then execute one or more software instructions in order to compare the result RES with an expected result ERES. In case the result RES corresponds to the expected value ERES (output "Y" of the verification step <NUM>), the microprocessor <NUM> executes at a step <NUM> a given first software subroutine, e.g., a routine being started when the correct password has been provided or when the encrypted/decrypted correspond to an expected value.

Conversely, in case the result RES does not correspond to the expected value ERES (output "N" of the verification step <NUM>), the microprocessor <NUM> executes at a step <NUM> a given second software subroutine, e.g., an error handler routine.

Once the routine <NUM> or <NUM> has been executed, the microprocessor <NUM> may execute further software instructions or the processing operations may be stopped at a stop step <NUM>.

For example, in higher-level programming languages, such as C, the conditional statement at the step <NUM> is usually expressed via IF/ELSE statements.

However, as shown in <FIG>, a typical microprocessor uses indeed an instruction pointer/program counter PC indicating a memory location, typically in the non-volatile program memory <NUM>, containing the software instruction to be executed.

Accordingly, in this case, the software instructions implementing the operations <NUM> are stored to a given memory area of the memory <NUM> and the microprocessor executes sequentially the instructions by increasing the program counter PC. However, in order to implement the IF/ELSE condition, the first routine <NUM> and the second routine <NUM> are stored to respective (different) memory locations. For example, this is shown in <FIG>, where the routine <NUM> starts at a memory address func_ok and the routine <NUM> starts at a (different) memory address func_fail.

Accordingly, in this case, the step <NUM> is implemented via software instructions configured to instruct the microprocessor <NUM> to selectively jump to the memory address of the first routine <NUM> (func_ok) or the second routine <NUM> (func_fail). For example, in this case, the verification step <NUM> is usually implemented with at least one conditional jump operation. For example, the software instructions <NUM> may comprise the following machine code instructions, which are expressed in assembly code:
CMP RES, ERES
JE func_ok
JMP func_fail.

Specifically, the first instruction (CMP) compares the value RES with the expected result ERES and asserts a flag when the value RES and ERES correspond, i.e., when RES = ERES. Generally, this instruction may indeed be implemented with a plurality of instructions, e.g., in order to load the values RES and/or ERES to internal registers of the microprocessor <NUM>.

Next the instruction JE (jump if equal) implements a conditional jump, which jumps to the address func_ok, i.e., sets the program counter PC to the address func_ok, when a flag of the microprocessor indicates that the previous comparison operation verified that the values are equal, for example when a zero flag ZF is asserted. Finally, the third instruction jumps to the address func_fail, i.e., sets the program counter PC to the address func_fail. Specifically, this instruction is only executed when the previous instruction JE not already jumps to the address func_ok.

Typically, modern microprocessors <NUM> support various types of conditional jump statements, which permit to verify whether one or more flags are set by the previous instructions, such as a carry flag CF and/or the zero flag ZF.

The inventors have observed that such IF/THEN statements, and in particular the respective conditional jump statements, e.g., obtained by compiling a higher-level programming language, such as C, may be rather dangerous from a security point of view. Specifically, recently it has been demonstrated that an attacker may modify the comparison result, e.g., assert the flag ZF, whereby the routine <NUM> is started, even when the result RES does not correspond to the expected result ERES. Accordingly, in this way, an attacker may force the execution of the routing <NUM>, even though the result RES does not correspond to the expected result ERES.

In security related applications it has thus been proposed to use several invocations of the routine <NUM>, and the routine func_ok is only started if and only if all of them return the expected value ERES. Alternatively, nested duplications of several conditional checks <NUM> may be used to force the attacker to perform several faults at precise locations.

However, the inventors have observed that the above solutions have various disadvantages. Specifically, even when implementing plural verifications <NUM>, such verifications are still based on conditional jump operations, whereby the respective jump operation is an explicit branch based on a successful comparison, and an attacker could still find the way to jump to that instruction just flipping branch flags.

Further relevant documents in the field are: <CIT>, <CIT>, <CIT>.

In view of the above, various embodiments of the present disclosure provide solutions for starting a first or a second software routine based on the result RES obtained by a previous software routine.

According to one or more embodiments, the above objective is achieved by means of a method having the features specifically set forth in the claims that follow. Embodiments moreover concern a related processing system, as well as a corresponding computer program product, which can be loaded into the memory of at least one microprocessor and comprises portions of software code for implementing the steps of the method when the software code is run on the microprocessor. As used herein, reference to such a computer program product is understood as being equivalent to reference to a computer-readable means containing software instructions for controlling a microprocessor in order to co-ordinate execution of the method.

The claims are an integral part of the technical teaching of the disclosure provided herein.

As mentioned before, various embodiments of the present disclosure relate to solutions, in particular respective software instructions, for operating a microprocessor, such as a microprocessor of a microcontroller. The microprocessor has associated a memory comprising a first software routine stored to a first memory area starting at a first address and a second software routine stored to a second memory area starting at a (different) second address. Specifically, in various embodiments, the microprocessor obtains data and an expected value, and is configured to start the first software routine when the obtained data correspond to the expected value. Conversely, the second software routine may correspond to an error handler routine. For example, the obtained data may correspond to a password, a calculated hash code or a calculated signature, and the expected value may correspond to an expected password, a hash code or signature, respectively.

Specifically, in various embodiments, the microprocessor generates a first result and a second result by combining the obtained data with the expected value exclusively via first combinational and/or arithmetic operations. Specifically, the first combinational and/or arithmetic operations are configured to, when the obtained data correspond to the expected value, set the first result to a first predetermined value and the second result to a second predetermined value, wherein the second predetermined value has a bit sequence being different from the bit sequence of the first predetermined value. In general, the microprocessor may also generate further results.

In various embodiments, the microprocessor obtains then the first address and the second address, and generates an address pointer by combining the first result, the second result, the first address and the second address exclusively via second combinational and/or arithmetic operations. Specifically, when the first result corresponds to the first predetermined value and the second result corresponds to the second predetermined value, the second combinational and/or arithmetic operations are configured to assign to the address pointer the value of the first address. Conversely, when the first result does not correspond to the first predetermined value or the second result does not correspond to the second predetermined value, the second combinational and/or arithmetic operations are configured to assign to the address pointer the value of the second address.

Finally, in various embodiments, the microprocessor jumps to the address pointer, thereby executing the first software routine when the data correspond to the expected value.

Accordingly, in various embodiments, the software instructions used to implement the first combinational and/or arithmetic operations, the second combinational and/or arithmetic operations and the jump operation, do not use conditional jump instructions, thereby avoiding the previously mentions security risks.

Generally, when the obtained data do not correspond to the expected value, the first combinational and/or arithmetic operations may assign any other value to the first and second results.

For example, in various embodiments, when the obtained data do not correspond to the expected value, the first combinational and/or arithmetic operations are configured to set the first result to the second predetermined value and the second result to the first predetermined value, i.e., the result values are inverted. In this case, the second combinational and/or arithmetic operations may be configured to generate the address pointer via a swap function. Specifically, when the first result corresponds to the first predetermined value and the second result corresponds to the second predetermined value, the second combinational and/or arithmetic operations assign to the address pointer the value of the first address. Conversely, when the first result corresponds to the second predetermined value and the second result corresponds to the first predetermined value, the second combinational and/or arithmetic operations assign to the address pointer the value of the second address.

As mentioned before, when the obtained data do not correspond to the expected value, the first combinational and/or arithmetic operations may also assign different values. For example, in various embodiments, the first combinational and/or arithmetic operations are configured to generate the first result and/or the second result by combining the data, the expected value and the respective predetermined value via exclusive OR operations. Alternatively, the first combinational and/or arithmetic operations may combine the data and the expected value via an exclusive OR operation, and add the respective predetermined value.

In this case, the microprocessor may be configured to use an additional mapping function, which then permits to use again the swap function. Additionally or alternatively, the software instructions may comprise, between the first combinational and/or arithmetic operations and the second combinational and/or arithmetic operations, one or more conditional jump operations configured to, when the first result does not correspond to the first predetermined value or the second result does not correspond to the second predetermined value, jump to the second address. As will be described in greater detail in the following, this may not represent a particular security risk when the second address points to an error handler routine.

Embodiments of the present disclosure will now be described with reference to the annexed drawings, which are provided purely by way of non-limiting example and in which:.

In the following description, numerous specific details are given to provide a thorough understanding of embodiments. The embodiments can be practiced without one or several specific details, or with other methods, components, materials, etc. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the embodiments.

Reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment.

As mentioned before, various embodiments of the present disclosure provide solutions for starting a first software routine <NUM> or a second software routine <NUM> based on the result RES obtained by a previous software routine. Specifically, similar to <FIG>, the software routines <NUM> and <NUM> may be stored to respective memory areas in the non-volatile memory <NUM>, wherein the software routine <NUM> starts at an address func_ok and the software routine <NUM> starts at an address func_fail, wherein the address func_fail is different from the address func_ok.

<FIG> shows an embodiment of the operation of a microprocessor <NUM> according to the present invention. Reference can be made to <FIG> for a general description of the operation of a microprocessor <NUM> and a respective processing system <NUM>, such as a micro-controller.

Specifically, after a start step <NUM>, the microprocessor <NUM> executes at a step <NUM> again one or more software instructions, e.g., in the form of a software subroutine, which generate a given result RES. Specifically, in various embodiments, the instructions <NUM> generate at least a first result RES1 and one or more further results, such as results RES2, RES3,.

Specifically, in various embodiments, each of the results RES1,. RESN corresponds to a bit-sequence having a given number of bits, such as <NUM>, <NUM>, <NUM> or <NUM> bit. For example, in various embodiments, the microprocessor <NUM> operates with a given word size, such as <NUM>, <NUM>, <NUM> or <NUM> bits, and each result RES1,. RESN has the word size of the microprocessor <NUM>. Generally, the encoding of the bits of the results RES1,. RESN is not relevant for the scope of the present disclosure. For example, the bit sequence of the results RES1,. RESN may correspond to a signed or unsigned integer value, or any other encoded bit sequence.

For example, in various embodiments, the step <NUM> implements the following function "secure_comparison":
RES1 = secure_comparison (B1, B2, [L], RES2 [,. RESN]) where B1 and B2 identify the data to be compared, e.g., respective pointers to memory locations having stored a value (B1) to be compared with an expected value (B2), L is an optional parameter indicating the length of the data to be compared, and RES1, RES2 and the optional further results indicate the result of the comparison, e.g., in the form of respective pointers to memory locations used to store the respective comparison result RES1,. RESN, i.e., at the end of the routine secure_comparison, the respective memory locations have stored the respective results RES1,.

For example, in various embodiments, the routine <NUM> is configured to set each of the results RES1,. RESN to a respective first predetermined value ERES1,. ERESN when the data B1 correspond to the data B2, or when using the parameter L, when the indicated number L of bits or bytes of the data B1 corresponds to the respective indicated number of bits or bytes of data B2. Generally, the routine <NUM> may assign any other value (being different from the respective first predetermined value ERES1,. ERESN) to the results RES1,. RESN when the data B1 do not correspond to the data B2, or when using the parameter L, when the indicated number L of bits or bytes of the data B1 does not correspond to the respective indicated number of bits or bytes of data B2. For example, in various embodiments, the routine <NUM> is configured to set in this case each of the results RES1,. RESN to a respective second predetermined value. For example, the value B1 may indicate a password, or a calculated hash code or signature and the value B2 may indicate a respective reference password, or an expected hash code or signature.

Specifically, in various embodiments, when the data B1 and B2 correspond, the routine <NUM> assigns to each of the results RES1,. RESN a predetermined first bit sequence ERES1,. ERESN, wherein the bit sequences are independent /univocal and preferably protected against simple faults. For example, usually the protection against simple faults may be ensured by using bit sequences which do not have all bits set to "<NUM>" or "<NUM>".

For example, the step <NUM> may be implemented with the following instructions: <MAT> <MAT> where "^" is and eXclusive-OR operation. Specifically, when the bit sequences B1 and B2 correspond, the respective XOR operation (B1 ^ B2) will have all bits set to <NUM>, whereby the value ERES1 and ERES2 is assigned to the values RES1 and RES2, respectively.

Generally, also any other suitable software instructions may be used, which preferably use exclusively combinational and/or arithmetic operations in order to assigned the expected values ERES1 and ERES2 to the values RES1 and RES2, when the bit sequences B1 and B2 correspond, such as: <MAT> <MAT> where "+" indicates an addition.

At a step <NUM>, the microprocessor <NUM> then executes a sequence of software instructions configured to determine an address/a pointer func, which corresponds to:.

For example, in various embodiments, the step <NUM> implements the following function "dispatcher":
func = dispatcher (RES1, RES2, [. RESN,] func_ok, func_fail)
wherein the function "dispatcher" is configured to return with the pointer func either the address func_ok or func_fail based on the values RES1,.

Moreover, at the end of the step <NUM>, a software instruction instructs the microprocessor <NUM> to jump to the address func, thereby executing at a step <NUM> either the routine <NUM> (when the pointer func corresponds to the address func_ok) or the routine <NUM> (when the pointer func corresponds to the address func _fail). Specifically, this jump is a conventional jump operation and not a conditional jump operation, e.g., the respective software instruction (JMP) sets the program counter to the value func without performing any verification operation.

Once the routine <NUM> or <NUM> has been executed, i.e., at the end of the step <NUM>, the microprocessor <NUM> may then execute further software instructions or the processing operations may be stopped at a stop step <NUM>.

In the following will now be described possible embodiments of the step <NUM>. Specifically, as mentioned before, the respective software instructions should be configured to return the address func_ok or func_fail by comparing the results RES1,. RESN with respective expected result ERES1,. Specifically, in various embodiments, the respective software routines do not use IF/ELSE statements, in particular respective conditional jump operations, but the routine <NUM> is implemented exclusively with combinational and/or arithmetic operations.

For example, in a first embodiment, the routine <NUM> implements the following operation: <MAT> where "&" indicates a logic AND operation, "|" indicates a logic OR operation, and "*" indicates a multiplication.

Accordingly, in the embodiment considered, when each of the results RES1,. RESN corresponds to the respective expected result ERES1,. ERESN, the address func_ok is multiplied with <NUM> and the address func_fail is multiplied with <NUM>, and the sum of both values, i.e., the address func_ok, is assigned to the pointer func. Conversely, when at least one of the results RES1,. RESN does not correspond to the respective expected result ERES1,. ERESN, the address func_ok is multiplied with <NUM> and the address func_fail is multiplied with <NUM>, and the sum of both values, i.e., the address func_fail, is assigned to the pointer func.

In the embodiment considered, the routine <NUM> implements thus comparison operations. Generally, the comparison operation "==" configured to verify whether two results correspond may already be implemented with a combinational logic operation. Conversely, the comparison operation "!=" configured to verify whether two results do not correspond usually requires a conditional jump operation. However, the inventors have observed that such a comparison operation may also be implemented with combinational and arithmetic operations. For example, in various embodiments, the comparison operation "!=" between two values A and B is implemented with the following operations: <MAT> where ">> (wordsize - <NUM>)" indicates a right-shift operation of (wordsize - <NUM>) bits, where wordsize is the bitsize of the involved operands A and B, such as <NUM> bit.

Accordingly, the above operations return <NUM> when the values A and B are different, and <NUM> when the values A and B correspond.

In general, the step <NUM> may also use other combinational and/or arithmetic operations. For example, in a second embodiment, a conditional swap function is used. For example, in various embodiments, the step <NUM> uses as expected results ERES1 and ERES2 complementary bit sequences, such as ERES1 = 0xAAAAAAAA and ERES2 = 0x55555555, and the routine <NUM> implements the following operations: <MAT>.

Specifically, the above operation ensures that the value func corresponds to the value func_ok when the value RES1 corresponds to the value ERES1 and the value RES2 correspond to the value ERES2. Moreover, the value func corresponds to the value func_fail when the value RES1 corresponds to the value ERES2 and the value RES2 correspond to the value ERES1.

Accordingly, in various embodiments, when using a conditional swap operation <NUM> and the values B1 and B2 do not correspond, the routine <NUM> is configured to assign to the result RES1 the value ERES2 and to the result RES2 the value ERES1. For example, similar to the previous description of the step <NUM>, for the purpose may be used the following operations at the step <NUM>: <MAT> <MAT>.

Generally, as schematically shown in <FIG>, when the routine 1002a does not assign automatically values satisfying the above criteria of the conditional swap function, the software instructions may implement an additional conversion step <NUM>.

For example, in various embodiments, the step <NUM> may be implemented (similar to the above equation) with the following operation: <MAT> <MAT>.

Alternatively, in various embodiments, a first conversion step <NUM> may implement the following operations: <MAT> <MAT> where ERES1' and ERES2' are the complementary bit sequences, such as ERES1' = 0xAAAAAAAA and ERES2' = 0x55555555, used by the routine <NUM>, and ERES1 and ERES2 are the expected results used by the routine <NUM>. Specifically, by using the XOR operations ("^"), the step <NUM> is configured to set the value RES1 to the value ERES1' when the value RES1 corresponds to the expected value ERES1, and the value RES2 to the value ERES2' when the value RES2 corresponds to the expected value ERES2. As shown in the foregoing in the context of the step <NUM>, the second XOR operation of each equation may also be replaced, e.g., with an addition ("+").

However, the above operations do not correctly map the values RES1 and RES2, when the values do not correspond to the expected results ERES1 and ERES2. Accordingly, in various embodiments, the conversion routine <NUM> may comprise one or more verification steps <NUM>, configured to determine whether the converted values RES1 and RES2 are different from the expected values ERES1' and ERES2'. Moreover, when the converted values RES1 and RES2 are different from the expected values ERES1' and ERES2' (output "N" of the verification step <NUM>), a software instruction, e.g., implemented via a conditional jump, may jump to the address func_fail. Conversely, when the converted values RES1 and RES2 correspond to the expected values ERES1' and ERES2' (output "Y" of the verification step <NUM>), the microprocessor <NUM> may proceed to the step <NUM>.

Generally, the conditional jump to the failure routine <NUM> at this stage does not represent a particular security risk, because by forcing the comparison operation <NUM> to provide an incorrect result, the jump at the step <NUM> to the failure routine <NUM> could be omitted. However, in this case, the routine <NUM> would still not assign correctly the address func_ok, because the previously described conditional swap routine <NUM> would in this case provide an address pointing neither to the address func_ok nor the address func_fail. For example, the steps <NUM> and <NUM> may be implemented with the following software instructions:
if (RES1 != ERES1')
func_fail()
if (RES2 != ERES2')
func_fail().

Accordingly, in the solutions disclosed herein no explicit branches, i.e., conditional jump operations, are used to verify at the step <NUM> the successful comparison of the results RES1,. , RESN, which could be exploited by an attacker. Similarly, in various embodiments, also the routine <NUM> preferably uses only combinational and/or arithmetic operations is order to determine the results RES1,. RESN, e.g., as a function of the values B1 and B2.

In various embodiments, the above software routines, such as the functions "secure_comparison" (step <NUM>) and "dispatcher" (step <NUM>), may also be provided in the form of a software library, in order to simplify the software development. In fact, in this way it is sufficient that the user provides to the software routines the values B1 and B2 to be compared and the addresses func_ok and func_fail, and the respective software routines implement the combinational and arithmetic operations in order to compare the values B1 and B2 and select, based on the results RES1,. RESN and the respective expected results ERES1,. ERESN, one of the addresses func_ok or func_fail.

Those of skill in the art will appreciate that the second embodiment has the advantage that the conditional swap operation may only use combinational logic operations, such as AND and OR operations, and optional XOR operations when implementing the mapping of the results RES1 and RES2. Moreover, the operations are performed always on a plurality of bits.

The above operations may further be improved by storing the routines <NUM> and <NUM> to memory areas far away from each other. Moreover, the routines <NUM> and <NUM> may comprise additional instructions in order to introduce random delays in the respective procedure, thereby better hiding the patterns in the instructions and reducing the exploitability of the solution.

Claim 1:
A method of operating a microprocessor (<NUM>) having associated a memory (<NUM>), wherein said memory comprises a first software routine (<NUM>) stored to a first memory area starting at a first address (func _ok) and a second software routine (<NUM>) stored to a second memory area starting at a second address (func_fail), wherein the method comprises the steps of:
- obtaining data (B1) and an expected value (B2);
- generating a first result (RES1) and a second result (RES2) by combining said obtained data (B1) with said expected value (B2) exclusively via first combinational and/or arithmetic operations (<NUM>; <NUM>, <NUM>), wherein said first combinational and/or arithmetic operations are configured to:
- when said obtained data (B1) correspond to said expected value (B2), set said first result (RES1) to a first predetermined value (ERES1), and
- when said obtained data (B1) correspond to said expected value (B2), set said second result (RES2) to a second predetermined value (ERES2), wherein said second predetermined value (ERES2) has a bit sequence being different from the bit sequence of said first predetermined value (ERES1);
- obtaining said first address (func_ok) and said second address (func_fail);
- generating an address pointer (func) by combining said first result (RES1), said second result (RES2), said first address (func_ok) and said second address (func _fail) exclusively via second combinational and/or arithmetic operations (<NUM>), wherein said second combinational and/or arithmetic operations are configured to:
- when said first result (RES1) corresponds to said first predetermined value (ERES1) and said second result (RES2) corresponds to said second predetermined value (ERES2), assign to said address pointer (func) the value of said first address (func _ok), and
- when said first result (RES1) does not correspond to said first predetermined value (ERES1) or said second result (RES2) does not correspond to said second predetermined value (ERES2), assign to said address pointer (func) the value of said second address (func_fail);
- jumping to said address pointer (func), thereby executing (<NUM>) said first software routine (<NUM>) when said data (B1) correspond to said expected value (B2).