Patent Description:
<CIT> relates to encrypting contents of a memory using an encryption key that is generated based on a random number and a memory location at which the contents are stored. Each of a plurality of locations of a memory can be associated with a respective unique pointer value, and an encryption key may be generated based on the unique pointer value and the random number.

<CIT> relates to systems and methods for dynamic data masking. The methods and systems can be used to dynamically mask data in cryptographic operations, such as advanced encryption standard (AES) operations, data encryption standard (DES) operations or triple DES operations. Specifically, data in cryptographic operations can be covered with unlimited and continuously changing masks.

<CIT> relates to a cryptographic system including a first round encryption logic circuit that is configured to encrypt input data by performing a first mask operation, e.g. an XOR operation, on the data using at least a portion of an address associated with the data, and then performing a second mask operation on the output of the first mask operation using a key.

Aspects of the present disclosure are directed to secure exchange of masked data between an embedded central processing unit (CPU) and an external memory during cryptographic operations. An integrated circuit having the embedded CPU may perform a cryptographic operation that may result in susceptibility of the integrated circuit to a side-channel analysis (SCA) attack where an attacker (e.g., an unauthorized entity) may obtain information as the cryptographic operation is performed. An example of a side-channel attack includes, but is not limited to, Differential Power Analysis (DPA) where the attacker who seeks to obtain a secret key used in the cryptographic operation may study the differences in power profile (i.e., power consumption patterns) of the integrated circuit as the cryptographic operation is performed. An attacker may be an unauthorized entity that may obtain the input (e.g., the secret key) to the cryptographic operation by analyzing power profile measurements of the integrated circuit over a period of time. Accordingly, when the sender transmits a ciphertext to a receiver by encrypting plaintext via a cryptographic operation, the attacker may be able to retrieve the secret key that is used to encrypt the plaintext to the ciphertext by observing the power profile of the integrated circuit as the cryptographic operation is performed to encrypt the plaintext into the ciphertext. For example, the attacker may uncover a cryptographic (e.g., secret or private) key that is used to encrypt the plaintext as the cryptographic operation is performed by the integrated circuit.

A key part of protecting embedded CPUs during a cryptographic operation is to protect the communication path from the CPU to the external memory (e.g., static Random Access Memory (SRAM) or other types of memory outside of the CPU) and vice versa. One way to protect the communication path is to use a masking technique to obfuscate the original data during CPU to memory communication. Masking may be implemented by Boolean or arithmetic techniques, both of which require splitting up the masked data into two or more shares. Each share is then independent of the original data and can be processed and stored individually without leaking information in side-channels. If the masked data is loaded to the CPU from external memory, the shares can be re-combined to reveal the original data again. This solution, however, incurs high overhead, because more external memory resource is required to store the two or more shares.

Aspects of the present disclosure address the above and other deficiencies by calculating masked data shares dynamically inside the CPU boundary (i.e., a trust boundary within which possibility of data leakage is minimal), and using a plurality of memory channels to write the masked data shares to an external memory location and/or to read the data shares from that external memory location. Each dynamically generated mask value is uniquely associated with a corresponding memory channel during writing data to the external memory. The modified masked data is unmasked during a subsequent read operation, and the unmasked data can be remasked again with a new mask, if necessary.

Note that in the specification, "dynamically" means substantially at the same time or without a perceptible delay ("on-the-fly"). In the context of computer operations, "dynamically" may mean during the running of a computer operation without interrupting the flow of the operation. Additionally, in this disclosure, Boolean operations (such as exclusive OR (XOR)) are shown as examples of masking techniques, though the scope of the disclosure is not limited to just Boolean masking. For example, pure arithmetic operation or a combination of Boolean and arithmetic operations, with appropriate mask conversions as necessary, is within the scope of this disclosure.

Advantages of the disclosed approach include prevention of data value leakage and/or data update/overwrite leakage inside the external memory and on the memory bus. The approach is also secure against microarchitecture-specific leaks (e.g., share cross-domain leaks, combination leaks, etc.).

An additional advantage of the approach disclosed herein is that the approach is agnostic of memory technology. For example, the methods are equally applicable to FPGA Block RAM, ASIC RAM macro cells, registers and any other type of memory technology. Furthermore, there is no significant impact on latency of the CPU performance, while the overall implementation cost decreases because of zero overhead on external memory resource.

<FIG> illustrates an example CPU including a masked output generator module, in accordance with some aspects of the present disclosure. The CPU <NUM> may include internal memory (not shown) and various components/modules <NUM>-<NUM> used for cryptographic operations. Examples of such cryptographic operations include, but are not limited to, generating a digital signature to authenticate an integrated circuit containing an embedded CPU. Specific examples of types of cryptographic operations may be based on, but are not limited to, Secure Hash Algorithm (SHA)-<NUM>, SHA-<NUM>, Advanced Encryption Standard (AES), Data Encryption Standard (DES), etc..

As shown in <FIG>, the CPU <NUM> may include, among other things, an input data receiving module <NUM>, a random number generator module <NUM>, a memory channel selector module <NUM>, an external memory address module <NUM>, a masked data generator module <NUM> and a data unmasking module <NUM>. In alternative embodiments, the functionality of one or more of the modules may be combined or divided. The masked data generator module <NUM> and data unmasking module <NUM> may be implemented by or in processing logic that may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, integrated circuit, hardware of a device, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof.

The input data receiving module <NUM> may receive shares corresponding to an input data value. Note that the input data value may already be masked with an initial mask. For example, an underlying secret input data value 'd' may be already masked by combining the value 'd' with an initial mask 'm1'. The combination of the value 'd' with the mask m1 may be the first share (d ⊕ m1). The mask value m1 itself may be the second share. Additional random numbers generated by the random number generator module <NUM> may be added to the secret value 'd' already masked with the first mask value 'm1' within the CPU boundary, as further elaborated with reference to <FIG>. The external memory address module <NUM> can maintain a table of memory addresses (e.g., all memory addresses) corresponding to the various memory locations in the external memory <NUM> shown in <FIG>. Each memory location may be addressable by a plurality of memory channels. The memory channel selector module <NUM> can select which memory channel is to be used to write data into a specific memory location with a specific memory address. The mask generator module <NUM> can be used to dynamically calculate a masked value to generate masked data (d ⊕ m2) sent to the input data port <NUM> to be written into the external memory <NUM>. The data unmasking module <NUM> can read the masked data (d ⊕ m2) from the output data port <NUM> of the external memory <NUM>, and retrieve original data 'd' within the CPU boundary.

<FIG> details an example implementation of dynamically generating channel-specific mask values (m2) within the CPU boundary (shown by the dashed line <NUM> for writing to external memory <NUM>) by the mask generation sub-component <NUM> (whose function may be performed by the masked data generator module <NUM> in <FIG>). The mask generation sub-component <NUM> can receive the address (mem_address <NUM>) of the memory location where masked data is to be written. The mask generation sub-component <NUM> can also receive information from the multiplexer <NUM> about what memory channel is to be used to write data. In the example illustrated in <FIG>, four memory channels (<NUM>, <NUM>, <NUM>, <NUM>) are shown that can be processed by the multiplexer <NUM> based on the channel select command <NUM>, though any arbitrary number of channels may be used. Each channel is associated with a unique seed value (seed <NUM>, seed <NUM>, seed <NUM> and seed <NUM>) stored in the corresponding registers <NUM>, <NUM>, <NUM> and <NUM>. A corresponding mask value is calculated for each of the channels.

The mask value can be a function 'f' of the known memory address (communicated via address port <NUM>) and the unique seed value, i.e., maski = f (memory address, seedi), where 'i' is the index of each of the plurality of memory channels corresponding to the memory address associated with a specific memory location. The seed values can be generated by a random number generator within the CPU boundary to make it difficult for a side-channel attack, as knowing only the memory address is not sufficient to reveal the mask value. The channels can be reseeded, i.e. the seed values may be refreshed periodically or randomly. Reseeding can happen at different rates to improve the security of the implementation (e.g., key schedule v. crypto primitive, or CBC state v. internal crypto primitive state). The memory channel switch method described here is an efficient way to achieve a high level of security with less frequent reseeding. Note that the dynamically generated mask value 'm2' shown in <FIG> does not necessarily indicate mask value calculated for channel <NUM>, but represents mask value calculated for whichever channel is selected.

The embodiment illustrated in <FIG> also shows that the side-channel resistance mode (e.g., the DPA mode) can be turned on or off using a dedicated Instruction Set Extension (ISE) or a Control Status Register (CSR) sending a signal <NUM> to the multiplexer <NUM> and multiplexer <NUM>. When DPA mode is on, the dynamically generated mask value m2 can be used for subsequent XOR operations <NUM> and <NUM>.

When the DPA mode is on, the dynamically generated mask value m2 can be combined with the first masked share (d ⊕ m <NUM>) of the input data by an XOR operation <NUM>, the result of which (d ⊕ m1 ⊕ m2) can be saved in register <NUM>. Another XOR operation <NUM> involving the result saved at <NUM> and the other input share m1 (saved at register <NUM>) can generate the dynamically modified masked data (d ⊕ m2) that is sent to the input data port <NUM> of the external memory <NUM> to be written at the targeted memory location. The target memory location can be addressed by the selected memory channel (which is not a physical channel) associated with calculated mask value m2.

In the embodiment shown in <FIG>, an additional mask (m3) is generated within the CPU boundary to eventually retrieve the original secret value 'd' which is masked with m2 during writing. In some implementations, the additional mask value m3 is not channel specific, but rather a random value generated within the CPU boundary. At XOR operation <NUM>, when the DPA mode is on at multiplexer <NUM>, the dynamically generated channel-specific mask value m2 can be combined with m3. The two shares of the XOR operation <NUM> (m3 ⊕ m2) can be saved in register <NUM> and m3 itself can be saved in register <NUM>. Knowing m3 enables the unmasking of the modified masked data (d ⊕ m2).

For reading operations within the CPU boundary (indicated by dashed line <NUM>), saved modified masked data (d ⊕ m2) can be accessed from output data port <NUM> of the external memory <NUM>, and an XOR operation <NUM> can be performed to generate shares (d ⊕ m3) and m3. Thus, the original value of d can be retrieved.

<FIG> is a flow diagram of an example method <NUM> to perform a SCA-resistant data transfer between a CPU and an external memory during writing. The method <NUM> may be performed by processing logic that may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, integrated circuit, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof. In some embodiments, the method <NUM> may be performed by the components of CPU <NUM> shown in <FIG>.

Referring back to <FIG>, method <NUM> begins at block <NUM>, where input data is received at the CPU. The input data is to be masked and written at an external memory location. Input data may be received at the input data receiving module <NUM> of the CPU <NUM>, shown in <FIG>. Input data may be already masked. Also, input data may be received in the form of a plurality of shares for further cryptographic operations. For example, in <FIG>, the two input shares that are received are (d ⊕ m1) and m1, where m1 is an initial mask. Input data can be further masked before writing.

At block <NUM>, a mask value is dynamically generated within the CPU boundary. The dynamically generated mask value m2 can be uniquely associated with the memory channel that is currently being used to address the memory location where the modified input data is to be written. As described above, m2 can be calculated as a function of the memory address and a unique seed value for the selected channel. The seed value can be a random number that may be generated by the random number generator module <NUM>. In an alternative embodiment, the random number may also be stored within an internal memory (not shown in <FIG>) within the CPU.

At block <NUM>, the input data is modified with the dynamically generated mask value m2. This can be performed by the masked data generator module <NUM> in <FIG>. In <FIG>, this operation is shown as the XOR operation <NUM>.

At block <NUM>, the modified input data is stored in the external memory location. The modified input data can be communicated to the input data port <NUM> shown in <FIG>. Note that during the sequence of operations performed within the CPU boundary, each of the intermediate values or any combination of intermediate values is statistically independent of the underlying secret value. Therefore, no direct-value leak is expected. Additionally, because the mask value m2 is dynamically generated based on which memory channel is currently being used, the modified masked value that is communicated outside of the CPU boundary <NUM> to the external memory <NUM> also keeps changing, thereby preventing possibility of information leakage during communication.

<FIG> is a flow diagram of an example method <NUM> to perform a SCA-resistant data transfer between an external memory and a CPU during reading. The method <NUM> may be performed by processing logic that may include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, integrated circuit, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof. In some embodiments, the method <NUM> may be performed by module <NUM> of CPU <NUM> shown in <FIG>.

Referring back to <FIG>, method <NUM> begins at block <NUM>, where the saved modified input data (e.g., data masked with the dynamically generated mask value m2) is read from the external memory location.

At block <NUM>, the input data is retrieved by unmasking the modified input data. In the example embodiment illustrated in <FIG>, the unmasking operation is shown as the XOR operation <NUM>. The additional mask m3 generated within the CPU boundary and combined with the dynamically generated mask m2 by the XOR operation <NUM> helps removing m2during XOR operation <NUM>. The output of the XOR operation <NUM> may be in the form of a plurality of data shares (e.g., one share is (d ⊕ m3) and the other share is m3). The shares can be used within the CPU boundary for further cryptographic operations.

Note that though not shown in <FIG>, the unmasking operations may be replaced by the remasking of the revealed data (or data shares) with another mask.

Persons skilled in the art will understand that although the flow diagrams in <FIG> show a particular sequence or order, unless otherwise specified, the order of the processes can be modified. Thus, the illustrated embodiments should be understood only as examples, and the illustrated processes can be performed in a different order, and some processes can be performed in parallel. Additionally, one or more processes can be omitted in various embodiments. Thus, not all processes are required in every embodiment. Other process flows are possible.

<FIG> compare the performance of side-channels when the DPA protection scheme is off versus when the DPA protection scheme is off, according to some embodiments. The side-channels are marked a, b, c,. , <NUM>, m, n. <FIG> shows <NUM> million power traces collected from unprotected (i.e. DPA protection off) side channels, showing prominent leakage from several channels. <FIG> shows <NUM> million power traces collected from protected (i.e. DPA protection on) side channels, showing leakage from only a few expected channels. As shown in <FIG>, the DPA protection scheme may be turned on or off by the command <NUM> sent to multiplexers <NUM> and <NUM>.

<FIG> illustrates an example machine of a computer system <NUM> within which a set of instructions, for causing the machine to perform any one or more of the methodologies discussed herein, may be executed. In alternative implementations, the machine may be connected (e.g., networked) to other machines in a LAN, an intranet, an extranet, and/or the Internet. The machine may operate in the capacity of a server or a client machine in client-server network environment, as a peer machine in a peer-to-peer (or distributed) network environment, or as a server or a client machine in a cloud computing infrastructure or environment.

The machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a cellular telephone, a web appliance, a server, a network router, a switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while a single machine is illustrated, the term "machine" shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

The example computer system <NUM> includes a processing device <NUM>, a main memory <NUM> (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM), etc.), a static memory <NUM> (e.g., flash memory, static random access memory (SRAM), etc.), and a data storage device <NUM>, which communicate with each other via a bus <NUM>. In one implementation, processing device <NUM> may be an embedded CPU <NUM> in <FIG>, and memory <NUM> may be external memory <NUM> shown in <FIG>.

Processing device <NUM> represents one or more general-purpose processing devices such as a microprocessor, a central processing unit, or the like. More particularly, the processing device may be complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or processor implementing other instruction sets, or processors implementing a combination of instruction sets. Processing device <NUM> may also be one or more special-purpose processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), network processor, or the like. The processing device <NUM> is configured to execute instructions <NUM> for performing the operations and steps discussed herein.

The computer system <NUM> may further include a network interface device <NUM> to communicate over the network <NUM>. The computer system <NUM> also may include a video display unit <NUM> (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device <NUM> (e.g., a keyboard), a cursor control device <NUM> (e.g., a mouse), a graphics processing unit <NUM>, a signal generation device <NUM> (e.g., a speaker), graphics processing unit <NUM>, video processing unit <NUM>, and audio processing unit <NUM>.

The data storage device <NUM> may include a machine-readable storage medium <NUM> (also known as a computer-readable medium) on which is stored one or more sets of instructions or software <NUM> embodying any one or more of the methodologies or functions described herein. The instructions <NUM> may also reside, completely or at least partially, within the main memory <NUM> and/or within the processing device <NUM> during execution thereof by the computer system <NUM>, the main memory <NUM> and the processing device <NUM> also constituting machine-readable storage media.

In one implementation, the instructions <NUM> include instructions to implement functionality corresponding to a masked output generator module <NUM> of <FIG>. While the machine-readable storage medium <NUM> is shown in an example implementation to be a single medium, the term "machine-readable storage medium" should be taken to include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more sets of instructions. The term "machine-readable storage medium" shall also be taken to include any medium that is capable of storing or encoding a set of instructions for execution by the machine and that cause the machine to perform any one or more of the methodologies of the present disclosure. The term "machine-readable storage medium" shall accordingly be taken to include, but not be limited to, solid-state memories, optical media and magnetic media.

Unless specifically stated otherwise as apparent from the above discussion, it is appreciated that throughout the description, discussions utilizing terms such as "identifying" or "determining" or "executing" or "performing" or "collecting" or "creating" or "sending" or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage devices.

The present disclosure also relates to an apparatus for performing the operations herein. This apparatus may be specially constructed for the intended purposes, or it may comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a computer readable storage medium, such as, but not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, each coupled to a computer system bus.

Various general purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct a more specialized apparatus to perform the method. The structure for a variety of these systems will appear as set forth in the description below. In addition, the present disclosure is not described with reference to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of the disclosure as described herein.

The present disclosure may be provided as a computer program product, or software, that may include a machine-readable medium having stored thereon instructions, which may be used to program a computer system (or other electronic devices) to perform a process according to the present disclosure. A machine-readable medium includes any mechanism for storing information in a form readable by a machine (e.g., a computer). For example, a machine-readable (e.g., computer-readable) medium includes a machine (e.g., a computer) readable storage medium such as a read only memory ("ROM"), random access memory ("RAM"), magnetic disk storage media, optical storage media, flash memory devices, etc..

Claim 1:
A computer-implemented method comprising:
receiving, at a central processing unit (CPU) (<NUM>), input data that is to be masked and written at a memory location within an external memory (<NUM>) coupled to the CPU (<NUM>), wherein the memory location is addressable by a plurality of memory channels;
dynamically generating, within a boundary of the CPU (<NUM>), a mask value uniquely associated with a memory channel of the plurality of memory channels that is currently being used to address the memory location;
prior to writing at the memory location within the external memory (<NUM>), modifying, within the boundary of the CPU (<NUM>), the input data by masking the input data with the dynamically generated mask value; and
storing the modified input data at the memory location within the external memory (<NUM>).