DE102011107104B4 - Portable security module and method for its operation to defend against an attack in real time using pattern recognition - Google Patents

Abstract

A method for operating a security module (CC) comprising an integrated circuit (IC) and a non-volatile memory (NVM), the integrated circuit (IC) executing an operation which can be measured from outside the security module (CC) Signal, such as power consumption, charging or emission, leads; and adds an interfering signal to the signal; characterized in that the integrated circuit (IC), when the operation is carried out, selectively varies the course of an edge of the signal by adding the interference signal in order to delay recognition of the edge with the aid of a pattern recognition, the operation at a completion time (t1 ) is completed after the end of the edge; the edge can be recognized with the help of pattern recognition at a pattern recognition time (ta) after the end of the current edge and the course of the current edge is varied such that the completion time (t1) before the pattern recognition -Time (ta) is.

Description

The invention relates to a method for operating a security module which comprises an integrated circuit and a non-volatile memory. The integrated circuit carries out an operation which leads to a signal that can be measured from outside the security module, such as power consumption, charging or emissions, and adds an interference signal to the signal. The invention also relates to a security module.

In chip cards or IC cards with an integrated circuit, for example, cryptographic operations are used to protect the operation of these devices or to protect data transported in the device. The arithmetic operations required for this are carried out both by standard arithmetic units and by dedicated crypto arithmetic units of the integrated circuit. The data or intermediate results used in this context are usually security-relevant information such as cryptographic keys or operands.

In the case of arithmetic operations carried out by the integrated circuit, for example for the calculation of cryptographic algorithms, logical links are carried out between operands or intermediate results. Depending on the technology used, these operations, in particular the loading of empty or previously deleted memory areas or registers with data, lead to increased power consumption by the data processing devices. A corresponding analysis of this change in current makes it possible to extract information about the calculated operations so that a successful analysis of secret operands, for example cryptographic keys, is possible.

Sufficient extraction of the information can be made possible by carrying out several current measurements on the portable data carrier. On the other hand, several current measurements can enable a difference formation that may be required. This type of cryptanalysis is called "differential power analysis", by means of which an outsider can successfully carry out an unauthorized cryptographic analysis of the cryptographic operations, algorithms, operands or data by simply observing changes in the power consumption of the portable data carrier. The "Differential Power Analysis" thus enables additional internal information of an integrated circuit to be obtained beyond pure functionality.

In a similar way, it is possible to detect and analyze the electromagnetic emissions occurring during the operation of the integrated circuit, in order to draw conclusions therefrom about calculated operations and information of the integrated circuit.

Mechanisms are therefore usually implemented in a portable data carrier which are intended to recognize such attacks and take suitable countermeasures. A typical countermeasure is to write a non-volatile memory with an attack counter or what is known as a DFA operating error counter. The operating error counter can be evaluated later in order to detect an attack that has taken place. A further countermeasure consists in changing the states of the operating system implemented in the portable data carrier or locking the data carrier.

In order to be able to carry out an attack successfully and to be able to react accordingly to possible countermeasures of the portable data carrier, the typical current pattern of the data carrier is recognized in real time using fast hardware logic (FPGA). If the attacker has recognized a certain countermeasure in real time, the data carrier is switched off or another malfunction is placed in order to circumvent the countermeasure usually implemented in software. For example, the power supply to the data carrier is switched off before the integrated circuit accesses the non-volatile memory for writing to an incorrect operation or attack counter or before the portable data carrier is locked.

Various approaches are known from the prior art for making the analysis of a current curve more difficult. For example, it is known to keep the current profile visible to the outside constant. In another approach, so-called dummy write accesses are used, which either represent write access to the non-volatile memory that is not required per se or which are carried out by activating a special circuit. The special circuit provided in the data carrier is designed so that it simulates the power consumption of a corresponding memory access as precisely as possible. It is also known to mark the power consumption at random using additional consumers in such a way that the consumption appears to the observer as constant noise.

For example, the US 6,419,159 B1 a method to prevent external detection of an operation of a chip on the basis of a power consumption analysis. The chip comprises a power consumption analysis safety circuit which has a plurality of power sinks connected to supply connections. The current sinks are generated by means of a random generator individually switched on or off in order to generate current fluctuations which can be measured at the supply connections.

The DE 101 28 573 A1 discloses a method with which the processing of operations is varied over time.

Furthermore, the DE 60 2004 003 675 T2 a method of encrypting a plaintext value to define a ciphertext. The plain text is encrypted into the ciphertext using a masked key and a table value defined using a cryptographic function.

The DE 10 2007 026 977 A1 describes a cryptographic system which contains encryption logic. The encryption logic is designed to encrypt input data by performing a masking operation on input data using an address which is linked to the input data.

One problem with the known defense mechanisms is that they all generate high, additional electricity consumption.

It is therefore the object of the present invention to specify a method for operating a security module and a security module which allow an attack to be defended in real time by pattern recognition in an efficient manner and at the same time avoid unnecessary power consumption.

These objects are achieved by a method and a security module with the features of the independent patent claims. Advantageous refinements result from the dependent claims.

The invention creates a method for operating a security module which comprises an integrated circuit and a non-volatile memory, the integrated circuit executing an operation which leads to a signal that can be measured from outside the security module, such as power consumption, charging or emission and the Adds an interfering signal to the signal. According to the invention, when the operation is carried out, the integrated circuit selectively varies the profile of an edge of the signal by adding the interference signal in order to delay recognition of the edge with the aid of pattern recognition.

The invention further proposes a security module that comprises an integrated circuit and a non-volatile memory, the integrated circuit being designed to carry out an operation which leads to a signal that can be measured from outside the security module, such as power consumption, charging or emissions and adds an interfering signal to the signal. The integrated circuit is also designed to selectively vary the profile of an edge of the signal by adding the interference signal when the operation is carried out, in order to delay recognition of the edge with the aid of pattern recognition.

Such a security module can be embodied in a portable data carrier, such as a chip card, a secure mass storage card or a USB token. It can also be a permanently installed security module, such as a Trusted Platform Module (TPM), an M2M module, a user identification module or a decoder module.

The procedure proposed according to the invention makes pattern recognition more difficult in the context of an attack, as a result of which the time at which a countermeasure initiated by an attack is recognized is postponed so far that the probability of successful writing of information, e.g. to lock the data carrier or to change an incorrect operation or attack counter, is increased sufficiently.

The procedure according to the invention is based on the consideration in which cases a defense measure is useful and countermeasures can be used in a targeted manner. It was found here that writing access to the non-volatile memory results in a signal edge that can be detected during an attack. This signal edge is now massively falsified by variation, so that access to the non-volatile memory can no longer be reliably detected. The edge when accessing the non-volatile memory can then no longer be safely used as a trigger point for a targeted shutdown of the integrated circuit of the data carrier in order to prevent a write process in the non-volatile memory.

The defense mechanism according to the invention is therefore not permanently active, but only in the case of a countermeasure taken by the integrated circuit in response to a pattern recognition attack which requires access to the non-volatile memory. As a result, the power consumption for the countermeasure can be reduced in comparison with known countermeasures.

The operation is completed at a completion time after the end of the edge. The edge is with the help of a pattern recognition in real time by an attacker at a pattern recognition time after the end of the current edge recognizable. The course of the current edge is varied in such a way that the completion time is before the pattern recognition time.

The edge is, in particular, a current edge, which is preferably produced as the operation by a write access of the integrated circuit to the non-volatile memory. Write access can e.g. be increasing or decreasing an attack counter. A write access can also write status information u. Like. Include.

According to a further embodiment, the operation is completed at the completion point in time as the first step in a sequence of operations. For example, the second operations following the first operation are operations which are unusable in order to be able to be used as a trigger point for a targeted shutdown of the integrated circuit of the data carrier and thereby prevent write access to the non-volatile memory.

According to a further embodiment, the interference signal added to the signal with the operation is started at the earliest at a start point in time with the beginning of the edge. This takes into account the fact that a current edge is usually caused by activating a charge pump when accessing the non-volatile memory. Alternatively, the interference signal added to the signal with the operation is started 5% to 20% of the duration of the edge before the beginning of the edge.

In a further embodiment it is provided that the interference signal added to the signal with the operation ends at the latest at the termination time after the end of the edge or at the end of the edge. Alternatively, the interference signal added to the signal with the operation ends 5% to 20% of the duration of the edge before or after the end of the edge.

In order to prevent a more complex evaluation of an attacker from being able to detect a disguised current edge signal in a simple manner, provision can furthermore be made to vary the course of the current edge at random.

An analysis of the security module is further complicated by the fact that the point in time of the beginning and / or the end of the interference signal is selected at random.

In a further embodiment it is provided that an interference amplitude of the interference signal is at least 10% and / or at most 100% of the useful component of the signal.

According to a further embodiment, the height and / or steepness of the edge of the signal is varied in sections. This also makes the analysis of the security module more difficult.

In a further refinement, the varied edge has a number of local maxima, the time interval between which and the height of the difference are generated at random with each varied edge. According to this embodiment variant, not only is the steepness of the flank changed, but it is also divided into a plurality of partial flanks. This makes it e.g. makes it difficult to turn on the charge pump of the integrated circuit as a trigger point for a targeted shutdown of the data carrier in the context of an attack. In particular, provision is made to generate “dummy current edges”, the height of which preferably varies from the edge of a real charge pump activation to a disguised activation. The exact reproduction of a write access in the further course is not necessary.

The variation of the edge of the signal can also be brought about by activating a hardware circuit that is already present in the data carrier, in particular a coprocessor. This has the advantage that no additional hardware has to be provided in the portable data carrier which enables the edge to be varied.

The variation of the edge of the signal can also be generated by the integrated circuit by executing a program, in particular by starting an interrupt routine, the program performing power-intensive calculations. The defense mechanism according to the invention can then be implemented in a simple and inexpensive manner.

The variation in the edge of the signal can also be generated at least sometimes when the non-volatile memory is accessed. In other words, this means that the flank does not always have to be falsified, but that it is sufficient to falsify the flank from time to time.

It is also expedient if the operation in the integrated circuit is carried out locally in a first circuit part above and / or below and / or next to a second circuit part in which the signal having the edge is generated. A spatially resolved emission measurement can hereby be prevented.

• 1 eine schematische Darstellung eines Sicherheitsmoduls,
• 2a, 2b den Stromverlauf eines herkömmlichen und eines erfindungsgemäßen Sicherheitsmoduls beim Zugriff auf einen nicht-flüchtigen Speicher nach der Erkennung eines Angriffs im Vergleich, und
• 3 eine alternative Darstellung einer variierten Stromflanke gemäß dem erfindungsgemäßen Verfahren.

The invention is explained in more detail below using an exemplary embodiment in the drawing. Show it:

• 1 a schematic representation of a security module,
• 2a , 2 B the current profile of a conventional and a security module according to the invention when accessing a non-volatile memory after the detection of an attack in comparison, and
• 3 an alternative representation of a varied current edge according to the method according to the invention.

1 shows a schematic representation of a security module CC according to the invention in the form of a portable data carrier (for example a chip card) which has an integrated circuit IC and a non-volatile memory NVM in a known manner. In the arithmetic operations carried out by the integrated circuit IC, logical links between operands and intermediate results are carried out in a known manner. These operations lead, for example, to loading empty or previously deleted memory areas or registers with data in the non-volatile memory NVM. Both the operation of the integrated circuit IC and the writing of data in the non-volatile memory NVM lead to a power consumption of the security module CC. As already described in the introduction, an attacker can gain knowledge of the information about the calculated operations through a corresponding analysis of current changes, so that, for example, a cryptanalysis of secret operands (for example cryptographic keys) is possible.

As part of such an attack on the security module CC, errors are induced in the process sequence with the aid of light flashes, for example. When such an attack is detected, a countermeasure is initiated by means of software implemented in the security module CC, which requires write access by the integrated circuit IC to the non-volatile memory NVM. For example, as part of such a countermeasure, an attack or incorrect operation counter in the non-volatile memory NVM can be increased, the data carrier can be locked or a state in the operating system can be changed.

Access to the non-volatile memory NVM is associated with a power consumption that results in a power edge. The current edge is caused by switching on a charge pump when accessing the non-volatile memory NVM.

In 2a the current profile I is shown over time t in a conventional data carrier, in which the charge pump is switched on at time -t0 (so-called start time), so that a current I _{NVM is} reached by time 0. At time t1 (so-called completion time), the countermeasure provided in the data carrier takes place, for example increasing the attack counter or operating error counter, changing a status in the operating system or locking the data carrier. With conventional data carriers, the current edge can be recognized by an attacker as a typical current pattern using fast hardware logic (FPGA) but in real time and used as the trigger time to switch off the security module CC at time ta (pattern recognition time). Since the point in time ta occurs before the access to the non-volatile memory, the countermeasure of the data carrier can be prevented.

In contrast, shows 2 B the current profile I of a security module CC according to the invention over time, in which the current edge generated by switching on the charge pump is varied by the integrated circuit IC. It is sufficient if the variation of the current edge in the time interval between [-t0; 0] takes place. In principle, however, the variation of the current edge can also go beyond time 0.

For the effectiveness of the defense mechanism according to the invention, the edge in the period between -t0 and 0 is particularly important. During this period, the current image is falsified with a high amplitude, so that the current edge is clearly distinguished from noise. The principle is not based on dummy writing, as is typically used in the prior art, but on dummy calculation.

While the varied current edge in 2 B for example a greater steepness and a greater height than the “normal” current edge of a conventional data carrier in 2a has, the current edge - as shown in 3 is shown - also be divided into a plurality of current edges A, B, C with respective local current maxima. The time interval and the difference for the respective current maxima are generated randomly with each varied current edge. The current signal can be noisy between the local current maxima.

The procedure according to the invention is thus based on massively falsifying the current signal when the charge pump of the integrated circuit IC of the data carrier CC is switched on, so that an access, i.e. a write operation to or into the non-volatile memory NVM can no longer be reliably detected. It is sufficient here if the variation or falsification does not act each time the charge pump is switched on, but only occasionally.

The variation or falsification of the current edge does not require any additional hardware, but can be implemented by using existing mechanisms of the integrated circuit. For example, the variation of the current edge can be caused by switching on the coprocessor of the integrated circuit IC. A random change in the current of the current edge can also be brought about by suitable software measures. For example, this can be implemented by starting an interrupt routine which carries out power-intensive calculations while the non-volatile memory is being accessed. As a result, when the charge pump is switched on, the current edge can no longer be safely used as a trigger point for a targeted shutdown of the integrated circuit IC in order to prevent data from being written into the non-volatile memory.

The procedure according to the invention makes it more difficult for an attacker to specifically prevent write / delete operations in the non-volatile memory NVM or to change a state by monitoring the current. An attack or incorrect operation counter, which switches off the data carrier when attacks are detected by means of a light attack, can thus be improved, since the point in time of a possible deactivation of the data carrier by the attacker is pushed back so far that the probability of a successful writing of the attack - or remote control counter is increased sufficiently.

The writing of the attack or remote control counter can be followed by one or more further operations. This further operation can also be carried out in parallel with writing the attack or remote control counter. The further operations are preferably such that they cannot be used as a trigger for an attack.

Another application of the invention relates to signals which could be analyzed on the basis of their electromagnetic emissions. The starting edge of an electromagnetic emission signal to be protected can be treated like a current edge. A spatially resolved emission measurement can also e.g. this prevents arithmetic operations in the integrated circuit of the security module from being carried out in a first circuit part and the interference signal or signals from being generated in a second circuit part of the integrated circuit. The second circuit part can optionally be arranged locally above and / or below and / or next to the first circuit part.

Claims (16)

A method for operating a security module (CC) comprising an integrated circuit (IC) and a non-volatile memory (NVM), the integrated circuit (IC) executing an operation which - to a measurable from outside the security module (CC) Signal, such as power consumption, charging or emission, leads; and - adds an interfering signal to the signal; characterized in that the integrated circuit (IC), when the operation is carried out, selectively varies the course of an edge of the signal by adding the interference signal in order to delay recognition of the edge with the aid of a pattern recognition, the operation at a completion time ( t1) is completed after the end of the edge; the edge is recognizable with the help of the pattern recognition at a pattern recognition time (ta) after the end of the current edge and the course of the current edge is varied such that the completion time (t1) is before the pattern recognition time (ta). Procedure according to Claim 1 , characterized in that the interference signal added to the signal with the operation occurs in a time interval of - 20% of the duration of the edge before the beginning of the edge and - 20% of the duration of the edge after the end of the edge. Procedure according to Claim 1 or 2 , characterized in that the flank can be recognized in real time by an attacker at the pattern recognition time (ta) after the end of the current flank with the aid of a pattern recognition. Method according to one of the preceding claims, characterized in that the edge is a current edge which is preferably produced by a write access by the integrated circuit (IC) to the non-volatile memory as the operation. Method according to one of the preceding claims, characterized in that the operation is completed at the completion time (t1) as the first step in a sequence of operations. Method according to one of the Claims 1 to 5 , characterized in that the interference signal added to the signal with the operation is started at the earliest at a start time (-t0) with the beginning of the edge. Method according to one of the Claims 1 to 5 , characterized in that the interference signal added to the signal with the operation is 5% to 20% of the duration of the edge is started before the edge begins. Method according to one of the Claims 1 to 7th , characterized in that the interference signal added to the signal with the operation ends at the latest at the termination time (t1) after the end of the edge or at the end of the edge (0). Method according to one of the Claims 1 to 7th , characterized in that the interference signal added to the signal with the operation ends 5% to 20% of the duration of the edge before or after the end of the edge. Method according to one of the Claims 6 to 9 , characterized in that the time of the beginning and / or the end of the interference signal is selected randomly. Method according to one of the preceding claims, characterized in that an interference amplitude of the interference signal is at least 10% and / or at most 100% of the useful portion of the signal. Method according to one of the preceding claims, characterized in that the height and / or steepness of the edge of the signal is varied in sections. Method according to one of the preceding claims, characterized in that the operation in the integrated circuit is carried out in a first circuit part locally above and / or below and / or next to a second circuit part in which the signal having the edge is generated. Security module (CC), which comprises an integrated circuit (IC) and a non-volatile memory (NVM), the integrated circuit (IC) being designed to carry out an operation which - to a signal measurable from outside the security module (CC) , such as power consumption, charging or emission leads; and - adds an interfering signal to the signal; characterized in that the integrated circuit (IC) is further designed to selectively vary the profile of an edge of the signal by adding the interference signal when the operation is carried out in order to delay recognition of the edge with the aid of pattern recognition, the operation is completed at a completion time (t1) after the end of the edge; the edge is recognizable with the help of a pattern recognition at a pattern recognition time (ta) after the end of the current edge and the course of the current edge is varied such that the completion time (t1) is before the pattern recognition time (ta). Security module after Claim 14 , characterized in that these means for performing the method according to one of the Claims 2 to 13 includes. Security module after Claim 14 or 15th , characterized in that this is embodied in a portable data carrier, such as a chip card, a secure mass storage card or a USB token, or a permanently installed security module, such as a Trusted Platform Module (TPM), an M2M module, a user identification Module or a decoder module.

Images