1. Field of the Invention
The present invention generally relates to digital processing circuits and, more specifically, to microprocessors capable of executing so-called secured tasks, that is, manipulating digital quantities intended to remain secret. These may be, for example, ciphering tasks using public key (asymmetrical) or secret key (symmetrical) mechanisms.
The present invention more specifically applies to digital data processing systems using at least two operating systems, among which is a secured operating system.
The present invention more specifically aims at the protection of a system sharing a time counter, against attacks by interpretation of the time for processing digital quantities to be protected. Such attacks are most often designated as timing attacks.
2. Discussion of the Related Art
Another example, not shown, of application of the present invention relates to personal microcomputers capable of operating under two different operating systems, one being considered as secured.
From a hardware point of view, central processing unit 20 comprises a timer 23 clocked by a clock signal CLK and in charge of synchronizing the operation of the entire system. Timer 23 is considered as secured, in that the information that it contains on the number of used clock cycles is not directly accessible from the outside of the circuit.
A first operating system (block 31, OS1) considered as secured uses time counter 23 when it needs executing tasks which are assigned thereto. In certain cases, the first operating system directly uses counter 23 as a sequencer. In other cases, a register 21 defining a counter COUNT1 is used as a sequencer dedicated to the first exploitation system. This counter (COUNT1) is incremented at rate CLK of timer 23. A second operating system (block 32, OS2) considered as non-secured also uses timer 23 to update a counter COUNT2 stored in a register 22. Exploitation system 31 is considered as secured because the content of its clock register 21 is not accessible by the other exploitation system. Exploitation system 32 is considered not to be secured because the content of its clock register 22 are accessible by the two operating systems.
The making of central processing unit 20 available for one or the other of the operating systems is managed by a mechanism of hardware resource sharing according to various access priority rules. The clock registers dedicated to the different operating systems (especially that of the non-secured system) may be in the software layer.
It is arbitrarily assumed that first operating system OS1 holds the lead during cycles i−5 and i−3 (
As illustrated in
An example of timing attacks on an AES algorithm is described in article “Cache-timing attacks on AES” of Daniel J. Bernstein (Department of Mathematics, Statistics, and Computer Science—The University of Illinois—Chicago, Apr. 14, 2005, XP007901095).
A known solution to solve this problem is described in U.S. Pat. No. 5,994,917 and comprises the introduction of a pseudo-random character into the clock signal frequency. This amounts to providing two clocks different in hardware terms in the central processing unit, each clock being respectively assigned to one of the operating systems.
A problem is that the forming of a hardware clock dedicated to each operating system is not always possible.
The present invention aims at providing a method and a system for timing non-secured tasks on a processor simultaneously supporting a secured operating system and a non-secured operating system by means of a single hardware clock signal.
The present invention more specifically aims at allowing a protection against attacks by examination of the execution times of the secured tasks.
More generally, the present invention aims at making the times of execution of tasks by different operating systems unexploitable while allowing the use of a same hardware or software reference clock.
To achieve all or part of these objects, as well as others, the present invention provides a method of sharing a clock by an electronic circuit between at least one first task clocked by at least one first counter and at least one second task clocked by a second counter, the two counters being clocked at the rate of said clock, the content of the first counter plus or minus an offset value being, on each execution of the second task, assigned to said second counter.
According to an embodiment of the present invention, each counter is assigned to a different operating system of a processor.
According to an embodiment of the present invention, said first counter is a timer of the processor.
The present invention also provides a method for sharing a first value of a timer between at least one first counter for timing at least one first task and at least one second counter for timing at least one second task, said counters being clocked at the rate of a same clock and being updated with said first value plus or minus a second value which is different for each counter.
The present invention also provides a method for protecting the duration of at least one first task clocked by at least one first counter, by an analysis of the duration of at least one second task clocked by a second counter.
According to an embodiment of the present invention, said offset value is selected randomly.
The present invention also provides a system for sharing a clock between at least one first operating system clocked by at least one first counter and at least one second operating system clocked by a second counter.
The present invention also provides a microprocessor comprising such a system.
The present invention also provides a system for sharing a first value between at least one first counter for timing at least one first task and at least one second counter for timing at least one second task.
The foregoing and other objects, features, and advantages of the present invention will be discussed in detail in the following non-limiting description of specific embodiments in connection with the accompanying drawings.
The same elements have been designated with the same reference numerals in the different drawings. For clarity, only those steps and elements which are useful to the understanding of the present invention have been shown in the drawings and will be described hereafter. In particular, the elements that enable passing data from one operating system to the other have not been described in detail, the present invention being compatible with any known method or system. Further, the actual mechanisms for processing the tasks executed by the different operating systems have not been described in detail either, the present invention being here again compatible with conventional mechanisms.
The present invention will be described hereafter in relation with an example of application to tasks executed for different operating systems. It more generally applies to a sharing of the same clock reference (clock signal or hardware or software timer) by different programs (different tasks). Unless otherwise mentioned, all that will be described in relation with different operating systems applies to the execution, by several instances (executions) of the same operating system, of different application programs.
On the side of central processing unit 20, a clock signal CLK clocks a timer 23 used by the central processing unit to execute the instructions coming from the two operating systems. This counter is considered as secured, that is, its content is not accessible at least by the second operating system.
According to the example of
During tasks executed by the first operating system, register 21 contains the same value as counter 23. However, during tasks executed by the second operating system, its clock register 22 is loaded with a value different from that of counter 23. For example, on each assignment of the central processing unit to the second operating system, register 22 is loaded with the value of register 21 incremented or decremented by a number of clock cycles. This function has been illustrated in
Accordingly, the number contained in register 22 dedicated to the second operating system provides no indication as to the number of cycles used by the first one.
As a variation, counter 23 is directly used by the first operating system. Its content, when it is transferred to clock register 22, is then increased or decreased by the variable number of cycles by function 44.
As previously, the execution, from a time t0, of tasks critical as to the security of the data that they manipulate, by the first operating system, for a number n−1 of clock cycles, is assumed.
As previously still, it is assumed that the central processing unit is assigned to the first operating system during cycles i−5 to i−3 and to the second operating system for the next three cycles.
According to this embodiment of the present invention, register 22 is loaded with value i+a−2 at the time (t1) when the second operating system must take the lead. Value a is the value provided by function 44. Accordingly, just before time t0 when the first operating system takes back the lead, the content of register 22 is i+a instead of i in the conventional system.
Register 21 contains the value of the secured clock (absolute time) and its value is not modified. Accordingly, from time t0, the value of counter COUNT1 is i+1 for the execution of the n cycles by the first operating system.
At the end of this execution, it is assumed that the second operating system takes back the lead. Register 22 is then loaded with the value corresponding to that of counter COUNT1, decremented by a value b. As a result, the accessible value contained in register 22 is i+n−b, instead of i+n.
Accordingly, the examination of values i+n−b and i+a contained in register 22 at the end and at the beginning of the execution of the n critical cycles by the first operating system does not enable determining this number n.
The selection between an increment and a decrement on each assignment of the processing unit to the second operating system is, for example, random. In the case of a decrement, it will preferentially be ascertained that the value (b) is lower than the number (n) of cycles during which the first system just took the lead to preserve the progression direction of clock register 22.
An advantage of the present invention is that it enables sharing a same reference clock for several operating systems by protecting the execution of tasks by at least one of the systems against timing attacks.
Of course, the present invention is likely to have various alterations, improvements, and modifications which will readily occur to those skilled in the art. In particular, although the present invention has been described in relation with an example with two operating systems, it more generally applies whatever the number of implemented operating systems. Further, although term “register” has been used to designate the elements containing the counter values, these elements may be any storage element, volatile or not, provided that it is rewritable. Further, all that has been described in relation with timing counters incremented at the rate of the shared clock also applies to counters decremented at the rate of this clock. Finally, the practical implementation of the present invention, be it by hardware or software means, is within the abilities of those skilled in the art based on the functional indications given hereabove.
Such alterations, modifications, and improvements are intended to be part of this disclosure, and are intended to be within the spirit and the scope of the present invention. Accordingly, the foregoing description is by way of example only and is not intended to be limiting. The present invention is limited only as defined in the following claims and the equivalents thereto.
Number | Date | Country | Kind |
---|---|---|---|
06 50541 | Dec 2006 | FR | national |
Number | Name | Date | Kind |
---|---|---|---|
5636373 | Glendening et al. | Jun 1997 | A |
5994917 | Wuidart | Nov 1999 | A |
6209106 | Kubala et al. | Mar 2001 | B1 |
6452980 | Zalud et al. | Sep 2002 | B1 |
6535519 | Ghodrat | Mar 2003 | B1 |
7076802 | Poisner | Jul 2006 | B2 |
20040205368 | Lange-Pearson et al. | Oct 2004 | A1 |
20070081454 | Bergamasco et al. | Apr 2007 | A1 |
Number | Date | Country | |
---|---|---|---|
20070220297 A1 | Sep 2007 | US |