Patent Grant
10223532
The present disclosure generally relates to electronic circuits and, more specifically, to circuits containing elements storing data in non-volatile fashion. The present disclosure, for example, may apply to integrated electronic systems (System On Chip).
As soon as an electronic system manipulates digital data, the data are typically at least temporarily stored in elements of the electronic circuits. These typically are RAM-type volatile storage elements, or registers or flip-flops storing binary data when they are being processed by the electronic circuit.
In principle, these data disappear when the integrated circuit is no longer powered. Actually, they do not really disappear, but the state that they represent is no longer reliable on restarting of the circuit.
In circuits manipulating digital data considered as secret, that is, that can only be accessed by authorized users or circuits, it should be ascertained that the data volatilely manipulated by an integrated circuit are no longer accessible in storage elements for applications other than authorized applications. Areas of the RAM assigned to such applications are thus generally reserved. Such a reservation is however dynamic, that is, it disappears at the circuit switching down or resetting. It should thus be ascertained that the data contained in previously-reserved areas are no longer accessible, for example, after a restarting of the electronic system. Indeed, even if the circuit switching down makes the data non-reliable, they are capable of containing, even partially, secret information. A first step of resetting the volatile memory elements is thus provided at the switching up of an electronic circuit, by erasing the memory at the switching up. Such a technique takes time.
In an embodiment, a method of detecting an attack on an integrated circuit, comprising: transferring, into a first volatile memory of the integrated circuit, a pattern stored in a non-volatile memory of the circuit; periodically causing a switching down and a switching up of the first volatile memory; and verifying that the number of bits which have switched state is within a range of values. According to an embodiment, the pattern is reloaded into the first volatile memory before each switching down. According to an embodiment, the pattern is selected so that said number of bits which switch state varies according to the integrated circuit temperature. According to an embodiment, said range of values is determined by statistical analysis of the states taken by the bits of the first volatile memory in successive switch up operations during a training phase.
According to an embodiment, information to be protected is contained in a second volatile memory, separate from the first one.
In an embodiment, an integrated circuit comprises: a first volatile memory; a non-volatile memory; and circuitry configured to implement a method disclosed herein.
According to an embodiment, the circuit further comprises a second volatile memory, separate from the first one and containing information to be protected against attacks by successive operations of switching up and cooling of the integrated circuit.
According to an embodiment, the circuit further comprises a control circuit causing, each time the integrated circuit is initialized, a transfer of said pattern from the non-volatile memory to the first volatile memory.
In an embodiment, a method comprises: transferring, into a first volatile memory of an integrated circuit, a pattern stored in a non-volatile memory of the integrated circuit; and periodically, switching down and switching up the first volatile memory; generating an indication of a number of switched bits in the first volatile memory; and generating an indication of a cold-boot attack based on the indication of the number of switched bits. In an embodiment, the pattern is reloaded into the first volatile memory before each switching down. In an embodiment, the pattern is selected so that said number of bits which switch state varies according to the integrated circuit temperature. In an embodiment, the generating the indication of the cold-boot attack comprises determining whether the indication of the number of switched bits is within a range of values. In an embodiment, said range of values is determined by statistical analysis of the states taken by the bits of the first volatile memory in successive switch up operations during a training phase. In an embodiment, the generating the indication of the number of switched bits comprises counting at least one of: a number of bits in a first state; and a number of bits in a second state different from the first state. In an embodiment, the generating the indication of the number of switched bits comprises at least one of: comparing the number of bits in the first state to one or more threshold values; and comparing the number of bits in the second state to one or more threshold values.
In an embodiment, a device comprises: a first volatile memory; a non-volatile memory; and cold-boot detection circuitry configured to: transfer a pattern stored in the non-volatile memory to the first volatile memory; and periodically, switch down and switch up the first volatile memory; generate an indication of a number of switched bits in the first volatile memory; and generate an indication of a cold-boot attack based on the indication of the number of switched bits. In an embodiment, the pattern is reloaded into the first volatile memory before each switching down. In an embodiment, the pattern is selected so that said number of bits which switch state is an indication of a temperature of the device. In an embodiment, the cold-boot attack detection circuitry is configured to determine whether the indication of the number of switched bits is within a range of values. In an embodiment, the cold-boot detection circuitry comprises a counter. In an embodiment, the cold-boot detection circuitry is configured to count at least one of: a number of bits in a first state; and a number of bits in a second state different from the first state. In an embodiment, the device comprises an integrated circuit including the first volatile memory, the non-volatile memory and the cold-boot detection circuitry. In an embodiment, the integrated circuit includes a second volatile memory different from the first volatile memory and the second volatile memory is configured to, in operation, store protected data.
In an embodiment, a system comprises: a processing unit; a first volatile memory; a non-volatile memory; and cold-boot detection circuitry configured to: transfer a pattern stored in the non-volatile memory to the first volatile memory; and periodically, switch down and switch up the first volatile memory; generate an indication of a number of switched bits in the first volatile memory; and generate an indication of a cold-boot attack based on the indication of the number of switched bits. In an embodiment, the cold-boot attack detection circuitry is configured to determine whether the indication of the number of switched bits is within a range of values. In an embodiment, the cold-boot detection circuitry comprises a counter. In an embodiment, the system comprises an integrated circuit including the first volatile memory, the non-volatile memory and the cold-boot detection circuitry. In an embodiment, the integrated circuit includes a second volatile memory different from the first volatile memory.
The same elements have been designated with the same reference numerals in the different drawings. For clarity, only those steps and elements which are useful to the understanding of the embodiments which will be described have been shown and will be detailed. In particular, the structure of a volatile memory has not been detailed, the described embodiments being compatible with usual structures and characteristics of such memories and volatile storage elements. Further, the circuits and electronic systems comprising volatile storage elements having a content which needs protection have not been detailed either, the described embodiments being here again compatible with usual circuits and systems.
Memory 12 stores different data manipulated by the different circuits, and particularly by processing unit 16. In applications where the electronic circuit manipulates secret quantities, be they data or algorithms, one or a plurality of areas of memory 12 are dedicated to such so-called secure applications. To achieve this, on starting of the circuit or when it is initialized, processing unit 16 or a unit dedicated to the memory (memory management unit, for example) configures rights of access to these areas of memory 12 and, for example, reserves the access of certain areas to programs authorized to manipulate the secret data.
A problem which arises is the vulnerability of the data stored in the volatile memory to attacks by resetting of the circuit. Indeed, when the circuit is switched down and back up, an interruption of the protected area configuration process or of the RAM reset process may provide access to the secret data processed before the resetting.
An example of this type of attack is known as “Cold Boot” since they often come along with a cooling of the integrated circuit to slow down the reset process.
Such attacks are generally performed repeatedly, that is, the attacker successively turns the integrated circuit off and on with a short delay (so that the memory does not have time to reset).
The inventor has discovered that, for a same cell content in a volatile memory, this content would statistically mainly take the same values after a switching down and back up. In other words, based on a pattern stored in a memory area, a pattern related thereto, or a proportion of states 0 and of states 1, can be found in the memory content after each resetting. It is then possible to determine the pattern or the proportion of states 0 and of states 1 that the memory will take after the storage of the first pattern and the successive reset operations. Pattern means a set of binary states contained in the concerned memory area.
According to an embodiment, it is provided to dedicate to the detection of cold boot type attacks a volatile memory separated from the memory storing the critical data, for example, of a size smaller than the size of the volatile memory used by the circuit.
According to an embodiment, it is provided to use a ring oscillator to detect an attack of cold boot type. The inventor has indeed observed that the reproducibility of the successive output states of a flip-flop sampling an output of such an oscillator is similar to that of a pattern in a volatile memory. A difference however is that the pattern is native in the case of a ring oscillator.
In both cases, it is started by determining, in a preparatory or training phase, the value or the proportion of states taken by the dedicated memory or the oscillator output after sudden resets. Such a determination then enables, in an operational phase, to compare the value or the proportion of states, for example, periodically, to detect a possible attack.
It determines a pattern which will then be stored in a non-volatile memory of the circuit to be transferred, at each initialization, into the volatile memory dedicated to the protection.
Thus, according to an embodiment, in a preparatory or training phase, a pattern is stored in a volatile memory (block 31, Prot RAM) dedicated to the protection or reference memory. In an embodiment, this memory 31 is different from the memory to be protected (12,
The circuit is then switched down (block 32, SWITCH DOWN), and then, after a short delay, switched back up (block 33, SWITCH UP). The delay between the switching down and up (power-off time) may be configurable (block 34, TIME) and may take different values. Typically, this delay is in the range from a few microseconds to a few seconds.
Once the circuit has been switched back up, the memory 12 content is read (block 34, READ Prot RAM). This reading is performed without having reset the memory. The reading aims at determining the number of memory cells which have switched state under the effect of the switching down/up. Rather than looking for the pattern stored in the memory, it is aimed at determining the effect of the switching down/up on the memory. The number of state switchings is stored (block 35, HISTOGRAM) and the process is repeated several times (block 36, REPEAT). This repeating aims at statistically determining the histogram of the number of state switchings on switching up of the memory 12.
The steps may be repeated for a plurality of patterns (arrow 37), for a plurality of time periods (arrow 38) and a plurality of temperatures (arrow 39 and block 40—TEMP). As a variation, they are also repeated for a plurality of power supply voltages.
To execute the process according to a plurality of patterns, it is returned to step 31 of storage into memory Prot RAM. To execute the process according to a plurality of power-off time periods, it is returned to switch-down step 32. To execute the process with a plurality of temperatures, it is returned before step 31 to try again with different patterns.
This training phase is, for a given pattern, used to determine in which statistical interval the number of state switchings after a switching down/up is located, for example, for different temperatures and different power-off time periods and different power supply voltages. According to an embodiment, the Hamming distance between the reference pattern and the current pattern is determined by combining their respective states by an XNOR-type comparison.
In an embodiment, one or a plurality of patterns and one or a plurality of power-off times periods which are most representative in terms of information relative to the circuit temperature are extracted from the training phase. In other words a pattern and a power-off time period for which the variation of the number of state switchings according to the circuit temperature is most significant are searched for. Thus, in operational phase, a switching down and up of the reference memory containing this pattern enables to assess the circuit temperature and, accordingly, the probability of being confronted to an attack.
Once the pattern has been selected, it is stored in a non-volatile memory area of circuit 1. The protection RAM is configured so that it can be loaded with the pattern on each reset operation.
It comprises a processing unit 16, a volatile memory 12 to be protected, and one or a plurality of functions 18. Further, circuit 5 comprises a non-volatile memory 52 (NVM). This memory is not necessarily dedicated to the protection, and may be a memory used by the other circuit functions. It may accordingly, unlike what is shown, be connected to buses 14.
Detection circuit 5 comprises a protection circuit 54 (PROT IC), for example, according to an embodiment, a volatile memory (31,
Control circuit 56 controls the transfer of the pattern stored in memory 52 to memory 54 each time the circuit is reset.
In the representation of
For each initialization (block 61, INIT) or resetting of circuit 5, the pattern stored in memory 52 is transferred (block 62, PATTERN→Prot RAM) into protection memory 54.
Then, circuit 36 starts, periodically (loop illustrated by block 63, TIMER) in an embodiment, a verification procedure 60.
This procedure starts with a switching down (block 64, SWITCH DOWN), followed after a power-off time (block 65, TIME), by a switching up (block 66, SWITCH UP) of reference memory 54 (here, memory 31,
If number COUNT is outside of the range (output N of block 67), this means a high probability of being confronted to an attack, that is, the circuit has been cooled since the last verification, and circuit 56 returns a state NOK.
According to an alternative embodiment, the characterization phase has enabled to determine a pattern which does not require being loaded, that is, in the authorized temperature range, the switching down/up of the reference memory provides a count COUNT remaining within the authorized range with no pattern reloading. In this case, step 62′ is avoided.
The periodicity with which the test is performed is selected to be sufficiently short for the number of possible attacks by interruption between two tests to be insufficient for an attacker to discover the critical information.
According to the fineness desired in the detection, a plurality of patterns may be kept for different temperatures in the non-volatile memory and their respective responses. The pattern to be stored can then be selected according to the operating temperature of the circuit (which may be fitted with a temperature sensor) and the pattern can be updated, in the protection RAM, according to the operating temperature. Of course, this is done at the cost of a larger space in the non-volatile memory. As a specific embodiment, the pattern comprises from 8 to 64 bits.
It is provided to integrate one or a plurality of ring oscillators in circuit 5. In the example of
Signal OUT is interpreted to determine its variation relative to a reference signal in an authorized operating temperature range.
For example, signal OUT is sent to the input of a shift register 75 (REG) at the rate of clock CLK, storing a result originating from the previous outputs of the ring oscillator. Each time a verification is needed (on each attack detection test), it is verified (block 77, COUNT C RANGE?) whether the number of states “1” (or the number of states “0”) in register 75 is within an authorized range RANGE.
Indeed, the response of the ring oscillator varies according to temperature, which influences the thermal noise of the transistors, which conditions the state switchings at input D of flip-flop 74.
As in the case of a reference volatile memory described hereabove, the statistical response (that is, the state of the output bit of flip-flop 74 or, more specifically, the number of “0s” or of “1s” in register 75) is determined at different temperatures, in a training phase, to determine the majority output taken on switching up. Interval RANGE with which the response of circuit 54′ is to be compared is, as in the embodiment based on a dedicated memory, stored in non-volatile memory 32.
As compared with the embodiment of
In the normal operating range of the circuit, the oscillations have a given shape (arbitrary). In the presence of a cold-boot attack, the shape of the oscillations of the ring oscillator is altered. As to the clock signal, assuming that the clock is stable, the cooling results in modifying the frequency, but not the duty cycle. Thus, the signal at the output of flip-flop 75 has another shape than when there is no attack.
As a variation, a circuit of another nature is integrated to play the role of circuit 54′. For example, an integrated circuit for which the statistical response of an output signal is different, when it is submitted to repeated switching down/up operations with a cooling, from the response during a stable operation.
Specific embodiments have been described. Various alterations, modifications, and improvements will readily occur to those skilled in the art. In particular, the practical implementation of the described embodiments is within the abilities of those skilled in the art based on the functional indications given hereabove.
Such alterations, modifications, and improvements are intended to be part of this disclosure, and are intended to be within the spirit and the scope of the present disclosure. Accordingly, the foregoing description is by way of example only and is not intended to be limiting.
Some embodiments may take the form of or include computer program products. For example, according to one embodiment there is provided a computer readable medium including a computer program adapted to perform one or more of the methods or functions described above. The medium may be a physical storage medium such as for example a Read Only Memory (ROM) chip, or a disk such as a Digital Versatile Disk (DVD-ROM), Compact Disk (CD-ROM), a hard disk, a memory, a network, or a portable media article to be read by an appropriate drive or via an appropriate connection, including as encoded in one or more barcodes or other related codes stored on one or more such computer-readable mediums and being readable by an appropriate reader device.
Furthermore, in some embodiments, some of the systems and/or modules and/or circuits and/or blocks may be implemented or provided in other manners, such as at least partially in firmware and/or hardware, including, but not limited to, one or more application-specific integrated circuits (ASICs), digital signal processors, discrete circuitry, logic gates, shift registers, standard integrated circuits, state machines, look-up tables, controllers (e.g., by executing appropriate instructions, and including microcontrollers and/or embedded controllers), field-programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), etc., as well as devices that employ RFID technology, and various combinations thereof.
The various embodiments described above can be combined to provide further embodiments. Aspects of the embodiments can be modified, if necessary to employ concepts of the various patents, applications and publications to provide yet further embodiments.
These and other changes can be made to the embodiments in light of the above-detailed description. In general, in the following claims, the terms used should not be construed to limit the claims to the specific embodiments disclosed in the specification and the claims, but should be construed to include all possible embodiments along with the full scope of equivalents to which such claims are entitled. Accordingly, the claims are not limited by the disclosure.
| Number | Date | Country | Kind |
|---|---|---|---|
| 14 55257 | Jun 2014 | FR | national |
| 14 55258 | Jun 2014 | FR | national |
| Number | Name | Date | Kind |
|---|---|---|---|
| 6330668 | Curiger et al. | Dec 2001 | B1 |
| 8719666 | Marinet | May 2014 | B2 |
| 20090096495 | Keigo | Apr 2009 | A1 |
| 20120006122 | Aitken | Jan 2012 | A1 |
| 20120079593 | Adams et al. | Mar 2012 | A1 |
| 20140215613 | Kelley et al. | Jul 2014 | A1 |
| 20160239663 | Healy et al. | Aug 2016 | A1 |
| Number | Date | Country |
|---|---|---|
| 2 974 648 | Nov 2012 | FR |
| 2011018414 | Feb 2011 | WO |
| Entry |
|---|
| Franco et al., “Ring Oscillators as Thermal Sensors in FPGAS: Experiments in Low Voltage,” IEEE, 2010, pp. 133-137. (6 pages). |
| Gruhn et al., “On the Practicability of Cold Boot Attacks,” International Conference on Availability, Reliability and Security, Regensburg, Germany, Sep. 2-6, 2013, pp. 390-397. |
| Halderman et al., “Lest We Remember: Cold Boot Attacks on Encryption Keys,” Proceedings of the 17th USENIX Security Symposium, San Jose, California, USA, Jul. 28-Aug. 1, 2008, 16 pages. |
| Müller, “Keepers of the Codes,” Pictures of the Future, Fall 2005, p. 39. |
| Simmons, “Security Through Amnesia: A Software-Based Solution to the Cold Boot Attack on Disk Encryption,” Annual Computer Security Applications Conference, Orlando, Florida, USA, Dec. 5-9, 2011, pp. 73-82. |
| Number | Date | Country | |
|---|---|---|---|
| 20170286687 A1 | Oct 2017 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 14668692 | Mar 2015 | US |
| Child | 15622991 | US |
