Patent Application
20130191652
Cryptography is the practice and study of techniques for secure communication in the presence of third parties (often called adversaries). More generally, cryptography is about constructing and analyzing protocols that overcome the influence of adversaries and which are related to various aspects in information security such as data confidentiality, data integrity and authentication. Applications of cryptography include ATM cards, computers and personal digital assistants (PDAs).
Encryption is the process of converting ordinary information (often called plain text) into unintelligible gibberish (often called cipher text). Decryption is the reverse; moving from the unintelligible cipher text back to plain text. A cipher (or cypher) is a pair of algorithms that create the encryption and the reversing decryption. The detailed operation of a cipher is controlled both by the algorithms and in each instance by a key. A key is a secret parameter (ideally known only to the communicants) for a specific message exchange context. Symmetric-key cryptography refers to encryption methods in which both the sender and receiver share the same key. Cryptanalysis is the study of methods for obtaining the meaning of encrypted information without access to the key normally required to do so (i.e. the study of how to “crack” encryption algorithms or their implementations).
The advanced encryption standard (AES), adopted by the US government, is one of the most popular algorithms used for symmetric key cryptography. Because of its theoretical strength and because it is relatively simple to implement in hardware, it has been adopted in many portable electronics (e.g. smart cards and readers). While the AES algorithm itself has been considered to provide adequate security for today's applications, physical implementations of the algorithm on integrated circuits (ICs), for example, may leak information such that the security information may be stolen.
Power analysis attacks have been used with great effectiveness to steal secure information from cryptographic devices. The power analysis attacks exploit the fact that the behavior of power consumption (i.e. “side-channel” information) of a cryptographic device is related to the computations performed by the cryptographic device.
A differential power analysis (DPA) attack is one form of a power analysis attack. A DPA attack uses a large number of power traces (sometimes more than a hundred thousand traces) to correlate them to a hypothetical power model of a cryptographic algorithm. The use of DPA attacks to obtain otherwise secure information has been highly effective. A DPA attack can reveal a key to the AES algorithm by analyzing less than 2000 power traces from a circuit on an IC that implements the AES algorithm (i.e. an AES core). Therefore, it is important that an AES circuit not leak a power “signature” that may be used by DPA attacks to retrieve secure information from the AES circuit.
The drawings and description, in general, disclose a method and device for reducing the probability that secure information may be obtained by unwanted third parties from a cryptographic device. In an embodiment of the invention, a cryptographic device includes an active shunt current regulator, a low-pass filter, a linear voltage regulator and an AES (advanced encryption standard) circuit. The AES circuit encrypts information using the advanced encryption standard algorithm. The cryptographic device, in general, “hides” the power consumed by the AES circuit by preventing power “spikes” (see
The low-pass filter “smooths” the power spikes on the electrical node that provides power to the AES circuit by providing charge when the AES is operating. The active shunt current regulator shunts current to ground when the AES is not drawing significant amounts of current keeping the current drawn through the electrical node substantially constant (i.e. prevents power spikes). The linear voltage regulator acts as a low-pass filter and keeps the power supply voltage on the AES circuit reasonably constant.
The cumulative effect of the low-pass filter, the linear voltage regulator and the active shunt current regulator is to smooth the power spikes on the electrical node that provides power to the AES circuit. Smoothing the power spikes on the electrical node reduces the probability that secure information created by the AES circuit may be obtained by unwanted third parties. The operation of the low-pass filter, the linear voltage regulator and the active shunt current regulator will be explained in more detail later in the specification.
The second terminal of the sensing resistor R1 is connected to an input of the active shunt current regulator 210 and the input of the low-pass filter 202. The output 212 of the low-pass filter 202 is connected to the input of the linear voltage regulator 204. The output 214 of the linear voltage regulator 204 is connected to the input of the AES circuit 206.
A reference voltage Vref1 is created at the second input of the operational amplifier 402 by connecting a first terminal of variable resistor R4 to the second terminal of resistor R3. The reference voltage Vref1 can be adjusted by varying the resistance of resistor R3. The output 408 of the operational amplifier 402 is directly connected to the gate of NFET1. The source of NFET1 is connected to ground.
The voltage on node 408 is proportional to the voltage Vdif1 between the inputs 406 and Vref1. When the voltage Vin between the inputs 404 and 406 increases, the voltage on node 408 decreases thereby decreasing the current drawn through NFET1. When the voltage Vin between the inputs 404 and 406 decreases, the voltage on node 408 increases thereby increasing the current drawn through NFET1. This feedback mechanism in the active shunt current regulator 208 helps to maintain the current I1 drawn through node N1 (see
A capacitor C2 is also directly connected to the output Vreg of the voltage regulator 204. The capacitor C2 acts as a low-pass filter helping to maintain a substantially constant voltage on the output Vreg of the voltage regulator 204. A first terminal of resistor R5 is connected to the output Vreg. The second terminal of resistor R5 is connected to a first input 506 of an operational amplifier 502 and to the first terminal of variable resistor R6. Varying the resistance of resistor R6 makes it possible to adjust the voltage on the first input 506 of the operational amplifier 502.
A reference voltage Vref2 is provided to the second input of the operational amplifier 502. The reference voltage Vref2 remains substantially constant. The difference voltage Vdif2 determines the voltage 504 provided to the gate of PFET1. The feedback from node 506 changes the difference voltage Vdif2 and as a result helps to maintain a substantially constant voltage on the output Vreg of the voltage regulator 204.
The second terminal of the sensing resistor R1 is connected to an input of the active shunt current regulator 210 and the input of the low-pass filter 202. The output 212 of the low-pass filter 202 is connected to the input of the linear voltage regulator 204. The output 214 of the linear voltage regulator 204 is connected to the input of the AES circuit 206 and to a first input of the noise generator 216. A second input of the noise generator 602 is directly connected to node N1.
The cumulative effect of the low-pass filter 202, the linear voltage regulator 204 and the active shunt current regulator 208 is to smooth the power spikes on the electrical node N1 that provides power to the AES circuit. Smoothing the power spikes on the electrical node N1 reduces the probability that secure information created by the AES circuit may be obtained by unwanted third parties.
The noise generator 602 shown in
The foregoing description has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed, and other modifications and variations may be possible in light of the above teachings. The embodiments were chosen and described in order to best explain the applicable principles and their practical application to thereby enable others skilled in the art to best utilize various embodiments and various modifications as are suited to the particular use contemplated. It is intended that the appended claims be construed to include other alternative embodiments except insofar as limited by the prior art.
