Tamper resistant cryptographic algorithm implementation

Patent metadata

Field	Value
Publication number	US-10127390-B2
Application number	US-201314779264-A
Country	US
Kind code	B2
Filing date	Mar 27, 2013
Priority date	Mar 27, 2013
Publication date	Nov 13, 2018
Grant date	Nov 13, 2018

Abstract

There is provided a method of performing a cryptographic algorithm in software, the cryptographic algorithm comprising one or more processing steps, wherein each processing step is arranged to process a respective input to the processing step so as to generate an output corresponding to the input, characterized in that, for each of at least one of the one or more processing steps, the method comprises: providing a respective input for the processing step as an input to a plurality of implementations of the processing step, wherein each implementation is arranged to output a corresponding intermediate result represented using a respective predetermined output representation; and using the representation of the intermediate results to generate a result for the processing step that is based on each of the intermediate results, wherein, if each intermediate result is the output that corresponds to the input for the processing step then the result for the processing step is the output that corresponds to the input for the processing step. Additionally provided is a method of enabling a data processor to perform a cryptographic algorithm in software, the method comprising: generating an implementation of the cryptographic algorithm, the implementation being arranged such that execution of the implementation by a processor causes the processor to carry out a method according to any one of the preceding claims; and configuring the data processor to execute the implementation of the cryptographic algorithm. There is further provided a system and computer program for carrying out such methods, as well as a computer readable medium for storing such a computer program.

First claim

The invention claimed is:

1. A method of secured execution of a cryptographic algorithm by at least one computer processor, the cryptographic algorithm comprising one or more processing steps, wherein each processing step is arranged to process a respective input to the processing step so as to generate an output corresponding to the input, characterized in that, for at least a particular processing step of the one or more processing steps, the method comprises:
providing an input for the particular processing step as an input to a plurality of implementations of the particular processing step, wherein each implementation of the particular processing step is arranged to output a corresponding intermediate result represented using a respective predetermined output representation; and
using the predetermined output representation of the intermediate results to generate a corresponding result for the particular processing step that is based on each of the intermediate results, wherein, if each intermediate result is the output that corresponds to the input for the particular processing step then the result for the particular processing step is the output that corresponds to the input for the particular processing step, wherein a difference between two or more intermediate results is indicative of potential tampering with the secured execution of the cryptographic algorithm.

2. The method of claim 1 , wherein each implementation uses a respective predetermined output representation that is different from the respective predetermined output representation used by the other implementations.

3. The method of any claim 1 , wherein for at least one of the implementations, the respective predetermined representation represents the intermediate result as the intermediate result.

4. The method of claim 1 , wherein each predetermined representation is a bijective mapping.

5. The method of claim 1 , wherein the result is generated as a function of the intermediate results such that if all of the intermediate results assume the same value then the result assumes that value.

6. The method of claim 1 , wherein the result is generated as a function of the intermediate results such that if the intermediate results do not all assume the same value then the result assumes a random value or a predetermined value.

7. The method of claim 1 , wherein the result is generated as a function of the intermediate results such that if the intermediate results do not all assume the same value then it is infeasible to determine, from the result, the output that corresponds to the input for the processing step.

8. The method of claim 1 , wherein the result is generated as a function of the intermediate results such that if the intermediate results do not all assume the same value then the result is an average of the intermediate results.

9. The method of claim 8 , wherein the average of the intermediate results is a mode of the intermediate results.

10. The method of claim 1 , wherein using the representation of the intermediate results to generate a result for the particular processing step that is based on each of the intermediate results comprises:
determining whether all of the intermediate results assume the same value and;
if it is determined that the intermediate results do not all assume the same value, performing a predetermined action.

11. The method of claim 10 , wherein the predetermined action comprises one or more of:
(a) ceasing performing the cryptographic algorithm;
(b) recording that the intermediate results do not all assume the same value.

12. The method of claim 1 , wherein the input for the particular processing step is provided as an input to the plurality of implementations of the processing step encoded using a predetermined encoding.

13. The method of claim 1 , wherein generating the result comprises generating the result encoded using a predetermined encoding.

14. The method of claim 1 , wherein the at least one of the one or more processing steps is an operation comprising a plurality of processing steps for that operation.

15. The method of claim 1 , wherein the at least one of the one or more processing steps comprises one or more rounds for the cryptographic algorithm.

16. The method of claim 1 , wherein the cryptographic algorithm is either encryption or decryption according to AES or triple DES.

17. The method of claim 1 wherein the at least one of the one or more processing steps together form a final processing operation for cryptographic algorithm.

18. A method of enabling a data processor to perform secured execution of a cryptographic algorithm in software, the method comprising:
generating an implementation of the cryptographic algorithm, the implementation being arranged such that execution of the implementation by a processor causes the processor to carry out a method according to claim 1 ; and
configuring the data processor to execute the implementation of the cryptographic algorithm.

19. A system comprising one or more hardware processors arranged to carry out a method of performing secured execution of a cryptographic algorithm, the cryptographic algorithm comprising one or more processing steps, wherein each processing step is arranged to process a respective input to the processing step so as to generate an output corresponding to the input, characterized in that, for at least a particular processing step of the one or more processing steps, the method comprises:
providing an input for the particular processing step as an input to a plurality of implementations of the particular processing step, wherein each implementation of the particular processing step is arranged to output a corresponding intermediate result represented using a respective predetermined output representation; and
using the predetermined output representation of the intermediate results to generate a corresponding result for the particular processing step that is based on each of the intermediate results, wherein, if each intermediate result is the output that corresponds to the input for the particular processing step then the result for the particular processing step is the output that corresponds to the input for the particular processing step, wherein a difference between two or more intermediate results is indicative of potential tampering with the secured execution of the cryptographic algorithm.

20. A non-transitory computer readable medium storing a computer program which, when executed by one or more processors, causes the one or more processors to carry out a method of performing secured execution of a cryptographic algorithm , the cryptographic algorithm comprising one or more processing steps, wherein each processing step is arranged to process a respective input to the processing step so as to generate an output corresponding to the input, characterized in that, for at least a particular processing step of the one or more processing steps, the method comprises:
providing an input for the particular processing step as an input to a plurality of implementations of the particular processing step, wherein each implementation of the particular processing step is arranged to output a corresponding intermediate result represented using a respective predetermined output representation; and
using the predetermined output representation of the intermediate results to generate a corresponding result for the particular processing step that is based on each of the intermediate results, wherein, if each intermediate result is the output

Assignees

• Irdeto Bv

Inventors

• Wiener Michael

Classifications

• H04L9/0631

  Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms · CPC title

• H04L9/004 Primary

  for fault attacks · CPC title

• H04L2209/16

  Obfuscation or hiding, e.g. involving white box · CPC title

• G06F9/466

  Transaction processing · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title