Time and frequency domain side-channel leakage suppression using integrated voltage regulator cascaded with runtime crypto arithmetic transformations

Patent metadata

Field	Value
Publication number	US-12047485-B2
Application number	US-202017132365-A
Country	US
Kind code	B2
Filing date	Dec 23, 2020
Priority date	Dec 23, 2020
Publication date	Jul 23, 2024
Grant date	Jul 23, 2024

Abstract

Apparatus and method for resisting side-channel attacks on cryptographic engines are described herein. An apparatus embodiment includes a cryptographic block coupled to a non-linear low-dropout voltage regulator (NL-LDO). The NL-LDO includes a scalable power train to provide a variable load current to the cryptographic block, randomization circuitry to generate randomized values for setting a plurality of parameters, and a controller to adjust the variable load current provided to the cryptographic block based on the parameters and the current voltage of the cryptographic block. The controller to cause a decrease in the variable load current when the current voltage is above a high voltage threshold, an increase in the variable load current when the current voltage is below a low voltage threshold; and a maximization of the variable load current when the current voltage is below an undervoltage threshold. The cryptographic block may be implemented with arithmetic transformations.

First claim

The invention claimed is:

1. An apparatus comprising:
a cryptographic block (crypto block) to perform cryptographic operations, the crypto block to consume a variable amount of power based on the cryptographic operations performed by the crypto block; and
a non-linear low-dropout voltage regulator (NL-LDO) coupled to a power input of the crypto block, the NL-LDO to provide a non-linear transformation of the variable amount of power consumed by the crypto block, the NL-LDO comprising:
a scalable power train to provide a variable load current to the crypto block;
randomization circuitry to generate randomized values for setting a plurality of parameters including voltage thresholds and scalable power train strength levels, the voltage thresholds comprising a high voltage threshold, a low voltage threshold, and a undervoltage threshold; and
a controller to adjust the variable load current provided by the scalable power train to the crypto block based on the plurality of parameters and a current voltage of the crypto block at the power input;
wherein the controller is to cause:
a decrease in the variable load current provided to the crypto block when the current voltage of the crypto block is above the high voltage threshold;
an increase in the variable load current provided to the crypto block when the current voltage of the crypto block is below the low voltage threshold; and
a maximization of the variable load current provided to the crypto block when the current voltage of the crypto block is below the undervoltage threshold.

2. The apparatus of claim 1 , wherein the scalable power train comprises a plurality of power tiles, each power tile capable of providing load current at one of the power strength levels set by randomized values generated by the randomization circuitry.

3. The apparatus of claim 2 , wherein the controller is to turn on or off different power tiles to adjust the variable load current provided to the crypto block.

4. The apparatus of claim 1 , wherein the randomization circuitry is to generate a randomized bit sequence divided into a plurality of different portions, each portion used to set a value for one of the voltage thresholds or one of the power strength levels of the power train.

5. The apparatus of claim 4 , wherein a mask is applied to the randomized bit sequence to limit a range of the randomized values for setting the plurality of parameters.

6. The apparatus of claim 5 , wherein based on the mask, the high voltage threshold is always set to a value greater than the low voltage threshold and the undervoltage threshold.

7. The apparatus of claim 5 , wherein based on the mask, the low voltage threshold is always set to a value greater than the undervoltage threshold.

8. The apparatus of claim 4 , wherein the randomization circuitry comprises a linear-feedback shift register (LFSR) to generate the randomized bit sequence.

9. The apparatus of claim 1 , wherein the crypto block comprises one of an AES crypto block, an RSA crypto block, or an ECC crypto block.

10. The apparatus of claim 1 , wherein the NL-LDO is to concurrently provide a second variable load current to a second crypto block.

11. The apparatus of claim 1 , wherein the crypto block is implemented with arithmetic transformations.

12. The apparatus of claim 11 , wherein the crypto block comprises an AES crypto block and the arithmetic transformations comprise randomized data flow through heterogeneous Sboxes, dual-rail key addition, and linear-masked MixColumns.

13. A method comprising:
coupling a non-linear low-dropout voltage regulator (NL-LDO) to a power input of a cryptographic block (crypto block), the crypto block to consume a variable amount of power based on different cryptographic operations performed by the crypto block;
providing, by the NL-LDO, a variable load current to the crypto block and a non-linear transformation of the variable amount of power consumed by the crypto block;
generating randomized values for setting a plurality of parameters including voltage thresholds and power strength levels, the voltage thresholds comprising a high voltage threshold, a low voltage threshold, and a undervoltage threshold;
adjusting the variable load current provided to the crypto block based on the plurality of parameters and a current voltage of the crypto block at the power input, wherein the adjusting comprises:
decreasing the variable load current provided to the crypto block when the current voltage of the crypto block is above the high voltage threshold;
increasing the variable load current provided to the crypto block when the current voltage of crypto block is below the low voltage threshold; and
maximizing the variable load current provided to the crypto block when the current voltage of the crypto block is below the undervoltage threshold.

14. The method of claim 13 , further comprises providing load current at one of the power strength levels set by the randomized values.

15. The method of claim 14 , further comprises turning on or off different power tiles of the NL-LDO to adjust the variable load current provided to the crypto block.

16. The method of claim 13 , wherein generating randomized values for setting the plurality of parameters further comprises:
generating a randomized bit sequence;
dividing the randomized bit sequence into a plurality of different portions; and
using each portion to set a value for one of the voltage thresholds or one of the power strength levels.

17. The method of claim 16 , further comprises applying a mask to the randomized bit sequence to limit a range of the randomized values for setting the plurality of parameters.

18. The method of claim 17 , further comprises setting the high voltage threshold to a value greater than the low voltage threshold and the undervoltage threshold based on the mask.

19. The method of claim 17 , further comprises setting the low voltage threshold to a value greater than the undervoltage threshold based on the mask.

20. The method of claim 16 , further comprises generating the randomized bit sequence using a linear-feedback shift register (LFSR).

21. The method of claim 13 , wherein the crypto block comprises one of an AES crypto block, an RSA crypto block, or an ECC crypto block.

22. The method of claim 13 , further comprises concurrently providing, by the NL-LDO, a second variable load current to a second crypto block.

23. The method of claim 13 , wherein the crypto block comprises an AES crypto block including arithmetic transformations that includes randomized data flow through heterogeneous Sboxes, dual-rail key addition, and linear-masked MixColumns.

Assignees

• Intel Corp

Inventors

• Kumar Raghavan
• Liu Xiaosen
• Krishnamurthy Harish
• Mathew Sanu
• Suresh Vikram

Classifications

• H04L2209/08

  Randomization, e.g. dummy operations or using noise · CPC title

• H04L9/0631 Primary

  Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms · CPC title

• G06F1/26

  Power supply means, e.g. regulation thereof (for memories G11C) · CPC title

• G05F1/575

  characterised by the feedback circuit · CPC title

• G05F1/468

  characterised by reference voltage circuitry, e.g. soft start, remote shutdown · CPC title