Method and device for protecting information from side channel attack
Provided is a method, performed by a device, of protecting information from a side channel attack, the method including: loading a library shared by at least one application installed in the device to a memory of a first layer; inputting a value to a function of the library; based on the value being input, detecting a region of the memory accessed by the device from among regions of the memory of the first layer, to which the library is loaded; generating a protection code which accesses regions of the memory other than the detected region from among the regions of the memory of the first layer, to which the library is loaded; and adding the protection code to the function of the library.
1. A method, performed by a device, of protecting information from a side channel attack, the method comprising:
loading a library shared by at least one application installed in the device to a memory of a first layer;
inputting a value to a function of the library;
based on the value being input, detecting a region of the memory accessed by the device from among regions of the memory of the first layer, to which the library is loaded;
generating a protection code which accesses, when the detected region is accessed in response to inputting the value to the function of the library, at least one region of the memory of the first layer other than the detected region from among the regions of the memory of the first layer, to which the library is loaded; and
adding the protection code to the function of the library.
2. The method of claim 1 , wherein the generating of the protection code comprises:
inputting a plurality of values into the function;
based on the plurality of values being input, detecting regions of the memory accessed by the device from among the regions of the memory of the first layer, to which the library is loaded, respectively with respect to the plurality of values; and
determining whether to generate the protection code based on whether the regions respectively detected with respect to the plurality of values are different from each other.
3. The method of claim 1 , wherein the generating of the protection code comprises determining the at least one s-region of the memory of the first layer, which is to be accessed by the protection code, based on the detected region.
4. The method of claim 1 , wherein the detecting of the region comprises:
measuring a time taken to access the region of the memory from among the regions of the memory of the first layer, to which the library is loaded, after the value is input; and
detecting the region of the memory accessed by the device, based on the time that is measured.
5. The method of claim 1 , wherein, based on the region of the memory of the first layer being accessed by the function of the library, data of the accessed region of the memory of the first layer is loaded to a memory of a second layer.
6. The method of claim 5 , wherein the memory of the first layer is a memory of a layer that is lower than the memory of the second layer.
7. The method of claim 5 , wherein the memory of the first layer is a main memory, and the memory of the second layer is a cache memory or a register.
8. A device comprising:
a memory of a first layer configured to load a library shared by at least one application installed in the device; and
a processor configured to:
input a value to a function of the library,
based on the value being input, detect a region of the memory from among regions of the memory of the first layer, to which the library is loaded,
generate a protection code which accesses, when the detected region is accessed in response to inputting the value to the function of the library, at least one region of the memory of the first layer other than the accessed region from among the regions of the memory of the first layer, to which the library is loaded, and
add the protection code to the function of the library.
9. The device of claim 8 , wherein the processor is further configured to:
input a plurality of values into the function,
based on the plurality of values being input, detect regions of the memory accessed by the processor from among the regions of the memory of the first layer, to which the library is loaded, respectively with respect to the plurality of values, and
determine whether to generate the protection code based on whether the regions respectively detected with respect to the plurality of values are different from each other.
10. The device of claim 8 , wherein the processor is further configured to determine the at least one region of the memory of the first layer, which is to be accessed by the protection code, based on the region accessed by the processor.
11. The device of claim 8 , wherein the processor is further configured to:
measure a time taken to access the region of the memory from among the regions of the memory of the first layer, to which the library is loaded, after the value is input, and
detect the region of the memory accessed by the processor device based on the measured time.
12. The device of claim 8 , further comprising a memory of a second layer, wherein, based on the at least one region of the memory of the first layer being accessed by the function of the library, data of the accessed region of the memory of the first layer is loaded to the memory of the second layer.
13. The device of claim 12 , wherein the memory of the first layer is a memory of a layer lower than the memory of the second layer.
14. The device of claim 12 , wherein the memory of the first layer is a main memory of the device, and the memory of the second layer is a cache memory or a register of the device.
15. A non-transitory computer-readable recording medium having recorded thereon a program which, when executed by a computer, performs the method of claim 1 .