Integrated circuit, method for protecting an integrated circuit and computer program product
According to a first aspect of the present disclosure, an integrated circuit is provided which comprises an active shield in a first layer and at least one security-critical component in a second layer, said security-critical component being configured to generate an access key for enabling access to at least a part of said security-critical component, wherein said access key is based on an output value of the active shield. According to a second aspect of the present disclosure, a corresponding method for protecting an integrated circuit is conceived. According to a third aspect of the present disclosure, a corresponding computer program product is provided.
1. An integrated circuit comprising;
an active shield in a first layer and a security-critical component in a second layer, said security-critical component being configured to generate an access key for enabling access to at least a part of said security-critical component and use the access key to enable access to content of a storage unit comprised in the security-critical component, wherein said access key is based on an output value of the active shield and on a fixed random number generated once at a production time of the integrated circuit.
2. The integrated circuit as claimed in claim 1 , wherein said content is encrypted content, and the access key comprises a decryption key for decrypting said encrypted content.
3. The integrated circuit as claimed in claim 1 , the security-critical component further being configured to generate the access key by performing an exclusive-or operation on the output value of the active shield and said fixed random number.
4. The integrated circuit as claimed in claim 1 , the security-critical component further being configured to provide an input value to the active shield, said input value being based on a fixed random seed value.
5. The integrated circuit as claimed in claim 4 , wherein the fixed random seed value is generated once at a production time of the integrated circuit.
6. The integrated circuit as claimed in claim 4 , the security-critical component further being configured to mask the input value with a variable random value before providing said input value to the active shield.
7. The integrated circuit as claimed in claim 6 , the security-critical component further being configured to unmask the output value of the active shield using said variable random value.
8. The integrated circuit as claimed in claim 7 , the security-critical component further being configured to use Boolean masking.
9. The integrated circuit as claimed in claim 7 , wherein the security-critical component comprises a shield controller which is configured to mask the input value and unmask the output value.
10. The integrated circuit as claimed in claim 1 , the security-critical component further being configured to generate an error signal if said access is not enabled.
11. A smart card comprising the integrated circuit as claimed in claim 1 .
12. An electronic identification document comprising the integrated circuit as claimed in claim 1 .
13. The integrated circuit as claimed in claim 1 , wherein the active shield comprises a plurality of slices and each slice is configured to implement a linear function.
14. The integrated circuit as claimed in claim 13 , wherein each slice comprises a first logic unit and a second logic unit and shield lines transport bits between the first logic unit and the second logic unit.
15. The integrated circuit as claimed in claim 13 , wherein each slice, except a first slice, is configured to accept as input an output of a previous slice and a shield controller is configured to receive an output of a last slice and generate the access key.
16. A method for protecting an integrated circuit, said integrated circuit comprising:
an active shield in a first layer and a security-critical component in a second layer, wherein the security-critical component generates an access key for enabling access to at least a part of said security-critical component and using the access key to enable access to content of a storage unit comprised in the security-critical component, and wherein said access key is based on an output value of the active shield and on a fixed random number generated once at a production time of the integrated circuit.
17. An article of manufacture including a non-transitory computer-readable storage medium having a computer program stored thereon that comprises executable instructions which, when being executed by a processor, cause the processor to perform an integrated circuit protection method for an integrated circuit comprising an active shield in a first layer and a security-critical component in a second layer, the article of manufacture comprising:
instructions for generating an access key to enable access to at least a part of said security-critical component; and instructions for using the access key to enable access to content of a storage unit comprised in the security-critical component, wherein the access key is based on an output value of the active shield and on a fixed random number generated once at a production time of the integrated circuit.