Method of execution of a binary code of a secure function by a microprocessor

1. Method of execution of a binary code of a secure function by a microprocessor, wherein this method comprises:

a) the provision of the binary code, this binary code comprising code lines, each code line containing:

a cryptogram of a single instruction executable by the microprocessor or of a single datum to be processed by the microprocessor, and

a message authentication code making it possible to verify the integrity and the authenticity of the cryptogram,

b) during the execution of the binary code by the microprocessor, each time the microprocessor loads a code line, the method comprises the following operations:

1) a securing hardware module of the microprocessor verifies the integrity and the authenticity of the cryptogram contained in the code line loaded with the aid of the message authentication code contained in this same line and triggers the signalling of an execution fault if the integrity or the authenticity of the cryptogram is not confirmed, and then

2) the securing hardware module decrypts the cryptogram to obtain a decrypted instruction or a decrypted datum if the integrity and the authenticity of the cryptogram are confirmed, and then:

in the case of a decrypted instruction, the decrypted instruction is recorded in a queue of instructions to be executed successively one after another by an arithmetic and logic unit of the microprocessor, and

in the case of a decrypted datum, the decrypted datum is recorded in an internal register of the microprocessor while waiting to be processed by the arithmetic and logic unit, and in which:

during step a), the cryptogram contained in the code line is a cryptogram of a concatenation:

of the said instruction or datum, and

of a first error-detecting code making it possible to detect an error in the instruction or in the datum with which it is concatenated,

during the operation, the decryption of the cryptogram by the securing hardware module makes it possible to obtain, in addition to the decrypted instruction or to the decrypted datum, the first decrypted error-detecting code, and then:

in the case of a decrypted instruction, the first decrypted error code is recorded in the queue of instructions with the decrypted instruction, and

in the case of a decrypted datum, the decrypted datum and the first decrypted error-detecting code are recorded in one and the same register of the microprocessor, and

after the operation 2), the method comprises the following operation 3):

when the next instruction to be executed contained in the queue of instructions is the instruction decrypted during the operation 2), the securing hardware module verifies, with the aid of the first error-detecting code recorded with this decrypted instruction, whether there exists an error in this decrypted instruction, and, in the case where such an error is detected in this decrypted instruction, the securing hardware module triggers the signalling of an execution fault, and, in the case where no error has been detected in this decrypted instruction, the microprocessor decodes the decrypted instruction and transmits it to the arithmetic and logic unit which executes it, or

when the next datum to be processed by the arithmetic and logic unit is the datum decrypted during the operation 2), the securing hardware module verifies with the aid of the first error-detecting code recorded associated with this decrypted datum, whether there exists an error in this decrypted datum, and, in the case where such an error is detected, the securing hardware module triggers the signalling of an execution fault, and, in the case where no error is detected, the arithmetic and logic unit processes this decrypted datum.

2. Method according to claim 1 , in which:

during step a), the first error-detecting code is an error-correcting code making it possible, in addition, to correct the error detected in the instruction or in the datum with which it is concatenated, during the operation 3):

when the securing hardware module detects an error in the decrypted instruction, in addition to triggering the signalling of an execution fault, the securing hardware module corrects this error with the aid of the first decrypted error-detecting code recorded together with this decrypted instruction, and then the microprocessor decodes the instruction thus corrected and transmits it to the arithmetic and logic unit which executes it, or

when the securing hardware module detects an error in the decrypted datum, in addition to triggering the signalling of an execution fault, the securing hardware module corrects this error with the aid of the first decrypted error-detecting code associated with this decrypted datum, and then the arithmetic and logic unit processes the corrected datum.

3. Method according to claim 1 , in which:

during step a), each code line comprises, in addition to the cryptogram and to the message authentication code, a second error-detecting code making it possible to detect an error in the cryptogram or the message authentication code contained in the same code line, and

during step b) before the execution of the operation 1), the method comprises an operation during which the securing hardware module verifies, with the aid of the second error-detecting code contained in the loaded code line, whether there exists an error in the cryptogram or the message authentication code contained in the loaded code line, and in the case where such an error is detected, the securing hardware module triggers the signalling of an execution fault and, in the case where no error is detected, the method continues via the operation 1).

4. Method according to claim 3 , in which:

during step a), the second error-detecting code is an error-correcting code making it possible, in addition, to correct the error detected in the cryptogram or the message authentication code contained in the same code line,

if the securing hardware module detects an error in the cryptogram or the message authentication code, in addition to triggering the signalling of an execution fault, the securing hardware module corrects this error with the aid of the second error-detecting code, and then the method continues via the operation 1) during which it is the corrected cryptogram and the corrected message authentication code which are used.

5. Method according to claim 1 , in which:

during the operation 1), a first encryption key is used to verify the authenticity of the cryptogram contained in the loaded code line, and

during the operation 2), a second decryption key is used to decrypt the cryptogram, this second decryption key being different from the first decryption key.

6. Method according to claim 1 , in which:

during step a), the binary code provided comprises a machine code containing a succession of base blocks in which:

each base block comprises a succession of code lines each containing the cryptogram of an instruction, the instructions encrypted in these successive code lines being intended to be executed by the microprocessor systematically in the order of these code lines, and

each base block starts at a branching address and terminates with a code line containing the cryptogram of an instruction for branching to a branching address of another base block, this other base block being called “the following base block” and the base block which terminates with the code line containing the cryptogram of this instruction for branching to this following base block being called “preceding base block”,

the cryptogram contained in a specific code line of a following base block having been obtained with the aid of a different initialization vector from the initialization vectors used to obtain the cryptograms of code lines of the other base blocks,

each preceding base block comprising a code line containing the cryptogram of a loading instruction which, when it is executed by the microprocessor, causes the loading into the microprocessor of the initialization vector to be used to decrypt the cryptogram of the specific code line of the following base block,

during the operation 2), the securing hardware module decrypts the cryptogram of the specific code line of a following base block with the aid of the initialization vector loaded into the microprocessor during the execution of the preceding base block.

7. Method according to claim 6 , in which:

during step a), the binary code comprises a machine code containing:

a base block called “calling block” which terminates with a code line containing the cryptogram of a branching instruction which, when it is executed by the microprocessor, carries out a branching to a branching address of a secure sub-function,

another base block called “return block”, and

the secure sub-function formed by one or more base blocks, this secure sub-function being callable on the basis of the various base blocks of the secure function and starting with a first base block and terminating with a last base block, the first base block starts at the branching address of the secure sub-function and the last base block terminates with a code line containing the cryptogram of a particular branching instruction called “return instruction” which, when it is executed by the microprocessor, carries out a branching to the branching address of the return block,

during a first execution of the operation 2), the securing hardware module records in a first register of the microprocessor the branching address of the return block and the initialization vector which is necessary to decrypt this return block, and then

during a second execution of the operation 2) during which the return instruction of the secure sub-function is decrypted, the branching address used for the execution of the return instruction is read in the first register, and then

during a third execution of the operation 2) during which the specific code line of the return block is decrypted, the securing hardware module uses the initialization vector recorded in the first register to decrypt the cryptogram of the specific code line of the return block.

8. Method according to claim 1 , in which:

before step b), the method comprises the recording:

of a first cryptographic certificate making it possible to authenticate a public key of an operating system executed by the microprocessor,

of a second cryptographic certificate making it possible to authenticate a public key of the microprocessor,

of a third cryptographic certificate making it possible to authenticate a public key of the author of the secure function,

a cryptogram of an application key decryptable with the aid of the public key of the microprocessor,

a signature of the application key verifiable with the aid of the public key of the author,

at the start of step b) the securing hardware module verifies in this order:

the authenticity of the first and of the third cryptographic certificate with the aid of the public key of the operating system,

only if the authenticity of the public key of the author has been confirmed, the authenticity of the signature of the application key with the aid of the public key of the author,

only if the authenticity of the signature of the application key has been confirmed, the decryption of the cryptogram of the application key with the public key of the microprocessor, and then

during the operation 2), the decryption of the cryptogram is carried out with the aid of this decrypted application key.

9. Method according to claim 1 , in which, during the operation 1), the securing hardware module:

constructs a label on the basis of the cryptogram contained in the loaded code line, and then

encrypts the label constructed with the aid of a secret key recorded in a nonvolatile memory of the securing hardware module, and then

compares the encrypted label with the message authentication code contained in the loaded code line, and then

confirms the integrity and the authenticity of the cryptogram only if the encrypted label is identical to this message authentication code.

10. Method according to claim 1 , in which:

during step a), the binary code provided contains:

an arithmetic and logic instruction comprising an opcode and one or more operands which, when it is executed by an arithmetic and logic unit of the microprocessor, causes the carrying out of the operation D 1 *D 2 * . . . *D n and the recording of the result of this operation in a register R res , where:

D 1 to D n are data recorded, respectively, in registers R 1 to R n of the microprocessor,

the registers R 1 to R n are the registers designated by the operands of the arithmetic and logic instruction,

the symbol “*” is the arithmetic and logic operation designated by the opcode of the arithmetic and logic instruction, and

the index n is an integer greater than or equal to one,

for each register R 1 to R n , a loading instruction which, when it is executed by the microprocessor, causes the loading of a datum D i into the register R i , where the index i is an identifier of the register R i from among the registers R 1 to R n ,

during the execution of step b), the method comprises the following operations:

each time an instruction for loading a datum D i into the register R i is executed by the microprocessor, a securing hardware module of the microprocessor calculates a code C i ,* with the aid of a relation C i, *=F*(D i ), and the loaded datum D i is recorded in the register R i and the code C i ,* calculated is recorded in the same register R i or in a register associated with the register R i , the function F* being a preprogrammed function of the securing hardware module,

in the case where n is greater than or equal to two, this function F* being a homomorphism from a set A of numbers furnished with the operation “*” to a set B of numbers furnished with the operation “#”, which satisfies the relation: F*(D 1 *D 2 * . . . *D n )=F*(D 1 )# F*(D 2 )# . . . # F*(D n )=C 1, * # C 2, * # . . . # C n ,*,

in the case where n is equal to one, this function F* is such that F*(D 1 )=T*(F*(D 1 )), where the function T* is a function preprogrammed into the securing hardware module,

the execution by the arithmetic and logic unit of the arithmetic and logic instruction contained in the binary code and the recording of the result D res-p of this execution in the register R res , and then

the securing hardware module:

calculates a code C res-p with the aid of the relation C res-p =F*(D res-p ) if n is greater than one and, otherwise, with the aid of the relation C res-p =T*(D res-p ) if n is equal to one, and

calculates a code C res-t with the aid of the relation C res-t =# C 2 ,* # . . . # C n, *, and then

compares the codes C res-p and C res-t and triggers the signalling of an execution fault if the code C res-p does not correspond to the code C res-t and, in the converse case, inhibits this signalling.

11. Method according to claim 1 , in which:

the method comprises the recording in a main memory at an address @ j of a code line, this code line containing:

a datum D j to be processed by the microprocessor or a cryptogram of this datum D j , and

a first error-detecting code making it possible to detect an error in the datum D j or in its cryptogram if this datum D j or its cryptogram is modified after its recording in the main memory,

at least one of the datum D j , of its cryptogram and of the first error-detecting code being encrypted as a function of an initialization vector iv j , this initialization vector iv j varying as a function of the address @ j at which the code line is recorded according to a relation iv j =F iv (@ j , where the function F iv is a preprogrammed function of a securing hardware module of the microprocessor which associates a different initialization vector iv j with each different address @ j of the main memory, during the execution of the binary code by the microprocessor, the method comprises the following operations:

the execution of a loading instruction by the microprocessor which causes the loading into the registers of the microprocessor of the code line recorded at the address @ j , and then

the securing hardware module calculates the initialization vector iv j with the aid of the relation iv j =F iv (@ j ), where is the address on the basis of which the code line has been loaded, and then

the securing hardware module decrypts the code line loaded with the aid of the initialization vector iv j calculated to obtain:

the datum D j or its cryptogram, and

the first error-detecting code, and then

the securing hardware module verifies, with the aid of the first error-detecting code obtained, whether there exists an error in the datum D j or its cryptogram and, if such an error exists, triggers the signalling of an execution fault and, if such an error does not exist, inhibits this signalling of an execution fault.

12. Binary code of a secure function stored in a non-transitory computer readable medium, executable by a microprocessor for the implementation of a method of execution in accordance with any one of the preceding claims, in which the binary code comprises code lines, each code line containing:

a cryptogram of a single instruction executable by the microprocessor or of a single datum to be processed by the microprocessor,

a message authentication code making it possible to verify the integrity and the authenticity of the cryptogram, and in which

the cryptogram contained in the code line is a cryptogram of a concatenation:

of the said instruction or datum, and

of a first error-detecting code making it possible to detect an error in the instruction or in the datum with which it is concatenated.

13. Microprocessor for the implementation of a method in accordance with claim 1 , the microprocessor comprising an arithmetic and logic unit and a securing hardware module, wherein the securing hardware module is configured to execute the operations 1), 2) and 3) of the method in accordance with claim 1 .

14. Compiler able to automatically transform a source code of a secure function into a binary code of this secure function, wherein the compiler is able to automatically transform the source code into a binary code in accordance with claim 12 .