Microprocessor equipped with an arithmetic and logic unit and with a hardware security module
View Patent ↗A microprocessor is provided to compute a code used to detect an execution fault, using a relationship C i =P o F a (D i ), where: F a (D i )=E 0 o . . . o E q o . . . o E NbE-1 (D i ), E q (x)=T αm,q o . . . o T αj,q o . . . o T α1,q o T α1,q (x), and T αj,q is a conditional transposition, configured by a secret parameter α j,q , that permutes two blocks of bits B 2j+1,q and B 2j,q of the variable x only when the parameter α j,q is equal to a first value, the blocks B 2j+1,q and B 2j,q of all of the transpositions T αj,q of the stage E q being different from one another and not overlapping and the blocks B 2j+1,q and B 2j,q are placed within one and the same block of greater size permuted by a transposition of the higher stage E q+1 .
1 . A microprocessor comprising:
an arithmetic and logic unit with a hardware security module; and
a plurality of registers, wherein:
a) the arithmetic and logic unit is capable of executing an arithmetic instruction, comprising an opcode and one or more operands, that, when executed by the arithmetic and logic unit of the microprocessor, causes the arithmetic and logic unit to perform a mathematical operation D 1 *D 2 * . . . *D n and store the result of the mathematical operation in a register R res-p among the plurality of registers, where:
the subscript n is equal to the number of data items D i processed by the arithmetic instruction, the subscript n being greater than or equal to one,
D 1 to D n are data items that are stored in registers R 1 to R n among the plurality of registers, respectively, of the microprocessor, the size, in terms of the number of bits, of each of these data items D; being equal to 24, where d is an integer greater than two,
the registers R 1 to R n are the registers denoted by the operands of the arithmetic instruction,
the symbol “*” is the arithmetic operation denoted by the opcode of the arithmetic instruction,
b) the microprocessor is configured to perform the following operations:
1) For each data item D i , the hardware security module performs computation of a code C i using a relationship C i =Q α (D i ) and association of the computed code C i with the data item D i , the function Q& being a pre-programmed function configured by a secret key α that is pre-stored in the microprocessor and known only to the microprocessor,
2) Each time an instruction for loading a data item D i into a register R i of the microprocessor is executed by the arithmetic and logic unit, the loaded data item D i is stored in the register R i and the code C i associated therewith is stored in the same register R i or in a register associated with the register R i , then
3) Execution, by the arithmetic and logic unit, of the arithmetic instruction and storage of the result D res-p of this execution in the register R res-p , and computation, by the hardware security module, of a code C res-t using the codes C 1 , C 2 , . . . , C n and without using the result D res-p , then
4) Checking, by the hardware security module, that the code C res-t corresponds to a code C res-p obtained from the result D res-p and triggering of the signalling of an execution fault if the code C res-t does not correspond to the code C res-p and, otherwise, suppressing this signalling,
wherein the function Q α is defined by the following relationship: Q α (D i )=P o F α (D i ), where P is a predetermined function and F α is a function defined by the following relationship: F α (D i )=E 0 o . . . o E q o . . . o E NbE-1 (D i ), where each function E q is a stage of transpositions and the index q is an order number between zero and NbE-1, where NbE is a whole number greater than one and less than or equal to d, each stage E q of transpositions being defined by the following relationship: E q (x)=T αm,q o . . . o Tα j,q o . . . o T α1,q o T α0,q (x), where:
x is a variable whose size, in terms of the number of bits, is equal to the size of the data item D i ,
T αj,q is a transposition, configured by the parameter α j,q , that permutes two blocks of bits B 2j+1,q and B 2j,q of the variable x when the parameter α j,q is equal to a first value and that does not permute these two blocks of bits when the parameter α j,q is equal to a second value, the transposition T αj,q being distinguished from all of the other transpositions of the function F α by the fact that it is the only one that permutes the two blocks B 2j+1,q and B 2j,q when the parameter α j,q is equal to the first value, the blocks B 2j+1,q and B 2j,q of all of the transpositions T αj,q of the stage E q being different from one another and not overlapping in such a way that all of the transpositions T αj,q of the stage E q can be executed in parallel,
“j” is an order number identifying the transposition T αj,q among the other transpositions of the stage E q ,
the symbol “o” denotes the function-composition operation,
the concatenation of the bits of all of the parameters α j,q of all of the stages E q is equal to the value of the secret key α, and
for all of the stages E q for which q is less than NbE-1 and for all of the transpositions T αj,q of this stage, the blocks B 2j+1,q and B 2j,q are placed within one and the same block of greater size permuted by a transposition of the higher stage E q+1 when the parameter of the transposition of the higher stage E q+1 is equal to the first value.
2 . The microprocessor according to claim 1 , wherein
the number NbE is equal to d,
the sizes of the blocks permuted by all of the transpositions T αj,q of one and the same stage E q are equal to 2 q ,
the blocks B 2j+1,q and B 2j,q permuted by each transposition T αj,q are adjacent.
3 . The microprocessor according to claim 1 , wherein:
the arithmetic and logic unit is capable of executing a logic instruction that, when executed, causes a Boolean operation D 1 &D 2 & . . . &D n to be performed and the result of this Boolean operation to be stored in the register R res-p , where the “&” symbol denotes the Boolean operation, and
the microprocessor is configured to perform operations 1) to 4) for this logic instruction and, during the execution of operation 3), to compute the code C res-t using the following relationship: C res-t =C 1 & C 2 & . . . &C n .
4 . The microprocessor according to claim 1 , wherein the arithmetic operation is chosen from the group made up of a bit shift, a bit rotation and an addition.