# US 10,374,791 B2 · Method of protecting electronic circuit against eavesdropping by power analysis and electronic circuit using the same

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,374,791 B2
- Document ID: US10374791B2
- Status: Granted
- Kind: B2
- Application number: 15/285,466
- Filed: 2016-10-04
- Published: 2017-07-27
- Granted: 2019-08-06
- Earliest claimed: 2016-01-26
- Assignees: Winbond Electronics Corp.
- Applicants: Winbond Electronics Corp.
- Inventors: Valery Teper; Nir Tasher
- Web page: https://patentgrep.com/patent/US10374791B2

## CPC

- H04L 9/003: {for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA]}
- G06F 1/12: Synchronisation of different clock signals {provided by a plurality of clock generators}
- G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00)
- H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation}
- H04L 2209/08: Randomization, e.g. dummy operations or using noise
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY

## Abstract

An electronic circuit with protection against eavesdropping by power analysis is provided. The electronic circuit includes: a storage element for storing a set of bits; a logic unit for processing the stored set of bits and providing a next state set of bits after two or more cycles, wherein in a first cycle, some of the stored set of bits are provided to the logic unit correctly and some are replaced by random values and in a last cycle, all of the stored set of bits are provided to the logic unit correctly; and a random bit generator that generates a random bit for each bit of the stored set of bits to determine which bits of the stored set of bits are to be provided correctly and which bits are to be replaced in each cycle.

## Claims

### Claim 1

An electronic circuit with protection against eavesdropping by power analysis, comprising:
a storage element, configured to store a set of bits;
a random bit generator, configured to generate random bits corresponding to the stored set of bits respectively;
a selector, coupled to the storage element and the random bit generator, configured to output at least one replaced bit by replacing at least one bit of the stored set of bits with a random value or an opposite value according to the random bits;
a combinatorial logic unit, coupled to the selector, configured to perform logic calculations in at least two cycles and provide a next state set of bits after the at least two cycles to the storage element, wherein the combinatorial logic unit is configured to perform a first logic calculation on the output of the selector including the at least one replaced bit under a first distribution of power consumption in a first cycle, and is configured to perform a last logic calculation on all of the stored set of bits under a second distribution of power consumption in a last cycle, and wherein the combinatorial logic unit is configured to obtain some of the stored initial set of bits from the storage element in the first cycle and replacing the rest of the bits which have been replaced by the random values in the first cycle with the corresponding bits of the stored initial set of bits after the first cycle and before the last cycle.

### Claim 2 (depends on 1)

The electronic circuit according to claim 1, wherein the electronic circuit is driven by two clock signals, and one of the clock signals is with half a frequency of the other, and the first distribution of power consumption is different from the second distribution of power consumption.

### Claim 3 (depends on 1)

The electronic circuit according to claim 1, further comprising an intermediate storage unit associated with the storage element for storing the stored set of bits for use in the last cycle.

### Claim 4 (depends on 1)

The electronic circuit according to claim 1, wherein the selector is controlled by the random bits to select between the random value provided by the random bit generator and a corresponding one bit of the stored set of bits.

### Claim 5 (depends on 1)

The electronic circuit according to claim 1, wherein the stored set of bits are stored in the storage element in an encrypted form.

### Claim 6 (depends on 5)

The electronic circuit according to claim 5, wherein the stored set of bits are decrypted when provided to the combinatorial logic unit.

### Claim 7 (depends on 1)

The electronic circuit according to claim 1, wherein in a second cycle, the at least one replaced bit is further replaced with a correct value coming from the at least one bit of the stored set of bits and provided to the logic combinatorial unit.

### Claim 8 (depends on 1)

The electronic circuit according to claim 1, wherein half of the stored set of bits are replaced by the random values provided by the random bit generator in the first cycle.

### Claim 9 (depends on 1)

The electronic circuit according to claim 1, wherein a random number of the stored set of bits are replaced by the random values provided by the random bit generator in the first cycle.

### Claim 10 (depends on 1)

The electronic circuit according to claim 1, wherein the at least one replaced bit that is randomly selected is set to be the opposite value of a corresponding one bit of the stored set of bits.

### Claim 11

A method of protecting an electronic circuit against eavesdropping by power analysis, comprising:
storing an initial set of bits corresponding to correct values to a storage element;
generating, by a random bit generator, random bits corresponding to the stored initial set of bits respectively;
replacing at least one bit of the stored initial set of bits with a random value or an opposite value according to the random bits by a selector;
performing logical calculations in at least two cycles by a combinatorial logic unit, wherein, in a first cycle of the at least two cycles, performing a first logical calculation on an intermediate set of bits including the at least one replaced bit and a part of the stored initial set of bits under a first distribution of power consumption; and
in a last cycle of the at least two cycles, performing a last logical calculation on all of the stored initial set of bits under a second distribution of power consumption to provide a next state set of bits;
storing the next state set of bits to the storage element; and
obtaining some of the stored initial set of bits from the storage element in the first cycle and replacing the rest of the bits which have been replaced by the random values in the first cycle with the corresponding bits of the stored initial set of bits after the first cycle and before the last cycle.

### Claim 12 (depends on 11)

The method according to claim 11, wherein the electronic circuit is driven by two clock signals, and one of the clock signals is with half a frequency of the other.

### Claim 13 (depends on 11)

The method according to claim 11, further comprising storing the initial stored set of bits for use in the last cycle to an intermediate storage unit associated with the storage element.

### Claim 14 (depends on 11)

The method according to claim 11, wherein the first distribution of power consumption is different from the second distribution of power consumption.

### Claim 15 (depends on 11)

The method according to claim 11, wherein the step of storing the initial set of bits further comprises encrypting the initial stored set of bits.

### Claim 16 (depends on 15)

The method according to claim 15, wherein the step of in the last cycle of the at least two cycles, performing the last logical calculation on all of the stored initial set of bits further comprises decrypting the stored initial set of bits before performing the last logical calculation.

### Claim 17 (depends on 11)

The method according to claim 11, wherein half of the stored initial set of bits are replaced by the random values provided by the random bit generator in the first cycle.

### Claim 18 (depends on 11)

The method according to claim 11, wherein a random number of the stored initial set of bits are replaced by the random values provided by the random bit generator in the first cycle.

### Claim 19 (depends on 11)

The method according to claim 11, wherein the at least one replaced bit that is randomly selected is set to be the opposite value of a corresponding one bit of the stored set of bits.