Methods and ip cores for reducing vulnerability to hardware attacks and/or improving processor performance
AssigneeFortifyiq, Inc.
InventorsUry Kreimer, Alexander Kesler, Yaacov Belenky, Vadim Bugaenko
Life of this patent
Estimating the term…
Abstract
In a general aspect, a GHASH semiconductor intellectual property (IP) core can include circuitry for calculating a GHASH function. The IP core can be configured to calculate the GHASH function by calculating the following quantities: X 0 = 0 ; X i + 1 = H k X i + ∑ j = 0 k - 1 ∑ n = 0 m - 1 C ki + j h ijn , where for any i and j ; and ∑ n = 0 m - 1 h ijn = H j , where k > 1 and m > 1 .
Claims12
A method of protecting hardware against fault injection attacks, the method comprising:
- (a) dividing a group of bits in a cryptographic hardware component into two or more subsets;
- (b) adding error detection code (EDC) bits to every subset to produce EDC subsets;
- (c) reuniting the EDC subsets and re-dividing the bits into two or more subsets, different than the subsets of (b);
- (d) applying an invertible transformation to every subset from (c) and storing the transformed subsets to a register;
- (e) loading the content of the register from (d) and applying the inverse transformation (relative to the transformation of (d));
- (f) dividing the bits into the same subsets as in (c);
- (g) verifying correctness of the EDC on the subsets of (f);
- and
- (h) raising an error flag if any EDC bit is incorrect.
A semiconductor intellectual property (IP) core for protecting hardware against fault injection attacks, the IP core comprising circuitry for:
- (a) dividing a group of bits in a cryptographic hardware component into two or more subsets;
- (b) adding error detection code (EDC) bits to every subset to produce EDC subsets;
- (c) reuniting the EDC subsets and re-dividing the bits into two or more subsets, different than the subsets of (b);
- (d) applying an invertible transformation to every subset from (c) and storing the transformed subsets to a register;
- (e) loading the content of the register from (d) and applying the inverse transformation (relative to the transformation of (d));
- (f) dividing the bits into the same subsets as in (c);
- (g) verifying correctness of the EDC on the subsets of (f);
- and
- (h) raising an error flag if any EDC bit is incorrect.
Dependencies are inferred from the claim text.