Secure-ic Sas

Institut Telecom/telecom Paristech

Institut Mines-telecom

Other

Centre National De La Recherche Scientifique

Sylvain Guilley

Adrien Facon

Jean-Luc Danger

Thibault Porteboeuf

Cédric Murdica

Philippe Nguyen

Florent Lozac'h

Olivier Rioul

Michel Le Rolland

Margaux Dugardin

Youssef Souissi

Nicolas Bruneau

Rachid Dafali

Théophile Boue

Robert Nguyen

Philippe Hoogvorst

Sébastien Carre

Annelie Heuser

Thibaut Porteboeuf

Michaël Timbert

Florent Flament

There is disclosed a Connected Synthetic Physically Unclonable Function (acronym CSPUF) made of a circuit configured to receive signals of one or more sensors and/or actuators in/of a computer device; determine one or more statistical properties of the noise distribution of the selected one or more of the sensors and/or actuators; receive data IN from one or more external data sources; determine one or more digital signatures (responses) from the statistical properties and the selected external data. In one embodiment, along a response R when challenged by a challenge C, the circuit is configured to receive data IN and/or to communicate data OUT from one or more external data sources. Developments describe uses and advantages of data IN and data OUT channels, e.g. static or dynamic calibration, options to disable the circuit. Other embodiments consider variants of interconnections of two CSPUF circuits, providing 'self-cycled', “iterative”, “cascaded” and other “blockchain” arrangements.

Connected synthetic physically unclonable function

A transmitter device for sending an encrypted message to a receiver device in an identity-based cryptosystem, the identity-based cryptosystem includes a transmitter trusted center connected to the transmitter device and a receiver trusted center connected to the receiver device. The transmitter device is configured to: receive, from the transmitter trusted center, two public authentication keys; check if a set of conditions related to a transmitter trusted center public key, to a receiver trusted center public key, and to a transmitter authentication key comprised in the two public authentication keys are satisfied; determine a ciphertext set comprising an encrypted message if the set of conditions are satisfied; send the ciphertext set to the receiver device.

Methods and devices for secured identity-based encryption systems with two trusted centers

Embodiments provide a memory device including a memory comprising at least one chip, each chip comprising one or more banks for storing a plurality of bits, each bank comprising a set of rows and columns, each row and column comprising a number of bits, the device further comprising a controller configured to generate access commands to the memory, an access command identifying an address corresponding to a given row of the memory and a command operation to be performed on the given row, wherein the device further comprises a protection device. The protection device is configured to transform an address, in response to the receipt of an access command identifying the address, into a transformed address. The protection device uses an address storage data structure, such as a histogram, to store the transformed address depending on a frequency of access associated with the address, the address storage data structure being reset in response to a memory protection operation (refresh for example) performed in the memory device. The protection device further comprises an access frequency manager configured to determine whether the access frequency associated with an address maintained in the address storage data structure is greater or equal to a threshold, and if so trigger a memory protection operation in the memory from within the memory.

Device and method for protecting a memory

There is provided a device for protecting a cryptographic program implemented in a cryptographic computing device, the cryptographic computing device includes one or more processors, the cryptographic program comprising instructions and being associated with an initial execution order of the instructions. The device comprises a compiler to compile the cryptographic program, which provides an intermediate representation of the cryptographic program comprising instructions and variables used to execute the instructions. The device is configured to: determine a graph of dependencies comprising nodes and edges, each node of the graph representing an instruction of the intermediary representation, and each edge of the graph representing a variable of the intermediary representation; mask the graph of dependencies by replacing each variable of the graph of dependencies with a masked variable, the processing unit determining the masked variable by applying a masking scheme to the variable, which provides a masked graph of dependencies; determine at least a set of independent instructions using the masked graph of dependencies; determine an execution order for each set of independent instructions from the initial execution order, the execution order representing the order of execution of the set of independent instructions by at least one of the one or more processors.

Devices and methods for protecting cryptographic programs

There is provided a device of protecting an Integrated Circuit from perturbation attacks. The device includes a sensing unit configured to detect a perturbation attack, the sensing unit comprising a set of digital sensors comprising at least two sensors, the sensors being arranged in parallel. Each digital sensor provides a digitized bit output having a binary value, in response to input data, the sensing unit being configured to deliver at least one binary vector comprising a multi-bit value, the multi-bit value comprising at least two bit outputs provided by the set of digital sensors. The sensing device further comprising an analysis unit, the analysis unit being configured to receive at least one binary vector provided by the sensing unit, the analysis unit being configured to detect a perturbation attack from the at least one binary vector.

Quantitative digital sensor

A transmitter device for sending an encrypted message to a receiver device in an identity-based cryptosystem, the transmitter device being associated with a transmitter identifier. The transmitter device is configured to receive a transmitter partial private key from a trusted center, the transmitter device being configured to: send a request for two public session keys to the receiver device; receive from the receiver device a first ciphertext set, the first ciphertext set being derived from an encryption and authentication of two public session keys; decrypt and authenticate the two public session keys from the first ciphertext set using a receiver identifier and the transmitter partial private key; determine a second ciphertext set from the transmitter partial private key, from the receiver identifier, and from the two public session keys, the second ciphertext comprising an encrypted message; send the second ciphertext set to the receiver device.

Certificateless public key encryption using pairings

There is provided a device for protecting the execution of a cryptographic operation from attacks, the cryptographic operation being implemented by a cryptographic algorithm, the cryptographic operation comprising at least one modular operation between a main base (m) representing a data block and at least one scalar (d) in at least one finite starting group. The device is configured to determine at least one intermediary group (E') different from the at least one starting group (E), the number of intermediary groups being equal to the number of starting groups E. The device is further configured to determine at least one final group (E&#x2033;) from the at least one starting group E and the at least one intermediary group E&#x2032;. The base m being mapped to an auxiliary element (x) in the at least one intermediary group and to an auxiliary base (m&#x2033;) in the at least one final group E&#x2033;. The device performs a first elementary operation in each final group (E&#x2033;i), the first elementary operation consisting in executing the modular operation between the auxiliary base (m&#x2033;) and an auxiliary scalar (d) in each final group E&#x2033;, which provides at least one result, the auxiliary scalar (d) being determined from the auxiliary element (x) and from the main scalar (d). The device further performs a second elementary operation in each starting group E, the second elementary operation consisting in executing the modular operation between an additional auxiliary base and an additional auxiliary scalar d&#x2032;in each starting group, at least one of the additional auxiliary base and of the additional scalar being derived from the result of the first elementary operation.

Device and method for protecting execution of a cryptographic operation

A device of executing a cryptographic operation on bit vectors, the execution of the cryptographic operation includes the execution of at least one arithmetic addition operation between a first operand and a second operand. Each operand comprises a set of components, each component corresponding to a given bit position of the operand. The device comprises a set of elementary adders, each elementary adder being associated with a given bit position of the operands and being configured to perform a bitwise addition between a component of the first operand at the given bit position and the corresponding component of the second operand at the given bit position using the carry generated by the computation performed by the elementary adder corresponding to the previous bit position. Each elementary adder has a sum output corresponding to the bitwise addition and a carry output, the result of the arithmetic addition operation being derived from the sum outputs provided by each elementary adder. The device is configured to apply a mask to each operand component input of at least some of the elementary adders using a masking logical operation, the mask being a random number.

Protection system and method

A circuit includes a cipher accessing a plurality of read-write memory units configured to handle data tables obtained from a modified mask; wherein the modified mask is being determined from an initial mask and a random value, the random value selecting one or more modifications of the initial mask amongst a plurality of predefined modifications including permutation operations. Developments of the invention describe the use of mathematically optimal or equivalent masks; the use of random values; a range of permutation operations comprising offset shifting and/or rotation and/or XOR operations and/or coprime construction; the use of round masks; the use of a Physically Unclonable Function; the refresh or update of modified masks and/or round masks; and verifications of the optimality and/or integrity of masks. System features (e.g. CPU, co-processor, local and/or remotely accessed external memory storing masks, volatile memory) and computer program products are described.

Dynamic masking

A machine characterization device for determining one or more machine characterization parameters of a computing device depending on a machine signature determined from sets of timing measurements associated with at least one machine characterization instruction executed by one or more processors comprised in the computing device using at least two machine configurations. A machine configuration comprises a sequence of two or more machine configuration instructions defining an order of execution of one or more instructions by the one or more processors.

Methods and devices for hardware characterization of computing devices

A secret key estimation device is provided for determining an estimate of at least one secret key used during a number of executions of a cryptographic function used by at least one cryptographic algorithm. The number of executions of the cryptographic function is at least equal to two. The secret key estimation device comprises an analysis unit for determining a plurality of sets of leakage traces from a side-channel information acquired during the number of executions of the cryptographic function. Each set of leakage traces corresponds to an execution of the cryptographic function and comprising at least one leakage trace. The secret key estimation device further comprises a processing unit configured to determine a statistical distribution of the acquired plurality of sets of leakage traces. The statistical distribution is dependent on a leakage function, the leakage function being represented in a basis of functions by a set of real values. The secret key estimation device is configured to determine the secret key from the statistical distribution of the plurality of sets of leakage traces using an estimation algorithm according to the maximization of a performance metric.

Secret key estimation methods and devices

There is provided a cryptographic key determination device for determining one or more cryptographic keys in a cryptographic device, the cryptographic device being configured to execute one or more test programs, the cryptographic device comprising one or more components (-), each component (-) being configured to generate static and dynamic data, the dynamic data being generated in response to the execution of the one or more test programs, wherein the cryptographic key determination device comprises: a data extraction unit configured to extract at least one part of the static data and at least one part of the dynamic data generated by the one or more components (-), and a key generator configured to combine the at least one part of static data and the at least one part of dynamic data, and to determine the one or more cryptographic keys by applying a cryptographic function to the combined data.

Methods and devices for secure secret key generation

Countermeasures against fault injection attacks of a cryptographic integrated circuit, and more specifically laser fault injection attacks are provided. The invention consists in generating sequences of bits belonging to a set of allowed sequences, and storing these sequences on a set of Flip-Flops. Then the sequences stored on the Flip-Flops are checked and, if they do not belong to the allowed sequence, this is the sign that a fault injection attack occurred and caused a bit flip in one of the flip-flops. An alarm signal is then generated.

Detection of laser fault injection attacks on cryptographic devices

A circuit for a Synthetic Physically Unclonable Function, acronym SPUF, in a computer device, wherein the circuit is configured to receive data from a plurality of hardware sensors and/or actuators accessible in the computer device; to determine deviations in the data; to determine a multivariate distribution of the deviations and to determine an identifier from the multivariate distribution. In described developments, deviations comprise random errors, statistical moments in data originating from sensors and/or actuators amongst accessible ones in the computer device can be selected, and entropy can be maximized. Computer program product embodiments are described.

Synthetic physically unclonable function

Embodiments of the invention provide a computing device comprising one or more processors, each processor comprising one or more processing unit, said one or more processing units being configured to execute at least one program, each program comprising data and/or instructions, the computing device further comprising, for at least some of the processors, a processor cache associated with each processor, the processor cache being configured to access data and/or instructions comprised in the programs executed by the processor, the computing device comprising: 

Growing community of inventors

Paris, France

Sylvain Guilley