TW201537332A - Clock phase control circuit - Google Patents

Abstract

This invention provides a clock phase control circuit that achieves a high resistance to power analysis attacks and that also achieves suppression of the information amount increase and instantaneous power consumption of a glitch PUF circuit. The clock phase control circuit comprises: a plurality of delay elements that delay a clock signal; a decoder that decodes a random number into a phase selection signal for selecting a phase of the clock signal; and a phase selection unit that selects, from among a plurality of clock signals as delayed by the delay elements and having different phases, a clock signal the phase of which is selected by the phase selection signal and that outputs the selected clock signal as the next clock signal.

Description

Clock phase control circuit

The present invention relates to a clock phase control circuit for preventing side channel attack on a semiconductor integrated circuit.

The system LSI (large integrated circuit) is an LSI that collects one or more functions in one wafer, and is also called Soc (system single chip). At present, system LSI is used for many purposes (for example, for security purposes), and the functions implemented by system LSI are also various. A system LSI (hereinafter referred to as a security LSI) for security use usually includes a cryptographic circuit as one of the constituent elements. Moreover, due to the PUF (Physical Unclonable Function), each wafer has physical information that cannot be copied, and is sometimes used for individual identification of the wafer.

One of the threats to secure LSIs is the Side Channel Attack. The edge channel attack measures the physical quantity of power consumption, electromagnetic waves, processing time, etc. of the cryptographic circuit, and by analyzing these physical quantities, the general name of the attack of the secret information inside the cryptographic circuit is obtained. For example, a side channel attack called a power analysis attack acquires secret information by referring to the power consumption of the secret information in the calculation of the password (see Non-Patent Documents 1 to 3). The cryptographic circuit of the security LSI requires high resistance to power analysis attacks.

Moreover, because of the counterfeiting of the wafer, PUF technology is sometimes used, and the individual recognizes the physical information that cannot be copied as the inherent information of the wafer. PUF, also It protects secret information, prevents attacks such as direct detection of non-volatile memory, and is also used to maintain secret information of a secure LSI. One of the techniques for realizing PUF is glitch PUF (Non-Patent Documents 4 and 5). For the purpose of cost reduction, etc., in a system LSI with limited resources, it is expected that more inherent information can be generated with a smaller PUF circuit.

Further, in general, the system LSI preferably has low power consumption. In many cases, the total energy consumption (electric quantity) of the LSI is low, and the safety LSI used for a non-contact IC card or the like temporarily limits the current that can be supplied to the LSI, and it is also necessary to suppress the instantaneous power consumption.

For the above requirements, document 1 describes that a pseudo-random variable sequence is output according to the clock signal, and a pseudo-random variable sequence is used as a clock signal in each sub-module. For the same processing, the processing time of the sub-module is changed each time and Power consumption makes timing analysis and power consumption analysis difficult.

Further, in Patent Documents 2 and 3, it is described that the instantaneous phase power consumption of the circuit is suppressed by controlling the clock phase in each of the clock regions (the flip-flop group) based on a predetermined value or a setting generated by the software.

[advance technical documents] [Non-patent document]

[Non-Patent Document 1] Kocher et al., "Differential Power Analysis", CRYPTO 1999, LNCS (Computer Science Special Record), Vol. 1666, pp. 388-397, Springer (Germany Springer Press) ), Heidelberg (Heidelberg) (1999).

[Non-Patent Document 2] Brier et al., "Correlation Power Analysys With a Leakage Model, CHES 2004, LNCS (Computer Science Special Record), Vol. 3156, pp. 16-29, Springer (Germany Springer Press), Heidelberg (Heidelberg) ) (2004).

[Non-Patent Document 3] Suzuki et al., "DPA lekage model for CMOS Logic Circuits", CHES 2005, LNCS (Computer Science Special Record), Vol. 3659, pp. 366- 382 pp. Springer-Verlag (Springer Press, Germany) (2005).

[Non-Patent Document 4] Shimizu et al., "Glitch PUF: Extracting Information from Usually Unwanted Glitches", IEICE Transactions (Electronic Information and Communication Society) 95-A(1): 223-233 (2012).

[Non-Patent Document 5] Shimizu et al., "Coprocessor Architecture" for secure key storage and challenge-response certification. 2013 Password and Information Security Review, SCIS2013.

[Patent Document]

[Patent Document 1] Japanese Patent Publication No. 2003-337750

[Patent Document 2] Japanese Patent Publication No. 2002-366250

[Patent Document 3] Japanese Patent Publication No. 2000-029563

A summary of the conventional clock distribution, with reference to the drawing.

Fig. 3 is a diagram showing an outline of a conventional clock distribution in a synchronizing circuit inside an LSI.

The clock source 1 is a clock signal supplied to the flip-flop 3 of the synchronizing circuit in the LSI, and may be supplied from the outside of the LSI, or may be generated by a PPL (phase-locked loop) of the phase synchronizing circuit inside the LSI.

The clock line 2 distributes the wiring of the source 1 to the majority of the flip-flop 3. Although omitted in the figure, the buffer line may be appropriately inserted into the clock line 2.

When the clock source 1 is transmitted on the clock line 2, the timing is adjusted in the LSI design phase with the delay time, so that the clock arrives at the clock terminal of any of the flip-flops 3 at the same time. Generally, it is realized by using equal length wiring so that the wiring length of the clock line branch to the clock terminal of each flip-flop is as uniform as possible (refer to FIG. 3). Strictly speaking, according to the difference in wiring length until the clock signal reaches the flip-flop, the offset of the clock phase is extremely small for each flip-flop. This phase difference is called a clock skew, and is usually designed to eliminate the clock offset when designing the LSI. Because the timing limit of the clock offset portion is necessary due to the timing design, as the timing design increases, it is possible that the associated performance (ie, the maximum operating frequency) decreases.

As described above, the conventional clock distribution has the following features: (1) the flip-flops 3 both (substantially) operate in a phase-matched clock, and (2) the phase difference of the micro-hours of each flip-flop ( The clock skew) is basically unchanged after the LSI is completed. The present invention solves the following problems associated with the occurrence of these features.

Question 1:

An example of a power analysis attack sequence is as follows. First, a large amount of random input data is provided to the cryptographic circuit, and the power waveform at the time of processing the data is obtained. Next, focusing on a certain data (signal group) being processed, the acquired power waveforms are grouped according to their values. Finally, at some point in the processing of the information, the use of each group The average power or the dispersion of power within the group is based on the difference in the data value, and the secret information about the information on the eye is estimated. In this order, if the data of the same value is processed in a random manner, the shape of the waveform of the power consumption is similar, and when the data of different values is processed, the shape of the waveform of the power consumption also changes.

The input data of the cryptographic circuit is generally the output of the flip flop. As described above, in the conventional clock distribution, since the clock phase supplied to the flip-flop is fixed, the timing of the bit change of the input data or the timing of the specific logic gate operation in the cipher circuit is also fixed. Therefore, an attack generated by statistical processing in the above order can be generated with respect to power at a certain time. That is, one of the reasons for the establishment of the power analysis attack can be said to be in the conventional clock distribution. An embodiment of the present invention provides an apparatus for solving this problem.

Question 2:

A circuit for realizing the above-mentioned interference PUF (physical non-replication function), externally providing a challenge data composed of a plurality of bits, the data is stored in a data register (a flip-flop), and then input to an interference generation circuit . The interference generating circuit is a combination circuit that relies on the value of the data or the signal delay in the circuit to generate a lot of interference. Due to the uneven manufacturing of the wafers, even if the wafers manufactured according to the same design data have slightly different signal delays in each individual wafer, the method of generating interference inside the interference generating circuits also changes. Interfering with the PUF is to output the interference difference of each individual as the inherent information of the wafer. When the temperature and voltage changes are neglected, the same output is obtained if the same individual and the same information are desired. That is, the maximum number of unique information that a single interfering PUF can output is limited to the number of bits of interference data. In order to get more intrinsic information, it is necessary to set up more interference generation circuits, which are sometimes difficult in LSIs with limited sources. This hair An embodiment of the present invention provides means for increasing the inherent information obtained from interfering PUF circuits without increasing the number of interference generating circuits.

Question 3:

In general, the instantaneous power consumption of the LSI is increased (or decreased) in the clock supplied to the flip-flop, and becomes a large value immediately after the output of the flip-flop is changed. In particular, when the output of a plurality of flip-flops is changed at the same time, the above-mentioned non-contact IC card or the like may exceed the amount of current that can be supplied, and may become unoperative. Therefore, it is important to be able to suppress the instantaneous power consumption. An embodiment of the present invention provides an apparatus for solving this problem.

Patent Document 1, for a specific circuit block, by controlling whether each clock cycle supplies a clock to a circuit block, the period of the supply clock and the period of the non-supply clock are irregularly generated, and the processing time is not fixed, as the side channel Attack countermeasures. However, if the period of the supply clock is recognized, there is a problem that the countermeasure effect is lowered.

Further, Patent Documents 1 and 2 suppress the instantaneous power consumption of the circuit by controlling the clock phase by each clock region (positive and reverse group) based on a predetermined value or a setting generated by the software, but regarding the attack on the power analysis. The countermeasures and the amount of information that interferes with the PUF circuit increase, and there is no description at all. For example, suppression of instantaneous power consumption and countermeasures against power analysis attacks may not be simultaneously realized.

The present invention provides a clock phase control circuit that solves the problems described above individually or simultaneously, and achieves high resistance to power analysis attacks, and also achieves an increase in the amount of information that interferes with the PUF circuit and suppresses instantaneous power consumption.

In order to solve the above-described problems, the clock phase control circuit of the present invention includes a plurality of delay elements for delaying a clock signal, a decoder for decoding a random variable into a phase selection signal for selecting a phase of a clock signal, and a phase selection unit. Among the complex clock signals delayed by the delay elements and having different phases, the clock signal of the phase selected by the phase selection signal is selected, and the next clock signal is output.

According to the present invention, a plurality of flip-flops are used to set a phase difference using a random variable, and dynamically change its value, thereby having an effect of achieving high resistance to power analysis attacks.

1‧‧‧ clock source

2‧‧‧ clock line

3‧‧‧Factor

4‧‧‧clock phase control circuit

5‧‧‧ Random Variable Information

6‧‧‧Software setting information

7‧‧‧Conversion signal

8‧‧‧ Delay element

9‧‧‧ Phase Control Information

10‧‧‧Decoder

11‧‧‧ Clock area allocation clock

[Fig. 1] is a configuration diagram for explaining clock distribution in the first embodiment; [Fig. 2] is a configuration diagram showing a configuration example of the clock phase control circuit of the first embodiment; [Fig. 3] A configuration diagram of a clock distribution of a conventional technique will be described; [Fig. 4] is an explanatory diagram of a countermeasure map of a power analysis attack generated by the clock phase control circuit 4 of the second embodiment; [Fig. 5] is a third implementation. An example explanation diagram of the clock phase control circuit 4 of the example applied to the interference PUF circuit; and [FIG. 6] is an explanatory diagram for reducing the instantaneous power consumption of the LSI according to the clock phase control circuit 4 of the fourth embodiment.

The basic idea of the invention is between the plural flip-flops, the intention The above-mentioned problems 1 to 3 are solved by setting the above-described clock offset (phase difference) and dynamically changing the value thereof. In the circuit to which the present invention is applied, if the maximum value of the clock offset is T, the delay time of the design signal transmission bus must be at least limited by T. Further, when focusing on a single flip-flop, when the present invention is applied, the clock jitter (change in the clock timing) of the T portion is increased.

Hereinafter, embodiments of the invention will be described.

First embodiment

Fig. 1 is a view showing the configuration of the clock distribution of the first embodiment.

The difference from the clock distribution of the prior art of Fig. 3 is that the flip-flop 3 (or the flip-flop group) of each of the assigned clocks is inserted into the clock-phase control circuit 4 on the clock line 2. The clock phase control circuit 4 delays the phase of the input clock source 1 by only the Δ output, and distributes it to the downstream flip-flop (group). The value of Δ can be changed according to the value of the random variable data 5 or the software setting data 6. Although not shown, the random variable data 5 is a random variable bit sequence generated by a random variable generating circuit in the LSI, and the software setting data 6 is, for example, an output of a register in which an arbitrary value can be set. The random variable data 5 can be a true random variable or a pseudo-random variable. Moreover, the random variable data 5 and the software setting data 6 can be converted by converting the signal 7.

Fig. 2 is a view showing the configuration of a configuration example of the clock phase control circuit of the first embodiment.

The clock phase control circuit of Fig. 2 corresponds to all of items 1, 2, and 3 of the patent application scope of the present invention.

First, the clock source 1 input to the clock phase control circuit 4 generates a complex number of clocks having different phases via a plurality of delay elements 8 arranged in series. In the example shown in Fig. 2, the clocks output by the clock source 1 and the three delay elements 8 are respectively input to the AND gates, and from these AND gates, Φ ₀ , Φ ₁ , Φ ₂ , Φ ₃ 4 are generated. Clocks with different phases.

On the other hand, any of the random variable data 5 and the software setting data 6 is selected as the phase control material 9 by the conversion signal 7. The value of the conversion signal 7 is, for example, a value set by the software.

Next, the phase control material 9 of n bits (n=2 in Fig. 2) is decoded by the decoder 10 to decode only 1 to 2 ⁿ bits of one bit, and becomes a signal for selecting a clock phase. The phase selection signal is stored in the flip-flop of the falling edge.

Next, the phase control data 9 is input to each of the flip-flops that accommodate the phase selection signal. At this time, the output of the AND gate input to the bit of the phase control data 9 is selected by the OR gate, and is output from the clock phase control circuit 4 as the clock region distribution clock 11.

Further, in Fig. 2, in order to prevent the occurrence of burrs, the maximum delay (phase latest) added to the delay element 8 is supplied to each flip-flop, and the earliest clock rise timing is guaranteed. If the phase clock is 0, any clock can be supplied.

Further, according to the output value of the flip-flop, before the clock of the second (phase is the earliest) rise, one clock is selected from the complex clocks having different phases, and the clock of the second clock cycle is from the clock phase. The control circuit 4 outputs.

Further, Fig. 2 is an example of a circuit for selecting one set of output from four sets of clock phases. However, by changing the number of bits of the input signal or the number of delay elements in the same circuit, the selectable phase can be changed to N. group.

As described above, the invention of the first embodiment has an effect of achieving high resistance to power analysis attacks by using a random variable between the plurality of flip-flops, intending to set the phase difference, and dynamically changing the value thereof.

Hereinafter, an embodiment in which the above-described problems 1 to 3 in the LSI are solved by using the clock phase control circuit 4 shown in the first embodiment will be described below.

Second embodiment

In the second embodiment, an embodiment in which the above-described problem 1 of the LSI is solved will be described.

For example, a Sbox (substitution box) that implements a circuit for AES (Advanced Encryption Standard) non-linear processing is an 8-bit input circuit, but consumes power according to an 8-bit input data value. There may be a bias. At this time, the power analysis attack secret information may leak. For this reason, for example, when the input data values are the same, the power consumption of the Sbox becomes similar. Thus, the clock phase control explained by the first embodiment is applied. Circuit 4 to Sbox can prevent the power consumption of the Sbox from becoming similar.

Fig. 4 is an explanatory diagram of a countermeasure map of a power analysis attack generated by the clock phase control circuit 4 of the second embodiment.

As shown in Fig. 4, by holding each of the data registers of the input data of the Sbox, by applying the clock phase control circuit 4 of the present invention, it is possible to prevent the waveform of power consumption from being fixed, and it is possible to avoid the power analysis attack. That is, even for the input data of the same value, the change timing of each bit changes every time, and as a result, the waveform of the power consumption also changes. Therefore, power analysis attacks become extremely difficult. Further, the second embodiment corresponds to items 4 and 5 of the patent application scope of the present invention.

As described above, the invention of the second embodiment is applied by the clock phase The bit control circuit 4 to the cryptographic circuit has the effect of achieving high resistance to power analysis attacks.

Third embodiment

In the third embodiment, an embodiment in which the above-described problem 2 of the LSI is solved will be described.

Fig. 5 is a diagram showing an example of application of the clock phase control circuit 4 of the third embodiment to the interference PUF circuit.

By applying the present invention to the interference PUF circuit, a single interference generation circuit can be used to increase the amount of inherent information obtained. That is, each data register holding the input data (question data) of the PUF circuit is applied, and the clock phase control circuit of the present invention is applied. At this time, in the clock phase control, instead of using the random variable data 5 of FIG. 2, the software setting data 6 is set, and the conversion signal 7 is set.

In the interior of the interference generating circuit, the signal delay is slightly different for each individual chip, and the difference between the operation timing of the circuit generated based on the delay of the signal and the value of the input data determines whether or not there is interference in the specific logic gate, which becomes the inherent information of the circuit. In the present invention, as shown in Fig. 5, the clock phase control circuit 4 changes the timing of each input signal change of the interference generating circuit, thereby changing the operation timing of the circuit. That is, even if the same input data and the same individual are provided, the output of the interference changes according to the supply of the clock phase, and the obtained inherent information also changes.

As described above, the invention of the third embodiment has an effect of increasing the amount of information obtained by the PUF by applying the clock phase control circuit 4 to the PUF circuit even in the case of a single interference generation circuit. This is equivalent to amplifying the interrogation space of the PUF without increasing the interference generating circuit. Further, the third embodiment corresponds to item 6 of the patent application scope of the present invention.

Fourth embodiment

In the fourth embodiment, an embodiment of solving the above problem 3 in the LSI will be described.

Fig. 6 is a diagram showing an example of reducing the instantaneous power consumption of the LSI according to the clock phase control circuit 4 of the fourth embodiment.

As described above, the instantaneous power consumption of the LSI is increased (or decreased) in the clock supplied to the flip-flop, and in particular, the output of the multiplexer is changed to a large value. By applying the clock phase control circuit 4 of the present invention, this problem can be avoided by limiting the number of flip-flops supplying the clock of the same phase.

Specifically, as shown in FIG. 6, most of the flip-flops in the circuit are divided into N groups (clock regions), and individual random variable data are used to determine the clock phase supplied to each group. In Fig. 6, an example of changing the clock phase of each Sbox is shown.

As described above, the invention of the fourth embodiment can reduce the instantaneous power consumption by using the random variable data in each clock region to change the clock phase and disperse the generation timing of the power consumption as the output of the flip-flop changes. Effect. Moreover, if the cryptographic circuit of the fourth embodiment is applied, countermeasures against power analysis attacks and reduction of instantaneous power consumption can be simultaneously achieved. Further, the fourth embodiment corresponds to item 7 of the scope of the patent application of the present invention.

Fifth embodiment

The technique described in Non-Patent Document 5 also uses the Sbox of the block cipher AES as the interference generating circuit for interfering with the PUF, and the cryptographic circuit and the interfering PUF circuit share the circuit. By applying the clock phase control circuit 4 of the present invention to such a circuit, it is possible to simultaneously obtain an effect of improving the resistance of the power analysis attack of the cryptographic circuit and an effect of increasing the amount of information of the PUF circuit.

Specifically, the usage is as follows: for keeping the input data of the Sbox Each bit of the data register, when the clock phase control circuit 4 of the present invention is applied as a cryptographic circuit, the phase is determined by the random variable data 5 as in the second embodiment described above, and is used as an interference PUF circuit. The phase is determined by the software setting material 6 as in the third embodiment described above. Further, the fifth embodiment corresponds to item 8 of the patent application scope of the present invention.

Sixth embodiment

In Fig. 2, for the clock phase control, both the random variable data 5 and the software setting data 6 are prepared, and the phase control generated by the two can be switched, but the circuit for performing the clock phase control by only one of them can be used.

Further, in the first drawing, although an example in which the output of one clock phase control circuit 4 is distributed to two flip-flops is shown, the number of flip-flops may not be limited to two. Each flip-flop controls the clock phase, and each circuit block with a complex flip-flop inside can also be controlled. Further, the circuit block for controlling the clock phase may be mixed with the circuit block for not controlling the clock phase.

1‧‧‧ clock source

2‧‧‧ clock line

3‧‧‧Factor

4‧‧‧clock phase control circuit

5‧‧‧ Random Variable Information

6‧‧‧Software setting information

7‧‧‧Conversion signal

Claims (8)

A clock phase control circuit comprising: a plurality of delay elements for delaying a clock signal; a decoder for decoding a random variable into a phase selection signal for selecting a phase of a clock signal; and a phase selection unit delaying from the delay element and having a different phase Among the complex clock signals, the clock signal of the phase selected by the phase selection signal is selected and output as the next clock signal. The clock phase control circuit according to claim 1, wherein the selector includes a setting value of the software setting or the random variable; and the decoder decodes the set value selected by the selector or the random variable. Select the signal for the phase. The clock phase control circuit according to claim 1, wherein the flip-flop includes a bit of the phase selection signal; and the decoder decodes the random variable whose clock period changes as the phase selection signal. And the phase selection unit, when the clock signal falls, storing the bit signal of the phase selection signal into the flip-flop, and selecting the phase selection signal stored in the flip-flop until the next clock signal rises The phase of the clock signal. The clock phase control circuit according to claim 1, wherein the cryptographic circuit includes an encryption input data, and the phase selection unit changes a clock signal of the input data of the cryptographic circuit to select the phase selection signal. The phase of the clock signal. The clock phase control circuit according to claim 4, wherein the phase selection unit changes a clock signal of the input data of the cryptographic circuit for each clock cycle to become a phase selected by the phase selection signal. Clock signal. The clock phase control circuit according to claim 1, wherein the circuit including the interference PUF (Physical Unclonable Function) circuit performs calculation processing on the input data according to the internal occurrence of the circuit. The interference waveform of the transition transition generates an identification code unique to the device, and the phase selection unit changes the clock signal of the input data of the interference PUF circuit to a phase signal selected by the phase selection signal. The clock phase control circuit according to claim 1, wherein the semiconductor integrated circuit includes a class of flip-flops as a group, and a clock signal is supplied to the group as an input signal; and the phase selection unit is changed. The clock signal of the input data of the semiconductor integrated circuit is a clock signal of a phase selected by the phase selection signal. The clock phase control circuit according to the first aspect of the invention, comprising: a cryptographic circuit for encrypting the first input data; and an interference PUF circuit for performing a calculation process on the second input data, according to the circuit The interference waveform of the transitional migration occurring internally generates an identification code inherent to the device; and includes: a semiconductor integrated circuit in which a part of the cryptographic circuit is shared by a common circuit of a part of the interference PUF circuit; and the phase selection unit changes the cryptographic circuit every clock cycle when the shared circuit is used in the cryptographic circuit a clock signal of the first input data is a clock signal of a phase selected by the phase selection signal; and when the shared circuit is used by the interference PUF circuit, changing a clock signal of the second input data of the interference PUF circuit A clock signal that becomes the phase of the phase selection signal selection.