JP2009288908A - Method of detecting failure attack for alterating content of memory, security device, and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security device capable of detecting that an instruction stored in a memory changes to such an instruction specified in advance in the security device (for example, NOP instruction) when an IC chip mounted on the security device is irradiated with laser beam as failure attack to the security device. <P>SOLUTION: A VM10 mounted on an IC card 1 which is a security device comprises a fetching means 100 which fetches an execution operation code from an EEPROM22, a specified operation code detecting means 101 which detects that the fetching means 100 has fetched the operation code of an instruction specified in advance in the IC card 1 (for example, operation code of NOP instruction), and an execution operation code validation means 102 which validates the validity of execution operation code when the specified operation code is fetched. The VM10 executes a process for stopping an operation of VM10 if validating the validity of the execution operation code fails. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a security device (for example, an IC card) mounted with a semiconductor integrated circuit. More specifically, the security device is provided with tamper resistance against a failure attack that changes the contents of a memory using a laser beam or the like. For technology.

  In recent years, many attacks on security devices against embedded devices storing confidential information such as IC cards have been studied and the results have been reported. As one of the attack methods against the security device, a side channel attack that decrypts the DES secret key stored in the security device by observing the side channel such as power consumption and electromagnetic waves is well known. Various known documents such as No. 1 disclose a technique for providing a security device with tamper resistance against side channel attacks.

  However, the attack method for the security device is not limited to the above-mentioned side channel attack, and as an attack other than the side channel attack, the semiconductor integrated circuit (IC chip) mounted on the security device is irradiated with laser light, and the contents of the memory There is a failure analysis (Fault Analysis) that decrypts the DES secret key by deliberately inducing a malfunction and using the malfunction of the IC chip as a starting point.

  Although it is sufficient that the side channel attack countermeasure method is effective against failure attacks using laser light, etc., since the attack method is different, the side channel attack countermeasure method is against laser beam failure attacks. Is not effective.

  As a technique for detecting a malfunction of an IC chip due to a failure attack, a technique called a watch dog timer as described in Patent Document 2 may be used. Certainly, when the security device is irradiated with laser light and the contents of the memory where the program code is stored change, the IC chip of the security device runs away, so the runaway can be detected by the watchdog timer. There is sex.

  However, the runaway of the IC chip can be a starting point for decrypting the secret information stored in the IC chip. Furthermore, depending on the contents of the memory when the memory is subjected to a failure attack such as laser light irradiation. In some cases, the IC chip malfunctions without running away. In such a case, this malfunction cannot be detected by the watchdog timer. For example, when an instruction stored in the memory changes to a NOP instruction that causes the CPU of the IC chip to perform no operation due to laser light irradiation or the like, the IC chip is likely to malfunction without running away. .

JP 2002-74245 A JP-A-5-224999

  Therefore, the present invention performs a failure attack using a laser beam or the like on a security device typified by an IC card, and an operation code stored in a memory is a command (for example, specified in advance in the security device). It is an object of the present invention to provide a method capable of detecting a change to an operation code of a NOP instruction), a computer program incorporated in a security device to execute the method, and a security device in which the computer program is mounted.

  Furthermore, the first invention is a method for detecting a failure attack that alters the contents of a memory, and a command executed by a virtual machine mounted on a security device from a byte code stored in the memory of the security device. The operation code fetched in step a, and the virtual machine confirms whether the execution opcode fetched in step a matches the operation code (designated opcode) of the instruction specified in advance in the virtual machine. Step b for executing the process of detecting that the designated opcode is fetched, and verifying the validity of the execution opcode when the virtual machine detects that the designated opcode is fetched in step b. Step c for executing the processing to Serial virtual machine, wherein when the validation fails the validity of the execution opcode in step c, characterized in that it comprises a step d, to execute a process to deal with the fault attack.

  According to the first invention, when the contents of the memory are tampered with using a laser beam or the like and the contents of the memory are tampered with, the operation code having the same value as the value that is easily converted is executed. The designated operation code is specified as an operation code that may cause a security problem, and the virtual machine is used to verify the validity of the execution operation code when the execution operation code is the specified operation code. When a failure occurs, a process for stopping the operation of the virtual machine is executed as a process for dealing with a failure attack, thereby reducing the risk that the security device malfunctions due to a failure attack that alters the contents of the memory. it can.

  In particular, the NOP instruction (NOP: No Operation) prepared by the byte code of the virtual machine is an instruction that does not cause the CPU of the security device to execute any operation. If the operation code is converted into a NOP instruction opcode and the CPU does not execute any processing, it is easily used as a starting point when decrypting confidential information (for example, an encryption key) stored in the security device. It is preferable to use an instruction opcode. For example, if a branch instruction is converted into a NOP instruction, confidential information stored in the security device is decrypted or the security device is abused without executing user authentication processing (for example, PIN verification processing). End up.

  The process executed in step c of the first invention, that is, the process for verifying the validity of the execution opcode may be any process as long as the execution opcode can be validated. For example, in the step c, the operation code is read again from the same memory address as the execution opcode, and by confirming whether the execution opcode fetched in the step a matches the operation code read in the step c, The validity of the execution opcode can be verified.

  Further, as another method for verifying the validity of the execution opcode, a verification code (for example, an error detection code) is used to verify the validity of the specified opcode in advance when the specified opcode is described in a byte code. ) May be included in the byte code, and in step c, the validity of the execution opcode may be verified using the detection code.

  In the present invention, the security device has a function for data communication with a terminal (not shown) and a function for executing a command transmitted from the terminal, and stores secret information (for example, an encryption key) therein. A device means a device such as an IC card or a USB key.

  Further, the second invention is a security device to which the method according to the first invention is applied and an IC chip is mounted, and an operation code (instruction code) to be executed from the bytecode stored in the memory of the security device. A fetch unit that fetches an execution opcode), and the execution opcode fetched by the fetch unit matches the operation code (designated opcode) of an instruction preliminarily designated in the security device, thereby specifying the designated opcode A designated opcode detecting means for executing a process for detecting that the fetched operation code has been fetched, and an execution opcode verifying means for executing a process for verifying the validity of the execution opcode when the execution opcode is the designated opcode. Failed to verify the validity of the execution opcode When, wherein the virtual machine running the process to deal with the fault attack is mounted on the IC chip.

  In the second invention, as the execution opcode verification means provided in the virtual machine of the security device, the operation code is read again from the same memory address as the execution opcode, and the execution opcode and the read opcode are A means for verifying the correctness of the execution opcode by confirming whether they match, or a verification code (for example, for verifying the correctness of the specified opcode when the specified opcode is included in the bytecode) , Error detection code) can also be included in the byte code, and a means for verifying the validity of the execution opcode using the detection code can be used.

  In the second invention as well, as in the first invention, it is preferable that the designated opcode is a NOP instruction.

  Further, a third invention is a computer program for causing a security device to execute the method according to the first invention, and fetches an operation code (execution operation code) of an instruction to be executed from a bytecode stored in a memory of the security device. A step of executing a process of detecting that the designated opcode is fetched by confirming whether or not the execution opcode matches an opcode (designated opcode) of an instruction designated in advance in the security device. When it is detected in step b that the designated opcode is fetched, step c is executed to verify the validity of the execution opcode, and when the validity of the execution opcode is failed in step c , Execute processing to deal with failure attacks The-up d, is a computer program to be executed by the security device.

  In the third invention as well, as in the first invention, it is preferable that the designated opcode is a NOP instruction.

  As described above, according to the present invention described above, a failure attack using a laser beam or the like is performed on a security device represented by an IC card, and an operation code stored in a memory is designated in advance in the security device. It is possible to provide a method capable of detecting a change to an operation code of a certain instruction (for example, a NOP instruction), a computer program incorporated in a security device to execute the method, and a security device in which the computer program is implemented.

  From here, an embodiment when the security device is the IC card 1 will be described in detail with reference to the drawings. FIG. 1 is an external view of an IC card 1 according to the present embodiment, FIG. 2 is a circuit block diagram of an IC chip 2 mounted on the IC card 1, and FIG. 3 is a software block diagram of the IC card 1.

  The IC card 1 shown in FIG. 1 is a plastic card having the same size as a cash card or credit card, and an IC module 2a in which an IC chip 2 is molded is mounted on the IC card 1.

  In FIG. 1, the IC card 1 is illustrated as a contact IC card. However, the IC card 1 has a non-contact IC card for wireless communication with a terminal outside the figure, or two communication functions of contact communication and wireless communication. It may be a dual interface IC card provided.

  In addition, the shape of the IC card 1 is not limited, and the IC card 1 is not the same shape as the cash card, but is a SIM (Subscriber Identity Module) or UIM (Universal) that is formed by cutting the vicinity of the IC module 2a into a strip shape. Subscriber Identity Module).

  As shown in FIG. 2, the IC chip 2 includes a central processing unit 20 (CPU: Central Processing Unit) having a calculation function and a function of controlling the circuit and memory of the IC chip 2, and a memory capable of high-speed reading. Cache 26 (Cache), random access memory 21 (RAM: Random Access Memory) as volatile memory, read-only nonvolatile memory 23 (ROM: Read Only Memory), EEPROM 22 (electrically rewritable nonvolatile memory) EEPROM: Electrically Erasable Programmable Read-Only Memory), and UART 24 for controlling the I / O circuit 25 and communicating with a terminal (not shown) using a predetermined transmission program (for example, communication conforming to ISO / IEC7816). It has.

  The ROM 23 and the EEPROM 22 of the IC chip 2 are memories for storing computer programs and data for operating the IC chip 2, and the RAM 21 and the cache 26 are memories for temporarily storing data used when the CPU 20 executes the computer programs. It is.

  The ROM 23 of the IC chip 2 interprets an instruction code of the CPU 20 of the IC chip 2 as a computer program, and causes the CPU 20 to execute predetermined processing, and a Java Card (registered trademark). ) And a MULTIS (registered trademark) virtual machine 10 (VM: Virtual Machine) are mounted, and the VM 10 is constructed on the COS 12.

  The EEPROM 22 of the IC chip 2 is mounted with an application 11 that operates in the execution environment of Java Card (registered trademark) built in the ROM 23 of the IC chip 2. The application 11 is described in byte codes corresponding to the VM 10 mounted on the ROM 23. For example, if the VM 10 mounted on the ROM 23 is a JAVA Card (registered trademark) VM 10, the application 11 mounted on the EEPROM 22 is It becomes an applet (Applet) written in Card (registered trademark) byte code.

  When the VM 10 executes the process of the application 11 mounted on the EEPROM 22, the VM 10 is described in a 1-byte binary format from the byte code of the application 11, and fetches an opcode of an instruction to be executed.

  In the case of an operation code accompanied by an operand, an operand described in the operation code is fetched. Then, the VM 10 converts the fetched operation code (when there is an operand, the operand) into a native code corresponding to the COS 12, and the COS 12 executes the native code delivered from the VM 10.

  If the IC card 1 does not receive a failure attack that alters the contents of the memory, such as laser light irradiation, the IC card 1 operates normally according to the procedure described above, but when the IC card 1 is operating, When the IC chip 2 is irradiated, for example, the contents of the EEPROM 22 are falsified, and the VM 10 may cause the IC card 1 to malfunction because the fetched opcode is not a correct one.

  In particular, a byte code instruction corresponding to the VM 10 is called a NOP instruction (NOP: No Operation), and an instruction that does not cause the CPU 20 to execute any processing is generally prepared. When the operation code other than the NOP instruction is changed to the operation code of the NOP instruction, the instruction that should be executed is not executed.

  For example, if a branch instruction is converted into a NOP instruction, confidential information stored in the security device is decrypted or the security device is abused without executing user authentication processing (for example, PIN verification processing). End up.

  Therefore, in the VM 10 mounted on the IC card 1 according to the present invention, an operation code of an instruction to be executed (hereinafter referred to as “execution operation code”) is an instruction (for example, a NOP instruction) designated in advance in the IC card 1. ) Operation code (hereinafter referred to as “designated opcode”), a function that detects that the specified opcode is fetched, and a function that verifies the validity of the execution opcode when the specified opcode is fetched Is provided.

  FIG. 4 is a functional block diagram of the IC card 1, and FIG. 5 is a flowchart showing an operation procedure of the VM 10 mounted on the IC card 1.

  As shown in FIG. 4, the VM 10 and at least one application are mounted on the IC card 1. The VM 10 fetches the execution opcode from the EEPROM 22, and the fetch means 100 fetches the specified opcode. A designated opcode detection unit 101 to detect and an execution opcode verification unit 102 to verify the validity of the execution opcode when the designated opcode is fetched are provided.

  4 is realized by a computer program for causing the IC chip 2 of the IC card 1 to function as each means. This computer program is a main body of the VM 10 or a library for using the VM 10. Embedded in a framework that is a collection of

  From here, each means with which VM10 of IC card 1 was equipped is demonstrated using the flow illustrated in FIG. When the VM 10 executes the processing of the application mounted on the EEPROM 22, the fetch unit 100 of the VM 10 reads the execution opcode from the bytecode of the application stored in the EEPROM 22 and stores the execution opcode in the register of the CPU 20. A 1-byte execution opcode is fetched (S1).

  When the fetch means of the VM 10 fetches a 1-byte execution opcode, the designated opcode detection means 101 of the VM 10 operates, and the designated opcode detection means 101 of the VM 10 compares the execution opcode fetched into the register of the CPU 20 with the designated opcode. Thus, it is confirmed whether or not the designated operation code has been fetched (S2).

  If the operation code fetched by the fetch unit 100 is not the specified operation code, the designated opcode detection unit 101 of the VM 10 continues the process of executing the instruction corresponding to the execution opcode fetched by the fetch unit 100 (S3), and the fetched execution opcode Is the designated opcode, the execution opcode verification means 102 of the VM 10 is called to verify the validity of the execution opcode fetched in S1 (S2_1).

  The execution opcode verification means 102 may use any method for validating the fetched execution opcode. For example, the fetch means 100 reads the operation code again from the same address of the EEPROM 22 from which the execution opcode is fetched, performs an operation to confirm that the read opcode and the execution opcode fetched in S1 match, and each opcode By confirming that they match, the validity of the fetched operation opcode can be verified.

  When the specified opcode is included in the application bytecode, the EDC (EDC: Error Detection Code) used to verify the validity of the specified opcode is calculated from the bytecode written near the specified opcode. Then, the EDC is included in the byte code of the application, and the execution opcode verification unit 102 can verify the validity of the fetched execution opcode by using the EDC.

  When the execution opcode verification means 102 succeeds in verifying the validity of the fetched execution opcode, the execution opcode verification means 102 proceeds to S3 and continues the process of executing the instruction corresponding to the fetched execution opcode.

  Further, if the validity of the fetched execution opcode fails, the execution opcode verification means 102 determines that the IC card 1 has received a failure attack that falsifies the contents of the memory, and proceeds to S2-2. The VM 10 An error process (for example, a process for stopping the operation of the VM 10) is executed when the IC card 1 receives a failure attack that alters the contents of.

  The present invention is not limited to the embodiments described so far, and various modifications and changes can be made. For example, in this embodiment, the security device is an IC card, but the present invention can also be applied to a security device other than the IC card (for example, a USB key). In the present embodiment, the designated instruction may be an instruction other than the NOP instruction.

  Furthermore, the configuration of the IC chip mounted on the IC card is not limited to the configuration illustrated in FIG. 2, and may be, for example, an IC chip without a cache.

1 is an external view of an IC card according to the present embodiment. The circuit block diagram of the IC chip mounted in an IC card. The software block diagram of an IC card. The functional block diagram of an IC card. The flowchart which showed the operation | movement procedure of VM mounted in the IC card.

Explanation of symbols

1 IC card 10 Virtual machine (VM)
100 fetch means 101 designated opcode detection means 102 execution opcode verification means 11 application 2 IC chip 20 CPU
22 EEPROM
23 ROM

Claims (6)

A method for detecting a failure attack that alters the contents of a memory, wherein a virtual machine installed in a security device fetches an operation code (execution operation code) of an instruction to be executed from a bytecode stored in the memory of the security device Step a,
A process in which the virtual machine confirms whether the execution opcode fetched in the step a matches an opcode (designated opcode) of an instruction designated in advance in the virtual machine, and detects that the designated opcode has been fetched Performing step b,
A step c for executing a process of verifying the validity of the execution opcode when the virtual machine detects that the designated opcode is fetched in the step b;
When the virtual machine fails to verify the validity of the execution opcode in the step c, the step d executes a process for dealing with a failure attack;
A failure attack detection method comprising:   The failure attack detection method according to claim 1, wherein the specified operation code is an operation code of a NOP instruction (NOP: No Operation). A security device on which an IC chip is mounted,
Fetch means for fetching an opcode of an instruction to be executed (execution opcode) from the bytecode stored in the memory of the security device;
A designated opcode that executes processing for confirming whether the execution opcode fetched by the fetch means matches an opcode (designated opcode) of an instruction designated in advance in the virtual machine, and detecting that the designated opcode has been fetched. Detection means;
When the execution opcode is the designated opcode, an execution opcode verification means for executing processing for verifying the validity of the execution opcode is provided,
A security device, wherein a virtual machine that executes processing to cope with a failure attack when verification of the validity of the fetched operation opcode fails is mounted on the IC chip.   4. A security device on which the IC chip according to claim 3 is mounted, wherein the designated operation code is an operation code of a NOP instruction (NOP: No Operation). A step of fetching an operation code (execution operation code) of an instruction to be executed from a byte code stored in a memory of a security device mounted with an IC chip;
A step of confirming whether the execution opcode and an opcode (designated opcode) of an instruction designated in advance in the security device match, and executing a process of detecting that the designated opcode is fetched; b
A step c for executing a process of verifying the validity of the execution opcode when it is detected in step b that the designated opcode is fetched;
When the verification of the validity of the execution opcode fails in the step c, a step d for executing a process for dealing with a failure attack is performed.
A computer program for causing the security device to execute. 6. The computer program according to claim 5, wherein the designated operation code is an operation code of a NOP instruction (NOP: No Operation).

Images