WO2007006887A1

WO2007006887A1 - Protection against attacks by generating errors on jump instructions

Info

Publication number: WO2007006887A1
Application number: PCT/FR2006/001519
Authority: WO
Inventors: Francis Chamberot; Emmanuel Barau
Original assignee: Oberthur Card Systems Sa
Priority date: 2005-07-11
Filing date: 2006-06-29
Publication date: 2007-01-18
Also published as: FR2888369B1; FR2888369A1

Abstract

The invention relates to a method for securing a program against attacks by error, in particular in a smartcard comprising at least one cycle consisting in identifying in a program a jump instruction towards a security action program, wherein said jump instruction is formed by an instruction code and an addressing parameter of the security action program, in determining a physical address for storing said security action program, therein said physical address is determined according to the jump instruction code, and in allocating the physical address value of a determined security action program to an address parameter contained in the jump instruction,

Description

PROTECTION AGAINST ATTACKS BY GENERATING FAULTS ON JUMPING INSTRUCTIONS

The present invention relates to a method for securing a computer program and to a device, in particular a microcircuit card (also called a "smart card") implementing such a method. The invention also relates to a device for generating the security of a program associated with this method.

The present invention aims in particular securing calls and jumps to pieces of programs having critical functions for the security of the system.

Furthermore, the term "security" of a computer program any treatment to guard against attacks including disruption of the operation of an electronic entity, also called "fault attack attacks" (English "Fault Attack" ).

Moreover, it will be understood by computer program, any program, whatever the computer language and storage means used. For example, and without limitation, the computer program can be written in machine language, assembler, C, C ++, Java. The program can be stored in a permanent memory, for example in a ROM or EEPROM memory, Flash or on a hard disk, or in a volatile memory, for example of the RAM type. The present invention aims, in particular, to protect against attacks intended to modify the execution of the execution of a computer program running on a secure electronic entity, (for example, a microcircuit card, a secure PCMCIA card (for example an IBM4758 card), a USB key or a passport (or other piece of identification) integrating a chip with a contactless interface in at least one of its pages).

The fault generation attacks are intended, in particular, to force a processor to not, or poorly, perform certain instructions of a computer program. The attacked computer program can then proceed in a very different way from the one planned at the time of its conception.

These attacks can, among other things and in a known manner, be carried out:

generating a voltage spike at one of the processor power terminals;

- by raising its temperature abruptly;

- by rapidly changing its clock frequency or its supply voltage;

- By applying a flash of light, a laser beam, or an electromagnetic field, on a part of the silicon that composes it.

Such attacks are particularly active on certain instructions of a program, in particular because of the instructions of jump or connections.

For this purpose, it should be noted that the branching instructions are for example the "if", "case" instructions, in the C language. The compilation of such connection instructions in assembly language produces a conditional or unconditional jump instruction to an address or an address. instruction of the program to be achieved. The instruction to be reached is identified by a label in an assembly program. According to the 8051 assembler language, the conditional or unconditional jump instructions of the C language are translated into "jnz" type instructions (which can be translated as "jump if the result of the previous instruction is not equal to 0"), " jz "(which can be translated as" jump if the result of the previous instruction is equal to 0 ")," jmp "(which can be translated as" jump "). Once compiled in machine language, the instruction to be reached is identified by its address passed as argument (or parameter) of the jump instruction. This address is either an increment or a decrement in number of bytes with respect to the address of the jump instruction, also called relative address, or an absolute address, that is to say, a fixed address within of memory.

During a fault attack, the execution of a jump instruction can in a very large majority of cases be disturbed leading to a jump to an address not provided by the initial program. Indeed, during the disruption of such an instruction, the result obtained is equivalent, for example, to a modification of the instruction code. This value is changed randomly.

Thus, for example, if we consider the following piece of program in machine language: 02 04 05, this piece corresponds in assembly language to the instruction LJMP @ 0x405. The LJMP instruction, which is Long JUMP in English terminology, means that this instruction pertaining to a jump having for parameter a 2-byte coded address. The code of the LJMP instruction is 0x02. The address 0x405 is the address of the first instruction of a series of instructions corresponding to a program called security action program. If, during a fault attack, the security action program is not executed, then this can jeopardize the security of the system.

A security action program may, in particular, consist in performing the following operations: an access code verification (PIN or "Personal Identification Number" in English terminology) a verification by a smart card of the code of message authentication (MAC or "Message Authentication Code" in English terminology) of a command it received before executing it - the execution of an encryption program, for example, encrypted data which will be sent to a recipient, the execution of a countermeasure following an attack, in particular, destruction of the smart card, infinite loop, etc.

Following an attack on the piece of program previously described leading to a modification, in particular random, bytes to read, the processor may be led to read and execute the following code: DO 04 05, that is to say the code a undergoes a modification so that the code 0x02 has been modified by the code OxDO, the latter corresponding to the instruction POP, that is to say to an instruction commanding to stack on the execution stack the value passed in parameter. This code corresponds in assembler language to the following instructions: POP 0x04 INC R1

Indeed, the code 0x05 corresponds to the INC R1 instruction, that is to say the incrementation instruction of the register R1, this instruction being without parameters.

In this way, the initial instruction encoded on 3 bytes is replaced by two instructions, the POP instruction coded on 2 bytes and the instruction INC R1 coded on a byte.

Thus, a fault attack, introduces a kind of desynchronization of the execution of the program, so that the program will then perform actions that the attacker can take advantage.

Similarly, such an attack makes it possible to prevent the execution of a security action program initiated during its call by means of a jump instruction or a call to a subroutine, while continuing thereafter. execution of the program. Thus, the attacker can prevent the execution of a security action program such as verification of personal access code, encryption, etc. and still access secure data, data in the clear, etc.

The present invention aims at a security method of the software type and does not have the above disadvantages.

For this purpose, it proposes a method for securing the execution of a computer program against fault attacks on instructions. of jump. This method is applicable in particular in a smart card. This method comprises at least one cycle comprising the following steps: identification in this program of a jump instruction responsive to such an attack during the execution of said program, to a safety-critical safety action program, the instruction of jump being formed of an instruction code and an addressing parameter of the security action program, determining the physical address of storage of the security action program, the physical address being determined from the code of the jump instruction and / or code of the instruction according to the jump instruction, assignment, to the addressing parameter contained in the jump instruction, of the value of the physical address of the program of determined security action. The method according to the invention thus makes it possible to secure the call or the jump to program portions having functions that are critical for the security of the system.

To do this, the address of the security action is linked to the codes of the jump instruction used to execute the security action program.

In the context of the invention, the concept of jump instructions includes all of the conditional jump instructions, unconditional jump instructions, and program call instructions.

According to an advantageous characteristic of the invention, the cycle further comprises, before the determining step, at least one step of duplicating said jump instruction to the safety action program forming a sequence of jump instructions.

Thus, a call sequence to the security action program is created to force the call even if the disturbance generates a desynchronization or a modification of the first bytes of the sequence. According to another advantageous characteristic of the invention, the length of the jump instruction sequence is greater than or equal to the length of the code of the longest instruction of the instruction set.

According to another advantageous characteristic of the invention, the method comprises an insertion step, prior to the security action program, of an instruction indicating said physical address of storage of this previously determined security action program.

This characteristic has the effect of imposing a start of storage address of the security action program. According to an alternative embodiment, the cycle further comprises, before the determining step, a step of inserting at least one other jump instruction to the security action program according to the identified jump instruction, and after the determination step, the following steps:

determination for each of said other inserted jump instructions of a physical address of storage of the security action program, the physical address being determined from the code of the jump instruction and / or the code of the preceding instruction ,

assigning to the parameter of each of said inserted jump instructions the value of the physical address of the determined security action program.

According to this variant, while securing the jump instruction in question, it is avoided to repeat a sequence comprising a structure and fixed codes while possibly performing a filling of the residual part of a memory, in particular a memory ROM. According to an advantageous characteristic of this variant embodiment, the cycle comprises a step of inserting at least one instruction, before the security action program, indicating said physical memory storage addresses of the security action program previously determined for the jump instruction and for each of the other jump instructions inserted.

According to another advantageous characteristic of this variant embodiment, the cycle further comprises an insertion step of at least one embodiment. instruction before the security action program indicating all the physical addresses of the safe action program storing, said addresses being determined by the set of possible combinations of the codes of the jump instruction and each of the jump instructions inserted.

According to yet another advantageous characteristic of this variant embodiment, the cycle further comprises, after the determining step, a step of inserting at least one instruction after the identified jump instruction, this inserted instruction corresponding to a instruction without dangerous effect on the course of the said program.

In this way, while securing the jump instruction to a safe action program, the random filling of the memory, in particular of the ROM memory, is increased.

According to yet another advantageous embodiment, the security action program is a distribution program to at least one elementary security action program.

In this way, it is possible to manage several security action programs for the same application.

Correlatively, the invention provides a device for securing the execution of a program against fault attacks on jump instructions, in particular in a smart card. The device, according to the invention, comprises: identification means able to identify in this program a jump instruction responsive to such an attack during the execution of said program, to a critical safety action program for security, the jump instruction being formed of an instruction code and an addressing parameter of the security action program, means for determining the physical address of the security action program, the address physical being determined from the code of the jump instruction and / or code of the instruction following the jump instruction, allocation means able to assign, to the addressing parameter contained in the jump instruction, the value of the physical address of the determined security action program.

This device has the same advantages as the method of securing a program against fault attacks.

The invention also proposes a computer program stored on an information medium, said program comprising instructions enabling the implementation of a security method according to the invention, when this program is loaded and executed by a computer system. .

Other aspects and advantages of the present invention appear more clearly on reading the description of particular embodiments which follows, this description being given solely by way of nonlimiting illustrative example, with reference to the appended drawings in which: Figure 1 is an example of duplication of a critical jump instruction to a security action program;

FIG. 2 is an example of a combination of the LJMP and LCALL instructions towards a program of safe action and memorization of this program by duplication thereof; FIG. 3 is an example of securing a relative jump instruction to a security action program;

FIG. 4 is an example of the use of a dispatch program for elementary security action programs;

- Figure 5 schematically shows a device in which the invention is implemented.

As is known, a program stored in a memory is composed of instructions and operands. Within a program, program portions can be identified, that is, a set of instructions and operands with critical functions for system security whose execution contributes to the reliability of the program . Thus, in particular, the instructions to be executed after a call or a jump to these Program Portions Critical to System Security These portions can be considered as safe instructions that must be performed to ensure security.

These programs are stored in a permanent memory, for example, a ROM, EEPROM, FLASH or a hard disk, or a volatile memory, for example RAM type.

Thus, jump instructions can be identified as being critical, including jump instructions, unconditional jump instructions, and call instructions for a safe action program, for example, the following instructions jnz, jz, jmp, Ijmp, call, Icall, and they should be secured.

To do this, a sequence of instructions is constructed according to the invention that repeats the call of a safe action program, or the jump to this program, so as to execute this program even if a desynchronization of the flow of execution occurs after a disturbance.

According to a first embodiment, provision is made for the call instructions, or jump, to a safe action program, to determine the physical address of storage of the program according to the code of the instruction in question and thus set the operand of the instruction. Thus, if we consider the instruction LJMP (or "Long Jump") assembly 8051, previously described, it is encoded according to the data 0x02. This instruction includes a 2-byte operand that indicates the absolute address that the jump is aimed at.

The storage address of the safe action program is determined according to the code of the jump instruction. Thus, given the value of the code of the instruction "LJMP", the physical address of storage of the security action program is, for example, 0x0202. Indeed, the physical address to be coded on 2 bytes, this address consists, in particular, of the duplication of the code of the instruction in question, here the value 0x02. Then, the parameter of the call or jump instruction to the safe action program is set to the determined address. In order to actually memorize the security action program, at the determined address, for example at the address 0x0202, a directive is given to the linker so that the latter effectively stores this program at the same address. address, here instruction CSEG 0202h. Other means may also be provided.

The result of securing the jump instruction is:

LJMP 0202h (hexadecimal notation) which will be compiled in machine language according to the following data sequence: 02 02 02. It is also possible to repeat the instruction to the safe action program to ensure that the program security action will be called even if the execution flow is out of sync.

Thus, according to the example considered, it is expected a repetition of the jump instruction to the security action program in the assembly language program after determining the physical address of the program storage. We thus obtain the following sequence:

LJMP 0202h

LJMP 0202h After compilation, we obtain the following code sequence: 02

02 02 02 02 02. In this way, the instruction 0x02 meaning LJMP with parameter 0x0202 is executed even if the first bytes of the code sequence 02 02 02 02 02 02 02 become the parameter of the previous instruction after disturbance, or if the first bytes of the sequence are "skipped" due to a disturbance.

Such a modification can be done directly in the assembly language program. However, according to another embodiment, this modification can be performed by the program compiler written in a high level language, for example, in C ++, by means of an inserted compilation directive, for example, before the calls or jumps to a safe action program so that the compiler doubles, triple, etc., the call or jump instructions identified in the executable program compiled in machine language, in order to secure this call or this jump.

Figure 1 illustrates the example previously considered. For this, the main program includes a jump instruction (LJMP 0202h) to the safe action program which has been doubled.

The security action program includes before the sequence of instructions forming the security action program a compilation directive that requires the compiler to place the following portion of code, that is to say, the security action program , at the address 0202h. According to one embodiment, the assembly code of the security instruction can be placed before compilation in a separate file. Thus, the compilation directive only concerns the code contained in the file.

The security action program must in principle include in the last line, or substantially towards the end of this program, an instruction consisting of the return address, indicating the execution address of the suite of the application program.

However, when the safe action program results in the completion of the premature application or a mutism, e.g. an endless loop, this instruction is not necessary. In order to increase the probability of executing the safety action program during a disturbance, it should be noted that the length of the sequence, built by duplication, is advantageously greater than or equal to the length of the code of the the longest instruction in the instruction set. An alternative embodiment consists in identifying, in the program, the LCALL instruction (or "Long CaII") consisting in calling a program; whose value of this instruction in hexadecimal is 12h which leads to choose for the address a value 12h 12h.

The complete instruction to double is then "12h 12h 12h". In this way, this instruction calls, for example, a security action program located at the address 12h 12h in memory, for example in ROM. Similarly, all conditional jump instructions or not, and the calling instructions of a safe action program, including instructions jnz, jz, jmp, Ijmp, call, lcall can be secured according to the invention.

Thus, it is more difficult for an attacker to prevent the execution of a safe action program and then continue the program.

According to another embodiment, it is also possible to combine the use of the LJMP and LCALL instructions, ie to insert an LCALL instruction after an LJMP critical instruction rather than to duplicate the LJMP instruction. The use of this combination is adapted to the call of a security program of terminal type, that is to say, ending the execution of the program without returning to the calling program. However, the use of such a combination may apply to any safe action program.

The combination of these two instructions having, in this example considered, the instruction codes 02h and 12h, makes that there are four possible addresses resulting from the combination of these two instruction codes, namely: 0202h, 0212h, 1202h and 1212h.

In this way, it avoids repeating a fixed address according to a model. Likewise, it is thus possible to fill a larger memory area, especially when it is desired to fill a residual area of a memory, for example in ROM memory, as illustrated in FIG. 2.

It is thus very difficult for a fraudster to detect the implementation of the invention. This principle can be generalized and therefore it can apply to more than two instructions. However, it is necessary that all the addresses corresponding to all the possible combinations of the codes of the instructions considered include the code of the security action program.

In general, according to the invention, the call sequence for the security action program is such that, whatever the modification of the first byte of the launch sequence of the security action program, or the byte read first after a disturbance, this safe action program is started. For this, in particular, the following sequence is provided: 02 02 12 02 12 02

Thus, by duplicating or multiplying the call instructions to a safe action program as seen above, the latter is executed despite the disturbances.

This technique is also useful for randomly filling a memory, including a ROM.

According to another variant, the previously described principle can be applied to two adjacent instructions, such as a jump instruction, for example, LJMP or LCALL, and an instruction whose execution is safe for the security of the data.

Thus, we can secure the call for a safe action program according to the following examples: Example 1:

LJMP 0204h in machine language: 02 02 04

INC A in machine language: 04

LJMP 0404h in machine language: 02 04 04

Thus the sequence in machine language is 02 02 04 04 02 0404.

Example 2

LJMP 0204h in machine language: 02 02 04

LJMP 0404h in machine language: 02 04 04

Thus the sequence in machine language is 02 02 04 02 04 04.

Where 04h is the instruction code of the assembler instruction INC A meaning "increment" and the addresses 0202h, 0204h, 0402h, 0404h correspond to the address of the start of storage of each duplication of the security action program. According to an alternative embodiment, the security action program is stored at the address determined and passed as a parameter of the first jump instruction, for example at the address 02 04h according to the example below. above and the other addresses, for example 0202h, 0402h, 0404h, store an action program for processing the detection of a disturbance.

Note that the INC A instruction is coded on one byte, however, otherwise, the second LJMP instruction must be replicated.

Regarding the relative jump instructions, including the JNZ instruction indicating a relative jump if the contents of the register A is non-zero, it is also possible to secure the jump address to ensure that the jump will achieve the security agenda. Thus, as shown in FIG. 3, the JNZ instruction having the code

7Oh and being followed by the relative address 7Oh as previously presented, we obtain the code 70 70. This code is doubled, see tripled as shown in FIG.

In order to also secure the arrival address of the jump, instructions of NOP type, that is to say, not executing any processing, are inserted at the arrival address of the jump. In this way, in the event of a fault, the probability of the security action program being increased is increased and it is ensured that if the second or third JNZ instruction is executed, then the security action program is likewise executed. According to a variant (in FIG. 4) of the embodiment illustrated in FIG. 1, a distribution program is implemented that makes it possible, no longer to manage a security action program for the application, but several security action programs.

This dispatch program is positioned at the address or addresses. These addresses are determined in a manner to describe the memorization of the security action program. Basic security programs are memorized at other addresses.

The dispatch program reorientates the call to the appropriate elementary safe action program and therefore manages a multitude of basic security programs.

In order to implement this distribution program, and to be able to redirect the call to the appropriate elementary security action program, a global variable is updated and stores information indicating the basic security action program to be performed when a call to the dispatch function is made.

The basic security action program, if it does not lead to the premature termination of the program, includes a jump instruction to the continuation of the normal program to be performed.

According to this embodiment, the call to the dispatch function is secured to the security action programs.

FIG. 5 represents a device that possesses all the means necessary for implementing the method of the invention for securing a computer program.

This device is, for example, implanted in a microcomputer and is intended for securing a program stored in a memory, in particular in a memory contained in a smart card. According to the embodiment chosen, this device may be, for example, a microcomputer 500, comprising a storage area containing the computer program to be secured 501.

The microcomputer also comprises means for identifying, in a program to be secured, a jump instruction to a security action program 502.

The microcomputer also comprises means for determining the physical address of storage of the security action program 503 or the means for determining the physical address of the storage program 504 which are able to determine the physical address from the code of the jump instruction and / or code of the instruction following the jump instruction.

In addition, the device 500 comprises means 505 for allocating, to the addressing parameter contained in the jump instruction, the value of the physical address of the security action program determined by the determination means 503, 504.

Of course, the present invention is not limited to the embodiments described and shown.

Claims

1. A method of securing the execution of a program against fault attacks on jump instructions, in particular in a smart card, characterized in that it comprises at least one cycle comprising the following steps: identification in this program of a jump instruction responsive to such an attack during the execution of said program, to a security critical safety action program, the jump instruction being formed of an instruction code and a addressing parameter of the security action program, determination of the physical address of storage of the security action program, the physical address being determined from the code of the jump instruction and / or the code of the instruction following the jump instruction, assigning, to the addressing parameter contained in the jump instruction, the value of the physical address of the determined security action program.

2. Method of securing a program according to the claim

1, characterized in that the cycle further comprises, before the determining step, at least one step of duplicating said jump instruction to the safety action program forming a sequence of jump instructions.

3. Method of securing a program according to the claim

2, wherein the length of the jump instruction sequence is greater than or equal to the code length of the longest instruction of the instruction set.

A method of securing a program as claimed in any one of the preceding claims, wherein the method comprises an insertion step, before the security action program, of an instruction indicating said physical address of memorization of this previously determined security action program.

5. A method of securing a program according to any one of the preceding claims, wherein the cycle further comprises, before the determining step, a step of inserting at least one other jump instruction to the program. following the jump instruction identified, and after the determining step, the following steps:

determination for each of said other inserted jump instructions of a physical address of storage of the security action program, the physical address being determined from the code of the jump instruction and / or the code of the preceding instruction assigning to the parameter of each of said inserted jump instructions the value of the physical address of the determined security action program.

6. A method of securing a program according to claim 5, wherein the cycle comprises a step of inserting at least one instruction before the security action program indicating said physical addresses of memory of the security action program previously. determined for the jump instruction and each of the other jump instructions inserted.

7. The method of securing a program according to claim 5, wherein the cycle further comprises a step of inserting at least one instruction, before the security action program, indicating all the physical addresses. storing the safe action program, said addresses being determined by the set of possible combinations of the codes of the jump instruction and each of the jump instructions inserted.

The method of securing according to claim 5, wherein the cycle further comprises, after the determining step, a step of inserting at least one instruction after the identified jump instruction, said inserted instruction corresponding to a instruction without dangerous effect on the course of the said program.

9. Securing method according to claim 1, characterized in that the security action program is a distribution program to at least one elementary security action program.

10. Securing method according to any one of the preceding claims, characterized in that the safety action program includes instructions for premature termination of the program.

11. Securing method according to any one of claims 1 to 9, characterized in that the security action program includes instructions for resetting the execution of the program.

12. Device for securing the execution of a program against fault attacks on jump instructions, in particular in a smart card, characterized in that it comprises: identifying means (502) able to identify in this program a jump instruction responsive to such an attack during the execution of said program, to a safety critical security action program, the jump instruction being formed of an instruction code and a addressing parameter of the security action program, means for determining the physical address of storage of the security action program (503), the physical address being determined from the code of the jump instruction and / or the code of the instruction following the jump instruction, allocation means (505) capable of assigning, to the addressing parameter contained in the jump instruction, the value of the physical address of the determined security action program.

13. Device for securing a program according to claim 12, characterized in that it comprises duplicating means, able to duplicate said jump instruction to the security action program to form a sequence of jump instructions.

14. Device for securing a program according to claim 12 or claim 13, wherein the device comprises means for inserting, before the safety action program, an instruction indicating said physical address of storage of this program. determined by the means of determination.

15. Device for securing a program according to any one of claims 12 to 14, wherein the device comprises:

jump instruction insertion means adapted to insert at least one other jump instruction to the security action program according to the identified jump instruction,

determination means adapted to determine for each of said other inserted jump instructions a physical address for storing the security action program, the physical address being determined from the code of the jump instruction and / or the code from the previous statement,

means for assigning to the parameter of each of said inserted jump instructions the value of the physical address of the determined security action program.

16. Device for securing a program according to claim 15, wherein the device comprises means for inserting at least one instruction before the safety action program suitable for indicate said physical security program storage addresses determined by the determination means for the jump instruction and for each of the other jump instructions inserted.

17. Device for securing a program according to claim 15, wherein the device comprises means for inserting at least one instruction before the security action program capable of indicating all the physical memory addresses of the program. of safe action, said addresses being determined by the set of possible combinations of the codes of the jump instruction and each of the jump instructions inserted.

18. Securing device according to claim 15, wherein the device comprises means for inserting at least one instruction after the identified jump instruction, this inserted instruction corresponding to an instruction without dangerous effect on the progress of said program.

19. Securing device according to claim 12, characterized in that the security action program is a distribution program to at least one elementary security action program.

20. Computer program stored on an information medium, said program comprising instructions for implementing a security method according to any one of claims 1 to 11, when this program is loaded and executed by a user. computer system.