 |
Claims  |
|
|
We claim:
1. A system for processing and storing sensitive information, including
messages received and generated by the system and keys used to encrypt and
decrypt the messages, and securing the information against potential
attacks, the system comprising:
(a) a cryptographic engine for performing cryptographic operations on
messages using a first key;
(b) one or more detectors for detecting events characteristic of an attack;
(c) a plurality of potential responses to detected events; and
(d) a programmable filter for correlating detected events with one or more
operational factors and for selecting and invoking one or more responses
based upon the correlation.
2. A secure cryptographic chip for processing and storing sensitive
information, including messages received and generated by the chip and
keys used to encrypt and decrypt the messages, and for securing the
information against potential attacks, the chip comprising:
(a) a cryptographic engine for performing cryptographic operations on
messages using a first key;
(b) one or more detectors for detecting events characteristic of an attack;
and
(c) a plurality of potential responses to detected events,
whereby sensitive information is unencrypted only on the chip, where it is
secure from attack.
3. The secure cryptographic chip of claim 2, further comprising a key
generator for generating a second key used by the cryptographic engine to
perform cryptographic operations on the first key.
4. A method for processing and storing sensitive information, including
messages and keys used to encrypt and decrypt the messages, and for
securing the information against potential attacks, the method comprising
the following steps:
(a) performing cryptographic operations on messages using a first key;
(b) detecting one or more events characteristic of an attack; and
(c) responding to the detected events,
whereby sensitive information is unencrypted only on the chip, where it is
secure from attack.
5. The method of claim 4, further comprising the steps of:
(a) generating a second key on the chip; and
(b) using the second key to perform cryptographic operations on the first
key.
6. A secure chip for processing sensitive information and securing the
information against potential attacks, the chip comprising:
(a) an internal system clock for synchronizing functions performed on the
chip; and
(b) an external signal synchronizer for synchronizing to the internal
system clock all asynchronous external signals received by the chip,
whereby the chip cannot be placed in an unknown state due to the receipt of
asynchronous external signals.
7. The secure chip of claim 6 wherein the external signal synchronizer
synchronizes asynchronous external signals by accepting and using the
signals only at selected times determined by the internal system clock.
8. A secure chip for processing sensitive information and securing the
information against potential attacks, the chip comprising:
(a) an internal bus for transferring information among components of the
chip;
(b) an input/output port for transferring information between internal
components of the chip and external devices; and
(c) a bus monitor for periodically comparing the contents of the
input/output port before and after the transfer of information along the
internal bus,
whereby the chip can detect unauthorized rerouting, to the input/output
port, of sensitive information transferred along the internal bus.
9. The secure chip of claim 8 wherein the bus monitor compares the contents
of the input/output port before and after:
(a) a first transfer of less than all of the sensitive information desired
to be transferred along the internal bus; and
(b) a second transfer of the remaining sensitive information, if no change
in the contents of the input/output port is detected following the first
transfer,
whereby the chip can effectively prevent the unauthorized rerouting, to the
input/output port, of sensitive information transferred along the internal
bus.
10. A secure chip for processing sensitive information and securing the
information against potential attacks, the chip comprising:
(a) a real time clock controlled by an external clock crystal having a
substantially consistent external clock frequency;
(b) an internal system clock for synchronizing functions performed on the
chip, the internal system clock cycle frequency within a predetermined
range of accuracy; and
(c) a clock integrity check for
(i) causing the chip to perform a reference operation requiring a
predetermined number of internal clock cycles and a predetermined range of
expected external clock cycles based upon the range of accuracy of the
internal system clock; and
(ii) determining, from the number of internal clock cycles elapsed per
actual external clock cycle during the performance of the reference
operation, whether the number of elapsed actual external clock cycles lies
within the range of expected external clock cycles,
whereby the chip can detect unauthorized tampering with the external clock
frequency.
11. A secure chip for processing sensitive information and securing the
information against potential attacks, the chip comprising:
(a) a real time clock controlled by an external clock crystal having a
substantially consistent external clock frequency, the real time clock
having a counter for counting the number of elapsed external clock cycles;
(b) a rollover detector for detecting whether the real time clock counter
rolled over; and
(c) a rollover bit, set upon detecting that the real time clock counter
rolled over,
whereby, if the rollover bit is set during an operation not expected to
require a sufficient number of external clock cycles to cause the counter
to roll over, the chip will detect unauthorized tampering with the
external clock frequency.
12. A secure chip for processing sensitive information and securing the
information against potential attacks, the chip comprising:
(a) a rewritable memory for storing sensitive information;
(b) a power loss detector for detecting that the loss of both system and
battery power is imminent; and
(c) a VRT bit for indicating the sufficiency of system and battery power
following the loading of sensitive information into the rewritable memory,
the VRT bit set upon the loading of the sensitive information into the
rewritable memory and reset upon the detection of power loss,
whereby the chip can detect the need to save the sensitive information
prior to the actual loss of both system and batter power.
13. The secure chip of claim 12, further comprising a rewritable memory
modification detector for detecting modification of the rewritable memory,
whereby the chip can detect the need to reload the sensitive information
into the rewritable memory.
14. A secure chip for processing sensitive information and securing the
information against potential attacks, the chip comprising:
(a) a rewritable memory for storing sensitive information having a
substantially constant value;
(b) a memory inverter for periodically inverting the contents of each cell
of the rewritable memory; and
(c) a memory state bit for indicating whether the contents of each cell of
the rewritable memory are in their actual state, or in the inverted state,
whereby the contents of the rewritable memory contain effectively no
residual indication of the constant value of the sensitive information. |
|
 |
|
 |
Claims |
|
|
|
Description |
|
|
BACKGROUND
This invention relates generally to integrated circuits for electronic data
processing systems and more specifically to the architecture,
implementation and use of a secure integrated circuit which is capable of
effectively preventing inspection, extraction and/or modification of
confidential information stored therein.
There are many applications in which information has to be processed and
transmitted securely. For example, automated teller machines (ATMs)
require the secure storage and transmission of an identifying key (in this
context a password or PIN number) to prevent unauthorized intruders from
accessing a bank customer's account. Similarly, pay-per-view (PPV) cable
and satellite television systems must protect keys which both distinguish
authorized from unauthorized subscribers and decrypt encrypted broadcast
television signals.
Typically, one or more integrated circuits are used to process the
information electronically. These integrated circuits may themselves store
internal confidential information, such as keys and/or proprietary
algorithms for encrypting and decrypting that information, as well as
implement the encryption/decryption "engine." Clearly, there is a need for
integrated circuits which are capable of preventing an unauthorized person
from inspecting, extracting, and/or modifying the confidential information
processed by such integrated circuits. Further, it is sometimes desirable
to destroy certain confidential information (e.g., the keys) and preserve
other confidential information (e.g., historical data, such as accounting
information used in financial transactions) upon detection of intrusion.
One problem with existing security systems is that the confidential
information (keys, encryption/decryption algorithms, etc.) is, at some
point in the process, available to potential intruders in an unencrypted
("cleartext") form in a non-secure environment. What is needed is a single
secure integrated circuit in which the keys and encryption/decryption
engine and algorithms can be embodied and protected from intruders. Such
an integrated circuit would effectively ensure that the information being
processed (i.e., inputs to the chip) is not made available off-chip to
unauthorized persons except in encrypted form, and would "encapsulate" the
encryption/decryption process on the chip such that the keys and
algorithms are protected, particularly while in cleartext form, from a
variety of potential attacks.
Existing secure integrated circuits typically contain barriers, detectors,
and means for destroying the confidential information stored therein when
intrusion is detected. An example of a barrier is the deposition of one or
more conductive layers overlying memory cells inside an integrated
circuit. These layers prevent the inspection of the memory cells by
diagnostic tools such as a scanning electron microscope. An example of a
detector and destroying means is a photo detector connected to a switching
circuit which turns off power to memory cells inside a secure integrated
circuit upon detection of light. When power is turned off, the contents of
the memory cells, which may contain confidential information, will be
lost. The theory behind such a security mechanism is that the photo
detector will be exposed to light only when the enclosure of the
integrated circuit is broken, intentionally or by accident. In either
event, it is often prudent to destroy the confidential information stored
inside the integrated circuit.
One problem with existing security systems is the "hard-wired" nature of
the process of responding to potential intrusions. Such systems are
inherently inflexible because it is very difficult to change the behavior
of the security features once the integrated circuit has been fabricated.
The only way to alter the behavior of these security features is to
undertake the expensive and time-consuming task of designing and
fabricating a new integrated circuit.
Another consequence of a hard-wired architecture is that it is difficult to
produce custom security features for low volume applications. This is
because it takes a considerable amount of time and money to design, test,
and fabricate an integrated circuit. Consequently, it is difficult
economically to justify building small quantities of secure integrated
circuits, each customized for a special environment.
There are many situations in which it is desirable to use the same secure
integrated circuit, yet have the ability to modify the security features
in accordance with the requirements of the application and environment.
For example, if the secure integrated circuit is used to process extremely
sensitive information, it will be prudent to implement a conservative
security "policy"--e.g., destroying all the confidential data (e.g., keys)
inside the integrated circuit upon detection of even a small deviation
from a predetermined state. On the other hand, if the information is not
very sensitive, and it is not convenient to replace the secure integrated
circuit, the security policy could be more lenient--e.g., action could be
taken only when there is a large deviation from the predetermined state.
Thus, it is desirable to have a secure integrated circuit architecture in
which a broad range of flexible security policies can be implemented.
SUMMARY OF THE INVENTION
The present invention is embodied in a Secured Processing Unit (SPU) chip,
a microprocessor designed especially for secure data processing. By
integrating the keys and the encryption/decryption engine and algorithms
in the SPU, the entire security process is rendered portable and is easily
distributed across physical boundaries. For example, the SPU could be
incorporated into an ATM card (and in ATM machines throughout the world),
thereby implementing a worldwide distribution mechanism for secure
financial transactions.
Reflecting this Programmable Distributed Personal Security (PDPS) design
philosophy, the SPU provides a powerful security solution that is
flexible, affordable, portable and personal. This enabling technology
makes a high level of data security widely available and practical for a
variety of applications: network communications, electronic funds
transfer, wireless data exchange, systems for access, authorization and
identification, and consumption-based delivery systems for intellectual
property, e.g. copyrighted or trade secret material. The programmability
of the SPU's security policies permits these various applications to be
implemented without SPU hardware design changes, and yet accommodates the
operating environment by facilitating application-specific responses to
the range of security attacks or hardware/software failures that the SPU
is designed to detect.
The present invention is designed to provide protection from an army of
attacks, both electrical and physical through a battery of integrated
hardware and software security features. By facilitating the
implementation of a flexible response strategy appropriate to the
application, the SPU is rendered highly resilient to physical attacks on
the silicon and electrical attacks on the pins. The result is a system
that is extremely difficult to reverse engineer, and that implements a
flexible policy for protecting confidential information that cannot be
easily compromised.
The SPU is dedicated to "security processing"--protecting both secret
information and the processing based on that information. It securely
creates, stores and/or deploys secret keys or algorithms used in the
encryption and decryption of information. For example, although keys can
be loaded into the SPU at manufacture time, keys may also be created
onboard the SPU, including secret keys or private/public key pairs, as
master keys, for various applications, for particular sessions within such
applications, etc., the secure environment of the SPU being ideal for such
functionality. The chip can be programmed through firmware to perform
other functions as well, such as digital signaturing, verification,
information metering and the like. Critical information can be stored both
on-board the CPU or in encrypted form off-chip, in either case making the
SPU the only place where such information exists at any time in
unencrypted form.
By incorporating the SPU into a "smart card", using a platform such as a
PCMCIA card (a standard interface promulgated by the Personal Computer
Memory Card Interface Association), the combined system could function as
an access card, holding information decryption keys, transaction records,
credit and account information, one's own private keys, and digital
certificates. About the size of a standard credit card, such access cards
could perform a variety of applications and house diverse peripheral
components, yet be extremely rugged, portable and secure.
Access cards incorporating the present invention would provide a very high
level of data security for fixed or portable commercial applications, even
on unsecured networks. They would provide increased security for existing
applications and networks, and allow developers able to add security
features to new products, such as messaging, privacy-enhanced mail and
passwording. Entertainment, software and database content providers stand
to benefit greatly from the high degree of protection for their
intellectual property that such a system affords.
Such access cards could detect alteration of confidential information sent
across computer networks and ensure that such information is made
available only to its intended recipients, with complete privacy along the
way. This is accomplished by the following SPU-based features: positive
identification and reliable authentication of the card user, message
privacy through a robust encryption capability supporting the major
cryptographic standards, secure key exchange, secure storage of private
and secret keys, algorithms, certificates or, for example, transaction
records or biometric data, verifiability of data and messages as to their
alteration, and secure authorization capabilities, including digital
signatures.
The access card could be seen as a form of electronic wallet, holding
personal records, such as one's driver's license, passport, birth
certificate, vehicle registration, medical records, social security cards,
credit cards, biometric information such as finger- and voiceprints, or
even digital cash.
A personal access card contemplated for everyday use should be resilient to
the stresses and strains of such use, i.e. going through X-ray machines at
airports, the exposure to heat if left in a jacket placed on a radiator, a
mistyped personal identification number (PIN) by a flustered owner, etc.
Thus, in such an application, the SPU could be programmed with high
tolerances to such abuses. A photo detector triggered by X-rays might be
cued a few moments later to see if the exposure had stopped. Detection of
high temperature might need to be coupled to other symptoms of attack
before defensive action was taken. A PIN number entry could be forgiving
for the first two incorrect entries before temporary disabling subsequent
functions as is the case with many ATMs.
For an application like a Tessera Crypto-Card, a secure cryptographic token
for the new Defense Messaging System for sensitive government information,
the system might be programmed to be less forgiving. Handling procedures
for Tessera Card users may prevent the types of common, everyday abuses
present in a personal access card. Thus, erasure of sensitive information
might be an early priority.
Various encryption schemes have been proposed, such as where a user creates
and authenticates a secure digital signature, which is very difficult to
forge and thus equally difficult to repudiate. Because of a lack of
portable, personal security, however, electronic communications based on
these schemes have not gained widespread acceptance as a means of
conducting many standard business transactions. The present invention
provides the level of security which makes such electronic commerce
practical. Such a system could limit, both for new and existing
applications, the number of fraudulent or otherwise uncollectible
transactions.
Another possible application is desktop purchasing, a delivery system for
any type of information product that can be contained in electronic
memory, such as movies, software or databases. Thus, multimedia-based
advertisements, tutorials, demos, documentation and actual products can be
shipped to an end user on a single encrypted CD-ROM or broadcast though
suitable RF or cable channels. Virtually any content represented as
digital information could be sold off-line, i.e. at the desktop, with end
users possibly permitted to browse and try such products before buying.
The encryption capabilities of the SPU could be employed to decrypt the
information, measure and record usage time, and subsequently upload the
usage transactions to a centralized billing service bureau in encrypted
form, all with a high degree of security and dependability. The SPU would
decrypt only the appropriate information and transfer it to a suitable
storage medium, such as a hard disk, for immediate use.
Information metering, software rental and various other applications could
also be implemented with an SPU-based system, which could authenticate
users and monitor and account for their use and/or purchase of content,
while securing confidential information from unauthorized access through a
flexible security policy appropriate to the specific application.
This pay-as-you-go option is an incentive to information providers to
produce products, as it minimizes piracy by authenticating the user's
initial access to the system, securing the registration process and
controlling subsequent use, thereby giving end users immediate access to
the product without repeated authorization.
Other aspects and advantages of the present invention will become apparent
from the following description of the preferred embodiment, taken in
conjunction with the accompanying drawings and tables, which disclose, by
way of example, the principles of the invention.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a simplified block diagram of the apparatus in accordance with
the present invention, showing the Secured Processing Unit (SPU) for
performing PDPS.
FIG. 2 is a simplified block diagram of the Power Block shown in FIG. 1.
FIG. 3 is a schematic representation of the Silicon Firewall.
FIG. 4 is a schematic representation of an embodiment of the Silicon
Firewall shown in FIG. 3.
FIG. 5 is a schematic representation of an alternative embodiment of the
Silicon Firewall shown in FIG. 3.
FIG. 6 is a block diagram of the System Clock shown in FIG. 1.
FIG. 7 is a schematic representation of the Ring Oscillator shown in FIG.
6.
FIG. 8 is a block diagram of the Real Time Clock shown in FIG. 1.
FIG. 9 is a flowchart of the firmware process for performing the Inverting
Key Storage.
FIG. 10 is a schematic representation of the Inverting Key Storage.
FIG. 11 is a block diagram of an embodiment of the Metallization Layer
Detector shown in FIG. 1.
FIG. 12 is a schematic representation of an alternative embodiment of the
Metallization Layer Detector shown in FIG. 1.
FIG. 13 is a schematic representation of a second alternative embodiment of
the Metallization Layer Detector shown in FIG. 1.
FIG. 14(a) is a flowchart of the firmware process for performing the Clock
Integrity Check.
FIG. 14(b) is a flowchart of the firmware process for performing the Power
Integrity Check.
FIG. 15 is a flowchart of the firmware process for performing the Bus
Monitoring Prevention.
FIG. 16 is a flowchart of the firmware process for performing the Trip Wire
Input.
FIG. 17 is a flowchart of the firmware process for performing the Software
Attack Monitor.
FIG. 18 is a flowchart of the firmware process for performing the Detection
Handler.
FIG. 19 is a simplified representation of the stages of the Filtering
Process, including correlating the detectors and selecting the responses.
FIG. 20 is a flowchart of the firmware process for performing the filtering
of detectors and selection of responses in the context of a simple SPU
application; in this instance, using an SPU-equipped PCMCIA card as a
digital cash or debit card.
DETAILED DESCRIPTION
a. General Architecture.
A flexible architecture in accordance with the present invention permits
extension and customization for specific applications without a compromise
in security. One physical embodiment of this invention is a single-chip
SPU that includes a 20-MHz 32-Bit CPU, based on the National Semiconductor
NS32FV16 Advanced Imaging and Communications microprocessor, but lacking
that chip's Digital Signal Processing (DSP) unit.
Referring to FIG. 1, the gross features of the SPU architecture are
described. This description is not meant to be a literal description of
the SPU layout, as some features have been moved or regrouped in order to
gain a better conceptual understanding of the principles underlying the
present invention. The SPU's Micro Controller 3 is isolated from all
off-chip input--such input regulated by the External Bus Interface Block 9
and the general purpose I/O Port Block 1--instead receiving programmed
commands via an Internal Data Bus 10 from the on-board ROM Block 7. In one
embodiment, the ROM Block 7 is configured at 32 KBytes, and the
battery-backed RAM Block 8 is configured at 4 KBytes. The Internal System
Bus 10 carries all the major signals among the SPU peripherals, such as
the address and data lines, read and write strobes, enable and reset
signals, and the Micro Controller clock signal, CTTL 25.
The System Clock Block has a programmable internal high-frequency
oscillator, and is the source, through SYSCLK 35, for the Micro Controller
clock signal CTTL 25, which governs all peripheral functions.
The Real Time Clock 5 for the SPU follows the IEEE 1212 standard, which
specifies control and status register architecture, and which builds upon
and significantly enhances the UNIX time format (UNIX time being the
number of seconds elapsed since Jan. 1, 1970). The Real Time Clock 5 is
implemented through a binary ripple counter which is driven via RTCLK 29
by an off-chip external 32.768 KHz quartz crystal 14 in conjunction with
RTC Oscillator 14 circuitry. Through an offset in battery-backed RAM 8,
for example, the Real Time Clock 5 provides UNIX time, and can implement a
host of time-based functions and time limits under ROM Block 7 program
control. One firmware routine stored in the ROM Block 9 cross-checks the
System Clock 2 and Real Time Clock 5 so as to overcome tampering with the
latter.
The I/O Port Block 1 is a general-purpose programmable input/output
interface which can be used to access off-chip RAM, and meet general I/O
requirements. Off-chip RAM (not shown) would be typically used for
information that cannot be accommodated internally but, for security and
performance reasons, still needs to be closer to the SPU than main system
memory or disk storage. This information may be protected by modification
detection codes, and may or may not be encrypted, depending on application
requirements. In addition to serving as a memory interface, several
signals on this port can be used to implement cryptographic alarms of trip
wire inputs, or even to zero inputs or keys.
The External Bus Interface Block 9 is the communications port to the host
system. In one embodiment, it is the means for getting the application
commands as well as data to and from the SPU, and is designed to match the
ISA bus standard requirements.
The Power Block 13 switches between system and battery power depending on
system power availability. Power from an external battery (not shown) is
supplied to the RTC Block 5, the RAM Block 8 and a Status Register 11
through VPP 24, as well as off-chip RAM (not shown) through VOUT 23 when
system power is not available. The Power Block 13 also provides signals
PWRGD 27, DLY.sub.-- PWRGD 26 and CHIP.sub.-- PWRGD 28, which,
respectively, start the System Clock 2, reset the Bus Controller 4 and
enable the isolation of the battery-backed parts of the circuit from the
non-battery backed parts through the Power Isolation 12.
A Silicon Firewall 20 protects the internal circuitry from any external
asynchronous or otherwise anomalous signals, conditioning the inputs from
the I/O Port Block 1 via PIN lines 32 or the External Bus Interface 9 via
ADDR/DATA lines 33, the RF. SET 30 to the Bus Controller 4, as well as
from a host of security detectors. Some internally generated signals, such
as the output of the Real Time Clock 5, are similarly conditioned.
The Status Register 11 is the repository of all hardware detector signals
arrayed through the device to detect various attempted security breaches.
Detectors may include a Photo Detector 16, Temperature Detector 17,
Metallization Layer Detector 18 and any Additional Detectors 19
(represented in ghost), for example: high/low voltage detectors, vibration
detectors, sand detectors. Each of these detectors may convey one or more
bits of information which, in one embodiment, are stored in the Status
Register 11. The Status Register 11 may also store internally generated
signals, such as the ROLLOVER 34 signal from the Real Time Clock 5 and the
Valid RAM and Time (VRT) bit, used to verify the integrity of the
information stored in the RAM Block 8 and the time counter in the Real
Time Clock 5.
In one embodiment, a DES Engine 6 is provided as a cryptographic engine to
encrypt and decrypt data using its DES algorithm. Alternative embodiments
of cryptographic engines may be implemented entirely in hardware or in a
combination of hardware and software, and may use other cryptological
algorithms, including RSA or secret algorithms such as RC2, RC4, or
Skipjack or combinations thereof. The DES Engine 6 receives keys and data
for the cryptographic process from the RAM Block 8 under the control of
the Micro Controller 3. The data used could be application data supplied
from the External Bus Interface 9 or protected data from the RAM Block 8. | | |
