Example embodiments disclosed herein relate generally to a system and method for protecting against template attacks.

BACKGROUND

Side-channel attacks attempt to gain unauthorized access to information that is protected by encryption. Unlike other hacking methods, side-channel attacks attempt to obtain information gained from the implementation of a system, rather than weaknesses in the implemented algorithm. The information may include timing data, power consumption patterns, electromagnetic leaks, or other parameters that occur when a decryption key is used by an authorized entity. The information may be processed to derive a reproducible stimulus (e.g., a signal pattern, signature, waveform, etc.) that mimics a decryption key and which allows access to the protected information by a hacker.

One type of side-channel attack is known as a template attack. A template attack involves creating a profile of a sensitive device (e.g., smartphone, computer, memory, etc.) storing protected data. The profile is then applied to determine the secret key of a victim. Once known, the malicious attacker uses the key to access the protected information.

Some template attacks demonstrated by security experts in the past have targeted memory encryption using XOR-Encrypt-XOR (XEX) mode of operation. If consecutive data blocks to be encrypted and stored at the same address slightly differ from each other (e.g., a single byte difference), then an attacker may be able to successfully build a template, during the profiling phase of attack, by measuring power consumption or/and electromagnetic radiation of that operation. During the exploitation phase, the attacker may measure the response from the secret data that is supposed to be encrypted and recovers it using previously built templates.

The reason this attack succeeds is because a single round of a block cipher has a very limited diffusion and hence the power signature of individual data bytes might be observable during the first round. In the first round, data bytes are typically XOR-ed with a secret (but fixed) key and the result of that operation is fed into the S-box layer. Only after the S-box layer has been processed, the first diffusion operation is applied and after that it becomes difficult to observe any individual byte leakage. However, it is the XOR logic itself as well as the corresponding S-boxes that cause the power consumption to be correlated to the data input.

Several attempts have been made to counter template attacks. One attempt involves changing the encryption key before the attacker is able to collect a number of power traces sufficient to form the template. However, this method has proven inadequate because key management is a sensitive operation on its own and typically a single key is used to encrypt a large portion of memory. Changing the key would therefore require re-encrypting the entire memory with a new key, which is practically inefficient and would have a substantial adverse impact on overall system performance.

SUMMARY

In accordance with one or more embodiments, a method for protecting data includes encrypting information to generate a first tweak; combining a data block with the first tweak; encrypting the tweaked data block to form encrypted data; combining the encrypted data with the first tweak; and providing the combined encrypted data for storage in a memory address, where storing the combined encrypted data at the memory address generates a first stimulus different from a second stimulus generated by storing same encrypted data combined with a second tweak at the memory address, the first stimulus generated based on the first tweak and the second stimulus generated based on the second tweak. In one case, the information may include the memory address and a first tweak control value.

The method may include combining the memory address and the first tweak control value to generate a combined value, where encrypting the information may include encrypting the combined value based on at least one key to generate the first tweak. Combining the memory address and the first tweak control value may include concatenating the memory address and the first tweak control value. Combining the data block with the first tweak may be performed based on first logic and combining the encrypted data with the first tweak may be performed based on second logic. The first logic may be same as the second logic. Each of the first logic and the second logic may perform an XOR operation.

The first tweak may be based on a first tweak control value, the second tweak may be based on a second tweak control value, and the first and second tweak control values may include at least one of different counter values, random values, or hashed values. Each of the first stimulus and the second stimulus may include at least one of timing data, power consumption pattern, electromagnetic leak, signal pattern, signature, or waveform.

In accordance with one or more other embodiments, a method for protecting data includes performing a first process including encryption of a first data block; providing the encrypted first data block for storage at a memory address; performing a second process including encryption of a second data block; and providing the encrypted second data block for storage at the memory address, where the first process is based on a first tweak and the second process is based on a second tweak different from the first tweak and wherein the encrypted first data block and the encrypted second data block are provided for storage at the memory address at different times, the first data block and the second data block including same data.

Performing the first process may include (a) combining the first data block with the first tweak to form a first combined data block; (b) encrypting the first combined block to generate encrypted data; and (c) combining the encrypted data in (b) with the first tweak to generate the first encrypted data block, for storage at the memory address. Performing second first process may include (d) combining the second data block with the second tweak to form a second combined data block; (e) encrypting the second combined data block to generate encrypted data; and (f) combining the encrypted data in (e) with the second tweak to generate the second encrypted data block for storage at the memory address. Combining in (a), (c), (d), and (f) may be performed based on same logic.

The first tweak may be based on the memory address and a first tweak control value and the second tweak may be based on the memory address and a second tweak control value different from the first tweak control value. The method may include generating the first tweak by combining the memory address and the first tweak control value to form a first combined value and encrypting the first combined value; and generating the second tweak by combining the memory address and second tweak control value to form a second combined value and encrypting the second combined value.

In accordance with one or more other embodiments, a data storage manager includes a first cipher engine configured to encrypt information to generate a first tweak; a first combiner configured to combine a data block with the first tweak; a second cipher engine configured to encrypt the tweaked data block to form encrypted data; and a second combiner configured to combine the encrypted data with the first tweak to form combined encrypted data for storage in a memory address, where storing the combined encrypted data at the memory address is configured to generate a first stimulus different from a second stimulus generated by storing same encrypted data combined with a second tweak at the memory address, the first stimulus to be generated based on the first tweak and the second stimulus to be generated based on the second tweak. The information may include the memory address and a first tweak control value.

The data storage manager may include a third combiner configured to combine the memory address and the first tweak control value to generate a combined value, wherein the first cipher engine may encrypt the combined value based on at least one key to generate the first tweak. The first combiner may include first logic to combine the data block with the first tweak; and the second combiner may include second logic to combine the encrypted data with the first tweak. The first tweak may be based on a first tweak control value, the second tweak may be based on a second tweak control value, and the first and second tweak control values may include at least one of different counter values, random values, or hashed values.

