JP6950861B2 - Electronic information storage device, IC card, calculation decision method, and calculation decision program - Google Patents

Description

The present invention relates to a technique for a security device having a cryptographic calculation function.

Security devices such as IC cards are equipped with a cryptographic calculation function. The cryptographic calculation function is used for encryption of confidential information, authentication, signing, etc. At this time, an attack method for acquiring confidential information and encryption key by measuring the power consumption during cryptographic calculation has been confirmed. ing. For example, in the differential power analysis (DPA) method, the current consumption, electromagnetic radiation, execution time, etc. corresponding to a known input or output value are measured many times, and the secret key information is obtained by performing statistical analysis. presume. If more current consumption during cryptographic calculation is measured, the success rate of fraudulent cryptographic analysis becomes high.

As a countermeasure against such an attack method, a true cryptographic operation using a true key (regular operation) and a dummy operation using a so-called dummy key (a key disguised as a true key) are performed in a random order. It is known to reduce the correlation between the side channel leak and the private key by executing with. Further, in Patent Document 1, a plurality of dummy keys having the same humming weight as the private key are generated, and cryptographic processing is performed using the private key and the plurality of dummy keys to perform cryptographic calculation and dummy calculation. A technique is disclosed in which cryptographic processing can be performed so that side channel leaks show similar waveforms between them.

Japanese Unexamined Patent Publication No. 2013-1260678

However, since the cryptographic operation occupies a large proportion of the execution time of the entire process, if the dummy operation is executed once for each cryptographic operation, the convenience is impaired due to the decrease in the execution speed. In the conventional technique as described above, since the necessity of the dummy operation is not determined for each cryptographic operation, the dummy operation is executed even when the necessity of the dummy operation is low, and the execution speed is reduced. There's a problem.

The present invention has been made in view of such problems and the like, and is an electronic information storage device and an IC capable of suppressing a decrease in execution speed in a process involving a cryptographic operation while preventing an illegal cryptographic analysis. It is an object of the present invention to provide a card, an arithmetic determination method, and an arithmetic determination program.

In order to solve the above problem, the invention according to claim 1 is an electronic information storage device that performs processing according to a command received from an external device and transmits a response indicating the result of the processing to the external device. When a cryptographic operation is executed during processing according to the command, the command type specified by the command code included in the command or included in the command is included as an execution condition of the spoofing operation corresponding to the cryptographic operation. A determination to determine one of the execution of the cryptographic operation with the spoofing operation and the execution of the cryptographic operation without the spoofing operation based on the type of the cryptographic operation specified by the command parameter. It is characterized by providing means.

Invention according to claim 2, the electronic information storage device according to claim 1, wherein the determining means, when the cryptographic computation is not limited to the number of retries is performed, the cryptographic operation with the impersonation operation It is characterized by deciding the execution.

The invention according to claim 3, in electronic information storage device according to claim 1, wherein the determining means, when the cryptographic operation which is implemented in software is executed, execution of the cryptographic operations involving the impersonation operation Is characterized by determining.

The invention according to claim 4 is an electronic information storage device that performs processing according to a command received from an external device and transmits a response indicating the result of the processing to the external device, and the processing according to the command. when performing cryptographic operations during the conditions for executing impersonation operation corresponding to the encryption computation, on the basis of the execution history of the cryptographic computation, the execution of the cryptographic operations involving the impersonation operation, involving the impersonation operation It is characterized by comprising a determination means for determining any one of the execution of the above-mentioned cryptographic operation.

The invention according to claim 5 is the electronic information storage device according to claim 4 , wherein when the number of executions of the cryptographic operation is equal to or greater than a threshold value, the determination means executes the cryptographic operation accompanied by the camouflage operation. It is characterized by determining.

The invention according to claim 6 is the electronic information storage device according to any one of claims 1 to 5 , wherein the camouflage operation is the same cryptographic algorithm as the cryptographic operation and is used in the cryptographic operation. It is characterized in that a key having the same humming weight as the key to be used is used.

The invention according to claim 7 is an IC card that performs processing according to a command received from an external device and transmits a response indicating the result of the processing to the external device during the processing according to the command. When executing a cryptographic operation, the cryptographic operation specified by the type of command specified by the command code included in the command or the command parameter included in the command is used as an execution condition of the camouflage operation corresponding to the cryptographic operation. It is characterized in that it includes a determination means for determining one of the execution of the cryptographic operation accompanied by the spoofing operation and the execution of the cryptographic operation not accompanied by the camouflage operation based on the type of.

The invention according to claim 8 is an arithmetic determination method executed by a processor included in an electronic information storage device that performs processing according to a command received from an external device and transmits a response indicating the result of the processing to the external device. When a cryptographic operation is executed during processing according to the command, the type of command specified by the command code included in the command or the command is used as an execution condition of the spoofing operation corresponding to the cryptographic operation. Based on the type of the cryptographic operation specified by the command parameter included in, one of the execution of the cryptographic operation with the spoofing operation and the execution of the cryptographic operation without the spoofing operation is determined. It is characterized by doing.

The invention according to claim 9 responds to the command by a processor included in an electronic information storage device that performs processing according to a command received from the external device and transmits a response indicating the result of the processing to the external device. When executing a cryptographic operation during processing, the execution condition of the spoofing operation corresponding to the cryptographic operation is specified by the command type specified by the command code included in the command or the command parameter included in the command. Based on the type of the cryptographic operation, it is characterized in that it functions to determine one of the execution of the cryptographic operation with the spoofing operation and the execution of the cryptographic operation without the spoofing operation. do. The invention according to claim 10 is an IC card that performs processing according to a command received from an external device and transmits a response indicating the result of the processing to the external device during the processing according to the command. When executing the cryptographic operation, as the execution condition of the spoofing operation corresponding to the cryptographic operation, the execution of the cryptographic operation accompanied by the spoofing operation and the execution of the cryptographic operation not accompanied by the spoofing operation are based on the execution history of the cryptographic operation. It is characterized by comprising a determination means for determining any one of execution of a cryptographic operation. The invention according to claim 11 is an arithmetic determination method executed by a processor included in an electronic information storage device that performs processing according to a command received from an external device and transmits a response indicating the result of the processing to the external device. When a cryptographic operation is executed during processing according to the command, the cryptography accompanied by the spoofing operation is based on the execution history of the cryptographic operation as an execution condition of the camouflage operation corresponding to the cryptographic operation. It is characterized in that one of the execution of the operation and the execution of the cryptographic operation without the camouflage operation is determined. The invention according to claim 12 responds to the command by a processor included in an electronic information storage device that performs processing according to a command received from the external device and transmits a response indicating the result of the processing to the external device. When executing a cryptographic operation during processing, as an execution condition of the camouflage operation corresponding to the cryptographic operation, the execution of the cryptographic operation accompanied by the spoofing operation and the camouflage operation are performed based on the execution history of the cryptographic operation. It is characterized in that it functions to determine any one of the execution of the cryptographic operation that is not accompanied.

According to the present invention, it is possible to prevent a decrease in execution speed in a process involving a cryptographic operation while preventing an illegal cryptanalysis.

It is a figure which shows the outline structure example of IC card 1. It is a figure which shows an example of the necessity of the dummy operation for each command. It is a flowchart which shows an example of the processing of CPU 10 in Example 1. FIG. It is a figure which shows an example of the necessity of the dummy operation for each option value included in a command. It is a flowchart which shows an example of the processing of CPU 10 in Example 2. FIG. It is a figure which shows an example of the necessity of the dummy operation for each encryption algorithm. It is a flowchart which shows an example of the processing of CPU 10 in Example 3. FIG. It is a figure which shows an example of the necessity of the dummy operation for each range of the number of executions. It is a flowchart which shows an example of the processing of CPU 10 in Example 4. FIG.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

First, the outline configuration and functions of the IC card 1 will be described with reference to FIG. FIG. 1 is a diagram showing a schematic configuration example of the IC card 1. As shown in FIG. 1, the IC chip 1a mounted on the IC card 1 includes a CPU (Central Processing Unit) 10, a ROM (Read Only Memory) 11, a RAM (Random Access Memory) 12, a non-volatile memory 13, and I / It is configured to include an O circuit 14, a cryptographic calculation unit 15, and the like. The IC chip 1a is an example of the electronic information storage device of the present invention.

The IC card 1 is used as a cash card, a credit card, an employee card, and the like. Alternatively, the IC card 1 may be incorporated in a terminal device such as a smartphone or a mobile phone. Alternatively, the IC chip 1a may be mounted integrally with the terminal device, for example, as an eUICC (Embedded Universal Integrated Circuit Card) so that it cannot be easily removed or replaced from the terminal device.

The CPU 10 is a processor (computer) that executes various programs stored in the ROM 11 or the non-volatile memory 13. The RAM 12 is used as a working memory. For example, a flash memory is applied to the non-volatile memory 13. Various programs and data are stored in the non-volatile memory 13. Various programs include an operating system, an application program, an arithmetic determination program of the present invention, and the like. The CPU 10 functions as a determination means of the present invention according to the arithmetic determination program of the present invention. A part of various programs and data stored in the non-volatile memory 13 may be stored in the ROM 11. The non-volatile memory 13 may be an "Electrically Erasable Programmable Read-Only Memory".

The data stored in the non-volatile memory 13 is, for example, a plurality of files having a hierarchical structure composed of MF (Master File), DF (Dedicated File), EF (Elementary File), etc. defined by ISO7816. Stored in. The MF is located at the highest level in the file structure, and the DF and EF are located in the lower hierarchy of the MF. The DF is provided for each application program, for example. The EF is, for example, a record file that stores a plurality of data used in an application program stored in the DF. The EF is divided into an IEF (internal basic file) and a WEF (working basic file). For example, an encryption key is stored in the IEF.

The I / O circuit 14 serves as an interface with the external device 2. In the case of the contact type IC chip 1a, the I / O circuit 14 is provided with, for example, eight terminals C1 to C8 defined by ISO7816. For example, the C1 terminal is a power supply terminal, the C2 terminal is a reset terminal, the C3 terminal is a clock terminal, the C5 terminal is a ground terminal, and the C7 terminal is a terminal for communicating with the external device 2. On the other hand, in the case of the non-contact type IC chip 1a, the I / O circuit 14 is provided with, for example, an antenna and a modulation / demodulation circuit. Examples of the external device 2 include an IC card issuing machine, an ATM, a ticket gate, an authentication gate, and the like. Alternatively, when the IC chip 1a is incorporated in the terminal device, the external device 2 corresponds to a control unit that has a function of the terminal device.

The cryptographic calculation unit 15 executes a cryptographic calculation using a key (hereinafter, referred to as “encryption key”) held in a key register (not shown) and a predetermined cryptographic algorithm in response to a calculation command from the CPU 10. Further, the cryptographic calculation unit 15 executes a dummy calculation using the dummy key held in the dummy key register (not shown) and the above-mentioned cryptographic algorithm in response to the calculation command from the CPU 10. Here, the dummy key is, for example, a key having the same byte length and the same humming weight as the encryption key used in the encryption operation. Further, the dummy operation is, for example, a camouflage operation corresponding to a cryptographic operation, and adopts the same cryptographic algorithm as the cryptographic operation. The dummy operation is inserted immediately before the cryptographic operation, immediately after the cryptographic operation, or in the middle of the cryptographic operation, but in the present embodiment, the dummy operation is inserted only in the processing for which the dummy operation is highly necessary (for example, the cryptographic analysis By inserting only the processes that need to be prevented), it is possible to prevent an illegal cryptanalysis by power analysis or the like, and suppress a decrease in execution speed in a process involving a cryptographic operation and a dummy operation.

Further, as the types of cryptographic algorithms used for cryptographic operations and dummy operations (in other words, the types of cryptographic operations), RSA (Rivest Shamir Adleman), AES (Advanced Encryption Standard), DES (Data Encryption Standard), 3DES, etc. Can be mentioned. These a plurality of cryptographic algorithms are implemented in the cryptographic calculation unit 15. For example, RSA, DES, and 3DES are implemented in hardware (consisting of electronic circuits), and AES is implemented in software (consisting of program code). The cryptographic calculation unit 15 may be equipped with a cryptographic algorithm of any one of the plurality of cryptographic programs.

When the CPU 10 receives a command from the external device 2 via the I / O circuit 14, it performs a process according to the command and sends a response indicating the result of the process to the external device 2 via the I / O circuit 14. Send. Here, the command is composed of, for example, an APDU (Application Protocol Data Unit) defined in ISO7816-3. The APDU is composed of at least CLA, INS, P1 and P2. Here, CLA indicates a command class (instruction class), and INS indicates a command code (instruction code). The type of command is specified by INS. Examples of command types include "READ BINARY", "WRITE BINARY", "UPDATE BINARY", "SELECT FILE", "VERIFY", "EXTERNAL AUTHENTICATE", "INTERNAL AUTHENTICATE", and "COMPUTE DIGITAL SIGNATURE". Further, P1 and P2 indicate command parameters (instruction parameters). P1 and P2 are command options, and for example, P1 can specify, for example, the type of encryption key (that is, the type of encryption operation). The APDU may include at least one of Le, Lc, and Data in addition to CLA, INS, P1 and P2. Here, Le indicates the maximum length (maximum size) of the response, Lc indicates the length of Data, and Data indicates the variable length data used in the IC card 1.

In the present embodiment, when a cryptographic operation is performed during processing according to a received command, the CPU 10 performs the cryptographic operation when executing the cryptographic operation (for example, immediately before or after executing the cryptographic operation). Based on the execution condition of the dummy operation corresponding to the cryptographic operation, one of the execution of the cryptographic operation with the dummy operation and the execution of the cryptographic operation without the dummy operation is determined. In other words, it is determined whether or not to insert the dummy operation during the process. Here, the execution conditions of the dummy operation are defined in advance on, for example, the operation determination program. Examples of dummy operation execution conditions include command type, cryptographic operation type (that is, the type of cryptographic algorithm used for the cryptographic operation), or cryptographic operation execution history (including the number of times the cryptographic operation is executed). Can be mentioned. The execution history of the cryptographic operation is stored in the non-volatile memory 13.

For example, the CPU 10 determines one of the execution of the cryptographic operation with the dummy operation and the execution of the cryptographic operation without the dummy operation based on the type of the command indicated by the INS included in the above command. Further, for example, the CPU 10 executes a cryptographic operation with a dummy operation and a cryptographic operation without a dummy operation based on the type of the encryption key indicated by P1 included in the above command (in other words, the type of the encryption operation). Determine one of the executions. The type of cryptographic operation executed during the processing according to the command may be preset in the IC chip 1a. In this case, the CPU 10 determines one of the execution of the cryptographic operation with the dummy operation and the execution of the cryptographic operation without the dummy operation based on the preset type of the cryptographic operation. Further, the type of the encryption operation may be specified by the length (key length) of the encryption key used in the encryption operation. That is, in this case, the CPU 10 determines one of the execution of the encryption operation with the dummy operation and the execution of the encryption operation without the dummy operation based on the length of the encryption key used in the encryption operation. Will be done.

Then, the CPU 10 outputs an operation command for executing a cryptographic operation (that is, a cryptographic operation with a dummy operation or a cryptographic operation without a dummy operation) to the cryptographic calculation unit 15 according to the above determination, and outputs the calculation command to the calculation command. Correspondingly, the result calculated by the cryptographic calculation unit 15 is acquired from the cryptographic calculation unit 15. When the cryptographic operation implemented by the software is executed, the CPU 10 may execute the cryptographic operation with the dummy operation or the cryptographic operation without the dummy operation according to the cryptographic operation program.

Next, the operation of the IC card 1 will be described separately in Examples 1 to 4.

(Example 1)
First, the operation of the IC card 1 in the first embodiment will be described with reference to FIGS. 2 and 3. The first embodiment is an example of determining whether or not to insert a dummy operation based on the type of the command. FIG. 2 is a diagram showing an example of the necessity of dummy operation for each command. FIG. 3 is a flowchart showing an example of the processing of the CPU 10 in the first embodiment.

According to the example of FIG. 2, the commands for which cryptographic operations are used are "WRITE BINARY" (with secure message), "EXTERNAL AUTHENTICATE", and "INTERNAL AUTHENTICATE". Here, in the processing according to "EXTERNAL AUTHENTICATE", since there is a limit on the number of times by the retry counter (that is, there is a limit on the number of retries), it is difficult for an attacker to repeatedly attack, and for fraudulent cryptanalysis. It is difficult to obtain a large number of samples. Therefore, there is no need for a dummy operation during processing according to "EXTERNAL AUTHENTICATE". In addition, in the process according to "WRITE BINARY" (with secure message), it is difficult for an attacker to repeatedly attack because the session key is changed by the sequence counter, and a large number of samples for malicious cryptanalysis are prepared. It's hard to get. Therefore, there is no need for dummy operation during processing according to "WRITE BINARY" (with secure message). On the other hand, in the process according to "INTERNAL AUTHENTICATE", since there is no limit to the number of retries, an attacker can repeatedly attack and obtain a large number of samples for fraudulent cryptanalysis. Therefore, it is necessary to perform a dummy operation during the processing according to "INTERNAL AUTHENTICATE". From the above, it is possible to suppress the influence on the performance on the processing that does not require (less necessary) countermeasures against attacks. The process shown in FIG. 3 is a process based on such a viewpoint.

The process shown in FIG. 3 is started when a command from the external device 2 is received. The CPU 10 starts processing according to the received command (step S1). Next, the CPU 10 determines whether or not there is a cryptographic operation in the process according to the received command (step S2). When the CPU 10 determines that there is a cryptographic operation (step S2: YES), the CPU 10 proceeds to step 3. On the other hand, when the CPU 10 determines that there is no encryption operation (step S2: NO), the CPU 10 proceeds to step S8.

In step S3, the CPU 10 determines whether or not the received command is "INTERNAL AUTHENTICATE" (for example, it is determined by the INS included in the command). When the CPU 10 determines that the command is "INTERNAL AUTHENTICATE" (step S3: YES), the CPU 10 determines to execute a cryptographic operation accompanied by a dummy operation (step S4). That is, when the cryptographic operation with no limit on the number of retries is executed, the CPU 10 determines the execution of the cryptographic operation accompanied by the dummy operation. Next, the CPU 10 outputs an operation command for executing a cryptographic operation accompanied by a dummy operation to the cryptographic calculation unit 15, and acquires the result of calculation by the cryptographic calculation unit 15 in response to the calculation command from the cryptographic calculation unit 15 (step). S5), the process proceeds to step S8.

On the other hand, when the CPU 10 determines that the command is not "INTERNAL AUTHENTICATE" (step S3: NO), the CPU 10 determines to execute the cryptographic operation without the dummy operation (step S6). Next, the CPU 10 outputs an operation command for executing a cryptographic operation without a dummy operation to the cryptographic calculation unit 15, and acquires the result of calculation by the cryptographic calculation unit 15 in response to the calculation command from the cryptographic calculation unit 15 ( Step S7), the process proceeds to step S8.

In step S8, the CPU 10 performs the remaining processing and transmits a response indicating the result of the processing according to the command to the external device 2 via the I / O circuit 14.

As described above, according to the first embodiment, the CPU 10 determines one of the execution of the cryptographic operation with the dummy operation and the execution of the cryptographic operation without the dummy operation based on the type of the command. Therefore, it is possible to prevent a decrease in execution speed in a process involving a cryptographic operation while preventing an illegal cryptographic analysis.

(Example 2)
Next, the operation of the IC card 1 in the second embodiment will be described with reference to FIGS. 4 and 5. The second embodiment is an example of determining whether or not to insert a dummy operation based on the type of encryption key (in other words, the type of encryption operation) indicated by the option (P1) included in the command, and is an example of determining whether or not to insert a dummy operation. Assume the command "COMPUTE CIPHER". With this encryption operation command, the IEF (encryption key stored) to be used can be switched using the value of P1. In the second embodiment, unlike the first embodiment, whether or not to insert a dummy operation is determined according to an option (including a secure message) even with the same command. FIG. 4 is a diagram showing an example of the necessity of dummy operation for each option value included in the command. FIG. 5 is a flowchart showing an example of the processing of the CPU 10 in the second embodiment.

According to the example of FIG. 4, in the case of P1 = 0x00 and P1 = 0x02, it is difficult for an attacker to repeatedly attack because there is a limit on the number of times by the retry counter (that is, there is a limit on the number of retries). It is difficult to obtain a large number of samples for fraudulent cryptanalysis. Therefore, when P1 = 0x00 and P1 = 0x02, there is no need for a dummy operation during the processing according to "COMPUTE CIPHER". On the other hand, in the case of P1 = 0x01, since there is no limit to the number of retries, an attacker can repeatedly attack and obtain a large number of samples for fraudulent cryptanalysis. Therefore, when P1 = 0x01, it is necessary to perform a dummy operation during the processing according to "COMPUTE CIPHER". The process shown in FIG. 5 is a process based on such a viewpoint.

The process shown in FIG. 5 is started when a command from the external device 2 is received. The CPU 10 starts processing according to the received command (step S11). Next, the CPU 10 determines whether or not the received command is "COMPUTE CIPHER" (step S12). When the CPU 10 determines that the command is "COMPUTE CIPHER" (step S12: YES), the CPU 10 proceeds to step S13. On the other hand, when the CPU 10 determines that the command is not "COMPUTE CIPHER" (step S12: NO), the CPU 10 proceeds to step S18.

In step S13, the CPU 10 determines whether or not the option (P1) included in the received command is “0x01”. When the CPU 10 determines that the option (P1) is "0x01" (step S13: YES), the CPU 10 determines to execute the cryptographic operation accompanied by the dummy operation (step S14). That is, when the cryptographic operation with no limit on the number of retries is executed, the CPU 10 determines the execution of the cryptographic operation accompanied by the dummy operation. Next, the CPU 10 outputs an operation command for executing a cryptographic operation accompanied by a dummy operation to the cryptographic calculation unit 15, and acquires the result of calculation by the cryptographic calculation unit 15 in response to the calculation command from the cryptographic calculation unit 15 (step). S15), the process proceeds to step S18.

On the other hand, when the CPU 10 determines that the option (P1) is not "0x01" (step S13: NO), the CPU 10 determines to execute the cryptographic operation without the dummy operation (step S16). Next, the CPU 10 outputs an operation command for executing a cryptographic operation without a dummy operation to the cryptographic calculation unit 15, and acquires the result of calculation by the cryptographic calculation unit 15 in response to the calculation command from the cryptographic calculation unit 15 ( Step S17), the process proceeds to step S18.

In step S18, the CPU 10 performs the remaining processing and transmits a response indicating the result of the processing according to the command to the external device 2 via the I / O circuit 14.

As described above, according to the second embodiment, the CPU 10 includes the execution of the cryptographic operation with the dummy operation and the execution of the cryptographic operation without the dummy operation based on the type of the cryptographic operation (option in the command). Since it is configured to determine any one of them, it is possible to prevent a decrease in execution speed in a process involving a cryptographic operation while preventing an illegal cryptographic analysis.

(Example 3)
Next, the operation of the IC card 1 in the third embodiment will be described with reference to FIGS. 6 and 7. The third embodiment is an example of determining whether or not to insert a dummy operation based on the implementation form of the cryptographic algorithm (cryptographic calculation) (the implementation form depends on the type of the cryptographic algorithm), and the IC card 1 has RSA. , AES, DES, and 3DES are implemented. In the third embodiment, whether or not to insert a dummy operation is determined according to the encryption algorithm regardless of the command. FIG. 6 is a diagram showing an example of the necessity of dummy calculation for each encryption algorithm. FIG. 7 is a flowchart showing an example of the processing of the CPU 10 in the third embodiment.

According to the example of FIG. 6, RSA, DES, and 3DES are each implemented by hardware and side channel countermeasures are taken, so that dummy calculation is not required during processing according to the command. On the other hand, AES is implemented by software and side channel countermeasures are implemented, but it is known that it is vulnerable compared to the hardware one, so dummy calculation is required during processing according to the command. There is. The process shown in FIG. 7 is a process based on such a viewpoint.

The process shown in FIG. 7 is started when a command from the external device 2 is received. The CPU 10 starts processing according to the received command (step S21). Next, the CPU 10 determines whether or not there is a cryptographic operation in the process according to the received command (step S22). When the CPU 10 determines that there is a cryptographic operation (step S22: YES), the CPU 10 proceeds to step 23. On the other hand, when the CPU 10 determines that there is no encryption operation (step S22: NO), the CPU 10 proceeds to step S28.

In step S23, the CPU 10 determines whether or not the cryptographic algorithm used for the cryptographic operation is AES. The type of cryptographic algorithm (type of cryptographic operation) is preset in the IC chip 1a for each command (or for each issuer), for example. When the CPU 10 determines that the encryption algorithm is AES (step S23: YES), the CPU 10 determines to execute the encryption operation accompanied by the dummy operation (step S24). That is, when the cryptographic operation implemented by the software is executed, the CPU 10 determines the execution of the cryptographic operation accompanied by the dummy operation. Next, the CPU 10 outputs an operation command for executing a cryptographic operation accompanied by a dummy operation to the cryptographic calculation unit 15, and acquires the result of calculation by the cryptographic calculation unit 15 in response to the calculation command from the cryptographic calculation unit 15 (step). S25), the process proceeds to step S28.

On the other hand, when the CPU 10 determines that the encryption algorithm is not AES (step S23: NO), the CPU 10 determines to execute the encryption operation without the dummy operation (step S26). Next, the CPU 10 outputs an operation command for executing a cryptographic operation without a dummy operation to the cryptographic calculation unit 15, and acquires the result of calculation by the cryptographic calculation unit 15 in response to the calculation command from the cryptographic calculation unit 15 ( Step S27), the process proceeds to step S28.

In step S28, the CPU 10 performs the remaining processing and transmits a response indicating the result of the processing according to the command to the external device 2 via the I / O circuit 14.

As described above, according to the third embodiment, the CPU 10 either executes a cryptographic operation with a dummy operation or executes a cryptographic operation without a dummy operation based on the type (implementation form) of the cryptographic operation. Since it is configured to determine one, it is possible to prevent a decrease in execution speed in a process involving a cryptographic operation while preventing an illegal cryptographic analysis.

(Example 4)
Next, the operation of the IC card 1 in the fourth embodiment will be described with reference to FIGS. 8 and 9. The fourth embodiment is an example of determining whether or not to insert a dummy operation based on the execution history of the cryptographic operation, and it is assumed that the number of executions is incremented and stored each time the cryptographic operation is executed. FIG. 8 is a diagram showing an example of the necessity of dummy calculation for each range of the number of executions. FIG. 9 is a flowchart showing an example of the processing of the CPU 10 in the fourth embodiment.

According to the example of FIG. 8, when the number of times of execution of the cryptographic operation is less than 10,000, it is difficult to obtain a sufficient sample for illegal cryptanalysis, so that the dummy operation is not necessary during the processing according to the command. On the other hand, when the number of executions of the cryptographic operation is 10,000 or more, it is possible to obtain a sufficient sample for illegal cryptanalysis, so that a dummy operation is required during the processing according to the command. The process shown in FIG. 9 is a process based on such a viewpoint.

The process shown in FIG. 9 is started when a command from the external device 2 is received. The CPU 10 starts processing according to the received command (step S31). Next, the CPU 10 determines whether or not there is a cryptographic operation in the process according to the received command (step S32). When the CPU 10 determines that there is a cryptographic operation (step S32: YES), the CPU 10 proceeds to step 33. On the other hand, when the CPU 10 determines that there is no encryption calculation (step S32: NO), the CPU 10 proceeds to step S38.

In step S33, the CPU 10 determines whether or not the number of executions of the cryptographic operation is equal to or greater than the threshold value (for example, 10000). When the CPU 10 determines that the number of executions of the cryptographic operation is equal to or greater than the threshold value (step S33: YES), the CPU 10 determines the execution of the cryptographic operation accompanied by the dummy operation (step S34). Next, the CPU 10 outputs an operation command for executing a cryptographic operation accompanied by a dummy operation to the cryptographic calculation unit 15, and acquires the result of calculation by the cryptographic calculation unit 15 in response to the calculation command from the cryptographic calculation unit 15 (step). S35), the process proceeds to step S38.

On the other hand, when the CPU 10 determines that the number of executions of the cryptographic operation is not equal to or greater than the threshold value (step S33: NO), the CPU 10 determines the execution of the cryptographic operation without the dummy operation (step S36). Next, the CPU 10 outputs an operation command for executing a cryptographic operation without a dummy operation to the cryptographic calculation unit 15, and acquires the result of calculation by the cryptographic calculation unit 15 in response to the calculation command from the cryptographic calculation unit 15 ( Step S37), the process proceeds to step S38.

In step S38, the CPU 10 performs the remaining processing and transmits a response indicating the result of the processing according to the command to the external device 2 via the I / O circuit 14.

As described above, according to the fourth embodiment, the CPU 10 performs one of the execution of the cryptographic operation with the dummy operation and the execution of the cryptographic operation without the dummy operation based on the execution history of the cryptographic operation. Since it is configured to determine, it is possible to prevent a decrease in execution speed in a process involving a cryptographic operation while preventing an illegal cryptographic analysis.

As described above, according to the above embodiment, when the IC card 1 executes the encryption operation during the processing corresponding to the received command, the cipher accompanied by the dummy operation is based on the execution condition of the dummy operation. Since it is configured to determine one of the execution of the operation and the execution of the cryptographic operation without the dummy operation, the execution speed is reduced in the processing involving the cryptographic operation while preventing illegal cryptographic analysis. It can be suppressed. Further, according to the above embodiment, since the number of times of executing the inserted dummy operation can be increased or decreased, it is possible to adjust the balance between the required security and convenience.

1 IC card 1a IC chip 10 CPU
11 ROM
12 RAM
13 Non-volatile memory 14 I / O circuit 15 Cryptographic calculation unit

Claims (12)

An electronic information storage device that performs processing according to a command received from an external device and sends a response indicating the result of the processing to the external device.
When executing a cryptographic operation during processing according to the command, the type of command specified by the command code included in the command or the command included in the command is used as an execution condition of the spoofing operation corresponding to the cryptographic operation. A determination means for determining one of the execution of the cryptographic operation with the spoofing operation and the execution of the cryptographic operation without the spoofing operation based on the type of the cryptographic operation specified by the parameter. An electronic information storage device characterized by being provided. The electronic information storage device according to claim 1 , wherein the determining means determines the execution of the cryptographic operation accompanied by the camouflage operation when the cryptographic operation is executed with no limit on the number of retries. The electronic information storage device according to claim 1 , wherein the determination means determines execution of the cryptographic operation accompanied by the camouflage operation when the cryptographic operation implemented by software is executed. An electronic information storage device that performs processing according to a command received from an external device and sends a response indicating the result of the processing to the external device.
When performing cryptographic operations in a process corresponding to the command, as an execution condition for impersonation operation corresponding to the encryption computation, on the basis of the execution history of the cryptographic computation, the execution of the cryptographic operations involving the impersonation operation An electronic information storage device comprising a determination means for determining any one of the execution of the cryptographic operation without the camouflage operation. The electronic information storage device according to claim 4 , wherein the determination means determines execution of the cryptographic operation accompanied by the camouflage operation when the number of executions of the cryptographic operation is equal to or greater than a threshold value. The impersonation operations, the a cryptographic operation and same encryption algorithm, and to any one of claims 1 to 5, characterized by using a key having the same hamming weight and key used in the cryptographic computation The electronic information storage device described. An IC card that performs processing according to a command received from an external device and sends a response indicating the result of the processing to the external device.
When executing a cryptographic operation during processing according to the command, the type of command specified by the command code included in the command or the command included in the command is used as an execution condition of the spoofing operation corresponding to the cryptographic operation. A determination means for determining one of the execution of the cryptographic operation with the spoofing operation and the execution of the cryptographic operation without the spoofing operation based on the type of the cryptographic operation specified by the parameter. An IC card characterized by being provided. It is an arithmetic determination method executed by a processor included in an electronic information storage device that performs processing according to a command received from an external device and transmits a response indicating the result of the processing to the external device.
When a cryptographic operation is executed during processing according to the command, the type of command specified by the command code included in the command or the command included in the command is used as an execution condition of the spoofing operation corresponding to the cryptographic operation. Based on the type of the cryptographic operation specified by the parameter, one of the execution of the cryptographic operation with the spoofing operation and the execution of the cryptographic operation without the spoofing operation is determined. Calculation determination method. A processor provided in an electronic information storage device that performs processing according to a command received from an external device and sends a response indicating the result of the processing to the external device.
When executing a cryptographic operation during processing according to the command, the type of command specified by the command code included in the command or the command included in the command is used as an execution condition of the spoofing operation corresponding to the cryptographic operation. A function to determine one of the execution of the cryptographic operation with the spoofing operation and the execution of the cryptographic operation without the spoofing operation based on the type of the cryptographic operation specified by the parameter. An arithmetic decision program characterized by making a command. An IC card that performs processing according to a command received from an external device and sends a response indicating the result of the processing to the external device.
When executing a cryptographic operation during processing according to the command, as an execution condition of the spoofing operation corresponding to the cryptographic operation, the execution of the cryptographic operation accompanied by the spoofing operation is performed based on the execution history of the cryptographic operation. An IC card comprising a determination means for determining any one of the execution of the cryptographic operation without the camouflage operation. It is an arithmetic determination method executed by a processor included in an electronic information storage device that performs processing according to a command received from an external device and transmits a response indicating the result of the processing to the external device.
When executing a cryptographic operation during processing according to the command, as an execution condition of the spoofing operation corresponding to the cryptographic operation, the execution of the cryptographic operation accompanied by the spoofing operation is performed based on the execution history of the cryptographic operation. , An operation determination method comprising determining any one of the execution of the cryptographic operation without the camouflage operation. A processor provided in an electronic information storage device that performs processing according to a command received from an external device and sends a response indicating the result of the processing to the external device.
When executing a cryptographic operation during processing according to the command, as an execution condition of the spoofing operation corresponding to the cryptographic operation, the execution of the cryptographic operation accompanied by the spoofing operation is performed based on the execution history of the cryptographic operation. , An arithmetic determination program characterized in that it functions to determine any one of the execution of the cryptographic operation without the camouflage operation.

Images