State-machine clock tampering detection

• US 9,223,960 B1
• Filed: 07/31/2014
• Issued: 12/29/2015
• Est. Priority Date: 07/31/2014
• Status: Active Grant

• Current Assignee: Winbond Electronics Corporation
• Original Assignee: Winbond Electronics Corporation
• Inventors: Kaluzhny, Uri, Weiser, Tsachi, Teper, Valery, Tasher, Nir
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US14/447,644
• Time in Patent Office: 516 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 1/04 Generating or distributing clock signals or signals derived directly therefrom
• CPC Class Codes: G06F 11/1604 where the fault affects the clock signals of a processing unit and the redundancy is at or within the level of clock signal generation hardware
• CPC Class Codes: G06F 21/725 operating on a secure reference time value

Abstract

An apparatus for detecting tampering with a clock of a state-machine, comprising, a master state-machine having master states and driven by a master clock, the master states being switchable responsive to events, and an auxiliary state-machine having auxiliary states and driven by an auxiliary clock synchronous with the master clock, the auxiliary states being switchable responsive to a signal generated based at least on said events, consequently establishing a correspondence between the master states and the auxiliary states, thus ensuing that subsequent to tampering with the master clock the correspondence between the master states and the auxiliary states become discordant, thereby indicating that the master clock has been tampered with.

Claims

1. A electronic apparatus for detecting tampering with a clock of an electronically implemented state-machine, comprising:

an electronically implemented state-machine as a master state-machine having master states and driven by a master clock, the master states being switchable responsive to events; and

an electronically implemented state-machine as an auxiliary state-machine having auxiliary states and driven by an auxiliary clock synchronous with the master clock, the auxiliary states being switchable responsive to a signal generated based at least on said events, consequently establishing a correspondence between the master states and the auxiliary states,

thus ensuing that subsequent to tampering with the master clock the correspondence between the master states and the auxiliary states become discordant, thereby indicating that the master clock has been tampered with.

2. The apparatus according to claim 1, wherein the correspondence between the master states and the auxiliary states become discordant since subsequent to tampering with the master clock the correspondence between the master states and the auxiliary states are eventually violated.

3. The apparatus according to claim 1, further comprising a validation circuitry configured to detect the discordant correspondence between the master states and the auxiliary states.

4. The apparatus according to claim 3, wherein the validation circuitry is configured to activate an action responsive to detecting the discordant correspondence between the master states and the auxiliary states.

5. The apparatus according to claim 4, wherein the action comprises a perceptible alert.

6. The apparatus according to claim 4, wherein the action comprises affecting the master state-machine.

7. The apparatus according to claim 1, further comprising redundant auxiliary state-machines thus, due to the redundancy of the auxiliary state-machines, increasing reliability of detecting tampering with the master clock in case an auxiliary clock is tampered with relative to reliability of detection without redundant auxiliary state-machines.