Shamir's secret sharing scheme is an effective way to distribute secret to a group of shareholders. The security of the unprotected sharing scheme, however, can be easily broken by cheaters or attackers who maliciously feed incorrect shares during the secret recovery stage or inject faults into hardware computing the secret. In this paper, we propose cheater detection and identification schemes based on robust and algebraic manipulation detection (AMD) codes and m-disjunct matrices (superimposed codes). We present the constructions of codes for cheater detection and identification and describe how the cheater identification problem can be related to the classic group testing algorithms based on m-disjunct matrices. Simulation and synthesis results show that the proposed architecture can improve the security level significantly even under strong cheating attack models with reasonable area and timing overheads.

Most cache designs support single or double bit-level error detection and correction in cache lines. However, a single error may distort a whole byte or even more, resulting in much higher decoding complexity than that of bit-level distortions. Thereby this paper proposes a new group testing based error correcting code (GTB code) for byte-level error locating and correcting which provides much stronger protection for memories. This new class of non-binary GTB codes is generated from binary superimposed codes. Since it is encoded and decoded by binary matrices, no complicated Galois Field computations in GF(Q) such as multiplications and inversions are involved. Comparing with popular non-binary error correcting codes (ECC) such as Hamming, Reed-Solomon and interleaved codes, the GTB codes achieves up to 42% reduction of the decoding complexity (hardware cost × latency) for single-byte error correction, and up to 98% reduction for double-byte error correction. Moreover, given the length of codewords (e.g. 512 bits for cache lines), as the size of each Q-ary digit (byte) increases, the saving increases.

The security of communication or computational systems protected by traditional error detecting codes rely on the assumption that the information bits of the message (output of the device-under-attack) are not known to attackers or the error patterns are not controllable by external forces. For applications where the assumption is not valid, e.g., secure cryptographic devices, secret sharing, etc, the security of systems protected by traditional error detecting codes can be easily compromised by an attacker. In this paper, we present constructions for strongly secure codes based on the nonlinear encoding functions. For $(\mbi {k},\mbi {m},\mbi {r})$ strongly secure codes, a message contains three parts: $\mbi {k}$ -bit information data $\mbi {y}$ , $\mbi {m}$ -bit random data $\mbi {x}$ , and $\mbi {r}$ -bit redundancy $\mbi {f}(\mbi {y},\mbi {x})$ . For any error $\mbi {e}$ and information $\mbi {y}$ , the fraction of $\mbi {x}$ that masks the error $\mbi {e}$ is less than 1. In this paper, we describe lower and upper bounds on the proposed codes and show that the presented constructions can generate optimal or close to optimal codes. An efficient encoding and decoding method for the codes minimizing the number of multipliers using the multivariate Horner scheme is presented.

Shamir's secret sharing scheme is an effective way to distribute secret to a group of shareholders. But this scheme is vulnerable to cheaters and attackers and thus how to protect the system from cheating and attacks is a big problem. In this paper, we proposed to use robust codes and algebraic manipulation detection (AMD) codes to protect the secret sharing module. Simulation and synthesis results show that the proposed architecture can improve the security level significantly even under strong cheating and attack models with some extra area and timing overheads.

Memories used in cryptographic devices are vulnerable to fault injection attacks. To mitigate the danger of these attacks, error control codes are often used in memories to detect maliciously injected faults. Most of codes proposed for memories in cryptographic devices are error detecting codes with small Hamming distances that cannot be used for error correction. While being able to provide sufficient protection against fault injection attacks, these codes cannot provide a satisfactory reliability under the presence of random errors. In this paper we present reliable and secure memory architectures based on two nonlinear error correcting codes. The presented coding technique can be used for detection of fault injection attacks as well as for correction of random errors. The construction and the error correction procedures for the code will be described. The error handling methodology used to distinguish between random errors and maliciously injected faults will be discussed.

As the technology moves into the nano-realm, traditional single-error-correcting, double-error-detecting (SEC-DED) codes are no longer sufficient for protecting memories against transient errors due to the increased multi-bit error rate. The well known double-error-correcting BCH codes and the classical decoding method for BCH codes based on Berlekamp-Massey algorithm and Chien search cannot be directly adopted to replace SEC-DED codes because of their much larger decoding latency. In this paper, we propose the hierarchical double-error-correcting (HDEC) code. The construction methods and the decoder architecture for the codes are described. The presented error correcting algorithm takes only 1 clock cycle to finish if no error or a single-bit error occurs. When there are multi-bit errors, the decoding latency is O(log2m) clock cycles for codes defined over GF(2m). This is much smaller than the latency for decoding BCH codes using Berlekamp Massey algorithm and Chien search, which is O(k) clock cycles - k is the number of information bits for the code and m ~ O(log2k). Synthesis results show that the proposed (79, 64) HDEC code requires only 80% of the area and consumes <; 70% of the power compared to the classical (78, 64) BCH code. For a large bit distortion rate (10-3 ~ 10-2), the average decoding latency for the (79, 64) HDEC code is only 36% ~ 60% of the latency for decoding the (78, 64) BCH code.

—The reliability and security of memories are crucial considerations in the modern digital system design. Traditional codes concentrate on detecting and correcting errors of certain types, e.g., errors with small multiplicities or byte errors, and cannot detect or correct unanticipated errors. Thereby, they may not be sufficient to protect memories against malicious attackers with strong fault injection capabilities and cannot correct unexpected errors with high multiplicities. The contribution of this paper is that we construct a new reliable and secure memory architecture based on robust Algebraic Manipulation Correction (AMC) codes. These codes can be used for correction of random errors and for detection of fault injection attacks. These codes can provide a guaranteed error detection probability for all errors even if both the user defined messages (data stored in the memory) and the error patterns are controllable by an attacker. The presented code can correct all single-bit errors in the information bits of the code. Moreover, these codes can be used to correct double-bit errors with high probabilities. The construction and the error correction procedures for the code will be described. The probability that an error can be successfully detected and/or corrected and the hardware overheads for the proposed memory architecture will be estimated. The presented approach is efficient for protecting security/reliability critical memories used to store the important information on the chip (e.g., a secret key in a cryptographic device).

Cryptographic devices suffer from fault injection attacks. The security of crypto-systems protected by traditional error detecting codes rely on the assumption that the information bits and the error patterns are not both controllable by the attacker. For applications where the assumption is not valid, the security of systems protected by traditional error detecting codes can be easily compromised. In this paper, we present constructions for algebraic manipulation detection (AMD) codes based on the nonlinear encoding functions. For a (k,m, r) AMD code, a message contains three parts: k-bit information data y, m-bit random data x and r-bit redundancy f(y, x). For any error e and information y, the fraction of x that masks the error e is less than 1. In this paper we describe lower and upper bounds on AMD codes and show that the presented constructions can generate optimal or close to optimal AMD codes in many cases. We presented efficient encoding and decoding methods for AMD codes minimizing the number of multipliers using the multivariate Horner scheme. The proposed codes can provide a guaranteed high error detecting probability even if both the information bits of the code and the non-zero error patterns are controllable by an attacker. These codes can be used for design of secure multipliers, secure memories or secure hardware implementing cryptography algorithms resistant to fault injection attacks. Keywords-Error Detecting Codes, Nonlinear Codes, Secure Hardware, Fault Injection Attacks.

The reliability and security of memories are crucial considerations in the modern digital system design. Traditional codes usually concentrate on detecting and correcting errors of certain types, e.g. errors with small multiplicities or byte errors, and cannot detect or correct unanticipated errors. In this paper we present a reliable and secure memory architecture based on robust Algebraic Manipulation Correction codes. These codes can provide a guaranteed error detection probability and can correct any error regardless of its multiplicity as long as the error stays for several consecutive clock cycles. The construction and the error correction procedure for the code will be described. The probability that an error can be successfully detected and/or corrected and the hardware overhead of the memory architecture based on these codes will be estimated.

Multi-level cell (MLC) nand flash memories are popular storage media because of their power efficiency and large storage density. Conventional reliable MLC nand flash memories based on BCH codes or Reed-Solomon (RS) codes have a large number of undetectable and miscorrected errors. Moreover, standard decoders for BCH and RS codes cannot be easily modified to correct errors beyond their error correcting capability t=[(d-1/2)], where d is the Hamming distance of the code. In this paper, we propose two general constructions of nonlinear multi-error correcting codes based on concatenations or generalized from Vasil'ev codes. The proposed constructions can generate nonlinear bit-error correcting or digit-error correcting codes with very few or even no errors undetected or miscorrected for all codewords. Moreover, codes generated by the generalized Vasil'ev construction can correct some errors with multiplicities larger than t without any extra overhead in area, latency, and power consumption compared to schemes where only errors with multiplicity up to t are corrected. The design of reliable MLC nand flash architectures can be based on the proposed nonlinear multi-error correcting codes. The reliability, area overhead and the penalty in latency and power consumption of the architectures based on the proposed codes are compared to architectures based on BCH codes and RS codes. The results show that using the proposed nonlinear error correcting codes for the protection of MLC nand flash memories can reduce the number of errors undetected or miscorrected for all codewords to be almost 0 at the cost of less than 20% increase in power and area compared to architectures based on BCH codes and RS codes.

Public-key cryptographic devices are vulnerable to fault-injection attacks. As countermeasures, a number of secure architectures based on linear and nonlinear error detecting codes were proposed. Linear codes provide protection only against primitive adversaries with limited attack capabilities. On the other hand nonlinear codes provide protection against strong adversaries, but at the price of high area overhead (200%-400%). In this paper we propose a novel error detection technique based on the random selection of linear arithmetic codes and explore the use of this technique for the protection of the multiplier, which is a basic block in many public-key cryptographic devices. The error detection technique does not imply any limitations on the types of errors at the output of the device, e.g., the multiplicity of the error does not have to be small. Under mild assumptions the proposed construction achieves near nonlinear code error detection performance at a lower cost (at most 50% area overhead for the protection of multipliers) due to the fact that no nonlinear operations are needed for the encoder and decoder.

This chapter mainly discusses robust and partially robust codes and their application to various cryptographic primitives. Initially, robust nonlinear codes are described in detail and their error detection capabilities are measured theoretically. Next, various nonlinear constructions are provided and their potential applications are described. More specifically, we discuss the protection of the AES data path, finite state machines (FSMs), and elliptic curve cryptosystems (ECCs). The main advantage of robust codes is that they are nonlinear and hence the success of an injected fault is data-dependent. As a result, error detection using nonlinear robust codes is one of the most effective solutions to active fault injection attacks.

Carbon nanotubes (CNTs) are considered as a possible successor to the CMOS technology. The adoption of these nanodevices for designing large VLSI systems, however, is limited by the unreliable manufacturing process. In this paper, we investigate the possibility of using CNTFETs to build SRAM arrays. We analyze the error mechanisms and show how stuck-at faults and pattern sensitive faults are caused by metallic tubes in different transistors of a 6-T SRAM cell. The results indicate the need of stronger error detecting codes than the widely used single-error-correcting, double-error-detecting codes in CMOS SRAMs.

The security of the cryptographic device may be compromised if the FSM of the system is not properly protected [1]. FSM protection architectures based on linear codes cannot provide a guaranteed level of protection under the assumption of a strong attack model. In this paper, we propose secure FSM architectures based on the idea of randomly selecting one code from a set of codes for each encoding and decoding operation. Assuming that the attacker is able to inject specific error patterns, randomly selecting one code from L codes as described in the paper can reduce the chance for the attacker to conduct a successful attack by a factor of L. The proposed techniques can achieve much higher security level than architectures based on linear codes with reasonable hardware overhead for cryptography applications (120% – 130% for the protection of the FSM for the Montgomery ladder algorithm). The security level of the proposed architectures can be increased by increasing L and the number of information bits k of the codes.

In this paper we propose memory protection architectures based on nonlinear single-error-correcting, double-error-detecting (SEC-DED) codes. Linear SEC-DED codes widely used for design of reliable memories cannot detect and can miscorrect lots of errors with large Hamming weights. This may be a serious disadvantage for many modern technologies when error distributions are hard to estimate and multi-bit errors are highly probable. The proposed protection architectures have fewer undetectable errors and fewer errors that are miscorrected by all codewords than architectures based on linear codes with the same dimension at the cost of a small increase in the latency penalty, the area overhead and the power consumption. The nonlinear SEC-DED codes are generalized from the existing perfect nonlinear codes (Vasil’ev codes, Probl Kibern 8:375–378, 1962; Phelps codes, SIAM J Algebr Discrete Methods 4:398–403, 1983; and the codes based on one switching constructions, Etzion and Vardy, IEEE Trans Inf Theory 40:754–763, 1994). We present the error correcting algorithms, investigate and compare the error detection and correction capabilities of the proposed nonlinear SEC-DED codes to linear extended Hamming codes and show that replacing linear extended Hamming codes by the proposed nonlinear SEC-DED codes results in a drastic improvement in the reliability of the memory systems in the case of repeating errors or high multi-bit error rate. The proposed approach can be applied to RAM, ROM, FLASH and disk memories.

Multi-level cell (MLC) NAND flash memories are very popular storage media because of their power efficiency and big storage density. This paper proposes to use nonlinear t-error-correcting codes to replace linear BCH codes for error detection and correction in MLC NAND flash memories. Compared to linear BCH codes with the same bit-error correcting capability t, the proposed codes have less errors miscorrected by all codewords and nearly no undetectable errors. For example, the proposed (8281, 8201, 11) 5-error-correcting code has no errors of multiplicity six miscorrected by all codewords while the widely used (8262, 8192, 11) linear shortened BCH code has 11 over 6 × A 11 errors in this class, where A 11 ≈ 10 14 is the number of codewords of Hamming weight eleven in the shortened BCH code. Moreover, in spite of the fact that the Hamming distance of the proposed code is 2t+1, it can also correct some errors of multiplicity t+1 and t+2 requiring no extra hardware overhead and latency penalty. In this paper, the constructions and the error correction algorithm for the nonlinear t-error-correcting codes are presented. The architecture of the encoder and the decoder for the codes are shown. The error correcting capabilities, the hardware overhead, the latency and the power consumption for the encoder and the decoder will be analyzed and compared to that of the linear BCH codes to demonstrate the advantages of the proposed codes for error detection and correction in MLC NAND flash memories.

Linear single-error-correcting, double-error-detecting (SEC-DED) codes used for design of reliable memories cannot detect and can miscorrect some errors with large Hamming weights. In this paper we present several constructions of optimal nonlinear robust and partially robust codes, i.e. the Vasil’ev codes, the Phelps codes and the codes based on one switching constructions. The error detection and correction capabilities of these codes are analyzed and compared. We propose protection for memory devices based on extended Vasil’ev codes and extended Phelps codes. These nonlinear SEC-DEC codes have a minimum distance of four, fewer undetectable errors and fewer errors that are miscorrected than linear codes with the same dimension and redundancy. The extended Vasil’ev codes and the extended Phelps codes can provide for higher reliability in the presence of repeating errors or high rate of multi-bit-upsets. In this case replacing extended Hamming codes by the proposed codes may result in a drastic improvement in reliability of the memory with a reasonable cost in hardware overhead and power consumption. The architectures of memories based on these codes are described and the simulation results are presented illustrating their advantages over linear extended Hamming codes. Simple decoding algorithms for the nonlinear codes that can be used to provide concurrent error correction are presented. The proposed approach can be applied to RAM, ROM, FLASH and disk memories.

We propose an efficient technique for the detection of errors in cryptographic circuits introduced by strong adversaries. Previously a number of linear and nonlinear error detection schemes were proposed. Linear codes provide protection only against primitive adversaries which no longer represents practice. On the other hand nonlinear codes provide protection against strong adversaries, but at the price of high area overhead (200–300%). Here we propose a novel error detection technique, based on the random selection of linear arithmetic codes. Under mild assumptions the proposed construction achieves near nonlinear code error detection performance at a lower cost (about 50% area overhead) due to the fact that no nonlinear operations are needed for the encoder and decoder.

Linear single-error-correcting, double-error-detecting (SEC-DED) codes used in the design of reliable memories cannot detect and can miscorrect errors with large Hamming weights. We propose protection for memory devices based on extended Vasil'ev codes. These nonlinear SECDED codes have a minimum distance of four, fewer undetectable errors and fewer errors that are miscorrected than linear codes with the same dimension and redundancy. The extended Vasil'ev codes can provide for higher reliability in the presence of repeating errors or high rate of multibitupsets. As far as we know, our paper is the only one discussing application of efficient nonlinear codes for design of reliable memories. The proposed approach can be applied to RAM, ROM, FLASH and disk memories with relatively low hardware overhead.

Transaction-level modeling is an essential component of system-level design. This paper advocates using rendezvous, a construct common to concurrent programming languages, as a theoretical foundation for transactions. Compared to regular function calls, rendezvous are atomic and support multipartiness and parallel composition. However, scheduling multiparty rendezvous is a challenging task due to its NP-hard complexity. This paper describes a heuristic algorithm that significantly reduces the scheduling complexity in practice. It first constructs a relationship graph among rendezvous. It then simplifies the graph and translates it into a decision tree, which assists the scheduler in partitioning and pruning the search space. Our experimental results show that the algorithm is able to improve the efficiency of the scheduler significantly.