1、BSI Standards Publication PD ISO/IEC TS 30104:2015 Information Technology Security Techniques Physical Security Attacks, Mitigation Techniques and Security RequirementsPD ISO/IEC TS 30104:2015 PUBLISHED DOCUMENT National foreword This Published Document is the UK implementation of ISO/IEC TS 30104:2
2、015. The UK participation in its preparation was entrusted to Technical Committee IST/33, Security techniques. A list of organizations represented on this committee can be obtained on request to its secretary. This publication does not purport to include all the necessary provisions of a contract. U
3、sers are responsible for its correct application. The British Standards Institution 2015. Published by BSI Standards Limited 2015 ISBN 978 0 580 88642 3 ICS 35.040 Compliance with a British Standard cannot confer immunity from legal obligations. This Published Document was published under the author
4、ity of the Standards Policy and Strategy Committee on 31 May 2015. Amendments issued since publication Date Text affectedPD ISO/IEC TS 30104:2015 Information Technology Security Techniques Physical Security Attacks, Mitigation Techniques and Security Requirements Technologies de linformation Techniq
5、ues de scurit Attaques de scurit physique, techniques dattnuation et exigences de scurit ISO/IEC TS 30104 First edition 2015-05-15 Reference number ISO/IEC TS 30104:2015(E) TECHNICAL SPECIFICATION ISO/IEC 2015 PD ISO/IEC TS 30104:2015ii ISO/IEC 2015 All rights reserved COPYRIGHT PROTECTED DOCUMENT I
6、SO/IEC 2015, Published in Switzerland All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written p
7、ermission. Permission can be requested from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Ch. de Blandonnet 8 CP 401 CH-1214 Vernier, Geneva, Switzerland Tel. +41 22 749 01 11 Fax +41 22 749 09 47 copyrightiso.org www.iso.org ISO/IEC TS 301
8、04:2015(E)PD ISO/IEC TS 30104:2015ISO/IEC TS 30104:2015(E)Foreword v Introduction vi 1 Scope . 1 2 Normative references 1 3 T erms and definitions . 1 4 Symbols and abbreviated terms . 5 5 Physical security . 5 6 Physical security invasive mechanisms 6 6.1 Overview 6 6.2 Tamper proof 7 6.3 Tamper re
9、sistant . 7 6.4 Tamper detection 7 6.5 Tamper evident . 7 6.6 Additional physical security considerations . 8 6.6.1 Summary . 8 6.6.2 Size and weight . 8 6.6.3 Mixed and Layered Systems . 8 7 Physical security invasive attacks and defences . 8 7.1 Overview 8 7.2 Attacks 9 7.2.1 Attack mechanisms 9 7
10、.2.2 Machining methods . 9 7.2.3 Shaped charge technology 11 7.2.4 Energy attacks .11 7.2.5 Environmental conditions 12 7.3 Defences .12 7.3.1 Overview 12 7.3.2 Tamper resistant .13 7.3.3 Tamper evident 14 7.3.4 Tamper detection sensor technology 15 7.3.5 Tamper responding 18 8 Physical security non
11、-invasive mechanisms 20 8.1 Overview .20 8.2 Mixed and Layered Systems 20 9 Physical security non-invasive attacks and defences 20 9.1 Overview .20 9.2 Attacks .20 9.2.1 Overview 20 9.2.2 External Probe attacks .20 9.2.3 External EME attacks 21 9.2.4 Timing analysis 21 9.3 Defences .21 10 Operating
12、Envelope Concept .22 11 Development, delivery and operation considerations .22 11.1 Introduction .22 11.2 Development 22 11.2.1 Functional test and debug.22 11.2.2 Security testing .22 11.2.3 Environmental testing . .23 11.2.4 Factory installed keys or security parameters 23 ISO/IEC 2015 All rights
13、reserved iii Contents PagePD ISO/IEC TS 30104:2015ISO/IEC TS 30104:2015(E)11.3 Delivery 23 11.3.1 Documentation .23 11.3.2 Packaging.24 11.3.3 Delivery verification.24 11.4 Operation 24 11.4.1 Overview 24 11.4.2 Implementation feedback .24 11.4.3 Feedback during attack .24 12 Physical security evalu
14、ation and testing 24 12.1 Overview .24 12.2 Standards 25 12.2.1 FIPS PUB 140-2, Security Requirements for Cryptographic Modules 25 12.2.2 Derived Test Requirements for FIPS PUB 140-2, Security Requirements for Cryptographic Modules .25 12.2.3 ISO/IEC 19790:2012, Information technology Security techn
15、iques Security requirements for cryptographic modules 25 12.2.4 ISO/IEC 24759:2014 Information technology Security techniques Test requirements for cryptographic modules .26 12.2.5 ISO/IEC 15408-1:2009, Information technology Security techniques Evaluation criteria for IT security Part 1: Introducti
16、on and general model 26 12.2.6 ISO/IEC 15408-2:2008, Information technology Security techniques Evaluation criteria for IT security Part 2: Security functional components .26 12.2.7 ISO/IEC 15408-3:2008, Information technology Security techniques Evaluation criteria for IT security Part 3: Security
17、assurance components .27 12.2.8 ISO/IEC 18045:2008, Information technology Security techniques Methodology for IT security evaluation .27 12.3 Programs and schemes .27 12.3.1 NIST and CSE Cryptographic Module Validation Program .27 12.3.2 Japan Cryptographic Module Validation Program .27 12.3.3 Kore
18、a Cryptographic Module Validation Program.27 12.3.4 Common Criteria .28 Annex A (informative) Example of a physical security design 29 Bibliography .30 iv ISO/IEC 2015 All rights reservedPD ISO/IEC TS 30104:2015ISO/IEC TS 30104:2015(E) Foreword ISO (the International Organization for Standardization
19、) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to dea
20、l with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IE
21、C have established a joint technical committee, ISO/IEC JTC 1. The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of document should
22、be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives). Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible f
23、or identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents). Any trade name used in this document is information given for the
24、 convenience of users and does not constitute an endorsement. For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISOs adherence to the WTO principles in the Technical Barriers to Trade (TBT), see the following URL: F
25、oreword Supplementary information. The committee responsible for this document is ISO/IEC JTC 1, Information technology, SC 27, Security techniques. ISO/IEC 2015 All rights reserved vPD ISO/IEC TS 30104:2015ISO/IEC TS 30104:2015(E) Introduction The protection of sensitive information does not rely s
26、olely on the implementation of software mechanisms employing cryptographic techniques, but also relies significantly on appropriate hardware implemented security devices that employ tamper detection and protection of critical security parameters (e.g. cryptographic keys, authentication data, etc.).
27、This is especially relevant for devices that may be installed, deployed or operated in hostile, untrusted, or non-secure environments, or for devices that contain high-value data assets. An attacker may not be motivated by the economic value or the successful access to sensitive information, but sim
28、ply the challenge of compromising a design or system that has been advertised as “secure”. The challenge to break the design gives such an attacker instant fame and recognition amongst peer groups. Currently, much of the information in this area originates from disparate sources, may not be presente
29、d consistently, and may not address appropriate evaluation and testing techniques.vi ISO/IEC 2015 All rights reservedPD ISO/IEC TS 30104:2015Information Technology Security Techniques Physical Security Attacks, Mitigation Techniques and Security Requirements 1 Scope Physical security mechanisms are
30、employed by cryptographic modules where the protection of the modules sensitive security parameters is desired. This Technical Specification addresses how security assurance can be stated for products where the risk of the security environment requires the support of such mechanisms. This Technical
31、Specification addresses the following topics: a survey of physical security attacks directed against different types of hardware embodiments including a description of known physical attacks, ranging from simple attacks that require minimal skill or resources, to complex attacks that require trained
32、, technical people and considerable resources; guidance on the principles, best practices and techniques for the design of tamper protection mechanisms and methods for the mitigation of those attacks; and guidance on the evaluation or testing of hardware tamper protection mechanisms and references t
33、o current standards and test programs that address hardware tamper evaluation and testing. The information in this Technical Specification is useful for product developers designing hardware security implementations, and testing or evaluation of the final product. The intent is to identify protectio
34、n methods and attack methods in terms of complexity, cost and risk to the assets being protected. In this way cost effective protection can be produced across a wide range of systems and needs. 2 Normative references The following documents, in whole or in part, are normatively referenced in this do
35、cument and are indispensable for its application. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 15408 (all parts), Information technology Security techniques Evaluation criteria
36、for IT security ISO/IEC 19790, Information technology Security techniques Security requirements for cryptographic modules ISO/IEC 24759, Information technology Security techniques Test requirements for cryptographic modules 3 T erms a nd definiti ons For the purposes of this document, the terms and
37、definitions given in ISO/IEC 19790 and ISO/IEC 24759 apply and are duplicated here for reference. NOTE Definitions followed by a reference in square brackets are taken verbatim from ISO/IEC 19790:2012 or ISO/IEC 24759:2014 All other terms and definitions are adapted from those in ISO/IEC 19790:2012
38、or ISO/IEC 24759:2014. TECHNICAL SPECIFICATION ISO/IEC TS 30104:2015(E) ISO/IEC 2015 All rights reserved 1PD ISO/IEC TS 30104:2015ISO/IEC TS 30104:2015(E) 3.1 compromise unauthorised disclosure, modification, substitution, or use of critical security parameters or the unauthorised modification or su
39、bstitution of public security parameters SOURCE: ISO/IEC 19790:2012, 3.13 3.2 conformal coating material that may be applied in layers or in various thicknesses that adhere directly to the electronic components or printed circuit boards and provide a hard coating that deters machining, probing, ener
40、gy or chemical attacks 3.3 critical security parameter CSP security related information whose disclosure or modification can compromise the security of a cryptographic module SOURCE: ISO/IEC 19790:2012, 3.18 EXAMPLE Secret and private cryptographic keys, authentication data such as passwords, PINs,
41、certificates or other trust anchors. Note 1 to entry: A CSP can be plaintext or encrypted. 3.4 cryptographic boundary explicitly defined perimeter that establishes the boundary of all components (i.e. set of hardware, software, or firmware) of the cryptographic module SOURCE: ISO/IEC 19790:2012, 3.2
42、1 3.5 cryptographic module module set of hardware, software, and/or firmware that implements security functions and are contained within the cryptographic boundary SOURCE: ISO/IEC 19790:2012, 3.25 3.6 differential power analysis DPA analysis of the variations of the electrical power consumption of a
43、 cryptographic module, for the purpose of extracting information correlated to a cryptographic operation SOURCE: ISO/IEC 19790:2012, 3.29 3.7 environmental failure protection EFP use of features to protect against a compromise of the security of a cryptographic module due to environmental conditions
44、 outside of the modules normal operating range SOURCE: ISO/IEC 19790:2012, 3.392 ISO/IEC 2015 All rights reservedPD ISO/IEC TS 30104:2015ISO/IEC TS 30104:2015(E) 3.8 environmental failure testing EFT use of specific methods to provide reasonable assurance that the security of a cryptographic module
45、will not be compromised by environmental conditions outside of the modules normal operating range SOURCE: ISO/IEC 19790:2012, 3.40 3.9 f i r mw a r e executable code of a cryptographic module that is stored in hardware within the cryptographic boundary and cannot be dynamically written or modified d
46、uring execution while operating in a non-modifiable or limited operational environment SOURCE: ISO/IEC 19790:2012, 3.45 EXAMPLE Storage hardware can include but is not limited to PROM, EEPROM, FLASH, solid state memory, hard drives, etc. 3.10 hardware physical equipment/components within the cryptog
47、raphic boundary used to process programs and data SOURCE: ISO/IEC 19790:2012, 3.50 3.11 passivation effect of a reactive process in semiconductor junctions, surfaces or components and integrated circuits constructed to include means of detection and protection SOURCE: ISO/IEC 19790:2012, 3.87 EXAMPL
48、E Silicon dioxide or phosphorus glass. Note 1 to entry: Passivation can modify the behaviour of the circuit. Passivation material is technology dependant 3.12 physical protection safeguarding of a cryptographic module, CSPs and PSPs using physical means SOURCE: ISO/IEC 19790:2012, 3.90 3.13 producti
49、on-grade product, component or software that has been tested to meet operational specifications SOURCE: ISO/IEC 19790:2012, 3.95 3.14 physical security invasive attacks attacks that involve a physical alteration to the implementation that may also cause an operating aberration different from normal operation 3.15 physical security non-invasive attacks attacks that do not involve a physical alteration to the implementat
