US20160140057A1 - Semiconductor device and encryption key writing method - Google Patents
Semiconductor device and encryption key writing method Download PDFInfo
- Publication number
- US20160140057A1 US20160140057A1 US15/006,837 US201615006837A US2016140057A1 US 20160140057 A1 US20160140057 A1 US 20160140057A1 US 201615006837 A US201615006837 A US 201615006837A US 2016140057 A1 US2016140057 A1 US 2016140057A1
- Authority
- US
- United States
- Prior art keywords
- encryption key
- memory
- key
- encryption
- cpu
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F12/00—Accessing, addressing or allocating within memory systems or architectures
- G06F12/14—Protection against unauthorised use of memory or access to memory
- G06F12/1408—Protection against unauthorised use of memory or access to memory by using cryptography
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
- G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
- G06F2212/10—Providing a specific technical effect
- G06F2212/1052—Security improvement
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/24—Key scheduling, i.e. generating round keys or sub-keys for block encryption
Definitions
- the present invention relates to a semiconductor device mounted in an IC (Integrated Circuit) card as an example, provided with a CPU and a ROM (Read Only Memory) which stores an encrypted program to be used by the CPU, and in particular, relates to a technology which can be suitably utilized for improvement of the security level against an attack trying to illegally read the encrypted program.
- IC Integrated Circuit
- ROM Read Only Memory
- an IC card is provided as a SoC (System on Chip) (microcomputer) in which a ROM, a RAM (Random Access Memory), an EEPROM (Electrically Erasable Programmable Read-Only Memory), and a CPU (Central Processing Unit) are integrated into a single chip.
- the IC card is provided with the required minimum number of external terminals, such as a power source, a ground, a clock, a reset, and a serial communication interface.
- the configuration of the IC card does not allow a direct access to the internal memory thereof and the exchange of data is always performed through serial communication; accordingly the secrecy of the memory content has been assured.
- the analysis of security equipment by reverse engineering is posing an issue, in association with the advancement in performance of an analysis device.
- the reverse engineering of a ROM is posing such an actual threat that the contents of the firmware stored in the ROM are read out.
- scrambling by a simple combinational circuit has been performed.
- the configuration of a scramble circuit is kept in secrecy and the secrecy has guaranteed the secrecy of the firmware.
- the advancement in the reverse engineering technology is now allowing even the analysis of the scramble circuit. In view of the above circumstances, it is required to establish encryption of the contents of a ROM such that the firmware cannot be analyzed only by a simple readout of a ROM pattern.
- the secrecy of a method or the secrecy of a key will improve the security level against an attack trying to illegally read out an encrypted program.
- an attack which can decode the contents of the ROM with reverse engineering is assumed, it is expected that an encryption method is also analyzed from the physical analysis of the circuit configuration. Accordingly, an encryption key is stored in an electrically rewritable nonvolatile memory, thereby making it difficult to read out the encryption key only by the reverse engineering by means of the optical observation of a physical shape or a circuit configuration.
- Patent Literature 1 and Patent Literature 2 disclose inventions concerning security equipment which encrypts and stores a program.
- the encrypted program is decrypted by use of an encryption key, developed into another storage device, and executed subsequently.
- Patent Literature 3 and Patent Literature 4 disclose technology which improves the security level against an attack trying to read out an encryption key illegally. That is, Patent Literature 3 discloses technology for storing the encryption key in a memory area in an IC card where read-out from the exterior is absolutely difficult, and Patent Literature 4 discloses technology for dividing the encryption key and storing the divided keys in distributed regions in one storage device. Patent Literature 5 discloses technology in which the key information of plural encryption keys is managed in a split manner or in a batch, thereby storing the key information efficiently.
- Patent Literature 1 Published Japanese Unexamined Patent Application No. 2000-155819
- Patent Literature 2 Published Japanese Unexamined Patent Application No. 2003-333027
- Patent Literature 3 Published Japanese Unexamined Patent Application No. Hei 04(1992)-102185
- Patent Literature 4 Published Japanese Unexamined Patent Application No. 2000-252973
- Patent Literature 5 Published Japanese Unexamined Patent Application No. 2012-080295
- Patent Literatures 1, 2, 3, 4, and 5 The examination performed by the present inventors on Patent Literatures 1, 2, 3, 4, and 5 has revealed that there exist the following new issues.
- Patent Literature 1 does not describe about a storing method of an encryption key, in particular, about the technology that improves the security level against an attack trying to illegally read out the encryption key.
- Patent Literature 2 describes the technology in which an encryption key is divided and stored in plural storage devices in a distributed manner; however, it is necessary to provide plural storage devices, accordingly, it is difficult to employ the technology in a small-scale system such as an IC card.
- One embodiment is as follows.
- a semiconductor device is provided with a CPU, an electrically rewritable EEPROM, and an electrically non-rewritable ROM.
- An encryption area and a non-encryption area are provided in the ROM, and encrypted firmware is stored in the encryption area.
- the semiconductor device is provided with a decrypter which holds an encryption key, decrypts the encrypted firmware and supplies the decrypted firmware to the CPU.
- the CPU operates in one of operation modes including a system mode and a user mode.
- the EEPROM is provided with a system area to which an access from the CPU is forbidden in the user mode.
- An encryption key which has encrypted the firmware is divided into split keys formed by plural bit strings, and is stored in distributed address areas in the system area of the EEPROM.
- An encryption key reading program which is not encrypted is stored in the non-encryption area of the ROM.
- the plural split keys held in the EEPROM in a distributed manner are read and reconfigured to restore the encryption key which is then supplied to the decrypter.
- the CPU is a processor which interprets and executes an instruction code provided, and is not restricted by the architecture thereof.
- the CPU may be a CPU of a microcomputer or a micro controller or it may be a multiple-processor and a DSP (Digital Signal Processor).
- DSP Digital Signal Processor
- FIG. 1 is a block diagram illustrating a configuration of a semiconductor device 1 according to Embodiment 1;
- FIG. 2 is a flow chart illustrating an example of a reset routine in the semiconductor device according to Embodiment 1;
- FIG. 3 is a block diagram illustrating a configuration of an LSI according to Embodiment 1;
- FIG. 4 is a memory map of a ROM and an EEPROM in an embodiment in which a key storing address specifies an address to store split keys;
- FIG. 5 is a memory map of a ROM and an EEPROM in an embodiment in which a key address storing address specifies a key address and the key address specifies an address to store split keys;
- FIG. 6 is a memory map of a ROM and an EEPROM in an embodiment in which a base point and a deviation specify an address to store split keys;
- FIG. 7 is an explanatory diagram illustrating an example of a communication flow in key write authentication and key writing
- FIG. 8 is an explanatory diagram illustrating another example of a communication flow in key write authentication and key writing
- FIG. 9 is an explanatory diagram illustrating an example of a communication flow in key writing in an embodiment in which a base point address and a deviation specify an address to store split keys;
- FIG. 10 is a flow chart illustrating key reading (loop) in an embodiment in which a key storing address specifies an address to store split keys;
- FIG. 11 is a flow chart illustrating key reading (loop unrolling) in an embodiment in which a key storing address specifies an address to store split keys;
- FIG. 12 is a flow chart illustrating key reading (loop) in an embodiment in which a key address storing address specifies a key address and the key address specifies an address to store split keys;
- FIG. 13 is a flow chart illustrating key reading (loop unrolling) in an embodiment in which a key address storing address specifies a key address and the key address specifies an address to store split keys;
- FIG. 14 is a flow chart illustrating key reading (loop) in an embodiment in which a base point address and a deviation specify an address to store split keys;
- FIG. 15 is a flow chart illustrating key reading (loop unrolling) in an embodiment in which a base point address and a deviation specify an address to store split keys.
- a semiconductor device ( 9 ) is provided with following elements.
- a CPU CPU 2 , a central processing unit which has a first operation mode (system mode) and a second operation mode (user mode).
- An electrically rewritable first nonvolatile memory (EEPROM 4 ) provided with a first region (system area 41 ) and a second region (user area 42 ).
- the first region is forbidden to access from the CPU in the second operation mode (user mode).
- An electrically non-rewritable second nonvolatile memory (ROM 3 ) provided with a third region (encryption area 32 ) and a fourth region (non-encryption area 31 ).
- the third region can store an encryption code as at least one of an encrypted instruction and encrypted data.
- the first nonvolatile memory (EEPROM 4 ) is provided with plural distributed address areas in the first region (system area 41 ), for holding plural split keys ( 12 ) composing an encryption key ( 11 ) for decrypting the encryption code.
- the decrypter holds the encryption key ( 11 ).
- the decrypter decrypts the encryption code read from the third region (encryption area 31 ) of the second nonvolatile memory with the use of the encryption key, and supplies the decrypted encryption code to the CPU.
- the second nonvolatile memory (ROM 3 ) holds an encryption key reading program in the fourth region (non-encryption area 31 ), which is executed by the CPU in the first operation mode (system mode) to restore the encryption key and to supply it to the decrypter, by reading and reconfigurating the plural split keys held in the first nonvolatile memory (EEPROM 4 ) in a distributed manner.
- the semiconductor device is further provided with a communication interface ( 5 ).
- the second nonvolatile memory (ROM 3 ) holds an encryption key writing program ( 80 ) in the fourth region (non-encryption area 31 ).
- the encryption key writing program is executed by the CPU to input the encryption key from the exterior through the communication interface and to write the encryption key, in the state of being divided into the split keys, in the distributed address areas in the first region (system area 41 ) of the first nonvolatile memory (EEPROM).
- the encryption key writing program executes an authentication step ( 90 ) for performing authentication, before the split keys are written in the first nonvolatile memory (EEPROM)
- EEPROM first nonvolatile memory
- Step ( 61 ) for determining that the operation mode to be operated by the CPU is the first operation mode (system mode) and Step ( 63 ) for determining whether the plural split keys are already written in the first nonvolatile memory (EEPROM 4 ) are executed.
- the operation mode to be operated by the CPU is the first operation mode (system mode)
- the plural split keys are not yet written in
- the encryption key writing program advances to the authentication step.
- the first nonvolatile memory (EEPROM 4 ) is provided with a region ( 14 ) for holding data indicative of whether the plural split keys have already been written in the first region (system area 41 ).
- the data indicative of whether the split keys have already been written has plural bits. With this configuration, it is possible to further improve the security level against an attack which tries to rewrite the encryption key written flag ( 14 ) intentionally.
- the authentication step includes a step in which, using public keys e and N and an expectation value p of RSA which are held and c inputted from the exterior, the remainder of the e-th power of c when divided by N is calculated and compared with p.
- the second nonvolatile memory (ROM 3 ) holds a program ( 60 ) in the fourth region (non-encryption area 31 ), in which, when it is determined that the operation mode to be operated by the CPU is the second operation mode (user mode) ( 61 ), the CPU is shifted to the second operation mode (user mode) after the encryption key reading program is executed.
- the encryption key reading program is executed by the CPU in the first operation mode (system mode).
- the plural distributed address areas in the first region (system area 41 ) of the first nonvolatile memory (EEPROM 4 ) for holding the plural split keys ( 12 ) are discontinuous with respect to the physical address in the first nonvolatile memory (EEPROM 4 ) and discontinuous with respect to the logical address for accessing by the CPU.
- At least one of the interval of the plural physical addresses corresponding to the plural distributed address areas in the first region (system area 41 ) of the first nonvolatile memory (EEPROM 4 ) for holding the plural split keys ( 12 ) and the interval of the plural logical addresses corresponding to the plural address areas is unequal.
- the first nonvolatile memory (EEPROM 4 ) is provided, in the first region (system area 41 ), with a key address storing area which stores plural key address values ( 15 ) of the plural address areas for storing the plural split keys, and the second nonvolatile memory (ROM 3 ) holds the address value ( 20 ) of the key address storing area in the fourth region (non-encryption area 31 ).
- each of the plural addresses corresponding to the plural distributed address areas in the first region (system area 41 ) of the first nonvolatile memory (EEPROM 4 ) for holding the plural split keys ( 12 ) can be calculated by use of a base point address ( 16 ) and a deviation ( 17 ).
- the first nonvolatile memory (EEPROM 4 ) is provided with an address area in the first region (system area 41 ) for holding the base point address and the deviation.
- the CPU (CPU 2 ), the first nonvolatile memory (EEPROM 4 ), the second nonvolatile memory (ROM 3 ), and the decrypter ( 1 ) are formed overlying a single semiconductor substrate.
- An encryption key writing method for writing an encryption key to a semiconductor device ( 9 ) is provided.
- the semiconductor device is configured with the following elements.
- a CPU ( 2 ) which has a first operation mode (system mode) and a second operation mode (user mode).
- An electrically rewritable first nonvolatile memory (EEPROM 4 ) provided with a first region (system area 41 ) and a second region (user area 42 ).
- the first region is forbidden to access from the CPU in the second operation mode (user mode).
- An electrically non-rewritable second nonvolatile memory (ROM 3 ) provided with a third region (encryption area 32 ) and a fourth region (non-encryption area 31 ).
- the third region can store an encryption code as at least one of an encrypted instruction and encrypted data.
- a decrypter ( 1 ) which decrypts the encryption code read from the third region (encryption area 32 ) of the second nonvolatile memory (ROM 3 ) with the use of an encryption key and supplies the decrypted encryption code to the CPU in the second operation mode (user mode).
- a Communication Interface ( 5 )
- the encryption key writing method includes a first step ( 81 ) for inputting the encryption key from the exterior through the communication interface, and a second step ( 80 ) for writing the inputted encryption key, in the state of being divided into plural split keys, in plural distributed address areas in the first region (system area) of the first nonvolatile memory (EEPROM).
- EEPROM first nonvolatile memory
- the encryption key writing method further includes, before the second step, a third step ( 61 ) for confirming that the operation mode to be operated by the CPU is the first operation mode (system mode), a fourth step ( 63 ) for confirming that the plural split keys are not written in the plural address areas of the first nonvolatile memory (EEPROM), and a fifth step ( 90 ) for authenticating the write of the encryption key.
- the encryption key writing method further includes a sixth step ( 70 ) and a seventh step ( 62 ).
- the sixth Step ( 70 ) restores the encryption key and supplies it to the decrypter in the first operation mode (system mode), by reading and reconfigurating the plural split keys which are held in the first nonvolatile memory (EEPROM 4 ) in a distributed manner.
- the seventh step ( 62 ) shifts the operation mode of the CPU to the second operation mode (user mode).
- the plural distributed address areas in the first region (system area 41 ) of the first nonvolatile memory (EEPROM 4 ) for holding the plural split keys ( 12 ) are discontinuous with respect to the physical address in the first nonvolatile memory, and discontinuous with respect to the logical address for accessing by the CPU.
- At least one of the interval of the plural physical addresses corresponding to the plural distributed address areas in the first region (system area 41 ) of the first nonvolatile memory (EEPROM 4 ) for holding the plural split keys ( 12 ) and the interval of the plural logical addresses corresponding to the plural address areas is unequal.
- the encryption key writing method further includes the eighth step.
- the eighth step reads the key storing address ( 15 , 19 ) from one of the first region (system area 41 ) of the first nonvolatile memory (EEPROM 4 ) and the fourth region (non-encryption area 31 ) of the second nonvolatile memory (ROM 3 ).
- the key storing address ( 15 , 19 ) indicates each of the plural address areas for storing the plural split keys ( 12 ) in a distributed manner, in the first region (system area 41 ) of the first nonvolatile memory (EEPROM 4 ).
- the key storing address indicative of each of the plural address areas for storing the plural split keys ( 12 ) in the first region (system area 41 ) of the first nonvolatile memory (EEPROM 4 ) in a distributed manner can be calculated by use of a base point address ( 16 ) and a deviation ( 17 ).
- the encryption key writing method further includes the ninth step ( 83 , 84 ) which inputs the base point address and the deviation from the exterior through the communication interface.
- FIG. 1 is a block diagram illustrating a configuration of a semiconductor device 1 according to Embodiment 1.
- a decrypter 1 , a CPU 2 , a ROM 3 which is an electrically non-rewritable nonvolatile memory, and an EEPROM 4 which is an electrically rewritable nonvolatile memory are coupled with each other through an address bus 7 and a data bus 8 .
- the CPU 2 can operate in several operation modes including a system mode and a user mode.
- the ROM 3 is provided with an encryption area 32 for storing an encryption code which includes at least one of an encrypted instruction and encrypted data, and a non-encryption area 31 for storing at least one of a non-encrypted instruction and non-encrypted data.
- the EEPROM 4 is provided with a system area 41 where an access from the CPU 2 is allowed in the system mode but forbidden in the user mode, and a user area 42 where the access from the CPU 2 is allowed in either of the modes.
- the system area 41 of the EEPROM 4 is provided with plural address areas for storing plural split keys 12 which compose an encryption key 11 to be used for decrypting the encryption code stored in the encryption area 32 of the ROM 3 .
- the non-encryption area 31 of the ROM 3 stores an encryption key reading program 70 .
- the encryption key reading program 70 When the encryption key reading program 70 is executed by the CPU 2 in the system mode, the plural split keys 12 held in the EEPROM 4 in a distributed manner are read and reconfigured to restore the encryption key 11 , which is then supplied to the decrypter 1 .
- the decrypter 1 holds the encryption key 11 , decrypts the encryption code read from the encryption area 32 of the ROM 3 with the use of the encryption key 11 in the user mode, and supplied the decrypted encryption code to the CPU 2 .
- a user program which should be protected is encrypted in advance with the use of the encryption key 11 and stored in the encryption area 32 of the ROM 3 . Even if the contents of the encryption area 32 of the ROM 3 are decoded, it is possible to maintain the secrecy of the contents of the user program which should be protected, unless the correct encryption key 11 is known.
- the encryption key 11 is divided into the split keys which are plural bit strings, and is stored in the system area of the EEPROM 4 in a distributed manner. By dividing and distributing, the combination number for reconfigurating can be increased and the security level can be improved.
- the split keys 12 which have been divided and stored in a distributed manner are read from the EEPROM 4 by the encryption key reading program 70 which is executed after the power-on, and the reconfigurated encryption key 11 is written in the decrypter 1 . Subsequently, the user program stored in the encryption area 32 of the ROM 3 is decrypted by the decrypter 1 with the use of the encryption key 11 , and supplied to the CPU 2 as an executable program.
- the system area 41 of the EEPROM 4 is not allowed to access in the user mode; therefore, it is protected from a dumping attack. Even if the contents of the EEPROM 4 are dumped, the encryption key is divided and stored in a distributed manner; therefore, the search space of the encryption key is enlarged, leading to the improved security level.
- the decrypter 1 is provided with an enabling bit 13 which specifies whether to decrypt a cipher or to supply the CPU 2 with the inputted code as it is.
- the encryption key reading program 70 is executed before the encryption key 11 is set to the decrypter 1 .
- the decrypter 1 is set up not to perform decrypting by the enabling bit 13 .
- the decrypter 1 is provided with a register for holding the encryption key 11 .
- an initial value of the register that is, a reset value immediately after power-on can be utilized as an initial value of the encryption key 11 .
- a program such as the encryption key reading program 70 which cannot be executed if encrypted by the correct encryption key 11 is encrypted in advance with the use of the initial value of the encryption key 11 which is the reset value of the register.
- the decrypter 1 can perform the decryption with the use of the initial value of the register as the encryption key until the correct encryption key 11 is written in.
- the encryption key reading program 70 is called from a reset routine 60 which operates immediately after the power-on of the semiconductor device.
- the reset routine 60 is executed before the encryption key 11 is set in the decrypter 1 , as is the case with the encryption key reading program 70 . Therefore, it is necessary that the reset routine 60 is encrypted in a simple way as described above or not encrypted.
- the reset routine 60 is also stored in the non-encryption area 31 of the ROM 3 .
- the EEPROM 4 is provided, in the system area 41 , with a region which stores a key written flag 14 indicative of whether the split keys 12 are already written or not.
- a key written flag 14 indicative of whether the split keys 12 are already written or not.
- FIG. 2 is a flow chart illustrating an example of the reset routine in the semiconductor device according to Embodiment 1.
- the reset routine 60 is activated by the power-on reset.
- the operation mode to be operated by the CPU 2 is determined (Step 61 ).
- the operation mode to be operated by the CPU 2 is specified by the state of a terminal in an ordinary microcomputer.
- a microcomputer which is employed for an IC card with a high security level cannot provide such a terminal. Accordingly, the operation mode is specified by a nonvolatile memory such as the EEPROM 4 , or the like.
- the present determining (Step 61 ) itself operates in the system mode.
- the operation mode to be operated by the CPU 2 is the user mode
- the operation mode is changed to the user mode (Step 62 ) after the key reading 70 _ 2 is performed.
- the key reading 70 _ 2 the split keys 12 are read from the EEPROM 4 , and the reconfigurated encryption key 11 is written in the decrypter 1 .
- the user program stored in the encryption area 32 of the ROM 3 is decrypted by the decrypter 1 with the use of the encryption key 11 , and supplied to the CPU 2 as a program executable in the user mode.
- Step 63 When the operation mode to be operated by the CPU 2 is the system mode, it is determined whether the split keys 12 are already written in the EEPROM 4 or not written yet (Step 63 ). At this time, it is preferable to read the key written flag 14 for the determining.
- the key reading 70 _ 1 is performed to read the split keys 12 , and the reconfigurated encryption key 11 is written in the decrypter 1 .
- the authentication for the system mode is performed (Step 64 ).
- authenticating When authenticating is successful (Step 65 ), operation in the system mode is started. On the contrary, when authenticating is unsuccessful (Step 65 ), an error processing (Step 66 _ 1 ) is performed, and the system is reset.
- the security level can be improved by authenticating before starting the operation in the system mode.
- Step 63 When it is determined that the operation mode to be operated by the CPU 2 is the system mode and the split keys 12 are not yet written in the EEPROM 4 (Step 63 ), the authentication for key writing (Step 90 ) is performed. As a result, when authenticating is successful (Step 67 ), the key writing (Step 80 ) is performed, and the system is reset. When authenticating is unsuccessful (Step 67 ), an error processing (Step 66 _ 2 ) is performed, and the system is reset.
- the encryption key 11 is received from the exterior and divided into plural bit strings to generate the split keys 12 .
- the split keys 12 are written in the system area 41 of the EEPROM 4 in a distributed manner. It is also preferable that plural split keys 12 generated by dividing the encryption key 11 into plural bit strings externally in advance may be written in the system area 41 of the EEPROM 4 in a distributed manner. With this configuration, it is possible to divide the encryption key and to write it in a semiconductor device in a distributed manner, after manufacture of the semiconductor device.
- the configuration is designed such that, in the user mode, the key writing (Step 80 ) is not executed when the key is already written and when authenticating is unsuccessful in the authentication for key writing (Step 90 ).
- this configuration it is possible to improve the security level against an attack which tries to search for a true value of the encryption key by rewriting intentionally the split keys 12 written in the EEPROM 4 one by one.
- the key written flag 14 may be formed by one bit; however, it is more preferable that the key written flag 14 is formed by plural bits managed secretly. With this configuration, it is possible to improve the security level against an attack trying to rewrite the key written flag 14 intentionally.
- One of the indices expressing the security level of a cipher is the magnitude of the search space of an encryption key. For example, when the encryption key is 128 bits, a true encryption key is surely included in 2 128 kinds of combination. Therefore, the magnitude of the search space is 2 128 .
- the security level does not deteriorate.
- a key of 128 bits (16B) is collectively stored in one place of the memory space of 256 KB on the other hand, the combination of how to cut out 16B from the memory space of 256 KB becomes 218 kinds. Compared with the search space of 2 128 which the encryption key has originally, the search space is reduced greatly. Therefore, the security level deteriorates markedly.
- the number of dividing the encryption key can be decided on the basis of the search space of the key, with the size of the real address space of a memory for storing the key as a parameter.
- the search space can be expressed as follows.
- R expresses the size of the real address space of the memory
- L expresses the number of divisions of the key
- M expresses the bit length of the key
- mi expresses the bit length of the i-th split key of the divided split keys.
- the real storage space is larger than the bit length of the key; therefore, it is possible to assume the relation as follows.
- the encryption key is protected from the dumping attack by storing the split keys in the system area of the EEPROM 4 to which an access in the user mode is very difficult. Furthermore, by choosing the number of divisions of the encryption key appropriately as described above, it is possible to keep the search space large enough, even if the security is broken and the dumping attack is allowed.
- the split keys In order to realize a large search space by division of the key as described above, it is preferable to store the split keys in discontinuous addresses in the memory. This is because the division effect will be lost when the split keys are stored in continuous addresses and the aggressor knows the fact. Even when stored in discontinuous addresses, if the address interval is equal, the division effect will be lost when the aggressor knows the fact. Therefore, it is preferable that the address interval is unequal.
- the address in the present case refers to the physical address of the memory and the logical address seen from the CPU. Although it is preferable that both of the physical address and the logical address are unequal, even when only one of them is discontinuous, there is the improvement effect of the security level.
- the semiconductor device illustrated in FIG. 1 can be formed overlying a single semiconductor substrate using the well-known integrated circuit manufacturing method.
- FIG. 3 is a block diagram illustrating a configuration of an LSI according to Embodiment 1.
- the LSI 9 is formed overlying a single silicon substrate for example.
- the LSI 9 is configured with a decrypter 1 , a CPU 2 , a ROM 3 , an EEPROM 4 , a UART 5 , and a RAM 6 , which are coupled with each other via an address bus 7 and a data bus 8 .
- the UART 5 is a Universal Asynchronous Receiver Transmitter.
- the UART 5 may be a USART (Universal Synchronous and Asynchronous Receiver Transmitter) with a synchronous receiver transmitter added.
- the communication interface is not restricted to the UART or the USART but may be any kind of communication interface.
- the LSI 9 is provided with terminals of a power source including a VCC and a GND, a reset, a clock, and a signal terminal of the UART 5 .
- the LSI 9 may be provided with several spare terminals.
- the clock terminal can be omitted.
- the reset terminal can be also omitted.
- an encryption key for the decryption is not set up in a ROM or a circuit in a chip in advance, but written in an electrically rewritable nonvolatile memory, such as an EEPROM, after manufacturing. Thereby, the risk of the key leakage by reverse engineering is reduced.
- the program is stored in the state of being encrypted and cannot be executed by the CPU 2 .
- the program can be utilizes after the encryption key is written. When shipped to a user, it is possible to prohibit accessing in the user mode to the contents of the non-encryption area 31 of the ROM 3 , such as a setup of the encryption key.
- the encryption key write program 80 In order to write the encryption key, by dividing or already divided, in the system area 41 of the EEPROM 4 in a distributed manner, the encryption key write program 80 is executed.
- the encryption key write program 80 must be executed before the write of the encryption key. Therefore, the instruction code thereof cannot be encrypted inevitably, and is stored in the non-encryption area 31 of the ROM 3 .
- the encryption key writing program 80 is once written in the RAM 6 or the EEPROM 4 before shipping, in lieu of being stored in the LSI, and is executed to write the encryption key in a distributed manner. Then, the encryption key writing program 80 written in the RAM 6 or the EEPROM 4 is erased before shipping. Accordingly, it is possible to protect from an attack which knows the contents of the encryption key writing program 80 .
- the setup which allows execution of the non-encrypted program in the RAM 6 or the EEPROM 4 is left in the LSI. In that sense, the vulnerability may be caused.
- FIG. 4 is a memory map of a ROM and an EEPROM in the present embodiment in which a key storing address specifies an address to store split keys.
- the key storing address is assigned to a different region in the logical address space seen from the CPU 2 .
- the ROM 3 is provided with a non-encryption area 31 and an encryption area 32
- the EEPROM 4 is provided with a system area 41 and a user area 42 .
- the key storing addresses 19 _ 1 , 19 _ 2 , and 19 _ 3 and the key written flag storing address 18 are respectively values of the addresses for storing the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 and the key written flag 14 in the system area 41 of the EEPROM 4 .
- the key storing addresses 19 _ 1 , 19 _ 2 , and 19 _ 3 and the key written flag storing address 18 are stored in the non-encryption area of the ROM 3 .
- the reset routine 60 determines whether the key write is completed or not at Step 63 as shown by the flow chart illustrated in FIG. 2 .
- the key written flag 14 of the EEPROM 4 is read and the value is determined.
- the key writing 80 writes the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 in the EEPROM 4 according to the key storing address 19 _ 1 , 19 _ 2 , and 19 _ 3 .
- the key reading 70 _ 1 and 70 _ 2 reads the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 from the EEPROM 4 according to the key storing addresses 19 _ 1 , 19 _ 2 , and 19 _ 3 , and writes them in the decrypter 1 .
- FIG. 10 is a flow chart illustrating key reading (loop) in the present embodiment in which a key storing address specifies an address to store split keys.
- the i-th split key 12 _i in the EEPROM 4 is fetched into a general-purpose register of the CPU 2 (Step 71 ), and the i-th split key 12 _i fetched into the general-purpose register is written in a register corresponding to the i-th split key 12 _i in the key registers of the decrypter 1 (Step 72 ).
- Steps 71 and 72 are repeatedly executed by the loop repeating i from 1 to L.
- FIG. 11 is a flow chart illustrating the key reading (loop unrolling) in the present embodiment.
- the key reading illustrated in FIG. 11 is executed, not by using a loop but by the instruction codes which describe sequentially L-piece instruction codes of the split key reading from the EEPROM 4 (Step 71 ) and the key writing to the decrypter 1 (Step 72 ).
- Step 71 the instruction codes which describe sequentially L-piece instruction codes of the split key reading from the EEPROM 4
- Step 72 the key writing to the decrypter 1
- the encryption key writing program 80 is stored in the non-encryption area 31 of the ROM 3 . Therefore, it cannot deny a possibility that the encryption key writing program 80 may be known by an aggressor through an attack of optical observation of the ROM 3 .
- the specification method of the address for storing the split keys described in Embodiment 2 has a possibility that the address of the EEPROM 4 at which the split keys 12 are stored may be detected, by observing the ROM 3 and analyzing the contents of the encryption key writing program 80 .
- the split keys 12 are stored in the system area 41 of the EEPROM 4 ; accordingly, granting that the design makes it difficult for the user to access, it is degradation of the security level that the address to store the split keys 12 is detected.
- Embodiments 3 and 4 present a specification method of the address to store the split keys, in which a serious degradation of the security level is not caused even by the analysis of the contents of the encryption key writing program 80 .
- FIG. 5 is a memory map of a ROM and an EEPROM in the present embodiment in which a key address storing address specifies a key address and the key address specifies an address to store the split keys. These addresses are assigned to different regions in the logical address space seen from the CPU 2 .
- the ROM 3 is provided with a non-encryption area 31 and an encryption area 32
- the EEPROM 4 is provided with a system area 41 and a user area 42 .
- the addresses to write the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 are stored in the system area 41 of the EEPROM 4 as the key addresses 15 _ 1 , 15 _ 2 , and 15 _ 3 .
- the addresses to store the key addresses 15 _ 1 , 15 _ 2 , and 15 _ 3 are stored in the non-encryption area of the ROM 3 as the key address storing addresses 20 _ 1 , 20 _ 2 , and 20 _ 3 .
- the address to store the key written flag 14 is specified by the key written flag storing address 18 , as is the case with Embodiment 2.
- the reset routine 60 determines whether the key write is completed or not at Step 63 as shown by the flow chart illustrated in FIG. 2 .
- the key written flag 14 of the EEPROM 4 is read and the value is determined.
- the key addresses 15 _ 1 , 15 _ 2 , and 15 _ 3 are inputted from the exterior, via the UART 5 for example, and are written in the system area 41 of the EEPROM 4 which is specified by the key address storing addresses 20 _ 1 , 20 _ 2 , and 20 _ 3 .
- the key writing 80 writes the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 in the EEPROM 4 , according to the key addresses 15 _ 1 , 15 _ 2 , and 15 _ 3 .
- the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 are inputted from the exterior, via the UART 5 for example.
- the key reading 70 _ 1 and 70 _ 2 read the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 from the EEPROM 4 according to the key addresses 15 _ 1 , 15 _ 2 , and 15 _ 3 and write them in the decrypter 1 .
- the EEPROM 4 stores information by means of the change of an electric state; accordingly, it is substantially impossible to read the information by the optical observation. Therefore, the security level is higher than the ROM 3 .
- FIG. 12 is a flow chart illustrating key reading (loop) in the present embodiment in which a key address storing address specifies a key address and the key address specifies an address to store split keys.
- a key address 15 _i which is the address at which the i-th split key 12 _i is stored in the EEPROM 4 is fetched into a general-purpose register of the CPU 2 (Step 75 ).
- the i-th split key 12 _i is fetched from the EEPROM 4 at the address indicated by the general-purpose register of the CPU 2 into the general-purpose register of the CPU 2 (Step 71 ).
- Step 72 The i-th split key 12 _i fetched into the general-purpose register is written to a register corresponding to the i-th split key 12 _i in the key registers of the decrypter 1 (Step 72 ). Assuming that the number of divisions of the encryption key is L, Steps 75 , 71 , and 72 are repeatedly executed by the loop repeating i from 1 to L.
- Step 71 serves as a load instruction by the register indirect addressing, and the value of the general-purpose register is determined by the load instruction at Step 75 executed before that.
- FIG. 13 is a flow chart illustrating the key reading (loop unrolling) in the present embodiment.
- the key reading according to the present embodiment is executed, not by using a loop, but by the instruction code which describes sequentially L-piece instruction codes of Steps 75 , 71 , and 72 .
- Embodiment 2 by eliminating the loop control, it is possible to improve the security level against an attack which rewrites only a portion of the key location by destroying temporarily the read value of the register for controlling a loop by means of laser radiation etc. and reducing the loop count.
- the address to store the split keys is specified through the intermediary of an indirect pointer, such that a key address storing address specifies a key address and the key address specifies an address to store the split keys. Accordingly, tracking is made difficult and the security level is improved. In contrast with this, in the present embodiment, tracking is made difficult with the use of a certain function for specifying the address to store the split keys. Accordingly, the security level is improved. For example, the address to store the split keys is calculated from a base point address and a deviation.
- FIG. 6 is a memory map of a ROM and an EEPROM in the present embodiment in which a base point and a deviation specify an address to store the split keys.
- the these addresses are assigned to respectively different regions in the logical address space seen from the CPU 2 .
- the ROM 3 is provided with a non-encryption area 31 and an encryption area 32
- the EEPROM 4 is provided with a system area 41 and a user area 42 .
- the addresses to write the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 are given by the sum of the base point addresses 16 _ 1 , 16 _ 2 , and 16 _ 3 and the deviations 17 _ 1 , 17 _ 2 and 17 _ 3 , respectively.
- the base point addresses 16 _ 1 , 16 _ 2 , and 16 _ 3 and the deviations 17 _ 1 , 17 _ 2 , and 17 _ 3 are stored in the system area 41 of the EEPROM 4 .
- the addresses to store the base point addresses 16 _ 1 , 16 _ 2 , and 16 _ 3 and the deviations 17 _ 1 , 17 _ 2 , and 17 _ 3 are respectively stored in the non-encryption area of the ROM 3 as the base point address storing addresses 21 _ 1 , 21 _ 2 , and 21 _ 3 and the deviation storing addresses 22 _ 1 , 22 _ 2 , and 22 _ 3 .
- the address to store the key written flag 14 is specified by the key written flag storing address 18 , as is the case with Embodiments 2 and 3.
- the reset routine 60 determines whether the key write is completed or not at Step 63 as shown by the flow chart illustrated in FIG. 2 .
- the key written flag 14 of the EEPROM 4 is read and the value is determined.
- the base point addresses 16 _ 1 , 16 _ 2 , and 16 _ 3 and the deviations 17 _ 1 , 17 _ 2 , and 17 _ 3 are inputted from the exterior, for example via the UART 5 , and written in the system area 41 of the EEPROM 4 specified by the base point address storing addresses 21 _ 1 , 21 _ 2 , and 21 _ 3 and the deviation storing addresses 22 _ 1 , 22 _ 2 and 22 _ 3 .
- the key writing 80 reads the base point addresses 16 _ 1 , 16 _ 2 , and 16 _ 3 and the deviations 17 _ 1 , 17 _ 2 , and 17 _ 3 , from the system area 41 of the EEPROM 4 specified by the base point address storing addresses 21 _ 1 , 21 _ 2 , and 21 _ 3 and the deviation storing addresses 22 _ 1 , 22 _ 2 and 22 _ 3 , and calculates the address to store the split keys. According to the calculated address, the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 are written in the EEPROM 4 .
- FIG. 9 is an explanatory diagram illustrating an example of a communication flow in the key writing in the present embodiment.
- a chip of the semiconductor device such as the LSI illustrated in FIG. 1 or 3 , is coupled to a card reader writer via a communication interface, such as the UART 5 .
- the card reader writer is not a card reader writer that a general user uses but it should be a special one that can operate the chip in the system mode and can write in the system area of the EEPROM 4 . If an equivalent function is provided with, a logic tester of an LSI or the like may be sufficient.
- the base point address 16 _ 1 , the deviation 17 _ 1 , and the corresponding split key 12 _ 1 are transmitted from the card reader writer to the chip via the communication interface, such as the UART 5 , as the base point address 83 _ 1 , the deviation 84 _ 1 , and the split key 81 _ 1 , respectively.
- the chip calculates the address to store by adding the base point address 16 _ 1 and the deviation 17 _ 1 , and writes the split key 12 _ 1 in the calculated address.
- a key writing completion status 82 _ 1 is sent to the card reader writer.
- the present procedure is repeated L times as the number of divisions.
- the key reading 70 _ 1 and 70 _ 2 read out the base point addresses 16 _ 1 , 16 _ 2 , and 16 _ 3 and the deviations 17 _ 1 , 17 _ 2 and 17 _ 3 , from the system area 41 of the EEPROM 4 specified by the base point address storing addresses 21 _ 1 , 21 _ 2 , and 21 _ 3 and the deviation storing address 22 _ 1 , 22 _ 2 , and 22 _ 3 , and calculates the address to store the split keys. According to the calculated address, the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 are read from the EEPROM 4 and written in the decrypter 1 .
- the address itself to store the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 (corresponding to the key storing addresses 19 _ 1 , 19 _ 2 , and 19 _ 3 in Embodiment 2 and the key addresses 15 _ 1 , 15 _ 2 , and 15 _ 3 in Embodiment 3) is not stored in any memory of the device.
- this configuration even if the contents of the system area 41 of the EEPROM 4 are dumped by an attack, it is difficult to obtain the address to store the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 ; accordingly, it is possible to improve the security level.
- the function for calculating the address to store the split keys 12 _ 1 , 12 _ 2 , and 12 _ 3 can be determined arbitrarily.
- the present embodiment specifies the address to store the split keys by a different base point address for every split keys. However, it is also preferable to specify the address to store the split keys by one base point address and plural deviations. In addition, it is also preferable to employ any kind of function for the calculation.
- the function itself is stored in the non-encryption area of the ROM 3 as a part of the program, it is preferable to store the parameter (the base point address and the deviation in the present embodiment) in the system area 41 of the EEPROM 4 .
- FIG. 14 is a flow chart illustrating key reading (loop) in the present embodiment in which a base point address and a deviation specify an address to store split keys.
- the base point address 16 _i of the i-th split key 12 _i stored in the EEPROM 4 is fetched into a general-purpose register 1 of the CPU 2 (Step 73 ), and the deviation 17 _i is fetched into a general-purpose register 2 of the CPU 2 (Step 74 ).
- the sum of the general-purpose register 1 and the general-purpose register 2 is calculated and stored in the general-purpose register 3 (Step 75 ). This is the address which should store the i-th split key 12 _i.
- the i-th split key 12 _i is fetched from the EEPROM 4 at the address indicated by the general-purpose register 3 into the general-purpose register 4 of the CPU 2 (Step 71 ).
- the i-th split key 12 _i fetched into the general-purpose register 4 is written to a register corresponding to the i-th split key 12 _i in the key registers of the decrypter 1 (Step 72 ). Assuming that the number of divisions of the encryption key is L, Steps 73 , 74 , 75 , 71 , and 72 are repeatedly executed by the loop repeating i from 1 to L.
- FIG. 15 is a flow chart illustrating the key reading (loop unrolling) in the present embodiment.
- the key reading according to the present embodiment is executed, not by using a loop, but by the instruction code which describes sequentially L-piece instruction codes of Steps 73 , 74 , 75 , 71 , and 72 .
- the instruction code which describes sequentially L-piece instruction codes of Steps 73 , 74 , 75 , 71 , and 72 .
- Embodiments 2 and 3 by eliminating the loop control, it is possible to improve the security level against an attack which rewrites only a portion of the key location by destroying temporarily the read value of the register for controlling a loop by means of laser radiation etc. and reducing the loop count.
- Step 90 Authentication for key writing
- a hash value of the secret input data for authentication is stored in the ROM as an expectation value, and when authenticating, the input data for generating the hash value is employed for the authentication.
- the key information of a block cipher is set as the secret information for authentication
- a plaintext is encrypted by the key of the block cipher for authentication as a ciphertext and the pair of the plaintext and the ciphertext are stored in a ROM
- the key information is inputted as an input value
- the plaintext stored in the ROM is encrypted by the key inputted, and it is examined whether the ciphertext stored in the ROM is obtained.
- FIG. 7 is an explanatory diagram illustrating an example of a communication flow in key write authentication and key writing.
- the chip of the semiconductor device such as the LSI illustrated in FIG. 1 or 3
- a card reader writer via a communication interface, such as the UART 5 .
- the card reader writer is not a card reader writer that a general user uses but it should be a special one that can operate the chip in the system mode and can write in the system area of the EEPROM 4 . If an equivalent function is provided with, a logic tester of an LSI or the like may be sufficient.
- the chip holds p, e, and N in the ROM 3 .
- An authentication success status 94 is transmitted to the card reader writer and the authenticating for key writing is completed, then, the flow moves to the key writing (Step 80 ).
- p′ ⁇ p the authentication is unsuccessful, and error processing (Step 66 _ 2 ) is performed, then, the flow terminates (reset).
- the key writing (Step 80 ) information 81 of the encryption key 11 stored in the encryption region of the ROM 3 is transmitted from the card reader writer to the chip.
- the entire of the encryption key 11 may be transmitted collectively, or the encryption key 11 may be divided in advance and transmitted as the split keys 12 .
- the chip performs writing of the key and sets up a key written flag 14 . Subsequently, the chip transmits a key writing completion status 82 to the card reader writer, and the key writing (Step 80 ) is completed.
- FIG. 8 is an explanatory diagram illustrating another example of a communication flow in key write authentication and key writing.
- the card reader writer transmits an authentication start command 91 to the chip via the communication interface such as the UART.
- the chip holds e and N in the ROM 3 , but does not hold the expectation value p.
- the chip When the authentication start command 91 is received, the chip generates a random number p employed as an expectation value, and transmits it to the card reader writer as an authentication random number 92 .
- An authentication success status 94 is transmitted to the card reader writer and the authenticating for key writing is completed, then, the flow moves to the key writing (Step 80 ).
- the authentication is unsuccessful, and error processing (Step 66 _ 2 ) is performed, then, the flow terminates (reset). Subsequently, the key writing (Step 80 ) same as in the explanation of FIG. 7 is performed.
- the expectation value p of authentication is not stored in the ROM 3 , but it is generated internally as a random number for every authenticating. Therefore, the security level is higher.
- the explanation is made for the number of divisions of the encryption key of three; however, the number of divisions is not restricted to three. It is preferable to set the number of divisions of the encryption key appropriately as explained in Embodiment 1.
- the embodiment in which the semiconductor device is formed overlying a single semiconductor chip is explained with reference to FIG. 3 .
- the present invention is not restricted to the embodiment.
- the semiconductor device is implemented as a multichip module formed by laminating plural chips.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Physics & Mathematics (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Storage Device Security (AREA)
Abstract
A semiconductor device includes a central processing unit (CPU), a first memory which stores a plurality of split keys, a second memory which stores an encryption code as at least one of an encrypted instruction and encrypted data, the plurality of split keys including an encryption key for decrypting the encryption code, and a decrypter which reads the encryption code from the second memory, decrypts the encryption code with the use of the encryption key, and supplies the decrypted encryption code to the CPU. The second memory stores an encryption key reading program which is executed by the CPU to restore the encryption key and to supply the encryption key to the decrypter, by reading and reconfiguring the split keys stored in the first memory in a distributed manner.
Description
- This Application is a Continuation Application of U.S. patent application Ser. No. 14/061,619, which was filed on Oct. 23, 2013, and the disclosure of which is incorporated herein in its entirety by reference thereto.
- The disclosure of Japanese Patent Application No. 2012-240051 filed on Oct. 31, 2012 including the specification, drawings and abstract is incorporated herein by reference in its entirety.
- The present invention relates to a semiconductor device mounted in an IC (Integrated Circuit) card as an example, provided with a CPU and a ROM (Read Only Memory) which stores an encrypted program to be used by the CPU, and in particular, relates to a technology which can be suitably utilized for improvement of the security level against an attack trying to illegally read the encrypted program.
- Generally an IC card is provided as a SoC (System on Chip) (microcomputer) in which a ROM, a RAM (Random Access Memory), an EEPROM (Electrically Erasable Programmable Read-Only Memory), and a CPU (Central Processing Unit) are integrated into a single chip. The IC card is provided with the required minimum number of external terminals, such as a power source, a ground, a clock, a reset, and a serial communication interface. The configuration of the IC card does not allow a direct access to the internal memory thereof and the exchange of data is always performed through serial communication; accordingly the secrecy of the memory content has been assured.
- However, the analysis of security equipment by reverse engineering is posing an issue, in association with the advancement in performance of an analysis device. Especially, the reverse engineering of a ROM is posing such an actual threat that the contents of the firmware stored in the ROM are read out. Hitherto, scrambling by a simple combinational circuit has been performed. The configuration of a scramble circuit is kept in secrecy and the secrecy has guaranteed the secrecy of the firmware. However, the advancement in the reverse engineering technology is now allowing even the analysis of the scramble circuit. In view of the above circumstances, it is required to establish encryption of the contents of a ROM such that the firmware cannot be analyzed only by a simple readout of a ROM pattern. In encryption, the secrecy of a method or the secrecy of a key will improve the security level against an attack trying to illegally read out an encrypted program. When an attack which can decode the contents of the ROM with reverse engineering is assumed, it is expected that an encryption method is also analyzed from the physical analysis of the circuit configuration. Accordingly, an encryption key is stored in an electrically rewritable nonvolatile memory, thereby making it difficult to read out the encryption key only by the reverse engineering by means of the optical observation of a physical shape or a circuit configuration.
-
Patent Literature 1 andPatent Literature 2 disclose inventions concerning security equipment which encrypts and stores a program. The encrypted program is decrypted by use of an encryption key, developed into another storage device, and executed subsequently. - In the IC card, before encryption is performed for the purpose of secrecy of a program which is firmware, the encryption technology has been widely utilized for the purpose of keeping the secrecy of the stored user information and communication, and several methods are known as for storage of the encryption key for that.
Patent Literature 3 andPatent Literature 4 disclose technology which improves the security level against an attack trying to read out an encryption key illegally. That is,Patent Literature 3 discloses technology for storing the encryption key in a memory area in an IC card where read-out from the exterior is absolutely difficult, andPatent Literature 4 discloses technology for dividing the encryption key and storing the divided keys in distributed regions in one storage device. Patent Literature 5 discloses technology in which the key information of plural encryption keys is managed in a split manner or in a batch, thereby storing the key information efficiently. - (Patent Literature 1) Published Japanese Unexamined Patent Application No. 2000-155819
- (Patent Literature 2) Published Japanese Unexamined Patent Application No. 2003-333027
- (Patent Literature 3) Published Japanese Unexamined Patent Application No. Hei 04(1992)-102185
- (Patent Literature 4) Published Japanese Unexamined Patent Application No. 2000-252973
- (Patent Literature 5) Published Japanese Unexamined Patent Application No. 2012-080295
- The examination performed by the present inventors on
Patent Literatures -
Patent Literature 1 does not describe about a storing method of an encryption key, in particular, about the technology that improves the security level against an attack trying to illegally read out the encryption key.Patent Literature 2 describes the technology in which an encryption key is divided and stored in plural storage devices in a distributed manner; however, it is necessary to provide plural storage devices, accordingly, it is difficult to employ the technology in a small-scale system such as an IC card. - The storing method of an encryption key described in
Patent Literatures - Even if the storing method of an encryption key disclosed by
Patent Literature 3 andPatent Literature 4 is applied to the technology disclosed byPatent Literature 1 andPatent Literature 2, it is difficult to improve the security level against an attack trying to read out a program illegally. The reason is as follows. That is, in the technology disclosed byPatent Literature 1 andPatent Literature 2, the encrypted program is decrypted with the use of an encryption key, developed in another storage device, and executed subsequently. Therefore, keeping the secrecy of the encryption key is meaningless to an attack trying to read the developed program which has become a plaintext program after the decryption. - The solution to such issues is explained in the following. The other issues and new features of the present invention will become clear from the description of the present specification and the accompanying drawings.
- One embodiment is as follows.
- That is, a semiconductor device is provided with a CPU, an electrically rewritable EEPROM, and an electrically non-rewritable ROM. An encryption area and a non-encryption area are provided in the ROM, and encrypted firmware is stored in the encryption area. The semiconductor device is provided with a decrypter which holds an encryption key, decrypts the encrypted firmware and supplies the decrypted firmware to the CPU. The CPU operates in one of operation modes including a system mode and a user mode. The EEPROM is provided with a system area to which an access from the CPU is forbidden in the user mode. An encryption key which has encrypted the firmware is divided into split keys formed by plural bit strings, and is stored in distributed address areas in the system area of the EEPROM.
- An encryption key reading program which is not encrypted is stored in the non-encryption area of the ROM. By executing the program by the CPU, the plural split keys held in the EEPROM in a distributed manner are read and reconfigured to restore the encryption key which is then supplied to the decrypter.
- Here, the CPU is a processor which interprets and executes an instruction code provided, and is not restricted by the architecture thereof. The CPU may be a CPU of a microcomputer or a micro controller or it may be a multiple-processor and a DSP (Digital Signal Processor).
- The effect obtained by the one embodiment is as follows when explained briefly.
- That is, it is possible to improve the security level to an attack trying to illegally read out the encrypted program stored in the encryption area of the ROM.
-
FIG. 1 is a block diagram illustrating a configuration of asemiconductor device 1 according toEmbodiment 1; -
FIG. 2 is a flow chart illustrating an example of a reset routine in the semiconductor device according toEmbodiment 1; -
FIG. 3 is a block diagram illustrating a configuration of an LSI according toEmbodiment 1; -
FIG. 4 is a memory map of a ROM and an EEPROM in an embodiment in which a key storing address specifies an address to store split keys; -
FIG. 5 is a memory map of a ROM and an EEPROM in an embodiment in which a key address storing address specifies a key address and the key address specifies an address to store split keys; -
FIG. 6 is a memory map of a ROM and an EEPROM in an embodiment in which a base point and a deviation specify an address to store split keys; -
FIG. 7 is an explanatory diagram illustrating an example of a communication flow in key write authentication and key writing; -
FIG. 8 is an explanatory diagram illustrating another example of a communication flow in key write authentication and key writing; -
FIG. 9 is an explanatory diagram illustrating an example of a communication flow in key writing in an embodiment in which a base point address and a deviation specify an address to store split keys; -
FIG. 10 is a flow chart illustrating key reading (loop) in an embodiment in which a key storing address specifies an address to store split keys; -
FIG. 11 is a flow chart illustrating key reading (loop unrolling) in an embodiment in which a key storing address specifies an address to store split keys; -
FIG. 12 is a flow chart illustrating key reading (loop) in an embodiment in which a key address storing address specifies a key address and the key address specifies an address to store split keys; -
FIG. 13 is a flow chart illustrating key reading (loop unrolling) in an embodiment in which a key address storing address specifies a key address and the key address specifies an address to store split keys; -
FIG. 14 is a flow chart illustrating key reading (loop) in an embodiment in which a base point address and a deviation specify an address to store split keys; and -
FIG. 15 is a flow chart illustrating key reading (loop unrolling) in an embodiment in which a base point address and a deviation specify an address to store split keys. - 1. Outline of Embodiments
- First, an outline of a typical embodiment of the invention disclosed in the present application is explained. A numerical symbol of the drawing referred to in parentheses in the outline explanation about the typical embodiment only illustrates what is included in the concept of the component to which the numerical symbol is attached.
- (1) A Microcomputer which Divides an Encryption Key and Stores It in a System Area of an EEPROM in a Distributed Manner
- A semiconductor device (9) is provided with following elements. A CPU (
CPU 2, a central processing unit) which has a first operation mode (system mode) and a second operation mode (user mode). - An electrically rewritable first nonvolatile memory (EEPROM 4) provided with a first region (system area 41) and a second region (user area 42). The first region is forbidden to access from the CPU in the second operation mode (user mode).
- An electrically non-rewritable second nonvolatile memory (ROM 3) provided with a third region (encryption area 32) and a fourth region (non-encryption area 31). The third region can store an encryption code as at least one of an encrypted instruction and encrypted data.
- Here, the first nonvolatile memory (EEPROM 4) is provided with plural distributed address areas in the first region (system area 41), for holding plural split keys (12) composing an encryption key (11) for decrypting the encryption code.
- The decrypter holds the encryption key (11). In the second operation mode (user mode), the decrypter decrypts the encryption code read from the third region (encryption area 31) of the second nonvolatile memory with the use of the encryption key, and supplies the decrypted encryption code to the CPU.
- The second nonvolatile memory (ROM 3) holds an encryption key reading program in the fourth region (non-encryption area 31), which is executed by the CPU in the first operation mode (system mode) to restore the encryption key and to supply it to the decrypter, by reading and reconfigurating the plural split keys held in the first nonvolatile memory (EEPROM 4) in a distributed manner.
- With this configuration, it is possible to improve the security level against an attack trying to read out the encrypted program illegally.
- (2) An Encryption Key Writing Program>
- In
Paragraph 1, the semiconductor device is further provided with a communication interface (5). The second nonvolatile memory (ROM 3) holds an encryption key writing program (80) in the fourth region (non-encryption area 31). The encryption key writing program is executed by the CPU to input the encryption key from the exterior through the communication interface and to write the encryption key, in the state of being divided into the split keys, in the distributed address areas in the first region (system area 41) of the first nonvolatile memory (EEPROM). - With this configuration, it is possible to divide the encryption key and to write it in a semiconductor device in a distributed manner, after manufacture of the semiconductor device.
- (3) Authentication Before Encryption Key Writing
- In
Paragraph 2, the encryption key writing program executes an authentication step (90) for performing authentication, before the split keys are written in the first nonvolatile memory (EEPROM) With this configuration, it is possible to further improve the security level against an attack which tries to search for a true value of the encryption key by rewriting intentionally the divided encryption key written in the first nonvolatile memory (EEPROM). - (4) Prohibition of Key Writing in the Case of a User Mode and the Key Write Being Completed
- In
Paragraph 3, before the split keys are written in the first nonvolatile memory (EEPROM 4), Step (61) for determining that the operation mode to be operated by the CPU is the first operation mode (system mode) and Step (63) for determining whether the plural split keys are already written in the first nonvolatile memory (EEPROM 4) are executed. When the operation mode to be operated by the CPU is the first operation mode (system mode), and when the plural split keys are not yet written in, the encryption key writing program advances to the authentication step. - With this configuration, it is possible to further improve the security level against an attack which tries to search for a true value of the encryption key by rewriting intentionally the encryption key, in the user mode and in a state where the encryption key is already written in.
- (5) An Encryption Key Written Flag
- In
Paragraph 4, the first nonvolatile memory (EEPROM 4) is provided with a region (14) for holding data indicative of whether the plural split keys have already been written in the first region (system area 41). - With this configuration, it is possible to further improve the security level against an attack which tries to search for a true value of the encryption key by rewriting the encryption key written flag (14) intentionally.
- (6) An Encryption Key Written Flag Having Plural Bits
- In Paragraph 5, the data indicative of whether the split keys have already been written has plural bits. With this configuration, it is possible to further improve the security level against an attack which tries to rewrite the encryption key written flag (14) intentionally.
- (7) Authentication by RSA Encryption
- In one of
Paragraph 3 toParagraph 6, the authentication step includes a step in which, using public keys e and N and an expectation value p of RSA which are held and c inputted from the exterior, the remainder of the e-th power of c when divided by N is calculated and compared with p. - With this configuration, it is possible to further improve the security level of the authentication which is the premise for the encryption key writing.
- (8) Branching to a User Program after Transferring the Key to a Decrypter
- In
Paragraph 2, the second nonvolatile memory (ROM 3) holds a program (60) in the fourth region (non-encryption area 31), in which, when it is determined that the operation mode to be operated by the CPU is the second operation mode (user mode) (61), the CPU is shifted to the second operation mode (user mode) after the encryption key reading program is executed. The encryption key reading program is executed by the CPU in the first operation mode (system mode). - With this configuration, it becomes possible to execute the encrypted user program after the split keys (12) are read from the first nonvolatile memory (EEPROM 4) and the restored encryption key (11) is stored in the decrypter (1).
- (9) Distributing to Discontinuous Addresses
- In
Paragraph 1, the plural distributed address areas in the first region (system area 41) of the first nonvolatile memory (EEPROM 4) for holding the plural split keys (12) are discontinuous with respect to the physical address in the first nonvolatile memory (EEPROM 4) and discontinuous with respect to the logical address for accessing by the CPU. - With this configuration, even in the cases where the contents of the first region (system area 41) of the first nonvolatile memory (EEPROM 4) are dumped by an attack (dumping attack), it is possible to make broad the space to be searched for the value of the encryption key, thereby improving further the security level.
- (10) Distributing to Addresses with an Unequal Address Interval
- In
Paragraph 9, at least one of the interval of the plural physical addresses corresponding to the plural distributed address areas in the first region (system area 41) of the first nonvolatile memory (EEPROM 4) for holding the plural split keys (12) and the interval of the plural logical addresses corresponding to the plural address areas is unequal. With this configuration, even in the cases where the contents of the first region (system area 41) of the first nonvolatile memory (EEPROM 4) are dumped by an attack (dumping attack), it is possible to make further broader the space to be searched for the value of the encryption key, thereby improving further the security level. - (11) A Key Address Storing Address
- In
Paragraph 1, the first nonvolatile memory (EEPROM 4) is provided, in the first region (system area 41), with a key address storing area which stores plural key address values (15) of the plural address areas for storing the plural split keys, and the second nonvolatile memory (ROM 3) holds the address value (20) of the key address storing area in the fourth region (non-encryption area 31). - With this configuration, even in the cases where the contents of the first region (system area 41) of the first nonvolatile memory (EEPROM 4) are dumped by an attack (dumping attack), it is possible to make further broader the space to be searched for the value of the encryption key, thereby improving further the security level.
- (12) Distributing to Addresses Specified by a Base Point Address and a Deviation
- In
Paragraph 1, each of the plural addresses corresponding to the plural distributed address areas in the first region (system area 41) of the first nonvolatile memory (EEPROM 4) for holding the plural split keys (12) can be calculated by use of a base point address (16) and a deviation (17). The first nonvolatile memory (EEPROM 4) is provided with an address area in the first region (system area 41) for holding the base point address and the deviation. - With this configuration, even in the cases where the contents of the first region (system area 41) of the first nonvolatile memory (EEPROM 4) are dumped by an attack (dumping attack), it is possible to make further broader the space to be searched for the value of the encryption key, thereby improving further the security level.
- (13) A Single Chip
- In one of
Paragraph 1 toParagraph 12, the CPU (CPU 2), the first nonvolatile memory (EEPROM 4), the second nonvolatile memory (ROM 3), and the decrypter (1) are formed overlying a single semiconductor substrate. - With this configuration, it is possible to improve the security level against an attack by optical observation or electric probing-based signal observation.
- (14) An Encryption Key Writing Method
- An encryption key writing method for writing an encryption key to a semiconductor device (9) is provided. The semiconductor device is configured with the following elements.
- A CPU (2) which has a first operation mode (system mode) and a second operation mode (user mode).
- An electrically rewritable first nonvolatile memory (EEPROM 4) provided with a first region (system area 41) and a second region (user area 42). The first region is forbidden to access from the CPU in the second operation mode (user mode).
- An electrically non-rewritable second nonvolatile memory (ROM 3) provided with a third region (encryption area 32) and a fourth region (non-encryption area 31). The third region can store an encryption code as at least one of an encrypted instruction and encrypted data.
- A decrypter (1) which decrypts the encryption code read from the third region (encryption area 32) of the second nonvolatile memory (ROM 3) with the use of an encryption key and supplies the decrypted encryption code to the CPU in the second operation mode (user mode).
- The encryption key writing method includes a first step (81) for inputting the encryption key from the exterior through the communication interface, and a second step (80) for writing the inputted encryption key, in the state of being divided into plural split keys, in plural distributed address areas in the first region (system area) of the first nonvolatile memory (EEPROM). With this configuration, it is possible to improve the security level against an attack trying to read out the encrypted program illegally.
- (15) Confirmation of an Operation Mode and a Key Written Flag and Authentication
- In
Paragraph 14, the encryption key writing method further includes, before the second step, a third step (61) for confirming that the operation mode to be operated by the CPU is the first operation mode (system mode), a fourth step (63) for confirming that the plural split keys are not written in the plural address areas of the first nonvolatile memory (EEPROM), and a fifth step (90) for authenticating the write of the encryption key. - With this configuration, it is possible to further improve the security level against an attack which tries to search for a true value of the encryption key by rewriting intentionally the encryption key, in the user mode and in a state where the encryption key is already written in.
- (16) Branching to a User Program after Fetching a Key into a Decrypter
- In
Paragraph 14, the encryption key writing method further includes a sixth step (70) and a seventh step (62). - When it is determined at the third step that the operation mode to be operated by the CPU is the second operation mode (user mode), the sixth Step (70) restores the encryption key and supplies it to the decrypter in the first operation mode (system mode), by reading and reconfigurating the plural split keys which are held in the first nonvolatile memory (EEPROM 4) in a distributed manner.
- The seventh step (62) shifts the operation mode of the CPU to the second operation mode (user mode).
- With this configuration, it becomes possible to execute the encrypted user program after the divided encryption key (12) is read from the first nonvolatile memory (EEPROM 4) and the restored encryption key (11) is stored in the decrypter (1).
- (17) Distributing to Discontinuous Addresses
- In
Paragraph 14, the plural distributed address areas in the first region (system area 41) of the first nonvolatile memory (EEPROM 4) for holding the plural split keys (12) are discontinuous with respect to the physical address in the first nonvolatile memory, and discontinuous with respect to the logical address for accessing by the CPU. - With this configuration, even in the cases where the contents of the first region (system area 41) of the first nonvolatile memory (EEPROM 4) are dumped by an attack (dumping attack), it is possible to make broad the space to be searched for the value of the encryption key, thereby improving further the security level.
- (18) Distributing to Addresses with an Unequal Address Interval
- In
Paragraph 17, at least one of the interval of the plural physical addresses corresponding to the plural distributed address areas in the first region (system area 41) of the first nonvolatile memory (EEPROM 4) for holding the plural split keys (12) and the interval of the plural logical addresses corresponding to the plural address areas is unequal. - With this configuration, even in the cases where the contents of the first region (system area 41) of the first nonvolatile memory (EEPROM 4) are dumped by an attack (dumping attack), it is possible to make further broader the space to be searched for the value of the encryption key, thereby improving further the security level.
- (19) A key Address Storing Address
- In
Paragraph 14, the encryption key writing method further includes the eighth step. - The eighth step reads the key storing address (15, 19) from one of the first region (system area 41) of the first nonvolatile memory (EEPROM 4) and the fourth region (non-encryption area 31) of the second nonvolatile memory (ROM 3). Here, the key storing address (15, 19) indicates each of the plural address areas for storing the plural split keys (12) in a distributed manner, in the first region (system area 41) of the first nonvolatile memory (EEPROM 4).
- With this configuration, even in the cases where the contents of the first region (system area 41) of the first nonvolatile memory (EEPROM 4) are dumped by an attack (dumping attack), it is possible to make further broader the space to be searched for the value of the encryption key, thereby improving further the security level.
- (20) Distributing to Addresses Specified by a Base Point Address and a Deviation
- In
Paragraph 14, the key storing address indicative of each of the plural address areas for storing the plural split keys (12) in the first region (system area 41) of the first nonvolatile memory (EEPROM 4) in a distributed manner can be calculated by use of a base point address (16) and a deviation (17). The encryption key writing method further includes the ninth step (83, 84) which inputs the base point address and the deviation from the exterior through the communication interface. - With this configuration, even in the cases where the contents of the first region (system area 41) of the first nonvolatile memory (EEPROM 4) are dumped by an attack (dumping attack), it is possible to make further broader the space to be searched for the value of the encryption key, thereby improving further the security level.
- The embodiments are further explained in full detail.
-
FIG. 1 is a block diagram illustrating a configuration of asemiconductor device 1 according toEmbodiment 1. - A
decrypter 1, aCPU 2, aROM 3 which is an electrically non-rewritable nonvolatile memory, and anEEPROM 4 which is an electrically rewritable nonvolatile memory are coupled with each other through anaddress bus 7 and adata bus 8. TheCPU 2 can operate in several operation modes including a system mode and a user mode. TheROM 3 is provided with anencryption area 32 for storing an encryption code which includes at least one of an encrypted instruction and encrypted data, and anon-encryption area 31 for storing at least one of a non-encrypted instruction and non-encrypted data. TheEEPROM 4 is provided with asystem area 41 where an access from theCPU 2 is allowed in the system mode but forbidden in the user mode, and auser area 42 where the access from theCPU 2 is allowed in either of the modes. - The
system area 41 of theEEPROM 4 is provided with plural address areas for storingplural split keys 12 which compose an encryption key 11 to be used for decrypting the encryption code stored in theencryption area 32 of theROM 3. Thenon-encryption area 31 of theROM 3 stores an encryptionkey reading program 70. - When the encryption
key reading program 70 is executed by theCPU 2 in the system mode, the plural splitkeys 12 held in theEEPROM 4 in a distributed manner are read and reconfigured to restore the encryption key 11, which is then supplied to thedecrypter 1. Thedecrypter 1 holds the encryption key 11, decrypts the encryption code read from theencryption area 32 of theROM 3 with the use of the encryption key 11 in the user mode, and supplied the decrypted encryption code to theCPU 2. - A user program which should be protected is encrypted in advance with the use of the encryption key 11 and stored in the
encryption area 32 of theROM 3. Even if the contents of theencryption area 32 of theROM 3 are decoded, it is possible to maintain the secrecy of the contents of the user program which should be protected, unless the correct encryption key 11 is known. The encryption key 11 is divided into the split keys which are plural bit strings, and is stored in the system area of theEEPROM 4 in a distributed manner. By dividing and distributing, the combination number for reconfigurating can be increased and the security level can be improved. Thesplit keys 12 which have been divided and stored in a distributed manner are read from theEEPROM 4 by the encryptionkey reading program 70 which is executed after the power-on, and the reconfigurated encryption key 11 is written in thedecrypter 1. Subsequently, the user program stored in theencryption area 32 of theROM 3 is decrypted by thedecrypter 1 with the use of the encryption key 11, and supplied to theCPU 2 as an executable program. - With this configuration, it is possible to improve the security level against an attack trying to read out the encrypted program illegally. The
system area 41 of theEEPROM 4 is not allowed to access in the user mode; therefore, it is protected from a dumping attack. Even if the contents of theEEPROM 4 are dumped, the encryption key is divided and stored in a distributed manner; therefore, the search space of the encryption key is enlarged, leading to the improved security level. - The instruction code and data which are stored in memories, such as the
ROM 3 and theEEPROM 4, may undergo scramble processing in addition to encryption. In that case, what is necessary is just to insert a descramble circuit in the path from the memory to theCPU 2 through thedata bus 8 and thedecrypter 1. - It is preferable that the
decrypter 1 is provided with an enablingbit 13 which specifies whether to decrypt a cipher or to supply theCPU 2 with the inputted code as it is. Naturally, the encryptionkey reading program 70 is executed before the encryption key 11 is set to thedecrypter 1. When executing a program which is not encrypted such as the encryptionkey reading program 70, thedecrypter 1 is set up not to perform decrypting by the enablingbit 13. - It is preferable that the
decrypter 1 is provided with a register for holding the encryption key 11. At this time, an initial value of the register, that is, a reset value immediately after power-on can be utilized as an initial value of the encryption key 11. A program such as the encryptionkey reading program 70 which cannot be executed if encrypted by the correct encryption key 11 is encrypted in advance with the use of the initial value of the encryption key 11 which is the reset value of the register. In lieu of providing the enablingbit 13 described above, it is possible to design such that thedecrypter 1 can perform the decryption with the use of the initial value of the register as the encryption key until the correct encryption key 11 is written in. In this case, it is necessary to encrypt the encryptionkey reading program 70 with the use of the initial value of the encryption key 11 to the middle, and to encrypt it with the use of the correct encryption key 11 from the point immediately after the write step of the correct encryption key 11. - The encryption
key reading program 70 is called from areset routine 60 which operates immediately after the power-on of the semiconductor device. Thereset routine 60 is executed before the encryption key 11 is set in thedecrypter 1, as is the case with the encryptionkey reading program 70. Therefore, it is necessary that thereset routine 60 is encrypted in a simple way as described above or not encrypted. Thereset routine 60 is also stored in thenon-encryption area 31 of theROM 3. - It is preferable that the
EEPROM 4 is provided, in thesystem area 41, with a region which stores a key writtenflag 14 indicative of whether thesplit keys 12 are already written or not. The description of the operation and effect will be included in the following explanation about the reset routine. -
FIG. 2 is a flow chart illustrating an example of the reset routine in the semiconductor device according toEmbodiment 1. - The
reset routine 60 is activated by the power-on reset. First, the operation mode to be operated by theCPU 2 is determined (Step 61). The operation mode to be operated by theCPU 2 is specified by the state of a terminal in an ordinary microcomputer. However, a microcomputer which is employed for an IC card with a high security level cannot provide such a terminal. Accordingly, the operation mode is specified by a nonvolatile memory such as theEEPROM 4, or the like. The present determining (Step 61) itself operates in the system mode. - When the operation mode to be operated by the
CPU 2 is the user mode, the operation mode is changed to the user mode (Step 62) after the key reading 70_2 is performed. By the key reading 70_2, thesplit keys 12 are read from theEEPROM 4, and the reconfigurated encryption key 11 is written in thedecrypter 1. Subsequently, the user program stored in theencryption area 32 of theROM 3 is decrypted by thedecrypter 1 with the use of the encryption key 11, and supplied to theCPU 2 as a program executable in the user mode. - When the operation mode to be operated by the
CPU 2 is the system mode, it is determined whether thesplit keys 12 are already written in theEEPROM 4 or not written yet (Step 63). At this time, it is preferable to read the key writtenflag 14 for the determining. When thesplit keys 12 are already written in theEEPROM 4, the key reading 70_1 is performed to read thesplit keys 12, and the reconfigurated encryption key 11 is written in thedecrypter 1. Subsequently, the authentication for the system mode is performed (Step 64). When authenticating is successful (Step 65), operation in the system mode is started. On the contrary, when authenticating is unsuccessful (Step 65), an error processing (Step 66_1) is performed, and the system is reset. The security level can be improved by authenticating before starting the operation in the system mode. - When it is determined that the operation mode to be operated by the
CPU 2 is the system mode and thesplit keys 12 are not yet written in the EEPROM 4 (Step 63), the authentication for key writing (Step 90) is performed. As a result, when authenticating is successful (Step 67), the key writing (Step 80) is performed, and the system is reset. When authenticating is unsuccessful (Step 67), an error processing (Step 66_2) is performed, and the system is reset. - At the key writing (Step 80), the encryption key 11 is received from the exterior and divided into plural bit strings to generate the
split keys 12. Then, thesplit keys 12 are written in thesystem area 41 of theEEPROM 4 in a distributed manner. It is also preferable thatplural split keys 12 generated by dividing the encryption key 11 into plural bit strings externally in advance may be written in thesystem area 41 of theEEPROM 4 in a distributed manner. With this configuration, it is possible to divide the encryption key and to write it in a semiconductor device in a distributed manner, after manufacture of the semiconductor device. - As described above, the configuration is designed such that, in the user mode, the key writing (Step 80) is not executed when the key is already written and when authenticating is unsuccessful in the authentication for key writing (Step 90). With this configuration, it is possible to improve the security level against an attack which tries to search for a true value of the encryption key by rewriting intentionally the
split keys 12 written in theEEPROM 4 one by one. - The key written
flag 14 may be formed by one bit; however, it is more preferable that the key writtenflag 14 is formed by plural bits managed secretly. With this configuration, it is possible to improve the security level against an attack trying to rewrite the key writtenflag 14 intentionally. - A quantitative consideration is now given to dividing and distributing methods of the encryption key 11.
- One of the indices expressing the security level of a cipher is the magnitude of the search space of an encryption key. For example, when the encryption key is 128 bits, a true encryption key is surely included in 2128 kinds of combination. Therefore, the magnitude of the search space is 2128.
- As compared with this, it is assumed that the
entire EEPROM 4 in which thesplit keys 12 have been written is read out by memory dump. Here, the search space for searching for and reconfigurating thesplit keys 12 from the memory space of theEEPROM 4 is calculated. For example, when a key of 128 bits (16B) is stored in the memory space of 256 KB with every one word (2B) in a random address area, eight addresses need to be selected from the addresses of 128K kinds in the combination considering the difference in order as well. Therefore, there are combinations of 2(17×8) kinds=2136 kinds. This is larger than the search space of 2128 which an encryption key of 128 bits has in principle. - Therefore, the security level does not deteriorate. When a key of 128 bits (16B) is collectively stored in one place of the memory space of 256 KB on the other hand, the combination of how to cut out 16B from the memory space of 256 KB becomes 218 kinds. Compared with the search space of 2128 which the encryption key has originally, the search space is reduced greatly. Therefore, the security level deteriorates markedly.
- The number of dividing the encryption key can be decided on the basis of the search space of the key, with the size of the real address space of a memory for storing the key as a parameter. For example, the search space can be expressed as follows.
-
- In
Mathematical 1, R (byte) expresses the size of the real address space of the memory, L expresses the number of divisions of the key, M expresses the bit length of the key, and mi expresses the bit length of the i-th split key of the divided split keys. Normally, the real storage space is larger than the bit length of the key; therefore, it is possible to assume the relation as follows. -
- Then,
Mathematical 1 can be approximated as follows. -
- When the key is divided into the same bit length,
- Mathematical 3 reduces to the following expression.
-
- When the following relation is satisfied here,
-
- it means that it is faster to perform exhaustive search of the key rather than finding out where the key is stored in the real address space of the memory.
- Such a case happens when the bit length M of the key is short. Ordinarily, the real storage space has the size which can be expressed by the address of ten-odd bits. Accordingly, when the number of divisions L is small, such a case does not happen. Therefore, when it is desirable to set the search space greater than S bits against the dumping attack, it suffices that the number of divisions is set up so that the following relation is satisfied.
-
- Since R may be assumed to be larger than unity, the following relation is satisfied.
-
- Judging from the power of the current computer, S of about 80 to 128 bits is required. Therefore, when the real storage space of 256 KB is assumed for example, the following relation is derived.
-
- It is seen that it is just necessary to divide the key into 5 or more.
- In the present embodiment, the encryption key is protected from the dumping attack by storing the split keys in the system area of the
EEPROM 4 to which an access in the user mode is very difficult. Furthermore, by choosing the number of divisions of the encryption key appropriately as described above, it is possible to keep the search space large enough, even if the security is broken and the dumping attack is allowed. - In order to realize a large search space by division of the key as described above, it is preferable to store the split keys in discontinuous addresses in the memory. This is because the division effect will be lost when the split keys are stored in continuous addresses and the aggressor knows the fact. Even when stored in discontinuous addresses, if the address interval is equal, the division effect will be lost when the aggressor knows the fact. Therefore, it is preferable that the address interval is unequal. The address in the present case refers to the physical address of the memory and the logical address seen from the CPU. Although it is preferable that both of the physical address and the logical address are unequal, even when only one of them is discontinuous, there is the improvement effect of the security level.
- The semiconductor device illustrated in
FIG. 1 can be formed overlying a single semiconductor substrate using the well-known integrated circuit manufacturing method. -
FIG. 3 is a block diagram illustrating a configuration of an LSI according toEmbodiment 1. TheLSI 9 is formed overlying a single silicon substrate for example. TheLSI 9 is configured with adecrypter 1, aCPU 2, aROM 3, anEEPROM 4, a UART 5, and aRAM 6, which are coupled with each other via anaddress bus 7 and adata bus 8. The UART 5 is a Universal Asynchronous Receiver Transmitter. The UART 5 may be a USART (Universal Synchronous and Asynchronous Receiver Transmitter) with a synchronous receiver transmitter added. The communication interface is not restricted to the UART or the USART but may be any kind of communication interface. TheLSI 9 is provided with terminals of a power source including a VCC and a GND, a reset, a clock, and a signal terminal of the UART 5. Although not shown, theLSI 9 may be provided with several spare terminals. When an on-chip oscillator is provided, the clock terminal can be omitted. When an on-chip power-on reset circuit is provided and when the system design is prepared assuming only a power-on reset as a reset, the reset terminal can be also omitted. By being provided with necessary minimum terminals, it becomes difficult to perform optical or electrical observation of the state of the interior of theLSI 9; accordingly it is possible to improve the security level against an attack by optical observation or electric probing-based signal observation and others. - In a secure microcomputer in which the contents of the
ROM 3 are encrypted and decrypted in real time when theCPU 2 executes the program in theROM 3, an encryption key for the decryption is not set up in a ROM or a circuit in a chip in advance, but written in an electrically rewritable nonvolatile memory, such as an EEPROM, after manufacturing. Thereby, the risk of the key leakage by reverse engineering is reduced. Immediately after the manufacture of the chip, except for the processing for writing an encryption key for decryption, the program is stored in the state of being encrypted and cannot be executed by theCPU 2. The program can be utilizes after the encryption key is written. When shipped to a user, it is possible to prohibit accessing in the user mode to the contents of thenon-encryption area 31 of theROM 3, such as a setup of the encryption key. - In order to write the encryption key, by dividing or already divided, in the
system area 41 of theEEPROM 4 in a distributed manner, the encryptionkey write program 80 is executed. The encryptionkey write program 80 must be executed before the write of the encryption key. Therefore, the instruction code thereof cannot be encrypted inevitably, and is stored in thenon-encryption area 31 of theROM 3. - It is also preferable that the encryption
key writing program 80 is once written in theRAM 6 or theEEPROM 4 before shipping, in lieu of being stored in the LSI, and is executed to write the encryption key in a distributed manner. Then, the encryptionkey writing program 80 written in theRAM 6 or theEEPROM 4 is erased before shipping. Accordingly, it is possible to protect from an attack which knows the contents of the encryptionkey writing program 80. On the other hand, the setup which allows execution of the non-encrypted program in theRAM 6 or theEEPROM 4 is left in the LSI. In that sense, the vulnerability may be caused. -
FIG. 4 is a memory map of a ROM and an EEPROM in the present embodiment in which a key storing address specifies an address to store split keys. The key storing address is assigned to a different region in the logical address space seen from theCPU 2. - The
ROM 3 is provided with anon-encryption area 31 and anencryption area 32, and theEEPROM 4 is provided with asystem area 41 and auser area 42. - The key storing addresses 19_1, 19_2, and 19_3 and the key written
flag storing address 18 are respectively values of the addresses for storing the split keys 12_1, 12_2, and 12_3 and the key writtenflag 14 in thesystem area 41 of theEEPROM 4. The key storing addresses 19_1, 19_2, and 19_3 and the key writtenflag storing address 18 are stored in the non-encryption area of theROM 3. Thereset routine 60 determines whether the key write is completed or not atStep 63 as shown by the flow chart illustrated inFIG. 2 . At this time, according to the key writtenflag storing address 18, the key writtenflag 14 of theEEPROM 4 is read and the value is determined. Thekey writing 80 writes the split keys 12_1, 12_2, and 12_3 in theEEPROM 4 according to the key storing address 19_1, 19_2, and 19_3. The key reading 70_1 and 70_2 reads the split keys 12_1, 12_2, and 12_3 from theEEPROM 4 according to the key storing addresses 19_1, 19_2, and 19_3, and writes them in thedecrypter 1. -
FIG. 10 is a flow chart illustrating key reading (loop) in the present embodiment in which a key storing address specifies an address to store split keys. The i-th split key 12_i in theEEPROM 4 is fetched into a general-purpose register of the CPU 2 (Step 71), and the i-th split key 12_i fetched into the general-purpose register is written in a register corresponding to the i-th split key 12_i in the key registers of the decrypter 1 (Step 72). Assuming that the number of divisions of the encryption key is L, Steps 71 and 72 are repeatedly executed by the loop repeating i from 1 to L. -
FIG. 11 is a flow chart illustrating the key reading (loop unrolling) in the present embodiment. In contrast with thekey reading 70 illustrated inFIG. 10 in which Steps 71 and 72 are repeatedly executed by a loop, the key reading illustrated inFIG. 11 is executed, not by using a loop but by the instruction codes which describe sequentially L-piece instruction codes of the split key reading from the EEPROM 4 (Step 71) and the key writing to the decrypter 1 (Step 72). By eliminating the loop control, it is possible to improve the security level against an attack which rewrites only a portion of the key location by destroying temporarily the read value of the register for controlling a loop by means of laser radiation etc. and reducing the loop count. - The encryption
key writing program 80 is stored in thenon-encryption area 31 of theROM 3. Therefore, it cannot deny a possibility that the encryptionkey writing program 80 may be known by an aggressor through an attack of optical observation of theROM 3. In such a case, the specification method of the address for storing the split keys described inEmbodiment 2 has a possibility that the address of theEEPROM 4 at which thesplit keys 12 are stored may be detected, by observing theROM 3 and analyzing the contents of the encryptionkey writing program 80. Thesplit keys 12 are stored in thesystem area 41 of theEEPROM 4; accordingly, granting that the design makes it difficult for the user to access, it is degradation of the security level that the address to store thesplit keys 12 is detected. - Therefore,
Embodiments key writing program 80. -
FIG. 5 is a memory map of a ROM and an EEPROM in the present embodiment in which a key address storing address specifies a key address and the key address specifies an address to store the split keys. These addresses are assigned to different regions in the logical address space seen from theCPU 2. TheROM 3 is provided with anon-encryption area 31 and anencryption area 32, and theEEPROM 4 is provided with asystem area 41 and auser area 42. - The addresses to write the split keys 12_1, 12_2, and 12_3 are stored in the
system area 41 of theEEPROM 4 as the key addresses 15_1, 15_2, and 15_3. The addresses to store the key addresses 15_1, 15_2, and 15_3 are stored in the non-encryption area of theROM 3 as the key address storing addresses 20_1, 20_2, and 20_3. The address to store the key writtenflag 14 is specified by the key writtenflag storing address 18, as is the case withEmbodiment 2. Thereset routine 60 determines whether the key write is completed or not atStep 63 as shown by the flow chart illustrated inFIG. 2 . At this time, as is the case withEmbodiment 2, according to the key writtenflag storing address 18, the key writtenflag 14 of theEEPROM 4 is read and the value is determined. The key addresses 15_1, 15_2, and 15_3 are inputted from the exterior, via the UART 5 for example, and are written in thesystem area 41 of theEEPROM 4 which is specified by the key address storing addresses 20_1, 20_2, and 20_3. Thekey writing 80 writes the split keys 12_1, 12_2, and 12_3 in theEEPROM 4, according to the key addresses 15_1, 15_2, and 15_3. At this time, the split keys 12_1, 12_2, and 12_3 are inputted from the exterior, via the UART 5 for example. The key reading 70_1 and 70_2 read the split keys 12_1, 12_2, and 12_3 from theEEPROM 4 according to the key addresses 15_1, 15_2, and 15_3 and write them in thedecrypter 1. - The
EEPROM 4 stores information by means of the change of an electric state; accordingly, it is substantially impossible to read the information by the optical observation. Therefore, the security level is higher than theROM 3. In the present embodiment, it is possible to improve the security level higher than inEmbodiment 1, by allotting the key addresses 15_1, 15_2, and 15_3, which are the addresses to store the split keys 12_1, 12_2, and 12_3, in thesystem area 41 of theEEPROM 4. -
FIG. 12 is a flow chart illustrating key reading (loop) in the present embodiment in which a key address storing address specifies a key address and the key address specifies an address to store split keys. A key address 15_i which is the address at which the i-th split key 12_i is stored in theEEPROM 4 is fetched into a general-purpose register of the CPU 2 (Step 75). Next, the i-th split key 12_i is fetched from theEEPROM 4 at the address indicated by the general-purpose register of theCPU 2 into the general-purpose register of the CPU 2 (Step 71). The i-th split key 12_i fetched into the general-purpose register is written to a register corresponding to the i-th split key 12_i in the key registers of the decrypter 1 (Step 72). Assuming that the number of divisions of the encryption key is L, Steps 75, 71, and 72 are repeatedly executed by the loop repeating i from 1 to L. - When compared with the key reading in
Embodiment 2 illustrated inFIG. 10 ,Step 71 serves as a load instruction by the register indirect addressing, and the value of the general-purpose register is determined by the load instruction atStep 75 executed before that. -
FIG. 13 is a flow chart illustrating the key reading (loop unrolling) in the present embodiment. In contrast with thekey reading 70 illustrated inFIG. 12 in which Steps 75, 71, and 72 are repeatedly executed by a loop, the key reading according to the present embodiment is executed, not by using a loop, but by the instruction code which describes sequentially L-piece instruction codes ofSteps Embodiment 2, by eliminating the loop control, it is possible to improve the security level against an attack which rewrites only a portion of the key location by destroying temporarily the read value of the register for controlling a loop by means of laser radiation etc. and reducing the loop count. - In
Embodiment 3, the address to store the split keys is specified through the intermediary of an indirect pointer, such that a key address storing address specifies a key address and the key address specifies an address to store the split keys. Accordingly, tracking is made difficult and the security level is improved. In contrast with this, in the present embodiment, tracking is made difficult with the use of a certain function for specifying the address to store the split keys. Accordingly, the security level is improved. For example, the address to store the split keys is calculated from a base point address and a deviation. -
FIG. 6 is a memory map of a ROM and an EEPROM in the present embodiment in which a base point and a deviation specify an address to store the split keys. The these addresses are assigned to respectively different regions in the logical address space seen from theCPU 2. TheROM 3 is provided with anon-encryption area 31 and anencryption area 32, and theEEPROM 4 is provided with asystem area 41 and auser area 42. - The addresses to write the split keys 12_1, 12_2, and 12_3 are given by the sum of the base point addresses 16_1, 16_2, and 16_3 and the deviations 17_1, 17_2 and 17_3, respectively. The base point addresses 16_1, 16_2, and 16_3 and the deviations 17_1, 17_2, and 17_3 are stored in the
system area 41 of theEEPROM 4. The addresses to store the base point addresses 16_1, 16_2, and 16_3 and the deviations 17_1, 17_2, and 17_3 are respectively stored in the non-encryption area of theROM 3 as the base point address storing addresses 21_1, 21_2, and 21_3 and the deviation storing addresses 22_1, 22_2, and 22_3. The address to store the key writtenflag 14 is specified by the key writtenflag storing address 18, as is the case withEmbodiments reset routine 60 determines whether the key write is completed or not atStep 63 as shown by the flow chart illustrated inFIG. 2 . At this time, as is the case withEmbodiments flag storing address 18, the key writtenflag 14 of theEEPROM 4 is read and the value is determined. The base point addresses 16_1, 16_2, and 16_3 and the deviations 17_1, 17_2, and 17_3 are inputted from the exterior, for example via the UART 5, and written in thesystem area 41 of theEEPROM 4 specified by the base point address storing addresses 21_1, 21_2, and 21_3 and the deviation storing addresses 22_1, 22_2 and 22_3. - The
key writing 80 reads the base point addresses 16_1, 16_2, and 16_3 and the deviations 17_1, 17_2, and 17_3, from thesystem area 41 of theEEPROM 4 specified by the base point address storing addresses 21_1, 21_2, and 21_3 and the deviation storing addresses 22_1, 22_2 and 22_3, and calculates the address to store the split keys. According to the calculated address, the split keys 12_1, 12_2, and 12_3 are written in theEEPROM 4. -
FIG. 9 is an explanatory diagram illustrating an example of a communication flow in the key writing in the present embodiment. A chip of the semiconductor device, such as the LSI illustrated inFIG. 1 or 3 , is coupled to a card reader writer via a communication interface, such as the UART 5. The card reader writer is not a card reader writer that a general user uses but it should be a special one that can operate the chip in the system mode and can write in the system area of theEEPROM 4. If an equivalent function is provided with, a logic tester of an LSI or the like may be sufficient. - The base point address 16_1, the deviation 17_1, and the corresponding split key 12_1 are transmitted from the card reader writer to the chip via the communication interface, such as the UART 5, as the base point address 83_1, the deviation 84_1, and the split key 81_1, respectively. The chip calculates the address to store by adding the base point address 16_1 and the deviation 17_1, and writes the split key 12_1 in the calculated address. When the writing is completed, a key writing completion status 82_1 is sent to the card reader writer. The present procedure is repeated L times as the number of divisions.
- The key reading 70_1 and 70_2 read out the base point addresses 16_1, 16_2, and 16_3 and the deviations 17_1, 17_2 and 17_3, from the
system area 41 of theEEPROM 4 specified by the base point address storing addresses 21_1, 21_2, and 21_3 and the deviation storing address 22_1, 22_2, and 22_3, and calculates the address to store the split keys. According to the calculated address, the split keys 12_1, 12_2, and 12_3 are read from theEEPROM 4 and written in thedecrypter 1. - Unlike
Embodiments Embodiment 2 and the key addresses 15_1, 15_2, and 15_3 in Embodiment 3) is not stored in any memory of the device. With this configuration, even if the contents of thesystem area 41 of theEEPROM 4 are dumped by an attack, it is difficult to obtain the address to store the split keys 12_1, 12_2, and 12_3; accordingly, it is possible to improve the security level. - The function for calculating the address to store the split keys 12_1, 12_2, and 12_3 can be determined arbitrarily. The present embodiment specifies the address to store the split keys by a different base point address for every split keys. However, it is also preferable to specify the address to store the split keys by one base point address and plural deviations. In addition, it is also preferable to employ any kind of function for the calculation. Although the function itself is stored in the non-encryption area of the
ROM 3 as a part of the program, it is preferable to store the parameter (the base point address and the deviation in the present embodiment) in thesystem area 41 of theEEPROM 4. -
FIG. 14 is a flow chart illustrating key reading (loop) in the present embodiment in which a base point address and a deviation specify an address to store split keys. The base point address 16_i of the i-th split key 12_i stored in theEEPROM 4 is fetched into a general-purpose register 1 of the CPU 2 (Step 73), and the deviation 17_i is fetched into a general-purpose register 2 of the CPU 2 (Step 74). Next, the sum of the general-purpose register 1 and the general-purpose register 2 is calculated and stored in the general-purpose register 3 (Step 75). This is the address which should store the i-th split key 12_i. Next, the i-th split key 12_i is fetched from theEEPROM 4 at the address indicated by the general-purpose register 3 into the general-purpose register 4 of the CPU 2 (Step 71). The i-th split key 12_i fetched into the general-purpose register 4 is written to a register corresponding to the i-th split key 12_i in the key registers of the decrypter 1 (Step 72). Assuming that the number of divisions of the encryption key is L, Steps 73, 74, 75, 71, and 72 are repeatedly executed by the loop repeating i from 1 to L. -
FIG. 15 is a flow chart illustrating the key reading (loop unrolling) in the present embodiment. In contrast with thekey reading 70 illustrated inFIG. 14 in which Steps 73, 74, 75, 71, and 72 are repeatedly executed by a loop, the key reading according to the present embodiment is executed, not by using a loop, but by the instruction code which describes sequentially L-piece instruction codes ofSteps Embodiments - Authentication for key writing (Step 90) is explained in more detail.
- There are several methods of the authentication. For an example of the methods, a hash value of the secret input data for authentication is stored in the ROM as an expectation value, and when authenticating, the input data for generating the hash value is employed for the authentication. For another example of the methods, the key information of a block cipher is set as the secret information for authentication, a plaintext is encrypted by the key of the block cipher for authentication as a ciphertext and the pair of the plaintext and the ciphertext are stored in a ROM, and when authenticating, the key information is inputted as an input value, the plaintext stored in the ROM is encrypted by the key inputted, and it is examined whether the ciphertext stored in the ROM is obtained.
- In the method using public key encryption, following the concept of DSA, RSA public keys e and N and an expectation value p are stored in the ROM, and a value C which satisfies p=Ce mod N is inputted from the exterior. When authenticating, Ce mod N is calculated and confirmed if it is equal to the expectation value p. The value of C can be calculated as C=pd mod N using a secret exponent number d of RSA. Calculating C from p is equivalent to solving the RSA encryption. Therefore, when the number of bits of the key is large enough, it is difficult to calculate C from p in realistic computation time. In either of these methods, a third party cannot calculate the expectation value easily from the information stored in the ROM. Therefore, the security level is not impaired by the dumping attack to the ROM.
-
FIG. 7 is an explanatory diagram illustrating an example of a communication flow in key write authentication and key writing. - The chip of the semiconductor device, such as the LSI illustrated in
FIG. 1 or 3 , is coupled to a card reader writer via a communication interface, such as the UART 5. The card reader writer is not a card reader writer that a general user uses but it should be a special one that can operate the chip in the system mode and can write in the system area of theEEPROM 4. If an equivalent function is provided with, a logic tester of an LSI or the like may be sufficient. - The card reader writer calculates c=pd mod N in advance, and transmits c as the
authentication data 93 to the chip via the communication interface such as the UART 5. The chip holds p, e, and N in theROM 3. When c is received as theauthentication data 93, p′=Ce mod N is calculated (Step 90). When p′=p, the authentication is successful (Step 67). Anauthentication success status 94 is transmitted to the card reader writer and the authenticating for key writing is completed, then, the flow moves to the key writing (Step 80). When p′≠p, the authentication is unsuccessful, and error processing (Step 66_2) is performed, then, the flow terminates (reset). - In the key writing (Step 80),
information 81 of the encryption key 11 stored in the encryption region of theROM 3 is transmitted from the card reader writer to the chip. The entire of the encryption key 11 may be transmitted collectively, or the encryption key 11 may be divided in advance and transmitted as thesplit keys 12. The chip performs writing of the key and sets up a key writtenflag 14. Subsequently, the chip transmits a keywriting completion status 82 to the card reader writer, and the key writing (Step 80) is completed. - With this configuration, it is possible to further improve the security level of the authentication which is the premise for the encryption key writing.
-
FIG. 8 is an explanatory diagram illustrating another example of a communication flow in key write authentication and key writing. - The card reader writer transmits an
authentication start command 91 to the chip via the communication interface such as the UART. The chip holds e and N in theROM 3, but does not hold the expectation value p. When theauthentication start command 91 is received, the chip generates a random number p employed as an expectation value, and transmits it to the card reader writer as an authenticationrandom number 92. Using the received authentication random number p (92), the card reader writer calculates c=pd mod N, and transmits c to the chip asauthentication data 93. When c is received as theauthentication data 93, the chip calculates p′=Ce mod N, (Step 90). When p′=p, the authentication is successful (Step 67). Anauthentication success status 94 is transmitted to the card reader writer and the authenticating for key writing is completed, then, the flow moves to the key writing (Step 80). When p′≠p, the authentication is unsuccessful, and error processing (Step 66_2) is performed, then, the flow terminates (reset). Subsequently, the key writing (Step 80) same as in the explanation ofFIG. 7 is performed. - The expectation value p of authentication is not stored in the
ROM 3, but it is generated internally as a random number for every authenticating. Therefore, the security level is higher. - As described above, the invention accomplished by the present inventors has been concretely explained based on the embodiments. However, it cannot be overemphasized that the present invention is not restricted to the embodiments, and it can be changed variously in the range which does not deviate from the gist.
- For example, in
Embodiments 2 to 4 andFIGS. 4 to 6 , the explanation is made for the number of divisions of the encryption key of three; however, the number of divisions is not restricted to three. It is preferable to set the number of divisions of the encryption key appropriately as explained inEmbodiment 1. The embodiment in which the semiconductor device is formed overlying a single semiconductor chip is explained with reference toFIG. 3 . However, the present invention is not restricted to the embodiment. For example, it is also preferable that the semiconductor device is implemented as a multichip module formed by laminating plural chips.
Claims (18)
1. A semiconductor device comprising:
a central processing unit (CPU);
a first memory which stores a plurality of split keys;
a second memory which stores an encryption code as at least one of an encrypted instruction and encrypted data, the plurality of split keys comprising an encryption key for decrypting the encryption code; and
a decrypter which reads the encryption code from the second memory, decrypts the encryption code with the use of the encryption key, and supplies the decrypted encryption code to the CPU,
wherein the second memory stores an encryption key reading program which is executed by the CPU to restore the encryption key and to supply the encryption key to the decrypter, by reading and reconfiguring the split keys stored in the first memory in a distributed manner.
2. The semiconductor device of claim 1 , wherein the CPU includes a first operation mode and a second operation mode.
3. The semiconductor device of claim 2 , wherein the first memory comprises an electrically rewritable nonvolatile memory including a first region and a second region, the first region being forbidden access from the CPU in the second operation mode.
4. The semiconductor device of claim 3 , wherein the first memory includes a plurality of distributed address areas in the first region, for storing the plurality of split keys.
5. The semiconductor device of claim 4 , wherein the second memory comprises an electrically non-rewritable nonvolatile memory including a third region and a fourth region, the third region storing the encryption code.
6. The semiconductor device of claim 5 , wherein the second memory stores the encryption key reading program in the fourth region.
7. The semiconductor device of claim 5 , wherein the decrypter stores the encryption key, and in the second operation mode the decrypter decrypts the encryption code read from the third region of the second memory.
8. The semiconductor device of claim 5 , further comprising:
a communication interface,
wherein the second memory stores an encryption key writing program in the fourth region, the encryption key writing program being executed by the CPU to:
input the encryption key from an exterior through the communication interface; and
write the encryption key in the distributed address area in the first region of the first memory, in a state where the encryption key is divided into the split keys.
9. The semiconductor device of claim 8 , wherein the encryption key writing program executes an authentication, before the split keys are written in the first memory.
10. The semiconductor device of claim 9 , wherein, before the split keys are written in the first memory, the encryption key writing program determines that the operation mode to be operated by the CPU is the first operation mode, and determines whether the split keys are already written in the first memory, and
wherein, when the operation mode to be operated by the CPU is the first operation mode and when the split keys are not yet written in, the encryption key writing program advances to the authentication.
11. The semiconductor device of claim 10 , wherein the first memory includes a region for storing data indicative of whether the split keys have already been written in the first region.
12. The semiconductor device of claim 11 , wherein the data indicative of whether the split keys have already been written comprises a plurality of bits.
13. The semiconductor device of claim 5 , wherein the distributed address areas in the first region of the first memory are discontinuous with respect to a physical address in the first memory, and discontinuous with respect to a logical address for accessing by the CPU.
14. The semiconductor device of claim 13 , wherein at least one of an interval of the physical addresses corresponding to the distributed address areas in the first region of the first memory and an interval of the logical addresses corresponding to the distributed address areas, is unequal.
15. The semiconductor device of claim 1 , further comprising:
an address bus and a data bus; and
a universal asynchronous receiver transmitter (UART) which is coupled to the CPU, the first memory, the second memory and the decrypter, by the address bus and the data bus.
16. An encryption key writing method for writing an encryption key to a semiconductor device, the method comprising:
providing a semiconductor device comprising:
a central processing unit (CPU);
a first memory which stores a plurality of split keys;
a second memory which stores an encryption code as at least one of an encrypted instruction and encrypted data, the plurality of split keys comprising an encryption key for decrypting the encryption code;
a decrypter which reads the encryption code from the second memory, decrypts the encryption code with the use of the encryption key, and supplies the decrypted encryption code to the CPU; and
a communication interface;
inputting the encryption key from an exterior through the communication interface; and
writing the inputted encryption key in a plurality of distributed address areas in a first region of the first memory, in the state where the encryption key is divided into a plurality of split keys.
17. The encryption key writing method of claim 16 , further comprising before the writing of the inputted encryption key:
confirming that an operation mode to be operated by the CPU is a first operation mode;
confirming that the split keys are not written in the plurality of distributed address areas of the first memory, and
authenticating the writing of the inputted encryption key.
18. The encryption key writing method of claim 17 , further comprising:
restoring the encryption key and supplying the encryption key to the decrypter in the first operation mode, by reading and reconfiguring the split keys stored in the first memory in a distributed manner, when it is determined that an operation mode to be operated by the CPU is a second operation mode, and
shifting the operation mode of the CPU to the second operation mode.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/006,837 US20160140057A1 (en) | 2012-10-31 | 2016-01-26 | Semiconductor device and encryption key writing method |
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2012240051A JP5984625B2 (en) | 2012-10-31 | 2012-10-31 | Semiconductor device and encryption key writing method |
JP2012-240051 | 2012-10-31 | ||
US14/061,619 US9280671B2 (en) | 2012-10-31 | 2013-10-23 | Semiconductor device and encryption key writing method |
US15/006,837 US20160140057A1 (en) | 2012-10-31 | 2016-01-26 | Semiconductor device and encryption key writing method |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/061,619 Continuation US9280671B2 (en) | 2012-10-31 | 2013-10-23 | Semiconductor device and encryption key writing method |
Publications (1)
Publication Number | Publication Date |
---|---|
US20160140057A1 true US20160140057A1 (en) | 2016-05-19 |
Family
ID=49484191
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/061,619 Active 2034-07-02 US9280671B2 (en) | 2012-10-31 | 2013-10-23 | Semiconductor device and encryption key writing method |
US15/006,837 Abandoned US20160140057A1 (en) | 2012-10-31 | 2016-01-26 | Semiconductor device and encryption key writing method |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/061,619 Active 2034-07-02 US9280671B2 (en) | 2012-10-31 | 2013-10-23 | Semiconductor device and encryption key writing method |
Country Status (3)
Country | Link |
---|---|
US (2) | US9280671B2 (en) |
EP (1) | EP2728509B1 (en) |
JP (1) | JP5984625B2 (en) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20150293857A1 (en) * | 2014-04-09 | 2015-10-15 | Seagate Technology Llc | Encryption key storage and modification in a data storage device |
CN107861892A (en) * | 2017-09-26 | 2018-03-30 | 大唐微电子技术有限公司 | A kind of method and terminal for realizing data processing |
FR3069935A1 (en) * | 2017-08-01 | 2019-02-08 | Maxim Integrated Products, Inc. | DEVICES AND METHODS FOR INTELLECTUAL PROPERTY PROTECTION OF SOFTWARE FOR INTEGRATED PLATFORMS |
US11449644B2 (en) | 2019-08-07 | 2022-09-20 | Samsung Electronics Co., Ltd. | Electronic device operating encryption for user data |
Families Citing this family (34)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10354325B1 (en) | 2013-06-28 | 2019-07-16 | Winklevoss Ip, Llc | Computer-generated graphical user interface |
US9892460B1 (en) | 2013-06-28 | 2018-02-13 | Winklevoss Ip, Llc | Systems, methods, and program products for operating exchange traded products holding digital math-based assets |
US10068228B1 (en) | 2013-06-28 | 2018-09-04 | Winklevoss Ip, Llc | Systems and methods for storing digital math-based assets using a secure portal |
US11282139B1 (en) | 2013-06-28 | 2022-03-22 | Gemini Ip, Llc | Systems, methods, and program products for verifying digital assets held in a custodial digital asset wallet |
US10269009B1 (en) | 2013-06-28 | 2019-04-23 | Winklevoss Ip, Llc | Systems, methods, and program products for a digital math-based asset exchange |
US10254737B2 (en) * | 2013-12-12 | 2019-04-09 | Panasonic Intellectual Property Management Co., Ltd. | Motor driving apparatus |
US9853977B1 (en) | 2015-01-26 | 2017-12-26 | Winklevoss Ip, Llc | System, method, and program product for processing secure transactions within a cloud computing system |
US10158480B1 (en) | 2015-03-16 | 2018-12-18 | Winklevoss Ip, Llc | Autonomous devices |
US10915891B1 (en) | 2015-03-16 | 2021-02-09 | Winklevoss Ip, Llc | Autonomous devices |
US10223294B2 (en) * | 2015-09-01 | 2019-03-05 | Nxp Usa, Inc. | Fast secure boot from embedded flash memory |
US10083325B2 (en) * | 2015-11-16 | 2018-09-25 | The Boeing Company | Secure removable storage for aircraft systems |
US10491380B2 (en) * | 2016-03-31 | 2019-11-26 | Shenzhen Bell Creative Science and Education Co., Ltd. | Firmware of modular assembly system |
CN106685646B (en) * | 2016-11-29 | 2020-08-18 | 北京奇艺世纪科技有限公司 | Digital certificate key management method and management server |
US10506642B2 (en) * | 2016-11-30 | 2019-12-10 | Samsung Eletrônica da Amazônia Ltda. | Method for verifying authenticity, configuring network credentials and cryptographic keys for internet of things (IoT) devices using near field communication (NFC) |
US10223531B2 (en) * | 2016-12-30 | 2019-03-05 | Google Llc | Secure device state apparatus and method and lifecycle management |
JP6972721B2 (en) * | 2017-07-18 | 2021-11-24 | 富士フイルムビジネスイノベーション株式会社 | Information processing equipment and information processing programs |
US11475442B1 (en) | 2018-02-12 | 2022-10-18 | Gemini Ip, Llc | System, method and program product for modifying a supply of stable value digital asset tokens |
US10540654B1 (en) | 2018-02-12 | 2020-01-21 | Winklevoss Ip, Llc | System, method and program product for generating and utilizing stable value digital assets |
US11522700B1 (en) | 2018-02-12 | 2022-12-06 | Gemini Ip, Llc | Systems, methods, and program products for depositing, holding and/or distributing collateral as a token in the form of digital assets on an underlying blockchain |
US10373129B1 (en) | 2018-03-05 | 2019-08-06 | Winklevoss Ip, Llc | System, method and program product for generating and utilizing stable value digital assets |
US11200569B1 (en) | 2018-02-12 | 2021-12-14 | Winklevoss Ip, Llc | System, method and program product for making payments using fiat-backed digital assets |
US11139955B1 (en) | 2018-02-12 | 2021-10-05 | Winklevoss Ip, Llc | Systems, methods, and program products for loaning digital assets and for depositing, holding and/or distributing collateral as a token in the form of digital assets on an underlying blockchain |
US10438290B1 (en) | 2018-03-05 | 2019-10-08 | Winklevoss Ip, Llc | System, method and program product for generating and utilizing stable value digital assets |
US11909860B1 (en) | 2018-02-12 | 2024-02-20 | Gemini Ip, Llc | Systems, methods, and program products for loaning digital assets and for depositing, holding and/or distributing collateral as a token in the form of digital assets on an underlying blockchain |
US10373158B1 (en) | 2018-02-12 | 2019-08-06 | Winklevoss Ip, Llc | System, method and program product for modifying a supply of stable value digital asset tokens |
US10929842B1 (en) | 2018-03-05 | 2021-02-23 | Winklevoss Ip, Llc | System, method and program product for depositing and withdrawing stable value digital assets in exchange for fiat |
US11308487B1 (en) | 2018-02-12 | 2022-04-19 | Gemini Ip, Llc | System, method and program product for obtaining digital assets |
US11334883B1 (en) | 2018-03-05 | 2022-05-17 | Gemini Ip, Llc | Systems, methods, and program products for modifying the supply, depositing, holding and/or distributing collateral as a stable value token in the form of digital assets |
US11263074B1 (en) * | 2018-03-29 | 2022-03-01 | Keep Security, Llc | Systems and methods for self correcting secure computer systems |
US10579465B1 (en) | 2018-03-29 | 2020-03-03 | Keep Security LLC | Systems and methods for self correcting secure computer systems |
US11669389B1 (en) | 2018-03-29 | 2023-06-06 | Keep Security, Llc | Systems and methods for secure deletion of information on self correcting secure computer systems |
US11501370B1 (en) | 2019-06-17 | 2022-11-15 | Gemini Ip, Llc | Systems, methods, and program products for non-custodial trading of digital assets on a digital asset exchange |
KR20210046418A (en) * | 2019-10-18 | 2021-04-28 | 삼성전자주식회사 | Semiconductor device inclduing secure patchable rom and pathc method thereof |
TWI775061B (en) * | 2020-03-30 | 2022-08-21 | 尚承科技股份有限公司 | Protection system and method for soft/firmware or data |
Family Cites Families (13)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP3067179B2 (en) * | 1990-08-21 | 2000-07-17 | 株式会社エヌ・ティ・ティ・データ | IC card secret key control method |
US6282657B1 (en) * | 1997-09-16 | 2001-08-28 | Safenet, Inc. | Kernel mode protection |
US6378072B1 (en) * | 1998-02-03 | 2002-04-23 | Compaq Computer Corporation | Cryptographic system |
JP4080079B2 (en) | 1998-11-20 | 2008-04-23 | 大日本印刷株式会社 | IC card |
JP2000252973A (en) | 1999-03-04 | 2000-09-14 | Matsushita Electric Ind Co Ltd | Method for mounting and restoring key |
JP2002026902A (en) * | 2000-07-10 | 2002-01-25 | Matsushita Electric Ind Co Ltd | Receiver terminal |
FI112707B (en) * | 2000-09-29 | 2003-12-31 | Setec Oy | A method for handling a secret key |
FI115257B (en) * | 2001-08-07 | 2005-03-31 | Nokia Corp | Method for Processing Information in an Electronic Device, System, Electronic Device, and Processor Block |
JP2003333027A (en) * | 2002-05-17 | 2003-11-21 | Nippon Telegr & Teleph Corp <Ntt> | Encryption key storage device and electronic apparatus |
IL187043A0 (en) * | 2007-10-30 | 2008-02-09 | Sandisk Il Ltd | Secure pipeline manager |
US8578175B2 (en) * | 2011-02-23 | 2013-11-05 | International Business Machines Corporation | Secure object having protected region, integrity tree, and unprotected region |
JP2012065123A (en) * | 2010-09-15 | 2012-03-29 | Fuji Electric Retail Systems Co Ltd | Ic card system, communication terminal therefor and portable terminal therefor |
JP2012080295A (en) * | 2010-09-30 | 2012-04-19 | Toshiba Corp | Information storage device, information storage method, and electronic device |
-
2012
- 2012-10-31 JP JP2012240051A patent/JP5984625B2/en active Active
-
2013
- 2013-10-23 US US14/061,619 patent/US9280671B2/en active Active
- 2013-10-24 EP EP13190143.1A patent/EP2728509B1/en active Active
-
2016
- 2016-01-26 US US15/006,837 patent/US20160140057A1/en not_active Abandoned
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20150293857A1 (en) * | 2014-04-09 | 2015-10-15 | Seagate Technology Llc | Encryption key storage and modification in a data storage device |
US9659191B2 (en) * | 2014-04-09 | 2017-05-23 | Seagate Technology Llc | Encryption key storage and modification in a data storage device |
US10218503B2 (en) | 2014-04-09 | 2019-02-26 | Seagate Technology Llc | Encryption key storage and modification in a data storage device |
FR3069935A1 (en) * | 2017-08-01 | 2019-02-08 | Maxim Integrated Products, Inc. | DEVICES AND METHODS FOR INTELLECTUAL PROPERTY PROTECTION OF SOFTWARE FOR INTEGRATED PLATFORMS |
CN107861892A (en) * | 2017-09-26 | 2018-03-30 | 大唐微电子技术有限公司 | A kind of method and terminal for realizing data processing |
US11449644B2 (en) | 2019-08-07 | 2022-09-20 | Samsung Electronics Co., Ltd. | Electronic device operating encryption for user data |
Also Published As
Publication number | Publication date |
---|---|
US20140122903A1 (en) | 2014-05-01 |
JP2014089640A (en) | 2014-05-15 |
JP5984625B2 (en) | 2016-09-06 |
US9280671B2 (en) | 2016-03-08 |
EP2728509B1 (en) | 2019-04-10 |
EP2728509A2 (en) | 2014-05-07 |
EP2728509A3 (en) | 2016-10-26 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9280671B2 (en) | Semiconductor device and encryption key writing method | |
US6457126B1 (en) | Storage device, an encrypting/decrypting device and method of accessing a non-volatile memory | |
EP2115655B1 (en) | Virtual secure on-chip one time programming | |
US10915464B2 (en) | Security system using random number bit string | |
KR101546204B1 (en) | Host device, semiconductor memory device, and authentication method | |
US20080205651A1 (en) | Secure processor system without need for manufacturer and user to know encryption information of each other | |
JP2010509662A (en) | Method and system for encryption of information stored in external non-volatile memory | |
US20160248588A1 (en) | Security ram block with multiple partitions | |
US9653004B2 (en) | Systems and methods for downloading code and data into a secure non-volatile memory | |
US7752407B1 (en) | Security RAM block | |
US8015416B2 (en) | Memory information protection system and methods | |
EP1830240A1 (en) | Memory information protecting system, semiconductor memory, and method for protecting memory information | |
US11533172B2 (en) | Apparatus and method for securely managing keys | |
CN111488630A (en) | Storage device capable of configuring safe storage area and operation method thereof | |
US20050132151A1 (en) | Portable electronic device | |
WO2008071222A1 (en) | Protecting a programmable memory against unauthorized modification | |
US20060289656A1 (en) | Portable electronic apparatus and data output method therefor | |
US20080104396A1 (en) | Authentication Method | |
JP7170999B2 (en) | Electronic devices that can protect sensitive data | |
CN112703703B (en) | Flash memory device for storing sensitive information and other data | |
JP2000181802A (en) | Semiconductor storage device | |
JPH10143441A (en) | Semiconductor device provided with secrecy holding function code processing method and storage medium storing software therefor | |
JP2007027955A (en) | Mobile communication system, mobile communication terminal and method for storing authentication data | |
JP2006024140A (en) | Random-number generator | |
CN107908980B (en) | Method for realizing encryption protection of memory data |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STCB | Information on status: application discontinuation |
Free format text: EXPRESSLY ABANDONED -- DURING EXAMINATION |