TW201546646A - Embedded system and a method of protecting contents thereof - Google Patents

Abstract

An embedded system capable of protecting its contents includes a security integrated circuit (IC) having an identification (ID) key storage for storing an ID key; and a system device having a system key storage for storing a system key. The system key is derived from a mathematical operation performed on the ID key and a function array. Before the embedded system activates functions, a mathematical operation is performed on the ID key and the system key to obtain the function array, according to which the functions are activated.

Description

Embedded system and content protection method

The present invention relates to a content protection mechanism, and more particularly to a software protection architecture for an embedded system.

Since the cost of software development is generally larger than hardware, it is necessary to use appropriate mechanisms to protect the software to reduce the illegal use or copying of the software. The first A picture shows a traditional software protection mechanism, which has a corresponding pass code A for a software function (or version) A. The software function A can be started when the pass code A is confirmed to be valid. When the software is upgraded to function B, as shown in the first B diagram, another corresponding new password B is required to start the software function B. The user must return the system to the factory for replacement with the new passcode B, thus causing an increase in cost and inconvenience to the user.

In order to improve the above-mentioned traditional software protection mechanism (first A picture, first B picture), the user needs to send the system back to the factory is inconvenient, so there is another software protection mechanism proposed, as illustrated in the second figure. In this software protection mechanism, the user only uses a single pass code C, and different software functions store different corresponding codes. If the software function C1 is in the system, the software function C1 is started when the pass code C is confirmed to be valid; if the software function C2 is in the system, the software function C2 is started when the pass code C is confirmed to be valid. For the software protection mechanism shown in the second figure, the software thief (that is, the person who has not legally purchased the upgrade software function C2) can easily use the software function C2 by copying the software function C2 and matching the original pass code C.

In view of the fact that traditional software protection mechanisms cannot effectively prevent software from being illegally used or copied, it is urgent to propose a novel software protection mechanism to improve the shortcomings of traditional software protection mechanisms.

In view of the above, one of the objects of the embodiments of the present invention is to provide an embedded system with content protection capability, which performs mathematical operations on the identification key and the function array to obtain a system key. When the embedded system wants to start the function, the recognition key and the system key are mathematically operated to obtain an array of functions to activate the functions required by the user. Since different embedded systems store different identification keys and system keys, content can be prevented from being stolen. In addition, when upgrading, the user does not need to change the identification key and can directly use the upgraded function.

According to an embodiment of the invention, an embedded system includes a secure integrated circuit and system means. The security integrated circuit is provided with an identification key storage device for storing an identification key. The system device is provided with a system key storage device for storing a system key. The system key is obtained by mathematically computing the identification key and a functional array representing one or more functions required by the embedded system. When the embedded system wants to initiate these functions, the identification key is mathematically operated with the system key, thereby obtaining an array of functions to initiate the required functions.

Figure 3A shows a system block diagram of an embedded system 300 in accordance with an embodiment of the present invention having the ability to protect content, such as software. In the present embodiment, the embedded system 300 mainly includes a security integrated circuit (security IC) 31 and a system device 32. Although the safety integrated circuit 31 shown in FIG. 3A is separate from the system device 32, it may be integrated.

The secure integrated circuit 31 includes an ID key storage device 311 for storing an identification key. The system device 32 includes a system key storage device 321 for storing a system key corresponding to the identification key. In the present embodiment, the identification key storage device 311 can be implemented using a mask-only memory (Mask ROM) or using one-time programming (OTP) memory. The system key storage device 321 can be implemented using flash memory or electronic erasable programmable read only memory (EEPROM).

The third B diagram illustrates that the identification key A is stored in the identification key storage device 311, and the system key B is stored in the system key storage device 321. The identification key A of the embodiment has a corresponding relationship with the system key B, but in general, the contents of the two are different. The third C diagram shows the corresponding relationship between the identification key A and the system key B. In detail, depending on one or more functions F0, F1, F2 ... Fn required by the user, a function array is assigned, which can be represented using a binary value. For example, if the user requires functions F0, F1, and F4, the value of the function array can be represented as 00...0010011 (bits 0, 1, 4 are "1" and other bits are "0"). In other words, the functional array is represented as a binary value and the validity of the functions is represented by the bit position. The function array is subjected to a mathematical operation, such as an encryption operation, with the identification key A, thereby obtaining the system key B. When the embedded system 300 is to initiate a software function, the identification key A and the system key B are subjected to mathematical operations, such as encryption operations, so that a functional array can be obtained to activate one or more software functions required by the user.

The fourth figure shows a flow chart of the content protection method of the embedded system 300 of the embodiment of the present invention. The system device 32 checks in step 41 whether or not the secure integrated circuit 31 is present before executing the software. If so, proceed to step 42 to perform mathematical operations on the identification key A and the system key B using an algorithm, such as an encryption algorithm. Next, in step 43, it is checked whether the mathematical operation result (that is, the function array) is correct. For example, check if the cyclic redundancy check (CRC) is correct. If it is correct, proceed to step 44 to determine which one or more of the software functions are required by the user based on the mathematical operation result (of step 42). For example, if the binary value of the mathematical operation result obtained in step 42 is represented as "00...0010011", and the bits 0, 1, and 4 are "1", it is known that the required software function is F0, F1 and F4.

The fifth figure illustrates the system block diagrams of the embedded systems 300X, 300Y, and 300Z of three users X, Y, and Z, respectively. In this example, the identification key storage device 311 of the user X stores the identification key A1, and the system key storage device 321 stores the corresponding system key B1. The identification key storage device 311 of the user Y stores the identification key A2, and the system key storage device 321 stores the corresponding system key B2. The identification key storage device 311 of the user Z stores the identification key A3, and the system key storage device 321 stores the corresponding system key B3. In general, the identification keys A1, A2, A3 are different from each other, and the system keys B1, B2, B3 are also different from each other. According to the embodiment illustrated in the fifth figure, since different embedded systems 300X, 300Y, and 300Z store different identification keys and system keys, software pirates cannot illegally use by copying other people's system keys or software functions. software.

The sixth figure illustrates a system block diagram of the embedded system 300 of the present embodiment applied to software upgrade. In this example, the corresponding system key of the software function FI is B1, and the corresponding system key of the upgraded software function FII is B2. When the user is legally upgraded, the system key storage device 321 will change to store the system key B2, but the identification key storage device 311 still stores the original identification key A1.

According to the embodiment shown in FIG. 6, when the software upgrade is performed, the user does not need to replace the identification key (that is, the embedded system 300 does not need to be sent back to the factory to replace the security integrated circuit 31), and the upgrade can be directly used. After the software function. In addition, as mentioned above, since different embedded systems store different identification keys and system keys, software pirates (that is, those who do not legally purchase upgrade software functions) are not easily able to steal software by copying.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention; all other equivalent changes or modifications which are not departing from the spirit of the invention should be included in the following Within the scope of the patent application.

300‧‧‧ embedded system
300X‧‧‧ embedded system
300Y‧‧‧ embedded system
300Z‧‧‧ embedded system
31‧‧‧Safe integrated circuit
311‧‧‧ID storage device
32‧‧‧System installation
321‧‧‧System Key Storage Device
41‧‧‧Whether the safety integrated circuit exists
42‧‧‧Mathematical operations
43‧‧‧Is the result of the operation correct?
44‧‧‧Determining the function of the software

The first A picture and the first B picture show a conventional software protection mechanism. The second figure shows another traditional software protection mechanism. Figure 3A shows a system block diagram of an embedded system in accordance with an embodiment of the present invention. The third B diagram illustrates that the identification key is stored in the identification key storage device of the third A picture, and the system key is stored in the system key storage device. The third C diagram shows the corresponding relationship between the identification key and the system key. The fourth figure shows a flow chart of a content protection method of an embedded system according to an embodiment of the present invention. The fifth figure illustrates a system block diagram of an embedded system of three users, respectively. The sixth figure illustrates a system block diagram of the embedded system of the embodiment applied to the software upgrade.

300‧‧‧ embedded system

31‧‧‧Safe integrated circuit

311‧‧‧ID storage device

32‧‧‧System installation

321‧‧‧System Key Storage Device

Claims (20)

An embedded system with content protection capability, comprising: a secure integrated circuit with an identification key storage device for storing an identification key; and a system device provided with a system key storage device for storing a system key Wherein the system key is obtained by mathematically computing the identification key and a functional array, the functional array representing one or more functions required by the embedded system; when the embedded system is to initiate the functions, The identification key is mathematically operated with the system key, thereby obtaining an array of functions for enabling the required functions. The embedded system with content protection capability according to claim 1, wherein the identification key storage device comprises a mask read-only memory or a single-time programmable memory. The content protection capable embedded system according to claim 1, wherein the system key storage device comprises a flash memory or an electronic erasable programmable read only memory. An embedded system with content protection capability according to claim 1 of the scope of the patent application, wherein the content includes software. An embedded system with content protection capability according to claim 1 of the scope of the patent application, wherein the mathematical operation comprises an encryption operation. The embedded system with content protection capability according to claim 1 of the patent application scope, wherein the function array is represented as a binary value, and the validity of the functions is represented by a bit position. The embedded system with content protection capability according to claim 1 of the patent application scope further includes: the embedded system checking whether the security integrated circuit exists. The embedded system with content protection capability according to claim 1, wherein the step of performing the mathematical operation to obtain the functional array further comprises: checking whether the function array obtained by the mathematical operation is correct. The embedded system with content protection capability according to claim 1 of the patent application scope, wherein the identification keys of different embedded systems are different from each other, and the system keys are also different from each other. According to the embedded system with content protection capability according to Item 1 of the patent application scope, the identification key of the same embedded system is fixed, and the system key thereof is changed due to the software upgrade. A content protection method for an embedded system, comprising: performing a mathematical operation on a recognition key and a function array to obtain a system key, the function array representing one or more functions required by the embedded system; storing the identification key Storing the system key in the system device; and when the embedded system starts the functions, performing mathematical operations on the identification key and the system key, thereby obtaining the function array, according to the startup These features are required. The content protection method of the embedded system according to claim 11, wherein the identification key is stored in a mask read-only memory or a single-time programmable memory. The content protection method of the embedded system according to claim 11, wherein the system key is stored in a flash memory or an electronic erasable programmable read only memory. The content protection method of the embedded system according to claim 11, wherein the content includes software. The content protection method of the embedded system according to claim 11, wherein the mathematical operation comprises an encryption operation. The content protection method of the embedded system according to claim 11, wherein the function array is represented as a binary value, and the validity of the functions is represented by a bit position. According to the content protection method of the embedded system according to claim 11, the embedded system further checks whether the secure integrated circuit exists. The content protection method of the embedded system according to claim 11, wherein the step of performing the mathematical operation to obtain the function array further comprises: checking whether the function array obtained by the mathematical operation is correct. The content protection method of the embedded system according to claim 11, wherein the identification keys of the different embedded systems are different from each other, and the system keys are also different from each other. According to the content protection method of the embedded system according to claim 11, wherein the identification key of the same embedded system is fixed, and the system key thereof is changed after the software is upgraded.