JPH09259104A - Dual-purpose maintenance architecture having protected internal operating system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To effectively and inexpensively provide a safe processing environment for dual mode processing. SOLUTION: In a general/external mode, a dual mode processor 12 executes the instruction that is supplied from an external supply source and this instruction is given to the processor via the input/output operations carried out to the processor. Receiving a special software or hardware interruption, the processor 12 inputs a maintenance/internal mode. This interruption specifies a maintenance function that is stored in a ROM of the processor 12. When the interruption is received, the input/output operations are disabled to the processor 12. Then the specified maintenance function is executed by the processor. When this execution is over, the input/output operations are enabled to the processor. At the same time, an exit routine is carried out in order to restart execution of the instruction that is supplied from the external supply source of the processor via the input/output operations.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to chip architectures and, more particularly, to a dual purpose secure chip architecture with a protected internal operating system.

[0002]

In processing applications, it is essential to operate in a secure environment so that operations cannot be explored or modified. Conventionally,
Various methods have been used to provide a secure processing environment.

For example, it is possible to use a mechanical chassis to house the processing equipment. The mechanical chassis may have tamper switches and other elements to detect and protect against interference and alteration. However, this mechanical chassis can add significantly to the cost of the product.

Also, in order to limit access to certain integrated circuits, the integrated circuits can be coated with epoxy resin or other chemicals to prevent access. But,
This coating often loses its effect easily and provides little protection.

Another method of providing a secure processing environment is:
Running the system on one integrated circuit. However, if a secure operating system is not running, these systems can also generally lose their effect. However, running a completely secure operating system for all functions severely limits the functionality of the system.

[0006]

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and an object thereof is to provide a means for inexpensively and efficiently providing a safe processing environment in dual mode processing. Especially.

[0007]

To achieve the above objects, the method of the present invention comprises the steps of (a) executing instructions provided by a source external to the processor, which instructions provide input / output to the processor. Via the processor, and (b) receiving an interrupt indicating a security function and at the same time performing the following sub-steps, said sub-steps comprising: (b.1) input to the processor. / A substep of disabling the output, (b.2) performing the integrity function specified by the interrupt, and instructions for the integrity function being stored in read-only memory within the processor;
(B.3) Upon completion of implementation of the integrity function, a substep of enabling an input / output to the processor and executing an exit routine that allows resumption of execution of instructions supplied by a source external to the processor; Instructions for the routine are stored in read-only memory.

[0008]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to FIGS. FIG. 1 shows a block diagram of a system in which a dual mode processor 12 is used in secure (internal) mode for encryption and decryption, according to a preferred embodiment of the present invention. The dual mode processor 12 communicates with the control channel processor 11 via the data channel 18 and the data channel 19. The data channels 18, 19 are equipped as input / output (I / O) buses that operate according to input / output bus standards, such as industry standard architecture (ISA). The control channel processor 11 supplies data to the dual mode processor 12. In addition, when the dual mode processor 12 is in the general (external) mode, the control channel processor 11 supplies the instructions that the dual mode processor 12 should execute.

The dual mode processor 12 is used to perform cryptographic functions such as cryptography or public key exchange. For example, FIG. 1 shows an encrypted data stream 1
4 shows a demultiplexer 13 receiving 4 and producing a demultiplexed decoded data stream 15.
The encrypted data stream 14 and the decrypted data stream 15 are composed of data blocks, that is, data packets transmitted to the demultiplexer 13 and transmitted from the demultiplexer 13, for example. The demultiplexer 13 transfers the encrypted data to the dual mode processor 12 via the data path 16. The dual mode processor 12 decodes this data and returns the decoded data to the demultiplexer 13 via the data path 17.

To protect the integrity of the cryptographic structure used, it is necessary to protect the cryptographic functions within the dual mode processor 12 from access or modification. To this end, the dual mode processor 12 has two operating modes. In the general mode, the dual mode processor 12 executes the instructions received from the control channel processor 11. In secure mode, dual-mode processor 12 performs cryptographic functions in a secure environment, as described in more detail below.

FIG. 2 shows a schematic block diagram of a dual mode processor 12 according to the present invention. The processing function is executed by the processing function circuit 21. For example, the processing function circuit 2
1 is a reduced instruction set computer (RISC) processor. The processing function circuit 21 uses a bus input / output (I /
O) Interfaces with the data channels 18 and 19 via the interface circuit 23. The processing function circuit 21 is interfaced to the data paths 16 and 17 via a cryptographic input / output (I / O) interface circuit 25.

Random access memory (RAM) 22
Are used by the processing function circuit 21 to store data and execute small blocks of code at high speed, for example. Read only memory (ROM) 24 is used to have integrity primitives which are executed by processing function circuitry 21 when dual mode processor 12 is in integrity mode. The I / O hardware control circuit 26 is addressed by the secure mode exit routine to release I / O control when the dual mode processor 12 is transitioning from secure mode to general mode. The hardware control circuit 26 is the dual mode processor 1
2 has exit logic that ensures that the dual-mode processor 12 executes a series of commands that it may not execute if it loses steps. By using the hardware control circuit 26 for transition between the maintenance mode and the general mode, the dual mode processor 12
However, it prevents the dual mode processor 12 from exiting maintenance mode prematurely or incompletely if a step is lost, for example due to a power failure or interference. When an interference or failure affects the operation of the dual-mode processor 12 during the maintenance mode, the hardware control circuit 26 locks the dual-mode processor 12 and requests a reset before the operation of the dual-mode processor 12 resumes. .

Upon entering secure mode, hardware control circuit 26 inputs / outputs to dual mode processor 12.
Disable output. Upon exiting maintenance mode, the hardware control circuit 26 causes the dual mode processor 12 to
Enable input / output to.

In the secure mode, all external access to the processing function circuit 21 is disabled. Processing function circuit 21 executes only the integrity primitives in ROM 24 while in integrity mode. In integrity mode, processing function circuit 21 still has the ability to access external memory for data, but only to the extent allowed by integrity primitives in ROM 24. Furthermore,
In secure mode, dual mode processor 12 ignores any attempt to insert an illegal instruction.

Assurance logic 27 provides protection against physical and electrical interference. Assurance logic 27 is activated upon entering maintenance mode. FIG. 3 shows a flowchart showing the initial setting of the dual mode processor 12. In step 31, the system is reset. Upon reset, all input / output paths of dual mode processor 12 are disabled. In step 32, dual mode processor 12 performs a self test function to ensure proper operation. The executed self-test routine is ROM2 as a maintenance routine.
4 is stored. During the execution of the self-test routine, assurance logic 27 is activated to prevent physical and electrical interference with dual mode processor 12. Once the dual mode processor 12 has undergone the self test function, step 3
At 3, the maintenance mode exit routine is executed. The secure mode exit routine clears, or erases, all registers. The integrity mode exit routine then addresses the hardware control circuit 26 to release I / O control. In step 34,
The exit routine ends and the program manager is called. In step 35, the program manager manages the execution of external programming code executed by the dual mode processor 12 when the dual mode processor 12 is in the general mode.

FIG. 4 shows a flow chart illustrating the operation of dual mode processor 12 in the secure operating mode in accordance with the preferred embodiment of the present invention. Prior to step 41, the dual mode processor 12 is in general mode and the program manager manages the execution of external programming code executed by the dual mode processor 12. In step 41, a special software or hardware interrupt (SWI) is identified. Special software / hardware interrupts direct the dual mode processor 12 to enter the internal security operating system. The special software / hardware interrupt has an address stored in ROM 24 that indicates the function to be performed.

In step 42, the security operating system is entered. All inputs / outputs are I / O
It is disabled by the hardware control circuit 26. Assurance logic 27 is activated to protect dual-mode processor 12 from physical or electrical interference. ROM 2 specified by address in special software / hardware interrupt in step 43
Address functions within 4 are positioned by internal pointers. At step 44, the addressed function is performed. At step 45, the maintenance mode exit routine is executed. The secure mode exit routine clears, or erases, all registers. Then, the maintenance mode exit routine commands the hardware control circuit 26 to release the I / O control. In step 46, the exit routine ends and the program manager is called. In step 47, the program manager manages the execution of external programming code executed by the dual mode processor 12 when the dual mode processor 12 is in the general mode.

FIG. 5 shows an example of contents in the ROM 24. R
The OM 24 has a security mode entry routine 51. The integrity mode entry routine 51 is the first routine executed when entering the integrity mode or when the dual mode processor 12 is reset. The integrity mode entry routine 51 disables all I / O to the dual mode processor 12 and internal pointer 5 to jump to the integrity function 53.
Use 2. Each maintenance function in the plurality of maintenance functions 53 is 1
It consists of one or more integrity primitives. ROM24
The security functions stored within are diverse depending on the application being performed. For example, in the preferred embodiment, the security function 53 has the primitives used for cryptographic operations. After executing the maintenance function, the maintenance mode exit routine 54 is used to exit the maintenance mode.

In accordance with the preferred embodiment of the present invention, a secure mode within dual mode processor 12 is implemented. In general / external mode, dual mode processor 12 executes instructions provided by an external source. This instruction is provided to the processor via an input / output to the processor. Upon receiving a special software or hardware interrupt, the dual mode processor 12 enters secure / internal mode. This interrupt identifies a security function stored in read-only memory within dual mode processor 12. Upon receipt of this interrupt, the input / output to dual mode processor 12 is disabled. An internal pointer specified by the interrupt is used to locate the integrity function stored in read-only memory within the processor. The identified security function is performed by the processor. Attempts to insert instructions that have not occurred from read-only memory are ignored while performing the integrity function. However, the processor is allowed to access the data specified by the integrity function performed.

After the integrity function has been performed, the exit routine is enabled to enable inputs / outputs to the processor and resume execution of instructions provided via inputs / outputs from sources external to the processor. To be executed. Instructions for the exit routine are also stored in read-only memory.

In the preferred embodiment, the exit routine uses special hardware control circuitry 26 to enable inputs / outputs to the processor.
Also, in the preferred embodiment, upon reset, the processor self-tests in maintenance mode with inputs / outputs disabled. After completing the implementation of the self-test function,
An exit routine is executed to enable inputs / outputs to the processor and begin executing instructions supplied via inputs / outputs from sources external to the processor. Assurance hardware is used to protect against physical and electrical interference.

The dual mode processing system is used to perform cryptographic functions such as cryptographic or public key exchange. For example, one of such applications
In one, data blocks, or data packets, are intercepted and sent to the dual mode processor 12. The primitives that encrypt / decrypt data are stored in read-only memory within the processor. These primitives are executed when the dual mode processor is in secure mode. Other system functions are performed in general mode.

The present invention provides an inexpensive and efficient means of providing dual mode processing. When operating in general mode, all external instructions are executable without the overhead associated with a secure operating system. During operation in integrity mode operation, integrity functions are performed to be protected from modification and exploration.

The foregoing merely discloses and describes exemplary methods and embodiments of the present invention. As those skilled in the art will appreciate, the present invention may be embodied in other ways without departing from its spirit or essential characteristics. Accordingly, the disclosure of the present invention is provided by way of illustration and not by way of limitation, of the scope of the present invention.

[0025]

As described in detail above, according to the present invention,
In the dual mode processing, there is an excellent effect that a safe processing environment can be provided inexpensively and efficiently.

[Brief description of drawings]

FIG. 1 is a block diagram of a system in which a dual mode processor is used in secure mode for encryption and decryption, according to a preferred embodiment of the present invention.

FIG. 2 is a schematic block diagram of the dual mode processor shown in FIG. 1 according to a preferred embodiment of the present invention.

FIG. 3 is a flow chart showing initialization of the dual mode processor shown in FIG. 2 according to a preferred embodiment of the present invention.

FIG. 4 is a flow chart illustrating operation of a dual mode processor in secure operating mode according to a preferred embodiment of the present invention.

FIG. 5 is a block diagram showing the contents of ROM in the dual mode processor shown in FIG. 2 according to a preferred embodiment of the present invention.

[Explanation of symbols]

12 ... Dual mode processor, 26 ... Hardware control circuit.

 ─────────────────────────────────────────────────── ─── Continued Front Page (71) Applicant 596043357 1109 McKay Drive M / S45 San Jose California a 95131 USA

Claims (15)

[Claims] 1. A computer-implemented method for providing an integrity mode within a processor, the method comprising: (a) executing instructions provided by a source external to the processor, the instructions providing input / output to the processor. At the same time as being supplied to the processor via (b) receiving an interrupt indicating a security function,
Performing the following sub-steps, said sub-steps comprising: (b.1) input to the processor /
A substep of disabling output, (b.2)
A sub-step for executing a security function specified by an interrupt, an instruction for the security function is stored in a read-only memory in the processor, and (b.3) an input / output to the processor at the same time when the execution of the security function is completed. A computer with substeps for enabling and resuming execution of instructions supplied by a source external to the processor, the instructions for the exit routine being stored in read-only memory. Execution method. 2. The computer-implemented method of claim 1, wherein enabling input / output to a processor in said sub-step (b.3) is performed by a hardware control circuit (26). 3. (c) Upon receipt of a reset by the processor, (c.1) disabling inputs / outputs to the processor, (c.2) performing a self test of the processor, and the instruction for the self test is the processor The computer-implemented method of claim 1, further comprising the step of: (c.3) executing an exit routine upon completion of execution of the self-test function stored in a read-only memory therein. 4. The computer-implemented method of claim 1, wherein said sub-step (b.2) includes using an internal pointer identified by an interrupt, the internal pointer pointing to a security function. 5. The computer-implemented method of claim 1, wherein said sub-step (b.2) comprises executing a primitive to encrypt / decrypt a data stream. 6. Instruction executing means for executing instructions,
A primitive having instructions, comprising input / output means for supplying external instructions by a source external to the dual mode processor (12), and read-only memory storing the primitives for a secure operating system. A function for disabling input / output to the dual mode processor (12) when executed by the executing means, a function for executing a security function specified by an interrupt for the dual mode processor (12), and an implementation of the security function. Upon completion, the ability to enable an input / output to the dual mode processor (12) and to execute an exit routine that allows resumption of execution of instructions supplied by a source external to the dual mode processor (12). Dual mode Processor. 7. An input / output to a dual mode processor (12) is enabled when called by the exit routine and an input / output to the dual mode processor (12) is disabled when entering maintenance mode. 7. The dual mode processor of claim 6, further comprising special circuitry used in the. 8. The dual mode processor of claim 7, further comprising assurance hardware that provides physical and electrical integrity to the dual mode processor (12) when the dual mode processor is in the secure mode. 9. The read-only memory further stores a primitive and is responsive to a dual-mode processor (12) that receives a reset when the primitive is executed by an instruction executing means, the dual-mode processor (12). ) /
7. The dual mode processor of claim 6, wherein the output is disabled, the dual mode processor (12) is self-tested and the exit routine is executed at the same time the self-test function is completed. 10. The dual-mode processor of claim 6, wherein the read-only memory has an internal pointer to a secure function, the internal pointer being indicated by an interrupt to the dual-mode processor (12). 11. The dual mode processor of claim 6, wherein the integrity function comprises a primitive to encrypt / decrypt a data stream. 12. A system for performing a cryptographic function on data in a data stream, the system comprising a shut-off means for shutting off a data stream and a dual-mode processor, the dual-mode processor (12) executing instructions. Instruction executing means for executing, input / output means for supplying external instructions by a source external to the dual mode processor (12), and read only memory storing primitives for a secure operating system. A primitive having the instruction, when executed by the instruction executing means, disables input / output to the dual mode processor (12) and implements a security function manifested by an interrupt to the dual mode processor (12). And the special feature is the data stream Includes primitives for encrypting / decrypting data in the dual-mode processor (12), as well as enabling inputs / outputs to the dual-mode processor (12) upon completion of performing any integrity function. A system that performs the functions of executing an exit routine that allows resumption of execution of an instruction supplied by a source. 13. The dual mode processor (1)
13. The system of claim 12, wherein 2) further comprises special circuitry to enable inputs / outputs to the dual mode processor (12) when called by the exit routine. 14. The dual mode processor (12) further responsive to a dual mode processor (12) for storing primitives and receiving a reset when the primitives are executed by an instruction executing means. Input for /
13. The system of claim 12, wherein the output is disabled, the dual-mode processor (12) is self-testing, and the function of executing an exit routine upon completion of self-testing is completed. 15. The system of claim 12, wherein the read-only memory has an internal pointer to a security function, the internal pointer being indicated by an interrupt to a dual mode processor (12).