JP2000029790A - Data security system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a data security system, capable of being reduced in cost, even in when it is incorporated inside a microcomputer system to be one-chip configuration only by adding a small-scale circuit, and preventing the alteration of a program by a third party and improving security and secretness confidentiality function to an exterior memory. SOLUTION: A microcomputer system composed of a 1-chip microcomputer is provided with an exclusive-OR means 12, a function for converting the address and data signals in address and data lines with the exterior memory 14 is provided by the exclusive-OR means 12 and the address and data signals converted by the function or only instruction code signals are stored in the exterior memory 14 beforehand.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a data security system having a security function for data in an external memory in a microcomputer system.

[0002]

2. Description of the Related Art In recent years, microcomputer systems have been integrated into one chip, and such a system can be realized at low cost and its operation speed can be increased.
However, there is a limit to the capacity of the internal memory in the one-chip implementation, and the program needs to be rewritable because the program is changed during long-term operation of the system. Therefore, when the scale of the program is large, a rewritable external memory (EPROM, flash memory, or the like) is used as a storage device, and 1
The system must be configured by connecting to the outside of the chip microcomputer.

In the microcomputer system connected in this way, since the external memory and wiring are outside the one-chip microcomputer, the contents of the program can be viewed. Further, since the instruction code is determined for each CPU, If the model of the CPU is known, it is easy to decode the contents of the program.
Also, by decoding the contents of the program, the contents are arbitrarily altered and the security of the system is reduced.

[0004] For example, when data encrypted in a disc is decrypted by a password decrypting chip and used, as in a DVD system, when instructions of the password decrypting chip are stored in an external memory, If the external memory is decrypted, there is no point in encrypting the data on the disk,
Data in the DVD disk is used illegally.
In such a case, it is necessary to enhance the security of the internal data of the external memory.

Therefore, as a conventional technique for improving the confidentiality and security of an external memory to improve its security, as shown in FIG. 6, a security having a function of converting a bit arrangement of an address and data is used. There is a system.

FIG. 6 schematically shows the connection between a one-chip microcomputer and an external memory in a conventional data security system. In FIG. 6, 41 is a CPU, 42 is a bit switching means, 43 is an external memory, and 44 is a built-in memory. A bit exchange means 42 for converting a bit arrangement is incorporated between the CPU 41 and the external memory 43, and the bit exchange means 42 is capable of exchanging all bits of the address A0... An or the data D0.

However, assuming that all of them can be exchanged, it is necessary for the bit exchange means 42 to arrange its circuits in a matrix as shown in FIG. In FIG.
45 is a three-state buffer circuit, and 46 is a NAND circuit. FIG. 7 shows a case where the address is two bits A0 and A1 and the data is two bits D0 and D1. When the address / data is n bits, n ² or more logic circuits are required, and n is large. As the circuit scale increases as the square, the area of the circuit added to the one-chip microcomputer increases.

Reference data for bit conversion is as follows:
It is stored in the external memory 43 as a conversion table. Therefore, once this configuration is understood, the above-mentioned conversion table can be referred to, the conversion rules can be easily decoded, and the program in the external memory 43 is analyzed. The nature becomes high.

[0009]

As described above, in the conventional data security system, since the conversion table is stored in the external memory 43, the rule of conversion is immediately decoded, and the conversion is performed in such a manner. If the rule is deciphered, the program is easily read, and the program in the external memory 43 is easily modified.

[0010] Further, the bit replacement means 4 as described above.
If the microcomputer system is used, the circuit configuration becomes complicated. If such a bit replacement means 42 is built in the microcomputer system and the microcomputer system is integrated into one chip, the production cost increases. There were also problems.

The present invention solves the above-mentioned conventional problems, and can reduce the cost even if only a small-scale circuit is added and it is built in a microcomputer system to form one chip. As a security function for an external memory, a data security system capable of preventing a third party from altering a program and improving security and confidentiality is provided.

[0012]

In order to solve the above-mentioned problems, a data security system according to the present invention is provided with an exclusive-OR means in a microcomputer system, and the exclusive-OR means enables communication with an external memory. Having a function of converting an address and data signal or an instruction code signal on an address and data line or an instruction code line,
Only addresses and data signals or instruction code signals converted by the function are stored in advance in an external memory, and an instruction code conversion table is provided in the microcomputer system, and the external memory is referred to by referring to the instruction code conversion table. And a function of converting an instruction code signal in an instruction code line between the two, and storing only the instruction code signal converted by the function in an external memory in advance.

As described above, the cost can be reduced even if only a small-scale circuit is added and the chip is built in the microcomputer system to form a single chip. Can prevent the program from being altered, thereby improving security and confidentiality.

[0014]

DESCRIPTION OF THE PREFERRED EMBODIMENTS A data security system according to a first aspect of the present invention is a data security system having a security function for data in an external memory connected to the outside of a microcomputer system having a CPU. Exclusive OR means for performing an exclusive OR operation on a plurality of signals; and key setting means for setting a key for performing an exclusive OR operation by the exclusive OR means. Logical OR means and key setting means, having a function of converting an address signal and a data signal output to an address line and a data line which are connection lines between the microcomputer system and the external memory,
By using only the address signal and the data signal converted by the exclusive OR means and the key setting means, the security function prevents data in the external memory from being altered.

According to a second aspect of the present invention, in the microcomputer system having a CPU,
An exclusive OR means for performing an exclusive OR operation on a plurality of signals, the data security system having a security function for data in an external memory externally connected through an internal bus of the CPU, Key setting means for setting a key for performing an exclusive OR operation by the exclusive OR means, wherein the exclusive OR means and the key setting means connect the internal bus in the CPU to the instruction decoder. It has a function of converting an instruction code output to an instruction code line which is a connection line, and uses only the instruction code converted by the exclusive OR means and the key setting means, thereby improving security in the security function. Is increased.

A data security system according to claim 3 is a microcomputer system having a CPU,
A data security system having a security function for data in an external memory externally connected through an internal bus of the CPU, wherein the data security system converts an instruction code from the internal bus and controls instruction execution in the CPU. And an instruction code conversion table referred to when the instruction code is converted by the instruction decoder.The instruction decoder and the instruction code conversion table allow an internal bus in the CPU to be A function of converting an instruction code output to an instruction code line, which is a connection line with the instruction decoder, and controlling only the signals converted by the instruction decoder and the instruction code conversion table to execute instructions in the CPU; By using for the signal, the security in the security function A configuration with enhanced.

According to a fourth aspect of the present invention, there is provided a data security system including a nonvolatile memory for storing a key set by the key setting means according to the first or second aspect. Using a replaceable memory, the configuration of the key can be changed.

According to the first, second, or fourth aspect of the present invention, the microcomputer system has an exclusive OR means, and the exclusive OR means allows the address and data to be transferred to and from the external memory. It has a function of converting an address and data signal or an instruction code signal on a line or an instruction code line, and stores only the address and data signal or the instruction code signal converted by the function in an external memory in advance.

According to the third aspect of the present invention, the microcomputer system includes an instruction code conversion table, and converts an instruction code signal on an instruction code line between the microcomputer system and an external memory with reference to the instruction code conversion table. And only the instruction code signal converted by the function is stored in the external memory in advance.

Hereinafter, a data security system according to an embodiment of the present invention will be specifically described with reference to the drawings. The data security system according to claim 1 will be described below.

FIG. 1 schematically shows the connection between a one-chip microcomputer and an external memory in the data security system according to the first embodiment. In FIG. 1, reference numeral 11 denotes a CPU, 12 denotes exclusive OR means, 13 denotes a key circuit as key setting means, 14 denotes an external memory, and 15 denotes a built-in memory.

In the one-chip microcomputer, the address (A
0-An), CPU having data (D0-Dm) space
When a program is written or read from the external memory 14 to the external memory 14, the exclusive-OR means 12 stores the address and data and the constant of the key circuit 13 (hereinafter referred to as a key) determined at the time of manufacture in the one-chip microcomputer. Is converted by performing an exclusive OR operation, thereby hiding the external memory 14.

FIG. 2 is a detailed connection diagram of the exclusive OR means 12 and the key circuit 13 in the data security system shown in FIG. In FIG. 2, 16 is an exclusive OR circuit, 17 is a write-side three-state buffer circuit, 18
Is a read-side three-state buffer circuit, 19 is a write control signal, and 20 is a read control signal.

When the address / data is n bits, it can be constituted by about n logic circuits. When n is large, it can be realized by 1 / n compared to the conventional bit replacement means 42. Since the exclusive OR operation is a simple inversion operation using a key to be referred to, an address / data value between two different points does not overlap with the same address / data value, and a value is obtained one-to-one even after conversion. be able to.

The written program in the external memory 14 is written in advance in the order of address / data obtained by performing an exclusive OR operation with the key. Therefore, the contents are not easily decoded from the external memory 14 side.

When writing to the external memory 14, the write control line 19 is selected, the write-side three-state buffer circuit 17 operates, and the CPU 11 in FIG.
Data is written from the side to the external memory 14 side. or,
When reading from the external memory 14, the read control line 2
0 is selected, the read-side three-state buffer circuit 18 operates, and data is read from the external memory 14 to the CPU 11. The address value /
Data values are converted.

At first glance, the converted data looks like the instruction code of the CPU has changed, but the instruction code itself has not changed. Originally, the instruction code is determined for each CPU, and if the model of the CPU is known, the instruction code in the external memory can be easily analyzed. Even in the case of claim 1, if the model of the CPU is known, the key information can be understood by analyzing the data in the external memory, and the contents of the external memory can be understood.

The form of the instruction is: instruction code + parameter +
It consists of + parameters, of which only the instruction code is converted. A method of converting the instruction code itself to enhance security will be described below.

The data security system according to claim 2 will be described below. FIG. 3 shows a schematic configuration of a one-chip microcomputer in the data security system according to the second aspect. 3, reference numeral 21 denotes a general-purpose register group, 22 denotes a processor status word, 23 denotes an instruction execution control unit, 24 denotes exclusive OR means, 25 denotes a key circuit as key setting means, 26 denotes an instruction decoder, and 27 denotes AL.
U and 28 are program counters, 29 is an internal bus, 30
Is an address bus, 31 is a data bus, and 32 is a control bus. The instruction code in the external ROM is written in advance with an instruction code corresponding to the key circuit 25 set by the user. The internal bus 29 is connected to the address bus 30, the data bus 31, and the control bus 32.

The operation of instruction execution will be described below. Exclusive ORing means 24 and key circuit 2
5, the exclusive OR of the instruction code is calculated, and CP
The instruction code is converted into an instruction code determined for each U, and transferred to the instruction execution control unit 23. The instruction execution control unit 23 controls execution by transmitting a control signal for the instruction to the instruction execution unit.
The data is held in the general-purpose register group 21, the operation is performed by the ALU 27, the state of the operation result is stored in the processor status word 22, the value of the program counter 28 is set to the next address value, and the process proceeds to the next instruction execution.

By converting the instruction code itself, C
The contents of the external memory cannot be decoded from the PU model, and the security can be improved as compared with the case where the instruction code is not converted. When the instruction code has a length of n bits, the number of bits of the key is n bits, and there are 2 ⁿ binary numbers that can be represented by n bits. Therefore, security can be improved by 2 ⁿ times.

The data security system according to claim 3 will be described below. FIG. 4 shows a schematic configuration of a one-chip microcomputer in the data security system according to the third aspect. In FIG. 4, reference numeral 33 denotes an instruction code conversion table. The instruction code conversion table 33 can be set for each user. The instruction code in the external memory is written in advance with an instruction code corresponding to the instruction code conversion table 33 set by the user.

The operation of instruction execution will be described below. The instruction code of the external memory is transmitted through the internal bus 29 to the instruction decoder 2.
Sent to 6. The transmitted instruction code is transmitted to the instruction decoder 26.
By referring to the instruction code conversion table 33, the instruction code is converted into an instruction code originally determined for each CPU, and is passed to the instruction execution control unit 23.

The instruction execution control unit 23 controls execution by transmitting a control signal for the instruction to the instruction execution unit. The data is held in the general-purpose register group 21, an operation is performed by the ALU 27, and the state of the operation result is stored in the processor status word 22.
, The value of the program counter 28 is set to the next address value, and the process proceeds to the next instruction execution.

As in the case of the data security system of claim 2, by converting the instruction code itself,
The contents of the external memory cannot be decrypted by the model of the CPU, and the security can be improved more than when the instruction code is not converted.

When the instruction code is n bits,
4. The method according to claim 3, wherein all binary numbers represented by n bits can be exchanged, and there are 2 ⁿ factorials.
The security can be improved more than in the case of the data security system.

The data security system according to claim 4 will be described below. FIG. 5 schematically shows the connection between the one-chip microcomputer and the external memory in the data security system according to the fourth aspect. In FIG. 5, 11
Is a CPU, 12 is an exclusive OR circuit, 13 is a key circuit,
14 is an external memory, 15 is a built-in memory, and 34 is a key storage memory.

A key storage memory 34 is provided for storing constants referred to in the exclusive OR operation. The key X bits (the number obtained by adding the address bit number n and the data bit number m) are set for each user and stored in the key storage memory 34. When writing data from the CPU 11 to the external memory 14, the exclusive OR means 12 takes the exclusive OR of the set key and the address to be written to the external memory 14.

Next, write data to the external memory 14 is obtained by exclusive OR of the write data and the key. This is written to the external memory 14. Similarly, at the time of reading, the address of the external memory 14 is designated by taking the exclusive OR of the address read from the external memory 13 and the key, and then the data read from the external memory 14 and the key Data to be read is obtained by taking the exclusive OR.

The key storage memory 34 can be written and read by a user.

[0041]

As described above, according to the first or second or fourth aspect of the present invention, the microcomputer system is provided with the exclusive OR means, and the exclusive OR means is used to control the external memory. Has the function of converting the address and data signal or instruction code signal on the address and data line or the instruction code line between them, and stores only the address, data signal or instruction code signal converted by that function in the external memory in advance You can keep.

According to the third aspect of the present invention, the microcomputer system includes an instruction code conversion table, and refers to the instruction code conversion table to convert an instruction code signal on an instruction code line between the microcomputer and the external memory. It has a conversion function, and only the instruction code signal converted by the function can be stored in the external memory in advance.

As described above, the cost can be reduced even if only a small-scale circuit is added and the chip is built in the microcomputer system to form a one-chip configuration. It is possible to prevent a user from altering the program and improve security and confidentiality.

[Brief description of the drawings]

FIG. 1 is a schematic configuration diagram of a data security system according to a first embodiment of the present invention;

FIG. 2 is a connection diagram of an exclusive OR means and a key circuit according to the embodiment;

FIG. 3 is a schematic configuration diagram of a data security system according to a second embodiment of the present invention;

FIG. 4 is a schematic configuration diagram of a data security system according to a third embodiment of the present invention.

FIG. 5 is a schematic configuration diagram of a data security system according to a fourth embodiment of the present invention.

FIG. 6 is a schematic configuration diagram of a conventional data security system.

FIG. 7 is a schematic configuration diagram of a bit replacement unit in the conventional example.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 11 CPU 12 Exclusive OR means 13 Key circuit 14 External memory 15 Internal memory 16 Exclusive OR circuit 17 Write-side three-state buffer circuit 18 Read-side three-state buffer circuit 19 Write control signal 20 Read control signal 21 General-purpose register group 22 Processor Status Word 23 Instruction Execution Control Unit 24 Exclusive OR Means 25 Key Circuit 26 Instruction Decoder 27 ALU 28 Program Counter 29 Internal Bus 30 Address Bus 31 Data Bus 32 Control Bus 33 Instruction Code Conversion Table 34 Key Storage Memory

Claims (4)

[Claims] 1. A microcomputer system having a CPU, which is a data security system having a security function for data in an external memory connected to the outside thereof, wherein the microcomputer performs an exclusive OR operation on a plurality of signals. Logical sum means, and key setting means for setting a key for performing an exclusive OR operation by the exclusive OR means, wherein the exclusive OR means and the key setting means allow the microcomputer system to be connected to the outside of the microcomputer system. Having a function of converting an address signal and a data signal output to an address line and a data line which are connection lines between the memory and the address signal and the address signal converted by the exclusive OR means and the key setting means. By using only the data signal, the security function prevents data in the external memory from being altered. Tea system. 2. A data security system having a CPU and having a security function for data in an external memory externally connected through an internal bus of the CPU, wherein the microcomputer system has an exclusive logic for a plurality of signals. Exclusive OR means for performing a sum operation, and key setting means for setting a key for performing an exclusive OR operation by the exclusive OR means, wherein the exclusive OR means and the key setting means Having a function of converting an instruction code output to an instruction code line which is a connection line between an internal bus in the CPU and an instruction decoder, wherein the instruction code converted by the exclusive OR means and the key setting means is provided. A data security system that enhances security in the security function by using only the security function. 3. A data security system comprising a microcomputer system having a CPU and having a security function for data in an external memory externally connected through an internal bus of the CPU, wherein the microcomputer converts an instruction code from the internal bus. An instruction decoder for outputting a signal for controlling instruction execution in the CPU;
An instruction code conversion table referred to when the instruction code is converted by the instruction decoder; and
Has a function of converting an instruction code output to an instruction code line, which is a connection line between an internal bus and an instruction decoder, and executes only signals converted by the instruction decoder and the instruction code conversion table in the CPU. A data security system in which the security of the security function is enhanced by using a signal for controlling the security function. 4. A non-volatile memory for storing a key set by a key setting means, wherein a rewritable memory is used as the non-volatile memory so that the key setting can be changed. Claim 1 or Claim 2
A data security system as described in.