JP2002026898A - Encryption processing device with test method not causing security hole - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a test method not causing a security hole for a random number generating circuit in the case of testing/verifying the circuit with a constant initial value in a specific mode where the circuit using an initial value has not a constant value at application of power and after reset for the encryption and authentication processing. SOLUTION: This invention provides the encryption processing unit that is provided with an interface section for transmission reception with an external device, an authentication control section that controls the authentication with the external device, a memory that stores data received from the external device, a memory control section that controls an access to the memory, and a switch section that revises a degree of difficulty or the propriety of authentication by the authentication control section, and is configured such that the processing unit limits access to the memory when the switch section is turned on and a degree of the difficulty or the propriety of authentication is revised.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a cryptographic processing device, and more particularly, to a technique of a test method for a device that performs cryptographic authentication processing.

[0002]

2. Description of the Related Art In a device such as a semiconductor audio player for storing and reproducing data such as music, it is necessary to perform encryption when storing data from the viewpoint of copyright protection and the like. As the encryption processing, a procedure of performing authentication processing and then encrypting data is generally used. At this time, a method that makes it difficult to decipher the encryption processing method is often used by setting the initial value of the random number not to be the same after turning on the power of the device performing the encryption process or after resetting.

FIG. 1 shows that the initial value of the random number value is not constant.
It is an example of a conventional cryptographic processing device. In FIG. 1, an external device 101 is a device such as a semiconductor audio player that handles encrypted data, and a cryptographic processing device 100 is a storage medium having a function of authenticating access permission such as an SD card. In the cryptographic processing device 100, the external device interface unit 102
1 and input / output of encrypted data, encryption key, etc. The authentication control unit 109 is a unit that performs a challenge response type authentication process with an external device. The random number required in the authentication processing is generated by the random number generation unit 103. The memory control unit 108 controls the authentication-necessary memory 107 and the authentication-needed memory 106, and controls the transfer of data and encryption keys to and from the external device 101. The authentication-unnecessary memory 107 is a memory that can be accessed regardless of whether authentication is performed, and mainly stores encrypted data. Authentication required memory 106
Is a memory accessible only when the authentication control unit 109 determines that authentication with the external device 101 has been established, and mainly stores an encryption key. Initial value fixed transmission means 10
5 generates an initial value fixing instruction to the random number generator when the switch 104 is on.

FIG. 3 shows an example of realization of the random number generator 103, and FIG. 4 shows a flowchart of random number generation in the random number generator. It consists of a nonvolatile memory 31, a random number generator 32, a volatile memory 33, a random number generator 34, a switch 35, and a fixed value memory 36. When the first authentication operation occurs after the power is turned on, the random number in the nonvolatile memory 31 The seed X0 is calculated by the random number generator 32 to generate X1, stored in the nonvolatile memory 31, and stored in the volatile memory 33. X1 is calculated by the random number generator 34 to generate X2, which is set as the initial value of the random number and, at the same time, stored in the volatile memory 33. When the second and subsequent authentication operations are performed after the power is turned on, the value calculated by the random number generator based on the seed of the random number stored in the volatile memory 33 is used as the random number. The switch 35 selects either the random number generator 34 or the fixed value memory 36. When receiving the initial value fixed instruction, the switch 35 selects and generates the value Y0 in the fixed value memory 36 as a random number.

Here, a random number for authentication between the external device 101 and the authentication control unit 109 through the external device interface unit 102 is generated in the random number generation unit 103, and its initial value is as shown in FIG. A different value for each authentication. Therefore, the switch 104 of FIG.
Is set to a test mode in which the initial value of the random number is fixed, the random number generation unit 103 receives the instruction as a fixed initial value command, and sets the fixed value memory 36 as a random number value.
Y0 in the middle is always selected and output.

Here, a conventional test method in a cryptographic processing apparatus whose initial value is not constant will be described with reference to FIG. Switch 1 in cryptographic processing device of FIG.
When 04 is turned on, the initial value fixing means 105 issues an initial value fixing command to the random number generation section 103. The switch 35 of the random number generator 103 shown in FIG. 3 receives the initial value fixing command and selects and outputs the value Y0 in the fixed value memory 36. Therefore, in the authentication control unit 109 in FIG.
0, the authentication with the external device can be controlled in exactly the same pattern.
06 can be realized. In this way, the test at the time of shipping the device can be performed at high speed, and mass production can be realized.

Table 1 summarizes this operation.

[0008]

[Table 1]

[0009]

SUMMARY OF THE INVENTION However,
In the conventional cryptographic processing device, if a third party temporarily discovers a mode in which the initial value is fixed and accesses in that mode, a challenge-response type authentication process is always performed using the same value. For this reason, if the value is found, it is possible to access a memory that originally requires authentication processing and to extract information such as an encryption key. That is, there is a security hole that can easily break the encryption.

However, in order to perform a test without fixing the initial value, it is necessary to connect a regular external device one by one, and a lot of time and labor are required for a test at the time of shipment, and mass production is performed. In doing so, it leads to an increase in production cost. The present invention has been made in view of this problem, and has a test mode for fixing an initial value,
It is an object of the present invention to provide a cryptographic processing device having a test method that does not reduce the cryptographic strength.

[0011]

According to the present invention, there is provided an interface unit for transmitting / receiving data to / from an external device, an authentication control unit for controlling authentication with the external device, a memory for storing data input from the external device, A memory control unit that controls access to a memory, and a switch unit that changes the degree of difficulty of authentication in the authentication control unit, wherein the switch unit is turned on and the degree of difficulty of authentication is changed. Further, the present invention relates to a cryptographic processing device for restricting access to the memory.

Also, an interface unit for transmitting / receiving data to / from an external device, an authentication control unit for controlling authentication from the external device, a memory for storing data input from the external device, and controlling access to the memory. A memory control unit, and a switch unit that changes the necessity of authentication in the authentication control unit. When the switch unit is turned on and access in a state of not performing authentication is permitted, the memory unit The present invention relates to a cryptographic processing device for restricting access to a device.

An interface unit for transmitting and receiving to and from an external device, an authentication control unit for controlling authentication with the external device, an encryption processing circuit for encrypting data to be output to the external device, An access control unit for restricting access and a switch unit for changing the difficulty of authentication in the authentication control unit, and when the switch unit is turned on and the difficulty of authentication is changed, The present invention relates to a cryptographic processing device that changes data output to an external device.

[0014] Also, an interface unit for transmitting and receiving to and from an external device, an authentication control unit for controlling authentication with the external device, an encryption processing device for encrypting data to be output to the external device, and An access control unit that controls access to the authentication unit, and a switch unit that changes the necessity of authentication in the authentication control unit. When the switch unit is turned on and access is permitted without performing authentication. To
The present invention relates to a cryptographic processing device that changes data output to the external device.

[0015]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a cryptographic processing apparatus having a test method according to the present invention which does not cause a security hole will be described with reference to the drawings.

(Embodiment 1) FIG. 2 shows a functional block diagram of a cryptographic processing apparatus according to the present embodiment. External device interface unit 202, random number generation unit 203, switch 2
04, authentication required memory 206, authentication unnecessary memory 207,
The configuration of the authentication control unit 209 is common to the conventional technology.

The initial value fixed transmission means 205 includes a switch 2
When the test mode control unit 210 is in the ON state, it transmits an initial value fixing command to the random number generation unit 203 and
Also generates an instruction to fix the initial value. Test mode control unit 2
10 receives the instruction to fix the initial value and informs the memory control unit 208 that the test mode is set, and the memory control unit 208 accesses the authentication required memory 206 even after the authentication is passed as shown in Table 2. If there is, a map is made to a fictitious address space to the authentication unnecessary memory 207 instead of the authentication required memory 206.

A test method for the cryptographic processing apparatus according to the present embodiment will be described with reference to FIG. When the switch 204 in the cryptographic processing device of FIG. 2 is turned on, the initial value fixing transmission unit 205 issues an initial value fixing command to the random number generation unit 203. The switch 35 of the random number generator shown in FIG. 3 receives the initial value fixing command and selects and outputs the value Y0 stored in the fixed value memory 36. Therefore, in the authentication control unit 209 in FIG. 2, the authentication is performed with the fixed value Y0, so that the authentication control with the external device can be performed in exactly the same pattern. Therefore, in the test at the time of shipment of the device, there is no need to use a device compatible with encryption, the test can be performed at high speed, and mass production can be realized.

At this time, the initial value fixing transmitting means 205 also transmits the initial value fixing command to the test mode control section 210,
Test mode control section 210 transmits a signal indicating the test mode to memory control section 208. The memory control unit 208 receives the signal from the test mode control unit 210, enters the test mode, prohibits access to the authentication required memory 206, and permits access to a virtual address space on the authentication unnecessary memory 207.

Therefore, if a third party temporarily switches the switch 204
Can be found, the test mode can be entered, and even if the authentication is successful, the memory required for authentication cannot be accessed. For this reason, data such as an encryption key cannot be taken out, and data such as content data is protected and does not become a security hole.

Table 2 summarizes this operation.

[0022]

[Table 2]

(Embodiment 2) Next, Embodiment 2 will be described. FIG. 5 is a functional block diagram of the cryptographic processing device according to the present embodiment. External device interface 5
02, a random number generation unit 503, a switch 504, an authentication required memory 506, an authentication unnecessary memory 507, a memory control unit 50
8. The configuration of the authentication control unit 509 is common to the first embodiment. When the switch 504 is on, the initial value fixing transmitting unit 505 outputs an initial value fixing command to the test mode control unit 510, and receives a signal indicating the test mode from the test mode control unit 510. Only in this case, an initial value fixing instruction is transmitted to the random number generation unit 503. The test mode control unit 510 notifies the memory control unit 508 and the initial value fixed transmission unit 505 of the test mode.
Further, the test mode control unit 510 includes the nonvolatile memory 51
The test mode switching count stored in 1 is incremented by 1 each time the test mode is entered. As for the address of the nonvolatile memory 511 where the number of times of switching is stored, access from outside the switch 504 is prohibited, and the number of times of switching is not falsified.

Next, a test method of the present cryptographic processing apparatus will be described with reference to FIG. When the switch 504 in the cryptographic processing apparatus of FIG. 5 is turned on, the initial value fixing transmitting unit 505 transmits an initial value fixing instruction only to the test mode control unit 510, and outputs a signal indicating that the test mode control unit is in the test mode. After detecting the output, an initial value fixing instruction is output to the random number generation unit 503. The random number generator 503 is the same as that shown in FIG. 3, and the switch 35 in FIG. 3 receives the initial value fixing command and selects and outputs the value Y0 stored in the fixed value memory 36. Therefore, since the authentication is performed with the fixed value Y0 in the authentication control unit 509 in FIG. 5, the authentication control with the external device can be performed in the same pattern. Therefore, in the test at the time of shipment of the device, there is no need to use a device compatible with encryption, the test can be performed at high speed, and mass production can be realized.

In the above configuration, every time the switch 504 is turned on and the test mode is entered, the number of times of switching the test mode of the nonvolatile memory is incremented by one. When the switch 504 is turned on, the test mode control unit 510 checks the number of times the test mode has been switched, and outputs a signal indicating the test mode to the memory control unit 508 when this value is 1 or less, No output is made when the value is 2 or more. For this reason, if the initial value of the number of times of switching the test mode is set to 0, the number of times that the mode can be switched to the test mode is limited to two times.

Table 3 summarizes this operation.

[0027]

[Table 3]

For this reason, if the test mode is switched to the test mode again after performing the test in the test mode at the time of shipment, the security cannot be entered again in the test mode, so that the security of the cryptographic processing apparatus is enhanced. In addition, when a trouble such as a mistake occurs in the test at the time of shipment, the test mode can be entered again and the test can be performed.

Although the number of times of switching is limited to two times,
The present embodiment is not limited to this.

Third Embodiment Next, a third embodiment will be described. FIG. 6 is a functional block diagram of the cryptographic processing device according to the present embodiment. In FIG. 6, an external device 601 is a device that handles encrypted data, such as a semiconductor audio player, and an encryption processing device 600 is a storage medium that has a function of authenticating access permission, such as an SD card.

In the cryptographic processing device 600, an external device interface unit 602 performs input / output of encrypted data, an encryption key, and the like with the external device 601.

The authentication control unit 609 is a means for performing a challenge response type authentication process with an external device. A random number generated by the random number generator 603 is used as a random number required in the authentication process. The memory control unit 608 controls the authentication-necessary memory 607 and the authentication-needed memory 606, and controls the exchange of data and encryption keys with the external device 601. The authentication unnecessary memory 607 is a memory that can be accessed irrespective of the presence or absence of authentication, and mainly stores encrypted data.
The authentication required memory 606 stores the authentication control unit 609 in the external device 6.
01 is a memory that can be accessed only when it is determined that authentication with 01 has been established, and mainly stores an encryption key.

The test mode control unit 610 includes the authentication control unit 6
09 is notified of the test mode, and the number of times the test mode is switched stored in the nonvolatile memory 611 is incremented by one each time the test mode is entered. Here, in the non-volatile memory 611, at least the address where the number of times of switching is stored is prohibited from being accessed from outside except the switch 604. In other words, the switching frequency cannot be falsified.

Next, a test method of the present cryptographic processing apparatus will be described with reference to FIG. When the switch 604 is turned on, the test mode control unit 610 generates an authentication processing invalid signal to the authentication control unit. The authentication control unit 609 includes:
When the authentication processing invalid signal is received, the access is permitted without performing the authentication processing. Therefore, in the test at the time of shipping the device, it is not necessary to use a device that supports encryption, and the test can be performed at high speed.

In the above configuration, each time the switch 604 is turned on and the test mode is entered, the number of times of switching the test mode of the nonvolatile memory increases by one. When the switch 604 is turned on, the test mode control unit 610 checks the number of times the test mode has been switched, and when this value is 1 or less, outputs a signal to enter the test mode to the memory control unit 608. There is no output when there is. For this reason, if the initial value of the number of times of switching the test mode is set to 0, the number of times that the mode can be switched to the test mode is limited to two times.

For this reason, if the test mode is switched to the test mode again after performing the test in the test mode at the time of shipment, it is impossible to enter the test mode again, and no security hole is caused. Further, when a trouble such as a mistake occurs in the test at the time of shipment, the test mode can be entered again and the test can be performed, so that it is unlikely that the test cannot be performed.

Although the number of times of switching is limited to two times, the present embodiment is not limited to this.

(Fourth Embodiment) Next, a fourth embodiment will be described. The first to third embodiments relate to a cryptographic processing device on a medium side such as an SD card, but the present embodiment relates to a device for recording on a medium, that is, a cryptographic processing device included in a device such as a semiconductor audio player. It is related to.

FIG. 7 is a functional block diagram of the cryptographic processing apparatus according to the present embodiment. In FIG. 7, an external device 701 is provided.
Is a recording medium such as an SD card, and includes, for example, the cryptographic processing device described in FIG. 1 therein, and has a configuration for performing data transfer after performing a challenge-response type authentication process. External device interface 70
Reference numeral 2 denotes an external device interface unit on the semiconductor audio player side for inputting and outputting encrypted data, an encryption key, and the like between the semiconductor audio player and the SD memory card.

The authentication control unit 712 is a means for performing a challenge response type authentication process with the external device 701. The random number required in this authentication process is generated by the random number generation unit 703. The access control unit 711 controls the signal processing circuit 710 and the encryption processing circuit 707, and
13 or an external device 701. The signal processing circuit 710 includes an external device 701
When the data is output to the CPU, data that does not require encryption is processed, and the encryption processing circuit 707 processes data that requires encryption. The switch 704 has a normal state (00), an initial value fixed state (01), a data fixed state (10), a key fixed state (1
There are four states of 1). Initial value fixed transmission means 705
When the switch 704 is in the state of fixed initial value (01), it transmits the fixed value initial value command to the random number generation unit 703 and also generates the fixed value initial value command to the test mode control unit 706.

Since the content data decrypted by the decryption unit 713 is raw data, the content data is input to the encryption processing circuit 707, subjected to encryption processing for output to an external device, and converted into an encryption key and encrypted data. . Access control unit 711
Is transmitted to the external device 701 only when the challenge-response type authentication is established in the authentication control unit 712.
The encryption key and the encrypted data by the encryption processing circuit 707 are output.

Next, a test method of the present cryptographic processing apparatus will be described with reference to FIG.

First, the case where the switch 704 is in the state of (01) will be described. In this state, the initial value fixing transmission unit 705 issues an initial value fixing command to the random number generation unit 703. At this time, the random number generation unit 703 receives the fixed initial value command and outputs a fixed value to the authentication control unit 712. Since authentication is performed with a fixed value in the authentication control unit 712,
Authentication control with an external device can be performed in the same pattern. Therefore, in the test at the time of shipping the device, there is no need to use a device that supports encryption, and it can be performed at high speed.
Mass production can be realized.

At this time, the initial value fixed transmission means 705 also generates a signal indicating that the mode is the initial value fixed mode to the test mode control unit 706, and upon receiving this signal, the access control unit receives the key of the encryption processing circuit. And convert the data output to a fixed value and output.

Therefore, if a third party operates this switch 704
Can be found, the test mode can be entered, and even if the authentication is successful, the output data from the cryptographic processing circuit cannot be obtained as it is. For this reason, data such as an encryption key cannot be taken out, and data such as content data is protected and does not become a security hole. However, at this time, only the external device interface unit 702, the access control unit 711, and the authentication control unit 71 can be tested.
2, a signal processing circuit 710 and the like, and an encryption processing circuit 707
Cannot be tested.

Although the authentication control unit 712 performs challenge-response-type authentication with a fixed value in the test mode, the authentication control unit 712 may be configured to permit access without performing authentication.

Next, when the switch 704 is in the state (10), that is, in the data fixed state, the test mode control unit 706 sends
Generates a signal to fix data. Upon receiving this, the access control unit 711 generates a signal for stopping the authentication control to the authentication control unit, and generates a signal for performing data fixing to the data fixing unit. In this state, the authentication control unit does not perform authentication, so that it is not necessary to use a device that supports encryption in the test at the time of shipping the device, so that it can be performed at high speed and mass production can be realized.

At this time, the access control unit does not particularly prohibit access to the cryptographic processing circuit, but the data fixing means converts all data output from the cryptographic processing device into fixed values and outputs them.

Therefore, it is assumed that a third party operates this switch 704
Can be entered into the test mode, the authentication is successful, and even if the output from the cryptographic processing circuit is successfully obtained, all the encrypted data takes a fixed value. The circuit cannot be broken. Therefore, in this mode, the cryptographic processing apparatus can be tested without the content of the cryptographic processing being seen by a third party.

At this time, it is preferable that the fixed data is not meaningful data such as music data or video data, but is meaningless data such as null data.

Next, when the switch 704 is in the state of (11), that is, in the key fixed state, the test mode control unit 706 generates a signal for setting the key fixed state to the access control unit 711. I do. Upon receiving this, the access control unit 711 generates a signal for stopping the authentication control to the authentication control unit 712, and the key fixing unit 709.
Generates a signal for key fixing. However, in this state, since the authentication control unit 712 does not perform authentication, it is not necessary to use a device that supports encryption in a test at the time of shipping the device, so that it can be performed at high speed and mass production can be realized.

At this time, the access control unit 711 does not particularly prohibit access to the encryption processing circuit 707, but the key fixing means converts all the encryption keys output from the encryption processing circuit into fixed values and outputs them.

Therefore, if a third party operates this switch 704
Can be entered, the test mode can be entered, the authentication is successful, and the output from the cryptographic processing circuit 707 is obtained, but the cryptographic circuit takes all fixed values. It cannot be deciphered. Therefore, in this mode, the cryptographic processing apparatus can be tested without the content of the cryptographic processing being seen by a third party.

In the present embodiment, when there is a change in the degree of difficulty or necessity of authentication of the authentication control unit, the test mode control unit counts the number of times and stores the count value in the nonvolatile memory. When the count value exceeds a certain value, if the configuration is such that the authentication control unit cannot change the difficulty or necessity of the authentication, that is, if the switching to the test mode is not permitted, the security is further enhanced. .

In all of the above embodiments, if the switch section is configured to be specified by a command via the external device interface section, switching to the test mode becomes easy. Further, when the difficulty level of authentication or necessity of authentication is changed by the authentication control unit, if a configuration in which the test mode is specified by a specific signal line is used, the state of the test mode at the time of the test can be changed. You can state that there is.

In the embodiment in which the challenge-response type authentication processing is performed, the random number generator stores the previously generated random number in the non-volatile memory and uses it as a seed for the next generated random number. It becomes difficult to predict the random number value of, and the security of authentication increases. Further, if a configuration for storing a previously generated random number in a memory that is not initialized at the time of resetting is further provided, the security of authentication is further enhanced.

[0057]

As described above, the cryptographic processing apparatus according to the present invention having the test method which does not become a security hole does not become a security hole even if a third party knows how to enter the test mode.

Therefore, there is an advantage that the security of the encryption processing is the same as before, while the shipment test at the factory can be performed at a high speed.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating an example of a conventional encryption processing circuit.

FIG. 2 is a functional block diagram of a cryptographic processing circuit according to the first embodiment;

FIG. 3 is a diagram illustrating an example of a random number generation circuit according to a conventional example and the first, second, and fourth embodiments.

FIG. 4 is a flowchart of an operation of the random number generation circuit shown in FIG. 3;

FIG. 5 is a functional block diagram of another encryption processing circuit according to the second embodiment;

FIG. 6 is a functional block diagram of a cryptographic processing circuit according to a third embodiment;

FIG. 7 is a functional block diagram of a cryptographic processing circuit according to a fourth embodiment.

[Explanation of symbols]

 REFERENCE SIGNS LIST 100 cryptographic processing device 101 external device 102 external device interface unit 103 random number generation unit 104 switch 105 initial value fixed transmission means 106 authentication required memory 107 authentication unnecessary memory 108 memory control unit 109 authentication control unit 201 external device 202 external device interface unit 203 random number Generating unit 204 Switch 205 Initial value fixed transmission means 206 Authentication required memory 207 Authentication unnecessary memory 208 Memory control unit 209 Authentication control unit 210 Test mode control unit 31 Non-volatile memory 32 Random number generator 33 Volatile memory 34 Random number generator 35 Switch 36 Fixed value memory 501 External device 502 External device interface unit 503 Random number generation unit 504 Switch 505 Initial value fixed transmission means 506 Authentication required memory 507 Authentication not required memory 5 8 Memory control unit 509 Authentication control unit 510 Test mode control unit 511 Non-volatile memory 601 External device 602 External device interface unit 603 Random number generation unit 604 Switch 606 Authentication required memory 607 Authentication unnecessary memory 608 Memory control unit 609 Authentication control unit 610 Test mode Control unit 611 Non-volatile memory 701 External device 702 External device interface unit 703 Random number generation unit 704 Switch 705 Initial value fixed transmission unit 706 Test mode control unit 707 Encryption processing circuit 708 Data fixing unit 709 Key fixing unit 710 Signal processing circuit 711 Access control Unit 712 authentication control unit 713 decryption unit

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Toshihiko Otake 1006 Kadoma Kadoma, Osaka Prefecture Matsushita Electric Industrial Co., Ltd. Terms (reference) 5J104 AA07 KA01 KA02 KA04 NA02

Claims (18)

[Claims] An interface unit for transmitting and receiving to and from an external device; an authentication control unit for controlling authentication with the external device;
A memory that stores data input from an external device, a memory control unit that controls access to the memory, and a switch unit that changes the difficulty of authentication in the authentication control unit, wherein the switch unit is An encryption processing device for restricting access to the memory when the authentication is turned on and the difficulty of authentication is changed. 2. The authentication process in the authentication control unit is a challenge-response type authentication process using a random number.
2. The cryptographic processing device according to claim 1, wherein changing the degree of difficulty of authentication means replacing the random number with a fixed value. 3. An interface unit for transmitting and receiving to and from an external device, an authentication control unit for controlling authentication from the external device, a memory for storing data input from the external device, and controlling access to the memory. A memory control unit, and a switch unit that changes the necessity of authentication in the authentication control unit. When the switch unit is turned on and access in a state of not performing authentication is permitted, the memory unit A cryptographic processing unit that restricts access to. 4. A test mode control unit for counting the number of times the switch unit is turned on, and a non-volatile memory for storing the count value, wherein the test mode control unit determines that the count value exceeds a certain value. 4. The encryption processing device according to claim 1, wherein the authentication control unit does not permit the authentication control unit to change the difficulty level of the authentication or the necessity of the authentication. 5. The memory has a first memory that requires authentication and a second memory that does not require authentication. The restriction on access to the memory means that access to the first memory is limited. 5. The cryptographic processing device according to claim 1, wherein, when mapping is performed, instead of mapping to the address space of the first memory, mapping is performed to the address space of the second memory. 6. An interface unit for transmitting and receiving to and from an external device, an authentication control unit for controlling authentication with the external device,
An encryption processing circuit that encrypts data for output to an external device, an access control unit that restricts access to the external device, and a switch unit that changes the degree of difficulty of authentication in the authentication control unit, An encryption processing device that changes data output to the external device when the difficulty level of authentication is changed by turning on the switch unit. 7. The authentication process in the authentication control unit is a challenge-response type authentication process using a random number.
7. The cryptographic processing apparatus according to claim 6, wherein changing the degree of difficulty of authentication means replacing the random number with a fixed value. 8. An interface unit for transmitting and receiving to and from an external device, an authentication control unit for controlling authentication with the external device,
An encryption processing device that encrypts data to be output to an external device, an access control unit that controls access to the external device, and a switch unit that changes whether authentication is necessary or not in the authentication control unit. A cryptographic processing device that changes data output to the external device when the switch is turned on and access is permitted without performing authentication. 9. A test mode control unit for counting the number of times the switch unit is turned on, and a non-volatile memory for storing the count value, wherein the test mode control unit determines that the count value exceeds a certain value. 9. The encryption processing device according to claim 6, wherein the authentication control unit does not permit the authentication control unit to change the difficulty level of the authentication or the necessity of the authentication. 10. The cryptographic processing apparatus according to claim 6, wherein changing the data to be output to the external device includes replacing the encrypted data and the encryption key data with fixed values, respectively. 11. The cryptographic processing apparatus according to claim 8, wherein said cryptographic processing circuit has a key changing means for changing the output of the cryptographic key to a meaningless value when said switch section is on. . 12. The cryptographic processing apparatus according to claim 11, wherein said key changing means is a key fixing means for changing a key to a fixed value. 13. The data changing means according to claim 8, wherein the data output of the cryptographic processing circuit is changed to a meaningless value when the switch is on. Cryptographic processing device. 14. The encryption processing device according to claim 13, wherein said data changing means is data fixing means for changing data to a fixed value. 15. The cryptographic processing device according to claim 1, wherein said switch unit has a configuration specified by a command via said external device interface unit. 16. The test mode according to claim 1, wherein when the difficulty level of the authentication or the necessity of the authentication is changed by the authentication control unit, the test mode is specified by a specific signal line. The cryptographic processing device according to the above. 17. A random number generator for generating the random number, wherein the random number generator stores a previously generated random number in a non-volatile memory and uses the random number as a seed for the next generated random number. 5, 7, 9, 10, 11, 12, 13, 14,
17. The cryptographic processing device according to 15 or 16. 18. A random number generator for generating the random number, wherein the random number generator stores a previously generated random number in a memory that is not initialized by a reset signal, and uses the random number as a seed for the next generated random number. 2, 4, 5, 7, 9, 10, 1
The cryptographic processing device according to 1, 12, 13, 14, 15, or 16.