JP2004088632A - Encryption device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enhance the security property by making it difficult to perform the estimation of internal key information or the analysis of hardware without performing post processing such as pattern cut, etc. <P>SOLUTION: An encryption device is equipped with: a storage means which stores data for inspection, parameters for inspection, random numbers for inspection, and a key for inspection as initial values; and an encryption processing means which performs encoding processing. The encryption processing means performs the encryption processing using the data for inspection, the parameter for inspection, the random numbers for inspection, and the key for inspection stored in the storage means, according to the instruction of an inspection mode is given from outside. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an encryption device that performs an encryption process.
[0002]
[Prior art]
2. Description of the Related Art In recent years, various services using various communication technologies such as electronic commerce and online shopping using the so-called Internet or the like have become widespread. In recent years, with the progress of communication technology, a non-contact type semiconductor memory in which not only communication technology via a terminal but also a communication function for use in, for example, toll collection of transportation or so-called electronic money is integrated. Card-like devices such as cards have also been developed.
[0003]
In a service using a card-shaped device having such a communication function (hereinafter, referred to as a non-contact type IC (Integrated Circuit) card), it is generally essential to improve security. Mutual authentication processing for authenticating validity and encryption processing for ensuring security of data communication are performed. At that time, the non-contact type IC card requires high-speed processing. Therefore, if these functions are implemented by software, a CPU (Central Processing Unit) with a high clock rate is required, which is not practical. Therefore, in the non-contact type IC card, it is desirable that these functions are implemented not by software but by hardware.
[0004]
Here, in the non-contact type IC card in which the above-described functions are implemented by such hardware, a relatively small circuit scale such as a so-called DES (Data Encryption Standard) encryption method is used in order to suppress power consumption as much as possible. Many employ so-called common key encryption schemes that can be implemented with power consumption.
[0005]
However, the common key encryption method that uses a common key for encryption and decryption has a problem that it is vulnerable to an attack by an unauthorized third party from the viewpoint that it is necessary to exchange key data. For this reason, there has been a concern about the non-contact type IC card in the case where it is applied to financial services in the future.
[0006]
Therefore, in a service using a contactless IC card, the contactless IC card is, for example, a so-called RSA (Rivest-Shamir-Adleman) encryption system or an elliptic curve encryption system (ECC). There is a growing demand for a highly secure system that employs a so-called public key encryption scheme in which a specific person needs to have a common key that needs to be kept secret while a different key is used for encryption and decryption. Many attempts have been made to develop a contactless IC card that performs signature generation and signature verification using a public key.
[0007]
[Problems to be solved by the invention]
By the way, when manufacturing an IC chip to be mounted on a non-contact type IC card or the like employing the above-described public key encryption method, it is necessary to confirm whether or not the encryption device operates normally after the manufacture. In order to do this, the manufacturer or the inspector of the IC chip must perform a shipping inspection. For this reason, the IC chip of the non-contact type IC card is provided with an external I / O terminal for inspection, which is a dedicated external bus for directly accessing the encryption device and inspecting the encryption device for a failure. .
[0008]
Here, an inspection circuit of a normal encryption device is configured as shown in FIG. That is, a CPU that controls each unit, a RAM (Random Access Memory) that is a memory that functions as a work area of the CPU, a ROM (Read Only Memory) that is a read-only memory that stores various programs, and the like, A CPU / RAM / ROM / EEPROM having an electrically erasable programmable read only memory (EEPROM), which is a rewritable memory; The ROM / EEPROM and the encryption engine are respectively connected to a not-shown external input / output terminal for inspection.
[0009]
When the cryptographic engine is inspected, the inspection data and the inspection parameters are directly input to the encryption engine from the external input terminal for inspection. The encryption engine performs encryption processing under the control of the CPU / RAM / ROM / EEPROM, and outputs an output value from the external output terminal for inspection. The inspector determines whether or not the cryptographic engine has a failure by checking whether or not the output value is correct.
[0010]
In other words, the person performing the inspection needs to know at least the expected values which are the correct values of the input data and the output data such as the inspection data and the inspection parameters.
[0011]
By the way, while the dedicated external input / output terminal for inspection is indispensable for the inspection of the encryption device, an unauthorized third party accesses the encryption engine and uses the above-mentioned input data and expected values. This can be a means for analyzing hardware by acquiring or estimating internal key information or the like, or by repeating the above-described inspection, which is a security problem.
[0012]
For this reason, after the chip is manufactured, a method called a so-called pattern cut, for example, which mechanically cuts the external input / output terminal for inspection, or a method of electrically burning out the external input / output terminal for inspection to the cryptographic engine, is used. In general, a method of making access impossible is adopted.
[0013]
However, if these methods are implemented, if a defect occurs in an IC chip after shipment, it becomes impossible to inspect or investigate the defective product, causing another problem that the cause of the defect cannot be specified, or a product yield. Can also be aggravated.
[0014]
Therefore, the present invention has been proposed to solve such a conventional problem, and makes it difficult to estimate internal key information and analyze hardware without performing post-processing such as pattern cutting, and to improve security. It is an object of the present invention to provide an encryption device capable of improving the encryption.
[0015]
[Means for Solving the Problems]
In order to achieve the above object, an encryption device according to the present invention includes a storage unit that stores test data, a test parameter, a test random number, and a test key as initial values, and an encryption device that performs an encryption process. Processing means, wherein the encryption processing means, in response to an inspection mode command being externally provided, stores the inspection data, the inspection parameter, the inspection random number, and the inspection data stored in the storage means. The encryption processing is performed using the inspection key.
[0016]
As described above, the encryption device according to the present invention stores inspection data, an inspection parameter, an inspection random number, and an inspection key in a storage unit as initial values, and when an instruction of an inspection mode is input from outside. These are read, encrypted, and the result is output. If the inspector knows the expected value, which is the correct value of the output result, it can determine whether or not the encryption device has a failure by comparing the expected value with the output result. For this reason, it is possible to avoid an attack on the encryption device due to repeated input / output of test data and the like.
[0017]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an encryption device to which the present invention is applied will be described in detail with reference to the drawings.
[0018]
The encryption device of the present invention is an IC chip built in a card-like device (hereinafter, referred to as a non-contact type IC (Integrated Circuit) card) such as a non-contact type semiconductor memory card having a communication function integrated. Etc., which implements the functions of mutual authentication processing for authenticating the validity of the communication partner and encryption processing for ensuring the security of data communication by hardware. It is.
[0019]
Here, first, the basic configuration and the inspection method of the encryption device will be described, and then, a specific example in the case where the inspection is performed by the encryption device mounted on the actual non-contact type IC card will be described.
[0020]
First, a first example of the basic configuration of the inspection circuit of the encryption device of the present invention will be described with reference to FIG.
[0021]
The test circuit shown in FIG. 1 is electrically rewritable between a CPU that controls each unit, a RAM that functions as a work area of the CPU, and a ROM that is a read-only memory that stores various programs and the like. A CPU / RAM / ROM / EEPROM having an EEPROM as a memory, and an encryption engine as encryption processing means for performing an encryption process, and the input side of the CPU / RAM / ROM / EEPROM has an The output side of the CPU / RAM / ROM / EEPROM and the cryptographic engine is connected to an external input terminal and an external output terminal for inspection (not shown).
[0022]
The cryptographic engine has a sequencer and is configured autonomously so that the cryptographic processing can be performed without the help of the CPU.
[0023]
In addition, inspection data, an inspection parameter, an inspection random number, and an inspection key are stored in advance as initial values in a ROM or a gate as storage means in the encryption engine. If these values are used as inspection-only values that are not actually used, even if any information is stolen, it is safe because it does not cause a problem such as being targeted by an attack.
[0024]
Note that these values stored in the ROM or the gate should not be read from the outside as much as possible, for example, by making the reverse engineering difficult by limiting the registers and the memory area that can be accessed by the CPU.
[0025]
When the cryptographic engine is inspected, a command for an inspection mode, which is a mode for inspecting the cryptographic engine, is input to the CPU / RAM / ROM / EEPROM from the external input / output terminal for inspection. When the inspection mode command is passed to the encryption engine via the CPU, the encryption engine reads the inspection data, the inspection parameter, the inspection random number, and the inspection key stored in the gate and performs encryption processing. The output value is output from the inspection external output terminal. Then, the inspector determines whether or not the cryptographic engine has a failure by checking whether or not the output value is correct.
[0026]
When the cryptographic engine performs an encryption process using a public key encryption method, more specifically, the signature engine is inspected by performing a signature generation process as described below.
[0027]
First, when a command of a test mode is given from a test external input terminal (not shown) to the cryptographic engine via the CPU, the test data, the test parameter, the test random number, The inspection secret key as an inspection key is read, and the read initial value is transferred to an arithmetic RAM (not shown) such as an ALU RAM (Arithmetic and Logical Unit Random Access Memory) to be described later.
[0028]
Next, the cryptographic engine actually generates a signature using the read initial value, and generates a signature. At the time of signature generation, the cryptographic engine performs, for example, SHA-1 processing to calculate a hash value of the test data, and uses the calculated hash value, the test parameter, the test random number, and the test secret key. For example, an elliptic curve encryption process is performed to generate a signature.
[0029]
Next, the generated signature is output from the inspection external output terminal as an output value. Then, the inspector determines whether or not the cryptographic engine has a failure by checking whether or not the signature as the output value is correct.
[0030]
As described above, when inspecting the cryptographic engine, the cryptographic engine performs encryption processing using only the internal data and compares the output value that is the result with the expected value that is the correct output value. It can be determined whether or not it has operated. At this time, the person performing the inspection need only know the expected value. Therefore, the cryptographic engine can be safely inspected without risking security such as directly inputting data, parameters, and the like to the cryptographic engine from the outside. The expected value that the inspector knows is too small for an attacker who tries to obtain internal information of the cryptographic engine such as key information, because the original inspection data and inspection parameters are unknown from outside. Has no meaning.
[0031]
Next, a second example obtained by modifying the first example will be described with reference to FIG. The second example is different from the first example in that the result of the encryption process is not output as it is, but is output as a result flag indicating whether or not the result of the encryption process is correct. .
[0032]
Specifically, the inspection circuit of the second example shown in FIG. 2 includes a CPU that controls each unit, a RAM that functions as a work area of the CPU, and a read-only memory that stores various programs and the like. CPU / RAM / ROM / EEPROM having a ROM which is an electrically rewritable memory, and an encryption engine as encryption processing means for performing encryption processing. The input side of the ROM / EEPROM is connected to an external input terminal for inspection (not shown), and the output side of the CPU / RAM / ROM / EEPROM and the encryption engine is connected to an external output terminal for inspection (not shown).
[0033]
The cryptographic engine has a sequencer and is configured autonomously so that the cryptographic processing can be performed without the help of the CPU.
[0034]
In addition, inspection data, an inspection parameter, an inspection random number, and an inspection key are stored in advance in a ROM or a gate as storage means in the encryption engine as initial values. If these values are used as inspection-only values that are not actually used, even if any information is stolen, it is safe because it does not cause a problem such as being targeted by an attack.
[0035]
In the second example, the inspection data, the inspection parameter, the inspection random number, and the expected value based on the inspection key are stored in advance in a ROM or a gate as storage means.
[0036]
Note that these values stored in the ROM or the gate should not be read from the outside as much as possible, for example, by making the reverse engineering difficult by limiting the registers and the memory area that can be accessed by the CPU.
[0037]
When the cryptographic engine is inspected, an inspection start command is input to the CPU / RAM / ROM / EEPROM from the external input terminal for inspection. When the inspection mode command is passed to the encryption engine via the CPU, the encryption engine reads the inspection data, the inspection parameter, the inspection random number, and the inspection key stored in the storage unit and performs an encryption process. Further, the cryptographic engine compares the result of the encryption process with the expected value stored in the ROM or the gate, and outputs a match or mismatch result flag from the external output terminal for inspection. Then, the inspector determines whether there is a failure in the cryptographic engine based on the result flag.
[0038]
When the cryptographic engine performs an encryption process using a public key encryption method, more specifically, the signature engine is inspected by performing a signature generation process as described below.
[0039]
First, when a command of a test mode is given to the cryptographic engine via a CPU from a test external input terminal (not shown) via the CPU, test data, a test parameter, a test random number, a test The inspection secret key as the service key and the expected value are read, and the read initial value is transferred to, for example, an arithmetic RAM (not shown) such as an ALU RAM described later.
[0040]
Next, the cryptographic engine actually generates a signature using the read initial value, and generates a signature. At the time of signature generation, the cryptographic engine performs, for example, SHA-1 processing to calculate a hash value of the test data, and uses the calculated hash value, the test parameter, the test random number, and the test secret key. For example, an elliptic curve encryption process is performed to generate a signature.
[0041]
Next, the cryptographic engine compares the generated signature with the expected value read into the arithmetic RAM, and outputs a match or mismatch result flag from the external test output terminal. Then, the inspector determines whether or not the cryptographic engine has failed based on the result flag.
[0042]
In the case of the second example, not only the above-described signature generation processing but also a signature generation processing and a signature verification processing are performed as a pair as described below, and the answers are internally matched, so that two processing circuits are provided. Can be checked by a single check of the cryptographic engine.
[0043]
In this method, first, a signature is generated using the initial value as described above. Next, the generated signature is used as it is to internally verify the signature, confirm that the signature is correct, and output a result flag. If both signature generation and signature verification operate normally, only outputting a 1-bit result flag can prove that the cryptographic engine operates normally.
[0044]
However, if the result flag is 1 bit, the reliability decreases when a special value is taken in both signature generation and signature verification. Therefore, as described below, after the signature generation and after the signature verification, Preferably, the cryptographic engine is configured to output a result flag.
[0045]
Specifically, first, inspection data, an inspection parameter, an inspection random number, an inspection secret key as an inspection key, and an expected value are read as initial values from a ROM or a gate inside the cryptographic engine. The read initial values are loaded into a not-shown operation RAM such as a RAM.
[0046]
Next, the cryptographic engine actually generates a signature using the read initial value, and generates a signature. At the time of signature generation, the cryptographic engine performs, for example, SHA-1 processing to calculate a hash value of the test data, and uses the calculated hash value, the test parameter, the test random number, and the test secret key. For example, an elliptic curve encryption process is performed to generate a signature.
[0047]
Next, the cryptographic engine compares the generated signature with the expected value read into the arithmetic RAM, and outputs a match or mismatch result flag from the external test output terminal. At the same time, the signature generated by the cryptographic engine is stored in the arithmetic RAM for use in subsequent signature verification processing.
[0048]
Next, a signature verification start command is provided from the external input terminal for inspection to the cryptographic engine via the CPU, and signature verification processing is performed using the signature stored in the arithmetic RAM. At the time of signature verification, the cryptographic engine loads an inspection parameter, an inspection random number, a hash value, and an inspection public key as an inspection key into, for example, an arithmetic RAM. Next, the cryptographic engine performs signature verification processing by, for example, elliptic curve encryption processing using various values loaded in the operation RAM. Then, a result flag indicating whether or not the calculated signature matches the signature stored in the operation RAM is output from the external output terminal for inspection.
[0049]
As described above, when inspecting the cryptographic engine, the encryption process is performed using only the internal data, and furthermore, the result flag indicating whether the result of the encryption process matches or does not match the expected value is simply checked. It can be determined whether or not the encryption engine operates normally. Therefore, the cryptographic engine can be safely inspected without risking security such as directly inputting data, parameters, and the like to the cryptographic engine from the outside. Furthermore, in the second example, since the inspector does not need to know the expected value in determining whether or not the cryptographic engine has a failure, compared with the first example in which the result of the encryption processing is output as it is. Security can be further improved.
[0050]
Also, by performing a signature generation process and a signature verification process as a pair and performing an internal answer, it is possible to check whether or not the two processing circuits operate normally by a single cryptographic core inspection. In addition, the inspection of the cryptographic engine can be further simplified.
[0051]
Next, a third example, which is a modification of the second example, will be described with reference to FIG. This third example differs from the second example in that the storage means for storing the initial value is outside the cryptographic engine.
[0052]
Specifically, a third example is a CPU / RAM including a CPU that controls each unit, a RAM that functions as a work area of the CPU, and an EEPROM that is an electrically rewritable memory. / EEPROM, and an encryption engine as encryption processing means for performing an encryption process, and an input side of the CPU / RAM / EEPROM and an output side of the CPU / RAM / EEPROM and the encryption engine have external input / output for inspection (not shown). Connected to terminal.
[0053]
The cryptographic engine has a sequencer and is configured autonomously so that the cryptographic processing can be performed without the help of the CPU.
[0054]
In the third example, test data, a test parameter, a test random number, and a test key are stored in advance in a MASK ROM, which is a read-only memory that stores various programs and the like, as initial values. . Also, the expected value which is the result of the encryption processing based on the inspection data, the inspection parameter, the inspection random number, and the inspection key is stored in the MASK ROM in advance. The MASK ROM is a ROM in which data is written at the time of manufacturing, and cannot be tampered with, such as rewriting an initial value at the time of development. If these values are used as inspection-only values that are not actually used, even if any information is stolen, it is safe because it does not cause a problem such as being targeted by an attack.
[0055]
Note that these values stored in the MASK ROM should not be read from the outside as much as possible, for example, by limiting the registers and memory areas that can be accessed by the CPU to make reverse engineering difficult.
[0056]
When the cryptographic engine is inspected, an inspection mode command is input to the CPU / RAM / EEPROM from an external input terminal for inspection. At this time, initial values are read from the MASK ROM, and these values are transferred to an arithmetic RAM (not shown) such as an ALU RAM. When the inspection mode command is passed to the encryption engine via the CPU, the encryption engine reads an initial value from the arithmetic RAM and performs an encryption process. Further, the encryption engine compares the result of the encryption process with the expected value, and outputs a match or mismatch result flag from the external output terminal for inspection. Then, the inspector determines whether or not the cryptographic engine has failed based on the result flag.
[0057]
As described above, when inspecting the cryptographic engine, the encryption process is performed using only the internal data, and furthermore, the result flag indicating whether the result of the encryption process matches or does not match the expected value is simply checked. It can be determined whether or not the encryption engine operates normally. Therefore, the cryptographic engine can be safely inspected without risking security such as directly inputting data, parameters, and the like to the cryptographic engine from the outside. Further, since the inspector does not need to know the expected value in determining whether or not the cryptographic engine has failed, the security is further improved as compared with the first example in which the result of the encryption processing is output as it is. Can be.
[0058]
In the case of the third example as well, the signature generation and signature verification are performed as a pair in the same manner as in the second example, and the answers are internally matched to determine whether the two processing circuits operate normally. Can be checked by one inspection of the cryptographic core.
[0059]
Next, as a fourth example, a case where the encryption device of the present invention is applied to an FPGA (Field Programmable Gate Array) will be described with reference to FIG. In the following, for convenience of explanation, in this FPGA, it is assumed that an encryption device generates a signature by a public key encryption method.
[0060]
As shown in FIG. 4, the FPGA has a built-in RAM for calculation and a cryptographic engine for performing an encryption process. The input side and the output side of the cryptographic engine are connected to an external input / output terminal for inspection (not shown). I have.
[0061]
The cryptographic engine has a sequencer and is configured autonomously so that the cryptographic processing can be performed without the help of the CPU.
[0062]
In the FPGA, for example, inspection data, an inspection parameter, an inspection random number, and an inspection key are stored in advance in storage means (not shown) such as a gate as initial values. If these values are used as inspection-only values that are not actually used, even if any information is stolen, it is safe because it does not cause a problem such as being targeted by an attack. Note that these stored values are prevented from being read from the outside as much as possible, for example, by making the reverse engineering difficult by limiting registers and memory areas that can be accessed by the CPU.
[0063]
When the FPGA having such a configuration is started, the above-described initial values are automatically loaded into the built-in RAM.
[0064]
When the cryptographic engine is inspected, first, a test mode command is given to the cryptographic engine from an external input terminal for inspection (not shown), and the inspection data, the inspection parameters, and the inspection parameters are loaded as initial values into the FPGA. The inspection random number and the inspection secret key as the inspection key are read by the cryptographic engine. Next, the cryptographic engine actually generates a signature using the read initial value, and generates a signature. At the time of signature generation, the cryptographic engine performs, for example, SHA-1 processing to calculate a hash value of the test data, and uses the calculated hash value, the test parameter, the test random number, and the test secret key. For example, an elliptic curve encryption process is performed to generate a signature. Finally, the generated signature is output as an output value from the external output terminal for inspection. Then, the inspector determines whether or not the cryptographic engine has a failure by checking whether or not the signature as the output value is correct.
[0065]
As described above, when inspecting the cryptographic engine, the cryptographic processing is performed using only the internal data, and the output value as a result is compared with an expected value to determine whether the cryptographic engine operates normally. Can be determined. At this time, the person performing the inspection need only know the expected value. Therefore, even if the encryption device is built in the FPGA, the inspection of the encryption engine can be performed safely without risking security such as directly inputting data and parameters from the outside to the encryption engine. . The expected value that the inspector knows is too small for an attacker who tries to obtain internal information of the cryptographic engine such as key information, because the original inspection data and inspection parameters are unknown from outside. Has no meaning.
[0066]
Next, as a fifth example, a case where the encryption device of the present invention is applied to an actual non-contact type IC card will be described with reference to FIG.
[0067]
As shown in FIG. 5, an IC chip built in the non-contact type IC card includes a CPU 10 for controlling each unit, a RAM 20 serving as a memory functioning as a work area of the CPU 10, and a read-only memory for storing various programs and the like. ROM 30 as a memory, EEPROM 40 as an electrically rewritable memory, an analog block 50 for a power supply circuit, a cryptographic core 60 for performing an encryption process, and a so-called hash value used for a public key cryptosystem ALU RAM 70 for storing data, etc., an external I / O terminal 80 for inspection, which is a dedicated external bus for checking the presence or absence of a failure in the cryptographic core 60, and a bus for transmitting and receiving data between the CPU 10 and each unit. And an RF (Radio Frequency) for performing wireless communication (not shown). cy) constituted a block as an integrated circuit was called LSI (Large Scale Integration).
[0068]
In the following, for convenience of description, the cryptographic core 60 as an encryption processing unit employs a so-called Elliptic Curve Cryptography system (ECC) as a public key encryption system, and has a hash used for authentication and digital signature. Description will be made assuming that what is called SHA-1 (Secure Hash Algorithm-1) is used as a function.
[0069]
In the following, as in the above-described second example, the inspection data, the inspection parameter, the inspection random number, and the inspection secret key and the inspection public key as the inspection key are stored in the encryption core 60 as initial values. A case will be described as an example in which the information is stored in the gate in advance and the cryptographic core 60 outputs whether or not the result of the encryption process is correct as a result flag.
[0070]
Further, in order to specifically explain the inspection of the cryptographic core 60, as shown in FIG. 6, each part of the contactless IC card shown in FIG. 5 is functionally represented. In the figure, for convenience of explanation, the cryptographic core 60 is represented by an ECC / SHA-1 block 60 representing the functions of the elliptic curve encryption processing and the SHA-1 processing. ₁ And a DES block 60 representing a function of a triple DES (Data Encryption Standard) encryption process ₂ It is roughly divided into and expressed. The DES block 60 ₂ Is a block for generating a random number used in a key generation process and the like required for performing an encryption process, using a so-called DES (Data Encryption Standard) encryption method, which is one of the common key encryption methods. . 6, the test external input / output terminal 80 shown in FIG. 5 is represented as a test block 80.
[0071]
When checking for a failure of the cryptographic core 60 mounted on such a non-contact type IC card, a signature is generated by the cryptographic core 60 as described below, and it is determined whether or not the generated signature is correct. I do.
[0072]
First, when an inspection mode command is given from the inspection external input / output terminal 80 to the cryptographic core 60 via the CPU 10, the inspection data, the inspection parameter, the inspection random number, and the inspection The inspection secret key as a service key is read and stored in the ALU RAM 70.
[0073]
Next, the test data stored in the ALU RAM 70 is read, and the ECC / SHA-1 block 60 is read. ₁ The hash value is calculated by the SHA-1 process according to. The generated hash value is stored in the ALU RAM 70.
[0074]
At this time, the storage location of the hash value calculated by the SHA-1 processing on the ALU RAM 70 is set in advance to an address used in the elliptic curve encryption processing described later, so that the hash value by the SHA-1 processing is obtained. After the calculation, the process can be immediately shifted to the elliptic curve encryption process, so that most of a series of operations such as signature generation and signature verification can be executed at high speed by hardware. Therefore, in the encryption device, the load on the CPU can be reduced, and the resistance against an attack due to software tampering and the like can be enhanced. Normally, in the encryption process, if the transfer of an intermediate operation result is delegated to the CPU, the software can be easily tampered with by falsification. It is possible to avoid tampering due to CPU intervention on the way.
[0075]
Next, the hash value, the inspection parameter, the inspection random number, and the inspection secret key are read from the ALURAM 70, and the ECC / SHA-1 block 60 is used by using these values. ₁ Performs an elliptic curve encryption process to generate a signature.
[0076]
Next, the obtained signature is compared with the expected value stored in the ALU RAM 70, and a 1-bit result flag is output from the inspection external input / output terminal 80, for example.
[0077]
On the other hand, the obtained signature is stored in the ALU RAM 70 for use in subsequent signature verification processing.
[0078]
Then, a command to start signature verification is sent from the external input / output terminal for inspection 80 via the CPU 10 to the ECC / SHA-1 block 60. ₁ , The process proceeds to a signature verification process using the signature stored in the ALU RAM 70.
[0079]
At the time of signature verification, first, an inspection parameter, an inspection random number, a hash value, and an inspection public key as an inspection key are loaded into the ALU RAM 70.
[0080]
Next, the inspection parameter, the inspection random number, the hash value, and the inspection public key as the inspection key are read from the ALU RAM 70, and the ECC / SHA-1 block 60 is read. ₁ Thus, the signature verification processing is performed by the elliptic curve encryption processing.
[0081]
Then, a result flag indicating whether or not the calculated signature matches the signature stored in the ALU RAM 70 is output from the external input / output terminal 80 for inspection.
[0082]
As described above, when inspecting the cryptographic core 60, the encryption process is performed using only the internal data, and further, the result flag indicating whether the result of the encryption process matches or does not match the expected value is checked. It can be determined whether or not the cryptographic core 60 operates normally. That is, the inspection of the cryptographic core 60 can be performed safely without risking security such as directly inputting data, parameters, and the like from the external input / output terminal 80 for inspection to the cryptographic core 60. Further, since the inspector does not need to know the expected value in determining whether or not the cryptographic core 60 has a failure, the security can be further improved as compared with the case where the result of the encryption processing is output as it is. .
[0083]
In addition, it is preferable that a test pattern that can sufficiently secure the failure detection rate of the cryptographic core 60 be back calculated by simulation, and that this test pattern be stored as an initial value in a storage unit such as a gate or a ROM in advance. Usually, in order to increase the failure detection rate of the cryptographic core 60, it is necessary to input and test a very large number of test patterns from the outside, but if the test pattern calculated back by simulation is used as an initial value, the number of times of the test is reduced. A high failure detection rate is secured without increasing. Note that the registers, flags, and the like may be inspected separately. Therefore, the non-contact type IC card incorporating the encryption device of the present invention can sufficiently cope with mass production.
[0084]
Further, according to the present invention, it is possible to avoid an attack on the cryptographic core 60 by inputting / outputting data from / to the external input / output terminal 80 for inspection provided on the IC chip. Subsequent processing becomes unnecessary.
[0085]
Further, since the encryption device of the present invention has the above-described configuration, even if the IC tester or the like is stolen by an unauthorized third party, it is impossible to analyze the encryption function.
[0086]
Note that the present invention is not limited to the above-described embodiment. For example, in the above-described embodiment, the elliptic curve encryption method has been described as the public key encryption method. However, the present invention can be easily applied to other public key encryption methods such as the RSA encryption method. Can be applied to
[0087]
In the above-described embodiment, the encryption device that performs the encryption process using the so-called public key encryption method has been described. However, the present invention can be applied to the encryption device using the common key encryption method.
[0088]
In the above-described embodiment, SHA-1 is used as a hash function. However, the present invention can be easily applied to other hash functions such as MD5 (Message Digest 5). .
[0089]
Furthermore, in the above-described embodiment, an application example of the encryption device has been described using the IC chip built in the FPGA and the non-contact type IC card. However, the present invention is not limited to any application requiring the same function. Of course, it can be applied to an apparatus or a device.
[0090]
As described above, it goes without saying that the present invention can be appropriately changed without departing from the spirit of the present invention.
[0091]
【The invention's effect】
As is clear from the above description, the encryption device according to the present invention stores the test data, the test parameter, the test random number, and the test key in the storage unit as initial values, and externally sets the test mode. When these instructions are input, these are read out, encrypted, and the result is output. If the inspector knows the expected value, which is the correct value of the output result, it can determine whether or not the encryption device has a failure by comparing the expected value with the output result. For this reason, it is possible to avoid an attack on the encryption device due to repeated input / output of test data and the like. Therefore, according to the present invention, it is possible to realize an encryption device that can reliably perform an inspection without risking security such as directly inputting inspection data or the like from the outside at the time of inspection.
[Brief description of the drawings]
FIG. 1 is a first example of an encryption device according to the present invention, and is a diagram illustrating a configuration of an inspection circuit.
FIG. 2 is a second example of the encryption device of the present invention, and is a diagram illustrating a configuration of a test circuit.
FIG. 3 is a third example of the encryption device of the present invention, and is a diagram illustrating a configuration of a test circuit.
FIG. 4 is a fourth example of the present invention and is a diagram illustrating a configuration of an FPGA in which an encryption device is incorporated.
FIG. 5 is a diagram illustrating a configuration of an IC chip of a non-contact type IC card in which an encryption device is incorporated according to a fifth example of the present invention.
6 is a block diagram functionally representing an IC chip of the non-contact type IC card shown in FIG.
FIG. 7 is a diagram showing a configuration of a test circuit of a conventional encryption device.
[Explanation of symbols]
10 CPU
20 RAM
30 ROM
40 EEPROM
50 analog blocks
60 cryptographic core
70 ALU RAM
80 External input / output terminal for test (test block)
90 Interface

Claims (12)

Storage means for storing test data, a test parameter, a test random number, and a test key as initial values;
Encryption means for performing encryption processing,
The encryption processing unit uses the inspection data, the inspection parameter, the inspection random number, and the inspection key stored in the storage unit in response to an inspection mode instruction being externally provided. An encryption device that performs an encryption process. The storage means further stores an expected value which is a correct value generated when an encryption process is performed using the inspection data, the inspection parameter, the inspection random number, and the inspection key,
The encryption processing means determines whether or not the result of the encryption processing using the inspection data, the inspection parameter, the inspection random number, and the inspection key matches the expected value. 2. The encryption device according to claim 1, wherein a result is output. 2. The encryption apparatus according to claim 1, wherein said encryption processing means performs an encryption process using a public key encryption method. 4. The encryption device according to claim 3, wherein the encryption processing means performs a signature generation process as the encryption process. 5. The encryption apparatus according to claim 4, wherein the encryption processing unit performs a signature verification process on the signature generated by the signature generation process, and outputs a result of the signature verification process. The apparatus further includes a hash value generation unit that generates a hash value for use in encryption processing, and a second storage unit that stores a hash value generated by the hash value generation unit. 2. The encryption device according to claim 1, wherein the hash value stored in the second storage unit is read. 2. The encryption apparatus according to claim 1, wherein the initial value is calculated from a required failure detection rate. 2. The encryption apparatus according to claim 1, wherein the inspection data, the inspection parameter, the inspection random number, and the inspection key are not used in actual encryption processing. 2. The encryption apparatus according to claim 1, wherein said encryption processing means performs an elliptic curve encryption process. 7. The encryption apparatus according to claim 6, wherein said hash value generation means performs SHA-1 processing. 2. The encryption device according to claim 1, wherein the encryption device is incorporated in an IC chip built in a contactless IC card having a communication function. The encryption device according to claim 1, wherein the encryption device is incorporated in an FPGA.

Images