JP2006072414A - Software radio system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To safely and efficiently load a program for communication to a software radio unit. <P>SOLUTION: An SDR manager 103 stores an agent program 21 for making a software radio unit perform decoding/security processing and agent ID 11 generated by hash-processing the program in each software radio unit 1 in which unique serial ID 10 is stored, and encrypts a file, which is obtained by generating electronic signature from a program for communication by encryption with the agent ID as a symmetric key, and adding it to the program for communication, by a symmetric key obtained by combining the agent ID and the serial ID as an encrypted file 22 for the software radio unit. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a software defined radio system, and more particularly to a software defined radio system with improved security against changes in a program that controls the operation of a software defined radio.

  Software defined radio (SDR) machines have reconfigurable logic such as FPGA (Field Programmable Gate Array), and signal processing processors such as DSP (Digital Signal Processor). The wireless communication function corresponding to the communication method can be realized. Therefore, if an unauthorized program for a communication method that is not permitted for a certain software defined radio or its owner is downloaded, illegal use such as illegal radio wave transmission is possible, and thus a preventive measure is indispensable.

  Conventional techniques for preventing unauthorized use of a software defined radio include, for example, “wireless communication apparatus, program download method, and computer program” (see Patent Document 1) and “wireless data / communication method for software download system”. And device "(see Patent Document 2). In these technologies, a fingerprint is generated by applying a hash process to the program D downloaded on the distribution side, and the digital signature DS is generated by encrypting the fingerprint with the private key of the public key encryption. Next, the data obtained by adding the digital signature DS to the program D is encrypted with the secret key of the symmetric key encryption to obtain distribution data.

  The software defined radio that receives the distribution data first decrypts the distribution data using the secret key of the symmetric key encryption to obtain the program D and the electronic signature DS. Next, the decrypted electronic signature DS is decrypted with the public key of the public key encryption (the public key corresponding to the private key of the public key encryption used on the distribution side), and the fingerprint generated on the distribution side is taken out and decrypted on the other hand A fingerprint of the decrypted program is generated by performing the same hash process on the program D as the distribution side. Then, the generated fingerprint is compared with the fingerprint extracted by the digital signature DS decryption. If the two match, the decrypted program is regarded as valid and used as a reconfigurable logic program for the software defined radio.

  Here, the secret key of the public key cryptosystem is managed by a management station such as a government agency, and the secret key of the symmetric key, the logic for performing the decryption process, and the reconfigurable logic cannot be read from the outside of the software defined radio. Housed in a tamper resistant hardware package. With such a configuration, it is confirmed that the downloaded program is authorized and has not been tampered with, prevents unauthorized operation of the software defined radio by the unauthorized program, and at the time of distribution To prevent eavesdropping in

In the technique of Patent Document 1, various combinations such as a hash function, a key, and an encryption method are prepared, and these can be switched and used to further improve security.
JP 2003-304235 A JP 2003-122442 A

  When downloading a program to a software defined radio for the first time, or when switching a program that has already been downloaded, decryption and security check processing in the software defined radio should be completed as soon as possible and operation as a communication terminal can be started. Is preferred. Since the decryption processing of the encrypted data occupies a large time in the decryption and security check processing, it is desirable that this processing can be executed in as short a time as possible. However, in the above-described prior art, the electronic signature is performed by the public key cryptosystem. However, in general, the public key cryptography process is more complicated and has a larger processing amount than that of the symmetric key cryptosystem, and some countermeasure has been desired.

  Furthermore, in the above known example, the security logic for performing decryption and security check processing and various keys together with the reconfigurable logic itself are intended to improve security by accommodating them in a tamper-resistant hardware package. More logic is accommodated in the tamper resistant hardware, and it may be preferable to simplify depending on the target security level.

  The object of the present invention is to prevent the software defined radio from sending illegal radio waves by using illegal programs, and to speed up the program check and simplify the key management. The object is to provide a software defined radio system having a simpler configuration.

The present invention relates to a reconfigurable logic that realizes an operation in a wireless communication system according to a communication program to be loaded, a tamper-resistant ROM that stores a serial ID unique to the machine, and processing means other than the reconfigurable logic A plurality of software defined radios, generation of an encrypted program file in which an electronic signature is added to the communication program and encryption, and installation in each software defined radio, and each software defined radio includes the encryption program A software defined radio system comprising an SDR administrator that installs an agent on a software defined radio that is a program for performing decryption / security check of a file and loading the reconfigurable logic of the corresponding machine,
The SDR administrator generates an agent ID by performing a hash process using the first hash function included in the agent on the agent installed in one software defined radio, and stores it in the tamper resistant ROM of the software defined radio. Then, the communication program for the software defined radio is subjected to a hash process using a second hash function included in the agent, and the hash process output is obtained by a symmetric key encryption method using the agent ID as an encryption key. An electronic signature is generated by encryption, and a signed program in which the electronic signature thus generated is added to the communication program is encrypted by a symmetric key encryption method using the combination of the agent ID and the serial ID as an encryption key. Generate an encryption program and use this software And file to be stored in the E A radio, along with further comprising a function of storing into said tamper ROM at least the first and second hash function of said agent,
When one of the encrypted program files stored by the SDR administrator directly or via the network is selected by the user, the software radio is executed on the processing means, and is first selected by this execution. The encrypted program file is decrypted using the combination key of the serial ID and the agent ID stored in the tamper resistant ROM to generate a decrypted program file and a decrypted electronic signature, and stored in the tamper resistant ROM. Comparing the first data obtained by hashing the decryption program file with the second hash function and the second data obtained by decrypting the decrypted electronic signature using the agent ID stored in the tamper resistant ROM as a key, If the comparison results match, the decryption program file Disclosed is a software defined radio system having a function of loading into a reconfigurable logic of a software defined radio and displaying the illegal operation by discarding the decryption program file if the comparison result does not match .

  According to the present invention, since the electronic signature uses a symmetric key cryptosystem together with the program body, the processing is quick and the communication program switching time can be shortened. Further, the tamper resistant ROM can be simplified by adopting a configuration in which the agent is executed by a normal processing means such as a CPU. In addition, since the encryption key for electronic signature can be generated as the agent ID by the hash processing of the agent, when changing the agent, the encryption key can be easily generated on the software radio side from its own information. There is no need to distribute the decryption key together.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows a configuration example of a software defined radio system of the present invention, and shows main components for realizing security in the present invention. In FIG. 1, a hardware manufacturer 101 manufactures a software defined radio (SDR) 1 and writes a unique serial ID 10 for each software defined radio to a storage means provided in the software defined radio to the SDR administrator 103. hand over. Here, in consideration of a situation in which a plurality of hardware manufacturers may exist, it is preferable that the serial ID 10 is managed by the SDR manager 103 in a unified manner. On the other hand, the program file 20 to be executed by the reconfigurable logic of the software defined radio 1 is created by the software manufacturer 102, and after confirming its operation, it is passed to the SDR manager 103. This software manufacturer may be integrated with the hardware manufacturer.

  The SDR administrator 103 writes the agent 21 which is a program for performing security processing in the software defined radio and the agent ID 11 generated from the agent 21 to the software defined radio 1 and uses the agent ID 11 and the serial ID 10 as encryption keys. An encrypted program file 22 with an electronic signature is generated from the program file 20. In general, a plurality of encrypted program files 22 corresponding to the communication method required for the software defined radio 1 are stored in the storage means of the software defined radio 1. It is assumed that the encryption program file can be stored not only when the software defined radio 1 is first delivered to the user 104 but also via a network or directly. The management table 2 is a table composed of information such as the name, serial ID, installed agent and program file of each software defined radio. The management table 2 is created by the SDR administrator 103 and used for managing the software defined radio.

  In the software defined radio 1 of the user 104, one of the encryption program files 22 corresponding to the communication method to be used is taken out from the storage means, and the agent 21 performs decryption processing and security processing using the agent ID 11 and serial ID 10 as keys, and security. After the confirmation, the decrypted program file 20 is loaded into the reconfigurable logic so that communication processing can be performed. Hereinafter, the configuration of the software defined radio 1, the security processing in the SDR administrator 103 and the software defined radio 1, etc. will be described in detail.

  FIG. 2 shows a hardware configuration example of the software defined radio 1. The bus 209 includes a CPU 201, a DSP 202, an FPGA 203 as a reconfigurable logic, a radio unit 204, a ROM 205, a RAM 206, an A / D and D / A conversion unit 207, a microphone. / An I / O unit 208 such as a speaker and a network, a tamper resistant ROM 209, and the like are connected. In this configuration, the wireless unit 204 has a function of transmitting and receiving a wide range of frequencies and various modulated waves in order to support various communication methods that are characteristic of software defined radio. The ROM 205 stores the encryption program 22 described above and an agent 21 that performs decryption / security processing of the encryption program 22. The tamper resistant ROM 209 stores the serial ID 10, the agent ID 11, and the first and second hash functions 12 that are part of the agent 21. Since the tamper resistant ROM 209 cannot read or rewrite data from the outside, the serial ID 10, the agent ID 11, and the hash function 12 stored therein are protected from eavesdropping. It is more preferable that the tamper resistant ROM 209 is configured integrally with the CPU 201.

  The FPGA 203 as the reconfigurable logic is not stored in the tamper resistant ROM as in the known technique. The program (hardware definition information) loaded into the FPGA 203 is a program 20 that has been confirmed to be legitimate by the processing of the agent 21 described later, and should be read out and diverted to other software defined radios. Even if it is done, it does not cause illegal radio wave transmission or the like. Therefore, in order to simplify the configuration of the entire hardware, the FPGA and the tamper resistant ROM are not housed together in the configuration example of FIG.

  FIG. 3 is a flowchart of the process for generating the encrypted program file described with reference to FIG. 1, which is executed by the SDR administrator 103. In this process, first, an agent 21 that performs decryption / security processing of the target software defined radio is selected, and this is written to the ROM 205 and the tamper resistant ROM 209 (hash function in the agent) (FIG. 2) of the software defined radio ( Step 301). In addition, although the serial ID 10 has already been written by the hardware manufacturer 101 in the tamper resistant ROM 209 of the target software defined radio, this writing may be performed by the SDR administrator 103. Next, the selected agent 21 is also subjected to hash processing using a predetermined first hash function (part of the agent 21) (step 302), and the hash value is set as the agent ID 11, which is the resistance of the software defined radio. Write to the tamper ROM 209 (step 303).

  On the other hand, the hash value obtained by the second hash function is applied to the program file 20 for FPGA used in the target software defined radio (step 304), and the hash value obtained by the process is encrypted using the encryption key K1. (Step 305), the result is the electronic signature 13. Here, the encryption key K1 is the agent ID 11. Next, the electronic signature 13 is added to the program 20 (step 306) to form a signed program file 14. Further, this file is encrypted using an encryption key K2 in which the agent ID 11 and the serial ID 10 are combined (step 307), and an encrypted program file 22 is generated.

  The first and second hash functions used in the above processing of FIG. 3 are the same functions used when the agent 21 written in the ROM or the like in step 301 is executed by the software defined radio, and the selected agent 21 is a part of 21. The encryption processing in step 305 and step 307 generally has different algorithms, but both are based on a symmetric key encryption method such as DES (Data Encryption Standard), and the agent 21 is executed by a software defined radio. This corresponds to the decryption process performed when

  FIG. 4 is a flowchart showing the operation of the agent 21 that decrypts the encrypted program file 22 generated and loaded by the processing of FIG. 3 and performs security processing. This is executed by the CPU or DSP of the software defined radio. . This agent 21 is activated with a user operation as a trigger when a software radio device first installs a program corresponding to one communication method in an FPGA, or when switching to a program corresponding to a communication method different from that time point. The When started, the encryption program file 22 corresponding to the communication method designated by the user operation is taken out from the ROM 205 (step 401), and the encryption key K2 combining the serial ID 10 and the agent ID 11 stored in the tamper resistant ROM 209 is used. The decoding process is performed (step 402). This decryption needs to correspond to the encryption processing 307 in FIG.

  A plain text program file 20R and an electronic signature 13R are generated from the encrypted program file 22 by the decryption process 402. These are the same as the original program file 20 and the electronic signature 13 if the encrypted program file is a legitimate one created by the SDR administrator 103 and the agent is executing the decryption process with the correct algorithm. , If there is any tampering, it will not match. Accordingly, the program file 20R is hashed by the second hash function (step 403), and the electronic signature 13R is corresponded to the encryption processing 305 of FIG. 3 using the encryption key K1 (agent ID 11 stored in the tamper-proof ROM). When the decryption process is performed (step 404), the data obtained by these two processes are the same as the output of the process step 304 of FIG. 3 unless any alteration is performed. Therefore, when it is checked whether or not the outputs of steps 403 and 404 match (step 405), the decrypted plaintext program file 20R can be loaded into the FPGA as a legitimate one (step 406). If there is a mismatch in step 405, the fact that there is any illegality is displayed on the display means of the software defined radio, and the decrypted program file 20R is discarded to prevent unauthorized use (steps 407, 408). When fraud is detected, countermeasures such as outputting illegal contents to an external storage device log file and rewriting the agent ID 11 to prevent subsequent illegal use may be taken.

  FIG. 5 is an example of the management table 2 provided for the SDR administrator 103. The name is the name of the software defined radio, and the group name is recorded in addition to the serial ID of the software defined radio and the installed program. This group name represents an agent installed in the software defined radio. If the group name is the same, the agent is the same. Such grouping of software defined radios by agents is useful for improving security because even if the agents themselves are leaked or diverted, only those software defined radios within the same group can be affected.

  According to the embodiment described above, since all encryption / decryption including the signature is performed by the symmetric key encryption method, the processing can be performed in a short time and the communication method of the software defined radio can be changed quickly. Then, the agent written in the software defined radio by the SDR administrator performs decryption and authentication, so that execution of an abnormal program file on the FPGA (generally reconfigurable logic) can be eliminated. In addition, by encrypting and decrypting using a key that combines a serial ID and an agent ID, even if the program file is misappropriated to another software defined radio, it can be used on reconfigurable logic. Software execution can be prevented. Even if the hardware is duplicated, the diverted program file cannot be executed by keeping the serial ID, agent ID, and the decryption and authentication procedures by the agent secret.

  In addition, the agent written by the SDR administrator can decrypt and authenticate the program, and control the execution and prohibition of software change of the reconfigurable logic, allowing the user to reconfigure illegal software that is not encrypted It cannot be transferred to logic. Furthermore, since it is an agent executed as a program, it is easy to limit the number of times and time limit for decryption and authentication processing, prevent abuse of SDR by malicious users, and manage the operation period Can do.

  In the configuration example of the software defined radio in FIG. 2, only the hash function in the agent 21 is stored in the tamper resistant ROM 209 for protection, but the other part of the agent 21, that is, the decryption processing step in FIG. If the algorithms 402 and 404 are also stored in the tamper resistant ROM 209 to prevent reading from the outside, security can be improved.

  In addition, the encrypted program file has been described as being directly stored in the software defined radio by the SDR administrator 103. However, if sufficient network security measures can be taken, the program is distributed via the network in response to a user request. It can also be.

  Further, the tamper resistant ROM 209 stores the serial ID 10 and the engineering ID 11, and encryption / decryption processing logic such as MUGI (a pseudo random number / hash generator developed by Hitachi, Ltd.) (and in some cases, reading from the ROM 205). And a ROM type FPGA or PLD having a DMA (Direct Memory Access) function for writing to the FPGA 203, which is realized separately from the CPU 201, and the decryption processing of the encryption program 22 performed by the CPU is performed in this ROM. You may make it carry out within type | mold FPGA.

It is a figure showing the system configuration outline of the present invention. It is a structural example of a software defined radio. It is a flowchart of an encryption program file generation process. It is a flowchart of a decoding and security process. It is a management table explanatory drawing.

Explanation of symbols

1 Software defined radio 2 Management table 10 Serial ID
11 Agent ID
12 Hash function 13 Electronic signature 14 Program file with signature 20 Program file 21 Agent 22 Encrypted program file 209 Tamper resistant ROM

Claims (1)

A plurality of reconfigurable logics that realize operations in a wireless communication system according to a communication program to be loaded, a tamper-resistant ROM that stores a serial ID unique to the machine, and processing means other than the reconfigurable logic Software radios, generation of encrypted program files in which electronic signatures are added to the communication programs and encryption, installation in software radios, and software radios decrypting the encrypted program files A software defined radio system comprising an SDR administrator that installs an agent on the software defined radio that is a program for performing security checks and loading the reconfigurable logic of the machine;
The SDR administrator generates an agent ID by performing a hash process using the first hash function included in the agent on the agent installed in one software defined radio, and stores it in the tamper resistant ROM of the software defined radio. Then, the communication program for the software defined radio is subjected to a hash process using a second hash function included in the agent, and the hash process output is obtained by a symmetric key encryption method using the agent ID as an encryption key. An electronic signature is generated by encryption, and a signed program in which the electronic signature thus generated is added to the communication program is encrypted by a symmetric key encryption method using the agent ID and the serial ID in combination as an encryption key. Generate an encryption program and use this software And file to be stored in the E A radio, along with further comprising a function of storing into said tamper ROM at least the first and second hash function of said agent,
When one of the encrypted program files stored by the SDR administrator directly or via the network is selected by the user, the software radio is executed on the processing means, and is first selected by this execution. The encrypted program file is decrypted using the combination key of the serial ID and the agent ID stored in the tamper resistant ROM to generate a decrypted program file and a decrypted electronic signature, and stored in the tamper resistant ROM. Comparing the first data obtained by hashing the decryption program file with the second hash function and the second data obtained by decrypting the decrypted electronic signature using the agent ID stored in the tamper resistant ROM as a key, If the comparison results match, the decryption program file Software loaded into reconfigurable logic radio, software radio system, characterized in that said comparison result having a function for displaying misbehaving discard the decryption program file if disagreement.

Images