JP2012093906A - Semiconductor memory device and information processing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a semiconductor memory device capable of preventing a security attack such as a cold boot attack.SOLUTION: A semiconductor memory device comprises: a memory cell array including a plurality of memory cells; an input/output control circuit for controlling input/output of data to/from the memory cell array; a storage part for storing an authentication code provided by an external device; and an input/output interface circuit for, when a read control signal is externally input, encrypting and outputting data received from the input/output control circuit. The input/output interface circuit, only when a release code corresponding to the authentication code is input from the external device, outputs the data received from the input/output control circuit without encrypting it.

Description

  The present invention relates to a semiconductor memory device and an information processing method.

  With the recent development of semiconductor process technology, the storage capacity of semiconductor memory devices is constantly increasing. In addition, as the semiconductor memory device has a large capacity, a high-speed operation, and a reduced price, various products are equipped with the semiconductor memory device. Therefore, semiconductor memory devices play an important role in various products such as computers. As a typical semiconductor memory device, a dynamic random access memory (hereinafter referred to as DRAM) is known.

  On February 21, 2008, a security researcher team at Princeton University announced that there is a security release technique using characteristics unique to DRAMs among semiconductor memory devices (see Non-Patent Document 1). In particular, it has been reported that a DRAM product storing an encryption key may have a security problem due to a direct attack called “cold boot attack”.

  The cold boot attack is a direct security attack technique to hardware using characteristics unique to DRAM as disclosed in Non-Patent Document 1. Hereinafter, this attack technique will be described in detail.

  When a command is not input for a certain period of time, a personal computer (hereinafter referred to as a PC) transitions to a so-called “standby mode” such as a sleep mode or a hibernation mode in order to suppress power consumption. Among these, in the sleep mode, the semiconductor memory device enters the standby state while retaining the data in the storage area in order to enable high-speed recovery from the standby state. Cold boot attack uses the fact that the memory cell holds data for a certain period of time (several minutes) even after the semiconductor memory device is a DRAM after the semiconductor memory device is powered off during this sleep mode. Thus, this is a method of reading data illegally. As a countermeasure, programs used for security attacks are widely available on the Internet, especially in English-speaking countries. Although countermeasures using security software have been proposed, stronger security countermeasures are desired.

  A semiconductor nonvolatile memory is disclosed in Patent Document 1 as a semiconductor memory device having a defense function against a security attack. In the method disclosed in Patent Document 1, when a code is input by a user when data stored in the memory unit is read, the input code matches the password stored in the password code storage area in advance. Only in this case, the data output circuit is operated to enable reading of data stored in the memory unit.

Japanese Patent Laid-Open No. 2001-125832

J. Alex Halderman, 8 others, "Lest We Remember: Cold Boot Attacks on Encryption Keys", released February 21, 2008 and published in Proc. 2008 USENIX Security Symposium, [October 19, 2010 search], Internet < URL: http: //citp.princeton.edu.nyud.net/pub/coldboot.pdf>

  In the method disclosed in Patent Document 1, the user himself / herself inputs a code for reading data from the memory unit of the semiconductor nonvolatile memory. Therefore, if a malicious third party steals the code that the user has left in the memo or if the malicious third party sees where the user is entering the code, the malicious third party Data could be read illegally.

  In a volatile semiconductor memory device such as a DRAM, it is generally considered that the data stored in the memory will be lost when the power supply is stopped due to its characteristics. Therefore, security such as a cold boot attack is required. No method for attack is currently proposed. Further, the method disclosed in Patent Document 1 is a method that can be applied only to a nonvolatile semiconductor memory device having a characteristic that data stored in a memory does not disappear even when power supply is stopped. It cannot be directly applied to a security attack such as a cold boot attack on a semiconductor memory device.

The semiconductor memory device of the present invention
A memory cell array including a plurality of memory cells;
An input / output control circuit for controlling input / output of data to / from the memory cell array;
A first storage unit for storing an authentication code provided from an external device;
An input / output interface circuit that encrypts and outputs data received from the input / output control circuit when a read control signal is input from the outside;
The input / output interface circuit includes:
The configuration is such that data received from the input / output control circuit is output without encryption only when a release code that matches the authentication code is input from the external device.

The information processing method according to the present invention includes a memory cell array including a plurality of memory cells, an input / output control circuit for controlling input / output of data to / from the memory cell array, and a memory for storing an authentication code provided from an external device. And an information processing method by a semiconductor memory device having an input / output interface circuit that outputs data received from the input / output control circuit to the outside,
When a read control signal is input from the outside, it is determined whether a cancel code for canceling the encryption process for the data is input from the outside,
When no release code is input from the outside, the data received from the input / output control circuit is encrypted and output, and only when the release code matching the authentication code is input from the external device, from the input / output control circuit The received data is output without being encrypted.

  In the present invention, even if there is a compulsory data read instruction to the memory cell array, if a cancel code that matches an authentication code provided in advance from an external device is not input, the data is encrypted and output. Since it is difficult for a third party to obtain a regular release code from the control device, the possibility that the encrypted data is decrypted is low.

  According to the present invention, it is possible to further increase the confidentiality of information stored in a storage area against a security attack such as a cold boot attack.

It is a block diagram which shows the example of 1 structure of the semiconductor memory device of this embodiment. FIG. 2 is a block diagram illustrating a configuration example of an input / output interface circuit illustrated in FIG. 1. 5 is a flowchart showing an operation procedure when the semiconductor memory device of the present embodiment transits to a sleep mode. 4 is a flowchart showing an operation procedure when the semiconductor memory device of the present embodiment returns from a sleep mode to a normal mode. 6 is a flowchart illustrating a normal operation procedure when the semiconductor memory device according to the present embodiment is started again after being turned off.

  The configuration of the semiconductor memory device of this embodiment will be described. In the present embodiment, it is assumed that the semiconductor memory device is a volatile semiconductor memory device. FIG. 1 is a block diagram showing a configuration example of the semiconductor memory device of this embodiment.

  The semiconductor memory device 1 of this embodiment includes an input / output interface circuit 2, a row decoder 3, a memory cell array 4, a column decoder 5, and an input / output (IO) control circuit 6. An MPU (Micro-Processing Unit) 30 is connected to the input / output interface circuit 2. In the present embodiment, the MPU 30 is an MPU used by a regular user of the semiconductor memory device 1.

In the memory cell array 4, a plurality of memory cells 40 are arranged in a matrix. The memory cell array 4 shown in FIG. 1 is provided with 2 ^N × 2 ^M memory cells 40. N rows of signal lines and M columns of signal lines intersect, and a memory cell 40 is disposed at each intersection.

  The IO control circuit 6 outputs data (Din) input from the MPU 30 via the input / output interface circuit 2 to the memory cell array 4, and reads data (Dout) read from the memory cell array 4 via the input / output interface circuit 2. Send to.

  When an address signal for designating a row and a column is input from the MPU 30, the input / output interface circuit 2 notifies the row decoder 3 of row information and notifies the column decoder 5 of column information. The input / output interface circuit 2 transfers data to the IO control circuit 6 when a write control signal that is a control signal for instructing data writing and data to be written are input from the MPU 30, and the IO control circuit 6 writes data into the memory cell array 4.

  The row decoder 3 identifies one of the N signal lines in the memory cell array 4 according to the row information notified from the input / output interface circuit 2. The column decoder 5 specifies any one of the M signal lines in the memory cell array 4 according to the column information notified from the input / output interface circuit 2. As a result, the data in the memory cell 40 located in the row and column designated by the address signal can be read out.

  In addition to the above-described configuration, the input / output interface circuit 2 according to the present embodiment has the following configuration.

  FIG. 2 is a block diagram showing a configuration example of the input / output interface circuit shown in FIG. In FIG. 2, in order to explain the flow of data and control signals when the MPU 30 reads data from the memory cell array 4 via the input / output interface circuit 2, the configuration other than the input / output interface circuit 2 is also shown in the figure. Yes.

  The input / output interface circuit 2 includes a random number generation circuit 7, an arithmetic circuit 11, a comparison circuit 9, an authentication code storage circuit 12, and a release code storage circuit 10.

  The authentication code storage circuit 12 is a storage unit that stores an authentication code for authenticating that the connection destination device is the MPU 30. When a new authentication code is input, the authentication code storage circuit 12 deletes the authentication code that has already been stored, stores the newly input authentication code, and stores the new authentication code and the authentication code as a pseudo-random number. A random number initial value setting signal including information to update the initial value is transmitted to the random number generation circuit 7.

  The cancellation code storage circuit 10 is a storage unit that stores a cancellation code that is a code for canceling data encryption. The release code storage circuit 10 stores the release code when the release code is input from the MPU 30 when the semiconductor memory device 1 returns from a standby state such as a sleep mode or when power supply to the semiconductor memory device 1 is started. . The authentication code storage circuit 12 and the release code storage circuit 10 are volatile storage units.

  The random number generation circuit 7 is a circuit that generates a random number for encrypting data output from the memory cell array 4. When the random number generation circuit 7 receives the random number initial value setting signal from the authentication code storage circuit 12, the random number generation circuit 7 generates a pseudo random number using the authentication code included in the signal as an initial value. In the present embodiment, the case where the random number generated by the random number generation circuit 7 is a pseudo-random number will be described, but it may be a pure random number.

  When a read control signal, which is a control signal for instructing data read, is input from the MPU 30, the input / output interface circuit 2 transfers the read control signal to the IO control circuit 6. Data stored in the memory cell array 4 is transmitted to the arithmetic circuit 11. Note that when the read control signal is input, if the address signal is input from the MPU 30, the data stored in the memory cell 40 specified by the address signal is the output target.

  The arithmetic circuit 11 is a decryption signal which is a control signal 13 for decrypting data when the semiconductor memory device 1 returns from a standby state such as a sleep mode or when power supply to the semiconductor memory device 1 is started. Is received from the comparison circuit 9, the data received from the IO control circuit 6 is output to the outside as it is, and when the decryption signal is not received from the comparison circuit 9, the pseudo random number generated by the random number generation circuit 7 is used. The data received from the IO control circuit 6 is encrypted and output to the outside.

  When the release code is input from the outside, the comparison circuit 9 compares the release code with a previously registered authentication code and controls the operation of the arithmetic circuit 11 according to the comparison result. Specifically, the comparison circuit 9 compares the cancellation code stored in the cancellation code storage circuit 10 with the authentication code stored in the authentication code storage circuit 12, and as a result, the cancellation code and the authentication code match. When the decryption signal is transmitted to the arithmetic circuit 11 and the decryption code does not match the authentication code, the data erase signal, which is the control signal 14 for instructing the erase of the data stored in the memory cell array 4, is sent to the IO control circuit. 6 to send. If the release code and the authentication code do not match, the input / output interface circuit 2 overwrites and saves the release code stored in the release code storage circuit 10 in the authentication code storage circuit 12 as a new authentication code.

  When the semiconductor memory device transitions to the sleep mode, normally, the power supply for holding the data stored in the memory cell array 4 is continued, but the power supply to the circuits related to data reading and writing is reduced. Therefore, power consumption is suppressed. In the semiconductor memory device 1 according to the present embodiment, when the mode is changed to the sleep mode, not only the power supply for holding data in the memory cell array 4 but also the authentication code stored in the authentication code storage circuit 12 is stored. The code storage circuit 12 is also supplied with power.

  Next, the configuration of the MPU 30 will be described. In the present embodiment, portions related to the information processing method of the present invention will be described in detail, and detailed description of the configuration of a general MPU will be omitted.

  The MPU 30 is an example of a control device that controls reading of data from the memory cell array 4 or writing of data to the memory cell array 4.

  When the MPU 30 changes the semiconductor memory device 1 to the sleep mode, the MPU 30 generates an authentication code and transmits it to the semiconductor memory device 1. When the MPU 30 returns the semiconductor memory device 1 from the sleep mode, the MPU 30 matches the authentication code that has already been transmitted. The release code to be transmitted is transmitted to the semiconductor memory device 1. Further, the MPU 30 newly generates a release code and transmits it to the semiconductor memory device 1 when power supply to the semiconductor memory device 1 is started. A program for causing an arithmetic unit (not shown) provided in the MPU 30 to execute such processing may be stored in advance in a nonvolatile memory (not shown) provided in the MPU 30. It is not necessary to add a special configuration to the MPU in order to execute the information processing method of the present embodiment.

  Next, the operation of the semiconductor memory device 1 of the present embodiment will be described with reference to FIGS. An operation procedure in the case where the semiconductor memory device 1 of the present embodiment transitions to the sleep mode will be described with reference to FIG.

  When the semiconductor storage device 1 receives an instruction from the MPU 30 to shift to the sleep mode (step 101), it waits for an authentication code to be sent from the MPU 30 (step 102). When the semiconductor memory device 1 receives the authentication code from the MPU 30, it stores the authentication code in the authentication code storage circuit 12 (step 103), and confirms the reception of the authentication code, thereby transitioning to the sleep mode (step 104). The authentication code is used in the random number generation circuit 7 as an initial value for generating a pseudo random number.

  Next, an operation procedure when the semiconductor memory device 1 returns from the sleep mode to the normal mode will be described with reference to FIG. The normal mode is a state in which a request for writing data to the semiconductor memory device 1 and a data reading request from the semiconductor memory device 1 can be immediately responded regardless of which request is from the MPU 30.

  When the semiconductor memory device 1 that has transitioned to the sleep mode receives an instruction to return to the normal mode from the MPU 30 (step 121), it waits for a cancel code to be sent from the MPU 30 (step 122). The semiconductor memory device 1 does not normally return from the sleep mode to the normal mode unless it receives the release code from the MPU 30.

  Here, when a cold boot attack is performed, it is considered that the read control signal is forcibly input to the semiconductor memory device 1 without inputting the release code. In this case, the semiconductor memory device 1 reads the data stored in the memory cell array 4 in accordance with the read control signal without receiving the release code (step 123), but the random number generated by the random number generation circuit 7 The data is encrypted by the arithmetic circuit 11 and output (step 124). After that, if the release code is not received after a certain period of time, for example, if the release code is a 4-digit number, the semiconductor memory device 1 has a release code of “0000” that cannot be generated by the MPU 30. As input, the process proceeds to step 125.

  In step 122, when the semiconductor storage device 1 receives the release code from the MPU 30, the semiconductor storage device 1 stores the received release code in the release code storage circuit 10, and the authentication code stored in the authentication code storage circuit 12 and the release code. The comparison circuit 9 determines whether or not the release codes stored in the code storage circuit 10 match (step 125).

  If the result of determination by the comparison circuit 9 in step 125 is that the cancellation code matches the authentication code, the arithmetic circuit 11 is made to cancel the data encryption process (step 126) and transition to the normal mode mode (step 126). 127). On the other hand, if the result of determination in step 125 is that the release code and authentication code do not match, a data erase signal is sent from the comparison circuit 9 to the IO control circuit 6 and all data held in the memory cell array 4 is erased ( Step 128). As a data erasing method performed by the semiconductor memory device 1 on the memory cell array 4, for example, there is a method of writing zero data to all the memory cells of the memory cell array 4, but other methods may be used.

  As described above, even if the semiconductor memory device 1 in the sleep mode is accessed by another MPU other than the MPU 30 used by the authorized user due to a security attack such as a call boot attack, the memory cell array 4 It is possible to prevent unauthorized reading of data held in the.

  After erasing all data in the memory cell array 4 in step 128, the semiconductor memory device 1 stores the release code input from the MPU 30 in the authentication code storage circuit 12 as a new authentication code (step 129). Subsequently, the semiconductor memory device 1 causes the arithmetic circuit 11 to cancel the data encryption process (step 126), and then transitions to the normal mode (step 127).

  Note that the order of steps 122 and 123 shown in FIG. 4 may be reversed. In this case, after determining the presence or absence of the read control signal in step 123, the semiconductor memory device 1 performs the determination in step 122. If the release code is not received, the process proceeds to step 124. If the release code is received, step 125 is performed. You can proceed to.

  Next, when the semiconductor memory device 1 is not subjected to a security attack such as a cold boot attack, after the external power supply is stopped by the control of the MPU 30 according to a normal procedure, the semiconductor memory device 1 is started again by the control of the MPU 30 The procedure will be described with reference to FIG.

  When power supply to the semiconductor memory device 1 is started under the control of the MPU 30 (step 141), the semiconductor memory device 1 waits for a release code sent from the MPU 30 (step 142).

  Even if the semiconductor memory device 1 receives the release code from the MPU 30, the data held in the authentication code storage circuit 12 is not uniquely determined after the power is turned on. For this reason, the authentication code and the cancellation code do not coincide with each other in the determination in step 125 described with reference to FIG. Subsequently, the semiconductor memory device 1 stores the release code received from the MPU 30 in the authentication code storage circuit 12 as an authentication code (step 144), and then cancels the encryption process of the arithmetic circuit 11 (step 145). The process proceeds to the initialization sequence (step 146).

  It has been described with reference to FIG. 5 that the semiconductor memory device 1 of this embodiment can operate in the same manner as a normal semiconductor memory device even when the power source of the semiconductor memory device is turned on according to a normal procedure. Here, after a third party who illegally reads data temporarily stops the power supply to the semiconductor memory device 1, the semiconductor memory device 1 is attached to its own PC, and the semiconductor memory device 1 is loaded. Next, it will be described that it is possible to cope with the case where the data supply is started by starting the power supply.

  After step 141, a third party who attempts to read data illegally operates the PC and inputs an instruction to the PC to forcibly read the remaining data without being erased from the memory cell array 4. Then, the MPU transmits a read control signal to the semiconductor memory device 1. In this case, the semiconductor memory device 1 performs the determination in step 123 shown in FIG. 4 and even if data remains in the memory cell array 4, it does not receive the release code, so the data is encrypted and stored in the PC. Output. If no data remains in the memory cell array 4 or if no release code is received after a certain time has elapsed, the semiconductor memory device 1 performs the processing of steps 143 to 146 shown in FIG.

  As described above, in the semiconductor memory device and the information processing method according to the present embodiment, not only the security attack performed after the power supply is completely stopped, but also the transition to the initialization sequence is performed without disturbing the normal operation. It is possible.

  In the semiconductor memory device of this embodiment, even if there is a compulsory data read instruction to the memory cell array, if the release code corresponding to the authentication code provided from a predetermined external device is not input, the data Is encrypted and output. Even if a semiconductor storage device is subjected to a security attack such as a cold boot attack, the data is encrypted and output, and it is difficult for a malicious third party to obtain a legitimate release code from the control device. It is difficult to decipher the recorded data. In addition, when there is an instruction to read data when the semiconductor memory device is returned from the standby state or when power supply is started, the data is encrypted and output even if data remains in the memory cell array. Therefore, the confidentiality of information stored in the storage area can be further enhanced against security attacks such as cold boot attack.

  In the semiconductor memory device of the present embodiment, since the authentication code is input from the MPU when transitioning to the standby state, only the MPU that has controlled the standby state stores the data held in the semiconductor memory device. It is possible to release encryption. Therefore, even if another MPU attempts to control data reading from the semiconductor memory device due to a cold boot attack, it becomes difficult to read data. Even if a malicious third party inputs the release code to the semiconductor memory device, if the release code does not match the authentication code, all data in the memory cell array is erased.

  Furthermore, in this embodiment, the initial value used when the random number generation circuit 7 generates the pseudo random number is updated by the MPU every time the semiconductor memory device enters the sleep mode. Since this functions as a so-called one-time password, the confidentiality of information against a security attack from a malicious third party as compared with the technique in which the code is fixed disclosed in Patent Document 1 Can be further enhanced.

  Note that the semiconductor memory device and the information processing method according to the present embodiment can be applied not only to a volatile semiconductor memory device but also to other semiconductor memory devices such as a nonvolatile semiconductor memory device, and its application range is limited. Not what you want.

  The semiconductor memory device of the present invention is optimal for mounting on an electronic device that requires high information confidentiality.

DESCRIPTION OF SYMBOLS 1 Semiconductor memory device 2 Input / output interface circuit 3 Row decoder 4 Memory cell array 5 Column decoder 6 IO control circuit 7 Random number generation circuit 9 Comparison circuit 10 Cancellation code storage circuit 11 Arithmetic circuit 12 Authentication code storage circuit 40 Memory cell

Claims (9)

A memory cell array including a plurality of memory cells;
An input / output control circuit for controlling input / output of data to / from the memory cell array;
A first storage unit for storing an authentication code provided from an external device;
An input / output interface circuit that encrypts and outputs data received from the input / output control circuit when a read control signal is input from the outside;
The input / output interface circuit includes:
A semiconductor memory device that outputs data received from the input / output control circuit without encryption only when a release code that matches the authentication code is input from the external device. The semiconductor memory device according to claim 1.
The input / output interface circuit includes:
A semiconductor memory device that encrypts and outputs data received from the input / output control circuit when the read control signal is input when returning from a standby state or when power supply is started. The semiconductor memory device according to claim 1 or 2,
The input / output interface circuit includes:
A semiconductor memory device that causes the input / output control circuit to erase data stored in the memory cell array when a release code input from outside does not match the authentication code. The semiconductor memory device according to claim 1,
The input / output interface circuit includes:
A second storage unit for storing the input release code;
A random number generator for generating a random number for encrypting the data;
A comparison circuit for determining whether to encrypt the data;
When receiving the decryption signal, which is a control signal for decrypting the data, from the comparison circuit, the data received from the input / output control circuit is output as it is, and the decryption signal is output to the comparison circuit. An operation circuit that encrypts and outputs data received from the input / output control circuit using a random number generated by a random number generation circuit.
The comparison circuit is
The cancellation code stored in the second storage unit and the authentication code stored in the first storage unit are compared, and if the cancellation code and the authentication code match, the decryption signal is calculated A semiconductor memory device that transmits to a circuit and transmits a signal for instructing erasure of data stored in the memory cell array to the input / output control circuit when the release code and the authentication code do not match. The semiconductor memory device according to claim 4.
The random number generation circuit includes:
When the authentication code is stored in the first storage unit, a semiconductor memory device generates a pseudo-random number using the authentication code as an initial value. The semiconductor memory device according to claim 4 or 5,
The external device is a control device that reads the data from the memory cell array by transmitting the read control signal to the input / output interface circuit,
The input / output interface circuit includes:
When the authentication code is received from the external device during the transition to the standby state, the authentication code is stored in the first storage unit, and the release code is stored when returning from the standby state or when starting the power supply. A semiconductor storage device that stores the release code in the second storage unit when received from the external device. A memory cell array including a plurality of memory cells, an input / output control circuit for controlling input / output of data to / from the memory cell array, a storage unit for storing an authentication code provided from an external device, and receiving from the input / output control circuit An information processing method using a semiconductor memory device having an input / output interface circuit for outputting data to the outside,
When a read control signal is input from the outside, it is determined whether a cancel code for canceling the encryption process for the data is input from the outside,
When no release code is input from the outside, the data received from the input / output control circuit is encrypted and output, and only when the release code matching the authentication code is input from the external device, from the input / output control circuit An information processing method that outputs received data without encryption. The information processing method according to claim 7,
An information processing method for encrypting and outputting data received from the input / output control circuit when the read control signal is input when returning from a standby state or when power supply is started. The information processing method according to claim 7 or 8,
An information processing method for causing the input / output control circuit to erase data stored in the memory cell array when a release code input from outside does not match the authentication code.

Images