JP2013003731A - Information processor, electronic circuit device, and data erasing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an electronic circuit device for enabling a user to perform analysis sufficiently as necessity arises while securing high security with respect to reverse engineering by IC opening by a third party.SOLUTION: The electronic circuit device includes: main storage means for storing data; first detecting means for detecting a change of clock frequencies; first count means for counting detected changes; first storage means for storing prescribed value set from outside; and output means for outputting an erasure signal for instructing erasure of data of the main storage means on the basis of the value counted by the first count means and value stored in the first storage means. Since changes occurring when the IC package is opened are detected from a change of clock frequencies, and reference value with respect to data erasure is set by a user, the user can select data erasure timing on the basis of a purpose of use.

Description

  The present invention relates to an information processing device, an electronic circuit device included in the device, and a data erasing method using the electronic circuit device, and in particular, a data erasing method that realizes high security and an electronic device used to implement the method. The present invention relates to a circuit device and an information processing device.

  For an application that requires high security, in order to maintain the high security, the information processing apparatus itself (for example, a microcomputer) that executes the application is also required to have higher security.

  The security function of the information processing apparatus itself includes, for example, a function for erasing data in the flash memory when security ID authentication fails and a function for setting a security command in on-chip debugging.

  However, it is assumed that the data in the built-in flash ROM is read by a third party performing reverse engineering by opening the IC. Considering such a method, it cannot be said that the above-described security function ensures sufficient security. Therefore, even for reverse engineering by opening the IC, a security function is required that can prevent a situation in which the data in the flash ROM is illegally read by a third party and the secret data is misused.

  Therefore, as a technique for preventing the secret data stored in the protection memory of the integrated circuit chip for the electronic data processing system from being analyzed by reverse engineering, the technique described in Patent Document 1 is disclosed.

  An integrated circuit chip described in Patent Document 1 includes a volatile memory that stores secret data, an opaque layer of material that encapsulates the chip, and a protection circuit that is encapsulated by the encapsulation material and coupled to the volatile memory And a protection circuit for detecting a change in current that occurs when the light-sensitive element is exposed to light, and a light-sensitive element having a current characteristic that changes when the light-sensitive element is exposed to light. The detecting means and switching means for cutting off the power supply to the volatile memory when a change in current is detected by the detecting means.

  According to this configuration, when the encapsulating material is removed from the chip, the coupling between the volatile memory and the power source is released, and the secret data in the volatile memory is erased. Accordingly, it is possible to realize a high security function against reverse engineering by opening a third party's IC.

Japanese Patent Laid-Open No. 4-258882

  When a defect occurs in the product, the user needs to unseal the IC and to investigate and verify the operation of the circuit inside the IC in detail in order to identify the cause of the defect. At that time, investigation / verification related to information stored in the memory is also performed.

  However, when the technique described in Patent Document 1 is introduced, the user can open the IC and perform the cause of the malfunction in an environment where there is no light irradiation so that the information in the memory is not erased. Various investigations and verifications for identification must be conducted.

  That is, even when the user analyzes his / her own product, severe conditions are imposed on the analysis environment, which not only significantly reduces the efficiency of the analysis work but also does not allow sufficient analysis. It was happening.

  An electronic circuit device according to the present invention includes a main storage unit that stores data, a first detection unit that detects a change in clock frequency, a first counting unit that counts the detected change, and a predetermined externally set value. Instructing to erase the data in the main storage unit based on the first storage unit that stores the value of the first storage unit, the value counted by the first counting unit and the value stored in the first storage unit An output unit for outputting an erasing signal.

  With the above-described configuration, it is possible to provide an environment in which an analysis operation can be appropriately performed with respect to IC opening from the user while maintaining high security against IC opening from a third party.

  The information processing apparatus according to the present invention includes a main storage unit that stores data, a processing unit that performs arithmetic processing, a first oscillation unit that outputs a first clock signal having a first frequency, and a second frequency. A second oscillation unit that outputs a second clock signal, a detection unit that detects a change in frequency of the first clock signal based on the first clock signal and the second clock signal, and the detected change An output for outputting an erasure signal based on a value counted by the counting unit and a value stored in the storage unit And an erasure unit for erasing data stored in the main storage unit based on the erasure signal.

  With the above-described configuration, it is possible to provide an environment in which an analysis operation can be appropriately performed with respect to IC opening from the user while maintaining high security against IC opening from a third party.

  The data erasing method of the present invention includes a storage step of storing a predetermined value set from the outside in a storage unit, a detection step of detecting a change in clock frequency, and a counting step of counting the detected change. And an output step for outputting an erase signal based on the value counted in the counting step and the value stored in the storage step, and an erase step for erasing data based on the erase signal.

  By erasing data by the above method, it is possible to maintain a high security against opening an IC from a third party while ensuring an environment in which an analysis operation can be appropriately performed for an IC opening from the user himself / herself. It becomes possible.

  According to the present invention, it is possible to provide an apparatus and a method by which a user himself can appropriately perform an analysis work as necessary while realizing a high security function against third party reverse engineering.

It is a block diagram which shows the structural example of the information processing apparatus which concerns on Embodiment 1 of this invention. It is a flowchart which shows operation | movement of the information processing apparatus which concerns on Embodiment 1 of this invention. It is a timing chart which shows operation | movement of the information processing apparatus which concerns on Embodiment 1 of this invention. It is a block diagram which shows the structural example of the electronic circuit apparatus which concerns on Embodiment 2 of this invention. It is a block diagram which shows the structural example of the electronic circuit apparatus which concerns on Embodiment 3 of this invention. It is a flowchart which shows operation | movement of the information processing apparatus which concerns on Embodiment 3 of this invention. It is a block diagram which shows the structural example of another form of the electronic circuit apparatus which concerns on Embodiment 3 of this invention. It is a block diagram which shows the structural example of the timer for time measurement contained in the electronic circuit apparatus which concerns on Embodiment 4 of this invention.

(Embodiment 1)
Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a block diagram of an information processing apparatus (microcomputer 100) according to Embodiment 1 of the present invention.

  The microcomputer 100 mainly includes a built-in oscillation clock change detector 101, a built-in oscillator 140, a sub built-in oscillator 150, a CPU core 160, a flash memory 170, an internal bus 180, and peripheral hardware 190.

  The built-in oscillator 140 generates a reference clock and supplies the CPU clock to the CPU core 160, the peripheral hardware clock to the peripheral hardware 190 such as a memory controller, and the built-in oscillation clock to the built-in oscillation clock change detector 101. 1 oscillator.

  The sub built-in oscillator 150 supplies a base clock, which is a clock signal having a frequency different from that of the built-in oscillation clock, to the built-in oscillation clock change detector 101.

  The CPU core 160 is a processing unit that performs arithmetic processing according to a program.

  The flash memory 170 is a main memory of the microcomputer 100, and is a main storage unit that temporarily stores programs and data.

  The internal bus 180 is a path connecting each block inside the microcomputer. The user can access a change number expected value register, which will be described later, through the internal bus 180 and store a predetermined value.

  The peripheral hardware 190 is, for example, a memory controller or an interrupt controller, and operates according to the peripheral hardware clock output from the built-in oscillator 140.

  The built-in oscillation clock change detector 101 is an electronic circuit device that further includes a clock mismatch detection unit 110 and an expected change number comparison unit 120.

  The clock mismatch detection unit 110 is a detection unit that detects a change in the internal oscillation clock that occurs when the IC is opened. The expected change count comparison unit 120 erases based on the value counted by the change count counter 121 that counts the change detected by the clock mismatch detection unit 110 and the value stored in the expected change count value register 122. It is an output part which outputs a signal. Hereinafter, each part will be described in detail.

  The clock mismatch detection unit 110 includes a built-in oscillation clock high / low width counter 111, a high / low width expected value register 112, and a second comparator 113.

  The internal oscillation clock high / low width counter 111 counts the high / low level period of the internal oscillation clock output from the internal oscillator 140. Specifically, the high / low level period of the internal oscillation clock output from the internal oscillator 140 as the first oscillator is counted using the base clock output from the sub internal oscillator 150 as the second oscillator. .

  The high / low width expected value register 112 stores the expected value of the high / low level period counted by the internal oscillation clock high / low width counter 111.

  The second comparator 113 constantly compares the value counted by the built-in oscillation clock high / low width counter 111 with the value stored in the high / low width expected value register 112. When these two values do not match as a result of the comparison, the second comparator 113 outputs a mismatch signal to the change counter 121 described later. The mismatch signal is a signal indicating that a change has occurred in the clock frequency. For example, when a value “7” is set as an expected value in the high / low width expected value register 112 and the count value of the internal oscillation clock high / low width counter 111 is “5”, Since the two values do not match, a mismatch signal is output assuming that the clock frequency has changed. Based on the mismatch signal, the change counter 121 is incremented. The value counted by the built-in oscillation clock high / low width counter 111 is cleared every time the comparison process is performed in the second comparator 113.

  Here, the high / low width expected value register 112 is configured to be accessible via the internal bus 180, and the user can arbitrarily set the expected value. It is preferable to give a certain margin to the expected value to be set in consideration of fluctuations in the internal oscillation clock due to temperature dependence within the guaranteed operating temperature range of the microcomputer 100. By setting in this way, it is possible to distinguish between clock fluctuations depending on stress changes caused by opening the IC and clock fluctuations due to temperature dependence. For example, if an error of about ± 1 occurs in the value counted by the internal oscillation clock high / low width counter 111 due to fluctuations in the internal oscillation clock caused by temperature dependence within the guaranteed operating temperature range, high / low width expectation is expected. It is advisable to set a value within a certain range in consideration of the error in the value counter. If three values “6”, “7”, and “8” are set in the high / low width expected value register 112, a mismatch signal is not output even if the internal oscillation clock fluctuation due to temperature dependence occurs.

  The expected change count comparison unit 120 includes a change count counter 121, a change count expected value register 122, and a first comparator 123.

  The number-of-changes counter 121 receives the above-described mismatch signal and increments and stores the counter value based on the mismatch signal.

  The change count expected value register 122 stores a predetermined value. The change count expected value register 122 is accessible via the internal bus 18, and the user can arbitrarily set a value to be stored. The predetermined value stored in the expected number-of-changes register 122 is a reference value used as a reference for comparison in the comparison process performed by the first comparator 123, and can be set from the outside according to the purpose of use. Yes.

  The first comparator 123 compares the value counted by the change count counter 121 with the value stored in the change count expected value register 122. The first comparator 123 generates and outputs a coincidence signal when the value counted by the change count counter 121 matches the value stored in the expected change count register 122 as a result of the comparison. The coincidence signal is an erase signal that serves as a trigger for erasing data in the flash memory 170. By outputting the coincidence signal, an erasing unit (not shown) erases data in the flash memory. As an erasing method in the erasing unit, erasing may be performed by providing a switch unit that cuts off power to the flash memory based on the coincidence signal, or an erasing command that executes a self-programming flash erasing command based on the coincidence signal You may delete by providing an execution part.

  Next, the operation of the microcomputer 100 described in FIG. 1 will be described. FIG. 2 is a flowchart regarding the operation of the microcomputer 100.

  First, the second comparator 113 sets the expected high / low width value of the high / low width expected value register 112 arbitrarily set by the user and the count value of the current internal oscillation clock high / low width counter 111, that is, the internal The value obtained by counting the high / low level period of the oscillation clock is compared (step S101).

  The second comparator 113 outputs a mismatch signal when the two values do not match as a result of the comparison in step S101. When the mismatch signal is input, the change number counter 121 increments the counter value once and stores the count value (step S102).

  The first comparator 123 compares the count value of the change count counter 121 incremented in step S102 with the value stored in the expected change count register 122 arbitrarily set by the user (step S103). The first comparator 123 outputs a coincidence signal when these two values coincide as a result of the comparison. On the other hand, if these two values do not match, the processes of S101 to S103 are repeated again.

  A self-erase command is executed based on the coincidence signal, and data in the flash memory is erased (step S104).

  Next, a method of counting the high / low width of the internal oscillation clock in the fluctuation detection of the internal oscillation clock performed by the clock mismatch detection unit 110 will be described with reference to the timing chart of FIG.

  CLK indicates a built-in oscillation clock output from the built-in oscillator 140, HCLK indicates a high width, and LCLK indicates a low width. BCLK indicates a base clock output from the sub built-in oscillator 150. In addition, here, the internal oscillation clock high / low width counter and the mismatch signal of FIG. 1 are individually described with respect to high and low, such as a high width counter, a low width counter, a high width mismatch signal, and a low width mismatch signal. Yes.

  In this example, both the high width and the low width of CLK are counted with respect to BCLK, so the count values of the high width counter and the low width counter are both “5”. On the other hand, since the value “7” is stored in the high / low width expected value register, the high width comparator and the low width comparator included in the second comparator 113 are not matched with the high width mismatch signal. Each signal is generated and output to the change counter. Since the value “M” is stored in the change count expected value register in advance, when the value of the change count counter reaches M, a coincidence signal serving as a trigger for starting the self programming erase command is output.

  Note that the clock mismatch detection unit 110 is not limited to a configuration that individually counts both the high width and the low width of the internal oscillation clock. The clock mismatch detection unit 110 may generate one mismatch signal by counting either one, or generate one mismatch signal by counting using BCLK in units of one cycle of a high / low pair. It may be configured to do so.

  Note that if the internal oscillation clock and the base clock undergo similar clock fluctuations due to applied stress or light irradiation, the internal oscillation clock always counts the same value, and the internal oscillation clock It is impossible to detect the fluctuation of Therefore, the sub built-in oscillator 150 that outputs the base clock (BCLK) has a different configuration from the built-in oscillator 140 that outputs the main built-in oscillation clock (CLK) in terms of the arrangement of capacitors, resistors, and the like. Give it. With this configuration, the base clock also fluctuates due to stress changes due to IC opening and light irradiation. However, since the frequency fluctuation characteristics are different from the internal oscillation clock, it is possible to detect fluctuations in the internal oscillation clock. Become.

  As described above, the information processing apparatus according to the first embodiment includes a flash memory that is a main storage unit that stores data, a CPU core that is a processing unit that performs arithmetic processing, and a first clock having a first frequency. In addition to the basic configuration of the information processing apparatus such as a built-in oscillator that is a first oscillation unit that outputs a signal, it has the following components. A second oscillation unit that outputs a second clock signal having a second frequency; and a detection unit that detects a change in the frequency of the first clock signal based on the first clock signal and the second clock signal. Based on a counting unit that counts the detected change, a storage unit that stores a predetermined value set from the outside, a value counted by the counting unit, and a value stored in the storage unit An output unit that outputs an erase signal, and an erase unit that erases data stored in the main storage unit based on the erase signal are provided.

  Further, the electronic circuit device included in the information processing apparatus according to the first embodiment counts the detected change, a main storage unit that stores data, a first detection unit that detects a change in clock frequency, and the detected change. Based on a first counting unit, a first storage unit that stores a predetermined value set from the outside, a value counted by the first counting unit, and a value stored in the first storage unit And an output unit that outputs an erasure signal instructing erasure of data in the main storage unit.

  With such a configuration, a stress or an external light irradiation that is inevitably generated when the IC package is opened is captured by a change in the clock frequency, and the change amount and a value stored in advance by the user are set to a predetermined condition. When this is satisfied, an erasure signal is output. Therefore, when performing analysis by the user himself / herself while maintaining high security against reverse engineering, a value to be stored can be set so as not to output an erasure signal.

  For example, when it is desired to erase the data stored in the main storage unit instantaneously when the IC is opened by a third party, the value stored in the first storage unit is set to “1”. By setting in this way, when a clock fluctuation due to a stress change due to IC opening is detected, the data stored in the main memory is immediately erased. On the other hand, when the IC package needs to be opened by a valid analysis operation by the user, the value stored in the first storage unit is very large in order to avoid erasing data at the moment of opening. Set to value. In this way, by adopting a configuration in which the user can change the value of the first storage unit as necessary, the data erasing timing can be changed according to the user's usage.

  The output unit includes a first comparison unit that compares a value counted by the first counting unit with a value stored in the first storage unit, and the first comparison unit is a result of the comparison. The erasing signal may be output when the value counted by the first counting unit matches the value stored in the first storage unit. With this configuration, the invention can be realized with a relatively simple electronic circuit.

  The first counting unit may be configured to count the number of changes detected by the detecting unit. By adopting a configuration that counts the number of changes in the detected clock frequency, the invention can be realized with a relatively simple electronic circuit.

  In addition, the detection unit counts a high width or a low width of a clock signal having a first frequency using a clock signal having a second frequency, and stores a second expected value. A storage unit, and a second comparison unit that compares the value counted by the second counting unit with the value stored in the second storage unit, wherein the second comparison unit is a result of the comparison, When the value counted by the second counting unit and the value stored in the second storage unit do not match, a signal indicating that the clock frequency has changed is output to the first counting unit. be able to. By using two clock signals having different frequencies as described above, it is easy to detect fluctuations in the clock frequency.

  In addition, the first oscillation unit and the second oscillation unit of the information processing apparatus may each have different frequency variation characteristics when light is irradiated from the outside, and the stress applied from outside On the other hand, different frequency fluctuation characteristics may be shown. As described above, since the first oscillation unit and the second oscillation unit have different oscillation characteristics under a predetermined condition, the frequency fluctuation can be easily detected. Such a difference in frequency variation characteristics can be realized by providing a difference in the arrangement and combination of resistors, capacitors, light sensing elements, and the like in the first oscillation unit and the second oscillation unit.

  In addition, the data erasing method according to the first embodiment includes a storage step of storing a predetermined value set from the outside in the storage unit, a detection step of detecting a change in the clock frequency, and counting the detected change. A counting step, an output step for outputting an erasing signal based on the value counted in the counting step and a value stored in the storing step, and data stored in the main storage unit based on the erasing signal And an erasing step for erasing. By adopting a configuration in which data is erased according to such a procedure, the data erasure timing can be changed according to the purpose of use.

  In the above description, the change count counter 121 is configured to count the number of changes in the clock frequency. However, the present invention is not limited to this, and may be counted including the amount of change in the clock frequency. For example, when the value recorded in the high / low width expected value register 112 is “9” and the count value of the internal oscillation clock high / low width counter 110 is “5”, the second comparator 113 The information corresponding to “4”, which is the difference between these values, may be included in the mismatch signal, output to the change counter 121, and incremented four times by the change counter 121.

  In the above description, the case where the coincidence signal is transmitted when the expected value stored in the expected change number register 122 and the count value of the change counter 121 is the same has been described. However, the present invention is not limited to this. . For example, a configuration may be adopted in which a match signal is output when the value of the change count counter 121 exceeds the expected value stored in the change count expected value register 122.

(Embodiment 2)
The invention according to the second embodiment is characterized in that a change in the clock frequency is detected by comparing the clock frequency in time series, thereby preventing reverse engineering by a third party.

  FIG. 4 is a block diagram of a built-in oscillation clock change detector 201 which is an electronic circuit device according to the second embodiment. Note that some of the same blocks as those described in Embodiment 1 are not described here.

  The clock mismatch detection unit 210 according to the second embodiment includes a built-in oscillation clock high / low width counter 111, a timer 211, a high / low width capture register 212, a built-in oscillation clock high / low width current value register 213, and a built-in oscillation clock. A high / low width hold value register 214 and a second comparator 215 are included.

  The timer 211 generates a capture trigger signal for every elapse of a preset time and outputs it to the high / low width capture register 212 and the internal oscillation clock high / low width current value register 213.

  The high / low width capture register 212 uses the capture trigger signal input from the timer as a trigger to capture the count value of the internal oscillation clock high / low width counter 111, and the captured count value is stored in the internal oscillation clock high / low width current value register. To 213.

  The internal oscillation clock high / low width current value register 213 stores the count value output from the high / low width capture register. Also, using the capture trigger signal input from the timer 211 as a trigger, the currently stored count value is output to the internal oscillation clock high / low width hold value register 214 and newly output from the high / low width capture register 212. Store the count value.

  The internal oscillation clock high / low width holding value register 214 stores the count value output from the internal oscillation clock high / low width current value register 213.

  The second comparator 215 compares the values stored in the internal oscillation clock high / low width holding value register 214 and the internal oscillation clock high / low width current value register 213, respectively. For the comparison timing, for example, the comparison is performed every predetermined time measured by the timer 211. If these two values are different as a result of the comparison, a mismatch signal is generated and output to the change counter 121. Since the subsequent operation is the same as that of the first embodiment, description thereof is omitted.

  According to the above configuration, the count values at different times set for the predetermined time set in the timer can be compared. Therefore, when different count values are generated as a result of time series comparison, a mismatch signal is generated, and the change counter 122 The value of is incremented. Then, an erase signal is output based on the value of the change count counter 122 and the value stored in the expected change count register 122, and the data in the flash memory can be erased.

  That is, the electronic circuit device according to the second embodiment stores a detection unit that detects a change in the clock frequency, a first counting unit that counts the detected change, and a predetermined value set from the outside. A first storage unit; and an output unit that outputs an erasure signal based on the value counted by the first counting unit and the value stored in the first storage unit. A second counting unit that counts a high width or a low width of a clock signal having a frequency of 1 using a clock signal having a second frequency, a time measuring unit that measures a predetermined time, and the second counting unit. The second storage unit that stores the counted value, the value stored in the second storage unit, and the value counted by the second counting unit after a predetermined time measured by the time measuring unit are compared. And a second comparison unit, wherein the second comparison unit is As a result of the comparison, the clock frequency has changed when the value stored in the second storage unit and the value counted by the second counting unit do not match after the lapse of a predetermined time measured by the time measuring unit A signal indicating this is output to the first counter.

  The data erasing method according to the second embodiment includes a storage step of storing a predetermined value set from the outside in the storage unit, a first counting step of counting the high width or low width of the clock signal, A time measurement step for starting the time measurement, a second count step for counting the high width or the low width of the clock signal after the predetermined time measured in the time measurement step, the first count step, and the second count A comparison step for comparing the values counted in the counting step, a third counting step for counting the number of times that the value counted in the first counting step and the value counted in the second step are not the same, and the storage An output step for outputting an erasure signal based on the value stored in the step and the value counted in the third counting step, and an erasure for erasing data based on the erasure signal. Has a step, a.

  When reverse engineering is performed by opening the IC, external light is applied to the electronic circuit device, which causes a change in the internal oscillation clock. Accordingly, the value counted by the built-in oscillation clock high / low width counter changes before and after opening. Since the electronic circuit device according to the second embodiment can detect a clock change by comparing count values obtained at different times, the IC can be opened without applying stress to the device. In addition, it is possible to detect that the IC has been opened based on the amount of change in the light applied to the device before and after opening, and to erase the data appropriately. When the user himself opens for analysis, if a large value is set in the change count expected value register, an erase signal is immediately output from the first comparator 123 even if the IC is opened. Therefore, the analysis work can be performed appropriately.

  As in the case of the first embodiment, the second comparator 215 considers the temperature dependence within the guaranteed operating temperature range, and the internal oscillation clock high / low width holding value register 214 and the internal oscillation clock high / low width. A configuration may be adopted in which a mismatch signal is generated when the values stored in the current value register 215 are different from each other by a predetermined error or more.

(Embodiment 3)
The electronic circuit device according to the third embodiment includes the first clock mismatch detection unit that detects a change in the built-in oscillation clock due to the stress described in the first embodiment, and the built-in oscillation clock described in the second embodiment. The second clock mismatch detection unit for detecting a series change is combined. This will be described below with reference to the drawings.

  FIG. 5 is a block diagram of the built-in oscillation clock change detector 301 according to the third embodiment. Note that some of the same blocks as those described in the first and second embodiments are not described.

  The built-in oscillation clock change detector 301 of the third embodiment is roughly composed of a first clock mismatch detection unit 310, an expected change count comparison unit 320, and a second clock mismatch detection unit 330.

  The first clock mismatch detection unit 310 is a first detection unit that detects a first fluctuation of the built-in oscillation clock caused by a change in stress when the IC is opened. When the first fluctuation is detected, the second clock mismatch detection unit 330 detects a change in the internal oscillation clock generated by irradiation of light after opening the IC after the first fluctuation in a time series. It is a detection unit. The expected change number comparison unit 320 counts fluctuations detected by the first clock mismatch detection unit 310 and the second clock mismatch detection unit 330. The output unit outputs an erasure signal when the counted value matches a preset value. Hereinafter, each block will be described in detail.

  The clock mismatch detection unit 310 includes a built-in oscillation clock high / low width counter 111, a high / low width expected value register 112, a second comparator 113, and a high / low width capture register 312.

  The internal oscillation clock high / low width counter 111 counts the high / low level period of the internal oscillation clock output from the internal oscillator using the base clock output from the sub internal oscillator.

  The high / low width expected value register 112 stores the expected value of the high / low level period counted by the internal oscillation clock high / low width counter 111. The built-in oscillation clock high / low width expected value register 112 is configured to be accessible from the outside via the internal bus 180, and the user can arbitrarily set the expected value.

  The second comparator 113 constantly compares the value counted by the built-in oscillation clock high / low width counter 111 with the value stored in the high / low width expected value register 112. If these two values do not match as a result of the comparison, the second comparator 113 outputs a first mismatch signal to a high / low width capture register 312, a timer 331, and a change counter 321 described later.

  The high / low width capture register 312 uses the count value of the built-in oscillation clock high / low width counter 111 as a trigger triggered by the first mismatch signal output from the second comparator 113 or the capture trigger signal output from the timer 331 described later. To capture. The count value captured based on the first mismatch signal is stored in a later-described built-in oscillation clock high / low width holding value register 334, and the value captured based on the capture trigger signal is stored in a later-described built-in oscillation clock high / low width. Each is output to the current value register 333.

  The second clock mismatch detection unit 330 includes a timer 331, a built-in oscillation clock high / low width current value register 333, a built-in oscillation clock high / low width hold value register 334, and a third comparator 335. .

  The timer 331 starts time measurement using the first mismatch signal output from the second comparator 113 as a trigger, generates a capture trigger signal after a preset time, and outputs it to the high / low width capture register 312. To do.

  The internal oscillation clock high / low width hold value register 334 receives and stores the value captured by the high / low width capture register 312 using the first mismatch signal as a trigger. That is, the high / low width capture register 312 takes the count value from the internal oscillation clock high / low width counter 111 using the first mismatch signal as a trigger, and the count value fetched into the internal oscillation clock high / low width hold value register 334. Output.

  The internal oscillation clock high / low width current value register 333 receives and stores the value captured by the high / low width capture register 312 using the capture trigger signal as a trigger. That is, the high / low width capture register 312 receives the count value from the internal oscillation clock high / low width counter 111 using the capture trigger signal as a trigger, and outputs the count value acquired to the internal oscillation clock high / low width current value register 333. To do.

  The third comparator 335 compares the value stored in the internal oscillation clock high / low width holding value register 334 with the value stored in the internal oscillation clock high / low width current value register 333. If these two values do not match as a result of the comparison, the third comparator 335 outputs a second mismatch signal. The second mismatch signal output from the third comparator 335 is input to the change counter 321.

  The expected change count comparison unit 320 includes a change count counter 321, an expected change count register 122, and a first comparator 123.

  The change count counter 321 receives the first mismatch signal and the second mismatch signal described above, and increments and stores the value of the counter each time these signals are input.

  The expected change value register 122 stores a predetermined value set from the outside. The expected change number register 122 is accessible via the internal bus 180, and the user can arbitrarily set a value to be stored.

  The first comparator 123 compares the value stored in the change count expected value register 122 with the value stored in the change count counter 321. If the value stored in the change counter 123 matches the value stored in the expected change count register 122 as a result of the comparison, the first comparator 123 generates and outputs a match signal.

  Next, the operation of the built-in oscillation clock change detector 301 according to this embodiment will be described with reference to the flowchart of FIG. Steps S101 to S103 are the same as steps S101 to S103 in the flowchart shown in FIG.

  If the value stored in the change count counter 321 and the value stored in the expected change count register 122 are different in S103, the high / low width hold value register 334 captures the high / low width capture register 312. The count value of the built-in oscillation clock high / low width counter 111 is stored (step S104).

  Next, the high / low width current value register 333 stores the count value of the built-in oscillation clock high / low width counter 111 captured by the high / low width capture register 312 after a predetermined time created by the timer 331 has elapsed (step S31). S105).

  Next, the third comparator 335 compares the past count value stored in the high / low width holding value register 334 with the current count value stored in the high / low width current value register 333 ( Step S106).

  As a result of the comparison, if the two count values match, the process returns to the previous stage of step S101 and waits. On the other hand, if the two count values do not match as a result of the comparison, the third comparator generates a mismatch signal and outputs the mismatch signal to the change counter 321 so that the value of the change counter 321 is incremented by one ( Step S107).

  Next, the first comparator 123 compares the value of the change count counter 321 with the value of the expected change count register 122. If these values are the same, a coincidence signal is generated and output. If not, the process returns to the previous stage of step S104 (step S108).

  The self-programming erase command is activated by the coincidence signal as a trigger, and the data in the built-in flash ROM are erased all at once (step S109).

  According to the above configuration, it is possible to determine whether or not to erase the data in the flash memory using both the clock fluctuation that occurs when stress is applied and the clock fluctuation that appears in time series.

  In the above description, the first clock mismatch detection unit and the second clock mismatch detection unit are arranged in series. However, the present invention is not limited to this, and the first and second clock mismatch detection units are arranged in parallel. The structure to arrange | position may be sufficient. FIG. 7 shows a block configuration of a built-in oscillation clock change detector 401 of another variation form.

  The built-in oscillation clock change detector 401 includes two detection means of a first clock mismatch detection unit 410 and a second clock detection unit 430 and two comparisons of a first expected change number comparison unit 420 and a second expected change number comparison unit 440. Means. Since the function of each internal block has been described above, a part of the description is omitted.

  The first expected change number comparison unit 420 receives the first mismatch signal output from the first clock mismatch detection unit 410, and the first expected change number comparison unit 420 receives the first mismatch signal when the value of the change number expected value register 422 matches the value of the change number counter 421. 1 coincidence signal is output. The second expected change count comparison unit 440 also receives the second mismatch signal output from the second clock mismatch detection unit 430, and the value of the change count expected value register 442 matches the value of the change count counter 441. To output a second coincidence signal.

  The erase command execution unit 450 inputs the first coincidence signal and the second coincidence signal, and when the two coincidence signals are inputted, executes the erase command to erase the data in the flash memory. Note that the input timing of the two coincidence signals does not have to be the same.

  As described above, the electronic circuit device according to the third embodiment is measured by the first detection unit that detects a change in the clock frequency, the time measurement unit that measures a predetermined time, and the time measurement unit. A second detector for detecting a change in the clock frequency at a time different by a predetermined time; a first counter for counting a change in the clock frequency detected by the first detector and the second detector; A first storage unit that stores a predetermined value set from the outside, and an output unit that outputs an erasure signal based on the value counted by the first counting unit and the value stored in the first storage unit And.

  The first detector stores a second expected unit that counts a high width or a low width of a clock signal having a first frequency using a clock signal having a second frequency, and stores a predetermined expected value. A second storage unit, and a second comparison unit that compares the value counted by the second counting unit with the value stored in the second storage unit, wherein the second comparison unit As a result, when the value counted by the second counting unit does not match the value stored in the second storage unit, a first mismatch signal indicating that the clock frequency has changed is sent to the first counting unit. It can be set as the structure which outputs.

  The second detection unit includes a third storage unit that stores a value counted by the second counting unit, a value stored in the third storage unit, and a predetermined time measured by the time measurement unit. A third comparison unit that compares the value counted by the second counting unit after elapses, and the third comparison unit compares the value stored in the third storage unit and the time measurement as a result of the comparison A second mismatch signal indicating that the clock frequency has changed when the value counted by the second counting unit does not match after a predetermined time measured by the unit is output to the first counting unit; can do.

  Further, the time measuring unit may be configured to start measuring the predetermined time by inputting the first mismatch signal.

  In addition, a fourth storage unit that stores a predetermined value is further provided, and the first counting unit is detected by the first change counting unit that counts the change detected by the first detection unit and the second detection unit. A second change counting unit that counts the change that has been made, and the output unit is configured to output the first change based on a value counted by the first change counting unit and a value stored in the first storage unit. A first output unit that outputs one erase signal, a second output that outputs a second erase signal based on the value counted by the second change counting unit and the value stored in the fourth storage unit And an output unit.

  When the first erasure signal and the second erasure signal are output, that is, when a change in the clock frequency is detected by the two detection units, a separate erasure unit is stored in the main storage unit. It may be configured to erase existing data.

(Embodiment 4)
The present embodiment is characterized in that the measurement time of the timer included in the electronic circuit device according to the third embodiment can be changed.

  FIG. 8 is a block diagram of timer 530 included in the built-in oscillation clock change detector according to the fourth embodiment.

  The timer 530 is a time measuring unit that measures a predetermined time, and corresponds to the timer 211 in FIG. 4 and the timer 431 in FIG. The timer 530 includes a compare register 531, a selector 532, an AND circuit 533, a frequency change count timer counter 534, and a comparator 535.

  The compare register 531 stores a reference value for time measurement.

  The selector 532 selects one signal from base clock signals having a plurality of frequencies that have been divided. The user can access the selector 532 and can set which frequency to select the base clock signal.

  The AND circuit 533 inputs the mismatch signal output from the timer 530 and the signal output from the selector 432, performs a logical product, and outputs a signal.

  The frequency change count timer counter 534 counts the frequency change of the signal output from the AND circuit 533.

  The comparator 535 compares the count value counted by the frequency change count timer counter 534 with the reference value stored in the compare register 531. As a result of the comparison, when the count value matches the reference value, a capture trigger signal is output.

  According to the above configuration, one clock signal can be selected from the clock signals having different frequencies by the selector 536 according to the setting from the user, and the output signal can be counted by taking the logical product with the mismatch signal. The time to be measured at 530 can be set.

  Note that the method for setting the time measured by the timer is not limited to the above method, and for example, the user can access the compare register through the internal bus. That is, the selector 536 is removed, the logical product output of the clock signal having a predetermined frequency and the mismatch signal is counted by the frequency change count timer counter, and is counted by the reference value set by the user in the compare register and the frequency change count timer counter. You may comprise so that it may compare with the counted value.

  As described above, according to the embodiments, according to the present invention, the user can arbitrarily select the erasing timing of the flash memory. Therefore, the security level can be set according to the usage purpose of the user. Therefore, it is possible to perform sufficient analysis by the user while maintaining high security against reverse engineering by a third party.

  The change count register and the high / low width expected value register can set values to be stored by a separately provided setting unit. That is, the setting unit may be configured to set a predetermined value stored in the change count register or the high / low width expected value register based on an instruction from the user.

  Further, in order to access the change count register and the expected high / low width value register, it can be configured to be accessible when a predetermined authentication or procedure is performed. In this case, a configuration may be adopted in which a separate access management unit is provided, and the access management unit performs a determination process for determining whether the register is accessed based on a predetermined authentication process or setting procedure. . After confirming that the access management unit is a register access request from an appropriate user, the user accesses the change count register or the high / low width expectation value register, and sets the reference value stored in these registers. The structure which can be changed may be sufficient.

  In the above description, the configuration for erasing the data in the flash memory, which is the main storage unit, based on the erasure signal is shown. However, the present invention is not limited to this, and the configuration for erasing secret data stored in another storage means It may be.

  In addition, the present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit of the present invention.

DESCRIPTION OF SYMBOLS 100: Microcomputer 101: Built-in oscillation clock change detector 110: Clock mismatch detection part 111: Built-in oscillation clock high / low width counter 112: High / low width expected value register 113: Second comparator 120: Expected change frequency comparison part 121: Change count counter 122: Change count expected value register 123: First comparator 140: Built-in transmitter 150: Sub built-in transmitter 160: CPU core 170: Flash memory 180: Internal bus 190: Peripheral hardware 201: Built-in oscillation Clock change detector 210: Clock mismatch detection unit 211: Timer 212: High / low width capture register 213: Internal oscillation clock high / low width current value register 214: Internal oscillation clock high / low width hold value register 215: Second comparison 301: Internal oscillation black Change detector 310: first clock mismatch detection unit 312: high / low width capture register 320: expected change count comparison unit 321: change count counter 330: second clock mismatch detection unit 331: timer 333: internal oscillation clock high / Low width current value register 334: Internal oscillation clock high / low width hold value register 335: Third comparator 401: Internal oscillation clock change detector 410: First clock mismatch detection unit 420: First expected change number comparison unit 421 Change count counter 422: Change count expected value register 423: First comparator 430: Second clock mismatch detection section 431: Timer 440: Second expected change count comparison section 441: Change count counter 442: Change count expected value register 443: First comparator 450: Erase command generator 501: Internal oscillation clock Click change detector 530: Timer 531: compare register 532: Selector 533: the AND circuit 534: frequency change frequency timer counter 535: a comparator

Claims (15)

Main storage means for storing data;
First detecting means for detecting a change in clock frequency;
First counting means for counting the detected change;
First storage means for storing a predetermined value set from the outside;
Output means for outputting an erasure signal instructing erasure of data in the main storage means based on the value counted by the first counting means and the value stored in the first storage means;
An electronic circuit device comprising: The output means includes first comparison means for comparing the value counted by the first counting means with the value stored in the first storage means,
The first comparing means outputs the erasure signal when the value counted by the first counting means matches the value stored in the first storage means as a result of comparison.
The electronic circuit device according to claim 1. The first counting means counts the number of changes detected by the first detecting means;
The electronic circuit device according to claim 1. The first detection means includes
Second counting means for counting a high width or a low width of a clock signal having a first frequency using a clock signal having a second frequency;
Second storage means for storing a predetermined expected value;
Second comparison means for comparing the value counted by the second counting means with the value stored in the second storage means;
With
The second comparing means outputs a signal indicating that the clock frequency has changed when the value counted by the second counting means and the value stored in the second storing means do not match as a result of comparison. Outputting to the first counting means;
The electronic circuit device according to claim 1. The first detection means includes
Second counting means for counting a high width or a low width of a clock signal having a first frequency using a clock signal having a second frequency;
A time measuring means for measuring a predetermined time;
Second storage means for storing the value counted by the second counting means;
A second comparing means for comparing the value stored in the second storage means with the value counted by the second counting means after a predetermined time measured by the time measuring means;
With
The second comparison means, as a result of comparison, when the value stored in the second storage means and the value counted by the second counting means do not match after a predetermined time measured by the time measurement means A signal indicating that the clock frequency has changed to the first counting means,
The electronic circuit device according to claim 1. A time measuring means for measuring a predetermined time;
Second detection means for detecting a change in clock frequency at a time different by a predetermined time measured by the time measurement means;
Further comprising
The first counting means counts the change in the clock frequency detected by the first detecting means and the second detecting means;
The electronic circuit device according to claim 1. A second storage means for storing a predetermined value set from outside;
The first counting means includes
First change counting means for counting changes detected by the first detecting means;
Second change counting means for counting changes detected by the second detecting means;
With
The output means includes
First output means for outputting a first erase signal based on the value counted by the first change counting means and the value stored in the first storage means;
Second output means for outputting a second erase signal based on the value counted by the second change counting means and the value stored in the second storage means;
Comprising
The electronic circuit device according to claim 6. The first detection means includes
Second counting means for counting a high width or a low width of a clock signal having a first frequency using a clock signal having a second frequency;
Second storage means for storing a predetermined expected value;
Second comparison means for comparing the value counted by the second counting means with the value stored in the second storage means;
With
The second comparison means indicates that the clock frequency has changed when the value counted by the second counting means and the value stored in the second storage means do not match as a result of comparison. Outputting a mismatch signal to the first counting means;
The electronic circuit device according to claim 6. The second detection means includes
Third storage means for storing the value counted by the second counting means;
Third comparison means for comparing the value stored in the third storage means with the value counted by the second counting means after a predetermined time measured by the time measuring means;
With
The third comparing means determines that, as a result of the comparison, the value stored in the third storing means and the value counted by the second counting means after a predetermined time measured by the measuring means do not match. Outputting a second mismatch signal indicating that the clock frequency has changed to the first counting means;
The electronic circuit device according to claim 8. The time measuring means starts measuring the predetermined time by inputting the first mismatch signal.
The electronic circuit device according to claim 9. Main storage means for storing data, processing means for performing arithmetic processing,
First oscillating means for outputting a first clock signal having a first frequency;
Second oscillating means for outputting a second clock signal having a second frequency;
Detecting means for detecting a change in frequency of the first clock signal based on the first clock signal and the second clock signal;
Counting means for counting the detected changes;
Storage means for storing a predetermined value set from outside;
Output means for outputting an erasure signal based on the value counted by the counting means and the value stored in the storage means;
Erasing means for erasing data stored in the main storage means based on the erasing signal;
An information processing apparatus comprising: The first oscillating means and the second oscillating means exhibit different frequency variation characteristics with respect to externally applied stress,
The information processing apparatus according to claim 11. The first oscillating means and the second oscillating means exhibit different frequency variation characteristics when light is irradiated from the outside,
The information processing apparatus according to claim 11. A storage step of storing a predetermined value set from outside in the recording unit;
A first detection step of detecting a change in clock frequency;
A counting step for counting the detected changes;
An output step of outputting an erasure signal based on the value counted in the counting step and the value stored in the storage step;
An erasing step of erasing data stored in the main memory based on the erasing signal;
A method for erasing data. A time measurement step for starting measurement of a predetermined time based on the detection result in the first detection step;
A second detection step of detecting a change in the clock frequency at a time different from the predetermined time measured in the time measurement step;
Further comprising
The counting step counts changes detected in the first detection step and the second detection step;
The data erasing method according to claim 14.

Images