JP2013156760A - Data processor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a data processor having high security.SOLUTION: A data processor 10 includes: a first processor 11; a second processor 12 having a security function; a shared memory 13 including a first memory area accessible by the first processor 11 and a second memory area accessible by the second processor 12; a control information storage section 15 capable of storing a boundary address; and an access control circuit 14 for controlling access to the shared memory 13 from the first processor 11 and the second processor 12 according to the boundary address. When rewriting the boundary address stored in the control information storage section 15, the second processor executes authentication processing.

Description

  The present invention relates to a data processing apparatus, and more particularly to a data processing apparatus capable of sharing a memory among a plurality of processors.

  There is known a data processing apparatus capable of sharing a single shared memory by a plurality of processors.

  Patent Document 1 discloses a technique related to a multiprocessor controller that can achieve both sharing of a program in initialization processing and independence between processors. A multiprocessor controller disclosed in Patent Document 1 includes a plurality of processors, a shared memory, a plurality of boundary registers, a comparator, a memory control unit, a plurality of mask registers, and an interrupt control unit. I have.

  The plurality of processors have a function of executing an initialization program for a specific memory address immediately after power-on. The shared memory is accessed from a plurality of processors. The plurality of boundary registers set addresses for dividing the shared memory into areas for a plurality of processors. The comparator compares the access addresses to the shared memory from the plurality of processors with the contents of the plurality of boundary registers. The memory control unit restricts access from the plurality of processors to the shared memory area based on the result of the comparator. A plurality of mask registers sets mask information for each interrupt factor. The interrupt control unit masks an interrupt to the processor according to the mask information from the mask register.

  In the multiprocessor controller disclosed in Patent Document 1, the independence of the shared memory area between processors is mainly necessary for normal processing, and is necessary for startup processing to execute common processing between processors. There is little nature. Therefore, in the multiprocessor type controller disclosed in Patent Document 1, an initialization program is arranged at an address where the processor first reads after power is turned on, and this initialization program is executed in common between the processors. ing. At this time, for accessing the shared memory, a boundary address is set in the boundary register, and all the processors can access the shared memory without restriction until the boundary address becomes valid.

  Patent Document 2 discloses a technique related to a multiprocessor system that can improve inter-processor communication throughput and execute inter-processor communication based on the priority order of messages to be transmitted and received.

JP 11-338833 A JP 2006-309512 A

  In a data processing apparatus in which a shared memory is shared by a plurality of processors, a program to be executed by each processor is stored in the shared memory. If the processor includes a highly secure processor (secure processor), a highly secure program is stored in the shared memory.

  In the multiprocessor controller disclosed in Patent Document 1, a shared memory area accessible by each processor is set by setting a boundary address in a boundary register. However, if the boundary address set in the boundary register can be easily rewritten, a processor other than the secure processor can access a highly secure program, and the security of the data processing apparatus including the secure processor is lost. There is a problem of being. In particular, this problem becomes significant when a processor other than the secure processor is vulnerable.

  A data processing apparatus according to an aspect of the present invention includes a first processor, a second processor having a security function, a first memory area accessible by the first processor, and a second processor accessible by the second processor. A shared memory having two memory areas, a control information storage unit capable of storing a boundary address that is an address corresponding to a boundary between the first memory area and the second memory area of the shared memory, and the boundary address And an access control circuit for controlling access to the shared memory from the first processor and the second processor in response to the second address when rewriting the boundary address stored in the control information storage unit. The processor performs an authentication process.

  In the data processing apparatus according to one aspect of the present invention, when the boundary address stored in the control information storage unit is rewritten, the second processor, which is a secure processor, performs the authentication process. Therefore, since it is possible to suppress unauthorized rewriting of the boundary address stored in the control information storage unit, it is possible to provide a data processing device with high security.

  According to the present invention, a data processing device with high security can be provided.

1 is a block diagram showing a data processing device according to a first exemplary embodiment; 3 is a diagram for explaining a memory area of a shared memory included in the data processing apparatus according to the first embodiment; FIG. 3 is a flowchart for explaining an operation of an access control circuit included in the data processing apparatus according to the first exemplary embodiment; 6 is a flowchart for explaining boundary address rewriting processing in the data processing apparatus according to the first exemplary embodiment; 6 is a flowchart for explaining boundary address rewriting processing in the data processing apparatus according to the first exemplary embodiment; FIG. 3 is a block diagram showing a data processing apparatus according to a second exemplary embodiment. FIG. 10 is a diagram for explaining a memory area of a shared memory included in the data processing apparatus according to the second embodiment; 10 is a flowchart for explaining an operation of an access control circuit included in the data processing apparatus according to the third embodiment; FIG. 10 is a diagram for explaining a memory area of a shared memory included in a data processing apparatus according to a third embodiment; FIG. 6 is a block diagram illustrating a data processing apparatus according to a fourth embodiment. FIG. 10 is a diagram for explaining a memory area of a shared memory included in a data processing apparatus according to a fourth embodiment; FIG. 9 is a block diagram illustrating a data processing apparatus according to a fifth embodiment. FIG. 10 is a diagram for explaining a memory area of a shared memory included in a data processing apparatus according to a fifth embodiment; It is a figure for demonstrating the usage example of the data processor concerning this invention. It is a figure for demonstrating the usage example of the data processor concerning this invention. It is a figure for demonstrating the usage example of the data processor concerning this invention.

<Embodiment 1>
Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is a block diagram for explaining the data processing apparatus according to the first embodiment of the present invention. As shown in FIG. 1, the data processing apparatus 10 according to the present embodiment includes a first processor 11, a second processor 12, a shared memory 13, an access control circuit 14, a control information storage unit 15, and a bus 16. The first processor 11, the second processor 12, the access control circuit 14, and the control information storage unit 15 are connected to each other via a bus 16. The shared memory 13 is connected to the bus 16 via the access control circuit 14.

  The first processor 11 accesses the first memory area of the shared memory 13 and stores data in the first memory area or reads data (program) stored in the first memory area and executes the program. Can be. The second processor 12 accesses the second memory area of the shared memory 13 and stores data in the second memory area, or reads data (program) stored in the second memory area and executes the program. Can be. For example, the second processor 12 can be configured by a processor (secure processor) having a security function. Here, the secure processor is a processor having attack resistance and tamper resistance.

  The shared memory 13 includes a first memory area accessible by the first processor 11 and a second memory area accessible by the second processor 12. A program to be executed by the first processor 11 is stored in the first memory area. A program executed by the second processor 12 is stored in the second memory area. Here, since the second processor 12 is composed of a secure processor, a program with high security is stored in the second memory area. The shared memory 13 is composed of, for example, the same memory (physically single memory), and the first memory area and the second memory area are divided using boundary addresses. The shared memory 13 can be configured using, for example, a flash memory.

  FIG. 2 is a diagram for explaining a memory area of the shared memory 13 included in the data processing apparatus according to the present embodiment. As shown in FIG. 2, the addresses add_a to add_b of the shared memory 13 are addresses corresponding to the first memory area, and the addresses add_b to add_c are addresses corresponding to the second memory area. Here, the address add_b is a boundary address corresponding to the boundary between the first memory area and the second memory area of the shared memory 13.

  In the shared memory 13 illustrated in FIG. 2, the size relationship between the addresses may be add_a <add_b <add_c, or add_a> add_b> add_c. When the magnitude relationship between the addresses is add_a <add_b <add_c, for example, the boundary address add_b can be the head address of the second memory area. In addition, when the size relationship between the addresses is add_a> add_b> add_c, for example, the boundary address add_b can be the head address of the first memory area.

  The access control circuit 14 controls access to the shared memory 13 from the first processor 11 and the second processor 12 according to the boundary address. That is, the access control circuit 14 can control access to the shared memory 13 from the first processor 11 and the second processor 12 according to the comparison result between the access destination address of the shared memory 13 and the boundary address add_b. it can. Thereby, the access control circuit 14 can logically divide the memory area of the shared memory 13 into the first memory area and the second memory area.

  For example, when an area having an address smaller than the boundary address add_b is a first memory area and an area having an address larger than the boundary address add_b is a second memory area (add_a <add_b <add_c), the access control circuit 14 When the access source to the memory 13 is the first processor 11 and the access destination address is smaller than the boundary address add_b, the first processor 11 is permitted to access the first memory area. Further, the access control circuit 14 has a case where the access source to the shared memory 13 is the second processor 12 and the access destination address is larger than the boundary address add_b (or the access destination address is greater than or equal to the boundary address add_b). ), Allowing the second processor 12 to access the second memory area.

  On the contrary, when the area having an address larger than the boundary address add_b is the first memory area and the area having an address smaller than the boundary address add_b is the second memory area, the access control circuit 14 is the access source to the shared memory 13. Is the first processor 11 and the access destination address is larger than the boundary address add_b (or the access destination address is greater than or equal to the boundary address add_b), the first processor 11 accesses the first memory area. Allow. Further, the access control circuit 14 determines that the second processor 12 accesses the second memory area when the access source to the shared memory 13 is the second processor 12 and the access destination address is smaller than the boundary address add_b. To give permission.

  The control information storage unit 15 stores a boundary address corresponding to the boundary between the first memory area and the second memory area of the shared memory 13. The boundary address can be rewritten at any timing by the first processor 11 or the second processor 12. In this way, the range of the first memory area and the second memory area can be arbitrarily changed by rewriting the boundary address. In the data processing apparatus according to the present embodiment, when the boundary address stored in the control information storage unit 15 is rewritten, the second processor 12 that is a secure processor performs an authentication process.

  The boundary address stored in the control information storage unit 15 is output to the access control circuit 14 via the bus 16. For example, the control information storage unit 15 outputs the boundary address to the access control circuit 14 every time the boundary address is rewritten. Thereby, the access control circuit 14 can hold the latest boundary address.

  Next, the operation of the data processing apparatus according to this embodiment will be described. First, the operation when the first processor 11 and the second processor 12 access the shared memory 13 will be described.

  When the first processor 11 and the second processor 12 access the shared memory 13, the access control circuit 14 controls access to the shared memory 13 from the first processor 11 and the second processor 12 according to the boundary address. FIG. 3 is a flowchart for explaining the operation of the access control circuit 14. In the following, a case will be described as an example where the size relationship of each address is add_a <add_b <add_c.

  When the first processor 11 and the second processor 12 make an access request (write request or read request) to the shared memory 13, the first processor 11 and the second processor 12 transmit access destination address and ID information indicating the access source. . The access control circuit 14 determines a processor (that is, an access source) that accesses the shared memory 13 based on the ID information transmitted by the first processor 11 and the second processor 12 (step S1). When the processor accessing the shared memory 13 is the first processor 11 (step S2: Yes), the access destination address accessed by the first processor 11 is compared with the boundary address add_b. When the access destination address is smaller than the boundary address add_b (step S3: Yes), the access destination address is within the range of addresses add_a to add_b (within the range of the first memory area). 11 is permitted to access the 11 shared memory 13 (first memory area) (step S4). On the other hand, when the access destination address is larger than the boundary address add_b (or the access destination address is greater than or equal to the boundary address add_b) (step S3: No), the access destination address is within the range of addresses add_a to add_b ( Since it is not within the range of the first memory area, access to the shared memory 13 by the first processor 11 is prohibited (step S5).

  If the processor accessing the shared memory 13 is not the first processor 11 (step S2: No), that is, if the processor accessing the shared memory 13 is the second processor 12, the access destination accessed by the second processor 12 Are compared with the boundary address add_b. If the access destination address is larger than the boundary address add_b (or the access destination address is greater than or equal to the boundary address add_b) (step S6: Yes), the access destination address is within the range of addresses add_b to add_c ( Therefore, the second processor 12 is permitted to access the shared memory 13 (second memory area) (step S7). On the other hand, if the access destination address is smaller than the boundary address add_b (step S6: No), the access destination address is not within the range of the addresses add_b to add_c (within the range of the second memory area). Access to the 12 shared memories 13 is prohibited (step S8).

  Next, an operation for rewriting the boundary address stored in the control information storage unit 15 will be described. FIG. 4 is a flowchart for explaining the boundary address rewriting process in the data processing apparatus according to the present embodiment. FIG. 4 shows an operation when the first processor 11 rewrites the boundary address stored in the control information storage unit 15.

  When the boundary address stored in the control information storage unit 15 is rewritten, the first processor 11 acquires the boundary address and access code for rewriting (step S11). For example, the first processor 11 can acquire a rewrite boundary address and access code from a setting circuit (not shown) connected to the bus 16. Here, the access code is, for example, a user ID and a password.

  Next, the second processor 12 performs an authentication process for the access code acquired by the first processor 11 (step S12). For example, the first processor 11 transmits the acquired access code to the second processor 12. Then, the second processor 12 determines whether or not the access code transmitted from the first processor 11 is correct.

  If the second processor 12 determines that the access code transmitted from the first processor 11 is correct (step S13: Yes), the second processor 12 instructs the first processor 11 to rewrite the boundary address. The first processor 11 permitted to rewrite the boundary address rewrites the boundary address stored in the control information storage unit 15 by using the boundary address for rewriting (step S14).

  On the other hand, when the second processor 12 determines that the access code transmitted from the first processor 11 is not correct (step S13: No), the second processor 12 notifies the first processor 11 that the access code is incorrect. In this case, the first processor 11 ends the boundary address rewriting process without rewriting the boundary address stored in the control information storage unit 15 (step S15).

  FIG. 5 is a flowchart for explaining boundary address rewriting processing in the data processing apparatus according to this embodiment. FIG. 5 shows an operation when the second processor 12 rewrites the boundary address stored in the control information storage unit 15.

  When the boundary address stored in the control information storage unit 15 is rewritten, the second processor 12 acquires the boundary address and access code for rewriting (step S21). For example, the second processor 21 can acquire a rewrite boundary address and access code from a setting circuit (not shown) connected to the bus 16. Here, the access code is, for example, a user ID and a password.

  Next, the second processor 12 performs an authentication process for the acquired access code (step S22). If the second processor 12 determines that the access code held is correct (step S23: Yes), the second processor 12 rewrites the boundary address stored in the control information storage unit 15 using the rewrite boundary address (step S24).

  On the other hand, when the second processor 12 determines that the held access code is not correct (step S23: No), the second processor 12 ends the boundary address rewriting process without rewriting the boundary address stored in the control information storage unit 15 ( Step S25).

  As described in the problem of the present invention, in a data processing apparatus in which a shared memory is shared by a plurality of processors, a program to be executed by each processor is stored in the shared memory. If the processor includes a highly secure processor (secure processor), a highly secure program is stored in the shared memory.

  In the multiprocessor controller disclosed in Patent Document 1, a shared memory area accessible by each processor is set by setting a boundary address in a boundary register. However, if the boundary address set in the boundary register can be easily rewritten, a processor other than the secure processor can access a highly secure program, and the security of the data processing apparatus including the secure processor is lost. There was a problem of being. In particular, this problem becomes significant when a processor other than the secure processor is vulnerable.

  Further, in the multiprocessor type controller disclosed in Patent Document 1, the initialization program is executed in common between the processors when the power is turned on, and all the processors can access the shared memory without restriction. For this reason, when a highly secure program is stored in the shared memory, a processor other than the secure processor can access the highly secure program, and the security of the data processing apparatus including the secure processor is lost. there were.

  On the other hand, in the data processing apparatus according to the present embodiment, when rewriting the boundary address stored in the control information storage unit 15, the second processor 12, which is a secure processor, performs an authentication process. Therefore, since it is possible to prevent the boundary address stored in the control information storage unit 15 from being rewritten illegally, it is possible to provide a data processing device with high security. That is, it is possible to prevent the boundary address from being rewritten illegally and the data in the second memory area in which the high security program is stored from being illegally acquired.

  Further, in the data processing apparatus according to the present embodiment, by providing the access control circuit 14, the first processor 11 can be prohibited from accessing the second memory area with high security. Therefore, even if the vulnerability is inherent in the first processor 11, the first processor 11 cannot access the second memory area of the shared memory 13, which affects the security of the second processor, which is a secure processor. Can be suppressed.

  Further, in the data processing apparatus according to the present embodiment, the shared memory 13 can be configured by the same memory (physically single memory), so it is necessary to mount independent memories corresponding to the respective processors. Therefore, the area and cost of the semiconductor chip can be reduced.

  In the data processing apparatus according to the present embodiment, the legitimate user arbitrarily rewrites the boundary address stored in the control information storage unit 15, so that the first memory area and the second memory area of the shared memory 13 are rewritten. The capacity can be changed. Therefore, the memory area of the shared memory can be used efficiently.

  The invention according to the present embodiment described above can provide a data processing apparatus with high security.

<Embodiment 2>
Next, a second embodiment of the present invention will be described. FIG. 6 is a block diagram showing a data processing apparatus according to this embodiment. In the data processing device 20 according to the present embodiment, the boundary address and the second processor reset vector (RSV) are stored in the control information storage unit 25, and the second memory area of the shared memory 23 has the second memory area. The difference from the data processing apparatus 10 described in the first embodiment is that a program for starting the two-processor 12 is stored. Other than this, since it is the same as the data processing apparatus 10 described in the first embodiment, the same components are denoted by the same reference numerals, and redundant description is omitted.

  As shown in FIG. 6, the control information storage unit 25 included in the data processing device 20 according to the present embodiment stores a second processor reset vector (RSV) along with the boundary address. Here, the reset vector for the second processor indicates a head address in which a program to be executed first when the second processor 12 is activated is stored.

  FIG. 7 is a diagram for explaining a memory area of the shared memory 23 included in the data processing apparatus according to the present embodiment. As shown in FIG. 7, the addresses add_a to add_b of the shared memory 23 are addresses corresponding to the first memory area, and the addresses add_b to add_c are addresses corresponding to the second memory area. Here, the address add_b is a boundary address corresponding to the boundary between the first memory area and the second memory area of the shared memory 13.

  In the shared memory 23 shown in FIG. 7, the size relationship between the addresses is add_a <add_b <add_c, and the boundary address add_b is the top address of the second memory area. In the data processing apparatus according to the present embodiment, a program for starting the second processor 12 is stored in the second memory area of the shared memory 23. The start address of this activation program corresponds to the reset vector.

  In the data processing device 20 according to the present embodiment, the second processor 12 reads the reset vector stored in the control information storage unit 25 when starting (restarting). Then, the second processor 12 transmits the shared memory address specified by the reset vector and ID information indicating the access source to the access control circuit 14 in order to read the activation program. Since the access source is the second processor 12 and the access destination is the second memory area (address specified by the reset vector), the access control circuit 14 permits the second processor 12 to access the shared memory 23. . Then, the second processor 12 reads the activation program from the shared memory 23 and executes it. With this operation, the second processor 12 is activated.

  Further, in the data processing device 20 according to the present embodiment, when the reset vector stored in the control information storage unit 25 is rewritten, the second processor 12 performs an authentication process. For the operation when rewriting the reset vector stored in the control information storage unit 25, the boundary address stored in the control information storage unit 15 described in FIGS. 4 and 5 (see the first embodiment) is used. Since it is the same as the operation of rewriting, a duplicate description is omitted.

  In the data processing apparatus according to the present embodiment, when the reset vector stored in the control information storage unit 25 is rewritten, the second processor 12 that is a secure processor performs an authentication process. Therefore, since the reset vector stored in the control information storage unit 25 can be prevented from being rewritten illegally, a highly secure data processing apparatus can be provided. Further, by storing the reset vector in the control information storage unit 25, the operation can be completed with only the program stored in the second memory area of the shared memory 23 when the second processor 12 is activated.

  The invention according to the present embodiment described above can provide a data processing apparatus with high security.

<Embodiment 3>
Next, a third embodiment of the present invention will be described. The data processing apparatus according to the present embodiment is different from the first embodiment in that the second processor 12 can access the first memory area of the shared memory 13. Other than this, since it is the same as the data processing apparatus 10 described in the first embodiment, the same components are denoted by the same reference numerals, and redundant description is omitted.

  FIG. 8 is a flowchart for explaining the operation of the access control circuit 14 (see FIG. 1). In the following, a case will be described as an example where the size relationship of each address is add_a <add_b <add_c.

  When the first processor 11 and the second processor 12 make an access request (write request or read request) to the shared memory 13, the first processor 11 and the second processor 12 transmit access destination address and ID information indicating the access source. . The access control circuit 14 determines a processor (that is, an access source) that accesses the shared memory 13 based on the ID information transmitted by the first processor 11 and the second processor 12 (step S31). When the processor accessing the shared memory 13 is the first processor 11 (step S32: Yes), the access destination address accessed by the first processor 11 is compared with the boundary address add_b. When the access destination address is smaller than the boundary address add_b (step S33: Yes), since the access destination address is within the range of the addresses add_a to add_b (within the range of the first memory area), the first processor 11 is permitted to access the 11 shared memory 13 (first memory area) (step S34). On the other hand, when the access destination address is larger than the boundary address add_b (or the access destination address is greater than or equal to the boundary address add_b) (step S33: No), the access destination address is within the range of the addresses add_a to add_b ( Since it is not within the range of the first memory area, access to the shared memory 13 by the first processor 11 is prohibited (step S35).

  If the processor accessing the shared memory 13 is not the first processor 11 (step S32: No), that is, if the processor accessing the shared memory 13 is the second processor 12, the access destination accessed by the second processor 12 Regardless of the comparison result between the first address and the boundary address add_b, the second processor 12 is permitted to access the shared memory 13 (first memory area and second memory area) (step S36).

  In the data processing apparatus according to the present embodiment, as shown in FIG. 9, since the access ranges of the first processor 11 and the second processor 12 can be different, it is possible to configure more various data processing apparatuses. it can. Further, by limiting the processor that can access the first memory area and the second memory area of the shared memory 13 to the second processor 12 that is a secure processor, the security of the data processing device can be maintained.

<Embodiment 4>
Next, a fourth embodiment of the present invention will be described. FIG. 10 is a block diagram showing the data processing apparatus according to this embodiment. The data processing device 40 shown in FIG. 10 is different from the data processing device described in the first and second embodiments in that N processors are provided (N is an integer of 3 or more). Other than this, since it is the same as the data processing apparatus described in the first and second embodiments, a repeated description is omitted as appropriate.

  As shown in FIG. 10, the data processing device 40 according to the present embodiment includes first to Nth processors 41_1 to 41_N, a shared memory 43, an access control circuit 44, a control information storage unit 45, and a bus 46. The first to Nth processors 41_1 to 41_N, the access control circuit 44, and the control information storage unit 45 are connected to each other via a bus 46. The shared memory 43 is connected to the bus 46 via the access control circuit 44.

  The configurations and operations of the first to Nth processors 41_1 to 41_N are basically the same as those of the first processor and the second processor described in the first and second embodiments. In the data processing device 40 shown in FIG. 10, the secure processor is only the second processor 41_2, but the number of secure processors is not limited to one and may be more.

  The shared memory 43 includes a first memory area accessible by the first processor 41_1, a second memory area accessible by the second processor 41_2, and an Nth memory area accessible by the Nth processor 41_N. The shared memory 43 is basically the same as the shared memory described in the first and second embodiments.

  FIG. 11 is a diagram for explaining a memory area of the shared memory 43 provided in the data processing device 40 according to the present embodiment. As shown in FIG. 11, the addresses add_a to add_b_1 of the shared memory 43 are addresses corresponding to the first memory area, the addresses add_b_1 to add_b_2 are addresses corresponding to the second memory area, and the addresses add_b_2 to add_b_3 are the third addresses. Addresses corresponding to the memory area, and addresses add_b_N-1 to add_b_c are addresses corresponding to the Nth memory area. Here, the addresses add_b_1 to add_b_N−1 are boundary addresses corresponding to the boundaries of the memory areas of the shared memory 43.

  The access control circuit 44 controls access to the shared memory 43 from the first to Nth processors 41_1 to 41_N according to the boundary address. In other words, the access control circuit 44 accesses the shared memory 43 from the first to Nth processors 41_1 to 41_N according to the comparison result between the access destination address of the shared memory 43 and the boundary addresses add_b_1 to add_b_N-1. Can be controlled. Thereby, the access control circuit 44 can logically divide the memory area of the shared memory 43 into the first to Nth memory areas. The access control circuit 44 is basically the same as the access control circuit described in the first and second embodiments.

  The control information storage unit 45 stores boundary addresses add_b_1 to add_b_N−1 corresponding to the boundaries of the first to Nth memory areas of the shared memory 43. The control information storage unit 45 stores second to Nth processor reset vectors (RSV). Any one of the first to Nth processors 41_1 to 41_N can rewrite the boundary addresses add_b_1 to add_b_N-1 and the reset vector at any timing. As described above, the range of the first to Nth memory areas can be arbitrarily changed by rewriting the boundary addresses add_b_1 to add_b_N-1. In the data processing apparatus according to the present embodiment, when rewriting the boundary address and the reset vector stored in the control information storage unit 45, the second processor 41_2, which is a secure processor, performs an authentication process. In the data processing device 40 according to the present embodiment, the case where the control information storage unit 45 includes N−1 reset vectors has been described. However, the number of reset vectors can be arbitrarily determined.

  The boundary address stored in the control information storage unit 45 is output to the access control circuit 44 via the bus 46. For example, the control information storage unit 45 outputs the boundary address to the access control circuit 44 every time the boundary address is rewritten. Thereby, the access control circuit 44 can hold the latest boundary address.

  Further, in the data processing device 40 according to the present embodiment, the second to Nth processors 41_2 to 41_N read the reset vector stored in the control information storage unit 45 when starting (restarting). As a result, the second to Nth processors 41_2 to 41_N can read and execute each startup program from the shared memory 43.

  The operation of the data processing device 40 according to the present embodiment, that is, the operation when the first to Nth processors 41_1 to 41_N access the shared memory 43, the boundary address stored in the control information storage unit 45, and Since the operation when rewriting the reset vector is the same as that described in the first and second embodiments, a duplicate description is omitted.

  Even if a large number of processors are installed, the data processing apparatus according to the present embodiment described above can provide a data processing apparatus having a memory area corresponding to each processor. In addition, according to the invention according to the present embodiment described above, a data processing apparatus with high security can be provided.

<Embodiment 5>
Next, a fifth embodiment of the present invention will be described. FIG. 12 is a block diagram showing the data processing apparatus according to this embodiment. The data processing device 50 shown in FIG. 12 is different from the data processing device described in the first embodiment in that the shared memory 53 includes a control information storage unit 55. Other than this, the data processing apparatus is the same as that described in the first embodiment, and thus redundant description will be omitted as appropriate.

  As shown in FIG. 12, the data processing device 50 according to the present embodiment includes a first processor 51, a second processor 52, a shared memory 53 including a control information storage unit 55, an access control circuit 54, and a bus 56. . The first processor 51, the second processor 52, and the access control circuit 54 are connected to each other via a bus 56. The shared memory 53 is connected to the bus 56 via the access control circuit 54.

  The configurations and operations of the first processor 51 and the second processor 52 are basically the same as those of the first processor 11 and the second processor 12 described in the first embodiment.

  The shared memory 53 includes a first memory area accessible by the first processor 51, a second memory area accessible by the second processor 52, and a control information storage unit 55. A program executed by the first processor 51 is stored in the first memory area. A program executed by the second processor 52 is stored in the second memory area. Here, since the second processor 52 is composed of a secure processor, a program with high security is stored in the second memory area.

  The shared memory 53 is composed of, for example, the same memory (physically single memory), and the first memory area, the second memory area, and the control information storage unit 55 are divided into areas using boundary addresses. Has been. The shared memory 53 can be configured using, for example, a flash memory.

  The control information storage unit 55 provided in the shared memory 53 stores boundary addresses corresponding to the boundaries of the first memory area, the second memory area, and the control information storage unit 55 of the shared memory 53. The boundary address can be rewritten at any timing by the first processor 51 or the second processor 52. As described above, by rewriting the boundary address, the ranges of the first memory area, the second memory area, and the area of the control information storage unit 55 can be arbitrarily changed. Further, in the data processing apparatus according to the present embodiment, when rewriting the boundary address stored in the control information storage unit 55, the second processor 52, which is a secure processor, performs an authentication process.

  The boundary address stored in the control information storage unit 55 is output to the access control circuit 54. For example, the control information storage unit 55 outputs the boundary address to the access control circuit 54 every time the boundary address is rewritten. Thereby, the access control circuit 54 can hold the latest boundary address.

  FIG. 13 is a diagram for explaining a memory area of the shared memory 53 provided in the data processing apparatus according to the present embodiment. As shown in FIG. 13, the addresses add_a to add_b_1 of the shared memory 53 are addresses corresponding to the first memory area, the addresses add_b_1 to add_b_2 are addresses corresponding to the second memory area, and the addresses add_b_2 to add_b_c are control information. The address corresponds to the storage unit 55. Here, the addresses add_b_1 and add_b_2 are boundary addresses corresponding to the boundary between the first memory area, the second memory area, and the control information storage unit 55 in the shared memory 53.

  In the shared memory 53 illustrated in FIG. 13, the size relationship between the addresses may be add_a <add_b_1 <add_b_2 <add_c, or add_a> add_b_1> add_b_2> add_c. When the size relationship between the addresses is add_a <add_b_1 <add_b_2 <add_c, for example, the boundary address add_b_1 can be the start address of the second memory area, and the boundary address add_b_2 can be the start address of the control information storage unit 55. In addition, when the size relationship of each address is add_a> add_b_1> add_b_2> add_c, for example, the boundary address add_b_1 can be the start address of the first memory area, and the boundary address add_b_2 can be the start address of the second memory area.

  The access control circuit 54 controls access to the shared memory 53 from the first processor 51 and the second processor 52 according to the boundary address. That is, the access control circuit 54 controls access to the shared memory 53 from the first processor 51 and the second processor 52 in accordance with the comparison result between the access destination address of the shared memory 53 and the boundary addresses add_b_1 and add_b_2. be able to. Thereby, the access control circuit 54 can logically divide the memory area of the shared memory 53 into the first memory area, the second memory area, and the control information storage unit 55.

  For example, an area having an address smaller than the boundary address add_b_1 is a first memory area, an area having an address larger than the boundary address add_b_1 and smaller than the boundary address add_b_2 is a second memory area, and an area having an address larger than the boundary address add_b_2. When the control information storage unit 55 is used (add_a <add_b_1 <add_b_2 <add_c), the access control circuit 54 controls access to the shared memory 53 from the first processor 51 and the second processor 52 as follows.

  The access control circuit 54 permits the first processor 51 to access the first memory area when the access source to the shared memory 53 is the first processor 51 and the access destination address is smaller than the boundary address add_b_1. . The access control circuit 54 also accesses the shared memory 53 when the access source is the second processor 52 and the access destination address is larger than the boundary address add_b_1 and smaller than the boundary address add_b_2 (or the access destination address is a boundary). When the address add_b is equal to or greater than the boundary address add_b_2), the second processor 52 is permitted to access the second memory area.

  The access control circuit 54 permits the first processor 51 and the second processor 52 to access the control information storage unit 55 when the access destination address is larger than the boundary address add_b_2. That is, when the first processor 51 and the second processor 52 rewrite the boundary address stored in the control information storage unit 55, the address corresponding to the control information storage unit 55 of the shared memory 53 is output to the access control circuit 54. As a result, the control information storage unit 55 can be accessed.

  The operation of the data processing device 50 according to the present embodiment, that is, the operation when the first processor 51 and the second processor 52 access the shared memory 53, and the boundary address stored in the control information storage unit 55 are shown. Since the operation in the case of rewriting is the same as that described in the first embodiment, a duplicate description is omitted. Further, the invention according to the present embodiment can be appropriately combined with the inventions according to the second to fourth embodiments.

  In the data processing apparatus according to the present embodiment, the first memory area, the second memory area, and the control information storage unit can be configured by the same memory (physically single memory). The area can be reduced.

<Embodiment 6>
Next, a sixth embodiment of the present invention will be described. In the sixth embodiment, a usage example of the data processing device 20 described in the second embodiment will be described. In the present embodiment, an example in which the data processor 20 is used by the user A and the user B will be described.

  In the present embodiment, the first processor 11 of the data processing device 20 shown in FIG. 6 is a main processor, the second processor 12 is a secure processor, the first memory area of the shared memory 23 is a main area, and the second memory area is Is a secure area.

  FIG. 14 is a diagram for explaining a usage example of the data processing device 20 according to the present invention, and shows the memory area of the shared memory 23 and the state of the control information storage unit 25 in the initial state. In the initial state, the memory area of the shared memory 23 is all set as the main area, and the secure area is not set. At this time, in the control information storage unit 25, the highest address add_c of the shared memory 23 is set as the boundary address and the second processor reset vector.

  FIG. 15 is a diagram for explaining an example of use of the data processing device 20 according to the present invention. When the user A uses the data processing device in the initial state, the memory area of the shared memory 23 and storage of control information are shown. The state of the unit 25 is shown. When using the data processor in the initial state, the user A writes the main program code A for the main processor (first processor) from the lowest address add_a in the main area of the shared memory 23. Further, the secure program code A for the secure processor (second processor) is written from the highest address add_c of the shared memory 23. Here, access to the security area in which the secure program code A is written is permitted only to a system in which the security of the user A is guaranteed.

  At this time, the boundary address can be the lowest address add_b_1 of the area storing the secure program code A of the user A. As a result, the areas add_b_1 to add_c storing the secure program code A of the user A can be set as secure areas. The second processor reset vector can be the lowest address add_b_1 of the area storing the secure program code A of the user A. Thereby, the secure processor (second processor) can start fetching from the secure program code A of the user A. The main program code A of the user A is stored in add_a to add_d_1 in the main area.

  FIG. 16 is a diagram for explaining an example of use of the data processing device 20 according to the present invention. In addition to the data processing device 20 storing the program code of the user A, the user B is the user B's The memory area and the state of the control information storage unit 25 when the program code is stored are shown. When using the data processing apparatus, the user B writes the main program code B for the main processor (first processor) from the address add_d_1 in the main area of the shared memory 23. At this time, the address higher than the area where the main program code B is written (the area of the address higher than the address add_d_2) is blank. Further, the secure program code B for the secure processor (second processor) is written from the address next to the address add_b_1 in the shared memory 23. Here, access to the security area in which the secure program code B is written is permitted only to a system in which the security of the user B is guaranteed.

  At this time, the boundary address can be the lowest address add_b_2 of the area storing the secure program code B of the user B. Accordingly, the areas add_b_1 to add_c storing the secure program code A of the user A and the areas add_b_2 to add_b_1 storing the secure program code B of the user B can be set as secure areas.

  Since the second processor reset vector remains the lowest address add_b_1 of the area storing the user A's secure program code A, the secure processor (second processor) is the user A's secure program. Fetch can be started from code A.

  According to the use example described above, the secure program code A of the user A and the secure program code B of the user B can be stored separately in the secure area of the shared memory 23. That is, the secure area of the shared memory can be used without interfering with each other among a plurality of users. Since this secure area is an area where access by the main processor (first processor) is prohibited, the secure program codes A and B are affected even if the main processor is vulnerable for some reason. Can be suppressed.

  In the above usage example, with the boundary address as the boundary, the upper address side of the shared memory 23 is the secure area and the lower address side is the main area. However, the arrangement of the secure area and the main area can be arbitrarily determined. For example, with the boundary address as the boundary, the lower address side of the shared memory 23 may be the secure area and the upper address side may be the main area. Further, in the present embodiment, the usage example of the data processing device 20 described in the second embodiment has been described. However, the data processing device described in the other embodiments (the first and third embodiments) is also described. Can be applied.

  Although the present invention has been described with reference to the above embodiment, the present invention is not limited to the configuration of the above embodiment, and can be made by those skilled in the art within the scope of the invention of the claims of the claims of the present application. It goes without saying that various modifications, corrections, and combinations are included.

DESCRIPTION OF SYMBOLS 10 Data processor 11 1st processor 12 2nd processor 13 Shared memory 14 Access control circuit 15 Control information storage part 16 Bus

Claims (12)

A first processor;
A second processor having a security function;
A shared memory comprising a first memory area accessible by the first processor and a second memory area accessible by the second processor;
A control information storage unit capable of storing a boundary address that is an address corresponding to a boundary between the first memory area and the second memory area of the shared memory;
An access control circuit for controlling access to the shared memory from the first processor and the second processor according to the boundary address,
When rewriting the boundary address stored in the control information storage unit, the second processor performs an authentication process;
Data processing device. When rewriting the boundary address stored in the control information storage unit, the first processor acquires a boundary address and an access code for rewriting,
The second processor performs an authentication process of the access code acquired by the first processor,
When the second processor determines that the access code is correct, the first processor rewrites the boundary address stored in the control information storage unit using the rewrite boundary address;
The data processing apparatus according to claim 1. When rewriting the boundary address stored in the control information storage unit, the second processor acquires the boundary address and access code for rewriting, performs authentication processing of the acquired access code, and executes the access code. Is rewritten, the boundary address stored in the control information storage unit is rewritten using the rewrite boundary address.
The data processing apparatus according to claim 1.   The access control circuit controls access to the shared memory from the first processor and the second processor in accordance with a comparison result between an access destination address of the shared memory and the boundary address. The data processing device according to any one of claims 1 to 3.   When the area having an address smaller than the boundary address is the first memory area, and the area having an address larger than the boundary address is the second memory area, the access control circuit can determine whether the access source to the shared memory is 5. The first processor according to claim 1, wherein the first processor permits the first processor to access the first memory area when the access destination address is smaller than the boundary address. 6. The data processing apparatus described.   The access control circuit is configured such that when the access source to the shared memory is the second processor and the access destination address is larger than the boundary address, the second processor accesses the second memory area. 6. The data processing apparatus according to claim 5, wherein the data processing is permitted.   When the area having an address larger than the boundary address is the first memory area, and the area having an address smaller than the boundary address is the second memory area, the access control circuit can determine whether the access source to the shared memory is 5. The first processor according to claim 1, wherein the first processor permits the first processor to access the first memory area when the access destination address is larger than the boundary address. 6. The data processing apparatus described.   The access control circuit is configured such that when the access source to the shared memory is the second processor and the access destination address is smaller than the boundary address, the second processor accesses the second memory area. 8. The data processing apparatus according to claim 7, wherein the data processing is permitted. The control information storage unit further stores a reset vector indicating a head address in which a program for starting the second processor is stored,
When rewriting the reset vector stored in the control information storage unit, the second processor performs an authentication process;
The data processing apparatus according to any one of claims 1 to 8.   The data processing apparatus according to any one of claims 1 to 9, wherein the second processor is configured to be accessible to the first memory area. The data processing device includes N processors,
The shared memory is provided corresponding to the N processors, and includes N memory areas that can be accessed by the N processors,
The control information storage unit stores N-1 boundary address information, which is an address corresponding to a boundary of the N memory areas,
The access control circuit controls each of the N processors to access only a memory area corresponding to each of the N processors.
The data processing apparatus according to claim 1. The data processing apparatus according to any one of claims 1 to 11, wherein the control information storage unit and the shared memory are configured by the same memory.

Images