JP2017108293A - Semiconductor integrated circuit device and data processing apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the load required for managing a nonvolatile memory for storing secret data that are encrypted by a device specific key of a connected LSI.SOLUTION: The present invention relates to an LSI comprising: a cryptographic arithmetic circuit holding a device specific key and a common key and capable of executing encryption/decryption using the device specific key and decryption using the common key; and an interface between a processor that is an example of a circuit to use the secret data, and an external nonvolatile memory. The LSI is configured as follows. Namely, when the LSI and the nonvolatile memory are connected, the cryptographic arithmetic circuit performs activation processing by which data encrypted using the common key are decrypted using the common key and the data are then encrypted using the device specific key and written into the nonvolatile memory. After the activation processing, the encrypted data are read out of the nonvolatile memory, and the data are decrypted using the device specific key and supplied to the processor by the cryptographic arithmetic circuit.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a semiconductor integrated circuit device and a data processing device, and more particularly to a semiconductor integrated circuit device to which a nonvolatile memory in which data to be used is encrypted and stored is connected, and a data processing device including them. It is.

  In order to ensure the confidentiality of data (including program code) used in LSIs (Large Scale Integrated circuits) such as microcontrollers, the data is encrypted and stored in a non-volatile memory connected to the LSI. The LSI reads the encrypted data and decrypts it before use.

  Patent Document 1 discloses a system including a program processing system that reads a previously encrypted program, decrypts the program, and executes the program. This system includes a transmission side that performs encryption and a reception side that performs decryption and program processing. On the transmission side, the program is encrypted using the encryption key of the first encryption key set, and the decryption key of the first encryption key set is encrypted using the encryption key of the second encryption key set. Supply. The receiving side decrypts the decryption key of the first encryption key set using the decryption key of the second encryption key set, and decrypts the encrypted program using the decryption key of the decrypted first encryption key set And run. Thereby, the confidentiality of a program is ensured.

JP 2005-275694 A

  As a result of examination of the patent document 1 by the present inventors, it has been found that there are the following new problems.

  In order to ensure the confidentiality of data used in an LSI, extremely high security can be ensured by using an encryption key unique to the LSI, a so-called device unique key. The device unique key is written from the outside when the LSI is shipped, or is generated and held internally. When data used in an LSI is stored in an external non-volatile memory, the encrypted data is encrypted with another device by using a device unique key unique to the LSI. In this case, since the data cannot be decrypted, the confidentiality of the data can be ensured.

  For this purpose, it is necessary to encrypt the data to be written in the nonvolatile memory using the same common key as the device unique key used for the decryption processing in the LSI or the corresponding encryption key (public key). That is, in order to encrypt data to be written in the nonvolatile memory so that it can be decrypted with a device unique key unique to the connected LSI, the connected LSI needs to be specified as an individual. Therefore, an LSI that uses a device unique key unique to one LSI and a non-volatile memory that stores data encrypted with a device unique key unique to that LSI for use in that LSI are encrypted. It is necessary to manage one pair from the generation of the converted data until the LSI and the non-volatile memory corresponding to each other are mounted and connected.

  However, there are many cases where a vendor that encrypts data and writes the data in the nonvolatile memory and a vendor that mounts the LSI and the nonvolatile memory in one device are different from the LSI manufacturer. In such a case, it has been found that the management of the device unique key and the management of the non-volatile memory become extremely complicated, and the management burden becomes extremely heavy.

  Means for solving such problems will be described below, but other problems and novel features will become apparent from the description of the present specification and the accompanying drawings.

  According to one embodiment, it is as follows.

  That is, a semiconductor integrated circuit device (LSI) having a cryptographic operation circuit, a circuit that uses secret data, and an interface circuit with an external nonvolatile memory is configured as follows.

  The cryptographic operation circuit can execute decryption using the first encryption key and encryption and decryption using the second encryption key that is a device unique key unique to the semiconductor integrated circuit device itself.

  When the LSI and the non-volatile memory are connected, the cryptographic operation circuit decrypts the secret data encrypted using the first encryption key or the encryption key paired with the first encryption key using the first encryption key. Thereafter, an activation process is performed in which the second encryption key, which is a device unique key, is encrypted and written to the nonvolatile memory via the interface.

  After the activation process, the secret data encrypted from the non-volatile memory is read out through the interface circuit, and the cryptographic operation circuit decrypts it using the second encryption key which is a device unique key or a decryption key paired therewith. And supply it to the circuit that uses the secret data.

  The effect obtained by the one embodiment will be briefly described as follows.

  That is, the secret data encrypted with the device unique key (second encryption key) unique to the semiconductor integrated circuit device (LSI) is written after the nonvolatile memory storing the secret data is connected to the LSI. It is possible to reduce the load required for management of the nonvolatile memory.

FIG. 1 is a block diagram illustrating a configuration example of an LSI according to a typical embodiment (Embodiment 1) and a data processing apparatus including the LSI and a nonvolatile memory. FIG. 2 is a block diagram illustrating a configuration example of an LSI according to the second embodiment and a data processing apparatus including the LSI and a nonvolatile memory. FIG. 3 is a flowchart showing an example of the activation process (security site side) in the data processing apparatus according to the second embodiment. FIG. 4 is a flowchart illustrating an example of the activation process (on the assembly factory side) in the data processing apparatus according to the second embodiment. FIG. 5 is an explanatory diagram schematically showing an overview of the entire process of installing customer secret data in the data processing apparatus according to the second embodiment. FIG. 6 is a flowchart illustrating an example of a customer server-side process in the entire process of installing customer secret data in the data processing apparatus according to the second embodiment. FIG. 7 is a flowchart illustrating an example of a security site side process in the entire process of installing customer secret data in the data processing apparatus according to the second embodiment. FIG. 8 is a flowchart illustrating an example of a writing process in the entire process of installing customer secret data in the data processing apparatus according to the second embodiment. FIG. 9 is a flowchart illustrating an example of an activation process in the entire process of installing customer secret data in the data processing apparatus according to the second embodiment. FIG. 10 is a block diagram illustrating a configuration example of hardware of the data processing apparatus according to the second embodiment. FIG. 11 is a block diagram illustrating another configuration example of hardware of the data processing device according to the second embodiment. FIG. 12 is an explanatory diagram schematically showing an overview of the entire process of installing customer secret data in the data processing apparatus according to the third embodiment. FIG. 13 is a block diagram illustrating a configuration example of an LSI according to the third embodiment and a data processing apparatus including the LSI and a nonvolatile memory. FIG. 14 is a flowchart illustrating an example of a security site side process in the entire process of installing customer secret data in the data processing apparatus according to the third embodiment. FIG. 15 is a flowchart illustrating an example of a writing process in the entire process of installing customer secret data in the data processing apparatus according to the third embodiment. FIG. 16 is a flowchart illustrating an example of an activation process in the entire process of installing customer secret data in the data processing apparatus according to the third embodiment.

  Embodiments will be described in detail. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiments for carrying out the invention, and the repetitive description thereof will be omitted.

Embodiment 1
FIG. 1 is a block diagram illustrating a configuration example of an LSI 1 and a data processing apparatus 100 including the LSI 1 and a nonvolatile memory 20 according to a typical embodiment.

  The data processing apparatus 100 includes an LSI 1 and a nonvolatile memory 20 that is electrically connected to the LSI 1. The LSI 1 includes a cryptographic engine 10 that is an example of a cryptographic operation circuit, a CPU (Central Processing Unit) 30 that is an example of a circuit that uses secret data, and an interface circuit 31 with an external nonvolatile memory 20. . The cryptographic engine 10 can execute a decryption operation process 12 using the first encryption key 15, and an encryption operation process 14 and a decryption operation process 11 using the second encryption key 16 that is a device unique key unique to the LSI 1. It is.

  In the activation process, the cryptographic engine 10 performs the decryption calculation process 12 using the first encryption key 15 on the secret data 22 encrypted using the input first encryption key 15, and the plain text is internally stored. After the secret data 22 is restored, the cryptographic operation processing 14 is performed using the device unique key 16 and is written into the nonvolatile memory 20 via the interface circuit 31.

  In the subsequent normal processing, the LSI 1 reads the secret data 21 encrypted using the device unique key 16 from the nonvolatile memory 20 via the interface circuit 31, and the decryption operation using the device unique key 16 is performed by the cryptographic engine 10. Processing 11 is performed and supplied to the CPU 30.

  Thereby, the secret data 21 encrypted with the device unique key 16 unique to the semiconductor integrated circuit device (LSI) 1 is written after the nonvolatile memory 20 storing the secret data is connected to the LSI 1. Processing can be performed, and the load required for management of the nonvolatile memory 20 can be reduced. In addition, in order to encrypt the secret data to the non-volatile memory 20, it is not necessary to read the device unique key 16, and a configuration in which the device unique key 16 is not read at all can be adopted. Is significantly strengthened.

  The device unique key 16 is unique to the LSI 1. For example, it is generated based on seed data input from the outside at the shipping stage of the LSI 1, or is generated from a physical parameter that reflects manufacturing variations of the LSI 1. In the latter case, for example, the function may be generated using a physically non-replicatable function (PUF). Since the device unique key 16 is unique to the LSI 1, the security performance is extremely high. In particular, by making the copy impossible physically using the PUF, even if the LSI 1 itself is copied, the encrypted customer secret data cannot be decrypted. .

  In order to provide such high security performance by the device unique key 16, it is necessary to strictly manage the device unique key 16 so that the device unique key 16 is not known to a third party. The highest security state is that data is not read out of the LSI 1. However, when the secret data is written in the nonvolatile memory, it is necessary to know the value in order to encrypt it with the device unique key 16. Further, since the non-volatile memory 20 in which the secret data encrypted with the device unique key 16 is written must be connected to the LSI 1 having the device unique key 16, it is associated with 1: 1 for each individual unit. Need to be managed. Normally, the nonvolatile memory connected to the LSI of the type name is only defined with the type name, and management associated with 1: 1 for each individual is not necessary. For example, a failed individual is replaced by a good individual. Therefore, in the nonvolatile memory 20 after the secret data encrypted using the device unique key 16 is written, the LSI 1 to be connected is associated with each individual, so that the 1: 1 level at the individual level is 1: 1. Management is required, and the management burden becomes extremely heavy.

  In the typical embodiment of the present application, since the data written in the external nonvolatile memory 20 is encrypted by the LSI 1 itself connected to the nonvolatile memory 20, naturally the device unique key Knows the value of 16 and can be encrypted. Further, since encryption is not performed outside the LSI 1, it is not necessary to read the device unique key 16 to the outside. In addition, since the nonvolatile memory 20 connected to the LSI 1 does not store data encrypted using the device unique key 16 until it is assembled, the nonvolatile memory 20 at the individual level as described above is stored. 1: 1 management is not required.

  The method of inputting the data before being encrypted using the device unique key 16 to the LSI 1 is arbitrary. It is desirable that the data is input in an encrypted state with some encryption key (the first encryption key in FIG. 1) and decrypted inside the LSI 1. When the assembly process for connecting the LSI 1 and the nonvolatile memory 20 is a factory or the like managed with sufficiently high security, it is input in plain text without encryption, and the decryption calculation processing 12 in the LSI 1 is omitted. May be. On the other hand, as shown in FIG. 1, the customer secret data 22 encrypted with the first encryption key is input, and the decryption calculation processing 15 with the first encryption key 15 is performed inside the LSI 1. Since the secret data is not read outside the LSI 1, the security is high.

  Algorithms with encryption and decryption are arbitrary, and may be, for example, a common key encryption method or a public key encryption method. If the keys used for encryption and decryption are different as in the public key cryptosystem, a pair may be used. That is, the encryption process 14 may be performed with the public key of the device unique key 16, and the decryption calculation process 11 may be performed with the corresponding secret key. Although FIG. 1 is illustrated as using the same key, it may be modified as described above. In FIG. 1, the encryption engine 14 and the decryption calculation processes 11 and 12 are shown as blocks in the encryption engine. However, the actual hardware is in a processor format that can execute these processes in a programmable manner. May be implemented. Although FIG. 1 shows an example in which the decrypted customer secret data is input to the CPU 30, it may be changed to another functional module. The LSI 1 is an arbitrary semiconductor integrated circuit device that uses customer secret data. For example, a microcontroller (or a microprocessor, both of which may be abbreviated as “microcomputer”), a system LSI (SOC: System On-a-Chip). ). An arrow indicating a signal flow is realized by 1-bit or multi-bit digital signal wiring, but vector display is omitted. The same applies to other drawings referred to in the present application.

[Embodiment 2]
In the second embodiment, a common key is adopted as the first encryption key, the common key is held in the LSI 1, and the customer secret data 22 encrypted using the same common key is connected to the LSI 1 in the assembly process. This is an embodiment in which data is written in advance in the nonvolatile memory 20 before being performed. The first encryption key is called an installation key.

  FIG. 2 is a block diagram illustrating a configuration example of the LSI 1 according to the second embodiment and the data processing apparatus 100 including the LSI 1 and the nonvolatile memory 20.

  The data processing apparatus 100 includes a microcontroller 1 that is an example of an LSI 1 and a flash memory 20 that is an example of a nonvolatile memory 20 that is electrically connected to the microcontroller 1. The microcontroller 1 includes a cryptographic engine 10, a CPU 30, and an interface circuit 31. The cryptographic engine 10 holds an installation key 15 and a device unique key 16, and executes a decryption operation process 12 using the installation key 15, and an encryption operation process 14 and a decryption operation process 11 using the device unique key 16. Is possible. The cryptographic engine 10 includes, for example, an arithmetic circuit capable of executing special arithmetic operations specific to cryptographic arithmetic processing, a register that temporarily stores intermediate data of arithmetic operations, and a sequence controller that controls the entire processing procedure. The sequence of processing that can be configured and applied to the sequence controller can be programmable. That is, one cryptographic engine 10 includes a sequence program for executing the decryption calculation process 12 using the installation key 15, a sequence program for executing the encryption calculation process 14 using the device unique key 16, and the device unique key 16 It is possible to hold a sequence program that executes the decoding calculation process 11 using the above in a form that can be selected at any time.

  The customer secret data 51 is encrypted in the customer secret data management device 50 using the install key 54 that is the same common key (or corresponding public key) as the install key 15 and encrypted with the install key. The customer secret data 22 is generated. The customer secret data 22 encrypted with the installation key is written into the flash memory 20. In the assembly process, the flash memory 20 in which the customer secret data 22 is written and the microcontroller 1 are electrically connected, for example, by being mounted on a printed board mounted on the data processing apparatus 100. Thereafter, an activation process is performed.

  In the activation process, the customer secret data 22 encrypted using the installation key 54 that is the same common key as the installation key 15 is read from the flash memory 20 and read into the cryptographic engine 10 via the interface circuit 31. The cryptographic engine 10 performs decryption operation processing 12 using the installation key 15 held inside the read customer secret data 22 to return it to plaintext customer secret data, which is also held internally. The encryption calculation process 14 using the device unique key 16 is performed, and it is written back as the customer secret data 21 encrypted with the device unique key onto the flash memory 20 via the interface circuit 31. This activation process is performed after the microcontroller 1 and the flash memory 20 are electrically connected in the assembly process of the microcontroller 1 and the flash memory 20 in the manufacturing process of the data processing apparatus 100, for example.

  In the subsequent normal operation, the microcontroller 1 reads the customer secret data 21 from the flash memory 20 via the interface circuit 31, and after performing the decryption calculation process 11 using the device unique key 16 in the cryptographic engine 10, the CPU 30 To supply.

  As a result, the activation process of writing the secret data 21 encrypted with the device unique key 16 unique to the individual microcontroller 1 after the flash memory 20 storing the secret data is connected to the microcontroller 1 is performed. This can be done, and the load required for managing the flash memory 20 can be reduced. Further, in order to encrypt the secret data to the flash memory 20, it is not necessary to read the device unique key 16, and a configuration in which the device unique key 16 is not read at all can be adopted. Remarkably strengthened.

  The operation of the data processing apparatus 100 will be described in more detail.

  3 and 4 are flowcharts showing examples of the activation process in the data processing apparatus according to the second embodiment on the security site side and the assembly factory side, respectively.

  The customer secret data management device 50 on the security site shown in FIG. 3 decrypts the customer secret data sent from the customer in an encrypted state (S01). Next, the decrypted customer secret data is encrypted with the installation key (common key) 54 (S02). The encrypted customer secret data is written in the external flash memory 20 (S03) and delivered to the assembly factory (S04).

  The assembly factory side shown in FIG. 4 performs an assembly process for connecting the delivered flash memory 20 and the microcontroller 1 (S05). After the assembly is completed, power is supplied, and the customer secret data 22 encrypted with the installation key (common key) is read into the microcontroller 1 (S06), and the microcontroller 1 holds the read customer secret data 22 inside. The installation key (common key) 15 to be decrypted is used (S07). The microcontroller 1 encrypts the customer secret data returned to the plain text by the decryption using the device unique key 15 unique to itself (S08), and stores the customer secret data 21 encrypted with the device unique key 15 in the flash memory. 20 is written (S09).

  Thus, the customer secret data 22 encrypted with the installation key is written in the flash memory 20 and delivered to the assembly process which is one of the manufacturing processes of the data processing apparatus 100, whereby the customer secret data in the delivery process is obtained. Can be protected in an encrypted state. Further, in the activation process, the customer secret data 22 is read into the microcontroller 1 through the interface circuit 31 that is also used in the normal operation and written back to the flash memory 20 through the same interface circuit 31. There is no need to add an interface to the microcontroller 1 that is used only for processing.

  Although not particularly limited, by using the installation key 15 and the device unique key 16 as a common key for the common key encryption method, the computation load of encryption and decryption by the cryptographic operation circuit 10 can be suppressed.

  FIG. 5 is an explanatory diagram schematically showing an overview of the entire process for installing and activating customer secret data in the data processing apparatus 100.

  Description will be made assuming that there is a customer server 61, a security site 60 managed by a semiconductor manufacturer that manufactures and sells the microcontroller 1, for example, and a factory 70 of the data processing apparatus 100. The security site 60 may be managed by a customer, or may be managed by an administrator entrusted by a customer or a semiconductor manufacturer, but refers to a site that is protected in a secret state without leakage of data by a firewall or the like. . The customer secret data is stored in an encrypted state in a storage medium 62 such as a CD (Compact Disc) and delivered from the customer server 61 to the security site 60. The security site 60 stores and manages the customer secret data sent to the data server 63. When installation on the data processing apparatus 100 is requested, the customer secret data is sent to the pre-activation customer secret data generation server 65. send. At this time, the customer secret data is transmitted while being held in the storage medium 64, but since it is in the security site, protection by encryption or the like is not necessarily required. The customer secret data generation server 65 before activation is encrypted using the installation key 54 and then delivered to the factory 70 of the data processing apparatus 100 while being held in the storage medium 66.

  In the factory 70 of the data processing apparatus 100, the customer secret data 22 encrypted using the installation key is written in the flash memory 20, and an assembly process for connecting to the microcontroller 1 is performed. The microcontroller 1 includes a cryptographic engine 10 having an installation key 15 and a device unique key 16, and after the activation process is completed as described above, the customer encrypted with the installation key on the flash memory 20. The secret data 22 may be deleted.

  Thereby, the storage area of the flash memory 20 is released and can be used, and security is enhanced. The customer secret data 22 encrypted with the installation key, which is a common key managed by the customer secret data management apparatus 50, is compared with the customer secret data 21 encrypted with the device unique key 16 that is not known to the outside. The reason why the security is inferior is that only the customer secret data 21 with high safety is stored in the non-volatile memory after assembly.

  The encrypted customer secret data 22 is written to the flash memory 20 in addition to the example shown in FIG. 2 at the security site 60 or at another site, for example, a non-volatile memory manufacturing factory. Also good.

  The recording media 62, 64, and 66 are not only the CDs exemplified above, but also DVD (Digital Versatile Disc; registered trademark), Blu-ray Disc (registered trademark), USB (Universal Serial Bus) memory, etc. It may be a semiconductor memory. Moreover, it is not limited to these tangible objects, but may be an intangible object such as a wired / wireless communication medium including a packet on a network such as the Internet.

  The customer secret data may be individual data such as personal information of each customer. In that case, secret data of a plurality of customers is supplied in a bundled state, and is installed for each unit. Since the customer secret data is often the encryption key used in the application, the encryption key in the signature, or the key data of the certificate, the bundle of customer secret data is sometimes called a “key bundle”. This key bundle is distinguished from encryption keys such as an installation key, a device unique key, and a temporary key described later, which are used for encryption processing for protecting the key bundle.

  6 to 9 are flowcharts showing an example of the flow of the entire process for installing the customer secret data bundle (key bundle) in the data processing apparatus according to the second embodiment. FIG. 6 illustrates processing on the customer server side, FIG. 7 illustrates processing on the security site side, FIG. 8 illustrates writing processing, and FIG. 9 illustrates activation processing.

  On the customer server side, as shown in FIG. 6, customer secret data is created (S11), encrypted (S12), and delivered to the security site (S13).

  In the security site, as shown in FIG. 7, the customer secret data is decrypted (S14), and one unit of the customer secret data is encrypted with the installation key (common key) (S15). This is repeated until the required number of customer secret data is encrypted (S15, S16), thereby generating a bundle of encrypted customer secret data. The bundle of encrypted customer secret data is written on a medium (storage medium) such as a CD (S17), and delivered to an assembly factory for an external flash memory (S18).

  In the writing process at the assembly factory, as shown in FIG. 8, the encrypted customer secret data is written into the flash memory 20 for each unit (S19), and an assembly process for connecting the flash memory 20 and the microcontroller 1 is performed (S19). S20).

  In the activation process at the assembly factory, as shown in FIG. 9, the customer secret data 22 encrypted with the installation key (common key) is read from the flash memory 20 (S21), and the installation key (common key) held inside is stored. ) 15 for decryption (S22). The customer secret data decrypted and converted into plain text is encrypted with the device unique key 16 (S23), and the encrypted customer secret data is written in the flash memory 20 (S24).

  The LSI 1 is a processor that can execute a program, like the microcontroller 1 exemplified above, and may include an interface circuit 31 for writing to the flash memory 20 connected to the outside.

  FIG. 10 and FIG. 11 are block diagrams respectively showing one configuration example and another configuration example of the hardware of the data processing apparatus 100.

  In both of the data processing devices 100 shown in FIGS. 10 and 11, the microcontroller 1, the data flash memory 20, and the code flash memory 40 are connected to an external bus 43 that is connected to a flash memory interface 31 of the microcontroller 1. Has been.

  The microcontroller 1 illustrated in FIG. 10 includes a CPU 30, a cryptographic engine 10, an installation key (common key) 15, a device unique key 16, a flash memory interface 31, a random number generator 32, a timer 33, a RAM 34, and a peripheral module 39. The main functional blocks are electrically connected to the CPU 30 via the internal bus 36. The installation key (common key) 15 and the device unique key 16 are directly connected to the cryptographic engine 10 and are configured so that they cannot be accessed from a functional module other than the cryptographic engine 10 such as the CPU 30. Sex is guaranteed. The installation key (common key) 15 and the device unique key 16 may be built in the cryptographic engine 10.

  The data flash memory 20 stores customer data 22 encrypted with an installation key before the activation process, and stores customer secret data 21 encrypted with the device unique key 16 after the activation process. . The code flash memory 40 stores an activation program 41 and other general programs 42.

  In order to execute the activation process, the CPU 30 accesses the code flash memory 40 via the flash memory interface 31 and executes the activation program 41. By executing the activation program 41, the secret data 22 encrypted with the installation key is read from the data flash memory 20, and the above-described processes are mainly executed by the encryption engine 10, whereby the customer secret data is stored in the device. The data is encrypted with the unique key 16 and written from the CPU 30 to the data flash memory 20 via the flash memory interface 31. As a result, the customer secret data 21 encrypted with the device unique key unique to the connected microcontroller 1 is stored in the data flash memory 20. The customer secret data 22 encrypted with the installation key may be subsequently deleted from the data flash memory 20.

  The data processing apparatus 100 illustrated in FIG. 11 differs from the microcontroller 1 illustrated in FIG. 10 in that the microcontroller 1 further incorporates a ROM 35, and the activation program 41 is replaced with the external code flash memory 40. Although different in that it is stored in the built-in ROM 35, the other configurations are the same, so the description thereof is omitted. In order to execute the activation process, the CPU 30 is different from the operation of FIG. 10 described above in that the activation program 41 stored in the built-in ROM 35 is executed. Since the content of the processing itself is the same as described above, the description thereof is omitted.

  The hardware configurations shown in FIGS. 10 and 11 are merely examples, and changing to other configurations is arbitrary. For example, the RAM 34, the ROM 35, and the flash memory interface 31 may be changed to be connected to the bus 36 instead of being directly connected to the CPU 30. In addition to the CPU 30, it may be changed to a multiprocessor equipped with a plurality of CPUs, and memories such as the bus 36 and the RAM 34 may be hierarchized.

[Embodiment 3]
In the third embodiment, the secret data is encrypted using an encryption key different from the installation key held in the LSI 1 and then supplied to the LSI 1 by writing it in a nonvolatile memory. Another encryption key at this time is referred to as a temporary key (Temp key), and the temporary key is also encrypted by using the installation key and supplied to the LSI 1 by writing it in a nonvolatile memory. The LSI 1 first decrypts the supplied temporary key using the installation key held inside, and then decrypts the secret data using the decrypted temporary key.

  FIG. 12 is an explanatory diagram schematically showing an overview of the entire process of installing customer secret data in the data processing apparatus 100 according to the third embodiment.

  In the customer secret data management device 50, the customer secret data 51 is subjected to an encryption process 52 using a temporary key 55, and the customer secret data 23 encrypted with the temporary key is generated. The temporary key 55 itself is subjected to an encryption process 52 using an installation key 54 that is the same common key as the installation key 15 held in the LSI 1, and the temporary key 24 encrypted with the installation key is generated. Similarly to the example shown in FIG. 5, this customer secret data management device 50 may also be configured as a data server 63 in the security site 60 and a customer secret data generation server 65 before activation. The customer secret data 23 encrypted with the temporary key and the temporary key 24 encrypted with the installation key are delivered to the nonvolatile memory writing process while being held in the storage medium 66 and written into the nonvolatile memory 20. . A suitable example of the nonvolatile memory 20 is the flash memory 20. The flash memory 20 is connected to the microcontroller 1 in the assembly process of the data processing apparatus 100. The microcontroller 1 holds the installation key 15 and the device unique key 16 as in the second embodiment, but does not hold the temporary key. In the assembly process, after the microcontroller 1 and the flash memory 20 are connected, a key activation process is performed.

  In the key activation process, the microcontroller 1 first reads the temporary key 24 encrypted with the installation key from the flash memory 20 and decrypts it using the installation key 15 held inside to obtain a plaintext temporary key. . Next, the microcontroller 1 reads the customer secret data 23 encrypted with the temporary key from the flash memory 20 and decrypts it using the decrypted temporary key. The microcontroller 1 encrypts the decrypted customer secret data using the device unique key 16 and writes it into the flash memory 20. The customer secret data written in the flash memory 20 is customer secret data 21 encrypted with the device unique key. When the microcontroller 1 uses this data, it reads from the flash memory 20 and uses the device unique key. Decrypt. Similar to the second embodiment, the customer secret data 23 encrypted with the temporary key on the flash memory 20 and the temporary key 24 encrypted with the installation key may be deleted after the activation process is completed.

  Thereby, it is not necessary to hold a temporary key (Temp key) in the microcontroller 1 in advance, and the customer secret data management device 50 can freely set and change the temporary key. For example, it can be set individually for each destination of encrypted secret data. It can also be changed frequently.

  FIG. 13 is a block diagram illustrating a configuration example of the LSI 1 according to the third embodiment and the data processing apparatus 100 including the LSI 1 and the nonvolatile memory 20.

  The data processing apparatus 100 includes a microcontroller 1 that is an example of an LSI 1 and a flash memory 20 that is an example of a nonvolatile memory 20 that is electrically connected to the microcontroller 1. The microcontroller 1 includes a cryptographic engine 10, a CPU 30, and an interface circuit 31. The cryptographic engine 10 holds the installation key 15 and the device unique key 16, and, similarly to the cryptographic engine of the second embodiment shown in FIG. The encryption calculation process 14 and the decryption calculation process 11 used can be executed. Unlike the cryptographic engine of the second embodiment, the temporary key 17 decrypted by the decryption calculation process 13 can be temporarily held, and the decryption calculation process 12 using this can be executed. The temporary key 17 is temporarily held in a register included in the cryptographic engine 10, for example.

  In the customer secret data management apparatus 50, the customer secret data 51 is subjected to encryption processing 52 using the temporary key 55 which is the same common key as the temporary key 17, and the customer secret data 23 encrypted with the temporary key is obtained. Generated. At this time, the temporary key used for encryption is subjected to encryption processing 53 using the installation key 54 which is the same common key as the installation key 17, and the temporary key 24 encrypted with the installation key is generated. The The customer secret data 23 encrypted with the temporary key and the temporary key 24 encrypted with the installation key are written into the flash memory 20. The flash memory 20 and the microcontroller 1 in which the customer secret data 23 and the temporary key 24 are written are electrically connected by being mounted on, for example, a printed board mounted on the data processing apparatus 100 in the assembly process. Thereafter, an activation process is performed.

  In the activation process, the temporary key 24 encrypted using the installation key 54 that is the same common key as the installation key 15 is read from the flash memory 20 and read into the cryptographic engine 10 via the interface circuit 31. The cryptographic engine 10 performs a decryption calculation process 13 using the installation key 15 held inside the read temporary key 24, returns it to the plaintext temporary key 17, and temporarily holds it in a register or the like. Next, the customer secret data 23 encrypted using the temporary key 55, which is the same common key as the temporary key 15, is read from the flash memory 20, read into the cryptographic engine 10 via the interface circuit 31, and stored in the cryptographic engine 10. Decryption calculation processing 12 is performed using a temporarily stored plaintext temporary key 17. The decrypted customer secret data is subjected to the encryption calculation process 14 using the device unique key 16 held inside, and encrypted on the flash memory 20 via the interface circuit 31 with the device unique key. Write back as customer secret data 21. This activation process is performed, for example, in an assembly process for electrically connecting the microcontroller 1 and the flash memory 20 in the manufacturing process of the data processing apparatus 100.

  In the subsequent normal operation, the microcontroller 1 reads the customer secret data 21 from the flash memory 20 via the interface circuit 31, and after performing the decryption calculation process 11 using the device unique key 16 in the cryptographic engine 10, the CPU 30 To supply.

  Thus, as in the second embodiment, the secret data 21 encrypted with the device unique key 16 unique to the individual microcontroller 1 and the flash memory 20 in which the secret data is stored are connected to the microcontroller 1. Activation processing to be written later can be performed, and the load required for managing the flash memory 20 can be reduced. Further, in order to encrypt the secret data to the flash memory 20, it is not necessary to read the device unique key 16, and a configuration in which the device unique key 16 is not read at all can be adopted. The same applies to the point that it is significantly strengthened. Furthermore, the temporary key may be deleted after the activation process is completed. As a result, even if the customer secret data 23 encrypted with the temporary key on the flash memory 20 is not erased, the temporary key for decrypting this data does not exist in the data processing apparatus 100. Will increase.

  14 to 16 are flowcharts showing an example of the flow of the entire process for installing the customer secret data bundle in the data processing apparatus according to the third embodiment. FIG. 14 illustrates the processing on the security site side, FIG. 15 illustrates the writing processing, and FIG. 16 illustrates the activation processing.

  As shown in FIG. 14, the security site generates a temporary key (S30), encrypts one unit of customer secret data with the created temporary key (S31), and uses the temporary key as an installation key (common key). (S32). Thereafter, the presence / absence of the next customer secret data is determined (S33). If there is customer secret data that has not been encrypted yet, the process returns to step S31 to repeat the encryption process. When all the encryption of the customer secret data is completed, the process proceeds to step S34. Through the repeated loop from step S31 to step S33, a bundle of encrypted customer secret data and an encrypted temporary key are generated. The bundle of customer secret data encrypted with the temporary key and the temporary key encrypted with the installation key are written to a medium (storage medium) such as a CD (S34) and directed to the assembly factory of the external flash memory. Delivered (S35).

  In the writing process at the assembly factory, as shown in FIG. 15, one unit of customer secret data encrypted with the temporary key and the temporary key encrypted with the installation key are written in the flash memory 20 (S36), An assembly process for connecting the memory 20 and the microcontroller 1 is performed (S37).

  In the activation process at the assembly factory, as shown in FIG. 16, the temporary key 24 encrypted with the installation key (common key) is read from the flash memory 20 (S38), and the installation key held inside the microcontroller 1 is stored. Decrypt with (common key) 15 (S39). Next, the customer secret data 23 encrypted with the temporary key is read from the flash memory 20 (S40), and decrypted using the temporary key decrypted in step S38 and converted into plain text (S41). The customer secret data decrypted and converted into plain text is encrypted with the device unique key 16 (S42), and the encrypted customer secret data is written to the flash memory 20 (S43).

  The LSI 1 is a processor that can execute a program, like the microcontroller 1 exemplified above, and may include an interface circuit 31 for writing to the flash memory 20 connected to the outside.

  Although the invention made by the present inventor has been specifically described based on the embodiments, it is needless to say that the present invention is not limited thereto and can be variously modified without departing from the gist thereof.

  For example, the cryptographic engine 10 mounted on the LSI 1 or the microcontroller 1 illustrated in FIGS. 1, 2, and 13 may be realized using hardware or software. For example, when implemented using software executed by the CPU 30, the hardware cryptographic engine 10 illustrated in FIGS. 10 and 11 is not necessary. Even in this case, the software and the hardware are cooperatively operated so that an accelerator capable of executing a part of the cryptographic operation at high speed is provided, and a part of the function of the cryptographic engine 10 realized by software is executed. You may comprise.

  As the encryption method, a public key encryption method may be adopted instead of the common key encryption method exemplified above. When the public key cryptosystem is adopted, a public key used for encryption and a secret key used for decryption may be paired. For example, inside the LSI 1, a pair of device-specific public key and private key is held, and in the activation process, the customer secret data is encrypted with the public key and written to the nonvolatile memory. In the normal process after activation, Using the corresponding private key, the plaintext customer secret data can be decrypted and used. The same applies when other encryption methods are adopted.

1 Semiconductor integrated circuit device (LSI; microcontroller, SOC, etc.)
10 Cryptographic engine 11, 12, 13 Decryption unit 14 Encryption unit 15 Installation key (shared key)
16 Device unique key 17 Temp Key
20 Nonvolatile memory (Flash memory)
21 Customer Secret Data Encrypted with Device Unique Key 22 Customer Secret Data Encrypted with Installation Key 23 Customer Secret Data Encrypted with Temporary Key 24 Temporary Key Encrypted with Installation Key 30 CPU
31 Interface 32 Random number generator 33 Timer 34 RAM
35 ROM
36 Bus 39 Peripheral module 40 Non-volatile memory (Flash memory)
41 Activation Program 42 General Program 43 External Bus 50 Customer Secret Data Management Device 51 Customer Secret Data 52, 53 Encryption Unit 54 Installation Key (Common Key)
55 Temp Key
60 Security site 61 Customer server 63 Data server 65 Customer secret data generation server 62, 64, 66 before activation Storage medium (CD, etc.)
70 Data processing equipment factory 100 Data processing equipment

Claims (16)

A semiconductor integrated circuit device having a cryptographic operation circuit, a circuit using secret data, and an interface circuit with an external nonvolatile memory,
The cryptographic operation circuit is capable of executing decryption using a first encryption key and encryption and decryption using a second encryption key that is a device unique key unique to the semiconductor integrated circuit device,
The cryptographic operation circuit decrypts the first data encrypted using the first encryption key or the encryption key paired with the first encryption key using the first encryption key, and An activation process can be performed in which the data is encrypted using the two encryption keys and written to the nonvolatile memory as the second data via the interface;
The cryptographic operation circuit reads the second data through the interface circuit, decrypts the second data using the second encryption key or a decryption key paired with the second encryption key, and uses the secret data Can be supplied,
Semiconductor integrated circuit device. In claim 1, the first encryption key and the second encryption key are each a common key by a common key encryption method,
The semiconductor integrated circuit device holds the first encryption key and the second encryption key,
The cryptographic operation circuit decrypts the first data encrypted using the first encryption key using the first encryption key, and then encrypts the second data using the second encryption key. age,
The cryptographic operation circuit decrypts the second data read from the nonvolatile memory using the second encryption key;
Semiconductor integrated circuit device. In claim 2, the first data is stored in the nonvolatile memory,
The cryptographic operation circuit reads the first data from the nonvolatile memory via the interface.
Semiconductor integrated circuit device. In claim 3,
The first data on the nonvolatile memory is erased after being read.
Semiconductor integrated circuit device. In claim 1,
The semiconductor integrated circuit device holds the second encryption key and the third encryption key,
The first encryption key and the second encryption key are each a common key by a common key cryptosystem,
The cryptographic operation circuit can further perform decryption using the third encryption key,
The cryptographic operation circuit decrypts the first encryption key encrypted with the third encryption key using the third encryption key, and then encrypts the first encryption key using the first encryption key. 1 data is decrypted using the decrypted first encryption key, and then encrypted using the second encryption key to obtain second data,
The cryptographic operation circuit decrypts the second data read from the nonvolatile memory using the second encryption key;
Semiconductor integrated circuit device. 6. The nonvolatile memory according to claim 5, wherein the first data encrypted using the first encryption key and the first encryption key encrypted using the third encryption key are stored in the nonvolatile memory. ,
Reading the encrypted first encryption key and the encrypted first data from the nonvolatile memory via the interface;
Semiconductor integrated circuit device. In claim 6,
The first data and the first encryption key on the nonvolatile memory are erased after being read.
Semiconductor integrated circuit device. In claim 1,
A program memory storing an activation program can be further connected to the interface circuit,
The semiconductor integrated circuit device executes the activation process by accessing the program memory and executing the activation program;
Semiconductor integrated circuit device. In claim 1,
The semiconductor integrated circuit device further includes an on-chip memory for storing an activation program, and executes the activation process by accessing the on-chip memory and executing the activation program.
Semiconductor integrated circuit device. A semiconductor integrated circuit device having a cryptographic operation circuit and a circuit using secret data, and a nonvolatile memory electrically connected to the semiconductor integrated circuit device,
The non-volatile memory holds first data encrypted using a first encryption key,
The semiconductor integrated circuit device is a device unique key unique to the semiconductor integrated circuit device after being decrypted by the cryptographic operation circuit using the first encryption key or a decryption key paired with the first encryption key. It is possible to execute an activation process in which the second data is encrypted using the second encryption key and written to the nonvolatile memory as second data,
After the activation process, the semiconductor integrated circuit device reads the second data from the nonvolatile memory, and uses the decryption key paired with the second encryption key or the second encryption key by the cryptographic operation circuit. Can be decrypted and supplied to a circuit that uses the secret data.
Data processing device. In Claim 10, said 1st encryption key and said 2nd encryption key are common keys by a common key encryption method, respectively,
The semiconductor integrated circuit device holds the first encryption key and the second encryption key,
The cryptographic operation circuit decrypts the first data encrypted using the first encryption key using the first encryption key, and then encrypts the second data using the second encryption key. age,
The cryptographic operation circuit decrypts the second data read from the nonvolatile memory using the second encryption key;
Data processing device. In claim 11,
The semiconductor integrated circuit device erases the first data on the nonvolatile memory after being read.
Data processing device. In claim 10,
The non-volatile memory further holds a first encryption key encrypted with a third encryption key;
The first encryption key, the second encryption key, and the third encryption key are common keys by a common key encryption method,
The semiconductor integrated circuit device holds the second encryption key and the third encryption key,
In the activation process, the semiconductor integrated circuit device reads the encrypted first encryption key from the non-volatile memory, causes the cryptographic operation circuit to decrypt it using the third encryption key, and encrypts it. Second data is read out and decrypted by the cryptographic operation circuit using the decrypted first encryption key, and then encrypted by the encryption operation circuit using the second encryption key. Data and
After the activation process, the semiconductor integrated circuit device causes the cryptographic operation circuit to decrypt the second data read from the nonvolatile memory using the second cryptographic key,
Data processing device. In claim 13,
The semiconductor integrated circuit device erases the first data and the first encryption key on the nonvolatile memory after reading them.
Data processing device. In claim 10,
A program memory for storing an activation program is further connected to the semiconductor integrated circuit device,
The semiconductor integrated circuit device executes the activation process by accessing the program memory and executing the activation program;
Data processing device. In claim 10,
The semiconductor integrated circuit device further includes an on-chip memory for storing an activation program, and executes the activation process by accessing the on-chip memory and executing the activation program.
Data processing device.

Images