JP2019096338A - Semiconductor device and semiconductor device sales model - Google Patents

Abstract

To provide a semiconductor device with which it is possible to operate a microprocessor as desired while protecting a secure program.SOLUTION: The semiconductor device comprises a memory equipped with a first program area in which a discretionary program is stored and a second program area in which a secure program is stored, a microprocessor CPU for outputting an address that indicates an instruction in the program, and a memory protection unit 204 for controlling access to the memory on the basis of the address outputted from the microprocessor CPU. When the address outputted due to execution of the program by the microprocessor CPU in the first program area indicates a branching-permitted area in the second program area, the memory protection unit 204 permits access to the memory; when it indicates a branching-prohibited area, the memory protection unit 204 prohibits access to the memory.SELECTED DRAWING: Figure 3

Description

  The present invention relates to a semiconductor device, and more particularly to a semiconductor device in which a microprocessor and an electrically rewritable non-volatile memory are incorporated in one semiconductor chip.

  For example, a semiconductor device in which a non-volatile memory electrically rewritable with a microprocessor (hereinafter, also referred to as a central processing unit) is incorporated in one semiconductor chip is known as a microcomputer, for example. Such microcomputers are also widely used in product areas where security is required. When using a microcomputer in a product field where security is required, attacks on security are mainly performed from the outside of the microcomputer. Therefore, in order to protect security, although the microcomputer is made to be highly resistant to attacks from the outside, the resistance to attacks in the microcomputer is often weak.

  A microprocessor built in the microcomputer operates, for example, in a real time operating system (hereinafter also referred to as RTOS), and an application program operates on this RTOS. In this case, in order to protect the RTOS from runaway application programs, an exception interrupt is generated to operate in a privileged mode. This makes it possible to protect the RTOS even if the application program is run away with malicious intent in the microcomputer. However, there is a problem that it is weak against an attack that repeatedly applies power supply noise and the like.

  As a technology relating to protection of a computer system, there is a technology described in Patent Document 1, for example.

Unexamined-Japanese-Patent No. 2007-304954

  The present inventors considered a new business model for selling semiconductor devices. Although this new semiconductor device sales model will be described in detail later, an outline of this new semiconductor device sales model will be described in order to explain the problem to be solved.

  In the new semiconductor device sales model, a program such as an RTOS (hereinafter, also referred to as a secure program) for which security should be secured is stored in advance in a nonvolatile memory of a microcomputer and sold. That is, it is provided to a user who uses a semiconductor device such as a microcomputer. The user who has purchased the microcomputer creates, for example, a user program operating on the RTOS and stores it in the non-volatile memory. In this case, the user needs only to create a user program using the functions provided by the RTOS, which facilitates the creation of the user program. As a result, the user can easily manufacture a microcomputer (semiconductor device) having a function desired by the user.

  In this case, a person who sells (provides) a microcomputer (hereinafter, also referred to as a seller) may, for example, use a program such as RTOS at the price of a microcomputer incorporating a non-volatile memory such as RTOS that does not store a program And the sale price as a sale price. This enables the seller to make a profit, allows the user to use a microprocessor that can easily create a user program, and easily obtains a microcomputer having a desired function. That is, benefits will arise for both the seller and the user.

  In this semiconductor device sales model, the user creates a program operating on the RTOS. That is, the user creates a program for operating the microprocessor built in the microcomputer. Therefore, in the microcomputer, it is required that the user's program can make it possible to arbitrarily call the function provided in the RTOS.

  Here, it is possible for the user to create a program for operating the microprocessor arbitrarily, and for the function of the RTOS to be arbitrarily accessed, which causes a new problem. For example, it is feared that the user can also create a user program that copies the RTOS, that is, a hacking program. When the RTOS is copied with malicious intent, for example, it becomes possible to purchase an inexpensive microcomputer and store the copied RTOS in the microcomputer. This leads to the loss of the seller's merit.

  Patent Document 1 describes a technology related to a computer system capable of preventing deletion, falsification, leakage and the like of confidential data in a storage area by a buffer overflow attack or the like. That is, the computer system (1) shown in FIG. 1 of Patent Document 1 has an access control memory map in which the presence or absence of the access right for program execution from the CPU (10) for each address of the storage area (19) is set. And an access right determination circuit (16). The access right determination circuit (16) determines the presence or absence of the access right from the CPU (10) to the storage area of the execution program storage address (Spc) specified by the program counter (20) based on the access control memory map If there is no access right, the CPU (10) outputs an access inhibition signal (SC) that causes the CPU (10) to execute predetermined processing that disables access to the storage area of the execution program storage address.

  This makes it possible to protect the computer system against an attack from outside the computer system (1), for example, an attack that causes the CPU to run away by adding power supply noise.

  However, this relates to a technique against an attack from the outside of the computer system, and is not aware of an attack when it is possible to arbitrarily operate the CPU which is a microprocessor. Of course, a new semiconductor device sales model is not described.

  A semiconductor device according to one embodiment designates a memory in a first program area in which an arbitrary program is stored, a second program area in which a program whose security is to be secured is stored, and an instruction in the program And a memory protection unit for controlling access to the memory based on the address output from the central processing unit. When the central processing unit issues an address output by executing a program in the first program area designates the first area in the second program area, the memory protection unit permits the central processing unit to access the memory. When specifying a second area different from the first area, the memory protection unit prohibits the central processing unit from accessing the memory.

  That is, when an arbitrary program in the first program area accesses the first area of the second program area where the program whose security is to be secured is stored, the access is permitted, and the second program area When the two areas are accessed, access is prohibited. This makes it possible to use a program whose security is to be secured from any program and to protect a program whose security is to be secured.

  A semiconductor device according to another embodiment of the present invention is a central processing unit that outputs an electrically rewritable non-volatile memory in which a program whose security is to be secured is stored and an address specifying an instruction to be executed. And a memory protection unit for detecting whether or not the address output from the central processing unit designates, in the non-volatile memory, a secure program area in which a program whose security is to be secured is stored. The semiconductor device further includes a non-volatile memory rewrite control circuit that controls rewrite of the non-volatile memory, and an unauthorized access detection circuit. Here, the unauthorized access detection circuit rewrites the non-volatile memory rewrite control unit when the memory protection unit detects that the address output from the central processing unit does not designate the secure program area. To ban

  Thus, when the central processing unit is not executing the program in the secure program area, the rewrite of the electrically rewritable nonvolatile memory is prohibited. In other words, in the non-secure program area where the user program is executed, rewriting of the electrically rewritable nonvolatile memory is prohibited when the program is executed. As a result, it is possible to rewrite the program whose security is to be secured, and to protect the program in the secure program area from being rewritten by the program in the non-secure program area.

  Furthermore, in another embodiment, a program to be secured is encrypted and provided to a semiconductor device formed in one semiconductor chip. Here, the semiconductor device includes an electrically rewritable non-volatile memory, a central processing unit coupled to the non-volatile memory and capable of executing the written program, and an encrypted program provided A decryption circuit that decrypts the encryption and a rewriting circuit that writes the program decrypted by the decryption circuit directly to the non-volatile memory are provided.

  Thus, even if the central processing unit can be operated arbitrarily by the user program, the decrypted program is directly written to the non-volatile memory, so that the program can be protected.

  According to one embodiment, it is possible to provide a semiconductor device capable of arbitrarily operating the central processing unit while protecting a secure program.

FIG. 1 is a system diagram showing a configuration of a semiconductor device sales model according to a first embodiment. FIG. 1 is a block diagram showing a configuration of a microcomputer according to Embodiment 1; FIG. 2 is a block diagram showing a configuration of a memory protection unit according to Embodiment 1. It is an explanatory view explaining protection of a memory. It is a schematic diagram of a secure program. FIG. 5 is an explanatory diagram for explaining protection of a memory by a memory protection unit according to the first embodiment. (A) and (B) are a block diagram showing configurations of a fetch start address monitoring circuit and a fetch address comparing circuit according to the first embodiment, and an explanatory view showing a secure program area. (A)-(D) are timing diagrams which show operation | movement of the memory protection unit concerning Embodiment 1. FIG. (A)-(D) are timing diagrams which show operation | movement of the memory protection unit concerning Embodiment 1. FIG. 5 is a table showing the operation of the memory protection unit according to the first embodiment. FIG. 18 is an explanatory diagram for explaining protection of a memory by a memory protection unit according to a modification of the first embodiment. FIG. 16 is a layout view showing a layout of data stored in a flash memory according to a second embodiment. FIG. 7 is a block diagram showing the configuration of a microcomputer according to Embodiment 2; FIG. 7 is a block diagram showing a configuration of an unauthorized access detection circuit according to a second embodiment. FIG. 10 is a block diagram showing a configuration of a microcomputer according to Embodiment 3. FIG. 16 is a block diagram showing the configuration of a microprocessor according to Embodiment 4; It is a flowchart figure which shows operation | movement of a microprocessor. FIG. 14 is a flowchart showing the operation of the microprocessor according to the fourth embodiment. FIG. 16 is a block diagram showing the configuration of a microprocessor according to Embodiment 4; FIG. 14 is a flowchart showing the operation of the microprocessor according to the fourth embodiment.

  Hereinafter, embodiments of the present invention will be described in detail based on the drawings. Note that, in all the drawings for describing the embodiments, in principle, the same reference numerals are given to the same parts, and the repetitive description thereof will be omitted in principle.

Embodiment 1
<Semiconductor device sales model>
Although a plurality of embodiments will be described below, the semiconductor device described in each embodiment is sold according to a new sales model considered by the present inventors. First, a semiconductor device sales model considered by the present inventors will be described.

  FIG. 1 is a system diagram showing the configuration of a semiconductor device sales model according to the embodiment. In the figure, reference numeral 100 denotes a semiconductor device sales model. Although not particularly limited, in this embodiment, the semiconductor device sales model 100 is configured by a seller PRD, a user USR, and a third party OTH that provides a program.

  The seller PRD sells the microcomputer LSI to the user USR. In the microcomputer LSI, a plurality of circuit blocks are formed on one semiconductor chip by a known semiconductor manufacturing method. The plurality of circuit blocks formed on the semiconductor chip include an electrically rewritable nonvolatile memory FRM, a microprocessor (hereinafter also referred to as a central processing unit) CPU and a license that operate according to a program written in the nonvolatile memory FRM. A management unit RCNT is included. This microcomputer LSI may be manufactured by the seller PRD, or may be manufactured by a semiconductor manufacturer (not shown) and sold by the seller PRD.

  The seller PRD has a server P-SV in which many types of programs are stored. The programs stored in the server P-SV include a paid program that is required to be granted a license and a free program that is not required to be granted a license when the program is executed. Before selling the microcomputer LSI to the user USR, the seller PRD writes one or more types of programs in the non-volatile memory FRM in the microcomputer LSI. Here, it is assumed that the program of the RTOS, which is a paid program, is written to the non-volatile memory FRM. If the program of RTOS, which is a paid program, is illegally created as a copy etc., the license fee will not be collected. Therefore, the RTOS program corresponds to a program whose security is to be secured, ie, a secure program.

  When selling the microcomputer LSI to the user USR, the seller PRD is required to license the RTOS, which is a paid program, for the value of the microcomputer LSI in a state where the program is not written in the non-volatile memory FRM. The license fee (license consideration) is added to determine the value (sales price) of the microcomputer in which the RTOS program is written to the non-volatile memory FRM. The selling price of the microcomputer in which the program of the RTOS is written in the non-volatile memory FRM for sales promotion and the like fluctuates.

  The user USR purchases the microcomputer LSI having the nonvolatile memory FRM in which the program of the RTOS is written in advance by paying the price including the license fee of the program of the RTOS as shown by a broken line. The user USR includes, but is not limited to, a server U-SV. The server U-SV is connected to the server P-SV of the seller PRD and / or the server O-SV of the third party OTH, for example, via the network NTW. The user USR downloads a paid program or / and a free program to the server U-SV from the seller PRD or / and the third party server P-SV, O-SV via the network NTW to the server U-SV. Store in SV. Uther USR purchased, for example, the user program U-AP created by the user USR itself and the program O-AP stored in the server U-SV so that the desired function is achieved by the purchased microcomputer LSI. It writes in non-volatile memory FRM of microcomputer LSI.

  In this case, the user program U-AP and the program O-AP from the server U-SV are created to operate on the RTOS program. For example, the user program U-AP and the program O-AP have been created so as to effectively use the subroutine in the RTOS program. A function desired by the user USR is realized by the microcomputer LSI by the microprocessor CPU executing the RTOS program, the user program U-AP and the program O-AP stored in the non-volatile memory FRM. .

  The user creates the user program U-AP so as to use the RTOS program. This makes it possible to reduce the burden on the user USR when creating the user program U-AP.

  Although not particularly limited, in this embodiment, the microcomputer LSI includes a license management unit RCNT. When selling the microcomputer LSI to the user USR, the seller PRD writes and sells license information corresponding to the number of licenses desired by the user USR in the non-volatile memory FRM. The selling price of the microcomputer LSI in this case further includes a license fee corresponding to the number of licenses desired by the user USR.

  When the user USR writes a program in the non-volatile memory FRM, the license management unit RCNT determines whether the program to be written is a paid program. If the program to be written is a paid program, the license information stored in advance in the non-volatile memory FRM is referenced to determine whether the number of licenses is one or more. If the number of licenses is one or more, the license management unit RCNT writes the program to the non-volatile memory FRM, and if the number of licenses is less than one, the writing to the non-volatile memory FRM is inhibited. When the program is written to the non-volatile memory FRM, the license management unit RCNT updates the number of licenses represented by the license information stored in the non-volatile memory FRM so as to reduce the number of licenses by one.

  In this embodiment, the license fee is prepaid when the microcomputer LSI is purchased, and the user USR uses the paid program in the non-volatile memory FRM until the prepaid license fee runs short. It will be possible to install and run. As described above, since the license fee is prepaid, it is possible to prevent the license fee from being uncollected, and to facilitate the management of the license fee payment.

  Here, an example has been shown in which the seller PRD writes license information corresponding to the number of licenses desired by the user USR in the non-volatile memory FRM before sales, but the present invention is not limited to this. For example, the seller PRD may prepare a microcomputer LSI in which license information corresponding to a predetermined number of licenses is written.

  Although the semiconductor device sales model in the case of selling the microcomputer LSI is shown, the semiconductor device to be sold is not limited to the microcomputer LSI.

<Configuration of microcomputer>
FIG. 2 is a block diagram showing the configuration of the microcomputer LSI according to the first embodiment. As described in FIG. 1, in the microcomputer LSI, a plurality of circuit blocks are formed on one semiconductor chip by a known semiconductor manufacturing technology. FIG. 2 shows a part of the plurality of circuit blocks described above. That is, only the circuit blocks necessary to explain this embodiment are shown. For example, the license management unit RCNT described in FIG. 1 is omitted. Further, in the microcomputer LSI shown in FIG. 2, a case where a so-called flash memory is used as the electrically rewritable nonvolatile memory FRM is shown. The flash memory is given the same reference numeral FRM as the non-volatile memory shown in FIG.

  FIG. 2 shows the state of the microcomputer LSI sold from the seller PRD to the user USR. That is, the state of the microcomputer LSI is shown, which the user USR pays to the seller PRD and purchases from the seller PRD, including the value of the program of the real time operating system (RTOS). Therefore, the program of RTS is written in and stored in the flash memory FRM. Further, FIG. 2 shows that the microcomputer LSI is connected to the server P-SV of the seller PRD via the network NTW in order to upgrade the program (for example, the program of the RTOS) written in the flash memory FRM. The state is shown. In FIG. 2, the server U-SV of the user USR is omitted in order to avoid the drawing becoming complicated.

  In FIG. 2, 200 denotes a communication function circuit, 201 denotes an encryption / decryption function circuit, 202 denotes a flash memory rewriting circuit, 203 denotes a volatile memory, 204 denotes a memory protection unit, 205 denotes a bus, and 206 denotes signal wiring.

  The communication function circuit 200 transmits and receives data between the outside and the inside of the microcomputer LSI. For example, the upgraded version of the program (software) is received from outside the microcomputer LSI and stored. The decryption function circuit 201 decrypts the encrypted program and converts it into an unencrypted program (decrypted program). The flash memory rewrite circuit 202 writes the supplied data, for example, a program into the flash memory FRM. The volatile memory 203 is, for example, a static memory or a dynamic memory, and temporarily stores data such as a program. The memory protection unit 204 will be described in detail later, but based on the information from the flash memory FRM and the information from the microprocessor (central processing unit) CPU, the memory from the microprocessor CPU (flash memory FRM and volatile memory Control access to 203).

  For example, in order to upgrade the program stored in the flash memory FRM, the microcomputer LSI is connected to the network NTW, and the upgraded program is downloaded to the microcomputer LSI. At the time of this download, the program is likely to be stolen. Therefore, the operation at the time of downloading will be described below.

  The program is encrypted. Therefore, even if the program is stolen from the server P-SV, the program can not be executed. Similarly, when downloading a program, the program passes through the network NTW, but since the program is also encrypted at this time, even if it is stolen, the program can not be executed.

  When the program is supplied to the microcomputer LSI via the network NTW, the communication function circuit 200 receives and stores data which is the program. Next, the microprocessor CPU receives data, which is a program, from the communication function circuit 200 through the bus 205, and transfers the data to the volatile memory 203 through the bus 205. Since the program stored in the volatile memory 203 is encrypted, the microprocessor CPU then decrypts the encrypted program stored in the volatile memory 203 via the bus 205. Transfer to the functional circuit 201. The encryption / decryption function circuit 201 decrypts the encryption and converts it into an unencrypted program. The microprocessor CPU transfers this unencrypted program to the volatile memory 203 via the bus 205.

  Thereafter, the microprocessor CPU transfers the unencrypted program stored in the volatile memory 203 to the flash rewriting circuit 202 via the bus 205. The flash rewrite circuit 202 writes the supplied unencrypted program into the flash memory FRM. Thus, for example, the upgraded version of the program is stored in the flash memory FRM. The microprocessor CPU reads and executes the upgraded program stored in the flash memory FRM.

  As understood from the above description of the operation, when the program is downloaded and written to the flash memory FRM, the encryption / decryption function circuit 201, the flash memory rewrite circuit 202, the volatile memory 203, and the microprocessor CPU are encrypted. There is a period of time when there is a program that has not been Also, in the flash memory FRM, an unencrypted program is present. Therefore, it is required to protect the unencrypted program from being stolen while the unencrypted program exists. Further, it is also required to protect the unencrypted program existing in the flash memory FRM from being stolen.

  In the first embodiment, focusing on the fact that only the microprocessor CPU has the function of accessing the memory such as the volatile memory 203 and the flash memory FRM, the memory protection unit 204 can access the area accessible by the microprocessor CPU. It is intended to set limits. In this case, the information specifying the area is directly transmitted from the flash memory FRM to the memory protection unit 204 by the signal wiring 206 without passing through the bus 205.

  In FIG. 2, Pin provided on each side of the microprocessor LSI schematically indicates an external terminal (pin) of the microprocessor LSI.

<Configuration of Memory Protection Unit>
Next, the configuration of the memory protection unit 204 will be described with reference to FIG. FIG. 3 is a block diagram showing the configuration of the memory protection unit according to the first embodiment. In the same figure, a microprocessor CPU and a flash memory FRM are also shown for convenience of explanation.

  The program is composed of a plurality of instructions. The microprocessor CPU outputs an address specifying an instruction to be executed from a plurality of instructions in the program. That is, the microprocessor CPU has a program counter, and the address specifying an instruction to be executed is formed by the program counter. In FIG. 3, the address formed by the program counter, that is, the address specifying an instruction to be executed is shown as a PC address 306. Further, data input / output by the microprocessor CPU is indicated by reference numeral 307.

  In the first embodiment, when the seller PRD writes a program to be secured in the flash memory (nonvolatile memory) FRM and sells the program (secure program) to be secured. The secure address information 304 specifying the program area of the stored flash memory FRM is written in the flash memory FRM and sold. At this time, the seller PRD writes, in the flash memory FRM, secure data information 305 specifying a data area for storing data (secure data) for which security is to be secured in the volatile memory 203 (FIG. 2). .

  Since the RTOS program is a paid program, it is a secure program. Therefore, the secure address information 304 specifying the program area of the flash memory FRM in which the RTOS program is written and the data area of the volatile memory 203 storing the data to be secured when the RTOS program operates are specified Secure data information 305 is written to the flash memory FRM. The writing of the secure address information 304 and the secure data information 305 is performed before the seller PRD sells the microprocessor LSI, like the program of RTSO.

  Any program (non-secure program) which is not required to secure security, such as a free program and user program U-AP, is written in a program area different from the program area of flash memory FRM specified by secure address information 304 Will be Similarly, data not required to ensure security (non-secure data), such as data generated when the free program and user program U-AP are operated, is stored in volatile memory 203 specified by secure data information 305. It is stored in a data area different from the data area.

  When the program area of the flash memory FRM in which the non-secure program is written is regarded as a first program area, the program area of the flash memory FRM in which the secure program is written can be regarded as a second program area. In this case, the second program area is identified by the secure address information 304. On the other hand, the program area of the flash memory FRM not specified by the secure address information 304 is the first program area. Of course, the first program area of the flash memory FRM may be specified by the non-secure address information.

  Similarly, when the data area of volatile memory 203 where non-secure data is stored is regarded as a first data area, the data area of volatile memory 203 where secure data is stored is regarded as a second data area. be able to. Also in this case, the second data area is identified by the secure data information 305. On the other hand, the data area of the volatile memory 203 not specified by the secure data information 305 is the first data area. Of course, the first data area of the volatile memory 203 may be specified by non-secure data information.

  The secure address information 304 and the secure data information 305 are directly supplied from the flash memory FRM to the memory protection unit 204 through the signal wiring 206 shown in FIG.

  The memory protection unit 204 includes a fetch start address monitoring circuit 300, a fetch address comparison circuit 301, and a memory access control circuit 303. The PC address 306 from the microprocessor CPU and the secure address information 304 from the flash memory FRM are supplied to the fetch start address monitoring circuit 300 and the fetch address comparison circuit 301, respectively. An example of the fetch start address monitoring circuit 300 and the fetch address comparison circuit 301 will be described later with reference to FIG. 7 and the like, so an outline will be described here.

  The fetch address comparison circuit 301 compares the PC address 306 with the secure address information 304, and selects whether the PC address 306 designates the second program area specified by the secure address information 304 or not. Output a signal. In the first embodiment, the program area of the flash memory FRM excluding the second program area specified by the secure address information 304 is a non-secure program area. Therefore, when the PC address 306 designates the secure program area (second program area), the selection signal output from the fetch address comparison circuit 301 should be regarded as a secure program area signal specifying the secure program area. When the PC address 306 designates a non-secure program area (first program area), it can be regarded as a non-secure program area signal designating the non-secure program area.

  When the selection signal output from the fetch address comparison circuit 301 indicates, for example, a secure program area, the secure program is prevented from being stolen by configuring the microcomputer LSI so that security is secured. It becomes possible.

  The secure address information 304 may be set, for example, to a fixed value in advance, and can not be changed. In this case, it becomes difficult to change the secure program area when the secure program stored in the flash memory FRM is changed, or when the secure program is changed after the user USR purchases the microcomputer LSI. . If the secure program area can not be changed, security becomes difficult to secure, for example, when the size of the secure program becomes large.

  For example, in order to enable the user USR to change the secure address information 304 after purchasing the microcomputer LSI, the secure address information 304 should be stored in volatile memory such as a register. It is possible to do. In this case, if the user USR can not operate the microprocessor CPU in the microcomputer LSI, it is difficult for the user USR to operate the register storing the secure address information 304. As a result, it is possible to change the secure program area while securing security.

  However, in the first embodiment, after the user USR purchases the microcomputer LSI, the user USR creates, for example, a user program U-AP for operating the microprocessor CPU. That is, the user USR can operate the microprocessor CPU. Therefore, it becomes possible for the user USR to create software (non-secure program) for operating volatile memory such as a register storing the secure address information 304. By changing the secure dress information 304 stored in the register, the secure program can be stolen.

  In the first embodiment, the secure address information 304 and the secure data information 305 are written into the electrically rewritable flash memory FRM before the seller PRD sells the microcomputer LSI. Thereby, secure address information 304 and secure data information 305 corresponding to the secure program can be written to the flash memory FRM. In addition, the seller PRD can change the secure address information 304 and the secure data information 305 as needed even after the sale. Since secure address information 304 and secure data information 305 stored in the flash memory FRM are not changed by software (non-secure program) created by the user USR, security can also be secured.

  In the first embodiment, the secure address information 304 and the secure data information 305 are supplied from the flash memory FRM to the memory protection unit 204 through the signal wiring 206 different from the bus 205. This makes it possible to prevent the secure address information 304 and the secure data information 305 from being read by the user USR even if the user USR operates the microprocessor CPU.

  Fetch start address monitoring circuit 300 receives secure address information 304, PC address 306 and a selection signal from fetch address comparison circuit 301, and outputs a secure data access permission signal 302.

  In the first embodiment, the user program U-AP or the like operates on the RTOS program. The user program U-AP or the like is a non-secure program because it is created by the user USR, and is written in the non-secure program area of the flash memory FRM. Since the user program U-AP operates on the RTOS program, the RTOS program is called from the user program U-AP.

  The RTOS program comprises a plurality of subroutines that achieve different functions. The user program U-AP will call a subroutine that achieves a desired function from a plurality of subroutines. The subroutine call here is performed by a branch. That is, an operation occurs in which the user program U-AP, which is a non-secure program, branches to a subroutine selected from a plurality of subroutines included in the RTOS program. Although an example will be described later with reference to FIG. 5 and the like, in a configuration where it is monitored whether the PC address 306 designates a secure program area, against an attack when branching from a non-secure program to a secure program. There is a problem that

  As will be described in detail later with reference to FIG. 7 and the like, the fetch start address monitoring circuit 300 determines that the branch destination address is a branch permitted area (first area It is determined whether or not the inside is specified. If the branch permitted area is designated, the secure data access permit signal 302 permits the microprocessor CPU to access the secure program area in the flash memory FRM, for example. This protects against attacks when branching from a non-secure program to a secure program.

  The memory access control circuit 303 receives the secure data information 305 from the flash memory FRM, the secure data access permission signal 302, the PC address 306 and the input / output data 307, and outputs the access signal 308 for the flash memory FRM and volatile memory 203. Do. That is, when the access to the memory is permitted by the secure data access permission signal 302, the memory access control circuit 303 sends the address signal corresponding to the PC address 306 to the memory (flash memory FRM, volatile memory 203). It outputs and permits transmission and reception of data 307 between the address in the memory designated by the address signal and the microprocessor CPU. On the other hand, when the secure data access permission signal 302 prohibits the access to the memory, the memory access control circuit 303 prohibits the transmission and reception of the data 307 between the memory and the microprocessor CPU.

<Example of attack>
FIG. 4 is an explanatory diagram for explaining a case where the memory is protected using the fetch address comparison circuit 301 and the memory access control circuit 303 shown in FIG. That is, FIG. 4 shows the case where the memory protection unit does not have the fetch start address monitoring circuit 300 shown in FIG.

  In the first embodiment, the non-secure program and the secure program are stored in the flash memory FRM, and the non-secure data and the secure data are stored in the volatile memory 203. The flash memory FRM stores secure address information 304 for specifying a secure program area for storing a secure program, and secure data information 305 for specifying a secure data area for storing secure data.

  The area (space) of the flash memory FRM is divided by the secure address information 304 into a non-secure program area in which the non-secure program is stored and a secure program area in which the secure program is stored. The area (space) of the volatile memory 203 is divided by the secure data information 305 into a non-secure data area in which non-secure data is stored and a secure data area in which secure data is stored.

  Both non-secure programs and secure programs are binary signals and can be regarded as data. Therefore, in FIG. 4, the non-secure program area storing the non-secure program and the non-secure data area storing the non-secure data are collectively shown as a non-secure data area. Similarly, a secure program area for storing a secure program and a secure data area for storing secure data are collectively shown as a secure data area in FIG. In this specification, unless otherwise specified, non-secure data means both non-secure program and non-secure data, and secure data means both secure program and secure data.

  In FIG. 4, an example in which the non-secure data area is a non-secure program area storing a non-secure program and the secure data area is a secure program area storing a secure program will be described.

  When PC address 306 designates the secure program area, that is, when the secure program is being executed, the select signal output from fetch address comparison circuit 301 is a memory access control circuit as a secure program area signal. It is supplied to 303. When the PC address 306 designates the secure program area in response to the secure program area signal, the memory access control circuit 303 causes the microprocessor CPU to set the secure data area (secure program area) and the non-secure data area. Allow access to both (non-secure program area). That is, data 307 can be transmitted / received by specifying either the secure data area or the non-secure data area by the PC address 306. Thereby, as shown in FIG. 4, from the secure program arranged in the secure program area, access is permitted to both the non-secure data area and the secure data area (referred to as access permission).

  On the other hand, when the PC address 306 designates the non-secure program area outside the secure program area, the selection signal output from the fetch address comparison circuit 301 is a non-secure program area signal designating the non-secure program area. It becomes. When the selection signal is a non-secure program area signal, the memory access control circuit 303 permits the microprocessor CPU to access the non-secure data area and prohibits the access to the secure data area. That is, in this case, when the PC address 306 designates the inside of the non-secure data area, transmission and reception of the data 307 is permitted, and when the PC address 306 designates the inside of the secure data area, the data 307 Sending and receiving are prohibited. Thereby, as shown in FIG. 4, from the non-secure program disposed in the non-secure program area, access to the non-secure data area is permitted (described as access permission), and the secure data area is Access will be prohibited (described as access prohibited).

  If there is a security hole in the secure program located in the secure program area, the hacking program is located in the non-secure program area, and the hacking program is stored in the secure data area by executing it with the microprocessor CPU It is possible to steal certain data (programs). That is, in a hacking program executed as a non-secure program, it branches to an address shown as a security hole in FIG. This branching causes a security program having a security hole to operate. Since this is a security program, access to the secure data area is permitted, and secure data (program) stored in the secure data area can be stored, for example, in a register or the like in the microprocessor CPU. With this secure data (program) stored in the register, the secure program returns to the hacking program which is a non-secure program. When returning, it is possible to steal secure data (program) by reading the contents of the register. In FIG. 4, the branch generated by the attack and the access to the memory (flash memory FRM) are shown as hacking.

  Here, the case where the secure data area is the secure program area has been described, but in the case where the secure data area is the secure data area in the volatile memory 203, the secure data stored in the volatile memory 203 is It would be possible to steal.

<Example of security hole>
FIG. 5 is a schematic view showing an example of a secure program in which a security hole exists. The RTOS program is stored in the secure program area of the flash memory FRM. The RTOS program has a plurality of subroutines as described above. FIG. 5 shows an example of a subroutine in which a security hole exists among a plurality of subroutines.

  The subroutine is called by a branch from the main routine (or the upper routine). That is, in the main routine, the value of the PC address 306 is set to a value specifying the address shown as the start address in FIG. Thereby, the main routine branches to a subroutine shown in FIG. In one example, the main routine stores a branch instruction whose start address is the branch destination address, and the branch is executed by the microprocessor CPU executing this branch instruction.

  In the subroutine, the instruction Ex-A stored at the address specified by the start address is executed first. By executing this instruction Ex-A, for example, the values of the registers and the like used in the processing of the main routine are saved in the stack area designated by the stack pointer (not shown). Next, the value of the PC address 306 changes in order from the start address to the end address. As a result, the instruction Ex-B to the instruction Ex-P are read by the microprocessor CPU in this order and executed in order. Thereby, predetermined processing is performed, and the function of the subroutine is achieved. When the value of the PC address 306 reaches the value indicating the end address, the instruction Ex-Z is executed. By executing the instruction Ex-Z, the values of the register and the like stored in the stack area previously designated by the stack pointer are restored to the register in the microprocessor CPU. As a result, the value of the register in the microprocessor CPU returns to the state before branching to the subroutine.

  As described above, when branching from the main routine to the subroutine, predetermined processing is executed by branching to a predetermined start address.

  In FIG. 5, when executing a predetermined process, the PC address 306 designates the secure program area, so the fetch address comparison circuit 301 outputs a secure program area signal. Therefore, the memory access control circuit 303 permits the microprocessor CPU to access the memory (flash memory FRM). For example, if the instruction Ex-S shown in FIG. 5 is a specific store instruction, this specific store instruction may be a security hole. This particular store instruction takes, for example, a value held in a particular register (hereinafter referred to as R0 for convenience of explanation) in the microprocessor CPU as an address, to the address in the secure data area designated by this address. The stored data (instruction) is an instruction to be stored in another specific register (hereinafter referred to as R1 for convenience of explanation) in the microprocessor CPU.

  In the hacking program, after setting the address in the secure data area to be read in the specific register R0, not the start address but the address storing the specific store instruction Ex-S as the branch destination address, as shown in FIG. Branch to the subroutine shown in. That is, when branching from the hacking program to the subroutine, the value of the PC address 306 is set not to the start address but to the address (branch destination address) of the security hole (specific store instruction Ex-S). As a result, saving and restoring of the specific register R1 is not performed, and the secure data (instruction) stored in the specific register R1 can be read by the hacking program.

  A large number of such security holes are considered to exist, and it is difficult to eliminate all the security holes.

<Anti-attack>
FIG. 6 illustrates the case of protecting memory against attack using the memory protection unit 204 using the fetch address comparison circuit 301, the fetch start address monitoring circuit 300 and the memory access control circuit 303 shown in FIG. FIG. FIG. 6 is similar to FIG. 4 described above. Here, differences from FIG. 4 will be mainly described.

  As described in FIG. 5, when branching off from the non-secure program to the secure program stored in the secure program area, the attack directly branches to the security hole without branching to the start address determined by the secure program. Is done. Although an example will be described later with reference to FIG. 7, the secure program area is divided into a branch permitted area (first area) BAA and a branch prohibited area (first area) by the fetch address comparison circuit 301 and the fetch start address monitoring circuit 300. And the second region BPA. Here, the start address of the secure program is allocated in the branch permission area BAA, and the branch destination address specifying the security hole is allocated in the branch prohibition area BPA. That is, taking FIG. 5 as an example, the instruction Ex-A (first instruction) is disposed in the branch permission area BAA, and the other instructions Ex-B to Ex-Z (second instruction) excluding the instruction Ex-A are , The branch prohibition area BPA.

  When calling the secure program stored in the secure program area from the non-secure program stored in the non-secure program area, the fetch start address monitoring circuit 300 specifies the branch permitted area BAA as the address of the branch destination at the time of the call. If so, it outputs a secure data access permission signal 302 that permits memory access. On the other hand, when the branch destination address at the time of calling designates the branch prohibited area BPA, the fetch start address monitoring circuit 300 outputs the secure data access permission signal 302 for prohibiting the memory access. When the secure data access permission signal 302 indicates permission of memory access, the memory access control circuit 303 permits the microprocessor CPU to access the memory (flash memory FRM), and the secure data access permission signal 302 indicates that If the memory access is prohibited, the microprocessor CPU is prohibited from accessing the memory.

  When a non-secure program that is not a hacking program calls a secure program, the secure program can be executed because it outputs an address of a branch destination that specifies the inside of the branch permission area BAA. On the other hand, when the hacking program calls the address corresponding to the security hole as the address of the branch destination, the branch destination address specifying the branch prohibited area BPA is output. Therefore, in this case, access to the memory by the microprocessor CPU is prohibited. As a result, it is possible to prevent the hacking program from performing hacking.

<Configuration of Fetch Start Address Monitoring Circuit and Fetch Address Comparison Circuit>
Next, configurations of the fetch start address monitoring circuit 300 and the fetch address comparison circuit 301 described with reference to FIG. 3 will be described with reference to FIGS. 7A and 7B. FIG. 7A is a block diagram showing configurations of fetch start address monitoring circuit 300 and fetch address comparison circuit 301 according to the first embodiment. FIG. 7B is an explanatory view of a secure program area according to the first embodiment.

  The secure address information 304 shown in FIG. 3 includes a secure program upper limit address 304-U (upper limit address information) indicating the upper limit address of the secure program area storing the secure program, and a secure program lower limit address indicating the lower limit address of the secure program area. 304-D (lower limit address information). The area of the flash memory FRM designated by the secure program upper limit address 304-U and the secure program lower limit address 304-D becomes a secure program area (second program area) for storing a secure program. In other words, the secure program area of the flash memory FRM in which the secure program is written is specified by the secure program upper limit address 304-U and the secure program lower limit address 304-D.

  In the first embodiment, the value of the upper limit address 304-U is larger than the value of the lower limit address 304-D. When executing the program, the value of the PC address 306 changes from the secure program upper limit address 304-U toward the secure program lower limit address 304-D. Thus, the microprocessor CPU proceeds from the instruction stored in the address specified by the upper limit address 304-U to the instruction stored in the address specified by the lower limit address 304-D, Reads an instruction from FRM and executes the read instruction. That is, the microprocessor CPU reads and executes an instruction from a large address to a small address.

  The fetch address comparison circuit 301 includes comparators 704 and 705, a two-input AND circuit 706 (first logic circuit), and an inverter circuit 708 (first logic circuit).

  The comparator 704 (first comparison circuit) compares the secure program upper limit address 304-U with the PC address 306, and when the value of the PC address 306 is less than or equal to the value of the secure program upper limit address 304-U, the high level The comparison result signal 704-R is output. Conversely, when the value of the PC address 306 exceeds the value of the secure program upper limit address 304-U, the comparator 704 outputs a low level comparison result signal 704-R.

  The comparator 705 (second comparison circuit) compares the secure program lower limit address 304-D with the PC address 306, and when the value of the PC address 306 is greater than or equal to the value of the secure program lower limit address 304-D, the high level The comparison result signal 705 -R is output. Conversely, when the value of the PC address 306 is less than the value of the secure program lower limit address 304-D, the comparator 705 outputs a low level comparison result signal 705-R.

  Comparison result signals 704 -R and 705 -R output from the comparators 704 and 705, respectively, are input to the 2-input AND circuit 706. Two-input AND circuit 706 determines the logical product of comparison result signals 704 -R and 705 -R. The output signal 707 of the two-input AND circuit 706 is supplied to the inverter circuit 708 and is inverted in phase by the inverter circuit 708.

  When the value of the PC address 306 is between the value of the secure program upper limit address 304-U and the secure program lower limit address 304-D, each of the comparison result signals 704-R and 705-R becomes high level, The output signal 707 of the 2-input AND circuit 706 becomes high level. As a result, the output signal 709 of the inverter circuit 708 becomes low level. That is, when the address represented by PC address 306 designates the secure program area designated by secure program upper limit address 304-U and secure program lower limit address 304-D, the output signal of 2-input AND circuit 706 The signal 707 goes high, and the output signal 709 of the inverter circuit 708 goes low.

  On the other hand, when the value of the PC address 306 exceeds the value of the secure program upper limit address 304-U or is smaller than the value of the secure program lower limit address 304-D, the output signal 707 of the 2-input AND circuit 706 becomes low level. The output signal 709 of the inverter circuit 708 becomes high level. That is, when the address represented by the PC address 306 designates other than the secure program area, the output signal 707 becomes low level and the output signal 709 becomes high level.

  Therefore, output signals 707 and 709 can be regarded as selection signals indicating whether the secure program area is selected or the non-secure program area is selected. The output signal 707 goes high when the secure program area is selected. Thus, the output signal 707 can be considered as a secure program domain signal 707. Similarly, the output signal 709 goes high when the non-secure program area is selected. Therefore, the output signal 709 can be regarded as the non-secure program area signal 709.

  The comparators 704 and 705, the two-input AND circuit 706, and the inverter circuit 708 can be considered to constitute a first comparison unit. In this case, the PC address counter designates the secure program area by monitoring the secure program area signal 707 or / and the non-secure program area signal 709 (first comparison output) formed by the first comparison unit. It is possible to determine whether or not a non-secure program area is specified.

  The fetch start address monitoring circuit 300 includes a comparator 700, a two-input AND circuit 701, and a flip flop circuit 703.

  The secure program upper limit address 304-U and the PC address 306 are supplied to the comparator 700 (third comparison circuit). The comparator 700 compares the PC address 306 with the value (upper limit address-4) obtained by subtracting 4 from the value of the secure program upper limit address 304-U. When the value of the PC address 306 is equal to or greater than the value obtained by subtracting 4 from the value of the secure program upper limit address 304-U (upper limit address-4), the comparator 700 sets the comparison result signal 700-R at high level. Output. On the other hand, when the value of the PC address 306 is less than the value (upper limit address -4) obtained by subtracting 4 from the value of the secure program upper limit address 304-U, the comparator 700 outputs a low level comparison result signal 700-R. Output

  The comparison result signal 700 -R and the comparison result signal 704 -R of the comparator 704 described above are supplied to the 2-input AND circuit 701 (second logic circuit). An output signal of the 2-input AND circuit 701 is supplied to the flip flop circuit 703 as a secure program branch permission area signal 702.

  The flip flop circuit 703 includes a set terminal (set), a clear terminal (clear) and an output terminal (Q), and the output terminal becomes high level by supplying the high level to the set terminal. The high level of the output terminal is maintained (held) until the clear terminal is supplied with the high level. By supplying a high level to the clear terminal, the output terminal changes to the low level.

  The secure program branch permission area signal 702 which is the output signal of the 2-input AND circuit 701 is supplied to the set terminal (set) of the flip flop circuit 703, and the output signal of the inverter circuit 708 described above, ie, the non secure program area signal 709 , And the clear terminal (clear) of the flip flop circuit 703. A signal output from the output terminal (Q) of the flip flop circuit 703 is supplied as the secure data access permission signal 302 to the memory access control circuit 303 shown in FIG.

  The relationship between the secure program upper limit address 304-U, the secure program lower limit address 304-D, and the value (upper limit address -4) obtained by subtracting 4 from the value of the secure program upper limit address 304-U is shown in FIG. 7 (B). In FIG. 7B, upper limit address 304-U and lower limit address 304-D are indicated by solid lines, and a value obtained by subtracting 4 from the value of secure program upper limit address 304-U (upper limit address -4). ) Are shown by dashed lines.

  In FIG. 7B, when the value (address) of the PC address 306 is smaller than the value (address) indicated as the upper limit address 304-U, as described above, the comparison result signal 704-R is: It becomes high level. On the other hand, when the value of the PC address 306 is 4 or more lower than the upper limit address 304-U (upper limit address-4) or more, the comparator 700 outputs the comparison result signal 700-R at high level. Therefore, the 2-input AND circuit 701 outputs the high level secure program branch permission area signal 702 when the value of the PC address is equal to or less than the value of the upper limit address 304-U and equal to or more than the value of the upper limit address-4. become. The secure program branch allowance region signal 702 (second comparison output) can be considered to be formed by the second comparison unit configured by the comparators 700 and 704 and the two-input AND circuit 701. In this case, the comparator 704 is shared by the first comparison unit and the second comparison unit.

  Although the secure program is placed in the secure program area, the program area specified by the value of upper limit address 304-U and the value of (upper limit address -4) at the time of arrangement is the start address of the secure program (see FIG. 5) At this start address, an instruction executed first at the time of branching, and in the example of FIG. 5, an instruction Ex-A for saving a register or the like is arranged.

  For example, when the value of the PC address 306 is less than the value of the lower limit address 304-D, the comparator 704 outputs a high level comparison result signal 704-R, and the comparators 700 and 705 compare low levels. The result signals 700-R and 705-R will be output. As a result, each of the secure program branch permission area signal 702 and the secure program area signal 707 becomes low level, and the non-secure program area signal 709 becomes high level. As a result, the high level is supplied to the clear terminal of the flip flop circuit 703, so the output terminal of the flip flop circuit 703 becomes low level, and the low level secure data access permission signal 302 is supplied to the memory access control circuit 303. It will be

  When the value of the PC address 306 exceeds the value of the upper limit address 304-U, the comparator 704 outputs a low level comparison result signal 704-R, and the comparators 700 and 705 output a high level. The comparison result signals 700-R and 705-R are output. As a result, each of the secure program branch permission area signal 702 and the secure program area signal 707 becomes low level, and the non-secure program area signal 709 becomes high level. As a result, the high level is supplied to the clear terminal of the flip flop circuit 703, so the output terminal of the flip flop circuit 703 becomes low level, and the low level secure data access permission signal 302 is supplied to the memory access control circuit 303. It will be

  When the value of the PC address 306 is less than or equal to the value of the upper limit address 304-U and is greater than or equal to the value of (upper limit address -4), the comparison result signal of high level from each of the comparators 700, 704 and 705 700-R, 704-R and 705-R will be output. As a result, each of the secure program branch permission area signal 702 and the secure program area signal 707 becomes high level, and the non-secure program area signal 709 becomes low level. As a result, the high level is supplied to the set terminal of the flip flop circuit 703, so the output terminal of the flip flop circuit 703 becomes high level, and the secure data access permission signal 302 of high level is output to the memory access control circuit 303. It will be supplied.

  The memory access control circuit 303 permits the microprocessor CPU to access the memory when the secure data access permission signal 302 goes high. That is, the memory access control circuit 303 supplies the PC address 306 at this time to the memory so that data can be transmitted and received between the memory and the microprocessor CPU. Therefore, when the secure program branch permission area signal 702 becomes high level, the PC address 306 from the microprocessor CPU is supplied to the memory, and data transmission / reception with the memory is enabled.

  On the other hand, when the value of the PC address 306 is less than the value of (upper limit address-4) and greater than or equal to the value of lower limit address 304-D, the comparison result signal 700-R from the comparator 700 becomes low level, High-level comparison result signals 704 -R and 705 -R are output from the comparators 704 and 705, respectively. As a result, each of the secure program branch permission area signal 702 and the non-secure program area signal 709 becomes low level, and the secure program area signal 707 becomes high level. As a result, the low level is supplied to the set terminal and the clear terminal of the flip flop circuit 703, so the output terminal of the flip flop circuit 703 maintains the previous state, and the previous state is high level. For example, the high level secure data access permission signal 302 continues to be supplied to the memory access control circuit 303, and if the previous state is low level, the low level secure data access permission signal 302 is supplied to the memory access control circuit 303. I will continue. Since the previous state is maintained (held) by the flip flop circuit 703, the flip flop circuit 703 can be regarded as a holding circuit.

  The memory access control circuit 303 prohibits the microprocessor CPU from accessing the memory when the secure data access permission signal 302 is at low level. That is, the PC address 306 is prohibited from being transmitted to the memory. This prohibits the transmission and reception of data between the microprocessor CPU and the memory.

  When branching from the non-secure program to the secure program, in the non-secure program, the value of the PC address 306 of the microprocessor CPU is set to the start address (FIG. 5). In this case, the start address is an address in the branch permission area BAA between the upper limit address 304-U and (upper limit address -4). When the PC address of the microprocessor CPU designates this branch permission area, as described above, the secure program branch permission area signal 702 becomes high level and the secure data access permission signal 302 becomes high level. . As a result, the PC address 306 of the microprocessor CPU is transmitted to the memory via the memory access control circuit 303, and the instruction stored in the branch permission area BAA is read out and executed by the microprocessor CPU.

  On the other hand, when the non-secure program branches, for example, from the hacking program to the secure program in the case of a hacking program, in the hacking program, the value of the PC address 306 of the microprocessor CPU is an address other than the start address (FIG. 5) Set to That is, the value of the PC address 306 is designated between (upper limit address-4) and lower limit address 304-D. In this case, the secure program branch allowance area signal 702 goes low, the secure program area signal 707 goes high, and the non-secure program area signal 709 goes low.

  By setting the secure program branch permission area signal 702 and the non-secure program area signal 709 to low level, the voltage of the output terminal (Q) of the flip flop circuit 703 is maintained at the previous voltage. Since this is a branch from the non-secure program, the previous state is the state when the non-secure program was being executed. When the non-secure program is being executed, the non-secure program area signal 709 becomes high level. Therefore, in the previous state, the output terminal (Q) of the flip flop circuit 703 is at the low level. As a result, when it is attempted to branch to the branch prohibition area BPA in the hacking program, the low level secure data access permission signal 302 is continuously output. In the memory access control circuit 303, when the secure data access permission signal 302 continues to be low level, access from the microprocessor CPU to the branch prohibition area in the memory is prohibited.

  In the first embodiment, the secure program area is divided into a branch permission area BAA and a branch prohibition area BPA by the comparators 700, 704 and 705. When branching from the non-secure program to the secure program, if the branch destination address represented by the PC address 306 designates the inside of the branch permission area BAA, access to the memory by the microprocessor CPU is permitted. On the other hand, if the branch destination address represented by the PC address 306 designates the inside of the branch prohibition area BPA, access to the memory by the microprocessor CPU is prohibited. This makes it possible to protect the secure program and secure data from attacks.

  In the first embodiment, branch permitted area BAA is a program area between the value of upper limit address 304-U (branch permitted area upper limit address) and the value of (upper limit address -4) (branch permitted area lower limit address). is there. The branch prohibited area is a program area between the value of BPA, lower limit address 304-D (branch prohibited area lower limit address) and the value of (upper limit address-5) (branch prohibited area upper limit address). Further, in the first embodiment, although not particularly limited, one 1-word instruction stored in the start address (FIG. 5) is configured by 4 bytes. Therefore, the upper limit address 304-U is an address obtained by subtracting 4 from the upper limit address 304-U so that the branch lower limit address is 4 bytes smaller than the upper limit address of the branch permission area BAA. However, the present invention is not limited to this, and the size of the branch allowance area BAA may be determined according to the use of the secure program or the like.

  In addition, although the flip-flop circuit 703 is illustrated as an example of an asynchronous flip-flop circuit, it is possible to use a synchronous flip-flop circuit if there is enough timing for the microprocessor CPU to access the memory. Although it is good, it is desirable to use an asynchronous flip-flop circuit when there is little margin in timing.

  Although an example using three comparators 700, 704 and 705 is shown here, the present invention is not limited to this. For example, two comparators may be used for each of the fetch address comparison circuit 301 and the fetch start address monitoring circuit 300. In this case, the fetch start address monitoring circuit 300 may be provided with a comparator similar to the comparator 704 as a fourth comparator. By setting the upper limit address to be compared by the fourth comparator to be an address different from the upper limit address to be compared by the comparator 704, the branch permission area BAA may be set arbitrarily.

  However, in the fetch address comparison circuit 301 and the fetch start address monitoring circuit 300, the number of comparators is reduced by making the upper limit address 304-U or the lower limit address 304-D common as an address to be compared with the PC address 306. It becomes possible. In this case, the branch permission area BAA may be defined by the permission address information on the basis of the upper limit address 304-U (or the lower limit address 304-D). In the first embodiment, the permitted address information is set to -4, and the lower limit address of the branch permitted area BAA is set to (upper limit address -4) based on the upper limit address 304-U.

<Operation of Memory Protection Unit>
Next, the operation when branching from the non-secure program to the secure program will be described with reference to FIGS. First, the case where the non-secure program branches from the non-secure program to the secure program normally instead of the hacking program will be described.

<< Bifurcation from non-secure program to secure program >>
FIGS. 8A to 8D are timing diagrams showing the operation of the memory protection unit 204 according to the first embodiment. FIG. 8 shows a case where the non-secure program branches to the secure program normally.

  The microprocessor CPU executes the nonsecure program in the nonsecure program area until time t0. That is, the PC address 306 designates not the secure program area shown in FIG. 7 (B) but the non-secure program area. Therefore, until time t0, the comparison result signal 704-R or 705-R from the comparator 704 or 705 (FIG. 7A) becomes low level. As a result, the secure program area signal 707 is at low level, and the non-secure program area signal 709 is at high level. Further, since the comparison result signal 704 -R or 700 -R is at the low level, the secure program branch permission area signal 702 is also at the low level.

  Since the non-secure program area signal 709 is at high level, the clear terminal (clear) of the flip flop circuit 703 is supplied with high level. Although the low level is supplied to the set terminal (set) of the flip flop circuit 703, the high level is supplied to the clear terminal, so the secure data access permission signal 302 becomes low level.

  At time t0, the microprocessor CPU executes a branch instruction in the non-secure program. The branch instruction executed at this time is a branch instruction instructing a branch to the secure program. Although not particularly limited, address information specifying the branch destination address at this time is given to the microprocessor CPU in the non-secure program being executed. The microprocessor CPU sets the PC address 306 in accordance with the provided address information. Here, the start address shown in FIG. 5 is set to the PC address 306 (FIG. 8 (A)). Since the start address is an address for designating the inside of the branch permission area BAA, each of the comparison result signals 700 -R, 704 -R and 705 -R becomes high level. As a result, the secure program area signal 707 becomes high level, the non-secure program area signal 709 becomes low level, and the secure program branch permission area signal 702 becomes high level (FIG. 8 (C), FIG. 8 (B)).

  The output terminal (Q) of the flip flop circuit 703 becomes high level when the secure program branch allowance area signal 702 becomes high level. At this time, since the low level is supplied to the clear terminal of the flip flop circuit 703, the flip flop circuit 703 outputs a high level. As a result, the secure data access permission signal 302 changes to high level (FIG. 8 (D)). When the secure data access permission signal 302 goes high, the memory access control circuit 303 (FIG. 3) permits the microprocessor CPU to access the memory.

  At time t1, the microprocessor CPU completes the execution of the instruction (for example, the instruction Ex-A in FIG. 5) stored in the branch permission area BAA, and between time t1 and time t2, the remaining secure program is executed. Execute an instruction. In order to execute the remaining instructions, the PC address 306 sequentially outputs an address specifying the inside of the branch prohibition area BPA between time t1 and time t2. Taking FIG. 5 as an example, in order to execute instructions Ex-B to Ex-P related to predetermined processing and instructions Ex-Z related to restoration of a register or the like between time t1 and time t2, the PC address 306 Are sequentially updated.

  These instructions are arranged in the secure program area and arranged in the branch prohibition area BPA. Therefore, at time t1, the comparator 700 outputs a low level comparison result signal 700-R from time t1 to time t2. However, since these instructions are located in the secure program area, comparison result signals 704-R and 705-R of comparators 704 and 705, respectively, maintain high level.

  At time t1, as the comparison result signal 700-R becomes low level, the secure program branch permission area signal 702 changes to low level. Thus, the low level is supplied to the set terminal (set) of the flip flop circuit 703. On the other hand, since the comparison result signals 704 -R and 705 -R maintain the high level, the non-secure program area signal 709 maintains the low level. Therefore, the low level is continuously supplied to the clear terminal (clear) of the flip flop circuit 703. Since the clear terminal (clear) is at the low level, the flip flop circuit 703 maintains (holds) the state of the output terminal (Q) at the high level. As a result, the secure data access permission signal 302 also maintains the high level from time t1 to time t2. Since the secure data access permission signal 302 is at the high level, the memory access control circuit 303 continues to permit the microprocessor CPU to access the memory also from time t1 to time t2.

  At time t2, when the execution of the secure program is completed, the secure program returns to the non-secure program. That is, the PC address 306 changes from the branch prohibition area BPA to an address for designating the inside of the non-secure program area. Since the PC address 306 changes from the secure program area to the address specifying the non-secure program area, at time t2, the comparison result signal 704-R or 705-R of the comparator 704 or 705 changes to low level. As a result, the non-secure program area signal 709 changes to high level. Thereby, the high level is supplied to the clear terminal (clear) of the flip flop circuit 703, the voltage of the output terminal (Q) of the flip flop circuit 703 changes to low level, and the secure data access permission signal 302 also changes to low level. . As the secure data access permission signal 302 goes low, the memory access control circuit 303 inhibits the microprocessor CPU from accessing the secure program area and secure data area of the memory.

  Focusing on the flip flop circuit 703, the output terminal (Q) is maintained at high level (predetermined state) until the address (PC address 306) from the microprocessor CPU indicates the non-secure program area. , Access to the memory will be allowed.

  In this way, it is possible to branch from the non-secure program to the secure program and execute the secure program. That is, the non-secure program can call and use the secure program constituting the RTOS.

<< Bifurcation from hacking program to secure program >>
Next, the case where the hacking program branches to the secure program will be described. In this case, the hacking program operates in the non-secure program area. FIGS. 9A to 9D are timing diagrams showing the operation of the memory protection unit according to the first embodiment. FIG. 9 shows the case where the hacking program branches to the secure program. In FIGS. 9B and 9D, broken lines indicate the state described with reference to FIG. That is, it shows the state when a secure program is called from a non-secure program normally.

  Until time t0, which is the same as FIG. 8, detailed description will be omitted, but since non-secure program is executed until time t0, non-secure program area signal 709 is at high level. Therefore, the output terminal (Q) of the flip flop circuit 703 is in the low level state, and the secure data access permission signal 302 is also in the low level.

  At time t0, the microprocessor CPU executes a branch instruction in the hacking program (non-secure program). The branch instruction executed at this time is a branch instruction instructing a branch to a predetermined branch destination address of the secure program. Although not particularly limited, address information specifying a predetermined branch destination address at this time is given to the microprocessor CPU in the hacking program being executed. The microprocessor CPU sets the PC address 306 in accordance with the provided address information. In the hacking program, for example, the branch destination address shown in FIG. 5 is set to the PC address 306 (FIG. 9 (A)). The branch destination address is, unlike the start address, an address at which an intermediate instruction is stored, for example, in a series of instruction sequences constituting the secure program. In the example of FIG. 5, the address at which the store instruction (Ex-S) in the middle of the series of instruction sequences (instructions Ex-B to Ex-P) is stored is taken as the branch destination address.

  Since the branch destination address is an address for designating the branch prohibition area BPA, the comparison result signal 700-R becomes low level, and the comparison result signals 704-R and 705-R become high level. Since the comparison result signals 704 -R and 705 -R become high level, the secure program area signal 707 becomes high level, and the non-secure program area signal 709 becomes low level. On the other hand, since the comparison result signal 700-R is at the low level, the secure program branch permitted area signal 702 is also at the low level (FIG. 9C, FIG. 9B).

  When each of the secure program branch permission area signal 702 and the non-secure program area signal 709 becomes low level, a low level is supplied to the set terminal (set) and the clear terminal (clear) of the flip flop circuit 703. Become. Therefore, the output terminal (Q) of the flip flop circuit 703 continuously outputs the state until time t0. That is, the output terminal (Q) of the flip flop circuit 703 continuously outputs a low level. As a result, as described with reference to FIG. 8D, the secure data access permission signal 302 does not change to the high level (broken line in FIG. 9D), and maintains the low level. Since the secure data access permission signal 302 is at low level, the memory access control circuit 303 (FIG. 3) prohibits the microprocessor CPU from accessing the secure program area and secure data area of the memory.

  At time t1, the access to the secure program area by the microprocessor CPU is prohibited by the memory access control circuit 303, so the instruction specified by the branch destination address in the secure program area (instruction Ex-S in FIG. 5) is , Not read, this instruction is not executed by the microprocessor CPU. In the example of FIG. 9, the microprocessor CPU continuously outputs the PC address 306 specifying the secure program area from time t1 to time t2. During a period in which the PC address 306 designates the secure program area, the secure program area signal 707 continues high level, and as shown in FIG. 9C, the non-secure program area signal 709 continues low level. Therefore, even during the period from time t1 to time t2, the flip-flop circuit 703 does not change its output terminal (Q) to the high level as shown by the broken line in FIG. 9D, and maintains the low level. That is, the secure data access permission signal 302 maintains the low level.

  Since the secure data access permission signal 302 maintains the low level, access to the secure program area and secure data area by the microprocessor CPU is inhibited by the memory access control circuit 303 even during the period from time t1 to time t2. Become.

  In the example of FIG. 9, at time t2, the microprocessor CPU changes the address stored in the PC address 306 so as to execute the non-secure program. By changing the PC address 306 to an address specifying a non-secure program area, the comparison result signal 704 -R or 705 -R changes from high level to low level. As a result, the secure program area signal 707 changes from high level to low level, and the non-secure program area signal 709 changes from low level to high level.

  When the non-secure program area signal 709 becomes high level, the flip flop circuit 703 makes the output terminal (Q) low level. Since the output terminal (Q) is at the low level until time t2, the flip-flop circuit 703 can be considered to continuously output the low level from the output terminal (Q). That is, the secure data access permission signal 302 becomes low level also after time t2.

  In the memory access control circuit 303, the secure data access permission signal 302 is at low level, but since the PC address 306 designates the non-secure program area, the non-secure program area and non-secure data by the microprocessor CPU are Allow access to the area.

  As a result, instructions relating to non-secure programs can be executed. Of course, in the hacking program, if the instruction of the non-secure program is placed after the branch instruction to the secure program, the instruction of the non-secure program placed after the branch instruction to the secure program is not executed. You may For example, when the non-secure program area signal 709 changes to low level, the secure program branch permission area signal 702 is sampled, and if the sampled secure program branch permission area signal 702 is low level, the memory access control circuit is performed after time t2. 303 may also prohibit the microprocessor CPU from accessing the non-secure program area and the non-secure data area.

  As described above, since the hacking program prohibits access to the secure data (including the secure program), the secure data can be protected from the attack by the hacking program. Here, although the hacking program has been described as an example, it is possible to prevent the secure data from being read out erroneously due to the defect of the non-secure program.

<< Operation of Memory Protection Unit >>
FIG. 10 is a table showing the operation of the memory protection unit 204 according to the first embodiment. FIG. 10 shows the operation of the memory protection unit 204 at the time of branching. In FIG. 10, BSA, BDA and BOP indicate the columns of the table. Here, the column BSA indicates a branch source address, the column BDA indicates a branch destination address, and the column BOP indicates control at the time of branching.

  The memory protection unit 204 divides and controls the branch source address into three. That is, when branching, whether the branch source is "(1) non-secure program area", "(2) secure program branch permission area", or "(3) secure program branch prohibition area" Divide and control. In other words, when executing a branch, the branch instruction is arranged in "(1) non-secure program area", "(2) secure program branch permission area", or "(3) secure program Control is performed separately depending on whether it is located in the branch prohibited area. In FIG. 10, the secure program branch allowance area represents a branch allowance area BAA, and the secure program branch prohibition area represents a branch prohibition area BPA.

  The memory protection unit 204 controls the “(1) non-secure program area” at time t0 shown in FIGS. 8 and 9. In addition, the memory protection unit 204 controls “(2) secure program branch permission area” and “(3) secure program branch prohibition area” in a period from time t0 to time t2 in FIG.

  The memory protection unit 204 determines that the branch source address indicated in the column BSA is the branch indicated in the column BDA for each of the “non-secure program area”, the “secure program branch allowance area” and the “secure program branch prohibition area”. The destination address is also divided into three and controlled. That is, when branching, the branch destination is divided into a "non-secure program area", a "secure program branch permission area", or a "secure program branch prohibition area" to control. Also in this case, the instruction at the branch destination when the branch instruction is executed is arranged in the "non-secure program area", in the "secure program branch allowance area", or in the "secure program branch prohibition area". It can be considered as being divided and controlled.

  Column BOP shows control at the time of branching, and FIG. 10 shows control on a secure data area at the time of branching. The secure data area here means both a secure program area and a secure data area. There are three types of control regarding the secure data area. That is, the memory access control unit 303 allows the microprocessor CPU to access the secure data area in the secure data access permission state, prohibits the access to the secure data area, the secure data access prohibition state, and the operation state before branching. It is a maintenance state to maintain. Here, the maintenance state means maintaining the secure data access permitted state if the branch before is the secure data access permitted state, and prohibiting secure data access if the branch before the branch is the secure data access prohibited state. It means maintaining the state.

  When the branch source address is “(1) secure program area” of column BSA, the memory protection unit 204 has three branch destinations whose branch destination addresses are described in the same row as “(1) secure program area”. One of the addresses is determined, and control corresponding to the determined branch destination address (control described in column BOP) is executed. Similarly, in the case where the branch source address is "(2) secure program branch permission area" of column BSA, the branch destination address is the three branches described in the same row as "(2) secure program branch permission area". One of the destination addresses is determined, and control (control described in the column BOP) corresponding to the determined destination address is executed. When the branch source address is "(3) secure program branch prohibition area" of column BSA, the branch destination address is the three branch destinations described in the same row as "(3) secure program branch prohibition area". One of the addresses is determined, and control corresponding to the determined branch destination address (control described in column BOP) is executed.

  Next, the operation of the memory protection unit 204 shown in FIG. 10 will be described using FIGS. 7 to 9.

  The user program U-AP is configured of, for example, a plurality of non-secure programs, and each non-secure program is arranged in the non-secure program area. When the user program U-AP, which is a non-secure program, uses a secure program such as RTOS, it branches from the non-secure program area to the secure program as described in FIGS. 8 and 9.

  Since the branch is from the non-secure program area, the memory protection unit 204 determines that the branch source is “(1) non-secure program area”. That is, when the RTOS program is called (branched) from the user program U-AP (time t0), the memory protection unit 204 determines that the branch source is "(1) non-secure program area".

  Next, the memory access control circuit 303 in the memory protection unit 204 determines whether the non-secure program area signal 709 described with reference to FIGS. 7, 8 and 9 is at the low level. If the non-secure program area signal 709 is high level, the branch destination is determined to be "non-secure program area", and the memory access control circuit 303 prohibits the microprocessor CPU from accessing the secure data area. ("Secure data access prohibited" in column BOP). In this case, although not described in FIG. 10, the memory access control circuit 303 permits the microprocessor CPU to access the non-secure data area. This allows the user program to branch from a given non-secure program to another non-secure program. In FIG. 3 and FIG. 7, signal wiring for supplying the non-secure program area signal 709 to the memory access control circuit 303 is omitted in order to avoid the complexity of the drawings.

  When non-secure program area signal 709 is at low level, secure data access permission signal according to the voltage (high level or low level) of secure program branch permission area signal 702 as described at time t0 in FIGS. 8 and 9. 302 is high level or low level. If the non-secure program area signal 709 is low level and the secure data access permission signal 302 is high level as shown in FIG. 8, the memory access control circuit 303 determines that the branch destination address (column BDA) is “secure program branch permission It is determined that the area is "area", and the microprocessor CPU permits access to the secure data area ("secure data access permission").

  On the other hand, if the non-secure program area signal 709 is low level and the secure data access permission signal 302 is low level as shown in FIG. 9, the branch destination address (column BDA) is “secure program branch prohibition area”. It is determined that there is, and the operation state before branching is maintained. As described at time t0 in FIG. 9, the output terminal (Q) of the flip flop circuit 703 maintains the state prior to time t0. In this case, the previous state is a state where access to secure data is prohibited. Therefore, in this case, a state where access to the secure data area by the microprocessor CPU is inhibited is maintained. In the case of FIG. 9, this state is maintained also in the period from time t0 to time t2.

  When the branch destination address is determined to be the “secure program branch permission area” at time t0, the memory protection unit 204 performs “(2) secure program branch permission area” or “during the period from time t0 to time t2”. (3) The control of the secure program branch prohibition area is executed.

  First, the microprocessor CPU executes an instruction arranged in the secure branch permission area in a period from time t0 to time t1. At this time, if the instruction to be executed is a branch instruction, control of “(2) secure branch permission area” is executed. That is, if the branch destination address of the branch instruction to be executed in this period is the "non-secure program area", the non-secure program area signal 709 is at the low level. Thereby, the memory access control circuit 303 prohibits the microprocessor CP from accessing the secure data area (prohibit secure data access). In this case, since the output terminal (Q) of the flip flop circuit 703 shown in FIG. 7 is cleared to the low level, in order to use the secure program again from the nonsecure program, secure program branch permission is permitted in the nonsecure program. It is required to execute a branch instruction specifying an area.

  If the branch destination address of the branch instruction to be executed from time t0 to time t1 designates the "secure program branch permitted area", the secure program branch permitted area signal 702 becomes high level. Thus, the output terminal (Q) of the flip-flop circuit 703 shown in FIG. 7 is set to the high level. As a result, the secure data access permission signal 302 becomes high level, and the memory access control circuit 303 permits the microprocessor CPU to access the secure data area (secure data access permission).

  If the branch destination address of the branch instruction executed from time t0 to time t1 designates the "secure program branch prohibited area", as described in FIG. 8, the secure program branch permitted area signal 702 goes low. However, the non-secure program area signal 709 is maintained at low level. Therefore, as described in FIG. 8, the voltage of the output terminal (Q) of the flip flop 703 is maintained at the high level. That is, the state before branching is maintained. As a result, the memory access control circuit 303 maintains the operation state before the branch. In this case, since the operation state before branching is the state of the secure data access permission, the microprocessor CPU continues the state of the permission to access the secure data area.

  Thus, the output terminal (Q) of the flip-flop circuit 703 shown in FIG. 7 is set to the high level. As a result, the secure data access permission signal 302 becomes high level, and the memory control circuit 303 permits the microprocessor CPU to access the secure data area (secure data access permission).

  If a branch instruction is executed with the "secure program branch prohibition area" as the branch destination address during the period from time t0 to time t1, the microprocessor CPU operates in the period shown as time t1 to time t2 in FIG. become. In this case, the microprocessor CPU executes the secure program stored in the secure program branch prohibition area. In other words, in this period, the branch source address of the branch instruction executed by the microprocessor CPU is "(3) secure program branch prohibition area".

  When the branch source address is "(3) secure program branch prohibition area", that is, in FIG. 9, the microprocessor CPU executes the instruction arranged in the secure branch prohibition area in the period from time t1 to time t2 Do. In this period, if the instruction to be executed is a branch instruction and the branch destination address is the "non-secure program area", the non-secure program area signal 709 is at the low level. Thereby, the memory access control circuit 303 prohibits the microprocessor CP from accessing the secure data area (prohibit secure data access). In this case, since the output terminal (Q) of the flip flop circuit 703 shown in FIG. 7 is cleared to the low level, in order to use the secure program again from the nonsecure program, secure program branch permission is permitted in the nonsecure program. It is required to execute a branch instruction specifying an area.

  If the branch destination address of the branch instruction executed from time t1 to time t2 designates the "secure program branch permission area", the secure program branch permission area signal 702 becomes high level. Thus, the output terminal (Q) of the flip-flop circuit 703 shown in FIG. 7 is set to the high level. As a result, the secure data access permission signal 302 becomes high level, and the memory access control circuit 303 permits the microprocessor CPU to access the secure data area (secure data access permission).

  If the branch destination address of the branch instruction executed from time t1 to time t2 designates the "secure program branch prohibition area", the secure program branch permission area signal 702 becomes low level as described in FIG. However, the non-secure program area signal 709 is maintained at low level. Therefore, as described in FIG. 8, the voltage of the output terminal (Q) of the flip flop 703 is maintained at the high level. That is, the state before branching is maintained. As a result, the memory access control circuit 303 maintains the operation state before the branch. In this case, since the operation state before branching is the state of the secure data access permission, the microprocessor CPU continues the state of the permission to access secure data.

  Thus, the output terminal (Q) of the flip-flop circuit 703 shown in FIG. 7 is set to the high level. As a result, the secure data access permission signal 302 becomes high level, and the memory access control circuit 303 permits the microprocessor CPU to access the secure data area (secure data access permission).

  In FIGS. 8 and 9, the non-secure program is executed at time t2. In the example of FIG. 8, in the control of “(3) secure program branch prohibition area”, the branch destination address is an operation when “non-secure program area” is designated. Further, in the example of FIG. 9, in the control of “(1) non-secure program area”, the operation is performed when “non-secure program area” is specified as the branch destination address. In either case, the memory access control circuit 303 prohibits the microprocessor CPU from accessing the secure data area and permits access to the non-secure data area.

  Although the example in which the non-secure program area signal 709 is supplied to the memory access control circuit 303 by signal wiring (not shown) has been described, the present invention is not limited to this. For example, the secure program area signal 707 may be supplied to the memory access control circuit 303 by signal wiring (not shown).

  As described above, in the first embodiment, the access destination from the non-secure program to the secure data area is determined by the branch destination address of the branch instruction in the non-secure program being the secure program branch permit area (branch permit area It is when specifying BAA). This makes it possible to protect a secure program such as an RTOS from an attack by a hacking program, even if it is possible to arbitrarily create a non-secure program capable of operating the microprocessor CPU. .

  When executing a branch instruction with the secure program branch prohibition area as the branch destination address in the secure program branch prohibition area, permission / prohibition of access to the secure data area is maintained at the state before executing the branch instruction. Ru. Thus, the microprocessor CPU can access the secure data area even when executing a branch instruction with the secure program branch prohibition area as the branch destination in the secure program arranged in the secure program branch prohibition area. . As a result, in a secure program such as an RTOS, even if another subroutine is called (branched) from a predetermined subroutine, the RTOS can be effectively used from the user program U-AP.

  The access to the secure data area is prohibited when the branch destination address of the branch instruction designates a non-secure program area.

<Modification>
FIG. 11 is an explanatory view of a modification according to the first embodiment. Since FIG. 11 is similar to FIG. 6, the differences from FIG. 6 will be mainly described.

  As in FIG. 6, the flash memory FRM includes a non-secure program area and a secure program area, and the volatile memory 203 includes a non-secure data area and a secure data area. Here, in the secure program area, a program whose security is to be secured is stored, and in the secure data area, data whose security is to be secured is stored. The non-secure program area, the non-secure data area, and the secure data area are the same as in FIG.

  Also in this modification, the secure program area is divided into a branch permission area BAA and a branch prohibition area BPA. For example, as described in FIG. 7, the range of the area of the flash memory FRM designated by the secure program upper limit address 304-U and the secure program lower limit address 304-D is a secure program area, excluding the secure program area. The area of the memory FRM is a non-secure program area. Further, the branch allowance area BAA is in the range between (upper limit address -4) and upper limit address 304-U shown in FIG. 7, and the branch prohibition area BPA is shown in FIG. 7 (upper limit address -5). It is a range between the lower limit address 304-D.

  In the modification, a predetermined branch instruction BRI is arranged in the branch permission area BAA. Further, in the branch prohibition area BPA, a check program CHK for checking input information, a selection program EXS for selecting an execution program, and a plurality of programs PRG1 to PRGn are stored. The programs PRG1 to PRGn are programs realizing different functions, and three programs PRG1 to PRG3 are illustrated as an example in FIG.

  The non-secure program that branches from the non-secure program arranged in the non-secure program area to the secure program arranged in the secure program area is executed, for example, in a predetermined area of the non-secure data area among the programs PRG1 to PRGn. An instruction for storing selection information for selecting a program to be executed, and a branch instruction with the branch permission area BAA as a branch destination address are provided. After the microprocessor CPU executes the non-secure program, selection information specifying a program to be executed among the programs PRG1 to PRGn is stored in a predetermined area of the non-secure data area, and then the PC address 306 is generated. Will specify the inside of the divisible area BAA.

  When the address of the branch instruction BRI arranged in the branch allowance area BAA is designated by the PC address 306, the branch instruction BRI is read by the microprocessor CPU and executed. The branch instruction BRI is an instruction to branch to the tick program CHK.

  By executing the branch instruction BRI, the check program CHK is next executed. In the check program CHK, the microprocessor CPU reads selection information from a predetermined area of the non-secure data area, and checks whether the read selection information is unexpected selection information. For example, it is checked whether the selection information is selection information that designates a program exceeding the programs PRG1 to PRGn. If it is determined by the check program CHK that the selected information is appropriate, then the selected program EXS is executed.

  The selection program EXS selects and executes the program designated by the selection information among the programs PRG1 to PRGn. This makes it possible to select and execute a desired secure program from a plurality of programs arranged in the secure program area.

  Although omitted in FIG. 11, in the branch permission area BAA, for example, an instruction to save the value of a register or the like is arranged. Further, in the branch prohibition area BPA, an instruction for restoring the value of a register or the like is arranged.

  It is possible to place a plurality of branch instructions for branching to each of the programs PRG1 to PRGn in the branch allowance area BAA, for example, but in this case, the size of the branch allowance area BAA becomes large. That is, the area for permitting branching is increased, and the area accessible to the hacking program is increased. According to this modification, it is possible to suppress an increase in the size of the branch allowance area BAA, and it is possible to suppress an increase in the area accessible by the hacking program.

  Also in this modification, as in FIG. 6, when the branch prohibition area BPA is accessed as the branch target address, the memory protection unit 204 can prohibit access to the secure data area, and the secure program It is possible to protect PRG1 to PRGn.

  Although an example in which selection information for specifying a secure program is stored in the non-secure data area has been described, the present invention is not limited to this.

  According to the first embodiment, the microprocessor CPU can execute the secure program and the user program U-AP created by the user while protecting the secure program such as the RTOS. That is, a microcomputer LSI having a program of RTOS stored in advance is provided, and a user program U-AP in which the user operates (operates) the microprocessor CPU in the microcomputer LSI to use the function of RTOS Even if it is created, the program of RTOS which is a secure program can be protected. As a result, even in the new semiconductor sales model, it is possible to prevent the secure program (the program of the RTOS) from being stolen, and it is possible to prevent the merits of the seller from being lost. As a result, the new semiconductor sales model will allow both sellers and users to benefit.

  In order to protect a secure program, it is conceivable to form a secure program area by generating an exception interrupt and transitioning to a privileged mode. However, in this case, it is possible to develop a hacking program in the non-secure program area, give noise and so on, and make a transition to the privileged mode by causing runaway, and protection against hacking using noise is provided. It is thought that it is weak.

  On the other hand, the memory protection unit 204 in the first embodiment monitors the PC address of the microprocessor CPU to control access to secure data by the microprocessor CPU. Therefore, it is possible to prevent the protection from being weakened against noise-based hacking. In addition, the hacking program is developed in the non-secure program area, and the protection is achieved by dividing the secure program area into the branch permission area BAA and the branch prohibition area BPA against attacks performed by branching from the hacking program to the secure program. It is suppressing the weakening.

  As a result, even if the microcomputer LSI provided with the RTOS program is provided in advance and the user who purchased the microcomputer creates a program that uses the RTOS function, the previously written secure program is stolen. It is possible to prevent

Second Embodiment
FIG. 12 is a layout diagram schematically showing the layout of data stored in flash memory FRM according to the second embodiment.

  The flash memory FRM according to the second embodiment is divided into a plurality of areas. FIG. 12 exemplifies a non-secure program area, a secure program area, and a protection information area among a plurality of areas constituting the flash memory FRM. In FIG. 12, the non-secure program area is indicated by reference numeral 1200, the secure program area is indicated by reference numeral 1201, and the protected information area is indicated by reference numeral 1202.

  In the second embodiment, the secure program area 1201 stores a secure program whose security should be secured, and the non-secure program area 1200 stores a non-secure program. The protection information area 1202 stores information for protecting the secure program area 1201.

  In the new semiconductor sales model, as described in FIG. 1, the seller PRD writes in advance a secure program such as RTOS to the flash memory FRM in the microcomputer LSI before selling the microcomputer LSI. The seller PRD sets the area of the flash memory FRM in which the RTOS is written as the secure program area 1201. In this manner, a microcomputer LSI provided with a flash memory FRM in which a secure program such as RTOS is written in the secure program area 1201 is sold from the seller PRD.

  The user USR who has purchased the microcomputer LSI from the seller PRD creates a user program U-AP that operates using the RTOS, and writes the user program U-AP to the non-secure program area 1200 of the flash memory FRM. When the user program U-AP is written to the flash memory FRM, if the previously written secure program (RTOS) is written, a security hole can be created in the secure program. In order to prevent this, the seller PRD provides a secure program address area 1203 in the protection information area 1202, and for example, the secure address information 304 and the secure data information 305 described above in the secure program address area 1203 and the microcomputer LSI. Write before you sell. This secure address information 304 (secure program upper limit address 304-U and secure program lower limit address 304-D) designates the secure program area and prohibits writing to the secure program area as described in FIGS. 3 and 7. Do. This prohibits the writing of the secure program.

  Also, after the sale, if the protected information area 1202 can be written to by the non-secure program (for example, user program U-AP) stored in the non-secure program area 1200, the secure program address area 1203 is rewritten. As a result, it becomes possible to release the write protection of the secure program area 1201 and create a security hole in the secure program. Therefore, the seller PRD provides the protected information control area 1204 in the protected information area 1202, and after the sale, protects the protected information 1205 that prevents the protected information stored in the protected information area 1202 from being rewritten. Write to control area 1204 before sale. Thereby, the writing of the protection information to the protection information area 1202 is prohibited.

  In this way, after the sale, rewriting of the secure program can be prohibited by the non-secure program stored in the non-secure program area 1200. However, if a defect such as a bug is found in the secure program after the sale, the rewriting of the secure program is prohibited, so that the update of the secure program becomes difficult, and the countermeasure against the problem becomes difficult. On the other hand, if it is possible to update the secure program after the sale, it is feared that a security hole will be created in the previously written secure program.

  In the second embodiment, from the secure program stored in secure program area 1201, the rewriting prohibition of protected information area 1202 can be released. In this case, depending on the non-secure program stored in the non-secure program area 1200, the rewriting prohibition of the protected information area 1202 can not be canceled.

  FIG. 13 is a block diagram showing the configuration of a microcomputer LSI according to the second embodiment. Of the configuration of the microcomputer LSI shown in FIG. 2, only the microprocessor CPU, the flash memory FRM, the flash memory rewrite circuit 202, and the memory protection unit 204 are shown in FIG. The configuration of the flash memory rewrite circuit 202 required in the description is shown in detail in FIG.

  The flash memory rewrite circuit 202 includes a flash memory rewrite address setting register 1300, a flash memory rewrite start register 1301, a flash memory rewrite control circuit 1304, and an unauthorized access detection circuit 1307. The flash memory rewrite address setting register 1300 and the flash memory rewrite start register 1301 are connected to the microprocessor CPU via the bus 205.

  In the flash memory rewrite address setting register 1300, when the flash memory FRM is rewritten, an address specifying an area to be rewritten in the flash memory FRM is set by the microprocessor CPU via the bus 205. The flash memory rewrite address setting register 1300 supplies the set address as the rewrite address 1302 to the flash memory rewrite control circuit 1304. Further, the flash memory rewrite address setting register 1300 determines whether or not the set address designates the protection information area 1202 among the areas 1200 to 2022 (FIG. 12) of the flash memory FRM, and the protection information area When 1202 is designated, the protection information selection signal 1305 is formed and supplied to the unauthorized access detection circuit 1307.

  In the flash memory rewrite start register 1301, start information indicating the timing of rewriting the flash memory FRM is set from the microprocessor CPU via the bus 205. The flash memory rewrite start register 1301 forms a flash memory rewrite start signal 1303 based on the set start information, and supplies it to the unauthorized access detection circuit 1307.

  The flash memory rewrite control circuit 1304 receives the rewrite address 1302, the flash memory rewrite start signal 1303, and the unauthorized access detection signal 1308 from the unauthorized access detection circuit 1307, and the unauthorized access detection signal 1308 does not indicate that the access is unauthorized. At this time, the area of the flash memory FRM designated by the rewrite address 1302 is rewritten. The start timing of the rewriting at this time is determined by the flash memory rewriting start signal 1303. Note that, in FIG. 13, the signal wiring for supplying the data to be written to the flash memory FRM is omitted to avoid the complexity of the drawing, but the data to be written is from the microprocessor CPU via the bus 205. It is supplied to the flash memory FRM.

  The unauthorized access detection circuit 1307 will be described later by way of example with reference to FIG. 14. However, the non-secure program selection signal 1306 from the memory protection unit 204, the protection information selection signal 1305 described above, and the flash memory rewrite start signal 1303 , Forms an unauthorized access detection signal 1308, and supplies it to the flash memory rewrite control circuit 1304.

  The memory protection unit 204 has the configuration shown in FIG. 3 and FIG. 7A, and the non-secure program area signal 709 formed in the fetch address comparison circuit 301 in FIG. 3 and FIG. The non-secure program selection signal 1306 is supplied to the unauthorized access detection circuit 1307. In the second embodiment, the memory protection unit 204 detects whether the address (PC address 306) from the microprocessor CPU designates a secure program area or a non-secure program area. It is used.

  As described in FIG. 7A, the fetch address comparison circuit 301 receives secure address information 304 (secure program upper limit address 304-U, secure program lower limit address 304-D) from the flash memory FRM and the microprocessor CPU. Has received a PC address 306 of When the PC address 306 designates the secure program area defined by the secure address information, the secure program area signal 707 (FIG. 7A) becomes high level and the non-secure program area signal 709 becomes low level. Become. On the other hand, when the PC address 306 designates not the secure program area but the non-secure program area, the secure program area signal 707 becomes low level and the non-secure program area signal 709 becomes high level. Therefore, when the non-secure program disposed in the non-secure program area is being executed, the non-secure program area signal 709, that is, the non-secure program selection signal 1306 becomes high level.

  The unauthorized access detection circuit 1307 determines whether a non-secure program is being executed or a secure program is being executed, depending on whether the non-secure program selection signal 1306 is high level or low level. In addition, the unauthorized access detection circuit 1307 is instructed by the protection information selection signal 1305 to rewrite the protection information area 1202 in the flash memory FRM or to instruct rewriting of an area other than the protection information area 1202. judge. Further, the unauthorized access detection circuit 1307 determines the rewrite timing of the flash memory FRM by the flash memory rewrite start signal 1303. In other words, the unauthorized access detection circuit 1307 detects whether the access is unauthorized or not at the timing indicated by the flash memory rewrite start signal 1303 based on the start information from the microprocessor CPU.

  The unauthorized access detection circuit 1307 indicates that the non-secure program selection signal 1306 indicates that the non-secure program is being executed, and the protected information selection signal 1305 indicates the protected information area 1202. And prohibit the flash memory rewrite control circuit 1304 from rewriting the flash memory FRM. The unauthorized access detection signal 1308 is formed at the timing indicated by the flash memory rewrite start signal 1303.

  This makes it possible to inhibit the protection information area 1202 in the flash memory FRM from being rewritten in the non-secure program, and allows the protection information area 1202 in the flash memory FRM to be rewritten in the secure program. It will be.

  FIG. 14 is a block diagram showing a configuration of the unauthorized access detection circuit 1307 according to the second embodiment. In the figure, 1400 is a 3-input AND circuit, and 1401 is a flip flop circuit. The protection information selection signal 1305, the flash memory rewrite start signal 1303 and the non-secure program selection signal 1306 described above are input to the 3-input AND circuit 1400. An output of the 3-input AND circuit 1400 is supplied to a set terminal (set) of the flip flop circuit 1401. The reset signal RST of the microcomputer LSI is supplied to the clear terminal (clear) of the flip flop circuit 1401.

  The flip-flop circuit 1401 is not particularly limited, but has a configuration similar to that of the flip-flop circuit 703 described in FIG. That is, in the flip-flop circuit 1401 (holding circuit), the high level is supplied to the set terminal (set), and the output terminal (Q) becomes high level. When the output terminal (Q) becomes high level, even if the set terminal (set) is supplied with low level, the output terminal (Q) is maintained at high level until the clear terminal (clear) is supplied with high level .

  The reset signal RST is supplied from the outside of the microcomputer LSI to a circuit block in the microcomputer LSI. For example, as shown in FIG. 13, the reset signal RST is also supplied to the microprocessor CPU. Although not particularly limited, in the second embodiment, when the reset signal RST goes high, the microcomputer LSI is reset.

  When the set address designates the protection information area 1202 in the flash memory FRM, the flash memory rewrite address setting register 1300 shown in FIG. 13 forms the protection information selection signal 1305 at high level. On the other hand, when the set address designates an area other than the protection information area 1202 in the flash memory FRM (for example, the non-secure program area 1200), the flash memory rewrite address setting register 1300 is low. A protection information selection signal 1305 is formed. Further, the flash memory rewrite start register 1301 shown in FIG. 13 sets the flash memory rewrite start signal 1303 to the high level at the timing of rewriting the flash memory FRM. The non-secure program selection signal 1306 is high when the non-secure program is being executed, and is low when the secure program is being executed.

  Therefore, when the protection information area 1202 in the flash memory FRM is rewritten, the output signal of the 3-input AND circuit 1400 becomes high level if the non-secure program is executed. In other words, when trying to rewrite the protection information area 1202 in the flash memory FRM in the non-secure program, the output signal of the 3-input AND circuit 1400 becomes high level. The high-level output signal from the three-input AND circuit 1400 is supplied to the set terminal (set) of the flip flop circuit 1401, so the voltage at the output terminal (Q) of the flip flop circuit 1401 becomes high level and unauthorized access The detection signal 1308 becomes high level.

  The flash memory rewrite control circuit 1304 prohibits writing to the protection information area 1202 designated by the supplied rewrite address 1302 when the unauthorized access detection signal 1308 becomes high level. The flip-flop circuit 1401 maintains the output terminal (Q) at high level until the reset signal RST becomes high level. Therefore, the flash memory rewrite control circuit 1304 prohibits writing to the protection information area 1202 until the microcomputer LSI is reset. This makes it possible to prevent the protection information area 1202 of the flash memory FRM from being rewritten even if attacked repeatedly by means of hacking.

  On the other hand, when the protected information area 1202 in the flash memory FRM is rewritten, the output signal of the 3-input AND circuit 1400 becomes low level if the secure program is executed. In other words, when trying to rewrite the protected information area 1202 in the flash memory FRM in the secure program, the output signal of the 3-input AND circuit 1400 becomes low level. Since the output signal of the 3-input AND circuit 1400 becomes low level, the voltage of the output terminal (Q) of the flip flop circuit 1401 becomes low level, and the unauthorized access detection signal 1308 also becomes low level.

  The flash memory rewrite control circuit 1304 permits writing to the protection information area 1202 designated by the supplied rewrite address 1302 when the unauthorized access detection signal 1308 becomes low level. That is, in the case of accessing the protected information area 1202 in the flash memory FRM in the secure program, it is permitted and the protected information area 1202 can be rewritten.

  According to the second embodiment, when attempting to rewrite the protected information area 1202 in the flash memory FRM in the non-secure program, the unauthorized access detection circuit 1307 outputs the unauthorized access detection signal 1308, and the flash memory rewrite control circuit 1304 And prohibit writing to the protection information area 1202 of the flash memory FRM. The prohibition of writing continues until the microcomputer LSI is reset and can not be released. This makes it possible to prevent the protection information area 1202 of the flash memory FRM from being rewritten illegally. Since the protected information area 1202 can be prevented from being rewritten illegally, the non-secure program can be prevented from forming a security hole in the secure program, and the secure program can be protected.

  Further, when rewriting the protected information area 1202 in the flash memory FRM in the secure program, the flash memory rewrite control circuit 1304 permits writing to the protected information area 1202 of the flash memory FRM. Therefore, if a defect is found in the RTOS program (secure program) written in advance in the flash memory FRM, the information in the protected information area 1202 is set so that the secure program area 1201 can be rewritten in the secure program. rewrite. After that, the RTOS (secure program) having the defect corrected is written in the rewritable secure program area 1201. After writing the corrected RTOS, in the secure program, the information in the protected information area 1202 is rewritten so that the secure program area 1201 becomes write-protected. As a result, even when a defect is found in the secure program, the secure program can be corrected.

  For example, the seller PRD distributes the RTOS that has corrected the problem and the secure program that rewrites the flash memory FRM via the network NTW (FIG. 1). These distributed secure programs are downloaded to the microcomputer LSI and executed. As a result, it becomes possible to correct the RTOS of the microcomputer LSI, which has been written and provided in advance to the flash memory FRM.

  In addition, secure address information 304 described in the first embodiment is written in the protected information area 1202 before the seller PRD sells, but according to the second embodiment, it is to be rewritten after the user USR purchases it. Is possible. Thereby, for example, the size of the secure program area can be changed later as needed.

Third Embodiment
FIG. 15 is a block diagram showing a configuration of a microcomputer according to the third embodiment. The configuration of the microcomputer LSI shown in FIG. 15 is similar to that of the microcomputer shown in FIG. Similarly to FIG. 2, FIG. 15 also shows the server P-SV and the network NTW in addition to the microcomputer LSI.

  In the new semiconductor sales model, as described in FIG. 1, the seller PRD writes a secure program such as an RTOS to the flash memory FRM in advance. A microcomputer LSI including a flash memory FRM in which an RTOS is written and a microprocessor CPU and the like is sold by a seller PRD. The user USR writes the user program U-AP or the like created by the user USR into the flash memory FRM in the purchased microcomputer LSI.

  When the user USR upgrades a secure program such as the RTOS stored in the flash memory FRM of the purchased microcomputer LSI, or when correcting a problem, the RTOS or the upgraded RTOS on the server P-SV The modified RTOS is stored. In this case, the upgraded RTOS or the modified RTOS is encrypted and stored in the server P-SV. Therefore, when the user USR passes the network NTW, the upgraded RTOS or modified RTOS passes the network NTW in order to download the upgraded RTOS or modified RTOS. Even if the RTOS is stolen by a third party, it is difficult to operate the upgraded RTOS or the modified RTOS.

  The program (versioned up RTOS or modified RTOS) via the network NTW is received by the communication function circuit 200, transmitted by the microprocessor CPU to the decryption function circuit via the bus 205, and the decryption function Decoded by the circuit. The program decrypted by the decryption function circuit and not encrypted is stored in the volatile memory 203 by the microprocessor CPU in FIG.

  In the new semiconductor sales model, the user USR creates a non-secure program for operating the microprocessor CPU. That is, although the user USR is a non-secure program, it can create a program for arbitrarily operating the microprocessor CPU. Therefore, the user USR can create a hacking program for operating the microprocessor CPU. Although memory protection unit 204 described in the first embodiment can protect secure data stored in volatile memory 203 and flash memory FRM, etc., microprocessor CPU and volatile memory 203 are weak against hacking, There is a risk that the microprocessor CPU and volatile memory 203 may be hacked upon finding a security hole.

  In the third embodiment, the decryption function circuit 201-A (decryption circuit) is connected to the flash memory rewrite circuit 202-A by the dedicated signal wiring 1500, and the flash memory rewrite circuit 202-A is a dedicated signal. The wiring 1501 is connected to the flash memory FRM.

  Unlike the decryption function circuit 201, the decryption function circuit 201-A transfers the decrypted unencrypted program to the flash memory rewrite circuit 202-A via the dedicated signal wiring 1500. Unlike the flash memory rewrite circuit 202, the flash memory rewrite circuit 202-A transmits the transmitted unencrypted program to the flash memory FRM via the dedicated signal wiring 1501, and the program is stored in the flash memory FRM. Write.

  Thus, the encrypted program transferred from the communication function circuit 200 (communication circuit) to the decryption function circuit 201-A by the microprocessor CPU is decrypted by the decryption function circuit 201-A and decrypted. The unencrypted program (data) is supplied directly to the flash memory rewrite circuit 202-A through the signal wiring 1500 without being accessed by the microprocessor CPU. The unencrypted program (data) supplied to the flash memory rewrite circuit 202-A is also not directly accessed by the microprocessor CPU but is directly supplied to the flash memory FRM by the signal wiring 1501.

  That is, an unencrypted program (data) can be written to the flash memory FRM without intervention of the microprocessor CPU and the volatile memory 203.

  When hacking from the outside of the microcomputer LSI is considered, it is difficult to arbitrarily operate the microprocessor CPU from the outside of the microcomputer LSI. Therefore, for example, it is difficult to hack a program even if an unencrypted program (data) passes through the microprocessor CPU. However, in the new semiconductor sales model, the user creates a program capable of arbitrarily operating the microprocessor CPU. Therefore, for example, when an unencrypted program passes through the microprocessor CPU, it is feared that the unencrypted program is stolen. In the third embodiment, an unencrypted program is directly transmitted from the decryption function circuit 201-A to the flash memory rewrite circuit 202-A without passing through the microprocessor CPU and the volatile memory 203. It is supplied to and written to the flash memory FRM. This makes it possible to protect the program from hacking.

  In the third embodiment, even if the microprocessor CPU can be arbitrarily operated by the hacking program, the downloaded unencrypted program (data) is not accessed by the microprocessor CPU, so the program is stolen. Can be prevented.

Embodiment 4
FIG. 16 is a block diagram showing a configuration of a microprocessor CPU according to the fourth embodiment. FIG. 16 schematically shows the configuration of the microprocessor CPU described in the first to third embodiments. The microprocessor CPU has various circuit blocks, but FIG. 16 shows only the circuit blocks involved in the description of the fourth embodiment.

  In the figure, reference numeral 1600 denotes a control unit, 1601 a general-purpose register group, 1602 a first stack pointer, 1603 a second stack pointer, 1604 a program counter, and 1605 an arithmetic unit.

  The general purpose register group 1601 includes a plurality of general purpose registers R0 to Rn. Each of the general purpose registers R0 to Rn stores operation data or / and an address when the microprocessor LSI executes a process. The address stored in the general purpose registers R0 to Rn is used, for example, as an address of the flash memory FRM or / and the volatile memory 203 when the microprocessor CPU executes a process.

  Control unit 1600 executes general-purpose registers in general-purpose register group 1601, arithmetic unit 1605, first stack pointer 1602, second stack pointer 1603 and program counter 1604 according to the secure program and non-secure program stored in flash memory FRM. Control. The control unit 1600 controls these circuit blocks, whereby the processing according to the secure program and the non-secure program is realized by the microprocessor CPU.

  The microprocessor CPU executes both the secure program and the non-secure program in a time division manner. That is, one microprocessor CPU executes both a secure program such as an RTOS and a non-secure program such as a user program U-AP in a time division manner.

  The program counter 1604 forms the PC address 306 described in the first to third embodiments. That is, when the microprocessor CPU executes a secure program, the program counter 1604 forms a PC address 306 specifying an instruction that configures the secure program. Similarly, when executing a non-secure program, the program counter 1604 forms a PC address 306 specifying an instruction that constitutes the non-secure program. Although not particularly limited, the first stack pointer 1602 outputs an address specifying a stack area when the microprocessor CPU executes a non-secure program. The second stack pointer 1603 outputs an address specifying a stack area when the microprocessor CPU executes a secure program.

  The arithmetic unit 1605 performs, for example, an operation between data stored in the general purpose registers R0 to Rn, and stores the operation result in the general purpose register as operation data or an address.

  As described above, the microprocessor CPU executes the secure program and the non-secure program in a time division manner. Therefore, it is necessary to take measures so that secure data generated when the secure program is executed can not be read when the non-secure program is executed.

  When the microprocessor CPU operates, the first stack pointer 1602, the second stack pointer 1603 and the program counter 1604 designate addresses such as the flash memory FRM and / or the volatile memory 203 but do not store secure data. The memory protection unit 204 can protect the memories (the flash memory FRM and the volatile memory 203) specified by the first stack pointer 1602, the second stack pointer 1603 and the program counter 1604. For example, as described in the first embodiment, it is possible to protect the memory by dividing the memory into a secure program area and a non-secure program area and restricting access to the secure program area by the non-secure program.

  On the other hand, general purpose registers R0 to Rn store operation data or / and an address. For example, when the secure program is executed, operation data which is secure data is stored in the general purpose registers R0 to Rn. When the data stored in the general purpose registers R0 to Rn is read by the non-secure program, the secure data is stolen. Next, an example in which data stored in general-purpose registers R0 to Rn is stolen will be described using FIG.

  FIG. 17 is a flowchart showing the operation of the microprocessor CPU when a hardware interrupt occurs while a secure program is being executed. In FIG. 17, HDW indicates processing performed by the microprocessor CPU in hardware, and NSP indicates processing performed by the microprocessor CPU executing a non-secure program. FIG. 17 shows an example of branching to interrupt processing defined by the non-secure program when a hardware interrupt occurs.

  First, at step SH00, the microprocessor CPU starts the secure program (Start). Next, in step SH01, it is assumed that a hardware interrupt has occurred (interrupt generation). In response to the occurrence of the interrupt, the interrupt flag is set in step SH02 (interrupt flag set).

  Next, in step SH03, an interrupt condition is determined (interrupt condition determination), and in step SH04, the interrupt flag is cleared (interrupt flag clear). Thereafter, after the interrupt processing is performed, the values of the general purpose registers R0 to Rn are designated by, for example, the second stack pointer 1603 in step SH05 so that the values of the general purpose registers R0 to Rn can be returned. Save to the target stack area (save the value of the general-purpose register). After saving the values of general-purpose registers R0 to Rn, in step SH06, the process branches to interrupt processing (interrupt branch).

  Next branch to the non-secure program by the interrupt branch. At step SN00, the microprocessor CPU executes interrupt processing in which the content of processing is defined by the non-secure program (interrupt processing), and at step SN01, the microprocessor CPU executes a return instruction (RET). .

  The microprocessor CPU executes step SH07 by executing the return instruction (RET). At step SH07, the values of the general purpose registers R0 to Rn saved at step SH05 are returned to the general purpose registers R0 to Rn from the stack area designated by the second stack pointer 1603 (the values of the general purpose registers are restored). In step SH08, execution of the secure program ends (End).

  As described above, when an interrupt occurs, the values of general purpose registers R0 to Rn when the secure program is being executed are saved, but while general purpose registers R0 to Rn hold their respective values, they are not The interrupt processing defined by the secure program will be performed in step SN00. Therefore, secure data stored in the general-purpose register can be read out by the interrupt process (step SN00). For example, by creating a hacking program as a non-secure program and repeatedly generating interrupts, it becomes possible to steal secure data stored in the general purpose registers R0 to Rn.

In the fourth embodiment, a microcomputer LSI provided with a microprocessor CPU capable of protecting data stored in general purpose registers R0 to Rn is provided. In the fourth embodiment, protection of data stored in general purpose registers R0 to Rn is achieved by a general purpose register clear process by a secure program and a general purpose register clear control circuit. Next, general purpose register clear processing by the secure program and a general purpose register clear control circuit will be described.

<General-purpose register clear by secure program>
FIG. 18 is a flowchart showing the operation of the microprocessor CPU according to the fourth embodiment. FIG. 18 is a flowchart showing the operation of the microprocessor CPU when a hardware interrupt occurs while executing a secure program such as RTOS, as in FIG. In FIG. 18, HDW indicates a process performed by hardware of a microprocessor CPU, NSP indicates a process performed by executing a non-secure program, and SSP executes a secure program. Shows the process performed by Also in FIG. 18, when a hardware interrupt occurs, an example of branching to the interrupt processing defined by the non-secure program is shown.

  The process HDW performed by the hardware is achieved by the steps SH00, SH01, SH02 and SH08. Further, the processing SSP performed by executing the secure program is achieved by steps SS00 to SS09, and the processing NSP performed by executing the non-secure program is achieved by steps SN00 and SN01.

  At step SH00, a secure program such as RTOS starts operation (Start). Next, in step SH01, an interrupt occurs (an interrupt is generated). When this interrupt occurs, the interrupt flag is set to, for example, 1 in step SH02 (interrupt flag set).

  On the other hand, in the secure program (RTOS) which has started the operation, the check (determination) of the above-described interrupt flag is performed at a predetermined cycle. That is, in the process SSP performed by executing the secure program, the microprocessor CPU executes an arbitrary secure program in step S00 (secure program execution). After executing the secure program in step S00, the microprocessor CPU determines whether or not the interrupt flag is set to 1 in step SS01. If the interrupt flag is not set, the process returns to step SS00, and an arbitrary secure program is executed. On the other hand, if the interrupt flag is set to 1, then step SS02 is executed by the microprocessor CPU. Thereby, it is periodically determined whether or not the interrupt flag is set to 1. If the interrupt flag is not set, an arbitrary secure program is repeatedly executed.

  Next, the microprocessor CPU executes the secure program to determine the interrupt condition (interrupt condition determination) in step SS02, and clears the interrupt flag in step SS03 (clear interrupt flag).

  Since the interrupt flag is cleared in step SS03, step SH03 (interrupt condition determination) to step SH07 (return of general-purpose register value) described in FIG. 17 are not performed in the process HDW by the hardware.

  Following step SS03, in step SS04, the microprocessor CPU saves the values of the general purpose registers R0 to Rn in the stack area designated by the second stack pointer 1603 (saves the value of the general purpose register). After saving the values of the general purpose registers R0 to Rn, the microprocessor CPU executes step SS05. At step SS05, the microprocessor CPU clears the general purpose registers R0 to Rn. For example, by writing a predetermined value to each of general purpose registers R0 to Rn, each value of general purpose registers R0 to Rn is cleared.

  After clearing each of the general purpose registers R0 to Rn, the microprocessor CPU switches the stack pointer to be used from the second stack pointer 1603 to the first stack pointer 1602 (switching of the stack pointer) in step SS06. Next, in step SS07, the microprocessor CPU executes a software interrupt instruction (CALL). The program called by the interrupt instruction at this time is a non-secure program. The process NSP performed by the called non-secure program is the same as the process NSP described in FIG. The steps performed by the microprocessor CPU in the process NSP are also the same as steps SN00 and SN01 described with reference to FIG. When the non-secure program is executed, the stack pointer is switched to the first stack pointer 1602 in step SS06, so the non-secure program is executed using the first stack pointer 1602.

  In the process NSP, the microprocessor CPU executes the process of step SN01, and the microprocessor CPU resumes the process with the secure program. That is, step SS08 is executed next. At step SS08, the stack pointer to be used is switched from the first stack pointer 1602 to the second stack pointer 1603 (switching of the stack pointer). In step SS09, the values of general purpose registers R0 to Rn saved in step SS04 are restored from general purpose registers R0 to Rn from the stack area designated by the switched second stack pointer 1603 (the values of general purpose registers are restored). .

  After step SS09, the process returns to step SS00. Thereafter, steps SS00 and SS01 are repeatedly executed until the interrupt flag is set to 1, and when the interrupt flag is set to 1, steps SS02 to SS09 and SN00 to SN01 are executed. When the secure program is ended, step SH08 is executed (End).

  As a result, even when a hardware interrupt occurs while executing a secure program, secure data (operation data, address) stored in the general purpose registers R0 to Rn is executed before the non-secure program is executed. Cleared by the microprocessor CPU. Therefore, it is possible to prevent secure data from being stolen.

<General-purpose register clear control circuit>
In the general purpose register clear by the secure program described in FIG. 18, the microprocessor CPU clears each of the general purpose registers R0 to Rn, for example, by writing a predetermined value to each of the general purpose registers R0 to Rn.

  If the secure program executed by the microprocessor CPU is an RTOS, real-time capability can be maintained if the processing performed for the interrupt is completed within a predetermined time. Therefore, real time property can be maintained if clearing of a plurality of general purpose registers by a secure program is completed within a predetermined time as processing for an interrupt. Even if the response from the occurrence of an interrupt to the execution of the corresponding interrupt processing is delayed by a process of clearing a general purpose register, there is no problem in real time.

  However, in an application that controls a motor, for example, in a microcomputer LSI, it is required to execute corresponding interrupt processing within a short period of time after an interrupt occurs. That is, it is required to shorten the response time. In the fourth embodiment, the microprocessor CPU is provided with a general purpose register clear control circuit, and response time can be shortened.

  FIG. 19 is a block diagram showing a configuration of a microprocessor CPU according to the fourth embodiment. FIG. 19 is similar to the microprocessor shown in FIG. 16, so the differences will be mainly described. In the microprocessor CPU shown in FIG. 19, a general purpose register clear control circuit 1900 is added to the microprocessor shown in FIG. The general purpose register clear control circuit 1900 is connected to the control unit 1600 and the general purpose register group 1601 and clears the general purpose registers R0 to Rn included in the general purpose register group 1601 according to an instruction from the control unit 1600.

  The microprocessor CPU according to the fourth embodiment has a function of receiving a maskable interrupt (first interrupt) and an unmaskable interrupt (second interrupt different from the first interrupt). When the non-maskable interrupt is received, the control unit 1600 outputs an instruction to clear the general purpose registers R0 to Rn to the general purpose register clear control circuit 1900.

  FIG. 20 is a flowchart showing the operation of the microprocessor CPU shown in FIG. The operation of the microprocessor CPU shown in FIG. 19 will be described with reference to FIG. The flow chart shown in FIG. 20 is similar to the flow chart shown in FIG. 18, so the main differences will be described here. Also in FIG. 20, HDW indicates processing executed by hardware of the microprocessor CPU, NSP indicates processing executed by executing a non-secure program, and SSP executes a secure program. Shows the processing to be performed.

  The process HDW performed in hardware is achieved by the steps SH00-SH08 and SH10-SH13. Further, the processing SSP performed by executing the secure program is achieved by steps SS00 to SS09, and the processing NSP performed by executing the non-secure program is achieved by steps SN02 to SN05.

  The process SSP (steps SS00 to SS09) performed by executing the secure program is the same as the process SSP (steps SS00 to SS09) described with reference to FIG. Further, in FIG. 20, of the processing NSP performed by executing the non-secure program, step SN02 is described as low-speed interrupt processing, but it is the same as step SN00 described in FIG. , It is the same as step SN01 explained in FIG. Therefore, the description of steps SN02 and SN03 is also omitted.

  At step SH00, the RTOS (secure program) starts operation (Start). Next, in step SH01, an interrupt occurs (an interrupt is generated). Next, in step SH10, it is determined whether the interrupt accepted in step SH01 is a high-speed interrupt (high-speed interrupt?). In the fourth embodiment, non-maskable interrupts correspond to high-speed interrupts. That is, when an unmaskable interrupt is accepted in step SH01, it is determined in step SH10 that the interrupt is a high-speed interrupt. On the other hand, when a maskable interrupt is accepted in step SH01, it is determined in step SH10 that the interrupt is not a high-speed interrupt.

  If it is determined in step SH10 that the interrupt is not a high speed interrupt, step SH02 is next executed. At step SH02, the interrupt flag is set to 1. A check (determination) as to whether or not the interrupt flag is set to 1 is performed at a predetermined cycle as the microprocessor CPU executes the secure program as described in FIG. When the interrupt flag is set to 1 in step SH02, the general purpose registers R0 to Rn are cleared in the process SSP performed by executing the secure program as described in FIG. After general-purpose registers R0 to Rn are cleared, low speed interrupt processing (step SN02) and RET instruction (step SN03) are executed in processing NSP performed by executing non-secure.

  If it is determined in step SH10 that the interrupt is a high speed interrupt, then in step SH03, the interrupt condition is determined (interrupt condition determination), and in step SH04 the interrupt flag is cleared (interrupt flag clear). After clearing the interrupt flag, the values of the general purpose registers R0 to Rn are saved in the stack area designated by the second stack pointer 1603 (the values of the general purpose registers are saved).

  After saving the value of the general purpose register, in step SH11, the control unit 1600 instructs the general purpose register clear control circuit 1900 to clear the general purpose registers R0 to Rn. In response to this instruction, general purpose register clear control circuit 1900 clears general purpose registers R0 to Rn (clears the general purpose register).

  Following step SH11, the stack pointer to be used is switched from the second stack pointer 1603 to the first stack pointer 1602 in step SH12 (switching of the stack pointer). Then, at step SH06, the process branches to interrupt processing (interrupt branch).

  Next branch to the non-secure program by the interrupt branch. In step SN04, the microprocessor CPU executes interrupt processing in which the content of processing is defined by the non-secure program (high-speed interrupt processing), and in step SN05, the microprocessor CPU executes a return instruction (RET). Do.

  The microprocessor CPU executes step SH13 by executing the return instruction (RET). At step SH13, the stack pointer to be used is switched from the first stack pointer 1602 to the second stack pointer 1603 (switching of the stack pointer).

  After switching the stack pointer to the second stack pointer 1603, at step SH07, the values of general purpose registers R0 to Rn saved at step SH05 from the stack area designated by the second stack pointer 1603 are compared with general purpose registers R0 to Rn. Return to (return general register value). At step SH14, execution of the secure program ends (End).

  At step SS05, the microprocessor CPU clears each of the general purpose registers R0 to R6 by executing the secure program. On the other hand, at step SH11, the general purpose registers clear control circuit 1900 clears the general purpose registers R0 to Rn. The general purpose register clear control circuit 1900 can clear the general purpose registers R0 to Rn faster than the general purpose registers R0 to Rn, for example, by the microprocessor CPU. Therefore, when a high speed interrupt is received, it is possible to execute the high speed interrupt processing SN04 with a short response time. Therefore, the microcomputer LSI can be applied to an application requiring interrupt processing to be executed with a short response time. Also in this case, the general purpose registers R0 to Rn are cleared before executing the non-secure program, which makes it possible to prevent secure data from being stolen.

  Furthermore, since the stack pointer is switched, in the secure program, it is difficult to grasp the stack area in which the general-purpose register is saved in the non-secure program. This can further prevent the secure data from being stolen.

  According to the fourth embodiment, a user USR who has purchased a microcomputer LSI having a flash memory FRM in which a secure program such as RTOS has been written uses the microcomputer LSI to require a high speed interrupt such as motor control. It can be used for Also, the user program created by the user USR makes it possible to prevent the secure data from being stolen, and it is also possible to maintain the merits of the seller PRD who sells the microcomputer LSI.

<Supplementary Note>
Although a plurality of inventions are disclosed herein, some of which are described in the claims, other inventions are also disclosed, the representative ones of which are listed below. List.

(A) A semiconductor device comprising: a central processing unit; and a non-volatile memory storing a non-secure program and a secure program executed by the central processing unit,
The central processing unit is a central processing unit capable of accepting a plurality of different interrupts and performing interrupt processing corresponding to the interrupt when there is an interrupt, wherein the central processing unit is:
A control unit that operates according to a program;
A plurality of registers used to hold information when the control unit operates;
A stack pointer specifying an area for saving the values of the plurality of registers when an interrupt occurs;
A register clear control circuit for clearing values held in the plurality of registers;
Equipped with
The central processing unit saves each of the plurality of registers after saving the values of the plurality of registers in the area designated by the stack pointer in response to the first one of the plurality of interrupts. Clear and execute predetermined interrupt processing corresponding to the first interrupt,
The central processing unit responds to a second interrupt different from the first interrupt among the plurality of interrupts, and stores the values held in the plurality of registers in the area designated by the stack pointer. A semiconductor device, wherein the plurality of registers are cleared by the register clear control circuit after evacuation and a predetermined interrupt process corresponding to the second interrupt is performed.

(B) In the semiconductor device according to (A),
The generation of the first interrupt is detected by monitoring by the secure program, and execution of the secure program saves the values of the plurality of registers to the area designated by the stack pointer, and the plurality of registers. Each of the clear and done,
In response to the occurrence of the second interrupt, the central processing unit saves the values of the plurality of registers in the area designated by the stack pointer, and clears the plurality of registers by the register clear control circuit. , Semiconductor devices.

(C) In the semiconductor device according to (B),
The semiconductor device, wherein the secure program is a real time operating system.

(D) A semiconductor device sales model for selling a semiconductor device including a central processing unit for executing a program and an electrically rewritable nonvolatile memory connected to the central processing unit,
A secure program constituting an operating system is stored in the non-volatile memory, and the semiconductor device is sold for a price including the price of the stored secure program,
In the purchased semiconductor device, a semiconductor device sales model in which a program operating on the operating system is written to the rewritable non-volatile memory.

(E) In the semiconductor device sales model described in (D),
In the purchased semiconductor device, a semiconductor device sales model in which a program downloaded via a network is written to the non-volatile memory.

(F) In the semiconductor device sales model described in (E),
The semiconductor device sales model, wherein the downloaded program is provided from those providing the semiconductor device.

(G) In the semiconductor device sales model described in (F),
The semiconductor device includes a license management unit, and before selling the semiconductor device, license information that is prepaid and corresponds to a value for paid software is stored in the license management unit.
In the purchased semiconductor device, if the downloaded program is pay software, the license management unit stores the downloaded program in the non-volatile memory until the value corresponding to the stored license information is reached. Allows the semiconductor device sales model.

  As mentioned above, although the invention made by the present inventor was concretely explained based on an embodiment, the present invention is not limited to the above-mentioned embodiment, and can be variously changed in the range which does not deviate from the gist. Needless to say.

CPU microprocessor FRM non-volatile memory (flash memory)
LSI Microcomputer PRD Vendor USR User 200 Communication Function Circuit 201 Decryption Function Circuit 202 Flash Memory Rewriting Circuit 203 Volatile Memory 204 Memory Protection Unit 300 Fetch Start Address Monitoring Circuit 301 Fetch Address Comparison Circuit 303 Memory Access Control Circuit 700, 704, 705 Comparator 703, 1401 Flip-flop circuit 1307 Illegal access detection circuit

Claims (7)

What is claimed is: 1. A semiconductor device comprising: a central processing unit; and a non-volatile memory storing a non-secure program and a secure program executed by the central processing unit,
The central processing unit is a central processing unit capable of accepting a plurality of different interrupts and performing interrupt processing corresponding to the interrupt when there is an interrupt, wherein the central processing unit is:
A control unit that operates according to a program;
A plurality of registers used to hold information when the control unit operates;
A stack pointer specifying an area for saving the values of the plurality of registers when an interrupt occurs;
A register clear control circuit for clearing values held in the plurality of registers;
Equipped with
The central processing unit saves each of the plurality of registers after saving the values of the plurality of registers in the area designated by the stack pointer in response to the first one of the plurality of interrupts. Clear and execute predetermined interrupt processing corresponding to the first interrupt,
The central processing unit responds to a second interrupt different from the first interrupt among the plurality of interrupts, and stores the values held in the plurality of registers in the area designated by the stack pointer. A semiconductor device, wherein the plurality of registers are cleared by the register clear control circuit after evacuation and a predetermined interrupt process corresponding to the second interrupt is performed. In the semiconductor device according to claim 1,
The generation of the first interrupt is detected by monitoring by the secure program, and execution of the secure program saves the values of the plurality of registers to the area designated by the stack pointer, and the plurality of registers. Each of the clear and done,
In response to the occurrence of the second interrupt, the central processing unit saves the values of the plurality of registers in the area designated by the stack pointer, and clears the plurality of registers by the register clear control circuit. , Semiconductor devices. In the semiconductor device according to claim 2,
The semiconductor device, wherein the secure program is a real time operating system. A semiconductor device sales model for selling a semiconductor device including a central processing unit for executing a program and an electrically rewritable non-volatile memory connected to the central processing unit,
A secure program constituting an operating system is stored in the non-volatile memory, and the semiconductor device is sold for a price including the price of the stored secure program,
In the purchased semiconductor device, a semiconductor device sales model in which a program operating on the operating system is written to the rewritable non-volatile memory. In the semiconductor device sales model according to claim 4,
In the purchased semiconductor device, a semiconductor device sales model in which a program downloaded via a network is written to the non-volatile memory. In the semiconductor device sales model according to claim 5,
The semiconductor device sales model, wherein the downloaded program is provided from those providing the semiconductor device. In the semiconductor device sales model according to claim 6,
The semiconductor device includes a license management unit, and before selling the semiconductor device, license information that is prepaid and corresponds to a value for paid software is stored in the license management unit.
In the purchased semiconductor device, if the downloaded program is pay software, the license management unit stores the downloaded program in the non-volatile memory until the value corresponding to the stored license information is reached. Allows the semiconductor device sales model.

Images