JP2019121955A - Semiconductor device and generating method of encryption key - Google Patents

Abstract

To provide a semiconductor device capable of preventing data leakage due to unauthorized access, and a generating method of an encryption key.SOLUTION: A semiconductor device (key storage) 22 holds the result of scramble of a random number generated by an external random number generation unit by a scramble processing unit 214 by using a scramble key generated by a scramble key generation unit 213 in a storage RAM 215 as a scramble encryption key. Further, in response to a read request, the scramble encryption key is descrambled by using the scramble key to output the obtained encryption key. The key storage 22 holds a key obtained by scrambling the held scrambled encryption key by the scramble key every predetermined period as a new scrambled encryption key.SELECTED DRAWING: Figure 7

Description

  The present invention relates to a semiconductor device, and more particularly to a semiconductor device including a storage unit that stores an encryption key for encrypting data, and an encryption key generation method.

  At present, there is a semiconductor device including a microcomputer having a function of decrypting data using an encryption key and decrypting the encrypted data using the encryption key to restore the original data. It is known (for example, refer to patent documents 1).

  In the semiconductor device, an EEPROM (Electrically Erasable Programmable Read-Only Memory) is provided as a memory for storing the encryption key.

JP, 2014-89640, A

  By the way, although the encryption key should not be leaked to a third party, the encryption key stored in the memory is illegally read out due to an external access such as a physical attack or physical analysis from outside. There was a fear. At this time, the above-described encrypted data is decrypted by the illegitimately obtained encryption key, which causes data leakage.

  Therefore, an object of the present invention is to provide a semiconductor device capable of preventing data leakage due to unauthorized access, and a method of generating an encryption key.

  A semiconductor device according to the present invention is a semiconductor device that encrypts data using an encryption key, and holds a random number generation unit that generates a random number and a scrambled key that scrambles the random number using a scramble key. A key holding unit for outputting an encryption key obtained by descrambling the scramble encryption key using the scramble key in response to a read request, and the key holding unit holds the scramble encryption key held The key is scrambled with the scramble key at predetermined intervals and held as a new scramble encryption key.

  Further, a method of generating an encryption key according to the present invention is a method of generating an encryption key used to encrypt data, wherein a random number scrambled with a scramble key is held in a memory as a scramble encryption key, and the scramble encryption is performed. The key is scrambled with a scramble key at predetermined intervals and held in the memory as a new scramble encryption key, and the scramble encryption key held in the memory is de-multiplexed using the scramble key according to the read request. The encryption key is obtained by scrambling.

  In the present invention, the key holding unit holds the scrambled random number scrambled as a scramble encryption key, and holds the scrambled encryption key itself held scrambled for each predetermined period as a new scramble encryption key.

  As a result, the scramble encryption key held in the key holding unit is itself scrambled repeatedly at predetermined intervals, and its value changes as time passes. Therefore, even if the scramble encryption key held in the key holding unit leaks due to an unauthorized access from the outside, it is difficult to specify the encryption key itself from the scramble encryption key. Therefore, it is possible to prevent the leakage of plaintext data even if unauthorized access is performed.

FIG. 1 is a block diagram showing a configuration of a microcomputer 100 as an example of a semiconductor device according to the present invention. FIG. 6 is a block diagram showing a state of data transfer in a first step performed in microcomputer 100 when data is encrypted. FIG. 7 is a block diagram showing a state of data transfer in a second step performed in microcomputer 100 when data is encrypted. FIG. 16 is a block diagram showing the state of data transfer in the third step performed in microcomputer 100 when data is encrypted. It is a block diagram showing the state of the data transfer in the 4th step performed in the microcomputer 100, when encrypting data. FIG. 16 is a block diagram showing the state of data transfer in a fifth step performed in microcomputer 100 when data is encrypted. FIG. 2 is a block diagram showing an example of an internal configuration of a key storage 22. FIG. 10 is a flowchart showing a procedure of an encryption key holding operation performed in the key storage 22. FIG. FIG. 10 is a flowchart showing a procedure of an encryption key reading operation performed in the key storage 22. FIG. FIG. 10 is a block diagram showing a modification of the internal configuration of the microcomputer 100. 10 is a block diagram showing another example of the internal configuration of the key storage 22. FIG. FIG. 11 is a block diagram showing a state of data transfer at a first stage performed in the microcomputer 100 shown in FIG. 10 when data is encrypted. FIG. 11 is a block diagram showing a state of data transfer in a second stage performed in microcomputer 100 shown in FIG. 10 when data is encrypted. FIG. 11 is a block diagram showing a state of data transfer in a third step performed in microcomputer 100 shown in FIG. 10 when data is encrypted. FIG. 11 is a block diagram showing a state of data transfer in a fourth step performed in microcomputer 100 shown in FIG. 10 when data is encrypted. FIG. 11 is a block diagram showing a state of data transfer in a fifth step performed in microcomputer 100 shown in FIG. 10 when data is encrypted. FIG. 11 is a block diagram showing a state of data transfer in a sixth step performed in microcomputer 100 shown in FIG. 10 when data is encrypted.

  FIG. 1 is a block diagram showing a configuration of a microcomputer 100 included in a semiconductor device according to the present invention.

  The microcomputer 100 includes an encryption processing unit 12, a random number generation unit 13, a CPU (central processing unit) 14, a RAM (random access memory) 15, a ROM (read only memory) control unit 16, a ROM 17, a secure RAM 19, a secure ROM 20, a secure It has a DMAC (direct memory access controller) 21 and a key storage 22.

  Further, microcomputer 100 includes two systems of data buses BS1 and BS8. The microcomputer 100 can perform data communication with an externally connected device, and transmits or receives various data via the data bus BS1.

  To the data bus BS1, an encryption processing unit 12, a random number generation unit 13, a CPU 14, a RAM 15, a ROM control unit 16, a ROM 17, a secure RAM 19, and a key storage 22 are connected.

  Data bus BS8 is an independent bus which is not connected to data bus BS1 and can not be accessed from the outside of microcomputer 100. The data bus BS8 is connected to the random number generation unit 13, the secure RAM 19, the secure ROM 20, the secure DMAC 21, the key storage 22, and the encryption processing unit 12 which are required to be confidential.

  The cryptographic processor 12 encrypts a plaintext data piece before encryption received via the data bus BS1 using an encryption key to obtain an encrypted data piece, and sends it to the data bus BS1. Also, the encryption processing unit 12 decrypts the encrypted data piece received via the data bus BS1 using this encryption key, thereby restoring the plaintext data piece before encryption. The encryption processing unit 12 acquires the encryption key from the key storage 22 prior to the execution of such encryption or decryption processing.

  The random number generation unit 13 generates a random number whose random number value changes at a predetermined constant cycle, and sends it to the data bus BS8.

  The CPU 14 is a central processing unit of the microcomputer 100, and performs various operations or data transfer in accordance with a program stored in the ROM 17.

  The RAM 15 is a storage element to which data can be written, and the CPU 14 writes or reads data.

  The ROM control unit 16 writes data to the ROM 17, performs verification to confirm whether the data is correctly written, or erases the written data. Further, the ROM control unit 16 makes a write request to the secure DMAC 21.

  Program data representing a program executed by the CPU 14 is written in the ROM 17.

  Secure RAM 19 stores data received via data bus BS 8 in response to data write access from secure DMAC 21. Also, in response to the data read access from the secure DMAC 21, the secure RAM 19 reads the data stored therein and sends it to the data bus BS8. In addition, secure RAM 19 stores data received via data bus BS1 in response to a data write access from CPU 14. The secure RAM 19 does not accept data read access from the CPU 14.

  In response to the data read access from secure DMAC 21, secure ROM 20 reads the data stored therein and sends it to data bus BS8. Also, when the ROM control unit 16 makes a write request to the secure DMAC 21, the secure ROM 20 writes the data received by the secure DMAC 21 via the data bus BS8.

  The secure DMAC 21 performs data transfer between the cryptographic processor 12, the random number generator 13, the secure RAM 19, the secure ROM 20, the secure DMAC 21, and the key storage 22 via the data bus BS8.

  The key storage 22 generates a scramble encryption key in which the random number generated by the random number generation unit 13 is scrambled, and holds this. Further, the key storage 22 reads the held scramble encryption key in response to the read request for the encryption key, and sends out the scrambled key applied to the scramble encryption key as the encryption key to the data bus BS8. .

  According to the above configuration, the microcomputer 100 performs various data processing including encryption and decryption processing of plaintext data using the above encryption key in accordance with the program stored in the ROM 17.

  The operation of encrypting the plaintext data stored in the RAM 15 will be described below with reference to FIGS.

  First, the secure DMAC 21 transfers the random number generated by the random number generation unit 13 to the key storage 22 via the data bus BS8, as indicated by the thick arrow in FIG. The key storage 22 holds the scrambled random number transferred as a scramble encryption key.

  Next, the secure DMAC 21 issues a read request for the encryption key to the key storage 22. As a result, the encryption key sent from the key storage 22 is secured via the data bus BS8 as shown by the thick arrow in FIG. It transfers to RAM19. Thereby, the secure RAM 19 stores the encryption key.

  Next, the secure DMAC 21 reads the encryption key stored in the secure RAM 19 and transfers it to the secure ROM 20 via the data bus BS8, as shown by the thick arrow in FIG. Thereby, the secure ROM 20 writes the encryption key. That is, each time encryption is performed by the encryption processing unit 12, the encryption key used in the encryption is additionally written to the secure ROM 20. Therefore, a history of the used encryption key remains in the secure ROM 20.

  Next, the secure DMAC 21 reads the encryption key stored in the secure RAM 19 and transfers it to the encryption processing unit 12 via the data bus BS8, as indicated by the thick arrow in FIG. Further, the CPU 14 reads the plaintext data piece stored in the RAM 15 and transfers it to the encryption processing unit 12 via the data bus BS1 as shown by the thick arrow in FIG. The encryption processing unit 12 encrypts the transferred plaintext data using the transferred encryption key to generate an encrypted data piece, and sends it to the data bus BS1.

  Next, the CPU 14 transfers the encrypted data piece generated by the encryption processing unit 12 to the RAM 15 via the data bus BS1 as indicated by the thick arrow in FIG. Thereby, the RAM 15 stores the transferred encrypted data piece.

  As described above, in encryption of plaintext data, in the microcomputer 100, the secure DMAC 21 first transfers the random number generated by the random number generation unit 13 to the key storage 22 as shown in FIG. At this time, the key storage 22 holds the scrambled random number as a scramble encryption key. Then, after the secure DMAC 21 reads out the scrambled encryption key from the key storage 22 and stores the encryption key in the secure RAM 19 and the secure ROM 20 as shown in FIGS. 3 and 4, as shown in FIG. To the cryptographic processor 12.

  When the encrypted data piece stored in the RAM 15 is to be decrypted into the original plaintext data piece, the CPU 14 reads the encrypted data piece from the RAM 15 and sends it to the encryption processing unit 12 via the data bus BS1. Transfer to Furthermore, the secure DMAC 21 reads out from the secure RAM 19 the encryption key used when encrypting the plaintext data piece, and transfers it to the encryption processing unit 12 via the data bus BS8. Therefore, the encryption processing unit 12 obtains a plaintext data piece by decrypting the transferred encrypted data piece using the transferred encryption key.

  Further, when transmitting the encrypted data piece to an external device connected to the microcomputer 100, the encryption data corresponding to the encrypted data piece is transmitted together with the encrypted data piece according to a predetermined algorithm.

  The key storage 22 adopts the following configuration in order to prevent leakage of the encryption key due to unauthorized access from the outside.

  FIG. 7 is a block diagram showing an example of the internal configuration of the key storage 22. As shown in FIG.

  As shown in FIG. 7, the key storage 22 includes a scramble key generation unit 213, a scramble processing unit 214, a storage RAM 215, a register 216, and a timer 217.

  The scramble key generation unit 213 generates, as the scramble key SKY, a random number whose random number value changes as time passes, and supplies this to the scramble processing unit 214.

  When the scramble processing unit 214 receives the random number generated by the random number generation unit 13 via the data bus BS8, the scramble processing unit 214 takes in the scramble key SKY, and performs a scramble operation (for example, exclusive OR) using the scramble key SKY. Apply to the above random number. Then, the scramble processing unit 214 sets the result obtained by the scramble operation as the scramble encryption key SEK, and causes the storage RAM 215 to hold the result in association with the scramble key SKY.

  In addition, the scramble processing unit 214 reads the scramble encryption key SEK held in the storage RAM 215 in response to the time-out signal Tout, and takes in the scramble key SKY generated by the scramble key generation unit 213. Here, the scramble processing unit 214 generates a new scramble encryption key SEK by performing a scramble operation using the acquired scramble key SKY on the scramble encryption key SEK read from the storage RAM 215. Then, the scramble processing unit 214 causes the storage RAM 215 to hold the new scramble encryption key data SEK in association with the scramble key SKY.

  Further, the scramble processing unit 214 first reads out the scramble encryption key SEK held in the storage RAM 215 and the scramble key SKY associated with the scramble encryption key SEK in response to the read request for the encryption key. . Next, the scramble processing unit 214 uses the scramble key SKY to perform a descrambling operation on the scramble encryption key SEK to restore the encryption key, and sends the encryption key to the data bus BS8.

  Register 216 holds an operation start signal or an operation stop signal received via data bus BS1. When the register 216 holds the operation start signal, the register 216 supplies the timer 217 with an operation start signal ST for starting the counting operation of the timer 217. On the other hand, when holding the operation stop signal, the register 216 supplies the timer 217 with the operation stop signal STP for stopping the counting operation of the timer 217.

  The timer 217 receives the clock signal, and starts counting the number of pulses of the clock signal when the operation start signal ST is supplied. Here, the timer 217 supplies the time-out signal Tout to the scramble processing unit 214 when the count number reaches the predetermined value. After supplying the timeout signal Tout to the scramble processing unit 214, the timer 217 continues to count the number of pulses of the clock signal from an initial value (for example, zero). That is, the timer 217 supplies the time-out signal Tout to the scramble processing unit 214 every predetermined period. When the timer 217 receives the operation stop signal STP, the timer 217 stops the counting operation described above.

  The operation of storing and reading the encryption key performed inside the key storage 22 having the configuration shown in FIG. 7 will be described below.

  FIG. 8 is a flowchart showing the procedure of the operation of holding the encryption key performed in the key storage 22 in response to the operation start signal received from the CPU 14 via the data bus BS1. The CPU 14 supplies an operation start signal to the key storage 22 via the data bus BS1, for example, in response to power on.

  First, the register 216 of the key storage 22 supplies the operation start signal ST to the timer 217 to start the counting operation of the timer 217 (step S31). Thus, the timer 217 counts the number of pulses of the clock signal from the initial value.

  During this time, the scramble processing unit 214 determines whether or not the time-out signal Tout is supplied from the timer 217 (step S32). The timer 217 supplies a time-out signal Tout to the scramble processing unit 214 when the count number reaches a predetermined value.

  If it is determined in step S32 that the timeout signal Tout is not supplied, the scramble processing unit 214 continues to determine whether the timeout signal Tout is supplied.

  If it is determined in step S32 that the time-out signal Tout has been supplied, the scramble processing unit 214 reads the scramble encryption key held in the storage RAM 215 and takes it in, and takes in the scramble key SKY (step S33).

  Next, the scramble processing unit 214 generates a new scramble encryption key SEK by performing a scramble operation on the acquired scramble encryption key using the scramble key acquired as described above (step S34).

  Next, the scramble processing unit 214 associates the scramble encryption key SEK generated in step S34 with the scramble key SKY used in the scramble operation and causes the storage RAM 215 to hold the scramble encryption key SEK (step S35).

  Next, the timer 217 determines whether the operation stop signal STP is supplied from the register 216 (step S36).

  If it is determined in step S36 that the operation stop signal STP is not supplied, the timer 217 continues counting the pulses of the clock signal. As a result, the scramble processing unit 214 returns to step S32 described above, and executes the operations of steps S32 to S35 described above again.

  Therefore, a scrambled encryption key obtained by scrambling the encryption key is held in the storage RAM 215, and the held scrambled encryption key itself is scrambled for each predetermined period, and is held in the storage RAM 215 as a new scrambled encryption key. The predetermined period, that is, the period from when the timer 217 starts counting from the initial value to when transmitting the time-out signal Tout, is shorter than the change period (fixed period) of the random number in the random number generation unit 13. As a result, one random number generated by the random number generation unit 13 can be scrambled a plurality of times.

  Here, when the operation of the key storage 22 is to be stopped, the CPU 14 supplies an operation stop signal to that effect to the key storage 22 via the data bus BS1. When the operation stop signal is received, the register 216 of the key storage 22 holds the operation stop signal and supplies the operation stop signal STP to the timer 217. Thereby, the operation of holding the encryption key by the key storage 22 is stopped.

  Incidentally, the scramble processing unit 214 reads out all scramble encryption keys and scramble keys held in the storage RAM 215 in response to the power-off, and sends them to the data bus BS8. At this time, the secure DMAC 21 transfers all the scramble encryption keys and scramble keys sent to the data bus BS 8 to the secure ROM 20. Therefore, in response to the power-off of the microcomputer 100, all the scramble encryption keys and scramble keys held in the storage RAM 215 are written in the secure ROM 20.

  FIG. 9 is a flow chart showing the procedure of the encryption key reading operation performed in the key storage 22 in response to the encryption key reading request received from the secure DMAC 21 via the data bus BS8.

  First, the scramble processing unit 214 reads a desired scramble encryption key from the storage RAM 215 (step S41), and subsequently reads a scramble key associated with the scramble encryption key (step S42).

  Next, the scramble processing unit 214 restores the encryption key by performing a descrambling operation using the scramble key on the read scramble encryption key to cancel the scrambling (step S43).

  Then, the scramble processing unit 214 transmits the restored encryption key via the data bus BS8 (step S44).

  As described above, the key storage 22 holds the scrambled random number generated by the random number generation unit 13 as the scramble encryption key. Thereafter, the key storage 22 holds, as a new scramble encryption key, one obtained by scrambling the held scramble encryption key itself for each predetermined period (S32 to S36).

  Further, the key storage 22 first reads the held scramble encryption key in response to the request for reading the encryption key (S41), and subsequently reads the scramble key corresponding to the scramble encryption key (S42). Then, the key storage 22 descrambles the scramble encryption key using the scramble key to restore the encryption key (S43), and outputs this.

  As such, since the scramble encryption key held in the key storage 22 is itself repeatedly scrambled at predetermined intervals, its value changes as time passes. Therefore, even if the scramble encryption key held in the key storage 22 leaks due to unauthorized access from the outside, the encryption key itself can not be identified from the scramble encryption key. Also, the secure RAM 19 and the secure ROM 20 in which the used encryption key is written are not the data bus BS1 accessible from the outside of the microcomputer 100, but read out of the encryption key via the data bus BS8 incapable of external access. Is done.

  Therefore, even if unauthorized access is performed, it is possible to prevent the leakage of plaintext data operated by the microcomputer 100.

  In the microcomputer 100 shown in FIG. 1, secrecy is achieved by using the data bus BS8 which is not connected to the CPU 14 and which is not connected to the CPU 14 separately from the externally accessible data bus BS1. Operation of high encryption keys.

  However, even with only the data bus BS1 as the data bus used in the microcomputer 100, it is possible to operate an encryption key with high confidentiality.

  FIG. 10 is a block diagram showing a modification of the internal configuration of microcomputer 100 made in view of the above point.

  In the microcomputer 100 shown in FIG. 10, the data bus BS8 is omitted from the configuration shown in FIG. 1, and the bus master enable signal BSE is supplied to each module (12 to 17 and 19 to 22). The bus master enable signal BSE is, for example, a binary signal representing one of logic level 1 representing an enable state and logic level 0 representing a disable state.

  When the bus master enable signal BSE indicates the disable state, the encryption processing unit 12, the CPU 14, the RAM 15, the ROM control unit 16 and the ROM 17 are connected to the data bus BS1. At this time, the random number generation unit 13, the secure RAM 19, the secure ROM 20, the secure DMAC 21, and the key storage 22 are disconnected from the data bus BS1.

  On the other hand, when the bus master enable signal BSE indicates the enabled state, the cryptographic processor 12, the random number generator 13, the secure RAM 19, the secure ROM 20, the secure DMAC 21, and the key storage 22 are connected to the data bus BS1. When the bus master enable signal BSE indicates the enable state, the CPU 14, the RAM 15, the ROM control unit 16 and the ROM 17 are disconnected from the data bus BS1.

  Except for the points described above, the configuration of each module (12 to 17 and 19 to 22) included in the microcomputer 100 shown in FIG. 10 is the same as that shown in FIG.

  FIG. 11 is a block diagram showing an internal configuration of key storage 22 used in microcomputer 100 having the configuration shown in FIG. In the configuration shown in FIG. 11, the other configuration and the operation thereof are the same as those described with reference to FIGS. 7 to 9 except that the bus connection unit 210 is newly provided.

  The bus connection unit 21 receives the bus master enable signal BSE, and connects the scramble processing unit 214 and the register 216 to the data bus BS1 when the bus master enable signal BSE indicates the enable state. On the other hand, when the bus master enable signal BSE indicates the disable state, the bus connection unit 21 cuts off the connection between the scramble processing unit 214 and the register 216 and the data bus BS1.

  In addition, the other modules (12 to 17 and 19 to 21) other than the key storage 22 are also switched in the connection state (connection or disconnection) with the data bus BS1 according to the bus master enable signal BSE as described above. Department is included. However, the encryption processing unit 12 is always connected to the data bus BS1 regardless of the contents (enable state, disable state) of the bus master enable signal BSE.

  In the following, in the microcomputer 100 having the configuration shown in FIG. 10 and FIG. 11, the operation in encrypting the plaintext data piece stored in the RAM 15 will be described with reference to FIG. 12 to FIG.

  First, the bus master enable signal BSE is set to the enable state. Thus, among the modules (12 to 17 and 19 to 22), the cryptographic processor 12, the random number generator 13, the secure RAM 19, the secure ROM 20, the secure DMAC 21, and the key storage 22 are connected to the data bus BS1. . Here, the secure DMAC 21 transfers the random number generated by the random number generation unit 13 to the key storage 22 via the data bus BS1 as shown by the thick arrow in FIG. At this time, the key storage 22 holds the scrambled random number transferred as a scramble encryption key.

  Next, the secure DMAC 21 requests the key storage 22 to read out the encryption key, whereby the encryption key read from the key storage 22 is transmitted via the data bus BS1 as shown by the thick arrow in FIG. Transfer to the secure RAM 19. Thereby, the secure RAM 19 stores the encryption key.

  Next, the secure DMAC 21 reads the encryption key stored in the secure RAM 19 as described above, and transfers it to the secure ROM 20 via the data bus BS1 as shown by the thick arrow in FIG. Thereby, the secure ROM 20 writes the encryption key. That is, every time encryption processing is performed by the encryption processing unit 12, the encryption ROM used in the encryption processing is additionally written to the secure ROM 20 in the secure ROM 20. Therefore, a history of the used encryption key remains in the secure ROM 20.

  Next, the secure DMAC 21 reads the encryption key stored in the secure RAM 19 and transfers it to the encryption processing unit 12 via the data bus BS1 as shown by the thick arrow in FIG.

  Next, as shown in FIG. 16, the bus master enable signal BSE is set to the disabled state. Thereby, among the modules (12 to 17 and 19 to 22), the encryption processing unit 12, the CPU 14, the RAM 15, the ROM control unit 16 and the ROM 17 are connected to the data bus BS1. Here, the CPU 14 reads the plaintext data piece stored in the RAM 15 and transfers it to the cryptographic processor 12 via the data bus BS1, as shown by the thick arrow in FIG. The encryption processing unit 12 generates the encrypted data piece by encrypting the transferred plaintext data using the transferred encryption key.

  Then, as shown in FIG. 17, the bus master enable signal BSE is set to the enable state again, and the secure DMAC 21 causes the encrypted data pieces generated by the cryptographic processing unit 12 to be indicated by thick arrows in FIG. It transfers to RAM15 via data bus BS1. Thereby, the RAM 15 stores the transferred encrypted data piece.

  As described above, when the configuration shown in FIG. 10 is adopted as microcomputer 100, data bus BS8 becomes unnecessary, and therefore, compared with the case where the configuration shown in FIG. It is possible to reduce the area.

  In the above embodiment, the key storage 22 including the storage RAM 215, that is, the volatile semiconductor memory is used as a key holding unit for holding the scrambled encryption key, but the key holding unit is a nonvolatile memory or It may be a magnetic or optical recording medium.

  In short, as the microcomputer 100 provided with the data encryption function, any microcomputer may be used as long as it includes the following random number generation unit and key holding unit.

  That is, the key holding unit (22) holds the random number generated by the random number generation unit (13) scrambled with the scramble key (SKY) as the scramble encryption key (SEK). At this time, the key holding unit (22) holds the scrambled encryption key scrambled by the scramble key every predetermined period as a new scrambled encryption key. In addition, the key holding unit (22) outputs, in response to the read request, the scrambled encryption key held and descrambled using the scramble key as the encryption key.

12 cryptographic processor 13 random number generator 22 key storage 213 scramble key generator 214 scramble processor 215 storage RAM

Claims (8)

A semiconductor device that encrypts data using an encryption key,
A random number generation unit that generates random numbers;
A key holding unit which holds the scrambled random number scrambled using a scramble key as a scramble encryption key, and outputs an encryption key obtained by descrambling the scramble encryption key using the scramble key according to the read request And
The key holding unit is
A semiconductor device characterized in that a scrambled key obtained by scrambling the held scrambled encryption key with a scramble key at predetermined intervals is held as a new scrambled encryption key. The key holding unit is
A scramble key generation unit that generates a random number whose value changes as time passes, as the scramble key;
With memory
The random number scrambled by the scramble key is held as the scramble encryption key in the memory, and the scramble key generated by the scramble key generation unit is stored in the memory for each predetermined period. A scramble processing unit for capturing a scramble encryption key, and scrambled the captured scramble encryption key with the captured scramble key, and holding the scrambled encryption key in the memory as a new scramble encryption key. The semiconductor device according to claim 1. The random number generation unit generates the random number whose random number value changes at a predetermined constant cycle,
The semiconductor device according to claim 1, wherein the predetermined period is shorter than the predetermined period. The ROM where the program is stored,
A CPU that performs control according to the program;
RAM,
An encryption processing unit that encrypts data based on an encryption key;
The semiconductor device according to any one of claims 1 to 3, further comprising: a direct memory access controller (DMAC) that performs write and read control on the key holding unit. A first data bus to which the ROM, the CPU, the RAM, and the encryption processing unit are connected;
The random number generation unit, the key holding unit, the DMAC, and a second data bus to which the encryption processing unit is connected;
A plaintext data piece is stored in the RAM,
The CPU transfers the plaintext data piece stored in the RAM to the encryption processing unit via the first data bus.
The DMAC transfers the encryption key read from the key holding unit in response to the read request to the encryption processing unit via the second data bus.
The encryption processing unit generates an encrypted data piece obtained by encrypting the plaintext data piece received via the first data bus with the encryption key received via the second data bus. 5. The semiconductor device according to claim 4, wherein the data is sent to a data bus of 1. Including the first data bus,
Receive a bus master enable signal representing enable or disable;
When the bus master enable signal indicates the enable, the random number generation unit, the key holding unit, the DMAC, and the encryption processing unit are connected to the first data bus, and the bus master enable signal indicates the disable. 5. The semiconductor device according to claim 4, wherein the ROM, the CPU, the RAM, and the encryption processing unit are connected to the first data bus in this case. A plaintext data piece is stored in the RAM,
With the bus master enable signal set to a state representing the disable, the CPU transfers the plaintext data piece stored in the RAM to the encryption processing unit via the first data bus,
With the bus master enable signal set to a state representing the enable, the DMAC sends the encryption key read from the key holding unit by the read request to the encryption processing unit via the first data bus. Transfer
The encryption processing unit may generate an encrypted data piece obtained by encrypting the plaintext data piece received via the first data bus with the encryption key received via the first data bus. The semiconductor device according to claim 6, characterized in that A method of generating an encryption key used for data encryption, comprising:
A random number scrambled by a scramble key is held as a scramble encryption key in a memory, and a scrambled key scrambled by a scramble key every predetermined period is held as a new scramble encryption key in the memory.
A method of generating an encryption key, comprising obtaining the encryption key by descrambling the scramble encryption key held in the memory using the scramble key in response to a read request.

Images