JP4722625B2 - Memory access control circuit, method and application storage method - Google Patents

Description

  The present invention relates to a memory access control circuit, a memory access control method, and an application storage method.

  2. Description of the Related Art Conventionally, businesses that are permitted to use memory areas in multi-application IC cards, memory areas that have been permitted in advance, and memory areas that have been used are prevented from being unreasonably consumed. (For example, refer to Patent Document 1).

  Further, in a multi-application IC card capable of storing a plurality of rewritable applications, an application corresponding to data selected by a plurality of communication means is selected from a plurality of applications and started (for example, , See Patent Document 2).

  Also, when translating high-level languages or intermediate languages into machine language, if secret information is rewritten or read out, the operation is detected and the translation is stopped (for example, patents) Reference 3).

As a memory protection function, a virtual storage mechanism using an MMU (Memory Management Unit) provided in a general-purpose OS (Operating System) is used. (For example, refer nonpatent literature 1).
JP 11-154207 A JP 2002-31722 A JP 05-290224 A Tsutomu Sawada, Masaki Gondo, Masatake Nagai, “Practical Embedded OS Construction Techniques—Introduction to Basic Technology RTOS to Support Information Communication”, Kyoritsu Publishing Co., Ltd., November 7, 2001, P244

  However, in such a method, when there are a plurality of applications in the same memory, CPU resources are scarce, or the OS does not support memory access management such as virtual memory corresponding to multi-applications, Since each application cannot prohibit writing to the memory area used by each other, unauthorized references from other applications, erroneous erasure due to bugs, and overwriting cannot be prevented, resulting in reduced safety. It was. In addition, there is a situation in which a portion unrelated to the secret information in the memory may be invaded by a malicious application or the like.

  In addition, it was possible to check the remaining memory size of the memory area and the occupancy of the illegal memory area of the application. However, in order to utilize multiple applications more effectively, the limited memory area can be efficiently used. There was a situation where multiple applications had to be deployed.

  The present invention has been made in view of the above-described conventional circumstances, and provides a memory access control circuit and a memory access control method capable of realizing highly secure memory access control even in an OS that does not support multi-applications. The purpose is to provide.

  It is another object of the present invention to provide a memory access control circuit for storing an application in a memory area and an application storage method.

  In order to achieve the above object, a first memory access control circuit of the present invention has an application reference list including address information related to an address of a memory area in which an application is stored, and the address information is input to the application reference list. An allocation unit to be registered; a latch unit that prohibits a change to the application reference list after registration by the allocation unit; a plurality of application reference areas to which the address information is allocated based on the application reference list; and the application And a switching unit that switches the application reference area based on an instruction from a system that controls execution of the application.

  With this configuration, highly secure memory access control can be realized even with an OS that does not support multi-applications.

  Further, in the second memory access control circuit of the present invention, the system has a system reference list including the address information, and the allocation unit is based on activation of the system and the system reference list. The address information is registered in the application reference list.

  With this configuration, when the system is activated, the system can set the application reference list, and the application cannot set the application reference list.

  According to a third memory access control circuit of the present invention, the system includes a determination unit that determines whether or not the application can be installed, and the latch unit when the installation is possible as a result of the determination by the determination unit. And a latch release unit that disables the prohibition of the change to the application reference list, and the address information of the application is registered in the application reference list in which the prohibition of the change is disabled by the latch release unit. .

  With this configuration, the application reference list can be changed only when the application is installed, and the application can be installed more safely.

In the fourth memory access control circuit of the present invention, the memory area is plural.
The application is configured to be stored in an arbitrary memory area.

  With this configuration, the application is stored so that it cannot be seen from a continuous area from the outside, so that the analysis difficulty level of the application is increased.

  In the fifth memory access control circuit of the present invention, the latch release unit invalidates the prohibition of changing the application reference list based on authentication using a security IC.

  With this configuration, the safety when changing the application reference list at the time of application installation is further increased, and the application can be installed more safely. For example, the password match or the case where the memory access control circuit authenticates with the first secret key and the system has the second secret key.

  The sixth memory access control circuit of the present invention is configured to prohibit switching to an application reference area that refers to the application when the application instructs switching of the application reference area.

  With this configuration, it is possible to eliminate the influence on other applications due to a malicious application runaway.

  The seventh memory access control circuit of the present invention has an application reference list that includes address information related to addresses of one or more memory areas in which one or more applications are stored, and the address is stored in the application reference list. An allocation unit for registering information, a latch unit for prohibiting a change to the application reference list after registration by the allocation unit, and a plurality of application reference areas to which the address information is allocated based on the application reference list And the application reference area is configured such that the total capacity of the memory area indicated by the address information to be allocated is limited.

  With this configuration, an application can be efficiently stored in the memory area.

  The first memory access control method of the present invention includes an allocation step in which the address information is registered in an application reference list including address information related to an address of a memory area in which the application is stored, and after registration in the allocation step, The change to the application reference list is prohibited, and the plurality of application reference areas to which the address information is assigned based on the application reference list are switched based on an instruction from a system that controls execution of the application And a method having steps.

  With this method, it is possible to realize highly secure memory access control even for an OS that does not support multi-applications.

  The first application storage method of the present invention includes an allocation step in which the address information is registered in an application reference list including address information related to addresses of one or more memory areas in which one or more applications are stored; A plurality of application reference areas to which the address information is allocated based on the application reference list are indicated by the address information to be allocated. The total capacity of the memory area is limited.

  By this method, the application can be efficiently stored in the memory area.

  As described above, according to the present invention, it is possible to provide a memory access control circuit and a memory access control method capable of realizing highly secure memory access control even for an OS that does not support multi-applications. . It is also possible to provide a memory access control circuit and an application storage method for efficiently storing an application in a memory area.

  Hereinafter, a memory access control circuit according to an embodiment of the present invention will be described with reference to the drawings.

  (First embodiment)

  FIG. 1 is a schematic diagram of a terminal device 100 according to the first embodiment of the present invention. The terminal device 100 includes a CPU (Central Processing Unit) 110, a memory access control circuit 120, and a memory 130. The CPU 110 has a system 111 and application execution means 112. In addition, the memory access control circuit 120 includes an allocation unit 121, a latch unit 122, a bank unit 123, and a switching unit 124. The memory 130 has a plurality of applications 131 to 134 in a plurality of memory areas.

  Here, the allocation means 121 is an example of an allocation unit. The latch unit 122 is an example of a latch unit. The bank unit 123 is an example of an application reference area. The switching unit 124 is an example of a switching unit.

  The system 111 gives various instructions to the allocation means 121, the latch means 122 and the switching means 124 of the memory access control circuit 120. In addition, the system 111 controls the application execution means for executing the application by 112.

  The application execution unit 112 activates and executes each of the applications 131 to 134.

  The memory access control circuit 120 is provided for improving security like a firewall, and is configured by hardware.

  The allocating unit 121 is configured by a circuit, and allocates address information of each application 131 to 134 to the memory map 121A according to an instruction from the system 111 before the application executing unit 112 activates the applications 131 to 134.

  The memory map 121A includes the type of memory allocated to the banks 123A to 123D, address information, memory area size information, and the like.

  The latch means 122 is constituted by a circuit and prohibits reassignment to the memory map 121A. This latch becomes invalid after a hard reset. Further, since the system 111 is activated before the memory access control circuit 120 when the system 111 is activated, the latch unit 122 latches the memory map 121A according to the instruction of the system 111 before the applications 131 to 134 to be activated are selected. As a result, memory allocation by the applications 131 to 134 can be prevented.

  The bank unit 123 includes a plurality of banks 123 </ b> A to 123 </ b> D that are temporary memories having a predetermined size area. Since the banks 123A to 123D have logic for assigning address information based on the memory map 121A, the applications 131 to 134 on the memory 130 can be referred to.

  In the present embodiment, the bank unit 123 has four banks, but the number of banks may be larger or smaller. The system 111 and the applications 131 to 134 are assigned to different banks 123A to 123D, respectively. Further, memory allocation is performed per bank, for example, in units of one application.

  The switching unit 124 performs switching (bank switching) to the banks 123A to 123D to which the permitted application is allocated in accordance with an instruction from the system 111. Since the switching means 124 interrupts the system 111 whenever the bank is switched, the control right is always assigned to the system when the bank is switched from the application 131 to 134 to the system 111 or from the application to another application. 111. Whether the system is switched to the system 111 or the applications 311 to 314 can be determined by checking the return value after the bank switching.

  If the result of this determination is that bank switching is instructed by the system 111, the switching means 124 transfers control rights to the applications 131 to 134 specified by the system 111. On the other hand, when the applications 311 to 314 attempt to switch banks, the control right is not transferred to the applications 311 to 314. It is also possible to ensure the safety of other applications by not giving control rights to the application that attempted this bank switching.

The memory 130 includes a ROM (Read Only Memory), a RAM (Random Access Memory), and the like, and includes a plurality of applications 131 to 134 for providing a plurality of different services.

Although this embodiment has four applications, it may be more or less than this. The application 131 corresponds to the bank 123A, the application 132 corresponds to the bank 123B, the application 133 corresponds to the bank 123C, and the application 134 corresponds to the bank 123D.

  Next, operations at the time of system startup of the terminal device 100 when performing bank switching, bank switching, and application installation will be described.

First, the operation of the terminal device 100 when the system 111 is activated will be described.
First, the system 111 sets the memory map 121A recorded at the head of the system area in the allocation means 121 of the memory access control circuit 120. Thereafter, the latch means 122 latches the memory map 121A so that the system 111 and the applications 131 to 134 cannot change the memory map 121A.

  Even if the application execution unit 122 malfunctions and the system 111 is reset regardless of whether it is unexpected or intentional, the system 111 and the application execution unit 112 restart the system 111 first. The memory map 121A cannot be changed by 134. In addition, when the system 111 is activated, only a part of the head of the system area in the system 111 can be referred to.

  Next, the operation of the terminal device 100 at the time of bank switching will be described. Here, an example of bank switching from the banks 123A to 123B (applications 131 to 132) will be described.

  First, when the application execution means 112 that is executing the application 131 attempts to switch banks, an interruption by the system 111 is entered, and the control right is transferred from the application 131 to the system 111. The switching circuit 124 selects the application 132 by changing the activation target bank from the bank 123A to 123B in accordance with an instruction from the system 111. With this switching, the control right is transferred from the system 111 to the application 132. The application 132 can have control right until a predetermined interruption such as the termination of the application 132 or an interruption by the system 111 occurs.

  Next, the operation of the terminal device 200 when installing a new application in the memory 130 will be described. Here, it is assumed that the new application is the application 133.

  First, the installation file of the application 133 is downloaded to the system area while the system 111 has the control right. The system 111 checks the installation information included in this installation file. If installation is possible, the system 111 is restarted in install mode, or the latches latched by the latch means 122 are released by secure means.

  Here, in the restart in the install mode, the latch is released after the system 111 is reset, and the restart is performed so that the memory map 121A can be reassigned. Further, as a method for releasing the secure latch, there is a method of releasing the latch by authenticating with a secret key possessed by a highly secure IC (security IC) and a secret key possessed by the system 111 in the system area. Using such a safe latch release method eliminates the need to reset the system 111.

  In a state where the latch is released, the system 111 installs the application 133 to be added in a predetermined memory area in the memory 130. At the same time, address information of a predetermined memory area where the application 133 is installed is registered in the memory map 121A. After the registration to the memory map 121A is completed, the latch means 122 latches the memory map 121A again and ends the installation operation.

  In this registration, if the address information is set so that the memory area allocated to the bank 123C is not a continuous area but an arbitrary memory area, the analysis difficulty of the application 133 can be increased (FIG. 1). (See bold line). This is because the analysis is difficult if the region is not visible from the outside.

  In this way, since the memory map 121A is always latched except when the application is installed, safe memory access management can be performed before and after the application is updated.

According to the terminal device 100 according to the first embodiment of the present invention as described above, the allocation includes the application reference list including the address information related to the address of the memory area where the application is stored, and the address information is registered in the application reference list. Unit 121, latch unit 122 that prohibits change to the application reference list after registration by the allocation unit 121, a plurality of application reference areas 123 to which address information is allocated based on the application reference list, and control of application execution By having a configuration including a switching unit 124 that switches the application reference area 123 based on an instruction from the system 111 that performs the process, it is possible to prevent the malicious application or the CPU runaway from affecting other applications. Camphor it can, high memory access management good safety can be realized.
(Second Embodiment)

Next, the terminal device 200 according to the second embodiment of the present invention will be described.
FIG. 2 is a schematic diagram of a terminal device 200 according to the second embodiment of the present invention. The terminal device 200 includes a size restriction bank unit 211 in the memory access control circuit 210 instead of the bank unit 123 of the terminal device 100. In FIG. 2, portions that are the same as those of the terminal device 100 described in the first embodiment of the present invention are denoted by the same reference numerals, and description thereof is omitted.

  Here, the size restriction bank unit 211 is an example of an application reference area.

  The size restriction bank unit 211 includes a plurality of size restriction banks 211A to 211D, which are temporary memories having an area of a predetermined size. Since the size restriction banks 211A to 211D have logic to allocate address information based on the memory map 121A, the applications 131 to 134 on the memory 130 can be referred to.

  Here, the size restriction banks 211A to 211D are provided with a hardware restriction on the memory size allocated to each bank. In order to efficiently allocate the address information to the limited size banks 211A to 211D having such a limited size, the memory area is in a state of being shredded.

Next, operations at the time of application deletion and addition of the terminal device 200 according to the second embodiment of the present invention will be described. Here, specific examples of the memory map 222 and the memory 230 will be introduced. For the sake of explanation, the reference numerals different from those used in the terminal device 200 of FIG. 2 are used.
FIG. 3 is a detailed view of the memory map 222 and the memory 230 before application deletion of the terminal device 200 according to the second embodiment of the present invention.

  In the memory map 222 set in the allocation means 221 in the memory access control circuit 210, address reference information is stored for each of the applications A, B, C, and D. The memory 230 includes a first ROM 230A, a second ROM 230B, a first RAM 230C, and a second RAM 230C. Also, reference information for one application is assigned to one size limit bank.

  The first ROM 230A has memory areas 231, 232, and 233, and stores application A, application C, and application B, respectively. The second ROM 230B has memory areas 234, 235, and 236, and stores application D, application A, and application C, respectively. The first RAM 230C has memory areas 237, 238, and 239, and stores application A, application D, and application D, respectively. The second RAM 230D has memory areas 240, 241, and 242 and stores application A, application C, and application B, respectively.

  In addition, there is a hardware limitation on the memory size allocated to each bank. In other words, the number of memory areas per application described in the memory map 222 has an upper limit, for example, up to five. It is that.

Next, a case where the applications B and C are deleted from the state of FIG. 3 will be described.
FIG. 4 is a detailed diagram of the memory map 222 and the memory 230 immediately after the application deletion of the terminal device 200 according to the second embodiment of the present invention.

  Since the application B and the application C are deleted, the reference information related to the application B and the application C described in the memory map 222 is deleted. In addition, the memory areas 232, 233, 236, 241, and 242 in which the applications B and C are stored are free areas.

Next, a case where a new application E is added from the state of FIG. 4 will be described.
FIG. 5 is a detailed diagram of the memory map 222 and the memory 230 after application addition of the terminal device 200 according to the second embodiment of the present invention.

  Since the application E has been added, the memory map 222 describes that the application E has been added to the memory areas 232, 233, 236, 241, and 242. The application E is actually stored in the memory areas 232, 233, 236, 241, and 242 that are free areas after the deletion of the application B and the application C.

  In this way, even in a memory area that has become a free area after deleting an application, the memory space can be used efficiently when an application is added. Further, by performing memory allocation without equally dividing the memory with the maximum memory capacity required for each application, it is possible to add as many applications as possible with respect to the memory capacity. Further, since the maximum capacity per application is limited, it is possible to prevent the addition of a large-scale application that does not match the memory capacity.

  The terminal device 200 according to the second embodiment of the present invention has an application reference list that includes address information related to addresses of one or more memory areas in which one or more applications are stored. An allocation unit 121 that registers address information in the list, a latch unit 122 that prohibits changing to the application reference list after registration by the allocation unit 121, and a plurality of application reference areas to which address information is allocated based on the application reference list 123, and the application reference area 123 has a configuration in which the total capacity of the memory area indicated by the address information to be allocated is limited, so that the upper limit of the memory area to be allocated per application can be set. application Even after repeated added or deleted, it is possible to reduce the memory area wasted, it is possible to further prevent runaway or malicious applications invasion of other applications.

  The present invention is useful for a memory access control circuit, a contactless IC card reader / writer, a memory access control method, and the like that can realize highly secure memory access control even for an OS that does not support multi-applications. Further, it is useful for a memory access control circuit, a contactless IC card reader / writer, an application storage method, and the like that efficiently store an application in a memory area.

Schematic diagram of the terminal device in the first embodiment of the present invention Schematic diagram of a terminal device in the second embodiment of the present invention The memory map before the application deletion of the terminal device in the 2nd Embodiment of this invention, and the detailed figure of memory The memory map immediately after application deletion of the terminal device in the 2nd Embodiment of this invention, and the detailed figure of memory Detailed view of memory map and memory after application addition of terminal device in second embodiment of the present invention

Explanation of symbols

100 Terminal device 110 CPU
120 Memory Access Control Circuit 121 Allocation Unit 121A Memory Map 122 Latch Unit 123 Bank Units 123A to 123D Bank 124 Switching Unit 130 Memory 200 Terminal Device 210 Memory Access Control Circuit 211 Size Limit Bank Units 211A to 211D Size Limit Bank 221 Allocation Unit 222 Memory map 230 Memory 230A First ROM
230B second ROM
230C first RAM
230D second RAM
231 to 242 Memory area

Claims (9)

An application reference list including address information relating to addresses of memory areas in which applications are stored, and an allocation unit for registering the address information in the application reference list;
A latch unit that prohibits changes to the application reference list after registration by the allocation unit;
A plurality of application reference areas to which the address information is assigned based on the application reference list;
A memory access control circuit comprising: a switching unit that switches the application reference area based on an instruction from a system that controls execution of the application. The memory access control circuit according to claim 1,
The system has a system reference list including the address information;
The allocation unit is a memory access control circuit that registers the address information in the application reference list based on activation of the system and the system reference list. The memory access control circuit according to claim 1, wherein the system includes:
A determination unit that determines whether the application can be installed;
If the result of determination by the determination unit is that the installation is possible, a latch release unit that invalidates prohibition of changes to the application reference list by the latch unit, and
A memory access control circuit for registering address information of the application in an application reference list whose change prohibition is invalidated by the latch release unit; A memory access control circuit according to any one of claims 1 to 3,
The memory area is plural,
A memory access control circuit in which the application is stored in an arbitrary memory area. The memory access control circuit according to claim 3,
The latch release unit is an access control circuit that invalidates prohibition of changing the application reference list based on authentication using a security IC. A memory access control circuit according to any one of claims 1 to 5,
A memory access control circuit that prohibits switching to an application reference area that refers to the application when the application instructs switching of the application reference area. An allocating unit having an application reference list including address information regarding addresses of one or more memory areas in which one or more applications are stored, and registering the address information in the application reference list;
A latch unit that prohibits changes to the application reference list after registration by the allocation unit;
A plurality of application reference areas to which the address information is assigned based on the application reference list;
The application reference area is a memory access control circuit in which a total capacity of a memory area indicated by address information to be allocated is limited. An allocation step in which the address information is registered in an application reference list including address information related to addresses of memory areas in which applications are stored;
After registration in the allocation step, the step of prohibiting changes to the application reference list;
A memory access control method comprising: switching a plurality of the application reference areas to which the address information is assigned based on the application reference list based on an instruction by a system that controls execution of the application. An allocation step in which the address information is registered in an application reference list including address information related to addresses of one or more memory areas in which the one or more applications are stored;
And after the registration in the allocation step, the step of prohibiting changes to the application reference list,
The plurality of application reference areas to which the address information is allocated based on the application reference list is an application storage method in which a total capacity of a memory area indicated by the allocated address information is limited.

Images