JP5322977B2 - Power consumption confusion type logic circuit and information storage medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce change of power consumption waveform to be generated, since the average number of charging path is different due to the combination of input signals and operation timing of gates of rear stages being different. <P>SOLUTION: The logic circuit 1 includes a logic operation circuit 10 which outputs an output logic state to be generated based on the input signals X, Y and a random number signal r to an output line Z1; an output control part 20, which controls an output state of the output line Z1 according to a control signal en1, and in the case of an output invalid state for invalidating the output logic state of the logic operation circuit 10, intercepts a path which leads from the output line Z1 to a power supply line VDD, and charges the output line Z1 by a potential of the power supply line VDD; and an output stage circuit 30, which switches the state to a masked state for invalidating a state for outputting based on the output state of the output line Z1 according to a control signal en2. <P>COPYRIGHT: (C)2011,JPO&amp;INPIT

Description

  The present invention relates to a power consumption confusion type logic circuit and an information storage medium that prevent power analysis attacks by analyzing power consumption during encryption / decryption processing and elucidating a secret key.

  There is a power analysis attack that elucidates a secret key used for encryption processing by analyzing power consumption of an information storage medium such as an IC card that performs encryption processing. A countermeasure circuit at the logic circuit level against this attack is disclosed. Non-Patent Document 1 discloses an RSL (Random Switching Logic) circuit that randomly switches between an input signal and positive / negative logic of a logical operation using a random number. When a CMOS (Complementary Metal Oxide Semiconductor) integrated circuit operates, power consumption by the current that charges and discharges the output load capacitance of the logic gate is dominant. Therefore, the RSL circuit is a circuit intended to eliminate the correlation between the statistical value of the power consumption and the secret key by randomly changing the output of the logic gate with a random number.

FIG. 12A shows a NAND (negative AND) gate (hereinafter referred to as RSL-NAND) based on RSL disclosed in Non-Patent Document 1. The input signals of the original NAND gate are a and b, and the output is c (= a NAND b). The input signals X and Y of the RSL-NAND are values obtained by XOR (exclusive OR) of the random number r and the input signals a and b, respectively (X = a XOR r, Y = b XOR r). The output Z of the RSL-NAND is also a value obtained by XORing the random number signal r and the output c (Z = c XOR r). The random number for performing the XOR operation on the input signals a and b and the random number for performing the XOR operation on the output c have the same value, and are set to different values every time the gate operation is performed.
The RSL-NAND includes a control signal en. When the control signal en is “1”, the output of the RSL-NAND is invalidated and the output of the RSL-NAND is fixed to “0”. Further, when the control signal en is “0”, the output of the RSL-NAND is made valid, and the output is made according to the values of the input signals X, Y, r. During the transition period of the input signals X, Y, r, the control signal en is set to “1”, and after the input is determined, the control signal en is set to “0” to enable the output of the RSL-NAND. This is to eliminate the power consumed when the input signals X, Y, and r transition.

D. Suzuki et al., “Random Switching Logic: A New Countermeasure against DPA and Second-Order DPA at the Logic Level” IEICE TRANS.FUNDAMENTALS, VOL.E90-A, NO.1, JANUARY 2007.

However, in the RSL-NAND shown in FIG. 12A, power consumption occurs when the control signal en transitions from “1” to “0” and switches from the invalid state to the valid state. The power consumption waveform varies depending on the states of the input signals X, Y, and r.
(B) of FIG. 12 is a logic table showing the logic of the RSL-NAND and the number of charging paths when “1” is output. When the random number r is “0”, the charging path is three paths in the combination (1) of the input signals a and b, and one path in the combinations (2) and (3). When the random number signal r is “1”, the charging path becomes one path in the combination (4). The average number of paths in each case of the combinations (1) to (4), that is, the average of the number of paths when r is “0” and the number of paths when r is “1” is 3 in order. / 2, 1/2, 1/2, 1/2. When the number of charging paths is different, there is a difference between the charging current and the charging speed. These two differences cause a difference in power consumption waveform that can be observed from the outside of the information storage medium. The combination of the input signals a and b may be specified by the difference in the power consumption waveform. That is, the above-mentioned RSL-NAND has a problem that the power consumption waveform changes because the average number of charging paths differs depending on the combination of the input signals a and b.

 In addition, if the charging speed is different, the output transition time of the RSL-NAND is different, which affects the operation timing of the subsequent gate. If the operation timing of the subsequent gate is different, a difference in power consumption waveform that can be observed from the outside of the information storage medium is generated. That is, the above-described RSL-NAND has a problem in that the power consumption waveform changes because the operation timing of the subsequent gate is different.

  The present invention has been made to solve the above problem, and its purpose is that the change in the power consumption waveform caused by the difference in the average number of charging paths depending on the combination of input signals and the operation timing of the subsequent gate are different. It is an object of the present invention to provide a power consumption confusion type logic circuit and an information storage medium that reduce a change in a power consumption waveform that occurs in the system.

  In order to solve the above problem, according to the present invention, a first potential is supplied from a first supply line, and a second potential lower than the first potential is supplied from a second supply line and inputted. A logic operation circuit for outputting an output logic state generated based on the input signal and the random number signal to the output line; and controlling an output state of the output line in accordance with the input first control signal; An output control unit that shuts off a first path from the output line to the second supply line and charges the output line with the first potential when the output is in an invalid output state; Power consumption comprising: an output stage circuit provided in a subsequent stage of the logic operation circuit, wherein the output stage circuit switches to a mask state that invalidates the output state based on the output state of the output line in accordance with the input second control signal It is a confusion-type logic circuit.

  Further, in the present invention according to the above invention, when the output control unit cancels the output invalid state, the output control unit conducts the first path, and according to the generated logic state, the output potential is set by the second potential. The output line is discharged.

  Further, the present invention is the above invention, wherein the logic operation circuit is configured to charge the output line with the first potential based on the input signal and the random number signal, the input signal and the random number signal. And the N net part discharging the output line with the second potential operates in a complementary manner to generate the output logic state, and the first path passes the N net part from the output line. And a path that leads to the second supply line.

  Further, the present invention is the above invention, wherein the power consumption confusion type logic circuit is configured to transmit the power supply from the first supply line through the P-net unit according to the first control signal or the second control signal. A P-net blocking unit that blocks the second path leading to the output line is provided.

  Further, the present invention is the above invention, wherein the input signal and the random number signal are changed after the output control unit is in the output invalid state and the output line is at the first potential, and the output control is performed. The unit cancels the output invalid state based on the first control signal after the change of the input signal and the random number signal is confirmed, and the output stage circuit cancels the output invalid state and outputs the output The mask state is canceled based on the second control signal after the output state of the line is determined.

  Further, the present invention is the above invention, wherein the input signal and the random number signal are changed after the output control unit is in the output invalid state and the P-net blocking unit blocks the second path, and the output The control unit releases the output invalid state based on the first control signal after the change of the input signal and the random number signal is confirmed, and the output stage circuit releases the output invalid state, After the output state of the output line is determined, the mask state is canceled based on the second control signal.

  Further, the present invention is the above invention, wherein the logic operation circuit generates a logic state corresponding to a predetermined logic operation process based on the input signal, and inverts the input signal based on the random number signal. Whether to perform the logical operation processing and whether to change the output logical state from the logical state are switched.

  The present invention also includes a storage unit that stores a secret key and information, a random number generation unit that generates the random number signal, and a power consumption confusion type logic circuit according to any one of the inventions described above, and is encrypted according to the secret key. An information storage medium including an encryption processing unit that performs processing.

  According to the present invention, the logic operation circuit is supplied with the first potential supplied from the first supply line, the second potential lower than the first potential is supplied from the second supply line, and the input signal inputted. And an output logic state generated based on the random number signal is output to the output line. The output control unit controls the output state of the output line of the logic operation circuit according to the first control signal, and outputs the logic operation circuit when the output control unit is in an output invalid state that invalidates the output logic state of the logic operation circuit. The first path from the line to the second supply line is cut off, and the output line is charged with the first potential. Thereby, the number of charging paths becomes the same regardless of the combination of input signals. Therefore, the power consumption confusion type logic circuit can reduce the change in the power consumption waveform caused by the difference in the average number of charging paths. Further, the output stage circuit provided in the subsequent stage of the logical operation circuit responds to the second control signal input to the mask state that invalidates the output state output based on the output state of the output line of the logical operation circuit. To switch. Thereby, the power consumption confusion type logic circuit masks the change in the operation timing of the output line of the logic operation circuit, and can reduce the change in the operation timing of the gate in the subsequent stage of the power consumption confusion type logic circuit. Therefore, the power consumption confusion type logic circuit can reduce the change in the power consumption waveform caused by the operation timing of the subsequent stage gates being different.

1 is a block diagram illustrating a logic circuit according to a first embodiment. It is a figure which shows the logic table | surface of the logic circuit in the embodiment. 3 is a time chart showing a sequence of a logic circuit in the same embodiment. It is a block diagram which shows the logic circuit by 2nd Embodiment. 3 is a time chart showing a sequence of a logic circuit in the same embodiment. It is a block diagram which shows the logic circuit by 3rd Embodiment. 3 is a time chart showing a sequence of a logic circuit in the same embodiment. It is a block diagram which shows the portable information storage medium by 4th Embodiment. It is a block diagram which shows the encryption process part in the embodiment. It is a block diagram which shows the logic circuit by 5th Embodiment. It is a figure which shows the logic table | surface of the logic circuit in the embodiment. It is a figure which shows the logic circuit and logic table by a prior art.

<First Embodiment>
Hereinafter, a logic circuit according to a first embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a logic circuit in this embodiment.
A logic circuit 1 that is a power consumption confusion type logic circuit shown in FIG. 1 includes a logic operation circuit 10, an output control unit 20, and an output stage circuit 30.
The logical operation circuit 10 is disposed between the power supply line VDD and the power supply line GND, and includes a P net unit 11 and an N net unit 12. Based on the input signals X and Y and the random number signal r, the logic operation circuit 10 outputs an output logic state generated by the P net unit 11 and the N net unit 12 operating in a complementary manner to the output line Z1.
The P net unit 11 is disposed between the power supply line VDD and the output line Z1, charges the output line Z1 with the potential of the power supply line VDD based on the input signals X and Y, and the random number signal r, and has a logic level “1”. "Is output.
The N net unit 12 is disposed between the output line Z1 and the power supply line GND, and discharges the output line Z1 by the potential of the power supply line GND based on the input signals X and Y and the random number signal r, and the logic level “0”. "Is output.

The P net unit 11 includes P channel metal oxide semiconductor field effect transistors (hereinafter referred to as PMOS) 111 to 115. The PMOSs 111 and 112 are arranged in series between the power supply line VDD and the output line Z1. The PMOS 111 has a source terminal connected to the power supply line VDD, a drain terminal connected to the node N1, and an input signal X supplied to the gate terminal. The PMOS 112 has a source terminal connected to the node N1, a drain terminal connected to the output line Z1, and an input signal Y supplied to the gate terminal.
The PMOSs 113 and 114 are connected in parallel between the power supply line VDD and the node N2. The PMOS 113 has a source terminal connected to the power supply line VDD, a drain terminal connected to the node N2, and an input signal X supplied to the gate terminal. The PMOS 114 has a source terminal connected to the power supply line VDD, a drain terminal connected to the node N2, and an input signal Y supplied to the gate terminal.
The PMOS 115 has a source terminal connected to the node N2, a drain terminal connected to the output line Z1, and a random number signal r supplied to the gate terminal.

The N net unit 12 includes N channel metal oxide semiconductor field effect transistors (hereinafter referred to as NMOS) 121 to 125. The NMOSs 121 and 122 are arranged in series between the output line Z1 and the node N4. The NMOS 121 has a source terminal connected to the node N3, a drain terminal connected to the output line Z1, and an input signal X supplied to the gate terminal. The NMOS 122 has a source terminal connected to the node N4 and a drain terminal connected to the node N3, and an input signal Y is supplied to the gate terminal.
The NMOSs 123 and 124 are connected in parallel between the output line Z1 and the node N5. The NMOS 123 has a source terminal connected to N5, a drain terminal connected to the output line Z1, and an input signal X supplied to the gate terminal. The NMOS 124 has a source terminal connected to the node N5, a drain terminal connected to the output line Z1, and an input signal Y supplied to the gate terminal.
The NMOS 125 has a source terminal connected to the node N4, a drain terminal connected to the node N5, and a random number signal r supplied to the gate terminal.

The output control unit 20 includes a PMOS 21 and an NMOS 22, and controls the output state of the output line Z1 according to the control signal en1. The output control unit 20 invalidates the output logic state of the logic operation circuit 10 according to the control signal en1 by the PMOS 21 and the NMOS 22.
The PMOS 21 is arranged in parallel with the P net unit 11 between the power supply line VDD and the output line Z1. The PMOS 21 has a source terminal connected to the power supply line VDD, a drain terminal connected to the output line Z1, and a control signal en1 supplied to the gate terminal. When the control signal en1 is “0” (when the output is disabled), the PMOS 21 conducts between the power supply line VDD and the output line Z1 and charges the output line Z1 to the logic level “1”. As a result, the P net unit 11 is invalidated.
Further, the NMOS 22 is arranged in series with the N net portion 12 between the output line Z1 and the power ship GND. The NMOS 22 has a source terminal connected to the power supply line GND, a drain terminal connected to the node N4, and a control signal en1 supplied to the gate terminal. When the control signal en1 is “0” (when the output is disabled), the NMOS 22 blocks the path from the power supply line GND to the output line Z1 via the N net unit 12 and invalidates the N net unit 12. Turn into.

The output stage circuit 30 is disposed after the logic operation circuit 10 and includes an inverter unit 31 and an output stage control unit 32. The output stage circuit 30 outputs a logic level “1” or “0” to the output line Z2 of the logic circuit 1 based on the output state of the output line Z1 of the logic operation circuit 10. Further, the output stage circuit 30 switches to a mask state that invalidates the output state of the output line Z2 in response to the control signal en2.
The inverter unit 31 includes a PMOS 311 and an NMOS 312 and outputs a logic level “1” or “0” obtained by inverting the logic state output to the output line Z1 of the logic operation circuit 10 to the output line Z2.
The PMOS 311 and the NMOS 312 have a gate terminal connected to the output line Z1 and a drain terminal connected to the output line Z2. The source of the PMOS 311 is connected to the node N6. The NMOS 312 has a source terminal connected to the power supply line GND.

The output stage control unit 32 includes a PMOS 321 and an NMOS 322, and switches to a mask state that invalidates the output state of the output line Z2 according to the control signal en2. The PMOS 321 is disposed between the power supply line VDD and the inverter unit 31. The PMOS 321 has a source terminal connected to the power supply line VDD, a drain terminal connected to the node N6, and a control signal en2 supplied to the gate terminal. When the control signal en2 is “1” (in the mask state), the PMOS 321 shuts off the inverter unit 31 from the power supply line VDD and invalidates the inverter unit 31.
The NMOS 322 is arranged in parallel with the NMOS 312 between the output line Z2 and the power supply line GND. The NMOS 322 has a source terminal connected to the power supply line GND, a drain terminal connected to the output line Z2, and a control signal en2 supplied to the gate terminal. The NMOS 322 conducts between the power supply line GND and the output line Z2 and discharges the output line Z2 to the logic level “0” when the control signal en2 is “1” (in the mask state). As a result, the output stage control unit 32 outputs the logic level “0” to the output line Z2 in the mask state.

Next, the operation of this embodiment will be described.
The logic circuit 1 is an AND circuit for obtaining an output c obtained by performing an AND (logical product) operation on the input signals a and b. The input signals X and Y of the logic circuit 1 are values obtained by performing an XOR (exclusive OR) operation on the input signals a and b and the random number signal r, respectively (X = a XOR r, Y = b XOR r). . Similarly, the output z2 of the output line Z2 of the logic circuit 1 is a value obtained by XORing the random number r and the output c (z2 = c XOR r). The random number signal r for XORing the inputs a and b and the random number signal r for XORing the output c have the same value, and the random number signal r is set to a different value every time the gate operation is performed.

  The logical operation circuit 10 is a NAND / NOR (negative logical sum) arithmetic circuit for obtaining an output z1 obtained by XORing the random number signal r with the result of NAND (negative logical product) operation of the input signals a and b. When the random number signal r is “0”, the logic operation circuit 10 functions as a NAND operation circuit for the input signals X and Y (z1 = X NAND Y). When the random number signal r is “1”, the logic operation circuit 10 functions as a NOR operation circuit for the input signals X and Y (z1 = X NOR Y). The principle is shown in equations (1) to (3).

  z1 = (a NAND b) XOR r (1)

  Expression (1) is an expression indicating a logical operation of the logical operation circuit 10.

[When r = "0"]
X = a XOR r = a, Y = b XOR r = b,
z1 = (a NAND b) XOR r = X NAND Y (2)

  Expression (2) is an expression showing a logical operation of the logical operation circuit 10 when the random number signal r is “0”. When the random number signal r is “0”, the input signals a and b are equal to the input signals X and Y, respectively. For this reason, the logic of the output line Z1 of the logic operation circuit 10 is obtained by NAND operation of the input signals X and Y.

[When r = “1”]
X = a XOR r = NOT (a), Y = b XOR r = NOT (b),
z1 = NOT (NOT (X) NAND NOT (Y)) = NOT (X OR Y) = X NOR Y (3)

  Expression (3) is an expression showing a logical operation of the logical operation circuit 10 when the random number signal r is “1”. When the random number signal r is “1”, the input signals a and b are values obtained by NOT (negative) calculation of the input signals X and Y, respectively. For this reason, the logic of the output line Z1 of the logic operation circuit 10 is obtained by performing a NAND operation on the input signals X and Y obtained by performing a NOT operation, and further performing a NOT operation on the operation result. According to De Morgan's theorem, (NOT (X) NAND NOT (Y)) is replaced by an OR (logical OR) operation (X OR Y) of the input signals X and Y. As a result, the logic of the output line Z1 of the logic operation circuit 10 is a NOR operation of the input signals X and Y.

In the logical operation circuit 10, when the random number signal r is “0”, the PMOS 115 of the P net unit 11 is turned on, and the PMOSs 113 and 114 connected in parallel to the power supply line VDD are enabled. Further, the NMOS 125 of the N net unit 12 is turned off, and the NMOSs 123 and 124 connected in parallel to the output line Z1 are disabled. As a result, the output line Z1 outputs an output logic state that is logically operated by the PMOSs 113 and 114 and the NMOSs 121 and 122 connected in series to the output line Z1 via the node N3. That is, the logic operation circuit 10 functions as a NAND operation circuit for the input signals X and Y. In this case, the PMOSs 111 and 112 are not involved in determining the output logic state.
In addition, when the random number signal r is “1”, the logic operation circuit 10 turns off the PMOS 115 of the P net unit 11 and disables the PMOSs 113 and 114 connected in parallel to the power supply line VDD. Further, the NMOS 125 of the N net unit 12 is turned on, and the NMOSs 123 and 124 connected in parallel to the output line Z1 become effective. As a result, the output line Z1 outputs an output logic state that is logically operated by the NMOSs 123 and 124 and the PMOSs 111 and 112 connected in series to the output line Z1 via the node N1. That is, the logic operation circuit 10 functions as a NOR operation circuit for the input signals X and Y. In this case, the NMOSs 121 and 122 are not involved in determining the output logic state.

The output z1 logically operated by the logical operation circuit 10 is supplied to the inverter unit 31 of the output stage circuit 30 via the output line Z1. The inverter unit 31 inverts the output logic state of the output z1 using the PMOS 311 and the NMOS 312 and outputs the inverted signal to the output line Z2 as the output z2.
Thereby, the logic circuit 1 outputs the AND operation result (z2 = X AND Y) of the input signals X and Y or the OR operation result (z2 = X OR Y) of the input signals X and Y according to the random number signal r. Output to the output line Z2.

FIG. 2 is a diagram showing a logic table of the logic circuit 1 in the present embodiment.
In FIG. 2, the state of the output z2 of the output line Z2 is shown according to eight combinations including four combinations of the input signals X and Y and a combination of the random number signal r. It can be seen that the output z2 is logically inverted according to the value of the random number signal r. Since the value of the random number signal r changes at random, the output z2 varies randomly even if the input signals a and b are the same.

Next, the operation of this embodiment will be described in detail with reference to a time chart.
FIG. 3 is a time chart showing a sequence of the logic circuit 1 in the embodiment.
FIG. 3 shows input signals X and Y, a random number signal r, control signals en1 and en2, an output state z1 of the output line Z1, and an output state z2 of the output line Z2.
First, when the control signal en1 is changed to the L (low) state (logic “0” state) from the time T0 _H to the time T0 _L , the output control unit 20 shifts from the output valid state to the output invalid state. Thereby, the NMOS 22 is turned off. Therefore, the output control unit 20 disables the N net unit 12 by blocking the path from the power supply line GND to the output line Z1 via the N net unit 12. Further, the PMOS 21 is turned on. The PMOS 21 charges the output line Z1 to the H (high) state (logic “1” state) by the power supply line VDD. Here, the output line Z1 is charged to the H state when the output logic state becomes “0” by the input signals X and Y and the random number signal r. Therefore, the route of the P net unit 11 is blocked. Accordingly, the charging of the output line Z1 is performed by the PMOS 21 without passing through the P net unit 11. In this case, the power consumption waveform is a constant waveform that does not depend on the combination of the input signals a and b.

  Time Ta indicates the time when charging of the output line Z1 is completed. Since the control signal en2 is in the L state that enables the output of the output line Z2, the output z1 of the output line Z1 is in the H state, so that the output z2 of the output line Z2 is in the L state. In the transition from the H state to the L state of the output line Z2, since the charging timing by the PMOS 21 is constant, the operation timing of the gate at the subsequent stage of the logic circuit 1 is constant.

Next, when the control signal en2 is changed from the time T1 _L to the H state (logic “1” state) at the time T1 _H , the output stage circuit 30 shifts from the output valid state to the mask state. As a result, the PMOS 321 is turned off and the NMOS 322 is turned on. Therefore, the output stage circuit 30 blocks the path from the power supply line VDD to the output line Z2 by the PMOS 321. Further, the output stage circuit 30 conducts between the output line Z2 and the power supply line GND by the NMOS 322 and discharges to the L state (logic “0” state). As a result, the output stage circuit 30 is in a mask state, and even if the state of the output line Z1 changes, the output stage circuit 30 does not propagate to the gate in the subsequent stage of the logic circuit 1. In the mask state, the output line Z2 maintains the L state (logic “0” state) regardless of the state of the output line Z1.

  The input signals X and Y and the random number signal r are changed between the time T2 and the time T3. The time T2 is a time after the time Ta when the output control unit 20 is in the output invalid state and the charging of the output line Z1 is completed and becomes the potential of the power supply line VDD. This is because when the input signals X and Y and the random number signal r are changed before the time Ta, the path from the power supply line VDD to the output line Z1 through the P net unit 11 becomes conductive, and the power consumption waveform is changed. This is because it may depend on the combination of the input signals a and b.

Next, when the control signal en1 is changed to the H state (logic “1” state) from the time T4 _L to the time T4 _H , the output control unit 20 shifts from the output invalid state to the output valid state. Thereby, the PMOS 21 is turned off. The PMOS 21 cuts off between the output line Z1 and the power supply line VDD. Further, the NMOS 22 is turned on. Therefore, the output control unit 20 conducts a path that leads from the power supply line GND to the output line Z1 via the N net unit 12, and sets the signal line Z1 to the L state (logic “logic” in accordance with the output logic state of the N net unit 12. 0 ”state). P0 of the output z1 is a case where the output logic state of the logic operation circuit 10 is “1”. In this case, the output z1 holds the H state (logic “1” state).
Further, p1 of the output z1 is a waveform when there is one path (path) for discharging to the power supply line GND in the N net portion 12 of the logic operation circuit 10. This state is, for example, when the combination (4) in the logical table of FIG. 2 and the random number signal r is “0”. In this case, since the NMOS 125 is turned off, the path from the output line Z1 to the power supply line GND is one path through the NMOS 121 and the NMOS 122. Since there is one discharge path, the output z1 is discharged to the L state later than p3. Here, the time when the output line Z1 is in the L state by p1 is Tb.

Further, p3 of the output z1 is a waveform when there are three paths (paths) discharging to the power supply line GND in the N net unit 12 of the logic operation circuit 10. This state is, for example, when the combination (1) in the logical table of FIG. 2 and the random number signal r is “1”. In this case, since the NMOS 125 is turned on, there are three paths from the output line Z1 to the power supply line GND: a path through the NMOS 121 and the NMOS 122, a path of the NMOS 123, and a path of the NMOS 124. Since there are three discharge paths, the output z1 is discharged to the L state earlier than p1.
Here, a discharge current for discharging the load capacitance of the output line Z1 to the power supply line GND flows. However, it is assumed that the power supply line GND connected to the NMOS 22 and the power supply line GND connected to the load capacity of the output line Z1 are connected and come out of the logic circuit 1 as a common power supply line. In this case, the discharge current is consumed in the logic circuit 1 and is not observed as power consumption from the outside. Further, the difference in transition timing between p1 and p3 is masked by the output stage circuit 30 and does not affect the operation timing of the subsequent gate of the logic circuit 1.

Next, when the control signal en2 is changed to the L state (logic “0” state) from the time T5 _H to the time T5 _L , the output stage circuit 30 shifts from the mask state to the output valid state. As a result, the PMOS 321 is turned on and the NMOS 322 is turned off. Therefore, a state in which the state of the output line Z1 is inverted is output to the output line Z2. At this time, the power consumed by the output stage circuit 30 is a current for charging the load capacity of the output line Z2. Therefore, the power consumption waveform is determined by the state of the output line Z1, and does not depend on the combination of the input signals a and b. Further, the transition timing of the output line Z2 does not depend on the combination of the input signals a and b. For this reason, the operation timing of the subsequent gate of the logic circuit 1 is constant regardless of the combination of the input signals a and b.

As described above, the output control unit 20 controls the output state of the output line Z1 of the logic operation circuit 10 according to the control signal en1. When the output control unit 20 is in an output invalid state, the NMOS 22 interrupts the path from the output line Z1 of the logic operation circuit 10 to the power supply line GND, and the PMOS 21 conducts the power supply line VDD and the output line Z. Charge to H state. As a result, the number of charging paths is one by the PMOS 21 regardless of the combination of input signals. Therefore, the logic circuit 1 can reduce the change in the power consumption waveform caused by the difference in the average number of charging paths. Thereby, the change of the statistical result of the power consumption waveform correlated with the input signals a and b can be reduced.
Further, the output stage circuit 30 provided in the subsequent stage of the logic operation circuit 10 is switched to the mask state in accordance with the control signal en2. When in the mask state, the output stage circuit 30 invalidates the output state of the output line Z1 and holds the output line Z2 of the logic circuit 1 in the L state (logic “0” state). As a result, the logic circuit 1 can mask the change in the operation timing of the output line of the logic operation circuit 10 and can reduce the change in the operation timing of the subsequent gate of the logic circuit 1. Therefore, the logic circuit 1 can reduce the change in the power consumption waveform that occurs because the operation timing of the subsequent gate is different. Thereby, the change of the power consumption waveform correlated with the input signals a and b can be reduced.

<Second Embodiment>
Hereinafter, a logic circuit according to a second embodiment of the present invention will be described with reference to the drawings.
FIG. 4 is a block diagram showing the logic circuit 1a in the present embodiment.
In FIG. 4, the logic circuit 1 according to the first embodiment is provided with a P-net blocking unit 40 composed of PMOS. Other configurations are the same as those of the first embodiment. In this figure, the same components as those in FIG.
The P-net blocking unit 40 is disposed between the P-net unit 11 and the output line Z1, and has a source terminal connected to the node N7 that is an output of the P-net unit 11, a drain terminal connected to the output line Z1, and a gate terminal. A control signal en2 is supplied. When the control signal en2 becomes “0” and the output stage circuit 30 is in the masked state, the P net blocking unit 40 blocks between the P net unit 11 and the output line Z1 and outputs the P net unit 11 Disconnect from line Z1.

Next, the operation of this embodiment will be described.
The basic operation of the logic circuit 1a is the same as that of the first embodiment except that the operation of the P-net blocking unit 40 is added.
The logic circuit 1a is an AND circuit for obtaining an output c obtained by ANDing the input signals a and b. The input signals X and Y of the logic circuit 1a are values obtained by XORing the input signals a and b and the random number signal r, respectively (X = a XOR r, Y = b XOR r). Similarly, the output z2 of the output line Z2 of the logic circuit 1a is a value obtained by XORing the random number r and the output c (z2 = c XOR r). The random number signal r for XORing the inputs a and b and the random number signal r for XORing the output c have the same value, and the random number signal r is set to a different value every time the gate operation is performed.

FIG. 5 is a time chart showing the sequence of the logic circuit 1a in the same embodiment.
FIG. 5 shows input signals X and Y, random number signal r, control signals en1 and en2, output state z1 of output line Z1, and output state z2 of output line Z2. In this figure, the following two timings, except made before the time T0 _H by the control signal en1 time T0 _L, is the same as the sequence in Figure 3. The two timings are from time T1 _L to time T1 _H based on the control signal en2, and from time T2 to time T3 for changing the input signals X and Y and the random number signal r.

When the control signal en2 is changed from the time T1 _L to the H state (logic “1” state) at the time T1 _H , the output stage circuit 30 shifts from the output valid state to the mask state. Further, the P net blocking unit 40 blocks a path from the power line VDD to the output line Z1 via the P net unit 11. The operation when the control signal en2 transitions from “0” to “1” is the same as in the first embodiment.
Next, the input signals X and Y and the random number signal r are changed between time T2 and time T3. The time T2 is a time after the time T1 _H when the P net blocking unit 40 blocks the P net unit 11. When the input signals X and Y and the random number signal r are changed at this timing, since the P net blocking unit 40 is after the P net unit 11 is blocked, the power consumption waveform is the input signal X, Y Even if the random number signal r is changed, it is not affected. Thus, the input signals X and Y and the random number signal r can be changed regardless of the state of the control signal en1. Therefore, the change timing of the input signals X and Y and the random number signal r can be advanced.

Next, when the control signal en1 is changed to the L state (logic “0” state) from the time T0 _H to the time T0 _L , the output control unit 20 shifts from the output valid state to the output invalid state. Thereby, the NMOS 22 is turned off. Therefore, the output control unit 20 disables the N net unit 12 by blocking the path from the power supply line GND to the output line Z1 via the N net unit 12. Further, the PMOS 21 is turned on. The PMOS 21 charges the output line Z1 to the H state (logic “1” state) by the power supply line VDD. Time Ta indicates the time when charging of the output line Z1 is completed.
In the subsequent operation, when the control signal en1 is changed to the H state (logic “1” state) from the time T4 _L to the time T4 _H , the output control unit 20 shifts from the output invalid state to the output valid state. Further, when the control signal en2 is changed to the L state (logic “0” state) from the time T5 _H to the time T5 _L , the output stage circuit 30 shifts from the mask state to the output valid state. Further, the P net blocking unit 40 conducts a path from the power supply line VDD to the output line Z1 through the P net unit 11. Thereby, when the output logic state of the logic operation circuit 10 is “1”, the output line Z1 holds the H state (“1” state). In addition, a state in which the state of the output line Z1 is inverted is output to the output line Z2.

As described above, the output control unit 20 controls the output state of the output line Z1 of the logic operation circuit 10 according to the control signal en1. When the output control unit 20 is in an output invalid state, the NMOS 22 interrupts the path from the output line Z1 of the logic operation circuit 10 to the power supply line GND, and the PMOS 21 conducts the power supply line VDD and the output line Z. Charge to H state. As a result, the number of charging paths is one by the PMOS 21 regardless of the combination of input signals. Therefore, the logic circuit 1a can reduce the change in the power consumption waveform caused by the difference in the average number of charging paths. Thereby, the change of the statistical result of the power consumption waveform correlated with the input signals a and b can be reduced.
Further, the output stage circuit 30 provided in the subsequent stage of the logic operation circuit 10 is switched to the mask state in accordance with the control signal en2. When in the mask state, the output stage circuit 30 invalidates the output state of the output line Z1 and holds the output line Z2 of the logic circuit 1a in the L state. Thereby, the logic circuit 1a masks the change in the operation timing of the output line of the logic operation circuit 10, and can reduce the change in the operation timing of the gate in the subsequent stage of the logic circuit 1a. Therefore, the logic circuit 1a can reduce the change in the power consumption waveform that occurs because the operation timing of the subsequent gate is different. Thereby, the change of the power consumption waveform correlated with the input signals a and b can be reduced.

  Further, the P net blocking unit 40 blocks a path from the power supply line VDD to the output line Z1 via the P net unit 11 in accordance with the control signal en2. Thereby, the input signals X and Y and the random number signal r can be changed before the time Ta at which the charging of the output line Z1 is completed. The time Ta needs to be determined by observing the state of the output line Z1, which is an internal signal of the logic circuit 1a. In this embodiment, the input signal X, Y and the input signal X2 are determined according to the state of the control signal en2, which is the input signal. The timing for changing the random number signal r can be determined. Therefore, the logic circuit 1a has an advantage that the timing for changing the input signals X and Y and the random number signal r can be easily determined.

<Third Embodiment>
Hereinafter, a logic circuit according to a third embodiment of the present invention will be described with reference to the drawings.
FIG. 6 is a block diagram showing the logic circuit 1b in the present embodiment.
In FIG. 6, a P-net blocking unit 40a configured by PMOS is provided as in the second embodiment. Other configurations are the same as those of the second embodiment. In this figure, the same components as those in FIG.
The P-net blocking unit 40a is disposed between the P-net unit 11 and the output line Z1, has a source terminal connected to the node N7 that is the output of the P-net unit 11, a drain terminal connected to the output line Z1, and a gate terminal. En1b (= NOT (en1)) obtained by logically inverting the control signal en1 is supplied. When the control signal en1 becomes “0” and the output stage circuit 30 is in the mask state, the P net blocking unit 40a blocks the connection between the P net unit 11 and the output line Z1, and outputs the P net unit 11. Disconnect from line Z1.

Next, the operation of this embodiment will be described.
The basic operation of the logic circuit 1b is the same as that of the second embodiment except that the control signal en1b of the P-net blocking unit 40a is different.
The logic circuit 1b is an AND circuit for obtaining an output c obtained by ANDing the input signals a and b. The input signals X and Y of the logic circuit 1b are values obtained by XORing the input signals a and b and the random number signal r, respectively (X = a XOR r, Y = b XOR r). Similarly, the output z2 of the output line Z2 of the logic circuit 1b is a value obtained by XORing the random number r and the output c (z2 = c XOR r). The random number signal r for XORing the inputs a and b and the random number signal r for XORing the output c have the same value, and the random number signal r is set to a different value every time the gate operation is performed.

FIG. 7 is a time chart showing the sequence of the logic circuit 1b in the same embodiment.
FIG. 7 shows input signals X and Y, a random number signal r, control signals en1, en1b, and en2, an output state z1 of the output line Z1, and an output state z2 of the output line Z2. This figure is the same as the sequence in FIG. 5 except that the following three timings are different in order. The three timings are time T0 _H to time T0 _{L based on} the control signal en1, time T1 _L to time T1 _H based on the control signal en2, and time T2 to time T3 for changing the input signals X, Y and the random number signal r. It is.

First, when the control signal en1 is changed to the L state (logic “0” state) from the time T0 _H to the time T0 _L , the output control unit 20 shifts from the output valid state to the output invalid state. Further, the control signal en1b obtained by logically inverting the control signal en1 causes the P net blocking unit 40a to block the path from the power supply line VDD to the output line Z1 via the P net unit 11. The operation of the output control unit 20 in response to the control signal en1 is the same as in the first and second embodiments. Time Ta indicates the time when charging of the output line Z1 is completed.
Next, the input signals X and Y and the random number signal r are changed between time T2 and time T3. Time T2 is a time after time T0 _H when the P net blocking unit 40a blocks the P net unit 11. When the input signals X and Y and the random number signal r are changed at this timing, since the P net blocking unit 40a blocks the P net unit 11, the power consumption waveform is the input signal X, Y. Even if the random number signal r is changed, it is not affected. Thereby, the input signals X and Y and the random number signal r can be changed at a timing before the time Ta at which the charging of the output line Z1 is completed. Therefore, the change timing of the input signals X and Y and the random number signal r can be advanced.
Next, when the control signal en2 is changed from the time T1 _L to the H state (logic “1” state) at the time T1 _H , the output stage circuit 30 shifts from the output valid state to the mask state. The operation when the control signal en2 transitions from “0” to “1” is the same as in the first embodiment.

In the subsequent operation, when the control signal en1 is changed to the H state (logic “1” state) from the time T4 _L to the time T4 _H , the output control unit 20 shifts from the output invalid state to the output valid state. At time T4 _H, P net blocking portion 40a is made conductive path leading to the output line Z1 from the power supply line VDD via a P net portion 11. Further, when the control signal en2 is changed to the L state (logic “0” state) from the time T5 _H to the time T5 _L , the output stage circuit 30 shifts from the mask state to the output valid state. As a result, a state in which the state of the output line Z1 is inverted is output to the output line Z2.

As described above, the output control unit 20 controls the output state of the output line Z1 of the logic operation circuit 10 according to the control signal en1. When the output control unit 20 is in an output invalid state, the NMOS 22 interrupts the path from the output line Z1 of the logic operation circuit 10 to the power supply line GND, and the PMOS 21 conducts the power supply line VDD and the output line Z. Charge to H state. As a result, the number of charging paths is one by the PMOS 21 regardless of the combination of input signals. Therefore, the logic circuit 1b can reduce the change in the power consumption waveform caused by the difference in the average number of charging paths. Thereby, the change of the statistical result of the power consumption waveform correlated with the input signals a and b can be reduced.
Further, the output stage circuit 30 provided in the subsequent stage of the logic operation circuit 10 is switched to the mask state in accordance with the control signal en2. When in the mask state, the output stage circuit 30 invalidates the output state of the output line Z1 and holds the output line Z2 of the logic circuit 1b in the L state. As a result, the logic circuit 1b masks the change in the operation timing of the output line of the logic operation circuit 10, and can reduce the change in the operation timing of the subsequent gate of the logic circuit 1b. Therefore, the logic circuit 1b can reduce the change in the power consumption waveform that occurs because the operation timing of the subsequent gate is different. Thereby, the change of the power consumption waveform correlated with the input signals a and b can be reduced.

  Further, the P net blocking unit 40a blocks a path from the power supply line VDD to the output line Z1 via the P net unit 11 in accordance with the control signal en1b (= NOT (en1)). Thereby, the input signals X and Y and the random number signal r can be changed before the time Ta at which the charging of the output line Z1 is completed. The time Ta needs to be determined by observing the state of the output line Z1, which is an internal signal of the logic circuit 1b. In this embodiment, the input signal X, Y and The timing for changing the random number signal r can be determined. Therefore, the logic circuit 1b has an advantage that the timing for changing the input signals X and Y and the random number signal r can be easily determined.

<Fourth Embodiment>
Hereinafter, an information storage medium according to a fourth embodiment of the present invention will be described with reference to the drawings.
FIG. 8 is a block diagram showing an information storage medium (IC card 200) in the present embodiment.
In FIG. 8, an information storage medium (IC card 200) includes a control unit 210, a RAM (Random Access Memory) 220, a ROM (Read Only Memory) 230, an EEPROM (Electrically Erasable Programmable ROM) 240, an interface unit 250, and an encryption processing unit. 260 and a random number generation unit 270. The IC card 200 is connected to the external device 300 through the interface unit 250. The control unit 210, the RAM 220, the ROM 230, the EEPROM 240, the interface unit 250, the encryption processing unit 260, and the random number generation unit 270 are each connected to the data bus B1.

The control unit 210 controls the entire IC card 200. The RAM 220 stores temporary storage information used by the control unit 210 for control. The ROM 230 stores a control program for the control unit 210, constant information, and the like. The EEPROM 240 is an electrically rewritable nonvolatile memory, and stores information supplied from the external device 300 via the interface unit 250, a secret key used for encryption processing or decryption processing, and the like. The interface unit 250 exchanges information with the external device 300.
The encryption processing unit 260 performs information encryption processing and decryption processing based on the secret key stored in the EEPROM 240. The random number generation unit 270 generates a random number R and supplies it to the encryption processing unit 260.

FIG. 9 is a block diagram showing the cryptographic processing unit 260 in the present embodiment.
9, the encryption processing unit 260 includes an input data register 261, an encryption key register 262, a control register 263, an encryption / decryption circuit 264, and an output data register 265. The input data register 261 stores information supplied by the control unit 210 through the data bus B1, and supplies the information to the encryption / decryption circuit 264. The information supplied by the control unit 210 is information stored in the EEPROM 240, information supplied from the external device 300 via the interface unit 250, or the like. The encryption key register 262 stores a secret key supplied by the control unit 210 through the data bus B1 and supplies the secret key to the encryption / decryption circuit 264. The control register 263 stores control information supplied by the control unit 210 through the data bus B1, and supplies a control signal to the encryption / decryption circuit 264. The control signal controls encryption processing and decryption processing of the encryption / decryption circuit 264. The control register 263 stores the state of the encryption / decryption circuit 264. The state of the encryption / decryption circuit 264 is referred to by the control unit 210 through the data bus B1.

The encryption / decryption circuit 264 includes a logic circuit 1 (FIG. 1) that is an AND circuit of the first embodiment. Although not shown, the encryption / decryption circuit 264 includes an encryption processing circuit and a decryption processing circuit using a basic logic circuit library including the logic circuit 1. Also, the encryption / decryption circuit 264 supplies the random number R supplied from the random number generation unit 270 to the logic circuit 1 as a random number signal r. The control signals en1 and en2 of the logic circuit 1 are generated by a timing controller (not shown) of the encryption / decryption circuit 264.
Further, the encryption / decryption circuit 264 performs encryption processing or decryption processing on the information supplied from the input data register 261 based on the secret key supplied from the encryption key register 262 in accordance with the control signal supplied from the control register 263. . As a result, encryption information or plaintext information is generated. The encryption / decryption circuit 264 stores the generated encryption information or plaintext information in the output data register 265. Here, the encryption method for performing the encryption process or the decryption process is, for example, DES (Data Encryption Standard) encryption.
The output data register 265 stores encryption information or plaintext information generated by the encryption / decryption circuit 264. The encrypted information or plaintext information is read by the control unit 210 via the data bus B1 and used for information processing of the IC card 200.

Next, the operation of this embodiment will be described.
The IC card 200 exchanges various information with the external device 300 via the interface unit 250. In the process of exchanging various information, the IC card 200 performs encryption processing or decryption processing using the encryption / decryption processing unit 260 when handling confidential information. For example, encryption processing or decryption processing is used in mutual authentication processing that mutually confirms the validity of the IC card 200 and the external device 300.
When performing the encryption process or the decryption process, first, the control unit 210 stores the secret key stored in the EEPROM 240 in the encryption key register 262 through the data bus B1. In addition, the control unit 210 stores information to be encrypted or decrypted in the input data register 261 through the data bus B1. Next, the control unit 210 supplies a control command to the control register 263 through the data bus B1. Thereby, the control signal is supplied to the encryption / decryption circuit 264, and the encryption process or the decryption process is started.

In response to the control signal, the encryption / decryption circuit 264 performs encryption processing or decryption processing on the information stored in the input data register 261 based on the secret key stored in the encryption key register 262. When performing this encryption process or decryption process, the logic circuit 1 constituting the encryption / decryption circuit 264 randomly changes the output of the output line Z2 (FIG. 1) of the logic circuit 1 in accordance with the random number signal r. The operation of the logic circuit 1 is as described in the first embodiment. By the operation of the logic circuit 1, the encryption / decryption circuit 264 can eliminate the correlation between the statistical value of power consumption and the secret key.
The encryption / decryption circuit 264 stores the generated encryption information or plaintext information in the output data register 265 when the encryption process or the decryption process is completed. Also, the encryption / decryption circuit 264 stores in the control register 263 that the encryption process or the decryption process has been completed. The control unit 210 refers to the control register 263 and detects that the encryption process or the decryption process is completed. When the completion of the encryption process or the decryption process is detected, the control unit 210 reads the information in the output data register 265 through the data bus B1 and stores it in the EEPROM 240 or supplies it to the external device 300 through the interface unit 250.

  As described above, the IC card 200 includes the control unit 210, the RAM 220, the ROM 230, the EEPROM 240, the interface unit 250, the cryptographic processing unit 260, and the random number generation unit 270. The encryption processing unit 260 includes an input data register 261, an encryption key register 262, a control register 263, an encryption / decryption circuit 264, and an output data register 265. The encryption / decryption circuit 264 includes the logic circuit 1 and performs encryption processing on information supplied from the input data register 261 based on a secret key supplied from the encryption key register 262 in accordance with a control signal supplied from the control register 263. Alternatively, the decryption process is performed. Therefore, in the IC card 200, the power generated due to the change in the power consumption waveform caused by the difference in the average number of charging paths of the logic circuit 1 and the operation timing of the gate at the subsequent stage of the logic circuit in the encryption process or the decryption process Changes in the consumption waveform can be reduced. As a result, the IC card 200 can reduce the correlation between the statistical value of the power consumption and the secret key, and can expect the effect of preventing the power analysis attack.

<Fifth Embodiment>
Hereinafter, a logic circuit according to a fifth embodiment of the present invention will be described with reference to the drawings.
FIG. 10 is a block diagram showing a logic circuit in the present embodiment.
The logic circuit 1c shown in FIG. 10 is a form in which a composite gate that performs an ORAND (logical sum AND) logic operation is applied to the logic circuit 1 shown in FIG. The logic circuit 1c includes a logic operation circuit 10a, an output control unit 20, and an output stage circuit 30. In this figure, the same components as those in FIG.
The logical operation circuit 10a is disposed between the power supply line VDD and the power supply line GND, and includes a P net unit 11a and an N net unit 12a. Based on the input signals X, Y, W and the random number signal r, the logic operation circuit 10a outputs an output logic state generated by the complementary operation of the P net unit 11a and the N net unit 12a to the output line Z1.
The P net unit 11a is arranged between the power supply line VDD and the output line Z1, charges the output line Z1 with the potential of the power supply line VDD based on the input signals X, Y, W and the random number signal r, and has a logic level. Outputs “1”.
The N net portion 12a is disposed between the output line Z1 and the power supply line GND, and discharges the output line Z1 by the potential of the power supply line GND based on the input signals X, Y, W and the random number signal r, and has a logic level. Outputs “0”.

The P net unit 11a includes PMOSs 111a to 115a, 116, and 117. The PMOSs 111a, 112a, and 115a are arranged in series between the power supply line VDD and the output line Z1. The PMOS 111a has a source terminal connected to the power supply line VDD, a drain terminal connected to the node N1a, and an input signal X supplied to the gate terminal. The PMOS 112a has a source terminal connected to the node N1a, a drain terminal connected to the node N8, and an input signal Y supplied to the gate terminal. The PMOS 115a has a source terminal connected to the node N8, a drain terminal connected to the output line Z1, and a random number signal r supplied to the gate terminal. The PMOS 116 is disposed in parallel with the PMOSs 111a and 112a. The PMOS 116 has a source terminal connected to the power supply line VDD, a drain terminal connected to the node N8, and an input signal W supplied to the gate terminal.
The PMOSs 113a and 114a are connected in parallel between the power supply line VDD and the node N2a. The PMOS 113a has a source terminal connected to the power supply line VDD, a drain terminal connected to the node N2a, and an input signal X supplied to the gate terminal. The PMOS 114a has a source terminal connected to the power supply line VDD, a drain terminal connected to the node N2a, and an input signal Y supplied to the gate terminal.
The PMOS 117 has a source terminal connected to the node N2a, a drain terminal connected to the output line Z1, and an input signal W supplied to the gate terminal.

The N net unit 12a includes NMOSs 121a to 125a, 126, and 127. The NMOSs 121a, 122a, and 125a are arranged in series between the output line Z1 and the node N4. The NMOS 121a has a source terminal connected to the node N3a, a drain terminal connected to the node N9, and an input signal X supplied to the gate terminal. The NMOS 122a has a source terminal connected to the node N4, a drain terminal connected to the node N3a, and an input signal Y supplied to the gate terminal. The NMOS 125a has a source terminal connected to the node N9, a drain terminal connected to the output line Z1, and a random number signal r supplied to the gate terminal. The NMOS 126 is arranged in parallel with the NMOSs 121a and 122a. The NMOS 126 has a source terminal connected to the node N4, a drain terminal connected to the node N9, and an input signal W supplied to the gate terminal.
The NMOSs 123a and 124a are connected in parallel between the node N5a and the node N4. The NMOS 123a has a source terminal connected to the node N4, a drain terminal connected to the node N5a, and an input signal X supplied to the gate terminal. The NMOS 124a has a source terminal connected to the node N4, a drain terminal connected to the node N5a, and an input signal Y supplied to the gate terminal.
The NMOS 127 has a source terminal connected to the node N5a, a drain terminal connected to the output line Z1, and an input signal W supplied to the gate terminal.

Next, the operation of this embodiment will be described.
The logic circuit 1c is an ORAND circuit for obtaining an output d obtained by performing an ORAND (logical sum product) operation on the input signals a, b, and c. The input signals X, Y, and W of the logic circuit 1c are values obtained by performing an XOR (exclusive OR) operation on the input signals a, b, and c and the random number signal r (X = a XOR r, Y = b XOR r, W = c XOR r). Similarly, the output z2 of the output line Z2 of the logic circuit 1c is a value obtained by XORing the random number r and the output d (z2 = d XOR r). The random number signal r for XORing the inputs a, b, and c and the random number signal r for XORing the output d have the same value, and the random number signal r is set to a different value every time the gate operation is performed.

  Further, the logical operation circuit 10a performs an ORAND / ANDNOR (logical NAND operation) to obtain an output z1 obtained by performing an XOR operation with the random signal r on the result of performing an ORAND (logical OR operation) on the input signals a, b, and c. ) Arithmetic circuit. When the random number signal r is “0”, the logic operation circuit 10a functions as an ORAND operation circuit for the input signals X, Y, and W (z1 = (XORY) NAND W). When the random number signal r is “1”, the logic operation circuit 10a functions as an ANDNOR operation circuit for the input signals X, Y, and W (z1 = (X AND Y) NOR W). The principle is shown in equations (4) to (6).

  z1 = ((a OR b) NAND c) XOR r (4)

  Expression (4) is an expression indicating a logical operation of the logical operation circuit 10a.

[When r = "0"]
X = a XOR r = a, Y = b XOR r = b, W = c XOR r = c,
z1 = ((a OR b) NAND c) XOR r = (X OR Y) NAND W (5)

  Expression (5) is an expression showing a logical operation of the logical operation circuit 10a when the random number signal r is “0”. When the random number signal r is “0”, the input signals a, b, and c are equal to the input signals X, Y, and W, respectively. Therefore, the logic of the output line Z1 of the logic operation circuit 10a is obtained by performing an ORAND operation on the input signals X, Y, and W.

[When r = “1”]
X = a XOR r = NOT (a), Y = b XOR r = NOT (b), W = c XOR r = NOT (c),
z1 = NOT ((NOT (X) OR NOT (Y)) NAND NOT (W)) = NOT ((X AND Y) OR W) = (X AND Y) NOR W (6)

  Expression (6) is an expression showing a logical operation of the logical operation circuit 10a when the random number signal r is “1”. When the random number signal r is “1”, the input signals a, b, and c are values obtained by NOT calculation of the input signals X, Y, and W, respectively. For this reason, the logic of the output line Z1 of the logic operation circuit 10a is obtained by performing an ORNAND operation on each of the input signals X, Y, and W, and further performing a NOT operation on the operation result. According to De Morgan's theorem, ((NOT (X) OR NOT (Y)) NAND NOT (W)) is an ANDOR (logical AND) operation ((X AND Y) OR of the input signals X, Y and W. W). As a result, the logic of the output line Z1 of the logic operation circuit 10a is an ANDNOR operation of the input signals X, Y, and W.

In the logical operation circuit 10a, when the random number signal r is “0”, the PMOS 115a of the P net unit 11a is turned on, and the PMOSs 111a, 112a, and 116 are enabled. Further, the NMOS 125a of the N net portion 12a is turned off, and the NMOSs 121a, 122a, and 126 are disabled. As a result, the output line Z1 outputs an output logic state that is logically operated by the PMOSs 111a, 112a, and 116 and the NMOSs 123a, 124a, and 127. That is, the logic operation circuit 10a functions as an ORAND operation circuit for the input signals X, Y, and W. In this case, the PMOSs 113a, 114a, and 117 are not involved in determining the output logic state.
Further, in the logical operation circuit 10a, when the random number signal r is “1”, the PMOS 115a of the P net unit 11a is turned off, and 111a, 112a, and 116 become invalid. Further, the NMOS 125a of the N net portion 12a is turned on, and the NMOSs 121a, 122a, and 126 are enabled. As a result, the output line Z1 outputs an output logic state that is logically operated by the NMOSs 121a, 122a, and 126 and the PMOSs 113a, 114a, and 117. That is, the logic operation circuit 10a functions as an ANDNOR operation circuit for the input signals X, Y, and W. In this case, the NMOSs 123a, 124a, and 127 are not involved in determining the output logic state.

  The output z1 logically operated by the logical operation circuit 10a is supplied to the output stage circuit 30 via the output line Z1. The output stage circuit 30 inverts the output logic state of the output z1 and outputs it as the output z2 to the output line Z2. As a result, the logic circuit 1c causes the ORAND operation result of the input signals X, Y, and W (z2 = (XORY) AND W) or the ANDOR operation result of the input signals X, Y, and W according to the random number signal r. (Z2 = (X AND Y) OR W) is output to the output line Z2.

FIG. 11 is a diagram showing a logic table of the logic circuit 1c in the present embodiment.
In FIG. 11, the state of the output z2 of the output line Z2 is shown according to 16 combinations of 8 combinations of the input signals X, Y, and W and combinations of the random number signal r. It can be seen that the output z2 is logically inverted according to the value of the random number signal r. Since the value of the random signal r changes randomly, the output z2 varies randomly even if the input signals a, b, and c are the same.

  The control sequence of the input signals X, Y, W, the random number signal r, and the control signals en1, en2 in the logic circuit 1c is the same as that in the time chart shown in FIG. The input signal W is changed at the same timing (time T2 to time T3) as the input signals X and Y.

As described above, the output control unit 20 controls the output state of the output line Z1 of the logic operation circuit 10a according to the control signal en1. When the output control unit 20 is in an output invalid state, the NMOS 22 interrupts the path from the output line Z1 of the logic operation circuit 10a to the power supply line GND, and the PMOS 21 connects the power supply line VDD and the output line Z1. Charge to H state. As a result, the number of charging paths is one by the PMOS 21 regardless of the combination of input signals. Therefore, the logic circuit 1c can reduce the change in the power consumption waveform that occurs because the average number of charging paths is different. Thereby, the change of the statistical result of the power consumption waveform correlated with the input signals a, b, and c can be reduced.
Further, the output stage circuit 30 provided in the subsequent stage of the logical operation circuit 10a switches to the mask state in accordance with the control signal en2. When in the mask state, the output stage circuit 30 invalidates the output state of the output line Z1 and holds the output line Z2 of the logic circuit 1c in the L state. Thereby, the logic circuit 1c masks the change in the operation timing of the output line of the logic operation circuit 10a, and can reduce the change in the operation timing of the gate in the subsequent stage of the logic circuit 1c. Therefore, the logic circuit 1c can reduce the change in the power consumption waveform that occurs because the operation timing of the subsequent gate is different. Thereby, the change of the power consumption waveform correlated with the input signals a, b, and c can be reduced.

According to the embodiment of the present invention, the logic circuit 1 (or any one of 1a, 1b, and 1c) is supplied with the potential of the power supply line VDD and supplied with the potential of the power supply line GND lower than the potential of the power supply line VDD. A logic operation circuit 10 (or 10a) for outputting an output logic state generated based on the input signals X, Y (or X, Y, W) and the random number signal r inputted to the output line Z1; In response to the control signal en1, the output state of the output line Z1 is controlled, and when the output logic state is invalid, the path leading from the output line Z1 to the power supply line GND is interrupted, and the power supply line VDD The output control unit 20 that charges the output line Z1 with the potential of the output and the mask state that is provided in the subsequent stage of the logic operation circuit 10 (or 10a) and invalidates the output state based on the output state of the output line Z1. Control signal And an output stage circuit 30 to switch in response to n2.
As a result, the number of charging paths is one by the PMOS 21, regardless of the combination of the input signals X, Y (or X, Y, W). Therefore, the logic circuit 1 (or any one of 1a, 1b, and 1c) can reduce the change in the power consumption waveform caused by the difference in the average number of charging paths.
Further, the logic circuit 1 (or any one of 1a, 1b, and 1c) masks a change in the operation timing of the output line Z1 of the logic operation circuit 10 (or 10a) by the output stage circuit 30, and the logic circuit 1 (or 1a, 1b, and 1c), the change in the operation timing of the subsequent stage gate can be reduced. Therefore, the logic circuit 1 (or any one of 1a, 1b, and 1c) can reduce the change in the power consumption waveform that occurs because the operation timing of the subsequent gate is different.

Further, when the output invalid state is canceled, the output control unit 20 conducts the path from the output line Z1 to the power supply line GND, and discharges the output line Z1 by the potential of the power supply line GND according to the generated logic state. To do.
In addition, the logical operation circuit 10 (or 10a) charges the output line Z1 with the potential of the power supply line VDD based on the input signals X, Y (or X, Y, W) and the random number signal r. (Or 11a) is complementary to the N net portion 12 (or 12a) that discharges the output line Z1 by the potential of the power supply line GND based on the input signals X, Y (or X, Y, W) and the random number signal r. To generate an output logic state. Further, the path leading from the output line Z1 to the power supply line GND is a path leading from the output line Z1 to the power supply line GND via the N net unit 12 (or 12a).
As a result, by discharging the load capacity of the output line Z1 to the power supply line GND, the output logic state of the logic operation circuit 10 (or 10a) is obtained. Since this discharge current is consumed in the logic circuit 1, it is not observed as power consumption from the outside. When determining the output logic state of the logic operation circuit 10 (or 10a), the power consumption waveform is not affected.

The logic circuit 1a (or 1b) also shuts off the P net that cuts off the path from the power line VDD to the output line Z1 via the P net unit 11 in response to the control signal en1 (en1b) (or control signal en2). The unit 40 (or 40a) is provided.
Thereby, when the output control part 20 charges the output line Z1 with the electric potential of the power supply line VDD, the P net | network part 11 can be interrupted | blocked from the output line Z1. Therefore, the output control unit 20 can charge the output line Z1 through one path by the PMOS 21 regardless of the states of the input signals X and Y and the random number signal r.

The input signals X, Y (or X, Y, W) and the random number signal r are changed after the output control unit 20 is in an output invalid state and the output line Z1 becomes the potential of the power supply line VDD. The output control unit 20 cancels the output invalid state based on the control signal en1 after the change of the input signals X, Y (or X, Y, W) and the random number signal r is confirmed. The output stage circuit 30 releases the mask state based on the control signal en2 after the output invalid state is released and the output state of the output line Z1 is determined.
This reduces the power consumed when the input signals X, Y (or X, Y, W) and the random number signal r transition, and depends on the combination of the input signals X, Y (or X, Y, W). Therefore, the charging path can be made one by the PMOS 21 without fail. Therefore, the logic circuit 1 (or any one of 1a, 1b, and 1c) can further reduce the change in the power consumption waveform caused by the difference in the average number of charging paths. Further, a change in the operation timing of the output line Z1 of the logic operation circuit 10 (or 10a) can be reliably masked. Therefore, it is possible to further reduce the change in the operation timing of the subsequent gate of the logic circuit 1 (or any one of 1a, 1b, and 1c).

Further, the input signals X and Y and the random number signal r are in an output invalid state by the output control unit 20, and the P net blocking unit 40 (or 40a) communicates from the power supply line VDD to the output line Z1 via the P net unit 11. It is changed after the route is blocked. The output control unit 20 cancels the output invalid state based on the control signal en1 after the change of the input signals X and Y and the random number signal r is confirmed. The output stage circuit 30 releases the mask state based on the control signal en1 after the output invalid state is released and the output state of the output line Z1 is determined.
Thereby, the change timing of the input signals X and Y and the random number signal r can be advanced. Further, the timing for changing the input signals X and Y and the random number signal r can be determined based on the state of the control signal en1 (or en2) that is an input signal. Therefore, the logic circuit 1a (or 1b) has an advantage that the timing for changing the input signals X and Y and the random number signal r can be easily determined.

The logic operation circuit 10 (or 10a) generates a logic state corresponding to a predetermined logic operation process based on the input signals X, Y (or X, Y, W), and based on the random number signal r. It is switched whether or not to perform a logical operation process by inverting the input signals X and Y (or X, Y and W) and whether or not to change the output logic state from the logic state.
Thereby, the logical operation circuit 10 (or 10a) can switch between the NAND logical operation and the NOR logical operation (or the ORNAND logical operation and the ANDNOR logical operation) based on the random number signal r. Therefore, the logic circuit 1 (or any one of 1a, 1b, and 1c) can change the output z2 of the output line Z2 at random with the random number r.

Further, according to the embodiment of the present invention, the IC card 200 includes an EEPROM 240 that stores a secret key and information, a random number generation unit 270 that generates a random number signal R, and at least logic circuits (1, 1a, 1b, 1c). And an encryption processing unit 260 that performs at least one of encryption processing and decryption processing according to a secret key.
Thereby, the IC card 200 changes the power consumption waveform caused by the difference in the average number of charging paths of the logic circuit 1 (or any of 1a, 1b, and 1c) in the encryption process or the decryption process, and the logic circuit It is possible to reduce the change in the power consumption waveform caused by the operation timing of the subsequent stage gates being different. As a result, the IC card 200 can reduce the correlation between the statistical value of the power consumption and the secret key, and can expect the effect of preventing the power analysis attack.

The present invention is not limited to the above embodiments, and can be modified without departing from the spirit of the present invention. The P net units 11 and 11a and the N net units 12 and 12a are not limited to the embodiments. For example, the connection order of the NMOS or PMOS connected in series may be connected in a different order. Further, although the logic operation circuits 10 and 10a have been described as being NAND / NOR operation circuits and ORNAND / ANDNOR operation circuits, the present invention is not limited to this, and other logic operations may be performed.
Further, in the logic operation circuits 10 and 10a, an inverted signal of the random number signal r may be used instead of the random number signal r. For example, when an inverted signal of the random number signal r is used for the logic operation circuit 10, the logic operation circuit 10 becomes NOR logic when the random number signal r is “0”, and becomes NAND logic when the random number signal r is “1”. It can be easily changed to a logic operation circuit (NOR / NAND operation circuit) that performs different logic operations. When an inverted signal of the random number signal r is used for the logical operation circuit 10a, an ANDNOR / ORNAND operation circuit is obtained.
Further, the output stage control unit 32 of the output stage circuit 30 has been described in the form in which the output line Z2 is held at “0” in the mask state, but the form in which the positions of the PMOS 321 and the NMOS 322 are changed to hold “1”. But it ’s okay. However, in this case, it is necessary to invert the logic of the control signal en2.

Further, the P net blocking unit 40 (or 40a) has been described as being disposed between the P net unit 11 and the output line Z1, but may be disposed between the power supply line VDD and the P net unit 11. Further, the NMOS 22 has been described as being disposed between the N net portion 12 (or 12a) and the power supply line GND, but may be disposed between the output line Z1 and the N net portion 12 (or 12a). Similarly, the PMOS 321 may be disposed between the PMOS 311 and the output line Z2.
Further, although the power supply line VDD used for the logic operation circuit 10 (or 10a) and the output control unit 20 and the power supply line VDD used for the output stage circuit 30 have been described with the same potential form, power supplies with different potentials are used. It may be used and connected via a level shifter.
In the first and third embodiments, the time T1 _L when the control signal en2 is in the H state may be before the time T0 _H when the control signal en1 is in the L state. In the second embodiment, the time T1 _L when the control signal en2 is in the H state may be after the time T0 _H when the control signal en1 is in the L state.

Further, the information storage medium of the present invention is not limited to the IC card 200 of the fourth embodiment. For example, a USB (Universal Serial Bus) memory or an SD (SD) memory card having a cryptographic processing function may be used, or another form of information storage medium may be used. The interface unit 250 may be a contact type interface using contacts or a non-contact type interface. In addition, the encryption method used by the encryption processing unit 260 is not limited to the DES encryption, and public key encryption such as AES (Advanced Encryption Standard) encryption, RSA (RSA) encryption, and elliptic curve encryption are disclosed. Key encryption or a hash function such as SHA-1 (Secure Hash Algorithm-1) may be used, or another encryption method may be used. In the fourth embodiment, the IC card 200 has been described as performing both encryption processing and decryption processing, but may be configured to process either one.
Further, although the IC card 200 has been described as having the EEPROM 240 as a rewritable nonvolatile memory for storing information, the IC card 200 may have another rewritable nonvolatile memory. For example, a form including a memory such as a flash memory or a FeRAM (Ferroelectric Random Access Memory) may be used.
Further, although the IC card 200 has been described as including the logic circuit 1 in the encryption / decryption circuit 264, the IC card 200 may include any one or more of the logic circuits 1a, 1b, and 1c.
Note that the power consumption confusion type logic circuit of the present invention corresponds to the logic circuit 1 (or any one of 1a, 1b, and 1c).

1, 1a, 1b, 1c Logic circuit 10, 10a Logic operation circuit 11, 11a P net unit 12, 12a N net unit 20 Output control unit 21 PMOS
22 NMOS
30 Output stage circuit 31 Inverter unit 32 Output stage control unit 40, 40a P net blocking unit 111, 111a, 112, 112a, 113, 113a, 114, 114a, 115 115a, 116, 117 PMOS
121, 121a, 122, 122a, 123, 123a, 124, 124a, 125125a, 126, 127 NMOS
200 IC card 210 Control unit 220 RAM
230 ROM
240 EEPROM
250 Interface unit 260 Cryptographic processing unit 261 Input data register 262 Cryptographic key register 263 Control register 264 Cryptographic decryption circuit 265 Output data register 270 Random number generating unit 300 External device 311, 321 PMOS
312 and 322 NMOS

Claims (8)

The first potential is supplied from the first supply line, and the second potential lower than the first potential is supplied from the second supply line, and is generated based on the input signal and the random number signal that are input. A logical operation circuit that outputs an output logic state to an output line;
The output state of the output line is controlled in accordance with the input first control signal, and when the output logic state is invalidated, the output line leads from the output line to the second supply line. An output control unit that interrupts one path and charges the output line with the first potential;
An output stage circuit provided at a subsequent stage of the logic operation circuit and switching to a mask state that invalidates the output state based on the output state of the output line according to the input second control signal. Characteristic power consumption confusion type logic circuit. The output control unit
2. The output circuit according to claim 1, wherein when the output invalid state is canceled, the first path is made conductive, and the output line is discharged by the second potential according to the generated logic state. Power confusion type logic circuit. The logical operation circuit is:
A P net unit that charges the output line with the first potential based on the input signal and the random number signal, and discharges the output line with the second potential based on the input signal and the random number signal. And the N net part that operates complementarily generates the output logic state,
The first route is:
3. The power consumption confusion type logic circuit according to claim 1, wherein the output line is a path that leads from the output line to the second supply line via the N net unit. 4. In accordance with the first control signal or the second control signal, a P net blocking unit that blocks a second path that leads from the first supply line to the output line via the P net unit. The power consumption confusion type logic circuit according to claim 3. The input signal and the random number signal are:
After the output control unit is in the output invalid state and the output line is at the first potential,
The output control unit
After the change of the input signal and the random number signal is confirmed, the output invalid state is canceled based on the first control signal,
The output stage circuit is
5. The mask state is canceled based on the second control signal after the output invalid state is canceled and the output state of the output line is determined. 5. The power consumption confusion type logic circuit described. The input signal and the random number signal are:
The output control unit is in the output invalid state, and the P net blocking unit is changed after blocking the second path,
The output control unit
After the change of the input signal and the random number signal is confirmed, the output invalid state is canceled based on the first control signal,
The output stage circuit is
The power consumption confusion type logic according to claim 4, wherein after the output invalid state is canceled and the output state of the output line is determined, the mask state is canceled based on the second control signal. circuit. The logical operation circuit is:
Generating a logical state corresponding to a predetermined logical operation process based on the input signal, whether to perform the logical operation process in which the input signal is inverted based on the random number signal, and the output logical state The power consumption confusion type logic circuit according to any one of claims 1 to 6, wherein whether or not the logic state is inverted from the logic state is switched. A storage unit for storing a secret key and information;
A random number generator for generating the random number signal;
An information storage medium comprising: a power consumption confusion type logic circuit according to any one of claims 1 to 7; and an encryption processing unit that performs encryption processing according to the secret key.

Images