JP6473874B2 - Memory device, host device, and memory system - Google Patents

Description

  The present invention relates to a memory device, a host device, and a memory system including them.

  2. Description of the Related Art In a memory system including a host device and a memory device connected to the host device, a memory system in which security is improved by encrypting commands and data transmitted / received between both devices has been put into practical use.

  Currently used cryptography is computationally safe for cryptographic analysis techniques. However, when the cryptographic module is actually mounted on the memory system, leaks depending on the mounting, such as power consumption and processing time, occur. By observing such an operating state with various physical means, the threat of side channel attacks that attempt to illegally acquire secret information such as a secret key has increased.

  As one of the side channel attacks, there is a power analysis attack that analyzes secret information by measuring the power consumption of the apparatus. Among them, differential power analysis (DPA: Differential Power Analysis) for performing analysis by statistical processing on a plurality of measured power consumption waveforms has been reported as a particularly powerful attack method (see Non-Patent Document 1 below).

  Therefore, in recent years, various countermeasure circuits against DPA attacks have been proposed. For example, the following Non-Patent Document 2 proposes an RSL (Random Switching Logic) circuit and a WDDL (Wave Dynamic Differential Logic) circuit. The RSL circuit eliminates the bias of the state transition probability by switching the operation mode of the logic circuit using a random number, and thereby randomizes the power consumption so as not to depend on the encryption key. After performing the precharge operation, the WDDL circuit equalizes the power consumption by reducing the difference in current consumption due to the difference in bit value at the time of calculation by the complementary circuit.

Paul Kocher and two others, “Introduction to Differential Power Analysis and related Attacks”, [online], Cryptography Research, search July 1, 2015, Internet <http://www.cryptography.com/public/pdf/ DPATechInfo.pdf> Daisuke Suzuki and two others, "Random Switching Logic: A Countermeasure against DPA based on Transition Probability", [online], International Association for Cryptologic Research, July 1, 2015 search, Internet <http: //eprint.iacr .org / 2004 / 346.pdf>

  However, in a memory system including a host device and a memory device, when the RSL circuit or the WDDL circuit described above is mounted on the device, operation time, circuit scale, and consumption are compared with a device that does not mount these circuits. Since the power increases by 2 to 3 times or more, the cost increases.

  The present invention has been made in view of such circumstances, and an object of the present invention is to obtain a memory device, a host device, and a memory system including them that can implement a countermeasure against a DPA attack at a low cost. It is.

A memory device according to a first aspect of the present invention is a memory device connected to a host device, and is usually used for encrypting and decrypting data transmitted and received between the host device and the memory device. A first cryptographic module and a second cryptographic module that execute an operation; and a control circuit that controls operations of the first cryptographic module and the second cryptographic module, wherein the control circuit includes the first cryptographic module and the second cryptographic module. In a first period in which the second cryptographic module performs a normal operation and the first cryptographic module does not perform a normal operation, the first cryptographic module performs a dummy operation, and the first cryptographic module A temporary data generating circuit for generating temporary data based on the data, and the second cryptographic module is configured to store the temporary data generated by the temporary data generating circuit. And the control circuit inputs dummy input data to the temporary data generation circuit in the first period, and the control circuit includes: When having a holding circuit that holds state transition information and causing the first cryptographic module to perform a dummy operation, the latest state transition information is saved in the holding circuit, and then the temporary data generation circuit When the operation is executed, the state transition information held by the holding circuit is written back to the temporary data generation circuit .

According to the memory device of the first aspect, the control circuit controls the first cryptographic module in the first period in which the second cryptographic module performs a normal operation and the first cryptographic module does not perform a normal operation. Perform a dummy operation. As described above, the power consumption characteristic of the second cryptographic module can be concealed by performing the dummy operation of the first cryptographic module in the first period in which only the second cryptographic module performs the normal operation. . As a result, a countermeasure against the DPA attack can be implemented at a low cost.
In the memory device according to the first aspect, the control circuit inputs dummy input data to the temporary data generation circuit in the first period. Thus, by inputting dummy input data to the temporary data generation circuit, it is possible to cause the temporary data generation circuit to execute a dummy operation for generating dummy temporary data.
According to the memory device of the first aspect, when the control circuit causes the first cryptographic module to perform a dummy operation, the control circuit saves the latest state transition information of the temporary data generation circuit to the holding circuit, Next, when causing the temporary data generation circuit to perform a normal operation, the state transition information held by the holding circuit is written back to the temporary data generation circuit. As a result, the temporary data generation circuit can generate the temporary data in the normal operation after the dummy operation.

  The memory device according to a second aspect of the present invention is the memory device according to the first aspect, in particular, the control circuit includes the first cryptographic module and the control circuit in a second period different from the first period. Both the second cryptographic modules are normally operated at the same time.

  According to the memory device of the second aspect, the control circuit normally operates both the first cryptographic module and the second cryptographic module simultaneously in the second period. In this manner, by simultaneously operating both the first cryptographic module and the second cryptographic module at the same time, it is possible to conceal the power consumption characteristics exposed when only one of them is normally operated. As a result, a countermeasure against the DPA attack can be implemented at a low cost.

The memory device according to a third aspect of the present invention is characterized in that, in the memory device according to the first or second aspect, the dummy input data is a fixed value.

According to the memory device of the third aspect, the dummy input data is a fixed value. In this way, the dummy input data is set to a fixed value and the attacker predicts that some key data generation processing is being executed, thereby attacking the useless work of identifying dummy input data through analysis. Can be expected. As a result, it is possible to protect true input data for a long time. Further, by setting the dummy input data to a fixed value, the power consumption of the temporary data generation circuit accompanying the dummy operation can be made uniform.

The memory device according to a fourth aspect of the present invention is characterized in that, in the memory device according to the first or second aspect, the dummy input data is a variable value.

According to the memory device of the fourth aspect, the dummy input data is a fluctuation value. Accordingly, since the power consumption of the temporary data generation circuit varies each time the dummy input data varies, the power consumption of the entire memory device can be varied. As a result, it becomes possible to make it difficult to analyze the power consumption characteristics due to the DPA attack.

The memory device according to a fifth aspect of the present invention is characterized in that, in the memory device according to any one of the first to fourth aspects, the input data is key information.

According to the memory device of the fifth aspect, the temporary data generation circuit can generate the session key as the temporary data by inputting the key information as the input data.

A memory device according to a sixth aspect of the present invention, in the memory device according to any one of the first to fifth aspects, further includes an unauthorized access detection circuit for detecting unauthorized access from the host device, The control circuit causes the second cryptographic module to perform a dummy operation in a first period when the unauthorized access detection circuit detects unauthorized access.

According to the memory device of the sixth aspect, the control circuit causes the second cryptographic module to perform a dummy operation in the first period when the unauthorized access detection circuit detects unauthorized access. Therefore, the availability of the system can be ensured, and an increase in power consumption caused by executing a dummy operation when no unauthorized access is detected can be avoided.

A host device according to a seventh aspect of the present invention is a host device to which a memory device is connected, and is usually used for encrypting and decrypting data transmitted and received between the host device and the memory device. A first cryptographic module and a second cryptographic module that execute an operation; and a control circuit that controls operations of the first cryptographic module and the second cryptographic module, wherein the control circuit includes the first cryptographic module and the second cryptographic module. In a first period in which the second cryptographic module performs a normal operation and the first cryptographic module does not perform a normal operation, the first cryptographic module performs a dummy operation, and the first cryptographic module A temporary data generating circuit for generating temporary data based on the data, and the second cryptographic module is configured to store the temporary data generated by the temporary data generating circuit. And the control circuit inputs dummy input data to the temporary data generation circuit in the first period, and the control circuit includes: When having a holding circuit that holds state transition information and causing the first cryptographic module to perform a dummy operation, the latest state transition information is saved in the holding circuit, and then the temporary data generation circuit When the operation is executed, the state transition information held by the holding circuit is written back to the temporary data generation circuit .

According to the host device of the seventh aspect, the control circuit causes the first cryptographic module to be in the first cryptographic module in the first period in which the second cryptographic module performs normal operation and the first cryptographic module does not perform normal operation. Perform a dummy operation. As described above, the power consumption characteristic of the second cryptographic module can be concealed by performing the dummy operation of the first cryptographic module in the first period in which only the second cryptographic module performs the normal operation. . As a result, a countermeasure against the DPA attack can be implemented at a low cost.
In the host device according to the seventh aspect, the control circuit inputs dummy input data to the temporary data generation circuit in the first period. Thus, by inputting dummy input data to the temporary data generation circuit, it is possible to cause the temporary data generation circuit to execute a dummy operation for generating dummy temporary data.
Further , according to the host device of the seventh aspect, when the control circuit causes the first cryptographic module to perform a dummy operation, the control circuit saves the latest state transition information of the temporary data generation circuit to the holding circuit, Next, when causing the temporary data generation circuit to perform a normal operation, the state transition information held by the holding circuit is written back to the temporary data generation circuit. As a result, the temporary data generation circuit can generate the temporary data in the normal operation after the dummy operation.

The host device according to an eighth aspect of the present invention is the host device according to the seventh aspect, in particular, the control circuit includes the first cryptographic module and the second circuit in a second period different from the first period. Both the second cryptographic modules are normally operated at the same time.

According to the host device of the eighth aspect, the control circuit normally operates both the first cryptographic module and the second cryptographic module simultaneously in the second period. In this manner, by simultaneously operating both the first cryptographic module and the second cryptographic module at the same time, it is possible to conceal the power consumption characteristics exposed when only one of them is normally operated. As a result, a countermeasure against the DPA attack can be implemented at a low cost.

The host device according to the ninth aspect of the present invention is characterized in that, in the host device according to the seventh or eighth aspect, the dummy input data is a fixed value.

According to the host device of the ninth aspect, the dummy input data is a fixed value. In this way, the dummy input data is set to a fixed value and the attacker predicts that some key data generation processing is being executed, thereby attacking the useless work of identifying dummy input data through analysis. Can be expected. As a result, it is possible to protect true input data for a long time. Further, by setting the dummy input data to a fixed value, the power consumption of the temporary data generation circuit accompanying the dummy operation can be made uniform.

The host device according to the tenth aspect of the present invention is characterized in that, in the host device according to the seventh or eighth aspect, the dummy input data is a variable value.

According to the host device according to the tenth aspect, the dummy input data is a fluctuation value. Accordingly, since the power consumption of the temporary data generation circuit varies every time the dummy input data varies, the power consumption of the entire host device can be varied. As a result, it becomes possible to make it difficult to analyze the power consumption characteristics due to the DPA attack.

The host device according to an eleventh aspect of the present invention is characterized in that, in the host device according to any one of the seventh to tenth aspects, the input data is key information.

According to the host device of the eleventh aspect, by inputting key information as input data, the temporary data generation circuit can generate a session key as temporary data.

A memory system according to a twelfth aspect of the present invention includes the memory device according to any one of the first to sixth aspects, and the host device according to any one of the seventh to eleventh aspects. It is characterized by.

According to the memory system of the twelfth aspect, since the countermeasure against the DPA attack is implemented in both the memory device and the host device, it is possible to increase the resistance against the DPA attack as the entire memory system.

  According to the present invention, it is possible to implement a countermeasure against a DPA attack at a low cost.

It is a figure which shows the structure of the memory system which concerns on embodiment of this invention. It is a figure which shows the structure of the encryption block of a memory device. It is a timing chart which shows the processing content of a session key generation circuit and a stream data generation circuit. It is a figure which shows the structure of the encryption block of a host apparatus. It is a timing chart which shows the processing content of a session key generation circuit and a stream data generation circuit. It is a figure which shows the structure of the encryption block of a memory device.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In addition, the element which attached | subjected the same code | symbol in different drawing shall show the same or corresponding element.

  FIG. 1 is a diagram showing a simplified configuration of a memory system 1 according to an embodiment of the present invention. As shown in FIG. 1, the memory system 1 includes a host device 2 and a memory device 3 such as a semiconductor memory that is detachably connected to the host device 2.

  The host device 2 includes a CPU 11, an internal memory 12, a main control circuit 13, and an encryption block 14. The memory device 3 includes an encryption block 21 similar to the encryption block 14 and a memory array 22 in which arbitrary data such as content data is stored. The encryption blocks 14 and 21 execute encryption processing and decryption processing on commands and data transmitted and received between the host device 2 and the memory device 3.

  FIG. 2 is a diagram illustrating a configuration of the encryption block 21 of the memory device 3. As shown in FIG. 2, the encryption block 21 includes a control circuit 31, encryption modules 32 and 33, a selector 34, and an arithmetic circuit 35. The control circuit 31 has a holding circuit 41 such as a register. The cryptographic module 32 has a session key generation circuit 42. The session key generation circuit 42 functions as a temporary data generation circuit, and generates a session key D12 as temporary data based on key information (secret key K11 or dummy key K12) as input data input from the selector 34. . The cryptographic module 33 has a stream data generation circuit 43. The stream data generation circuit 43 functions as an encryption processing circuit, and generates stream data D13 for stream encryption based on the key information (secret key K13) and the session key D12 input from the session key generation circuit 42. To do. The arithmetic circuit 35 restores the non-encrypted command S12 by calculating an exclusive OR of the encrypted command S11 received from the host device 2 and the stream data D13 input from the stream data generating circuit 43. Further, the arithmetic circuit 35 calculates the exclusive OR of the non-encrypted data S13 read from the memory array 22 and the stream data D13 input from the stream data generation circuit 43, thereby obtaining the encrypted data S14. Is generated.

  FIG. 3 is a timing chart showing the processing contents of the session key generation circuit 42 and the stream data generation circuit 43. In the command processing period (time T11 to T12), the stream data generation circuit 43 performs generation processing of the stream data D13 as a normal operation for executing encryption or decryption of the command or data, and thereby the encrypted command. The decryption of S11 is executed. In the command processing period, the session key generation circuit 42 performs a dummy operation that is not a normal operation. In the latency period (time T12 to T13), the session key generation circuit 42 performs update processing of the session key D12 as a normal operation. At the same time, the stream data generation circuit 43 performs an initialization process as a normal operation using the session key D12 before update that is currently input. In the data processing period (time T13 to T14) after the reading of data from the memory array 22 is completed, the stream data generation circuit 43 performs the generation process of the stream data D13 as a normal operation, and thereby the non-encrypted data S13. Encryption is performed. In the data processing period, the session key generation circuit 42 executes a dummy operation that is not a normal operation.

  Hereinafter, the operation of the memory device 3 will be described in detail by taking as an example a process of reading data stored in the memory array 22 from the memory device 3 to the host device 2.

  When the memory system 1 is activated, the control circuit 31 reads out DPA control information D11 (ON or OFF flag information) stored at a predetermined location in the memory array 22. The control circuit 31 executes the DPA countermeasure process described below when the DPA control information D11 is set to ON, and does not execute it when it is set to OFF. In the example of the present embodiment, it is assumed that the DPA control information D11 is set to ON. The DPA control information D11 may be stored in a part of a command issued from the host apparatus 2. In this case, the host apparatus 2 can easily switch whether or not to execute the DPA countermeasure process. It becomes possible.

  Next, the control circuit 31 reads state transition information indicating the current setting content of the session key generation circuit 42 from the cryptographic module 32 in order to execute the dummy operation of the session key generation circuit 42 as the DPA countermeasure process. Then, the read state transition information is held by the holding circuit 41. Further, the control circuit 31 causes the selector 34 to select the dummy key K12. The dummy key K12 may be a fixed value or a variable value using a random number generator. Alternatively, the dummy key K12 may be the same as the secret key K11.

  Next, the host apparatus 2 transmits the encryption command S11 to the memory device 3 by encrypting the read command issued by the CPU 11 with the encryption block 14.

  Next, in the command processing period (time T11 to T12), the session key generation circuit 42 executes a dummy operation for generating a dummy session key D12 based on the dummy key K12. The generated dummy session key D12 is not input to the stream data generation circuit 43. Further, during the command processing period, the stream data generation circuit 43 performs generation processing of the stream data D13 based on the latest session key D12 input from the session key generation circuit 42 as a normal operation, and thereby the encryption command S11 Decryption is performed.

  Next, in the latency period (time T12 to T13), the control circuit 31 writes the state transition information held by the holding circuit 41 back to the session key generation circuit 42. Thereby, the setting content of the session key generation circuit 42 is reset to the state before the dummy operation is executed. Further, the control circuit 31 causes the selector 34 to select the secret key K11. The session key generation circuit 42 generates a new session key D12 to be used next time by performing update processing of the session key D12 as a normal operation. At the same time, the stream data generation circuit 43 performs an initialization process as a normal operation using the session key D12 before update that is currently input.

  Next, in order to execute the dummy operation of the session key generation circuit 42 as the DPA countermeasure process, the control circuit 31 stores the state transition information indicating the current setting content (that is, the updated setting content) of the session key generation circuit 42. Read from the cryptographic module 32. Then, the read state transition information is held by the holding circuit 41. Further, the control circuit 31 causes the selector 34 to select the dummy key K12.

  Next, desired data S13 is read from the memory array 22 based on the non-encrypted command S12 restored by the decryption of the encrypted command S11.

  Next, in the data processing period (time T13 to T14), the session key generation circuit 42 executes a dummy operation for generating a dummy session key D12 based on the dummy key K12. The generated dummy session key D12 is not input to the stream data generation circuit 43. Further, during the data processing period, the stream data generation circuit 43 performs the generation process of the stream data D13 based on the session key D12 input from the session key generation circuit 42 as a normal operation, thereby encrypting the non-encrypted data S13. Is executed. The encrypted data S14 is transmitted from the memory device 3 to the host device 2.

  As described above, according to the memory device 3 according to the present embodiment, the control circuit 31 is configured such that the cryptographic module 33 (second cryptographic module) performs normal operation and the cryptographic module 32 (first cryptographic module) is normal. In the command processing period and the data processing period (first period) during which no operation is performed, the cryptographic module 32 is caused to perform a dummy operation. As described above, the power consumption characteristics of the cryptographic module 33 can be concealed by performing the dummy operation of the cryptographic module 32 in the first period in which only the cryptographic module 33 performs the normal operation. As a result, a countermeasure against the DPA attack can be implemented at a low cost.

  Further, the control circuit 31 normally operates both the cryptographic module 32 and the cryptographic module 33 simultaneously in the latency period (second period). In this way, by simultaneously operating both the cryptographic module 32 and the cryptographic module 33 simultaneously, it is possible to conceal the power consumption characteristics exposed when only one of them is normally operated. As a result, a countermeasure against the DPA attack can be implemented at a low cost.

  In addition, the control circuit 31 inputs the dummy key K12 (dummy input data) to the session key generation circuit 42 (temporary data generation circuit) in the first period. Thus, by inputting the dummy key K12 to the session key generation circuit 42, it is possible to cause the session key generation circuit 42 to execute a dummy operation for generating a dummy session key D12 (dummy temporary data).

  In addition, the dummy key K12 is set to a fixed value, and the attacker predicts that some key data generation processing is being executed, thereby causing the attacker to perform useless work of specifying the dummy key K12 by analysis. The effect can be expected. As a result, the private key K11 can be protected for a long time. Further, by setting the dummy key K12 to a fixed value, it becomes possible to equalize the power consumption of the session key generation circuit 42 accompanying the dummy operation.

  Further, by setting the dummy key K12 as a variation value, the power consumption of the session key generation circuit 42 varies each time the dummy key K12 varies, so that the power consumption of the entire memory device 3 can be varied. As a result, it becomes possible to make it difficult to analyze the power consumption characteristics due to the DPA attack.

  Further, when the control circuit 31 causes the cryptographic module 32 to execute a dummy operation, the control circuit 31 saves the latest state transition information of the session key generation circuit 42 to the holding circuit 41, and then performs normal operation on the session key generation circuit 42. In the case of execution, the state transition information held by the holding circuit 41 is written back to the session key generation circuit 42. Thereby, the session key generation circuit 42 can generate the session key D12 without any problem in the normal operation after the dummy operation.

  Further, by inputting the secret key K11 (key information) as input data, the session key generation circuit 42 can generate a session key D12 as temporary data.

<First Modification>
In the above-described embodiment, the example in which the DPA countermeasure is implemented in the memory device 3 has been described.

  FIG. 4 is a diagram illustrating the configuration of the encryption block 14 of the host device 2. As shown in FIG. 4, the encryption block 14 includes a control circuit 51, encryption modules 52 and 53, a selector 54, and an arithmetic circuit 55. The control circuit 51 has a holding circuit 61 such as a register. The cryptographic module 52 has a session key generation circuit 62. The session key generation circuit 62 functions as a temporary data generation circuit, and generates a session key D22 as temporary data based on key information (secret key K21 or dummy key K22) as input data input from the selector 54. . The cryptographic module 53 has a stream data generation circuit 63. The stream data generation circuit 63 functions as an encryption processing circuit, and generates stream data D23 for stream encryption based on the key information (secret key K23) and the session key D22 input from the session key generation circuit 62. To do. The arithmetic circuit 55 restores the non-encrypted data S24 by calculating an exclusive OR of the encrypted data S23 received from the memory device 3 and the stream data D23 input from the stream data generating circuit 63. Further, the arithmetic circuit 55 calculates the exclusive OR of the non-encrypted command S21 input from the main control circuit 13 and the stream data D23 input from the stream data generation circuit 63, thereby obtaining the encrypted command S22. Is generated.

  FIG. 5 is a timing chart showing the processing contents of the session key generation circuit 62 and the stream data generation circuit 63. In the command processing period (time T21 to T22), the stream data generation circuit 63 performs generation processing of the stream data D23 as a normal operation for executing encryption or decryption of the command or data, and thereby performs non-encryption. Encryption of command S21 is executed. In the command processing period, the session key generation circuit 62 performs a dummy operation that is not a normal operation. In the latency period (time T22 to T23), the session key generation circuit 62 performs update processing of the session key D22 as a normal operation. At the same time, the stream data generation circuit 63 performs initialization processing using the session key D22 before update that is currently input as a normal operation. In the data processing period (time T23 to T24), the stream data generation circuit 63 performs the generation process of the stream data D23 as a normal operation, and thereby the encrypted data S23 is decrypted. In the data processing period, the session key generation circuit 62 executes a dummy operation that is not a normal operation.

  Hereinafter, the operation of the host device 2 will be described in detail by taking as an example a process of reading data stored in the memory array 22 from the memory device 3 to the host device 2.

  When the memory system 1 is activated, the control circuit 51 reads out DPA control information D11 stored in a predetermined location of the memory array 22. The control circuit 51 executes the DPA countermeasure process described below when the DPA control information D11 is set to ON, and does not execute it when it is set to OFF. In this modification, it is assumed that the DPA control information D11 is set to ON.

  Next, the control circuit 51 reads out state transition information indicating the current setting contents of the session key generation circuit 62 from the cryptographic module 52 in order to execute the dummy operation of the session key generation circuit 62 as the DPA countermeasure process. The read state transition information is held by the holding circuit 61. In addition, the control circuit 51 causes the selector 54 to select the dummy key K22. The dummy key K22 may be a fixed value or a variable value using a random number generator. Alternatively, the dummy key K22 may be the same as the secret key K21.

  Next, the CPU 11 issues a non-encrypted read command S21. The command S21 is input to the encryption block 14 via the main control circuit 13.

  Next, in the command processing period (time T21 to T22), the session key generation circuit 62 executes a dummy operation for generating a dummy session key D22 based on the dummy key K22. The generated dummy session key D22 is not input to the stream data generation circuit 63. Further, during the command processing period, the stream data generation circuit 63 performs generation processing of the stream data D23 based on the latest session key D22 input from the session key generation circuit 62 as a normal operation, and thereby the unencrypted command S21. Encryption is performed.

  Next, in the latency period (time T22 to T23), the control circuit 51 writes the state transition information held in the holding circuit 61 back to the session key generation circuit 62. Thereby, the setting contents of the session key generation circuit 62 are reset to the state before the dummy operation is executed. Further, the control circuit 51 causes the selector 54 to select the secret key K21. The session key generation circuit 62 generates a new session key D22 to be used next time by performing update processing of the session key D22 as a normal operation. At the same time, the stream data generation circuit 63 performs initialization processing using the session key D22 before update that is currently input as a normal operation.

  Next, in order to execute the dummy operation of the session key generation circuit 62 as the DPA countermeasure process, the control circuit 51 stores state transition information indicating the current setting content (that is, the updated setting content) of the session key generation circuit 62. Read from the cryptographic module 52. The read state transition information is held by the holding circuit 61. In addition, the control circuit 51 causes the selector 54 to select the dummy key K22.

  Next, in the data processing period (time T23 to T24), the session key generation circuit 62 executes a dummy operation for generating a dummy session key D22 based on the dummy key K22. The generated dummy session key D22 is not input to the stream data generation circuit 63. Further, during the data processing period, the stream data generation circuit 63 performs the generation process of the stream data D23 based on the session key D22 input from the session key generation circuit 62 as a normal operation, and thus received from the memory device 3 Decryption of the encrypted data S23 is executed. The decrypted data S24 is input to the CPU 11 via the main control circuit 13.

  As described above, according to the host device 2 according to this modification, the control circuit 51 is configured such that the cryptographic module 53 (second cryptographic module) performs a normal operation and the cryptographic module 52 (first cryptographic module) performs a normal operation. In the command processing period and the data processing period (first period) during which no encryption is executed, the cryptographic module 52 is caused to execute a dummy operation. In this way, the power consumption characteristics of the cryptographic module 53 can be concealed by performing the dummy operation of the cryptographic module 52 in the first period in which only the cryptographic module 53 performs the normal operation. As a result, a countermeasure against the DPA attack can be implemented at a low cost.

  In addition, the control circuit 51 normally operates both the cryptographic module 52 and the cryptographic module 53 simultaneously in the latency period (second period). As described above, by simultaneously operating both the cryptographic module 52 and the cryptographic module 53 at the same time, it is possible to conceal the power consumption characteristics exposed when only one of the cryptographic module 52 and the cryptographic module 53 is normally operated. As a result, a countermeasure against the DPA attack can be implemented at a low cost.

  In addition, the control circuit 51 inputs the dummy key K22 (dummy input data) to the session key generation circuit 62 (temporary data generation circuit) in the first period. Thus, by inputting the dummy key K22 to the session key generation circuit 62, it is possible to cause the session key generation circuit 62 to execute a dummy operation for generating a dummy session key D22 (dummy temporary data).

  In addition, the dummy key K22 is set to a fixed value, and the attacker predicts that some key data generation processing is being executed, thereby causing the attacker to perform useless work of specifying the dummy key K22 by analysis. The effect can be expected. As a result, the private key K21 can be protected for a long period. Further, by setting the dummy key K22 to a fixed value, it becomes possible to equalize the power consumption of the session key generation circuit 62 accompanying the dummy operation.

  In addition, by setting the dummy key K22 as a variation value, the power consumption of the session key generation circuit 62 varies each time the dummy key K22 varies, so that the power consumption of the entire host device 2 can be varied. As a result, it becomes possible to make it difficult to analyze the power consumption characteristics due to the DPA attack.

  Further, when the control module 51 causes the cryptographic module 52 to perform a dummy operation, the control circuit 51 saves the latest state transition information of the session key generation circuit 62 to the holding circuit 61, and then performs normal operation on the session key generation circuit 62. In the case of execution, the state transition information held by the holding circuit 61 is written back to the session key generation circuit 62. Thereby, the session key generation circuit 62 can generate the session key D22 without any problem in the normal operation after the dummy operation.

  Further, by inputting the secret key K21 (key information) as input data, the session key generation circuit 62 can generate a session key D22 as temporary data.

  Note that DPA countermeasures may be implemented in both the host device 2 and the memory device 3, and in this case, the memory system 1 as a whole can increase resistance to DPA attacks.

<Second Modification>
In the above embodiment, the necessity of executing the DPA countermeasure process is determined based on the DPA control information D11. However, the DPA countermeasure process is performed on condition that there is an unauthorized access from the host device 2 to the memory device 3. May be executed.

  FIG. 6 is a diagram showing a configuration of the encryption block 21 of the memory device 3. An unauthorized access detection circuit 36 is added to the configuration shown in FIG. The unauthorized access detection circuit 36 receives the unencrypted command S12 restored by the decryption from the arithmetic circuit 35.

  The unauthorized access detection circuit 36, for example, receives an access request to a predetermined access prohibited area, an access request exceeding the data capacity of the memory array 22, an access request by an undefined command with no command ID defined, and a prescribed command sequence. When an access request or the like based on a sequence other than the above is received from the host device 2, the access is detected as an unauthorized access, and an unauthorized access detection signal D 14 is input to the control circuit 31.

  The control circuit 31 executes the DPA countermeasure process described in the above embodiment on the condition that the unauthorized access detection signal D14 is input.

  As described above, according to the memory device 3 according to the present modification, the control circuit 31 executes the DPA countermeasure process when the unauthorized access detection circuit 36 detects unauthorized access. Therefore, it is possible to ensure the availability of the memory system 1 and avoid an increase in power consumption caused by executing a dummy operation when no unauthorized access is detected.

DESCRIPTION OF SYMBOLS 1 Memory system 2 Host apparatus 3 Memory apparatus 14,21 Encryption block 31,51 Control circuit 32,33,52,53 Encryption module 36 Unauthorized access detection circuit 41,61 Holding circuit 42,62 Session key generation circuit 43,63 Stream data Generator circuit

Claims (12)

A memory device connected to a host device,
A first cryptographic module and a second cryptographic module that perform normal operations to encrypt and decrypt data transmitted and received between the host device and the memory device;
A control circuit for controlling operations of the first cryptographic module and the second cryptographic module;
With
The control circuit causes the first cryptographic module to perform a dummy operation in a first period in which the second cryptographic module performs a normal operation and the first cryptographic module does not perform a normal operation ;
The first cryptographic module has a temporary data generation circuit that generates temporary data based on input data;
The second cryptographic module has a cryptographic processing circuit that performs cryptographic processing based on the temporary data generated by the temporary data generating circuit,
The control circuit inputs dummy input data to the temporary data generation circuit in the first period,
The control circuit includes:
A holding circuit for holding state transition information of the temporary data generation circuit;
When causing the first cryptographic module to perform a dummy operation, the latest state transition information is saved in the holding circuit,
Next, when causing the temporary data generation circuit to perform a normal operation, the memory device writes the state transition information held in the holding circuit back to the temporary data generation circuit .   The memory device according to claim 1, wherein the control circuit normally operates both the first cryptographic module and the second cryptographic module simultaneously in a second period different from the first period.   The memory device according to claim 1, wherein the dummy input data is a fixed value.   The memory device according to claim 1, wherein the dummy input data is a variable value.   The memory device according to claim 1, wherein the input data is key information.   An unauthorized access detection circuit for detecting unauthorized access from the host device;
  6. The control circuit according to claim 1, wherein when the unauthorized access detection circuit detects unauthorized access, the control circuit causes the second cryptographic module to execute a dummy operation in a first period. 7. Memory device.   A host device to which a memory device is connected,
  A first cryptographic module and a second cryptographic module that perform normal operations to encrypt and decrypt data transmitted and received between the host device and the memory device;
  A control circuit for controlling operations of the first cryptographic module and the second cryptographic module;
With
  The control circuit causes the first cryptographic module to perform a dummy operation in a first period in which the second cryptographic module performs a normal operation and the first cryptographic module does not perform a normal operation;
  The first cryptographic module has a temporary data generation circuit that generates temporary data based on input data;
  The second cryptographic module has a cryptographic processing circuit that performs cryptographic processing based on the temporary data generated by the temporary data generating circuit,
  The control circuit inputs dummy input data to the temporary data generation circuit in the first period,
  The control circuit includes:
  A holding circuit for holding state transition information of the temporary data generation circuit;
  When causing the first cryptographic module to perform a dummy operation, the latest state transition information is saved in the holding circuit,
  Next, when causing the temporary data generation circuit to perform a normal operation, the host device writes back the state transition information held by the holding circuit to the temporary data generation circuit.   The host device according to claim 7, wherein the control circuit normally operates both the first cryptographic module and the second cryptographic module simultaneously in a second period different from the first period.   The host device according to claim 7 or 8, wherein the dummy input data is a fixed value.   The host device according to claim 7 or 8, wherein the dummy input data is a variable value.   The host device according to claim 7, wherein the input data is key information.   A memory device according to any one of claims 1 to 6;
  A host device according to any one of claims 7 to 11,
A memory system.

Images