JP7307400B2 - Electronic information storage medium, counter update method and counter update program - Google Patents

Description

The present invention relates to the technical field of electronic information storage media such as IC chips with nonvolatile memory.

2. Description of the Related Art Conventionally, an IC chip having a non-volatile memory sometimes counts up a counter stored in the non-volatile memory along with the execution of cryptographic processing or the like.

Due to its structure, the nonvolatile memory has an upper limit of several tens of thousands to several hundreds of thousands of times of rewriting, and data cannot be recorded normally in a storage element that has been rewritten beyond the upper limit. In order to make it less susceptible to the upper limit, wear leveling processing is generally performed on non-volatile memory. Even so, if data that is frequently rewritten, such as a counter, is stored in a specific storage element, there is a risk that the rewrite upper limit will be reached soon.

Patent Literature 1 discloses an IC chip that stores a counter in a nonvolatile memory and that can reduce the influence on the rewriting durability of the nonvolatile memory.

JP 2016-153945 A

Although the technique described in Patent Document 1 can also reduce the impact on the rewrite durability of the nonvolatile memory, the present invention adopts a new technique for reducing the number of rewrites of the nonvolatile memory that stores the counter. It is an object of the present invention to provide an electronic information storage medium or the like that can extend the life of a nonvolatile memory.

In order to solve the above problems, the invention according to claim 1 is an electronic information storage medium comprising a volatile memory that stores a first counter and a nonvolatile memory that stores a second counter, wherein is executed, the value of the first counter is changed to the second a second addition means for executing a second addition process of adding a second predetermined value, which is two times or more the first predetermined value, to the second counter when the counter value is larger than the value of the counter; The second predetermined value is a value obtained by multiplying the first predetermined value by an integer, and the second adding means, when the value of the first counter is equal to the value of the second counter, adds the It is characterized by executing a second addition process .

The invention according to claim 2 is the electronic information storage medium according to claim 1, wherein when the power supply to the volatile memory is interrupted and the power supply is restarted, the first counter stores the It is characterized by further comprising writing means for writing the value of the second counter.

The invention according to claim 3 is the electronic information storage medium according to claim 1 or 2 , wherein the first predetermined value is "1".

According to a fourth aspect of the present invention, there is provided an electronic information storage medium comprising a volatile memory that stores a first counter and a nonvolatile memory that stores a second counter. a first addition means for executing a first addition process for adding a first predetermined value to a counter; and second addition means for executing a second addition process of adding a second predetermined value that is two times or more of the first predetermined value to the second counter, wherein the predetermined process is encrypted. The cryptographic process uses a key, and further comprises updating means for updating the cryptographic key when the value of the first counter becomes equal to or greater than a predetermined upper limit value.

According to a fifth aspect of the present invention, there is provided a counter update method using an electronic information storage medium having a volatile memory that stores a first counter and a nonvolatile memory that stores a second counter. , the first adding step of adding a first predetermined value to the first counter, and the subsequent first adding step, when the value of the first counter becomes larger than the value of the second counter, the and a second addition step of adding a second predetermined value that is two times or more the first predetermined value to the 2 counter , wherein the second predetermined value is an integer equal to the first predetermined value. and the second adding step is performed when the value of the first counter is equal to the value of the second counter.
According to a sixth aspect of the present invention, there is provided a counter update method using an electronic information storage medium having a volatile memory that stores a first counter and a nonvolatile memory that stores a second counter, wherein , the first adding step of adding a first predetermined value to the first counter, and the subsequent first adding step, when the value of the first counter becomes larger than the value of the second counter, the a second adding step of adding a second predetermined value that is two times or more the first predetermined value to the 2 counter, wherein the predetermined processing is cryptographic processing using a cryptographic key; The method further includes an updating step of updating the encryption key when the value of the first counter reaches or exceeds a predetermined upper limit.

According to a seventh aspect of the present invention, a computer included in an electronic information storage medium having a volatile memory that stores a first counter and a non-volatile memory that stores a second counter is operated by executing a predetermined process. first addition means for executing a first addition process for adding a first predetermined value to a first counter, when the value of the first counter becomes larger than the value of the second counter by the next first addition process; second addition means for executing a second addition process of adding a second predetermined value that is two times or more the first predetermined value to the second counter; The value is a value obtained by multiplying the first predetermined value by an integer, and the second addition means executes the second addition process when the value of the first counter is equal to the value of the second counter. It is characterized by
According to an eighth aspect of the present invention, a computer included in an electronic information storage medium having a volatile memory that stores a first counter and a nonvolatile memory that stores a second counter is operated by executing a predetermined process. first addition means for executing a first addition process for adding a first predetermined value to a first counter, when the value of the first counter becomes larger than the value of the second counter by the next first addition process; and second addition means for executing a second addition process of adding a second predetermined value that is two times or more the first predetermined value to the second counter, wherein the predetermined process is The cryptographic processing uses a cryptographic key, and further functions as update means for updating the cryptographic key when the value of the first counter becomes equal to or greater than a predetermined upper limit value.

According to the present invention, the first counter is stored in the volatile memory, and the second counter is stored in the nonvolatile memory. does not exceed the value of the second counter, the second counter is not rewritten. 2, a second predetermined value that is more than twice the first predetermined value is added. As a result, only the first counter is rewritten while the value of the first counter does not exceed the value of the second counter, and the second counter is rewritten only when the value of the first counter exceeds the value of the second counter. 2 counter can be rewritten, and the life of the nonvolatile memory can be lengthened.

1 is a block diagram showing a schematic configuration example of a communication device 1 and a secure element (SE) 2 that constitute a cryptographic system S according to this embodiment; FIG. It is a sequence diagram showing an example of cryptographic processing by the cryptographic system S according to the present embodiment. 9 is a flowchart showing an example of count-up processing by SE2 according to the present embodiment; 7 is a flow chart showing an example of power-off recovery processing by SE2 according to the present embodiment.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The embodiments described below are embodiments in which the present invention is applied to a cryptographic system S. FIG.

First, with reference to FIG. 1 and the like, the configuration and functional overview of the encryption system S according to the present embodiment will be described.

[1. Configuration of cryptographic system S]
FIG. 1 is a block diagram showing a schematic configuration example of a cryptographic system S according to this embodiment. As shown in FIG. 1, the cryptographic system S includes communication equipment 1 and SE2. The communication device 1 is connected to a server device (not shown) via a communication network, and communicates with the server device by having the SE 2 perform encryption/decryption processing on the communication data.

[2. Configuration of communication device 1]
As shown in FIG. 1, the configuration of a communication device 1 and an SE 2 capable of communicating with the communication device 1 will be described. The SE 2 operates by receiving power supply from the communication device 1 .

The communication device 1 has a control section 11 , a communication section 12 , an input section 13 and an output section 14 .

The control unit 11 includes a CPU (Central Processing Unit) 111, a RAM (Random Access Memory) 112, a ROM (Read Only Memory) 113, an I/O circuit 114 and a non-volatile memory 115, and controls the communication device 1 as a whole. Control. For example, the control unit 11 performs processing based on input data and input information input to the input unit 13 and outputs output data and output information to the output unit 14 . The communication unit 12 performs processing for communicating with an external device such as a server (not shown). The input unit 13 inputs input data and input information to the control unit 11 . The output unit 14 performs output based on output data and output information output from the control unit 11 .

The RAM 112 stores, for example, data temporarily required for the OS (Operating System) and various applications to function. The ROM 113 stores an OS, various applications, and the like. I/O circuit 114 serves as a communication interface with SE2. A flash memory or an "electrically erasable programmable read-only memory" can be applied to the nonvolatile memory 115, for example. The nonvolatile memory 115 stores programs and the like for executing cryptographic processing by the cryptographic system S, which will be described later.

The SE 2 comprises a CPU 21 , RAM 22 , nonvolatile memory 23 and I/O circuit 24 . SE2 has high tamper resistance. High tamper resistance means that confidential information such as keys for encryption, decryption, and signature verification, as well as the mechanism for processing confidential information, can be illegally observed or altered from the outside. It means that it is extremely difficult to modify to

The RAM 22 is a volatile memory, and can store information when power is supplied to the SE 2, and when the power supply from the communication device 1 is cut off (cutting off the power supply is called "power cut off"). ”), the information cannot be stored, and the data stored up to that point is lost. The RAM 22 stores, for example, data temporarily required for the OS and various applications to function. Specifically, it stores an encryption counter that counts the number of times of encryption processing using an encryption key, which will be described later.

Flash memory or "Electrically Erasable Programmable Read-Only Memory" can be applied to the nonvolatile memory 23, for example. The nonvolatile memory 23 stores an OS, various applications, programs for executing encryption processing, count-up processing, power-off recovery processing, and the like by the encryption system S described later, encryption keys, and the like. The nonvolatile memory 23 stores an encryption application, and the encryption application holds an encryption key for encrypting/decrypting communication between the communication device 1 and a server (not shown). Encryption keys are managed in key storage in a secure storage area in non-volatile memory 23 .

Here, the encryption counter will be explained. The cryptographic counter plays a role in managing the lifetime of the cryptographic key used in cryptographic processing (the number of times the cryptographic key is used is set to an upper limit, and the cryptographic key is updated when the value of the cryptographic counter reaches the upper limit). bear. The cipher counter also serves as information for not generating the same ciphertext when the same plaintext is cipher-processed using the same encryption key. Specifically, by cryptographically processing the plaintext to be encrypted and the value of the encryption counter together, even if the same plaintext is encrypted multiple times using the same encryption key, the Output a different ciphertext. This is because it is not desirable from a security point of view to generate the same ciphertext when the same encryption key is used for the same plaintext (same encryption key for the same plaintext (There is a risk that the fact that the cryptographic processing was performed using

In order to play this role, the cryptographic counter has the following characteristics: (1) The counter value does not have to match the number of times cryptographic processing has been performed, but it must not be less than the number of times cryptographic processing has been performed (the counter value is (2) it does not have to be exactly the same as the number of cryptographic processing executions. Due to the characteristic of (1), the value of the encryption counter differs each time encryption processing is performed, so even if the same plaintext is encrypted multiple times using the same encryption key, a different ciphertext can be output each time. . For example, if the plaintext "XXXXXX" is to be encrypted three times in a row, the objects to be encrypted are "XXXXXX1", "XXXXXX2", and "XXXXXX3" (the last character is the value of the encryption counter). The same ciphertext is not output because it changes every time. Note that the position where the value of the encryption counter is included may be a predetermined position other than the last position of the plaintext.

Since the cryptographic counter is stored in the RAM 22 which is a volatile memory, the counter value disappears when the power supply from the communication device 1 is cut off. Therefore, in the SE2 of the present embodiment, the non-volatile memory 23, which does not lose information due to interruption of the power supply, stores an auxiliary counter in addition to the cryptographic counter stored in the RAM 22. FIG. When the power supply from the communication device 1 is interrupted and then restarted, the encryption counter is restored by copying the value of the auxiliary counter to the value of the encryption counter (referred to as "power-off restoration processing"). sometimes).

The cryptographic counter is counted up by "1" as the cryptographic processing is executed (using the cryptographic key) (a predetermined value added to the cryptographic counter ("1" in this embodiment) is referred to as a "count-up value"). there is). On the other hand, the auxiliary counter is not counted up each time cryptographic processing is executed, but when the value of the cryptographic counter exceeds the value of the auxiliary counter at the next count up, the margin value (in this embodiment, "200", but any integer of "2" or more is acceptable) is added. This allows the auxiliary counter to always hold a value greater than the value of the cryptographic counter. Also, even if the value of the encryption counter is lost due to power failure, the value of the encryption counter is recovered by the power failure restoration process to a value larger than the value of the encryption counter at the time of power failure. By operating the cryptographic counter and the auxiliary counter in this way, the characteristic (1) of the cryptographic counter can be maintained.

In addition, while the encryption counter is incremented each time encryption processing is performed, writing to the RAM 22 occurs. Occurs each time cryptographic processing for the margin value is performed (except when there is power-off recovery processing). That is, by storing in the RAM 22 a counter (encryption counter) that counts up each time encryption processing is performed, writing to the nonvolatile memory 23 can be suppressed and the life of the nonvolatile memory 23 can be lengthened. If the margin value is "200" as in the present embodiment, writing to the non-volatile memory (auxiliary counter) occurs once every 200 times of cryptographic processing. That is, the number of writes to the nonvolatile memory 23 (auxiliary counter) is 1/200 of the number of writes to the RAM 22 (cipher counter). If the endurance upper limit of the number of write operations of the nonvolatile memory 23 is 100,000 times, and the number of cryptographic processing operations per day is 5,000 times, the life of the nonvolatile memory 23 is determined by adopting the method of the present embodiment (nonvolatile If the encryption counter is stored in the memory 23), "100,000 (times)/5,000 (times/day) = 20 (days)", but according to the method of the present embodiment, " 20 (days) x 200 = 4000 (days).

The I/O circuit 24 serves as a communication interface with the control section 11 .

[3. Cryptographic processing by cryptographic system S]
Next, an example of cryptographic processing by the cryptographic system S will be described with reference to FIG.

First, the control unit 11 of the communication device 1 and the CPU 21 of the SE2 establish a secure channel between the communication device 1 and the SE2 (encryption application) (step S1). Specifically, the communication device 1 transmits an INITIALIZE UPDATE command or an EXTERNAL AUTHENTICATE command to the SE2, the SE2 performs processing for each command, and returns a response including the processing result to the communication device 1. done. Communication between the communication device 1 and SE2 (encryption application) is performed by APDU (Application Protocol Data Unit).

When the secure channel is opened, the control unit 11 of the communication device 1 transmits a C-APDU (command APDU) including plaintext to the SE2 via the secure channel (step S2).

When the plaintext is received, the CPU 21 of SE2 executes count-up processing (processing related to the encryption counter and the auxiliary counter), which will be described later with reference to FIG. 3 (step S3).

Next, the CPU 21 of the SE2 uses the value of the encryption counter as a parameter and uses the encryption key to perform encryption processing on the plaintext (step S4).

Next, the CPU 21 of the SE2 transmits an R-APDU (response APDU) including the ciphertext generated by the encryption processing in step S4 and SW (Status Word) "9000h" (indicating normal termination) to the communication device 1 ( step S5). Although not shown, if there is a plaintext to be encrypted after that, the processing of steps S2 to S5 is repeated.

[5. Count-up processing by SE2]
Next, an example of count-up processing by SE2 will be described with reference to FIG.

First, the CPU 21 of the SE2 determines whether or not the value of the auxiliary counter stored in the nonvolatile memory 23 is equal to the value of the encryption counter stored in the RAM 22 (step S101).

When the CPU 21 determines that the value of the auxiliary counter and the value of the encryption counter are not equal (step S101: NO), the CPU 21 adds the count-up value "1" to the encryption counter (step S103), and ends the count-up process. do.

On the other hand, when the CPU 21 determines that the value of the auxiliary counter and the value of the encryption counter are equal (step S101: YES), the CPU 21 adds the margin value "200" to the auxiliary counter (step S102). The count-up value "1" is added (step S103), and the count-up process ends.

In the count-up process, after performing the process of step S103, the process of step S101 and the process of step S102 (only when the determination result of step S101 is "YES") may be performed. In this case, since the value of the encryption counter is incremented by the processing in step S103, the margin value is immediately added to the value of the auxiliary counter when the value of the auxiliary counter and the value of the encryption counter become equal. The value of the auxiliary counter can remain greater than the value of the crypto counter.

[4. Power-off recovery process by SE2]
Next, an example of power-off restoration processing by SE2 will be described using FIG. When the communication device 1 cuts off the power supply to the SE2, for example, when the communication device 1 and the SE2 are restarted periodically, when an error occurs in the SE2, or when the setting is changed, the communication device 1 may reset (restart) the reset signal sending SE2.

The CPU 21 of the SE2 copies the value of the auxiliary counter stored in the nonvolatile memory 23 to the value of the encryption counter stored in the RAM 22 (step S111), and ends the power-off recovery process.

As described above, in the SE 2 (an example of an "electronic information storage medium") according to the present embodiment, the RAM 22 (an example of a "volatile memory") stores an encryption counter (an example of a "first counter"), A nonvolatile memory 23 (an example of a "nonvolatile memory") stores an auxiliary counter (an example of a "second counter"), and a CPU 21 (an example of a "first adding means" and a "second adding means") stores a cryptographic Along with the execution of the process (an example of the "predetermined process"), the process of step S103 for adding the count-up value "1" (an example of the "first predetermined value") to the encryption counter (an example of the "first addition process"). example) is executed, and when the value of the cryptographic counter becomes larger than the value of the auxiliary counter by the processing of the next step S103, the margin value "200" ("2nd An example of a "predetermined value") is added (an example of a "second addition process") in step S102.

Therefore, according to the cryptographic system S of the present embodiment, the cryptographic counter is stored in the RAM 22 and the auxiliary counter is stored in the nonvolatile memory 23, and the count-up value "1" is added to the cryptographic counter as the cryptographic processing is executed. During the period when the counter value does not exceed the auxiliary counter value, the auxiliary counter is not rewritten. Add As a result, only the encryption counter is rewritten while the encryption counter value does not exceed the auxiliary counter value, and the auxiliary counter is rewritten only when the encryption counter value exceeds the auxiliary counter value, thereby suppressing the number of times the auxiliary counter is rewritten. and the life of the nonvolatile memory 23 can be lengthened.

Further, the CPU 21 (an example of a "writing means") of the SE 2 (an example of an "electronic information storage medium") according to the present embodiment, when the power supply to the RAM 22 is cut off and restarted, the encryption counter Execute power failure recovery processing to write the value of the auxiliary counter to the value of As a result, even if the value of the encryption counter is lost due to a power failure, the value of the encryption counter at the time of power failure can be recovered by the power failure recovery processing, and the value of the encryption counter above (1 ) can be maintained.

In the present embodiment, the margin value is set to "200" and the count-up value is set to "1" for determining whether or not the value of the encryption counter exceeds the value of the auxiliary counter in the processing of the next step S103. Then, the CPU 21 determines whether or not the value of the encryption counter is equal to the value of the auxiliary counter (step S101). Here, a modified example of the margin value and the count-up value will be described. The margin value may be a value obtained by multiplying the count-up value by an integer (however, "2" or more). For example, if the count-up value is set to "2" (the step-up value can be other than "1") (in this case, the number of times the encryption key is used is 1/2 of the encryption counter (however, the power supply If the disconnection recovery process is not executed)), the margin value can be an integer multiple of "2" equal to or greater than "4". As a result, the CPU 21 determines whether or not the value of the encryption counter is equal to the value of the auxiliary counter (step S101), thereby determining whether or not the value of the encryption counter exceeds the value of the auxiliary counter in the next step S103. It is possible to determine whether

Further, as a modification of the present embodiment, in the process of step S101, it may be determined whether or not the value of the auxiliary counter becomes larger than the value of the encryption counter by the process of the next step S103. The margin value in this case does not have to be an integer multiple of the step-up value as long as it is at least twice the step-up value.

Furthermore, although not shown, the CPU 21 (an example of "update means") of SE2 updates the encryption key when the value of the encryption counter reaches or exceeds a predetermined upper limit. This can prevent continued use of the same encryption key. Note that when the count-up value is set to a number (n) other than "1", the number of times of encryption processing (the number of times the encryption key is used) is approximately the number of times obtained by dividing the value of the encryption counter by n. We will consider it.

By the way, the larger the margin value, the less the number of times the margin value is added to the auxiliary counter, and the more times the data is written to the nonvolatile memory 23 . However, if the value is too large, a large value will be copied to the encryption counter when the power is restored, and the maximum number of times the encryption key will be used will be reached soon, and the encryption key will need to be updated frequently. become necessary. Therefore, it is preferable to set the margin value in consideration of the frequency with which the power failure recovery process is executed and the upper limit of the number of times the encryption key is used.

In addition, in the present embodiment, a cryptographic counter that counts cryptographic processing has been described. (the counter value must not be the same value twice); can be done.

S encryption system 11 control unit 111 CPU
112 RAMs
113 ROMs
114 I/O circuit 115 nonvolatile memory 12 communication unit 13 input unit 14 output unit 2 SE
21 CPUs
22 RAMs
23 non-volatile memory 24 I/O circuit

Claims (8)

An electronic information storage medium comprising a volatile memory that stores a first counter and a non-volatile memory that stores a second counter,
a first addition means for executing a first addition process of adding a first predetermined value to the first counter along with execution of a predetermined process;
When the value of the first counter becomes larger than the value of the second counter by the following first addition processing, a second value equal to or more than twice the first predetermined value is stored in the second counter. a second addition means for executing a second addition process for adding a predetermined value;
with
The second predetermined value is a value obtained by multiplying the first predetermined value by an integer,
The electronic information storage medium, wherein the second addition means executes the second addition process when the value of the first counter is equal to the value of the second counter. The electronic information storage medium according to claim 1,
The electronic information storage medium further comprising writing means for writing the value of the second counter to the first counter when power supply to the volatile memory is interrupted and resumed. 3. The electronic information storage medium according to claim 1 or 2 ,
The electronic information storage medium, wherein the first predetermined value is "1". An electronic information storage medium comprising a volatile memory that stores a first counter and a non-volatile memory that stores a second counter,
a first addition means for executing a first addition process of adding a first predetermined value to the first counter along with execution of a predetermined process;
When the value of the first counter becomes larger than the value of the second counter by the following first addition processing, a second value equal to or more than twice the first predetermined value is stored in the second counter. a second addition means for executing a second addition process for adding a predetermined value;
with
the predetermined processing is cryptographic processing using an encryption key;
updating means for updating the encryption key when the value of the first counter reaches or exceeds a predetermined upper limit;
An electronic information storage medium, further comprising: A counter updating method by an electronic information storage medium comprising a volatile memory storing a first counter and a non-volatile memory storing a second counter,
a first addition step of adding a first predetermined value to the first counter as predetermined processing is executed;
When the value of the first counter becomes larger than the value of the second counter by the following first adding step, the second counter is set to a value equal to or more than two times the first predetermined value. a second addition step of adding a predetermined value;
including
The second predetermined value is a value obtained by multiplying the first predetermined value by an integer,
The counter updating method, wherein the second adding step is executed when the value of the first counter is equal to the value of the second counter . A counter updating method by an electronic information storage medium comprising a volatile memory storing a first counter and a non-volatile memory storing a second counter,
a first addition step of adding a first predetermined value to the first counter as predetermined processing is executed;
When the value of the first counter becomes larger than the value of the second counter by the following first adding step, the second counter is set to a value equal to or more than two times the first predetermined value. a second addition step of adding a predetermined value;
including
the predetermined processing is cryptographic processing using an encryption key;
an updating step of updating the encryption key when the value of the first counter reaches or exceeds a predetermined upper limit;
A counter update method , further comprising : a computer contained in an electronic information storage medium comprising a volatile memory storing a first counter and a non-volatile memory storing a second counter;
a first addition means for executing a first addition process for adding a first predetermined value to the first counter along with execution of a predetermined process;
When the value of the first counter becomes larger than the value of the second counter by the following first addition processing, a second value equal to or more than twice the first predetermined value is stored in the second counter. second addition means for executing a second addition process for adding a predetermined value;
function as
The second predetermined value is a value obtained by multiplying the first predetermined value by an integer,
The counter update program, wherein the second addition means executes the second addition process when the value of the first counter is equal to the value of the second counter. a computer contained in an electronic information storage medium comprising a volatile memory storing a first counter and a non-volatile memory storing a second counter;
a first addition means for executing a first addition process for adding a first predetermined value to the first counter along with execution of a predetermined process;
When the value of the first counter becomes larger than the value of the second counter by the following first addition processing, a second value equal to or more than twice the first predetermined value is stored in the second counter. second addition means for executing a second addition process for adding a predetermined value;
function as
the predetermined processing is cryptographic processing using an encryption key;
A counter updating program further functioning as updating means for updating the encryption key when the value of the first counter reaches or exceeds a predetermined upper limit.

Images