JPH05282472A - Microcomputer and card incorporating the same - Google Patents

Abstract

PURPOSE:To provide the one-chip microcomputer which displays a secure security function by the addition of a slight circuit. CONSTITUTION:Various instruction codes including a loss command code for losing the contents of an instruction decoder 11 are stored in a ROM 2 and when specific security execution conditions are satisfied, the loss command code is read out of the ROM 2 and decode; and then the security of internal data is improved by generating a loss control signal and writing a specific value of the PROM of the instruction decoder or erasing its contents and physically disabling the instruction decoder 11 to operate.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a microcomputer and a card containing the same, and more particularly, to a one-chip microcomputer having a confidentiality keeping function for the data contained therein, which improves the security of the data. It relates to such a microcomputer.

[0002]

2. Description of the Related Art An individual authentication card typified by an IC card is usually equipped with a one-chip microcomputer and has the advantage of being multifunctional and highly functional. In particular, I
Recently, the C card is being put to practical use for applications such as employee ID cards. In this case, since it is used within a relatively limited range, such as time card replacement or fee settlement in the employee cafeteria, security and the like can be easily managed, and the above-mentioned advantages are effectively used.

FIG. 2 shows the basic configuration of a conventional one-chip microcomputer used in such an IC card and other various control devices. In Figure 2, 1 is RO
Instruction decoder (ID-ROM) made by M,
2 is a ROM (PR that stores instruction codes
OG-ROM), 3 is a program counter (PC), 4
Is an arithmetic circuit (ALU). In addition, PROG-ROM
2 is an application program (application) 2a expressed as a series of instruction codes.
Is remembered. In addition, usually other registers and RAM
Etc. are included, but the explanation is omitted for the sake of clarity.

Under such a configuration, the application program 2a is mainly executed by the following procedure.
First, the instruction code B in the PROG-ROM 2 at the address A indicated by the program counter 3 is read. Next, this instruction code B
In response to this, the instruction decoder 1 decodes it according to the stored contents, and the program counter 3
And a control signal D for the arithmetic circuit 4 are generated. Upon receiving the control signal D, the arithmetic circuit 4 performs arithmetic operations such as addition and shift, and the arithmetic result is held in a register (not shown) or the like. In response to the control signal C, the program counter 3 increments the value of the address A or changes it to the jump destination address.

In this way, the application program 2a is executed by successively processing a series of instruction codes of the application program 2a via the instruction decoder 1.
Thereby, for example, various functions as an IC card are fulfilled. As described above, the IC card is equipped with the one-chip microcomputer and realizes various functions according to the application program.

However, up to the present, due to problems such as cost and security, it has not been sufficiently spread as expected. As with other ICs, the cost of these problems is likely to decline rapidly due to mass production effects once they start to spread, and there is a solution based on economic principles in which demand and supply are related to price. Be expected.

[0007]

However, with respect to security, such a thing cannot be expected, and it is unavoidable to solve it purely technically. In particular, in the case of an IC card which is expected to become a breakthrough in the spread of IC cards as a passbook for banks, there are more severe requirements for security. For example, is the security of the means for a conventional employee card, in the security measures of the extent to check the encryption and ID of the communication data by software is inadequate. This is because there is a possibility that a group of instructions possessed by the microcomputer, that is, an instruction set, is understood according to the architecture and the stored contents of the instruction decoder, the code of the application program 2a is read, and the contents of the program are decoded. Because.

Therefore, there is a demand for realizing a reliable security means by means of hardware in order to popularize the IC card, further reduce the cost of the one-chip microcomputer, and further popularize it.

An object of the present invention is to solve the above problems of the prior art, and to provide a one-chip microcomputer capable of exerting a reliable security function by adding a few circuits. .. Another object of the present invention is to provide a personal authentication card or the like which incorporates a microcomputer requiring a confidentiality protection function and whose security can be improved.

[0010]

The structure of the microcomputer of the present invention which achieves such an object has a loss instruction code for losing or invalidating the contents of an instruction decoder (hereinafter referred to as loss in this specification and claims). Which stores various instruction codes, and a PROM which decodes the instruction code read from the ROM and generates a plurality of control signals including a loss control signal generated according to the loss instruction code. A built-in instruction decoder and a write control circuit for writing (or erasing) a predetermined value in the instruction decoder in response to the loss control signal are built in one chip, whichever is used during or during operation as a microcomputer. Crab prescribed security execution condition By accessing the loss command code of the ROM when satisfied is intended to be sent to the instruction decoder.

[0011]

In the microcomputer of the present invention having such a configuration, when the security execution condition is satisfied when a control which is not normal in terms of software or hardware is received, a loss control signal, for example, A loss start signal may be generated. For example, the microcomputer executes an instruction to generate a loss start signal when the microcomputer detects an error in the personal identification number a plurality of times or an abnormality is detected by checking means such as a test program. Then, the loss start signal is generated from the instruction decoder, and in response to this, the write control circuit writes predetermined information to the instruction decoder or erases its contents.

Here, writing from the writing control circuit,
The instruction decoder to be erased is PRO
Since it has been converted to M, the content can be lost by overwriting the instruction decoder or erasing the stored content.

If the memory contents of the instruction decoder are lost in this way, the instruction set (microcomputer architecture in a narrow sense) cannot be understood, so that even if the code of the application program is read, the content and meaning of the application program will be read. , It is impossible to decipher the structure and function. Moreover, since the instruction decoder is a PROM, writing to it can be performed after the completion of the IC, so that even an IC maker cannot decode it.

Therefore, by using the one-chip microcomputer having this structure, reliable security can be realized by hardware means. Regarding the circuit scale, the ROM storing the application program occupies a considerable area of the chip area in order to realize various functions. On the other hand, the instruction decoder only needs to decode a portion of several bits, excluding the address portion and the like, from the instruction code, so that the ratio of the occupied area in the chip is small. Therefore, the instruction decoder is ROM
Even if the area of that portion is increased by replacing the PROM with the PROM, the influence of the increase of the entire chip can be suppressed to a slight one.

Further, although the write control circuit has a function of losing the contents of the instruction decoder, this write control circuit also has an original write control circuit for the instruction decoder which is provided for writing data after completion of the IC. It can be used in common, and if a flash memory or the like is used as the PROM, a simple erase circuit is sufficient. Therefore, the increase in the circuit scale as a whole is slight, and not so much as to sacrifice other functions.

[0016]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment will be described with reference to the block diagram of FIG. Here, 2 is a ROM (PROG-ROM) for storing instruction codes, 3 is a program counter (PC), and 4 is an arithmetic circuit (ALU). Further, 11 is an instruction decoder (ID
-PROM), 12 is a flip-flop, 13 is a write control circuit, 14 is an increment circuit (incrementer), and 15 is an address counter.

The PROG-ROM 2 is EEPRO.
It is composed of M or EPROM, and stores an application program (application) 2a expressed as a series of instruction codes and a check program (test) 10 for detecting an abnormal state. Normally, other elements such as registers, RAMs, bus lines, interfaces, etc. are also included, but they are not directly related to the description of the present invention, so the description thereof will be omitted for the sake of clarity.

Most of the check program 10 is a conventional check program or the like for checking by comparing the ID number and the secret registration number (including the scrambled collation). As a result, abnormality detection is performed by software. If there is no abnormality as a result, the application program 2a is executed, and if an abnormality is detected, an instruction for generating a loss start signal is executed. Also, when an abnormal signal is applied to the hardware via the external terminal of the IC,
Since there is a possibility that the program, the circuit configuration, etc. are being deciphered, this is detected by, for example, an abnormality detection circuit using a voltage detection circuit or the like, and an instruction for similarly generating a loss start signal is executed. That is,
The check program 10 is a specific example of a determination program that determines whether or not the security execution condition is satisfied. It should be noted that the execution of this instruction may be performed after counting the number of times of abnormality detection a plurality of times.

From the above, the check program 10 basically has only to be additionally modified to execute a specific instruction with respect to the conventional program, and thus affects the size of the PROG-ROM 2. Almost never. The write control circuit 13 has a register inside and has a write control signal E from the outside.
In response to this, the bus 1 from the external terminal of this IC
Write address data and write data are set in the internal register via 6. These data are
The signals F1 and F2 are sent from the write control circuit 13 to the address counter 15 and the instruction decoder 11, respectively. As a result, the address counter 15 generates the address G, and the stored content corresponding to the instruction set is written at the address of the PROM of the instruction decoder 11 indicated by the address G. Further, when the write control circuit 13 receives the Q output from the flip-flop 12, the write control circuit 13 controls the incrementer 14 so that each address of the instruction decoder 11 receives either one of “1” and “0” data. Are sequentially written while updating the address counter 15.
The flip-flop 12 is set by the loss start signal from the instruction decoder 11. Further, the write control circuit 13 may be provided with a booster circuit for writing data in the EEPROM.

As a result, the memory contents of the instruction decoder can be written after the completion of the IC, so that everything is RO
Unlike the case of M, even the IC maker who manufactured this IC must decode the contents of the application program 2a etc. if there is no correspondence table between the instruction set and the contents of the ID-ROM when the program was developed. Is impossible.

Under such a configuration, the application program 2a and the check program 10 are executed in the steady state in the following procedure. First, a certain address A is set in the program counter 3, and the PROG-ROM 2 at the address A pointed to by the program counter 3 is set.
The instruction code B therein is read out.

Next, upon receiving this instruction code B, the instruction decoder 11 decodes it according to the stored contents, and generates, for example, a control signal C to the program counter 3 and a control signal D to the arithmetic circuit 4. .. Upon receiving the control signal D, the arithmetic circuit 4 performs arithmetic operations such as addition and shift, and the arithmetic result is held in a register (not shown) or the like. In response to the control signal C, the program counter 3 increments the value of the address A or changes it to the jump destination address.

In this way, a series of instruction codes of the application program 2a and the check program 10 are successively output to the instruction decoder 1.
Processed through 1. Then, the application program 2a and the check program 10 are executed as a series of the processing, and various functions such as an IC card or a controller are performed. When the check program 10 becomes a condition for executing the application program, the check program 10 is executed prior to it as described above.

The above is the operation in the normal state. On the other hand, when the check program 10 detects any abnormality and occurs three times, for example, the check program 10 generates the instruction code H for generating the loss start signal. To do. The count of abnormality detection is performed by a soft counter provided in a memory (not shown). The instruction code H is decoded by the instruction decoder 11 as one of the instruction codes B. Then, as a result of decoding this, the loss start signal I is generated.

The occurrence event of the loss start signal I is held by the flip-flop 12, the overwrite control signal J is generated from the flip-flop 12, and this is sent to the write control circuit 13. Then, the write control circuit 13 writes “1” or “0” in the PROM of the instruction decoder 11 while successively updating the address G from the address counter 15 via the increment circuit 14.

In the process of overwriting, a part of the stored contents of the instruction decoder 11 is lost, so that the programs 2a and 10 can no longer be executed normally. However, the flip-flop 12 sends the overwriting control signal J to the write control circuit 13. Write control circuit 1 independently
3 operates and the write control circuit 13 writes to the last address of the instruction decoder 11. As a result, the contents stored in the instruction decoder 11 are completely lost. A signal R from the address counter 15 when the address of the address counter 15 exceeds the last address of the instruction decoder 11.
This resets the flip-flop 12 and the write control circuit 13 stops its operation.

As a result, the instruction set cannot be obtained even by hardware means. Therefore, since the instruction set cannot be obtained, even if the code of the application program is read, it is impossible to decipher the content, meaning, structure, function, etc. of the application program.

It should be noted that the contents of the instruction decoder 11 whose memory contents have been lost are given a write control signal E from the outside to a predetermined terminal of the write control circuit 13 by a person who has the proper authority, and a predetermined I of this microcomputer. By inputting the write data and the write address to the / O terminal, the correct instruction set can be written and the contents can be easily recovered.

Although the elements added for this security function are clearly shown in broken lines in FIG. 1, the check program 10 is slightly increased as described above, and the flip-flop 12 and the increment circuit 14 are shown.
Is a circuit of a small scale from the current degree of IC integration. Further, as described above, the write control circuit 13 and the address counter 15 for invalidating the contents of the instruction decoder also serve as the original write control circuit for the instruction decoder. The size of the instruction decoder 11 is PROG-RO.
Since the size of the instruction decoder 11 is much smaller than that of M2, the increase in the circuit scale due to the change of the instruction decoder 11 from ROM to PROM is slight. Therefore, the increase in the circuit scale of the entire chip can be suppressed to a slight one.

If a flash memory or the like is used as the PROM for the instruction decoder 11, the stored contents can be erased in one operation. Therefore, depending on the configuration of the write control circuit 13, the flip-flop 12 and the increment circuit 14 may further include the address counter 15. Can also be omitted.

As described above, an example in which an EEPROM or an EPROM is used for the instruction decoder is given here, but the instruction decoder is a ROM that can write "1" or "0" even once. If so, the contents can be destroyed by writing "1" or "0" by the write control circuit, so that any PROM can be used.

[0032]

As can be understood from the above description, in the microcomputer having the configuration of the present invention, the instruction decoder is made into a PROM, and a small circuit is added to ensure reliable security by hardware means. It is possible to realize a configuration of a one-chip microcomputer that exhibits the function. As a result, IC
This can contribute to the spread of cards and the cost reduction of 1-chip microcomputers.

[Brief description of drawings]

FIG. 1 is a block diagram of an embodiment of a one-chip microcomputer of the present invention.

FIG. 2 is a block diagram of a conventional one-chip microcomputer.

[Explanation of symbols]

1 ... Instruction decoder (ID-ROM), 2 ... ROM for storing instruction code (PR
OG-ROM), 2a ... Application program (application), 3 ... Program counter (PC), 4 ... Arithmetic circuit (AL)
U), 10 ... Check program (test), 11 ... Instruction decoder (ID-PRO)
M), 12 ... Flip-flop, 13 ... Write control circuit, 14 ... Increment circuit (incrementer), 15 ...
Address counter.

─────────────────────────────────────────────────── ─── Continuation of the front page (51) Int.Cl. ⁵ Identification code Internal reference number FI technical display location G06K 19/073

Claims (3)

[Claims] 1. A ROM for storing various instruction codes including a loss instruction code for losing the contents of an instruction decoder, and an instruction code read from the ROM is decoded to respond to the loss instruction code. PRO that generates multiple control signals, including lost control signals
An instruction decoder of M and a write control circuit which receives the loss control signal and writes a predetermined value in the instruction decoder or erases the contents of the instruction control circuit are built in one chip, and operates as a microcomputer. A microcomputer that accesses the loss instruction code of the ROM and sends the loss instruction code to the instruction decoder when a predetermined security execution condition is satisfied either at time or during operation. 2. The ROM according to claim 1, further comprising a determination program for determining whether or not the security execution condition is satisfied, and generating the loss command code when the security execution condition is satisfied. Microcomputer. 3. A ROM which stores various instruction codes including a loss instruction code for losing the contents of the instruction decoder, and an instruction code read from the ROM are decoded to respond to the loss instruction code. PRO that generates multiple control signals, including lost control signals
A card having a built-in IC, comprising: an M instruction decoder; and a write control circuit that receives the loss control signal and writes a predetermined value in the instruction decoder or erases the content of the instruction decoder. A card for accessing the loss command code of the ROM and transmitting the loss command code to the instruction decoder when a predetermined security execution condition is satisfied either during the operation of executing a predetermined process by the IC or during the operation.