JPS6356750A - Single chip microcomputer - Google Patents

Abstract

PURPOSE:To realize a secure fail safe by providing a special area in a writable ROM and providing an access control circuit including a semi-fixed writing prohibiting flag which can be used again and an address decoding circuit to select the special area. CONSTITUTION:An access control circuit 14 is composed of an address decoder 14-1, a writing prohibiting flag 14-2 and three two-input AND gates. When the address decoder 14-1 decodes the address data on an address bus 3 and the area of a confidential zone 11-2 is selected, a confidential zone selecting line 14-7 is made into a high level. The writing prohibiting flag 14-2 is the flag to prohibit the writing to the confidential zone 11-2, mapped on a PROM space, set by the exclusive-use instruction of the processor to write to a built-in PROM, and is the semi-fixed flag which cannot be reset once setting is executed and is composed of a PROM cell.

Description

Detailed Description of the Invention [Field of Industrial Application] The present invention provides a single-chip microcomputer that integrates memory and computer functions on a single semiconductor substrate, in which a programmable internal data memory is non-rewritable. The present invention relates to a single-chip microcomputer having a large memory area and a built-in means for managing access to the area.

[Conventional technology]

In recent years, advances in LSI manufacturing technology have led to higher integration in the field of single-chip microcomputers.
The cost per unit function is also decreasing significantly.

Traditionally, 8-ki cards have been mainly used at banks and other financial institutions, but magnetic cards have low storage capacity and security issues, and have recently become more susceptible to unauthorized use.
Many crimes such as counterfeiting occur frequently and have become a major social problem. Therefore, an IC card equipped with a single-chip microcomputer has appeared as an alternative to the morale card, and large-scale experiments are underway in Japan and abroad to put it into practical use.

The IC card has a much larger memory capacity than the quick card, and also has a combiator function built into the card, so it is very convenient.4. ．． It is also extremely reliable in terms of IJ tee.

Generally, in an IC card equipped with a single-chip microcontroller, most of the data memory is UV-EPROM (
Ultra-Violet Erasabie Pro
g-rammable ROM) or EEPROM
(El ect r -1cal Erasable
e Programmable ROM) (hereinafter UVEPROM and EEPROM are generally referred to as F).
(referred to as ROM), its data memory is divided into several areas and its access is managed.

When an IC card is used as a cash card or credit card between financial departments such as banks, a part of this divided data memory is called a Confidential Zone.
It is used to store highly confidential data such as bank branch numbers and account numbers. This confidential zone is the most important part in preventing unauthorized use and counterfeiting of IC cards, and conventional software controls access to this area, and normally once confidential data is written, rewriting is permitted. The above area can only be accessed in special cases.

Below, an example of a conventional single-chip microcomputer having a confidential zone in the data memory is shown in the block diagram of the microcomputer shown in FIG.
This will be explained using the flowchart shown in FIG.

First, the constituent elements will be explained.

In FIG. 5, program counter 1 is a pointer pointing to the storage address of the instruction code. ROM (Read
0nly Memory) 2 is a read-only memory used to store user programs. Address bus 3 is a bus for transferring address data. The data bus 4 is a path for transferring processing data of a central processing unit (hereinafter referred to as CPU). The instruction register 5 is a register that stores the instruction code read from the ROM 2. The instruction decoder 6 is a device that controls the CPU operation specified by the instruction code stored in the instruction register 5. Temporary registers 7 and 8 are registers for temporarily holding input data to the arithmetic and logic unit 9.

The arithmetic and logic operation unit 9 performs arithmetic and logic operations on the data stored in the temporary register 7.8 and outputs the result to the data bus 4. RAMl0 is a general-purpose register and a readout register used for storing various processing data;
A writable memory that outputs stored data addressed by the address bus 3 to the data bus 4 or stores data on the data bus 4 at an address designated by the address bus 3. The RAM 10 includes a general-purpose register group 10-1 that is the center of calculations, and a key manual data storage area 10-2 that stores data input by the card user from the terminal via the board 12. Read permission flag 10- indicating permission to read data within the confidential zone
It has 3.

FROM II has a built-in UVEFROM or EEf'ROM as a data memory, and the data memory includes a card password storage area 11-1. Confidential zone 11-2, write prohibition flag 11-3 that prohibits writing into the confidential zone
A high level signal on the write signal line 15 causes the address on the address bus 3 to be sent to the data bus 4.
The data specified by the address data on the address bus 3 is output onto the data bus 4 by the high level signal on the read strobe signal line 16.

The boat 12 is a boat for communicating with the outside of the chip, and has the function of outputting data on the data bus 4 to the outside and inputting data from the outside.

Program counter 1, instruction register 5, instruction decoder 6, temporary registers 7 and 8, general-purpose register group 10
-1. The block consisting of the arithmetic and logic unit 9 constitutes a central processing unit (CPU).

The interrupt control circuit 131d receives and controls interrupt signals generated from peripheral hardware such as the board 12, and causes the CPU to execute interrupt processing.

The operation will be explained using the above components.

In a single-chip microcomputer having a confidential zone in 280M11, the instruction code at the address specified by the program counter 1 is read from the ROM 2 and stored in the instruction register 5 via the data bus 4. The instruction code stored in the instruction register 5 is input to the instruction decoder 6, and is decoded by hardware such as a programmable logic play (PLA) to execute the instruction function.

For example, in the case of a binary operation between general-purpose registers, the contents of general-purpose register 10-1 are read from RAM10 and stored in temporary registers 7 and 8. Next, the arithmetic and logic operation unit 9 is operated, and the operation result is written to the corresponding register in the general-purpose register group 10-1 in the RAM 10 via the data bus 4 if the destination is a general-purpose register.

Next, a method of accessing the confidential zone 11-2 in FROM II will be explained using the flowchart of FIG.

First, data (password) entered manually by the user from an external device is stored in the key entered data storage area 10-2 in the RAM 10 via the boat 12.

Next, the program stored in the ROM 2 predefines the key manually entered PIN stored in the key data storage area 10-2 and the PROMI.
A comparison is made with the value of the password storage area 11-1 that is not set in I. If the comparison results in a match, the arithmetic and logic unit 9 performs arithmetic processing on the keyed data by further generating random numbers, executes the same arithmetic operation on an online computer, and then sends the results via the boat 12. The card is accepted, and only if the result of the calculation is the same as the above, it is confirmed that the card access is valid.

As a result of the above confirmation, if it is determined that the card access is valid, the read permission flag 10-3 in RAM10 is set to '1''.
and permits reading of data in the confidential zone 11-2 in PR, OMI I. In the case of a mismatch, the Fi read permission flag 10-3 is set to 0'', and reading of data in the confidential zone 10-3 is not permitted and subsequent card access is prohibited.

Next, if the access command to the confidential zone 11-2 is executed in the program stored in the ROM2, the process branches to the confidential zone access determination routine (program in the ROMZ) and performs the following processing. (See Figure 6).

■ In the confidential zone access routine, first it is determined whether the instruction in question is a data write instruction or a data read instruction.

■ If it is determined that it is a boar data write command, the value of the write prohibition flag 11-3 is checked, and if it is 10'', writing is permitted and the address data and write data are transferred to the address bus 3 and data bus 4, respectively. After the output, the write signal line 15 is set to high level to cause FROM II to perform a write operation to the confidential zone.

If you want to prohibit writing to the confidential zone from now on, set the write inhibit flag 11-3 to 11''.However, if the write inhibit flag 11-3 is '1'', writing is prohibited, so no writing can be done. Execute the access niller routine without performing any action.

If the result of ■ is determined to be a data read command, RAhilO
Check the value of read permission flag 10-3 in
”, it is assumed that reading data in the confidential zone is permitted, and after outputting the address data to the address bus 3, the read strobe a16fc high level transfers the confidential zone 11-2 to F) data to the data bus. 4. If the read permission flag 10-3 is 0'', no read operation is performed and the access niler routine is executed.

■ The access error handling routine performs all processes such as counting the number of access errors, and performs processing such as making the card unusable based on that value.

Therefore, when using the card for the first time, necessary data is written to the confidential zone 11-2 by instructions from the processor, and the write inhibit flag 11-3') is set. If data writing is prohibited, rewriting to the confidential zone will be prohibited the next time the card is used by using the confidential zone access determination routine described above.

As mentioned above, in conventional single-chip microcomputers, confidential data? All access management to the stored Confidential Zone is performed by the user's software. When such a microcomputer is mounted on a card, it is conceivable that illegal data may be written into the confidential zone due to illegal access from outside by a communication means or the like or by decoding of the built-in ROM pattern. In addition, as data memory, ultraviolet edge erase type read-only memo 1.1 (
When UVEP (OM) is used, is there always a voltage on the ROM cell? In some cases, the write protect flag data may be lost when the program goes out of control.
There is a risk that illegal writing will be performed on the confidential zone, resulting in the card becoming unusable. Furthermore, there is an electrically erasable read-only memo in the data memory!
When a write command is executed when a J (EEPROM) is used, a write voltage is automatically generated inside the 280M. Illegal writing may occur.

[Problem that the invention seeks to solve]

As mentioned above, access to the confidential zone, which is a write-protected area in conventional data memory, is controlled by software. In the single-chip microcomputers used in the management system, all access control to the confidential zone that stores confidential data is performed by software, so if that software is decrypted using an unknown method, unauthorized There is a risk that the data in the confidential zone may be lost or fraudulently accessed, or that the data may be intentionally rewritten. Furthermore, if the software goes out of control, there is a risk that the confidential data in the confidential zone will be compromised, and memory management based solely on software has the disadvantage that it is incomplete in terms of fail-safety.

[Means for solving problems]

The single-chip microcomputer according to the present invention has a ROM (Prog.
rammable Read 0nly Memory
.

In a single-chip microcombiator that integrates a FROM (hereinafter referred to as FROM) and a computer function, the FROM has a specific area, and the access consists of a reusable semi-fixed write-inhibit flag and an address decoding circuit that selects the area. and a built-in means for erasing the semi-fixed write prohibition flag, which achieves fail-safety for data in the area by prohibiting writing to the specific area by the access control circuit. This makes it possible to reuse the product.

In conventional single-chip microcomputers, access to the confidential zone is managed only by software, so there is a possibility that data may be written to the zone due to program runaway or unauthorized access. In contrast, the present invention adds a simple access control circuit and provides an excellent effect in that more reliable fail-safe can be easily obtained.

Furthermore, the single-chip microcomputer according to the present invention has a specific area in the FROM. an access control circuit consisting of a reusable semi-fixed address register to specify, a reusable semi-fixed write inhibit flag, and a comparator that compares the contents of the address register and address data; By prohibiting writing by the access control circuit), fail-safe is realized for the data in the specific area, the specific area can be specified flexibly, and the semi-fixed address register and write inhibit flag are A built-in erasing means may also be provided.

[Embodiment 1] Next, a first embodiment of a single-chip microcomputer according to the present invention will be described with reference to FIGS. 1 and 2.

FIG. 1 is a block diagram of a single-chip microcomputer according to a first embodiment of the present invention. FIG. 2 is a detailed diagram of the access control circuit 14 in FIG. 1.

First, the constituent elements will be explained.

In the single-chip microcomputer of the first embodiment according to the present invention, the components other than the FROM II and the access control circuit 14 newly added in this embodiment are the same as the conventional example shown in FIG. , hereafter FROM
The configuration and performance of the access control circuit 14 and the access control circuit 14 will be explained with reference to FIG.

21st fA K PROMI 1 UVEPRO
M t *tdEEPR,OM, which includes a password storage area x1-1 and a confidential zone 11-2, as in the conventional example. Also, when FROM II receives the confidential zone write strobe signal line 14-10 from the access determination circuit 14, the address indicated by the address data on the address bus 3 is changed to the data on the data bus 4? Store.

The access control circuit 14 is a block composed of an address decoder 14-1, a write inhibit flag 14-2, and three two-person AND gates.

The address decoder 14-1 decodes the address data on the address bus 3 and decodes the address data on the confidential zone 1.
When area 1-2 is selected, confidential zone selection Rmx4-r is set to high level.

The write prohibition flag 14-2 is a no-fragment flag to prohibit writing to the confidential zone 11-2.
It is mapped in ROM space, and iJFROM is mapped in the ROM space.
This is a semi-fixed flag that is set by a dedicated instruction of the processor that performs a write operation, and is made up of FROM cells that cannot be reset once it is set.

The write inhibit flag 14-2 is a 1-bit flag made up of the same cells as those in I'ROMII, and is
When Mll is configured as UVEPROM-C and fc, the flag is set when the select line 18 and the program line 20 are high and the write voltage is applied, as shown in FIG. 4-1, and the write inhibit line 14- 6 becomes high.

The select line 18 becomes high only when the address corresponding to the flag is accessed by FROMll.

FROMII KaiJ:PIjOM! configuration f'
As shown in Figure 4-2, the above UVI)RO
In addition to the case of M, there is an eraser 21.

The erase gland 21 erases the PROM1 according to a dedicated instruction of the processor.
FROM11 is set high only when erasing the contents of all EEFROM cells in 1.

Write inhibit line 1 which is the output of write inhibit flag 14-2
4-6 and the confidential zone selection line 14-7 are input to the first analog gate 14-8, and the output 14-9 of the AND gate is input to the second analog gate 14-12.

First AND gate output 14-9 and write signal line 15
is input to the second AND gate) 14-12, and when the output 14-9 of the first AND gate is low level and the write signal line 15 is high level, the confidential zone write strobe signal line 14-10 is input to the second AND gate 14-12. Becomes a high level.

First AND gate output 14-9 and write signal line 15
is input to the third AND gate 14-13, and when the output 14-9 of the first AND gate is at a high level (when the confidential zone is selected while the @ message is prohibited), the write signal 15 is input. When the access error interrupt signal is increased, the confidential zone write strobe signal line 14-10 remains at a low level, and an access error interrupt signal is generated from the access error interrupt signal line 14-11 to the divided processing control circuit 13.

The operation during confidential zone access will be explained using the above components.

Hereinafter, it is assumed that PR and OM in FROMII are constituted by EEPROM.

First, the most important confidential data required when using the card is programmed into the confidential zone 11-2 according to instructions from the processor. This write operation is performed by decoding the address data on the address bus 3 by the address decoding section in PROMI l and writing the data on the data bus 4 by setting the write signal line 15 to a high level. At this time, the write inhibit flag 14-2 is not set, so the output 14-9 of the first add gate 14-8 is always at a low level, and the FROM including the confidential zone 11-2 is
Data can be written freely throughout the memory.

Next, after the necessary data is written into the confidential zone 11-2+ by the above operation, the processor's PLL, oM write A dedicated command performs all writing to the mapped address of the write master flag 14-2.

At this time, FROM II sets the select line 18 and the program line 20 to high, supplies the write voltage 19, and sets the write inhibit flag 14-2t-. Write protect flag 1
Once set, 4-2 is a semi-fixed flag that cannot be reset except when all PROM cells are erased by a dedicated command from the processor.
4-6 is always a 71 level. Therefore, the confidential zone is subsequently selected by the address decoder 14-1 and the confidential zone selection 114-7 is performed.
becomes high level, the output 14 of the first AND gate
-9 becomes a high level, and even if the write signal line 15 is at a high level, the confidential zone write strobe line 14 which is the output of the second AND gate 14-12
-10 is a low level, and from then on writing to the confidential zone 11-2 is completely impossible.

Furthermore, if data is written to the confidential zone 11-2 while data writing is prohibited, the second access error interrupt signal line 14-11 becomes non-maskable. What interrupt signal? occurs, causing the processor to perform access error interrupt processing.

Therefore, in the embodiment of Wooden Tablet 1, by adding simple hardware such as a semi-fixed write-protection flag,
It is possible to prevent data in the Confidential Zone from being irrevocably rewritten or data in the Confidential Zone from being lost due to runaway programs, making it completely fail-safe.

Since the semi-fixed flag is composed of FROM cells, it can be easily realized without using any special semiconductor manufacturing technology.

Furthermore, as in this embodiment, FROM and EE
When using FROM, it is possible to use it again by erasing all the contents of the FROM cell using a dedicated instruction from the processor, which makes it possible to reuse the IC card, which has a great effect on reducing costs.

The above is the data writing operation to the confidential zone in the first embodiment of the present invention, but the data reading operation in the confidential zone is performed in the same manner as in the conventional example, and countermeasures against unauthorized access are performed by software processing. Let's do good.

[Embodiment 2] Next, a second embodiment of the single-chip microcomputer according to the present invention will be described with reference to FIGS. 1 and 3.

FIG. 1 is a block diagram of a second single-chip microcomputer according to the present invention. This tenth block diagram is the same as the block diagram in the first embodiment. FIG. 3 is a detailed diagram of the access control circuit 14 in FIG. 1.

First, the constituent elements will be explained.

In the single-chip microcomputer of the second embodiment of the present invention, the components other than the access control circuit 14 are the same as those of the first embodiment, so FIG. I will explain using

The access control circuit 14 shown in FIG. 3 includes an address register 14-21, a comparator 14-20, and a write inhibit flag 14.
-2, and three AND gates.

Address registers 14-21 are 8-bit registers made up of FROM cells, and the upper 7 bits
The upper address of the confidential zone 11-2 of the M area is stored, and the least significant bit is a write inhibit flag 14-2. Each bit of the address registers 14-21 has the same structure as the write inhibit flag in the first embodiment, and is a semi-fixed register that cannot be rewritten once data has been written. This register is mapped onto FROM space.

Comparison W1420 compares the upper 7 bits of address data on address bus 3 with 7 bits of address data stored in address register 14-21, and if they match, sets confidential zone selection line 14-7 to high level. .

Using the above components, we will explain the operation when accessing the confidential zone.

Hereinafter, Pl'l, OM block 11 is EEPRO
Suppose that it is composed of hl.

First, as in the first conventional example, the confidential
Confidential data necessary when using the card is stored in zone 11-2 according to instructions from the processor. At this time, the write east flag 14-2 has not been set or sorted, so the output 14-9 of the first AND gate is at a low level, and when the write signal line 15 becomes zero level, the confidential zone write strobe is activated. Since the line 14-10 goes high, the booter can be freely written to the entire FROM memory, including in the confidential zone 11-2.

Next, use the above operations to convert the necessary data into a confidential file.
After writing to zone 11-2, address register 14-2 is written by a dedicated command of the processor that performs FROM write.
21 mapped addresses V to data bus 4
Write the above data and specify the confidential zone in address registers 14-21. Upper 7 addresses
The bit data and the write inhibit flag 14-2 are stored in the lower bit of the lower bit, and the write inhibit flag 14-2 is stored.
2ff: Set. The address register 14-21 in the second embodiment stores 7-bit address data.
Since the address bus is configured to stay overnight, the address bus is 16 bits.
), the entire FROM cell can be specified in units of 512 bytes, but by changing the bibut length of the address register 14-21, the memory area of any customer class can be specified as the confidential zone. By setting the data in the address register 14-21 above,
The address value of confidential sea 711-2 is determined, and data writing to confidential sea:/11-2 is prohibited from now on.

Next, data on the data bus is written to the address corresponding to the address register 14-21 using a processor-specific instruction to write PRO81 to the address register 14-21, and the write inhibit flag 14-2 is set. Assume that after setting t, writing to the confidential zone 11-2 is executed. The comparator 14-20 detects a match between the confidential zone address data in the confidential zone address register 14-21 on the address bus 3, and outputs the O-4 signal? It is output to the confidential zone selection line 14-7 to notify that the confidential zone 711-2 has been selected. However, since the write inhibit flag 14-2 is set to 14-8%, the write inhibit line 14-6 is at a high level.
Write signal line 15 by 14 12
Even if becomes active, if the confidential zone write strobe ffJ14101d is at high level, data cannot be written to the confidential zone. Furthermore, when the output 14-9 of the first AND gate is at a high level (when the confidential zone is selected while write is prohibited) and the write signal gland 15 is at a high level, access is made by the third AND gate 14-13. An error interrupt signal 14-11 is generated to cause the processor to execute access error interrupt processing.

Therefore, as described above, in the second embodiment, by adding a semi-fixed address register (including a write inhibit flag) and a comparator, the area of the confidential zone 11-2 can be specified. can. Furthermore, since the address register is semi-fixed, data in the confidential zone may be changed due to changes to the area after the confidential zone area has been specified, illegal rewriting of data in the confidential zone, or runaway of the program. Destruction can be prevented, making the Confidential Zone completely fail-safe.

Furthermore, when an EEPROM is used as the PRC) M as in the second embodiment, it is possible to reuse the IC card by erasing all the contents of the 9FROM cells using a dedicated instruction from the processor. This has a significant effect on reducing costs.

Next, data in the confidential zone is read out in the same manner as in the conventional column, and countermeasures against unauthorized access are performed by software processing.

〔Effect of the invention〕

As explained above, in the present invention, for the FROM block conventionally used as a data memory, a write inhibit flag, PRO, 'd, address decoder or address register for the confidential zone in the memory, a comparator, etc. are provided. Is there security against illegal data writing that occurs when software processing is traditionally prohibited from writing data to the confidential zone by forcing the hardware? It has a further enhancing effect.

- Even if the program in the i7j ROM goes out of control, the data in the confidential zone is completely protected by the hardware, which ensures more reliable fail-safety.
It has the effect of achieving safety.

Furthermore, the above write inhibit flag and address register are set to FR.
By constructing OM cells, it can be easily realized using existing semiconductor technology, and the content of all FROM cells can be determined by the processor's dedicated instructions. Erasure has the effect of making it possible to reuse the IC card without compromising high security.

[Brief explanation of drawings]

FIG. 1 is a block diagram of a single-chip microcomputer in the first and second embodiments of the present invention, and FIG. 2 is a block diagram of the access control circuit and P of the first embodiment in FIG.
A detailed diagram of R, OM, and FIG. 3 is a detailed diagram of the access control circuit and FROM of the second embodiment in FIG. 1.
Fig. 4-1 is a configuration diagram of a write-inhibit flag made up of UVPROM cells in the present invention, and Fig. 4-2 is a configuration diagram of a write-inhibit flag made up of EEP-ROM cells in the present invention. FIG. 5 is a block l of a conventional single-chip microcomputer, and FIG. 6 is a flowchart of conventional confidential zone access. 1...Program counter, 2...>
%OM, 3... Address bus, 4...
f-';' bus, 5, river, 3rd order register, 6...
・・Instruction decoder, 7・・・・Temporary register, 8
...Temporary register, 9. ...Arithmetic logic unit, 1o...R, AM, 10-
1...General-purpose register group, 10-2...
Key human data storage area, 10-3...Read permission flag, 11...PRC 11-1.
...Password storage fl, 11-2 ... Confidential zone, 11-3 ... Write-protect flag, 12 ... Port, 13 ...・
...Interrupt control circuit, 14...Access control circuit, 14-1...Address decoder, 14-2
...Write protection flag, 14-6...
Writing is prohibited! , 14-7...confidential zone selection, 14-8...first AND gate), 14-9...output of first AND gate, 14-10... Confidential zone write strobe line, 1411... Access error interrupt signal line, 14-12... Second AND gate, 14-13... ...Third AND gate, 14-20...Comparator, 14-21...
...Address register, 15...Write signal line, 16...Leitstrope signal line, 18...
...Select wire, 19...Write voltage,
20... Program line, 21... Erase line. 1″ meeting 30 lines 4-10 Figure 4-2

Claims (1)

[Claims] (1) In a single-chip microcomputer that integrates a writable ROM and computer functions on a single semiconductor substrate, the ROM has a specific area, and a reusable semi-fixed write-inhibit flag and the area are selected. an access control circuit including an address decoding circuit to prevent writing to the specific area by the access control circuit, and fail-safe the data in the area; A single-chip microcomputer characterized by having a built-in erasing means to enable reuse.