JPWO2006117866A1 - IC tag - Google Patents

Abstract

For example, the nonvolatile memory array NVM_ARY includes a storage area NML_ARA that can be used by a general user and an extended storage area EXTD_ARA that can be used by a specific user. The EXTD_ARA stores the trimming data of the regulator circuit and the security-related area TRIM_ARA. An area SECU_SW for storing the data is provided. Trimming data and security-related data are read out from NVM_ARY via the memory control circuit NVM_CTL, for example, triggered by an AND output of the rising edge detection signal of the regulator circuit in which VREG_DET is generated and the preamble start detection signal in which PRE_DET is generated It is. The read trimming data is set in the regulator circuit, and the security-related data is used to set release / non-release of EXTD_ARA for the user, for example.

Description

  The present invention relates to an IC tag, and more particularly to a technique effective when applied to a passive IC tag.

  According to a study by the present inventor, the following technologies can be considered for the IC tag technology.

  An IC tag refers to a small device including a storage medium, a wireless communication function, an antenna, and the like. The IC tag is sometimes referred to as a “wireless tag”, an “electronic tag”, an “RFID (Radio Frequency Identification) tag”, or the like. For example, there are various shapes such as a coin type having a diameter of about 2 cm, a stick type having a length of about 5 cm, a label type and a card type having a cash card level.

  Such an IC tag has information in its storage medium. The information can be read out wirelessly using a device called a reader / writer. In recent years, for example, attempts have been made to perform process management using an IC tag in a product assembly process, or to perform product management using an IC tag instead of a barcode.

  By the way, the IC tag is roughly classified into an active type and a passive type due to a difference in power supply method. An active IC tag obtains electric power necessary for operation by mounting a battery or the like. On the other hand, a passive IC tag does not have a battery or the like, and obtains power necessary for operation through wireless communication with a reader / writer. That is, the radio wave transmitted from the reader / writer is used not only as a signal but also converted into electric power as radio wave energy.

  Note that the frequency band of radio waves used in communication between the IC tag and the reader / writer is determined by standards. As an example, a 13.56 MHz band using an electromagnetic induction system, a 2.45 GHz band using a microwave system, or the like can be given. Of these, the 2.45 GHz band standard is defined in ISO 18000-4, which is an international standard. Normally, radio waves in the 2.45 GHz band have a longer communication distance than the 13.56 MHz band, and have a communication distance of about 1 m, for example. Recently, attention has been focused on 900 MHz radio waves as a frequency band that can further extend the communication distance.

  By the way, as a result of the study of the IC tag technology as described above, the following has been clarified.

  For example, the standard ISO 18000-4 as described above defines a procedure for signal transmission / reception between an IC tag and a reader / writer. In this standard, there are provisions such as a signal format for synchronizing with an input signal to an IC tag, a start bit, etc., but there is no provision for a specific circuit.

  Data transmission / reception from the reader / writer to the IC tag is performed by the IC tag designation and address designation by the reader / writer. For example, in the case of a READ command, the IC tag reads a unique ID value from the storage medium, and when the ID value matches the ID value specified by the reader / writer, the data of the address specified by the reader / writer is stored in the storage medium. Is read out and returned to the reader / writer.

  Under such circumstances, the following problems can be considered for such an IC tag.

  First, there is a problem related to the reliability of the operation of the IC tag. For example, a passive IC tag as described above rectifies a carrier wave transmitted from a reader / writer to generate a power supply voltage. The input voltage level of this carrier wave depends on the distance between the reader / writer and the IC tag at the time of communication, and is large at a short distance and small at a long distance. For this reason, if this power supply voltage is used as an operating power supply for a storage medium or the like in an IC tag as it is, a variation of, for example, about 1.5 V to 4 V may occur, and the operation guarantee range for the storage medium or the like may be out of range. Therefore, it is conceivable to provide a regulator circuit in order to stabilize the operation power supply of the storage medium or the like. However, even when a regulator circuit is mounted in an IC tag, the output voltage varies due to process variations of the regulator circuit and the like, and there is a concern that the reliability may be lowered.

  Second, there is a problem related to data security of IC tags. The IC tag can read the information on the storage medium if the ID values match as described above. Therefore, as long as the ID value is known, the information in the storage medium can be easily stolen by remote operation using a general-purpose reader / writer. Of course, there is no problem even if it is used in such a way that only information that has no problem even if it is read is stored in the IC tag, but depending on the case, you want to use data that can be read freely and data that is not There are times.

  Accordingly, an object of the present invention is to improve the reliability of an IC tag. Another object of the present invention is to improve IC tag data security. Furthermore, it is to reduce the cost of the IC tag.

  The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

  Of the inventions disclosed in the present application, the outline of typical ones will be briefly described as follows.

  The IC tag according to the present invention is a passive IC tag including a nonvolatile memory and a regulator circuit, and includes trimming data for adjusting the value of the internal power supply voltage generated by the regulator circuit in the nonvolatile memory. Is reflected in the regulator circuit. By providing trimming data in the nonvolatile memory in this way, variations in internal power supply voltage due to process variations can be suppressed at low cost or in a small area, and the reliability of the IC tag can be improved.

  Here, the trimming data read from the non-volatile memory must be performed after the regulator circuit starts up upon receiving power supply from the reader / writer and accordingly the operable voltage level is supplied to the non-volatile memory. There is. Further, it is desirable that the synchronization is performed before the synchronization of the internal clock in the IC tag is completed in response to the synchronization signal from the reader / writer. That is, after the internal clock is synchronized, there is a concern that the internal power supply voltage changes with the reflection of the trimming data, and the synchronization is lost. Therefore, by reflecting before the synchronization is completed, a stable internal clock can be generated, and the reliability of the IC tag is improved.

  The reader / writer normally transmits a synchronization signal of, for example, about 10 cycles after a signal for supplying power. The start of this synchronization signal (that is, the first signal edge) is used as a trigger to read trimming data. You may go. Usually, the regulator circuit has already started up before the time of this trigger, and from this time of the trigger, an internal clock signal having substantially the same clock cycle as that of the synchronizing signal starts to be generated by a clock recovery circuit or the like. Therefore, since the nonvolatile memory can be operated using the internal clock signal, the trimming data can be easily read. Even when this trigger is used, it is possible to sufficiently read and reflect the trimming data within the time when the synchronization signal is transmitted from the reader / writer (that is, before the synchronization is completely confirmed). .

  The IC tag according to the present invention is a passive IC tag including a non-volatile memory and a regulator circuit. The non-volatile memory includes a first storage area and a second storage area, and accesses only the first storage area. The first mode is possible, and the second mode is accessible to both the first storage area and the second storage area. The second storage area stores first data for setting the first mode or the second mode.

  In such a configuration, after the regulator circuit starts up upon receiving power supply from the reader / writer and a voltage level at which the nonvolatile memory is operable is supplied to the regulator circuit, the first data is first transferred from the nonvolatile memory. Is read out. Then, the first data is compared with a specific value provided in advance in the IC tag, and the mode is switched between the first mode and the second mode. Accordingly, two types of IC tags having different apparent storage areas from the reader / writer can be easily realized by using one IC tag.

  Therefore, for example, if the first storage area is an open area for general users and the second storage area is a security area that can be used only by a specific user, the first data is set at the manufacturing stage, so that An IC tag having no security area and an IC tag having a security area for a specific user can be realized.

  In addition to the first data, the second storage area may further store second data for authenticating whether or not access to the second storage area is possible. The second data is compared with the security code when the security code is transmitted from the reader / writer, and the IC tag permits access to the second storage area only when they match.

  Therefore, even an IC tag whose second storage area is open (that is, an IC tag in the second mode) cannot access the second storage area unless the security code is successfully authenticated. improves. The second data may be rewritten only by a specific user who knows the second data. Then, the security code (that is, the second data) can be changed as necessary. In addition to the first and second data, if a unique command for accessing the second storage area is provided in the IC tag, data security can be further improved.

  The IC tag according to the present invention includes trimming data in addition to the first data and the second data described above in the second storage area described above. In this case, after the operable voltage level is supplied to the nonvolatile memory, the trimming data is first read, and then the first data is read. Then, along with the reflection of the trimming data as described above, security related processing is performed using the first data. Furthermore, when the security code is issued together with the unique command from the reader / writer, the second data is read, and when the security code matches the security code, the second storage area can be accessed. As a result, the reliability of the IC tag and the data security can be improved at a low cost or in a small area.

  Note that it is desirable that the trimming data and the first data are written only in the manufacturing stage, and thereafter, only the reading is possible and the rewriting is not possible. Further, the trimming data and the first data may be stored at consecutive memory addresses in the second storage area. Thus, for example, by using an address counter or the like, it is possible to efficiently read out these data and perform a desired process.

  If the effect obtained by the representative one of the inventions disclosed in the present application is briefly described, the reliability of the IC tag can be improved. In addition, the data security of the IC tag can be improved. Furthermore, the cost reduction of the IC tag can be realized.

1 is a schematic diagram showing an example of a system configuration including an IC tag according to an embodiment of the present invention. 1 is a block diagram illustrating an example of the overall configuration of an IC tag according to an embodiment of the present invention. FIG. 3 is an explanatory diagram showing an example of a signal format when a reading request is made from the reader / writer in the IC tag of FIG. 2, (a) is an example of a signal format directed from the reader / writer to the IC tag, and (b) is an IC It shows an example of a signal format directed from a tag to a reader / writer. FIG. 3 is a block diagram illustrating a configuration example of a part of a logic control circuit, a VREG detection circuit, and a nonvolatile memory in the IC tag of FIG. 2. 5 is a circuit diagram showing a detailed configuration example of a circuit related to setting of trimming data in the IC tag of FIGS. 2 and 4. FIG. 3 is an explanatory diagram showing an example of a memory map of the nonvolatile memory in the IC tag of FIG. 7 is a flowchart showing an example of processing of the security transaction or normal operation transaction in the IC tag of FIGS. 2 and 6. FIG. FIG. 8 is an explanatory diagram showing an example of a signal format from the reader / writer to the IC tag in the flow of FIG. 7, where (a) is the signal format of the first half, and (b) is (a ) Is the latter half signal format.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted. The circuit elements constituting each functional block of the embodiment are not particularly limited, but are formed on a semiconductor substrate such as single crystal silicon by a known integrated circuit technology such as a CMOS (complementary MOS transistor). .

  In the drawing, the PMOS transistor is distinguished from the NMOS transistor by adding a circle symbol to the gate. Further, in the drawing, the connection of the substrate potential of the MOS transistor is not specified, but the connection method is not particularly limited as long as the MOS transistor can operate normally. In the following description, a passive IC tag that operates in the 2.45 GHz band based on the standard ISO 18000-4 will be described as an example. However, the present invention is not limited to this, and other frequency bands are provided. The same can be applied to the IC tag.

  FIG. 1 is a schematic diagram showing an example of a system configuration including an IC tag according to an embodiment of the present invention. The system shown in FIG. 1 includes, for example, a reader / writer RW and a plurality of IC tags TG. For example, the reader / writer RW supplies electric power to the plurality of IC tags TG by radio waves, and performs communication by radio waves with a desired TG. The TG performs processing according to the command from the radio wave from the RW, and returns the processing result to the RW.

  The IC tag TG of FIG. 1 has an IC chip in which a storage medium, a communication circuit, and the like are integrated on a film and an antenna connected to the IC chip, and the size in the long side direction is about several centimeters, for example. It has become. In FIG. 1, for example, an IC tag TG called an inlet or the like is shown. By packaging the IC tag TG, various shapes such as a stick type, a coin type, and a card type are formed.

  FIG. 2 is a block diagram showing an example of the overall configuration of an IC tag according to an embodiment of the present invention. The IC tag shown in FIG. 2 includes, for example, a power supply system circuit block, a signal processing system circuit block, and a nonvolatile memory NVM. The circuit block of the power supply system includes, for example, a rectifier circuit RECT connected to the antenna ATN, a voltage limiter circuit LMT and a regulator circuit VREG connected to the output thereof, a VREG detection circuit VREG_DET that detects the voltage of VREG, and the like. Yes.

  The circuit block of the signal processing system includes, for example, a modulation circuit MODU and a demodulation circuit DMODU connected to the antenna ATN, and a logic control circuit LOG_CTL provided between these circuits and the nonvolatile memory NVM. The signal processing system circuit block also includes an oscillation circuit OSC, a clock recovery circuit CLK_GEN, a power-on reset circuit POR, and the like.

  The antenna ATN receives the radio wave from the reader / writer RW and sends a reply to the reader / writer RW. The rectifier circuit RECT includes, for example, a diode bridge and a smoothing capacitor, and rectifies and smoothes an AC signal radio wave (specifically, a 2.45 GHz carrier wave) received by the ATN to convert it into a DC power supply voltage. This DC power supply voltage is, for example, about 7 to 8 V when it is high. The voltage limiter circuit LMT limits the DC power supply voltage converted by the RECT within a certain range for the purpose of ensuring the breakdown voltage of the transistor. That is, for example, a voltage of about 7 to 8 V is limited to a DC power supply voltage RFvdd such as 5 V or less.

  The regulator circuit VREG generates an internal power supply voltage Vdd to be supplied to the signal processing system circuit block, the nonvolatile memory NVM, and the like based on the DC power supply voltage RFvdd limited by the LMT. The VREG detection circuit VREG_DET operates at RFvdd, and detects the power supply rise of the VREG by determining the output voltage of the VREG. Details of VREG and VREG_DET will be described later with reference to FIG.

  The modulation circuit MODU modulates the carrier wave transmitted from the reader / writer RW based on the baseband data output from the logic control circuit LOG_CTL when returning to the reader / writer RW. Specifically, for example, encoding called FM0 is performed on 40 kHz baseband data, and the impedance of the antenna ATN is changed based on the data. Then, the 2.45 GHz carrier wave transmitted from the RW is reflected by the ATN, and the RW receives a different reflected wave corresponding to the change in its impedance, so that a response from the IC tag is received by detecting this. Can do.

  The demodulation circuit DMODU demodulates the radio wave received from the reader / writer RW via the ATN, and generates a baseband signal. Specifically, for example, a 40 kHz base is obtained by detecting a signal portion from a radio wave subjected to amplitude modulation or the like on a carrier wave of 2.45 GHz and performing decoding based on a format called Manchester. Generate a band signal. This generated signal is output to the logic control circuit LOG_CTL and the clock recovery circuit CLK_GEN.

  The logic control circuit LOG_CTL performs various baseband processes. For example, a process of decoding a command from a signal input via DMODU, a process of reading or writing storage data to or from an NVM based on a command, or a process of outputting storage data read from an NVM to a MODU Can be mentioned. The oscillation circuit OSC is supplied with, for example, an internal power supply voltage Vdd, is configured by a so-called ring oscillator including a plurality of inverter circuits, and outputs a 1 MHz clock signal. The clock regeneration circuit CLK_GEN includes, for example, a counter that is supplied with the internal power supply voltage Vdd and operates with a 1 MHz clock signal from the OSC.

  Such CLK_GEN generates an internal clock signal in a cycle based on a counter value, for example. This counter value is obtained by, for example, measuring the time between the plurality of rising / falling edges when the 40 kHz preamble signal (synchronization signal) is input from DMODU, and averaging them. It is determined by making it. This makes it possible to generate an internal clock signal (40 kHz) with a uniform duty ratio in synchronization with the radio wave received from the ATN. This internal clock signal is used as a reference clock signal for internal circuits such as LOG_CTL.

  The power-on reset circuit POR waits for the power-on of the regulator circuit VREG or the generation of an internal clock signal in addition to the power-on of the regulator circuit VREG, or resets each internal circuit, and detects the power-fall of the VREG to detect each internal circuit. Perform a reset process. The nonvolatile memory NVM is supplied with Vdd and can be read and written, for example, an EEPROM (Electronically Erasable and Programmable Read Only Memory) or a FLASH memory. Here, the NVM has a capacity of 256 bytes.

  In such a configuration, the main feature of the present invention is that trimming data of the regulator circuit VREG and security-related data are provided in the nonvolatile memory NVM in addition to the ID data normally provided. Then, these data are used while complying with a standard defined by, for example, ISO 18000-4. Hereinafter, these details will be described.

  3 is an explanatory diagram showing an example of a signal format when a read request is made from the reader / writer in the IC tag of FIG. 2, and FIG. 3A is an example of a signal format directed from the reader / writer to the IC tag. b) shows an example of a signal format from the IC tag to the reader / writer.

  In response to the read request, the reader / writer RW outputs radio waves having a signal format as shown in FIG. 3A toward the IC tag. The signal format illustrated in FIG. 3A includes a preamble detection 300, a preamble 301, an S delimiter 302, a command 303, an ID 304, an address 305, and a CRC 306. The preamble detection 300 is for the purpose of starting up the power supply of the IC tag, and is a “1” level signal continuous for a certain period of time.

  Although not shown in the figure, the “1” level signal on the actual radio wave is a waveform after the 2.45 GHz carrier wave is modulated with the “1” level signal, and thus becomes a carrier wave having an amplitude A, for example. . On the other hand, the ‘0’ level signal on the actual radio signal is a carrier wave having an amplitude B smaller than the amplitude A of the ‘1’ level signal, for example, when amplitude modulation is used.

  The preamble 301 is for the purpose of IC tag synchronization, and is composed of a synchronization signal in which a “0” level signal and a “1” level signal are repeated nine times. The S delimiter 302 is intended to notify the start of the command 303 and is, for example, a “1100111010” signal. The command 303 is an 8-bit signal. In the case of a READ command, for example, it is a “00001100” signal. ID 304 is an 8-byte (64-bit) signal for specifying the destination IC tag. The address 305 designates a memory address in the transmission destination IC tag, and is an 8-bit signal, for example. A CRC (Cyclic Redundancy Check) 306 is used to check whether or not data communication is normally performed, and is a 16-bit signal, for example.

  On the other hand, the IC tag receives a signal as shown in FIG. 3A, performs an operation corresponding thereto (in this case, a memory read operation), and faces the reader / writer RW as shown in FIG. 3B. A reply of the correct signal format. The signal format shown in FIG. 3B is composed of a quiet 307, a preamble reply 308, read data 309, and a CRC 310.

  The quiet 307 is a period of, for example, 16 bits provided to regenerate the power supply of the IC tag that may be lowered, as in the preamble detection 300 described above. The preamble reply 308 is a synchronization signal returned to the reader / writer RW, and has 16 bits, for example. The read data 309 is a signal corresponding to data read from the NVM in response to a read request from the RW, and is 8 bytes (64 bits), for example. CRC 310 is the same signal as described above.

  In such a signal format, the IC tag performs an operation shown in the lower part of FIG. 3A, for example, in response to a read request from the reader / writer RW. First, the first point in this operation is that the trimming data (TRIM_DAT) is read from the NVM by the end of the preamble, and the setting is completed. In the preamble 301, the reader / writer RW and the IC tag are synchronized using the clock recovery circuit CLK_GEN as described in FIG. Here, assuming that the setting of trimming data is completed after completion of the preamble 301, the internal power supply voltage Vdd of CLK_GEN varies after synchronization, and the oscillation circuit cycle and counter cycle variation accompanying this change There is a risk of loss of synchronization.

  Therefore, by completing the setting of the trimming data before the preamble 301 is completed, it is possible to prevent such a synchronization problem. Further, after setting the trimming data (and after synchronization), the IC tag can be operated with the internal power supply voltage Vdd based on the trimming data. Therefore, variations in the internal power supply voltage Vdd due to process variations and the like are reduced, and malfunction of the IC tag due to inappropriate power supply voltage values, destruction of the IC tag due to excessive power supply voltage values, and the like can be prevented. In addition, the yield of IC tags in the manufacturing process is improved. For this reason, it is possible to improve the reliability of the IC tag. In addition, the manufacturing cost of the IC tag can be reduced.

  The second point in the IC tag operation of FIG. 3A is that the security switch (SECU_SW) is read after the trimming data (TRIM_DAT) is read from the NVM and before the ID data (ID_DAT) is read. There is to be. Here, for example, TRIM_DAT and SECU_SW may be stored in successive memory addresses, and TRIM_DAT and SECU_SW may be read continuously. As a result, the reading time can be shortened and the reading power can be reduced.

  A detailed usage example of the SECU_SW will be described later with reference to FIGS. Reading of ID_DAT after reading of SECU_SW is performed based on the standard. That is, the ID tag is read from the memory address of the NVM defined by the standard, and the IC tag is specified by comparing the ID_DAT with the ID transmitted from the reader / writer RW described above.

  Such reading of the trimming data TRIM_DAT and the security switch SECU_SW is performed using, for example, a configuration as shown in FIG. FIG. 4 is a block diagram showing a configuration example of a part of the logic control circuit, the VREG detection circuit, and the nonvolatile memory in the IC tag of FIG. Here, for ease of explanation, each circuit is classified into circuit blocks for explanation, but the correspondence between each circuit and the circuit block is of course not limited thereto.

  In FIG. 4, the logic control circuit LOG_CTL includes an S delimiter analysis circuit S_CTL, a command analysis circuit CMD_CTL, a read / write address register ADD_REG, and a preamble falling detection circuit PRE_DET. In addition, an AND circuit AND of the PRE_DET and the VREG detection circuit VREG_DET described above is also included. The output signals from these circuits are input to the nonvolatile memory NVM.

  The nonvolatile memory NVM is classified into, for example, a nonvolatile memory array NVM_ARY and a memory control circuit NVM_CTL that controls the memory array. The NVM_CTL includes a count control circuit CUNT_CTL, a load value control circuit LD_CTL, an address counter ADD_CUNT, and a memory address register MADD_REG.

  The output signals S_CTL and CMD_CTL and the output signal trg of the AND circuit AND described above are input to CUNT_CTL. LD_CTL receives an output signal trg and output signals of S_CTL and ADD_REG. The output signals of CUNT_CTL and LD_CTL are input to the address counter ADD_CUNT, and the output signal of ADD_CUNT is set to the memory address register MADD_REG. In the nonvolatile memory array NVM_ARY, a read operation or a write operation using the address value of this MADD_REG is performed. Note that the bit width of MADD_REG is, for example, 8 bits.

  Here, the storage area of the nonvolatile memory NVM includes an extended storage area EXTD_ARA in addition to the normal storage area NML_ARA defined by the standard. NVM is, for example, 256 bytes, 128 bytes are allocated to NML_ARA, and 128 bytes are allocated to EXTD_ARA. The NML_ARA includes an ID storage area ID_ARA in which the ID of the IC tag is stored and a user area USR_ARA that can be used by the user from the lower order of the address according to the standard. The EXTD_ARA includes, for example, a region TRIM_ARA in which trimming data is stored, a region in which security-related data is stored (security switch SECU_SW and security code SECU_CD), and a private memory region SPE_ARA.

  Next, the operation of FIG. 4 will be described. First, the VREG detection circuit VREG_DET detects that the regulator circuit VREG has risen and its output voltage has reached a desired value. The preamble falling detection circuit PRE_DET detects the first falling signal in the preamble 301 in FIG. That is, in FIG. 3A, a change from a “1” level signal to a “0” level signal when the preamble detection 300 transitions to the preamble 301 is detected. An output signal trg obtained by performing an AND operation on these detection signals is input to the load value control circuit LD_CTL and the count control circuit CUNT_CTL.

  The LD_CTL receives the output signal trg and outputs an initial value provided in advance (that is, a head address where trimming data is stored) to the address counter ADD_CUNT. Then, the output of ADD_COUNT is set in the memory address register MADD_REG, and then reading of trimming data from the nonvolatile memory array NVM_ARY is started. On the other hand, CUNT_CTL receives the output signal trg and controls the count in ADD_CUNT. Therefore, the trimming data can be completely read out by sequentially counting up the addresses by a preset amount. Furthermore, when trimming data and security-related data are stored continuously (that is, when TRIM_ARA and SECU_SW are continuous), it is possible to read both data continuously by controlling the count. Become.

  Here, in addition to the rise of the regulator circuit VREG, the trimming data is read out in response to the first fall of the preamble. However, in some cases, the trimming data is read out only at the rise of VREG. Is possible. In the operation of FIG. 4, the first falling edge of the preamble that occurs after the rising edge of VREG is added as a condition in order to facilitate the timing of the NVM read operation. That is, here, it is assumed that the NVM operates based on the 40 kHz internal clock signal output from the clock recovery circuit CLK_GEN in FIG. 2, and this 40 kHz internal clock signal is output from the first falling edge of the preamble. Will be. Therefore, trimming data can be read out only at the rising edge of VREG as long as the NVM is operated using another clock signal from the rising edge of VREG.

  The S delimiter analysis circuit S_CTL is a circuit that detects, for example, the first falling signal when the S delimiter 302 in FIG. S_CTL is used when TRIM_ARA and SECU_SW are not continuous, or when it is desired to read trimming data and SECU_SW individually. That is, starting from the detection signal of S_CTL, LD_CTL loads the head address of SECU_SW in the same manner as the above-described reading of trimming data, and CUNT_CTL controls ADD_CUNT to completely read SECU_SW from NVM_ARY.

  In the read / write address register ADD_REG, the value input at the address 305 in FIG. 3A is set. For example, the command analysis circuit CMD_CTL analyzes whether the command 303 in FIG. 3A is a 1-byte read command or an 8-byte read command. In the case of a 1-byte read command, the value of ADD_REG is set to MADD_REG via LD_CTL and ADD_COUNT, thereby reading 1 byte of the address. On the other hand, in the case of an 8-byte read command, 8 bytes are read by controlling ADD_CUNT by CUNT_CTL in addition to the 1-byte read operation.

  FIG. 5 is a circuit diagram showing a detailed configuration example of a circuit related to setting of trimming data in the IC tag of FIGS. 2 and 4. FIG. 5 shows the regulator circuit VREG in FIG. 2, the VREG detection circuit VREG_DET, the preamble falling detection circuit PRE_DET, the AND circuit AND, the nonvolatile memory array NVM_ARY, and the memory control circuit NVM_CTL in FIG.

  The regulator circuit VREG includes, for example, a so-called series regulator having a two-stage configuration. One series regulator (first series regulator) has a configuration in which a PMOS transistor MP1 and a variable resistor RV are connected in series between a power supply voltage RFvdd and a ground voltage GND, and the output of the amplifier circuit AMP1 is connected to the gate of MP1. It has become. The variable resistor RV has a configuration in which a plurality of resistors are connected in series, and any connection node between the resistors can be connected to the output node ND1. That is, the voltage of ND1 can be changed by changing the resistance ratio. The selection of the connection node is performed by selecting the switch SW, for example, and the selection of the SW is performed based on the value of the trimming setting register TRIM_REG. Here, 16 SWs are used, and TRIM_REG has a 16-bit (2 bytes) configuration.

  In the amplifier circuit AMP1, the reference voltage BIAS is input to one input, and the feedback signal from the specific connection node ND11 in the variable resistor RV is input to the other input. An NMOS transistor MN1 is connected between the other input and the output node ND1. The gate of MN1 is controlled by the VREG detection circuit VREG_DET.

  The other series regulator (second series regulator) has a configuration in which a PMOS transistor MP2 and a plurality of resistors RL are connected in series between the power supply voltage RFvdd and the ground voltage GND, and the output of the amplifier circuit AMP2 is connected to the gate of MP2. It has become. In the amplifier circuit AMP2, the output node ND1 described above is connected to one input, and a feedback signal from a connection node ND21 in the plurality of resistors RL is input to the other input. The other connection node ND22 in the plurality of resistors RL is connected to the VREG detection circuit VREG_DET. The internal power supply voltage Vdd is output from the drain of MP2.

  The VREG detection circuit VREG_DET includes, for example, a comparator circuit CMP and an inverter circuit INV connected to the output thereof. The output of CMP is also connected to the gate of the NMOS transistor MN1 described above. One input of the comparator circuit CMP is connected to the output node ND1 described above, and the other input is connected to the connection node ND22 described above.

  The AND circuit AND includes, for example, two-stage flip-flops DFF1 and DFF2. The first-stage flip-flop DFF1 outputs the power supply voltage RFvdd to the DFF2 when the inverter circuit INV rises, and the DFF2 generates the output signal trg according to the detection signal of the preamble falling detection circuit PRE_DET. That is, the AND of the output of VREG_DET and the output of PRE_DET is taken. The AND output signal trg is output to the memory control circuit NVM_CTL.

  Next, an operation outline of the configuration of FIG. 5 will be described. First, at the stage where VREG rises, the output of CMP becomes a ‘1’ level signal. Therefore, MN1 is on and the output signal trg is a '0' level signal. At this time, the output of TRIM_REG and the state of SW are indefinite, but the connection to AMP2 is secured by turning on MN1. That is, MN1 equivalently defines the SW connection point in the initial state.

  Thereafter, the output of MP1 is input to AMP2 via variable resistors RV and MN1, and MP2 is turned on by driving AMP2. When the voltage of ND22 becomes equal to or higher than a desired determination value (that is, when VREG rises and NVM becomes higher than a voltage level at which normal operation is possible), the output of CMP is changed from a “1” level signal to a “0” level signal. Invert to. As a result, MN1 is turned off. Here, although there is a concern about the indefiniteness of the voltage of ND1, any SW (for example, Y6) is turned on in advance by resetting TRIM_REG at a timing before MN1 is turned off.

  On the other hand, in response to the transition of the CMP output to the “0” level signal, a “1” level signal is output from the DFF 1, and the output signal trg of the DFF 2 is “ Transition from a 0 level signal to a 1 level signal. As a result, the operation described with reference to FIG. 4 is performed, and the trimming data is transferred from the nonvolatile memory array NVM_ARY to the TRIM_REG. If the NVM data width is 8 bits, TRIM_REG is set in two data transfers. When TRIM_REG is set, the SW is set according to the setting, and a desired internal power supply voltage Vdd can be generated. Note that the value of Vdd is set to 1.7 V, for example, by trimming in consideration of the operation range of the transistor, power consumption, and the like.

  In addition, the trimming data value is determined for each IC tag by inspecting each IC tag in the IC tag manufacturing process (test process). Then, the optimum value is written in each NVM in the manufacturing process. Here, as means for setting the trimming data, it is also possible to use a widely known fuse other than the NVM. In this case, since the internal power supply voltage reflecting the trimming data has already been generated when the regulator circuit is started, there is no difficulty in conforming to the standard.

  However, if a fuse is used, the manufacturing cost associated with the fuse cutting increases, and the circuit area may also increase. In an IC tag, there is a very high demand for cost reduction and area reduction, and such a problem is not preferable. Therefore, if the trimming data is set using the configuration and method as described above using NVM, the reliability of the IC tag can be improved at low cost and in a small area without affecting the standard. Furthermore, in addition to reading trimming data from the NVM, it is possible to efficiently improve the reliability and data security of the IC tag by continuously reading out security-related data as described later. Become.

  Next, a usage example of security related data stored in the NVM will be described.

  FIG. 6 is an explanatory diagram showing an example of a memory map of the nonvolatile memory in the IC tag of FIG. FIG. 6 shows a 256-byte memory map in NVM, for example. Of these, the lower 128 bytes of the address is a storage area NML_ARA defined by the standard. For example, an 8-byte area ID_ARA in which an ID of an IC tag is stored and an area USR_ARA that can be freely used by general users are included. Contains. In addition, an area for storing a production number or the like may be provided in the USR_ARA.

  On the other hand, the upper 128 bytes of the address is an expanded storage area EXTD_ARA. Inside, for example, a 2-byte trimming data storage area TRIM_ARA, a 1-byte security switching data storage area SECU_SW, an 8-byte security code storage area SECU_CD, and a unique memory area SPE_ARA are provided. . This EXTD_ARA is used as an area that can be used only by a specific user, for example.

  SPE_ARA stores secret information of a specific user. The SECU_SW stores data for switching whether to enable the security function. If the specific code in the SECU_SW is stored, the EXTD_ARA is released, and if not, the EXTD_ARA is not released. That is, the two modes are switched by the SECU_SW. In one mode, only NML_ARA can be used, and in the other mode, both NML_ARA and EXTD_ARA can be used. The SECU_CD stores, for example, a security code for authenticating access permission to the SPE_ARA.

  In such a configuration, when a signal format similar to that shown in FIG. 3A is received from the reader / writer RW, the logic control circuit LOG_CTL of the IC tag in FIG. 2 performs, for example, the operation shown in FIG. FIG. 7 is a flowchart showing an example of processing of the security transaction or normal operation transaction in the IC tag of FIGS. 2 and 6. FIG. 8 is an explanatory diagram showing an example of a signal format from the reader / writer to the IC tag in the flow of FIG. 7, (a) is the signal format of the first half, and (b) Is the signal format of the second half following (a).

  First, the outline of the processing flow of FIG. 7 will be described. The IC tag of this embodiment can support two compatible signal formats. One is a normal signal format as shown in FIG. 3 (a), and the other is uniquely provided including a unique command 303a as shown in FIGS. 8 (a) and 8 (b) that does not conflict with the standard command. Signal format. In the case of the signal format of FIG. 3A, processing is performed as a normal operation transaction, and in the case of the signal format of FIGS. 8A and 8B, processing is performed as a security transaction. Note that which of these transactions is performed is determined depending on the data of the SECU_SW and whether or not a unique command is received. Details of these will be described below.

  First, in response to the first falling of the preamble detections 300 and 300a and the preambles 301 and 301a in FIGS. 3A and 8A, as described above, the trimming data and the security-related data are continuously read out. It is. That is, TRIM_ARA and SECU_SW in FIG. 6 are read out. The trimming data is transmitted from the NVM to the VREG, while the data of the SECU_SW is transmitted from the NVM to the logic control circuit LOG_CTL and held in the LOG_CTL. Here, in order to proceed with the internal processing of the IC tag promptly in response to the input signal from the reader / writer, the transmission of the commands 303 and 303a in FIGS. 3 (a) and 8 (a) is not completed at the latest. It is desirable that the data of the SECU_SW is held in the LOG_CTL. It should be noted that this condition can be satisfactorily satisfied when 1-byte SECU_SW is read immediately after trimming data.

  Thereafter, as shown in FIG. 7, LOG_CTL looks at the value of SECU_SW and determines whether or not it is a specific code (S701). If the code is a specific code, the EXTD_ARA is released (S702), and if not, the release is not performed (S707). That is, when no specific code is stored in the SECU_SW, an IC tag having only an apparent 128-byte NML_ARA is obtained. Therefore, in this case, when the unique command is received in the subsequent commands 303 and 303a, the command is not recognized (S708), and the operation is performed only when the normal command is received. That is, the signal format of FIG. 8A does not function, and only the signal format of FIG. 3A functions.

  When a normal command is received (S709), normal operation including ID 304 and ID_DAT match determination (S709a) is performed according to the signal format of FIG. 3A (S710). A series of processes for performing a normal operation after receiving this normal command will be referred to as a normal operation transaction here.

  On the other hand, when the specific code is stored in the SECU_SW and the EXTD_ARA is released (S702), it is determined whether or not the subsequent commands 303 and 303a are unique commands (S703). If the command is not a unique command, the normal command is determined (S709), resulting in a normal operation transaction according to the signal format of FIG. If the command is an original command, the matching of ID 304a and ID_DAT is determined according to the signal format of FIG. 8A (S703a). If they do not match, for example, reply refusal processing is performed such that nothing is returned to the reader / writer (S706).

  If the IDs 304a match, the LOG_CTL reads the data of the SECU_CD from the NVM and holds it. At this time, in order to promptly respond to the input signal from the reader / writer and proceed with the internal processing of the IC tag, the data of the SECU_CD is not sent until the transmission of the security code 311a in FIG. Is preferably maintained in LOG_CTL.

  Then, LOG_CTL compares the read SECU_CD data with the security code 311a transmitted by the reader / writer according to the signal format of FIG. 8A (S704). If the results match, access to SPE_ARA is permitted (S705), and if they do not match, the reply is rejected (S706). A series of processing from receiving this unique command to authenticating whether or not access to the SPE_ARA is authenticated is referred to as an authentication transaction here. The authentication transaction and the unique operation transaction to be described later are referred to as a security transaction.

  When access to the SPE_ARA is permitted by the authentication transaction, a unique operation transaction is subsequently performed. In the unique operation transaction, a specific command (read or write) is issued from the reader / writer to SPE_ARA based on the signal format as shown in FIG. Here, the signal format shown in FIG. 8B has the same configuration as the signal format shown in FIG. 3A, and it is possible to perform a desired operation by designating the address of SPE_ARA as the address 305a. It has become.

  Further, the signal format shown in FIG. 8B is issued immediately after the signal format shown in FIG. 8A, and the internal power supply voltage Vdd of VREG is maintained from the initial stage of the signal format shown in FIG. 8B. It remains. That is, in FIG. 8B, since the internal power supply voltage Vdd is maintained, trimming data and security related data are not read from the NVM. Therefore, authentication is performed by the authentication transaction, and the unique operation transaction is performed while maintaining the authentication state.

  As described above, by providing security-related data in the NVM and processing the data so as to conform to the standard signal format, it is possible to easily improve the data security of the IC tag. . Further, by switching the data of the SECU_SW with respect to a common chip, a normal IC tag and an IC tag having a security function can be realized, so that it is possible to reduce the cost associated with the common use of the chip. .

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say.

  For example, up to now, a 2.45 GHz band passive IC tag based on the standard has been described as an example, but it is considered that the signal format is almost the same in an IC tag of another frequency band. Trimming settings and security settings can be made using the same method as described above. In addition, it is considered beneficial to store trimming data and security-related data in the NVM even for an active IC tag. That is, it is not preferable to keep these data constantly by the built-in battery from the viewpoint of power saving. Therefore, when actually performing the operation, the NVM uses the same method as described above. A method to load data is recommended.

  The IC tag of the present invention is particularly useful when applied to an IC tag that is passive and requires data security, and is not limited to this, and can be widely applied to all IC tags.

Claims (11)

A circuit for generating a power supply voltage using the power transmitted wirelessly from the reader / writer;
A regulator circuit that converts the power supply voltage to generate an internal power supply voltage, and that can adjust the value of the internal power supply voltage based on trimming data;
A voltage detection circuit that generates a detection signal when the internal power supply voltage reaches or exceeds a desired voltage level with the start of the operation of the regulator circuit;
A clock recovery circuit that synchronizes an internal clock signal based on a synchronization signal transmitted from the reader / writer;
An IC tag having a nonvolatile memory to which the internal power supply voltage is supplied,
The trimming data is stored in the nonvolatile memory,
After the voltage detection circuit generates the detection signal and before the synchronization of the internal clock signal by the clock recovery circuit is determined, the trimming data is read from the nonvolatile memory and reflected in the regulator circuit. IC tag characterized by The IC tag according to claim 1, further comprising:
A signal detection circuit that outputs a detection signal when detecting a first edge in the synchronization signal transmitted from the reader / writer;
After the voltage detection circuit generates a detection signal and the signal detection circuit generates the detection signal, the trimming data is read from the nonvolatile memory before the synchronization of the internal clock signal by the clock recovery circuit is determined. An IC tag that is read out and reflected in the regulator circuit. The IC tag according to claim 1 or 2,
The regulator circuit is:
A first series regulator that outputs a voltage to the first node using the first voltage as a reference voltage;
A second series regulator that outputs the internal power supply voltage to a second node using the voltage of the first node as a reference voltage;
A trimming setting register for holding trimming data read from the nonvolatile memory;
Each of the first and second series regulators includes an amplifier circuit, an output transistor, and a plurality of resistors connected in series,
The first node is
After holding the trimming data in the trimming setting register, based on the held trimming data, it is connected to one of connection points in a plurality of resistors included in the first series regulator,
Before holding the trimming data, it is connected to any one of the connection points previously determined as an initial state,
The IC tag, wherein the voltage detection circuit includes a comparator circuit that compares the voltage of the first node before holding the trimming data with the voltage of the second node. A circuit for generating a power supply voltage using the power transmitted wirelessly from the reader / writer;
A regulator circuit for converting the power supply voltage to generate an internal power supply voltage;
A voltage detection circuit that generates a detection signal when the internal power supply voltage reaches or exceeds a desired voltage level with the start of the operation of the regulator circuit;
A non-volatile memory that is supplied with the internal power supply voltage and includes a first storage area and a second storage area;
An IC tag having a control circuit including an access control function for the nonvolatile memory,
The IC tag is
A first mode accessible only to the first storage area;
A second mode accessible to the first storage area and the second storage area;
The second storage area stores first data for setting the first mode or the second mode,
The control circuit reads the first data from the non-volatile memory after the voltage detection circuit generates a detection signal, and determines whether the first data is the same as a specific value set in advance. If it is the same as the specific value, the IC tag shifts to the second mode, and if not, the IC tag shifts to the first mode. The IC tag according to claim 4, wherein
The second storage area further stores second data for authenticating whether or not access to the second storage area is possible,
The control circuit reads the first data and the second data from the non-volatile memory after the voltage detection circuit generates a detection signal, and is transmitted from the reader / writer when the mode is shifted to the second mode. An IC tag, wherein access to the second storage area is permitted when a security code matches the second data. The IC tag according to claim 4, wherein
Reading of the first data from the nonvolatile memory is completed before the transmission of the command from the reader / writer is completed. The IC tag according to claim 5, wherein
Reading of the second data from the nonvolatile memory is completed before the transmission of the security code from the reader / writer is completed. The IC tag according to claim 5, wherein
The IC tag further has a unique command specially provided for accessing the second storage area,
When the ID is transmitted after the unique command is transmitted from the reader / writer, and then the security code is transmitted,
The reading of the first data is completed before the transmission of the unique command is completed,
The reading of the second data is completed before the transmission of the security code is completed,
The control circuit shifts to the first mode or the second mode by reading the first data, and shifts to the second mode and when the unique command is transmitted from the reader / writer and The access to the second storage area is permitted when the transmitted ID matches the ID of the IC tag and when the read second data and the transmitted security code match. IC tag to do. A circuit for generating a power supply voltage using the power transmitted wirelessly from the reader / writer;
A regulator circuit that converts the power supply voltage to generate an internal power supply voltage, and that can adjust the value of the internal power supply voltage based on trimming data;
A voltage detection circuit that generates a detection signal when the internal power supply voltage reaches or exceeds a desired voltage level with the start of the operation of the regulator circuit;
A clock recovery circuit that synchronizes an internal clock signal based on a synchronization signal transmitted from the reader / writer;
A non-volatile memory that is supplied with the internal power supply voltage and includes a first storage area and a second storage area;
An IC tag having a control circuit including an access control function for the nonvolatile memory,
The IC tag is
A first mode accessible only to the first storage area;
A second mode accessible to the first storage area and the second storage area;
In the second storage area,
The trimming data;
First data for setting the first mode or the second mode is stored;
The control circuit includes:
After the voltage detection circuit generates the detection signal and before the synchronization of the internal clock signal by the clock recovery circuit is determined, the trimming data is read and reflected in the regulator circuit,
After reading out the trimming data, reading out the first data,
The IC tag is shifted to the second mode if the read first data is the same as a preset specific value, and is shifted to the first mode otherwise. The IC tag according to claim 9, further comprising:
A signal detection circuit that outputs a detection signal when detecting a first edge in the synchronization signal transmitted from the reader / writer;
After the voltage detection circuit generates a detection signal and the signal detection circuit generates the detection signal, the trimming data is read from the nonvolatile memory before the synchronization of the internal clock signal by the clock recovery circuit is determined. An IC tag that is read out and reflected in the regulator circuit. The IC tag according to claim 9 or 10, further comprising:
An address counter,
The trimming data and the first data are stored at adjacent memory addresses in the nonvolatile memory,
Reading of the trimming data and the first data from the nonvolatile memory is performed continuously using the address counter.

Images