KR101475821B1 - Apparatus and method for encryption in system on chip - Google Patents

Abstract

The present invention relates to an encryption method and apparatus in a system-on-chip, the method comprising: receiving data and an address; selecting an encryption seed value from a pre-stored seed table using some bits of the address; And a step of encoding the data using the modified seed value, wherein the step of encrypting the data with the modified seed value comprises: encrypting / decrypting a wrapper type added between a bus and an IP, The encryption and decryption are performed by selecting and modifying a seed for encryption by using address information through a hierarchical layer so as to prevent hacking or interconnection at a level of a software operating system A hardware level security technique can be provided.

System On Chip (SOC), encryption, seed, cipher,

Description

[0001] APPARATUS AND METHOD FOR ENCRYPTION IN SYSTEM ON CHIP [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an encryption method and apparatus in a system-on-chip, and more particularly, to an encryption / decryption layer in a wrapper format between a bus and an IP to perform encryption / ≪ / RTI >

2. Description of the Related Art Generally, as shown in FIG. 1, in a system on chip, a central processing unit (CPU), a memory and other peripherals are connected to each other by using a bus (BUS) In recent years, memory signals or peripheral devices can be added to the system-on-chip by connecting bus signals in the system-on-chip to the outside in order to expand a single chip.

In recent years, due to the development of electric and electronic technology, information that is more valuable than the past has been digitized, and interest in security and copyright of the above information is increasing. For example, if user personal information such as an ID, a password, and a certificate used for electronic transactions is leaked, damage may be caused through impersonation of the user, and the firmware of the specific device may be damaged. The firmware can be used for a purpose other than the intention of the maker through the hacking firmware, and studies on security and copyright for preventing or solving the firmware have been actively conducted.

In the past, several security techniques have been provided to protect the important information. For example, a technique for encrypting and storing important information at a software level, a technique for using a dedicated encryption and interface for a physically accessible external memory or a peripheral device, A technique for internally designing a dual structure, and a technique for controlling area-by-area access at the bus level are provided.

However, as described above, all the techniques provided in the prior art have disadvantages. First, the technique of encrypting and storing information at the software level complicates the software code, consumes power of the central processing unit, and accesses important data stored in the entire system when using other software . The technique using a dedicated encryption and interface for the external memory or peripheral device has a disadvantage in that it can not share the external memory or peripheral device with another chip to which the same encryption interface is not applied. In the designing method, since two domains are created in the chip, the bus or other structure must be designed in a dual structure, so that the complexity increases and data exchange between internal domains must be performed only through a dedicated interface. Lastly, there is a problem that bus data may be leaked through a debug mode of the bus or the like.

Accordingly, there is a need for a security technique that can solve the above problems.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and it is an object of the present invention to provide an encryption method and apparatus in a system-on-a-chip.

It is another object of the present invention to provide a security method and apparatus for encrypting / decrypting information at a hardware level in a system-on-chip.

It is still another object of the present invention to provide a method and apparatus for encrypting / decrypting data by adding a wrapper-type encryption / decryption layer between a bus and an IP in a system-on-chip have.

It is still another object of the present invention to provide a method and apparatus for performing encryption by selecting and modifying a seed for encryption using address information in a system-on-chip.

According to a first aspect of the present invention, there is provided an encryption method in a system-on-chip, comprising: receiving data and an address; Modifying the selected encryption seed value using the remaining bits of the address, and encrypting the data with the modified seed value.

According to a second aspect of the present invention, there is provided an encryption device in a system-on-chip, comprising: an IP device outputting data and an address; And a cryptographic wrapper for encrypting the data by selecting an encryption seed value from the table and modifying the selected encryption seed value with the remaining bits of the address.

In the present invention, a wrapper-type encryption / decryption layer is added between a bus and an IP in a system-on-chip, and a seed for encryption is selected and transformed using address information, It is possible to provide a hardware level security technique for hardware illegal access to hacking or interconnection at a level of a software operating system (Operating System). In addition, it is possible to use various methods by using the position of the encryption / decryption layer and its operation characteristics, hardware access control can be performed for a specific address, and virtual address mapping using an address mapping table it is possible to provide physical memory virtualization at the hardware level through address mapping and the like, which can be used as a strong security measure compared to the conventional techniques.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings. In the following description of the present invention, detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

In the present invention, a wrapper-type encryption / decryption layer is added between a bus and an IP (Intelligent Peripheral) device in a system-on-chip, a seed for encryption is generated using address information, A technique for performing encryption / decryption by selecting and modifying a value will be described.

In the present invention, as shown in FIG. 2, in the system-on-chip, each IP such as a central processing unit (CPU), an internal memory, an external memory or a peripheral device (Cipher Wrapper) 200, 202, 204, 206, 208 for performing encryption / decryption between the bus and the bus to encrypt / decrypt data at the hardware level. That is, it is possible to encrypt data output from the IP to the bus by adding a password wrapper between the IP and the bus. Here, the encryption wrapper may be added between the respective IPs and the bus, if necessary, or may not be added.

Hereinafter, a detailed block configuration of the encryption wrapper will be described with reference to FIG. Hereinafter, an operation of encrypting data by the cryptographic wrapper will be described as an example, and it will be appreciated that the cryptographic wrapper decrypts the data encrypted with the cryptographic method described below in a corresponding manner.

FIG. 3 shows a detailed block configuration of a cryptographic wrapper in a system-on-chip according to the present invention.

3, the encryption wrapper 310 is located between the CPU 300 and the bus wrapper 320 and includes a range selector 312, a seed memory 314, A Seed Modifier 316, and a data masking unit 310. [ Here, the case where the encryption wrapper 310 exists between the CPU 300 and the bus wrapper 320 is described as an example. However, even when there exists an IP device other than the CPU 300 and the bus wrapper, Lt; / RTI >

First, when the data and the address are provided from the CPU 310, the encryption wrapper 310 selects and modifies an encryption seed value using the address, and then transmits the data to the modified encryption seed And provides the encrypted data to the bus wrapper 320.

That is, the encryption wrapper 310 extracts some bits from an address input from the CPU 300 through the area selection unit 312, identifies an address area for storing the data, And extracts an encryption seed value for the corresponding address area from the seed memory 314 using the divided address area.

4, the region selector 312 includes a bit selector 400 for selecting some bits from the input address 410 according to the pre-set address region selection information 402, A signal (Address Range selection) 412 for selecting an address region by selecting some bits from an address 410 input from the CPU 300 and generating a sub-address signal (Sub address) 414 and outputs it. Here, the address area selection information 402 can be updated under the control of the CPU 300.

The seed memory 314 stores the encryption seed value for each address area, and the encryption seed value stored in the seed memory 314 can be deleted, added and updated by the user. That is, as shown in FIG. 5, the seed memories 314 and 500 store a seed table for encryption, and thereby generate a seed table corresponding to the address range selection signal (Address Range selection) And outputs the seed value of the region to the seed deformation units 316 and 510.

Also, the encryption wrapper 310 generates an encryption key by modifying the encryption seed value extracted from the seed memory 314 through the seed modification unit 316. At this time, the seed deformation unit 316 transforms the extracted encrypted seed value by using the remaining bits except for some bits extracted for the address region division in the region selection unit 312. 5, the seed deformation units 316 and 510 are connected to the seed memory 500 using the sub address signal generated by the area selector 312, Modify the value. Here, the modified seed may be used as a cryptographic key after modifying the seed using the subaddress signal, thereby changing the values of cryptographic keys applied to the corresponding region.

 The encryption wrapper 310 encrypts the data provided from the CPU 300 using the modified encryption seed value through the data masking unit 318 and outputs the encrypted data to the bus wrapper 320 do. 5, the data masking units 318 and 520 encrypt the data input from the CPU 300 using the modified seed values in the seed deformation units 316 and 510, And outputs the encrypted data. The encryption wrapper 310 basically encrypts data by performing a masking technique to reduce transmission delay. However, the encryption wrapper 310 encrypts data by applying a complicated encryption algorithm within a range that does not impair the operation speed of the bus.

FIG. 6 illustrates a procedure for encrypting data in a cipher wrapper of a system-on-chip according to an embodiment of the present invention.

Referring to FIG. 6, when the address and data are received from the CPU, the encryption wrapper extracts some bits from the received address in step 603, and generates an address region selection signal and a sub address signal. That is, the encryption wrapper generates a signal (Address Range selection) for selecting an address region by selecting some bits from the received address according to the pre-set address region selection information, And generates a sub address signal.

In step 605, the encryption wrapper extracts an encryption seed value corresponding to the address area selection signal from the seed memory storing the encryption seed value for each address area, and then, in step 607, And generates an encryption key by modifying the encryption seed value extracted from the seed memory.

In step 609, the encryption wrapper encrypts the data provided from the CPU using the generated encryption key, that is, the modified encryption seed value, and then encrypts the encrypted data and the received address through a bus wrapper Lt; / RTI >

Thereafter, the encryption wrapper terminates the algorithm according to the present invention.

Hereinafter, an example of utilizing the cipher wrapper according to the present invention will be described with reference to FIGS. 7A to 7E based on the above-described configuration.

7A to 7E illustrate an example of utilizing a cryptographic wrapper in a system-on-chip according to an embodiment of the present invention.

7A illustrates an example of storing data of a CPU in a secure range 701 of an internal memory. It is also possible to store data of a CPU in the secure range 701 without encrypting data and determining a storage position through software. If the storage location is defined as the security area 701, the hardware can encrypt the data and store the data in the security area 701 by itself.

7B and 7C show that the security area accessible by the CPU is changed according to the seed value. FIG. 7B shows that when a specific seed value is deleted from the seed memory stored in the encryption wrapper, the security area can not be accessed . That is, although the CPU 1 711 can access the security areas A and B 713 and 715 through the cipher wrapper, the CPU 1 711 deletes the seed value for the security area B from the cipher wrapper, Only the area A 713 can be accessed, and the security area B 715 can not be accessed.

7C, in the system using a plurality of CPUs 721 and 723, when the seed values of the seed memories stored in the encryption wrappers connected to the CPUs 721 and 723 are exchanged with each other, the CPUs 721, 723) can be accessed. That is, the CPU 1 721 can access the secure area B 727 and the CPU 2 723 can access the secure area A 725 according to the seed values stored in the respective cipher wrappers. However, By exchanging the seed values stored in the wrapper, the CPU 1 721 can access the secure area A 725 and the CPU 2 723 can access the secure area B 727. Here, since there is no encryption wrapper between the internal memory 2 and the internal memory 2 BUS wrapper, each area of the internal memory 2 can be separately encrypted by each IP device do.

As shown in FIGS. 7B and 7C, when the encryption wrapper according to the present invention is used, the seed value stored in the seed memory is changed or deleted to permit or prohibit access to the information of the corresponding region to each IP device . In addition, by exchanging the seed value, exchange of data between a plurality of security areas becomes possible within a short time.

7D shows a data channel between the CPU 731 and an external device 733 to which a cipher wrapper is applied. The data through the CPU 731 and the external device 733 are both encrypted through a cipher wrapper, A highly reliable data channel is formed and it is not necessary to provide a separate encryption interface module for encryption.

FIG. 7E shows a data path between IPs to which a cryptographic wrapper is added. The data of each IP is decrypted at the time of output, encrypted at the time of inputting the IP, and transmitted in an encrypted state in most data paths, The risk of exposure of the original data is reduced even if a malicious access is made through the access point 741.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments. Therefore, the scope of the present invention should not be limited by the illustrated embodiments, but should be determined by the scope of the appended claims and equivalents thereof.

1 is a diagram showing a bus structure of a general system-on-chip,

FIG. 2 is a diagram illustrating a bus structure to which an encryption / decryption layer is added in a system-on-chip according to the present invention;

3 is a block diagram showing a detailed block configuration of a cryptographic wrapper in a system-on-chip according to the present invention;

4 is a diagram showing a detailed configuration of an address region selection unit in a system-on-chip according to an embodiment of the present invention;

FIG. 5 is a block diagram showing a block configuration for encrypting data by selecting and modifying a seed in a system-on-chip according to an embodiment of the present invention;

6 is a diagram illustrating a procedure for encrypting data in a cipher wrapper of a system-on-chip according to an embodiment of the present invention; and

7A to 7E are diagrams illustrating an example of utilizing a password wrapper in a system-on-chip according to an embodiment of the present invention.

Claims (10)

In a system-on-chip encryption method, Receiving data and an address, Selecting an encryption seed value from a pre-stored seed table using some bits of the address; Modifying the selected encryption seed value using the remaining bits of the address; And encrypting the data with the modified seed value. The method according to claim 1, The data and address are input from an IP (Intelligent Peripheral) device, And providing the encrypted data to the bus. 3. The method of claim 2, Wherein the IP device is any one of a central processing unit, an internal memory, an external memory, and a peripheral device. The method according to claim 1, Wherein the step of selecting the encryption seed value comprises: Extracting a bit from the address to identify an address region for storing the data; And selecting an encryption seed value corresponding to the distinguished address area in the seed table storing an encryption seed value for each address area. The method according to claim 1, Wherein the encryption seed value is at least one of deletion, addition and update by the user. In a system-on-chip encryption device, An IP device for outputting data and addresses, A cipher wrapper for selecting an encryption seed value from a pre-stored seed table using some bits of the address provided from the IP device and encrypting the data by modifying the selected encryption seed value with the remaining bits of the address . The method according to claim 6, And a bus for receiving the encrypted data and forwarding the encrypted data to another device. 8. The method of claim 7, Wherein the IP device is any one of a central processing unit, an internal memory, an external memory, and a peripheral device. The method according to claim 6, The encryption wrapper extracts some bits from the address to identify an address area for storing the data, and selects an encryption seed value corresponding to the separated address area from the seed table storing an encryption seed value for each address area Device. The method according to claim 6, Wherein the encryption seed value is at least one of deletion, addition, and update by the user.

Images