TWI489280B - Memory controller, memory control device, memory device, memory information protection system, and method of controlling a memory control device - Google Patents

Description

Memory controller, memory control device, memory device, memory information protection system, and control method of memory control device

The present invention relates to a technique for ensuring the confidentiality of information.

There is a known technique in which a memory device such as a semiconductor memory or the like is mounted on an information processing device, and a predetermined function is realized in the information processing device by using information such as a software program or data stored in the memory device.

In such a memory device, there is a security function for ensuring confidentiality of information stored in the memory device. For example, Patent Document 1 discloses a method of encrypting data output from a memory unit using key data.

[Previous Technical Literature]

[Patent Literature]

Patent Document 1: Japanese Patent Laid-Open No. Hei 7-219852

However, in Patent Document 1, when the key information is obtained by analyzing the encrypted output signal, the confidentiality of the information stored in the memory device is lost.

In view of the above, it is an object of the present invention to provide a technique for improving the confidentiality of information stored in a memory device.

A first aspect of the present invention is a memory controller, comprising: a key generation means for generating a new key information for encrypting/decoding information at a predetermined timing; and a data conversion means according to the key The information encrypts information outputted to the memory device that memorizes the predetermined information, and decodes the encrypted predetermined information input from the memory device according to the key information; and in the data conversion means, When the key generation means generates new key information, the new key information is updated as the key information of the key information.

Further, a second aspect of the present invention is a memory device comprising: means for instructing generation of key information for encrypting/decoding information at a predetermined timing; and key generation means for generating a new one based on the generation instruction The key information; the memory means, the memory has the predetermined information; and the data conversion means encrypts the information as the read object in the predetermined information according to the key information, and inputs the information from the external device according to the key information. The encrypted information is decoded; and in the data conversion means, whenever the key generation means generates new key information, the new key information is updated as the key information of the key information. .

Further, a third aspect of the present invention is a memory information protection system including: a memory device that memorizes predetermined information; and a memory control device that corresponds to the memory device; and the memory control device includes: The first key generation means generates a new first key information for encrypting/decoding the information at each predetermined timing; and the first data conversion means outputs the first key information pair to the memory device based on the first key information pair Encrypting the information, and decoding the encrypted information input from the memory device based on the first key information; and in the first data conversion means, each of the first key generation means generates a new one In the case of the first key information, the new first key information is updated as the key information of the first key information, and the memory device includes a second key generation means that synchronizes with the predetermined timing. Generating a new second key information identical to the first key information; the memory means memorizing the predetermined information; and the second data conversion means, based on the second key information Encrypting the information to be read in the fixed information, and decoding the encrypted information input from the memory control device based on the second key information; in the second data conversion means, each of the above When the second key generation means generates new second key information, the key information is updated by using the new second key information as the key information.

According to the present invention, the confidentiality of information stored in the memory device can be improved.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

<1. First embodiment>

[1-1. Summary of composition]

Fig. 1 is a view showing the appearance of the memory information protection system 1A.

As shown in FIG. 1, the memory information protection system 1A includes an information processing device 10A and a memory device 20.

The memory device 20 stores information about programs and/or data (also referred to as "memory information" or "storage information") in a memory core such as a general-purpose mask-type read-only memory. The memory information is, for example, data to be executed by the information processing device 10A as a computer device, and/or data used in the application software. The memory device 20 has, for example, a card or a cassette, and can be detachably attached to the information processing device 10A. The memory device 20 is used in a state of being mounted on the information processing device 10A.

The information processing apparatus 10A that utilizes the memory information stored in the memory device 20 may include, for example, a portable information terminal device such as a personal computer, a personal digital assistant (PDA), or an image processing device. Device.

In the memory information protection system 1A, when an encrypted command (encryption command) is supplied from the information processing device 10A to the memory device 20, the encryption device is decoded in the memory device 20, and executed by the memory device 20 The processing specified by the command.

[1-2. Function block]

Further, the function of the memory information protection system 1A will be described in detail. Fig. 2 is a block diagram showing the functional configuration of the memory information protection system 1A of the first embodiment.

As shown in FIG. 2, the information processing device 10A constituting the memory information protection system 1A includes a whole control unit 100A, a memory control unit (memory controller) 110A, and a face portion 120.

The overall control unit 100A is a microcomputer, and mainly includes a CPU (Central Processing Unit), a RAM (Random Access Memory), and a ROM (Read Only Memory). The entire control unit 100A reads out the program stored in the ROM and executes the program by the CPU, thereby realizing various functions.

Specifically, the overall control unit 100A functionally realizes the command generation unit 101, the material acquisition unit 102, and the command distribution detection unit 103 by execution of the above-described program.

The command generation unit 101 has a function of generating a command code related to the command of the memory device 20 or a command including the command code and the address. For example, when the data stored in the memory device 20 is read, a command (also referred to as a "read command") including the read command code and the address of the data to be read is used by the command generating portion 101. generate.

The data acquisition unit 102 sequentially stores the data read from the memory device 20 in the memory unit (RAM) in the entire control unit 100A, and determines whether or not the acquisition of the data to be read is completed (completed).

The command issuance detecting unit 103 has a function of detecting an output of a command from the command generating unit 101, and when detecting the output of the command, performs key information (key data) for encrypting or decoding the key generating unit 112 described below. Generate instructions. In other words, the command issuance detecting unit 103 also has an instruction means for instructing the key generation unit 112 to generate key information based on the output of the command.

The memory control unit 110A includes a hardware key 111, a key generation unit (key generation means) 112, and a material conversion circuit (data conversion means) 113.

The hardware key 111 is a fixed material that is executed on the hard wafer. The hardware key 111 is, for example, a plurality of inverters (NOT circuits) corresponding to the bit length of the hardware key 111, and the input of the inverter is clamped to a power supply voltage (Vcc) or GND (ground potential). ) is achieved. Furthermore, since the hardware key 111 is a fixed data realized by hardware, it can also be expressed as key data that is not interfered by the CPU.

The key generation unit 112 has a function of performing arithmetic processing at a predetermined timing and newly generating key information for encryption/decoding of information.

Specifically, when the power of the information processing device 10A is turned on, the key generation unit 112 generates initial key information (initialization of the key generation unit 112) based on the hardware key 111. Further, the key generation unit 112 includes a shift means for shifting the bit string constituting the key information, and issues a key generation instruction based on the command distribution detecting unit 103 to cause the bit string constituting the initial key information to be Sequential shifting, thereby generating new key information.

As the shifting means, for example, a shift register can be employed. When the shift register is used as the shifting means, the key generating unit 112 may be configured as follows, that is, each time the key generation instruction is accepted, the clock is input to the shift register, and The bit string of the hardware key 111 is sequentially input to the shift register by the input of the clock.

Furthermore, at the time of generation of the initial key information, for example, a virtual random number generating circuit can be used. When the key generation unit 112 is configured to include the virtual random number generation circuit, the virtual random number generation circuit generates a virtual random number based on the hardware key 111, and the generated virtual random number is used as the initial key information. .

Thus, the generation of the key information in the information processing apparatus 10A is performed based on the key generation instruction from the command issuance detecting section 103 synchronized with the command issuance, and a new key information is generated each time a new command is issued. .

The data conversion circuit 113 has a function of generating an encryption command by using a predetermined arithmetic process using the key information generated by the key generation unit 112 for the command output from the command generation unit 101. The encryption command encrypted by the material conversion circuit 113 is supplied to the memory device 20 via the interface 120. Furthermore, regarding the encryption method, for example, a stream encryption method or a block encryption method can be employed.

Further, the data conversion circuit 113 also has a function of decoding the encrypted material supplied from the memory device 20 using the key information generated by the key generation unit 112. The decoded data is supplied to the material acquisition unit 102.

In the data conversion circuit 113 for performing encryption/decoding of information, each time the key generation unit 112 generates new key information, the new key information is made as the key information for encryption/decryption. Key information update.

The device including the memory control unit 110A operates as a memory control device that controls the operation of the memory device 20. In the present embodiment, the memory control unit 110A is included in the information processing device 10A, and the information processing device 10A operates as a memory control device.

On the other hand, the memory device 20 constituting the memory information protection system 1A includes a memory unit (memory means) 200, an internal memory control unit 210, and a dielectric surface portion 220.

The memory unit 200 is a non-volatile memory such as a mask-type read-only memory, and stores programs and/or materials that are protected by confidentiality or protected from unauthorized reading. Furthermore, the memory unit 200 is not limited to a mask-type read-only memory, and may also be a flash memory, an erasable programmable read only memory (EP-ROM) or a hard disk (HD, Hard Disk). )Wait.

The memory control unit 210 includes a hardware key 211, a key generation unit 212, a material conversion circuit 213, and a command determination unit 214.

The hardware key 211 is a fixed material executed on the hardware chip, and the hardware key 211 has the same data structure as the hardware key 111 of the information processing apparatus 10A.

The key generation unit 212 has a function of performing arithmetic processing at a predetermined timing and generating new key information for encryption/decoding, similarly to the key generation unit 112 of the information processing device 10A. Specifically, when the initialization command issued from the information processing device 10A is detected after the power of the information processing device 10A is turned on, the key generation unit 212 generates initial key information (key) based on the hardware key 211. Initialization of the generating unit 212). Further, the key generation unit 212 is configured to include a shift means (for example, a shift register) for shifting the bit string constituting the key information, and to generate an initial key information based on a key generation instruction of the command determination unit 214. Shift sequentially to generate new key information.

The data conversion circuit 213 has a function of decoding the encryption command by performing a predetermined arithmetic process using the key information generated by the key generation unit 212 on the encryption command received via the interface unit 220. The command decoded by the material conversion circuit 213 is supplied to the command determination unit 214.

Further, the data conversion circuit 213 also has a function of encrypting the data read from the memory unit 200 by using the key information generated by the key generation unit 212 to generate encrypted data. The encrypted data encrypted by the material conversion circuit 213 is supplied to the information processing device 10A via the interface portion 220.

In the data conversion circuit 213 for performing encryption/decoding of information, each time the new key information is generated by the key generation unit 212, the new key information is made as the key information for encryption/decryption. Update of key information.

The command determining unit 214 discriminates the decoded command and instructs execution of a predetermined action corresponding to the command. For example, when the command from the information processing device 10A decoded by the data conversion circuit 213 is a read command from the data of the memory unit 200, the read command code and the read address data are extracted from the read command. And the read signal and the read address data are supplied to the memory unit 200.

Further, the command determination unit 214 also has an instruction means for instructing the key generation unit 212 to generate key information based on the input of the command.

Thus, the generation of the key information in the memory device 20 is performed based on the key generation instruction from the command determination unit 214 in synchronization with the reception of the command, and each time the memory device 20 accepts a new command, the key information will be Updated.

As described above, in the memory information protection system 1A including the information processing device 10A and the memory device 20, information such as commands or materials (also referred to as "communication" between the information processing device 10A and the memory device 20 The communication of the information" is encrypted. Further, the key information for encryption and/or decoding is between the information processing device 10A and the memory device 20, and is updated at any time with a predetermined timing and synchronization.

Specifically, the following describes an example of reading out the data stored in the memory device 20. Fig. 3 is a view showing the state transition of the memory information protection system 1A at the time of data reading.

As shown in FIG. 3, after the information processing apparatus 10A issues a read command (state st1) encrypted according to the key information K1, the information processing apparatus 10A and the memory apparatus 20 each generate a new key information K2 (state st2). .

When the read data D1 corresponding to the read command is transmitted, in the memory device 20, the read data D1 is encrypted according to the new key information K2, and the encrypted read data is transmitted to the information processing. Device 10A (state st3). In the information processing apparatus 10A, the encrypted read data is decoded using the key information K2, and the read data is received. When the reading of the data is performed until the reading of the specified data length is completed, when the reading data D1 of the specified length has been read, the reading is terminated (state st4).

When the data is further read from the memory device 20, the information processing device 10A encrypts the read command using the key information K2, and issues the encrypted read command again (state st5). When the read command is issued, the information processing device 10A and the memory device 20 respectively generate new key information K3 (state st6).

Moreover, when the read data D2 corresponding to the read command is transmitted, the read data D2 is encrypted in the memory device 20 based on the new key information K3, and the encrypted read data is transmitted to the information processing. Device 10A (state st7). In the information processing apparatus 10A, the encrypted read data is decoded using the key information K3, and the read data is received.

As described above, the information processing device 10A and the memory device 20 include the common key generation units 112 and 212 and the common hardware keys 111 and 211, respectively, and generate new secrets common to each other in a synchronized state every predetermined time. Key information. Further, the information processing device 10A and the memory device 20 are linked to each other in the data conversion circuits 113, 213, and the key information for encrypting/decoding the communication information is updated using the newly generated key information. Update the action.

Thereby, the updated common key information can be used for encryption and decoding between the information processing device 10A and the memory device 20 at a predetermined timing, thereby improving the confidentiality of the memory information stored in the memory device 20. . For example, even if the key information of a certain period can be interpreted and a part of the content included in the memory information is obtained, the possibility of obtaining the entire content of the information can be reduced.

Further, in the memory information protection system 1A, key information is generated by each of the information processing device 10A and the memory device 20, and no key information is performed between the information processing device 10A and the memory device 20. Exchange, thus further ensuring the confidentiality of key information.

Further, in the memory information protection system 1A, key information is generated using the hardware key generation units 112 and 212 and the hardware keys 111 and 211, and the CPU does not participate in the generation of the key information. Thereby, the key information cannot be specified by analyzing the program executed by the CPU, so that the confidentiality of the key information can be further ensured.

Further, although the above-described key generation units 112 and 212 have been described as including the shift means and the key information is shifted by the shift means to generate new key information, the present invention is not limited thereto. Specifically, the key generation units 112 and 212 may be configured to include an encryption circuit and perform encryption by a stream encryption method or a block encryption method, and generate new key information based on the hardware keys 111 and 211.

In the case where the above configuration is employed, in the series of processes performed by the key generation units 112 and 212 and the data conversion circuits 113 and 213, the key generation units 112 and 212 may be expressed as the hardware keys 111 and 211. The first stage encryption process is performed to generate key information, and the data conversion circuits 113 and 213 perform the second stage encryption process of encrypting the command using the key information.

[1-3. Action of Memory Information Protection System 1A]

Hereinafter, the operation of the memory information protection system 1A will be described. 4 and 5 are flowcharts showing the operation of the memory information protection system 1A. In FIGS. 4 and 5, the left side shows a flowchart of the operation of the information processing apparatus 10A, and the right side shows a flowchart of the operation of the memory apparatus 20. Further, the memory device 20 is not a processing means such as a CPU, but is operated by a hardware circuit. Here, for convenience, it is represented by a flow corresponding to the operation flow of the information processing device 10A.

Before the operation of the memory information protection system 1A is started, the memory device 20 is mounted on the information processing device 10A, and the respective dielectric surfaces 120 and 220 are electrically connected. Further, when the power of the information processing device 10A is turned on, the information processing device 10A is activated, and the memory device 20 is supplied with power to start the operation of the system.

As shown in FIG. 4, in the information processing apparatus 10A, when the power is turned on, the initialization of the key generation unit 112 is performed in step SP101. In the initialization of the key generation unit 112, initial key information is generated based on the hardware key 111.

In step SP102, initialization of the material conversion circuit 113 is performed using the initial key information.

In step SP103, the command generating unit 101 generates an initialization command to issue an initialization command to the memory device 20. Moreover, after the initialization command is issued, in the material conversion circuit 113, the encryption/decoding function is effectively turned "ON". Thereby, in the material conversion circuit 113, data encryption/decoding using the initial key information can be performed.

On the other hand, in the memory device 20, after the power supply is started, the command determination unit 214 determines whether or not the initialization command is input in step SP201. Upon detecting the input of the initialization command, the command determination unit 214 instructs the key generation unit 212 to perform initialization.

In step SP202, the key generation unit 212 is initialized based on the initialization instruction of the command determination unit 214, and the initial key information is generated based on the hardware key 211.

In step SP203, the material conversion circuit 213 is initialized using the initial key information. Thereby, in the data conversion circuit 213, the encryption/decoding of the data can be performed using the initial key information.

Next, in the information processing device 10A, in step SP104, it is determined whether or not the power of the information processing device 10A is turned off. When the power of the information processing device 10A is turned off, the operation of the information processing device 10A is terminated. When the power of the information processing apparatus 10A is turned on, the operation procedure transits to step SP105.

In step SP105 (refer to FIG. 5), the command generation unit 101 generates a command to the memory device 20.

In step SP106, the command generated by the command generation unit 101 is input to the material conversion circuit 113, and the data conversion circuit 113 performs encryption of the command using the initial key information. Furthermore, when step SP106 is executed again by repeated processing, the command is encrypted using the new key information.

In step SP107, the encryption command encrypted by the material conversion circuit 113 is distributed to the memory device 20 via the interface 120.

When the command issuance detecting unit 103 detects the command output of the command generating unit 101, the command issuance detecting unit 103 instructs the key generating unit 112 to generate the key information. Thereby, in step SP108, the key generation unit 112 generates new key information, and updates the key information in the material conversion circuit 113.

On the other hand, in the memory device 20, if an encryption command is input in step SP204, the operation proceeds to step SP205.

In step SP205, the encryption command is decoded using the initial key information.

When the decoded command is input to the command determination unit 214, the command determination unit 214 instructs the key generation unit 212 to generate key information. Thereby, in step SP206, the key generation unit 212 generates new key information, and updates the key information in the material conversion circuit 213.

Further, in step SP207, the command determining unit 214 determines whether or not the command of the information processing device 10A is a read command. When the command input from the information processing device 10A is not the read command, the operation proceeds to step SP208, and other processing than the read processing based on the input command is executed.

When the command input from the information processing device 10A is the read command, the process proceeds to step SP209, and the data read processing is executed (step SP209 to step SP211).

Specifically, in step SP209, the read signal and the read address data are supplied to the memory unit 200, and the data stored in the designated read address is read from the memory unit 200. Further, in step SP210, the material conversion circuit 213 encrypts the read data using the new key information. In step SP211, the encrypted read data is output to the information processing apparatus 10A via the interface 220.

In the information processing apparatus 10A, after the key information is updated in step SP108, the operation step transits to step SP109.

In step SP109, it is determined whether or not the read command has been generated in step SP105. When the read command is not generated, the operation step transits to step SP104, and the command generation processing or the like is executed again. On the other hand, when the read command has been generated, the operation proceeds to step SP110, and the process of receiving the read data from the memory device 20 is performed.

Specifically, in step SP110, if the read data is input from the memory device 20, the material conversion circuit 113 decodes the read data using the new key information generated in step SP108.

In step SP111, the data acquisition unit 102 stores the read data in the RAM.

In step SP112, the data acquisition unit 102 determines whether or not the data acquisition of the specified data length has been completed. When the acquisition of the read data has not been completed, the processing of steps SP110 to SP112 is repeatedly executed until the data of the specified data length is obtained. When the data of the specified data length has been obtained, the process proceeds to step SP104, a new command is generated as needed, and an action corresponding to the new command is executed.

As described above, the memory information protection system 1A includes the memory device 20 in which the predetermined information is stored, and the memory control device 10A corresponding to the memory device 20. Further, the memory control device 10A includes a key generation unit 112 that generates new first key information for encryption/decoding of information at a predetermined timing, and a data conversion circuit 113 that outputs the information based on the first key information. The information of the memory device 20 is encrypted, and the encrypted information input from the memory device 20 is decoded based on the first key information. In the data conversion circuit 113, the key generation unit 112 generates a new first secret each time. In the case of the key information, the update of the key information using the new first information as the key information is performed. On the other hand, the memory device 20 includes a key generation unit 212 that generates new second key information identical to the first information in synchronization with the predetermined timing; the memory unit 200 stores the predetermined information; and the data conversion circuit 213. Encrypt the information to be read in the predetermined information according to the second key information, and decode the encrypted information input from the memory control device 10A according to the second information; and in the data conversion circuit 213. When the new second key information is generated by the key generation unit 212, the update of the key information using the new second key information as the key information is performed.

According to the above-described memory information protection system 1A, in the memory control device 10A and the memory device 20, the common key information for each predetermined timing update can be encrypted/decoded, so that the memory device 20 can be improved in memory. The confidentiality of the established information.

<2. Second embodiment>

Next, a second embodiment of the present invention will be described. The memory information protection system 1B of the second embodiment has almost the same structure and function as the memory information protection system 1A except for the portion including the random number generating unit, and the same component symbol is added to the common portion. The description is omitted. Fig. 6 is a block diagram showing the functional configuration of the memory information protection system 1B of the second embodiment.

As shown in FIG. 6, the information processing device 10B of the memory information protection system 1B includes the entire control unit 100B, the memory control unit 110B similar to that of the first embodiment, and the dielectric surface portion 120 similar to that of the first embodiment.

The overall control unit 100B mainly includes a CPU, a RAM, a ROM, and the like. The command generation unit 101, the data acquisition unit 102, and the command distribution detection unit 103 further functionally realize the random number generation unit 104 and the control register unit 105.

The random number generating unit 104 has a function of generating a random number based on a virtual random number generating algorithm when the information processing apparatus 10B is activated.

The random number generated by the random number generating unit 104 is sent to the command generating unit 101. The command generation unit 101 that obtains the random number also generates a command including a random number (also referred to as a "random storage command"). Further, the random number generated by the random number generating unit 104 is transmitted to the key generating unit 112 via the control register unit 105.

The key generation unit 112 of the memory control unit 110B has a function of acquiring a random number from the entire control unit 100B that is closer to the outside than the memory control unit 110B, and generates an initial key based on the hardware key 111 and the random number at the time of initialization. News.

Here, the operation of the memory information protection system 1B will be described. Fig. 7 is a flow chart showing the initial operation of the memory information protection system 1B after activation. In FIG. 7, the left side shows a flowchart of the operation of the information processing apparatus 10B, and the right side shows a flowchart of the operation of the memory apparatus 20.

The memory device 20 is mounted on the information processing device 10B, and when the information processing device 10B is powered on, the operation of the system is started.

Specifically, as shown in FIG. 7, in the information processing device 10B, in step SP51, the random number generating unit 104 generates a random number.

In the next step SP52, the command generation unit 101 generates a random number storage command including a random number, and issues a random number storage command to the memory device 20.

Further, in step SP101, initialization of the key generation unit 112 is performed, and initial key information is generated based on the hardware key 111 and the hash value.

In step SP102, initialization of the material conversion circuit 113 is performed using the initial key information.

In step SP103, the command generating unit 101 generates an initialization command to issue an initialization command to the memory device 20. Further, after the initialization command is issued, the encryption/decoding function is effectively turned "ON" in the material conversion circuit 113. Thereby, in the data conversion circuit 113, the encryption/decoding of the data can be performed using the initial key information.

On the other hand, in the memory device 20, after the power supply is started, in step SP61, the command determining unit 214 determines the presence or absence of the input of the random number storage command. When the command determination unit 214 determines that the random number storage command has been input, the operation procedure transits to step SP62.

In step SP62, the command determination unit 214 extracts the hash value from the random number storage command, and transmits the random number to the key generation unit 212.

In the next step SP201, the command determining unit 214 determines whether or not the input of the initialization command is present. When the command determination unit 214 determines that the initialization command has been input, the operation proceeds to step SP202.

In step SP202, initialization of the key generation unit 212 is performed, and initial key information is generated based on the hardware key 211 and the hash value.

In step SP203, initialization of the material conversion circuit 213 is performed using the initial key information. Thereby, in the data conversion circuit 213, the initial key information can be used to encrypt or decode the data.

In the information processing device 10B and the memory device 20, after the initial operation is completed, the same operations as those of the information processing device 10A and the memory device 20 of the first embodiment (see FIG. 5) are performed.

As described above, in the memory information protection system 1B, the first initial key information is generated based on the same hash value in the information processing device 10B and the memory device 20, respectively. Thereby, it is possible to avoid generating the same initial key information every time it is started, so that the third party can make the specificity of the hardware keys 111, 211 more difficult.

Further, the key generation units 112 and 212 have an encryption circuit and perform encryption using a stream encryption method or a block encryption method. When the key information is configured, the key generation units 112 and 212 transmit the encryption according to the encryption. The hardware key 111 and the hash value generate new key information.

<3. Modifications>

Although the embodiments of the present invention have been described above, the present invention is not limited to the above description.

For example, in each of the above-described embodiments, the information processing apparatuses 10A and 10B and the hardware for the key generation in the memory device 20 are configured to be common, but are not limited thereto. Specifically, as long as the common key information can be generated, the information processing apparatuses 10A and 10B and the hardware configuration for the key generation in the memory device 20 may be different.

Further, in each of the above embodiments, the case where the information processing apparatuses 10A, 10B and the memory device 20 each include one hardware key 111, 211 has been exemplified, but the present invention is not limited thereto. Specifically, a plurality of hardware keys may also be included. Fig. 8 is a block diagram showing the functional configuration of a memory information protection system 1H according to a modification.

For example, as shown in FIG. 8, the memory control unit 110H of the memory information protection system 1H includes a first hardware key 151, a second hardware key 152, a key generation unit 112H, and a material conversion circuit 113H.

The key generation unit 112H generates initial key information based on the second hardware key 152 at the time of initialization. Further, after the initial key information is generated, the initial key information is sequentially shifted according to the key generation instruction, thereby generating new key information.

The data conversion circuit 113H initializes the data conversion circuit 113H based on the first hardware key 151 and the key information generated by the key generation unit 112, and updates the key information for encryption/decoding.

The memory control unit 210H of the memory information protection system 1H also includes a first hardware key 153, a second hardware key 154, a key generation unit 212H, and a data conversion circuit 213H.

The key generation unit 212H generates initial key information based on the second hardware key 154 at the time of initialization. Moreover, after the initial key information is generated, the initial key information is sequentially shifted according to the key generation instruction, thereby generating new key information.

The data conversion circuit 213H initializes the data conversion circuit 213H based on the first hardware key 153 and the key information generated by the key generation unit 212H, and updates the key information for encryption/decoding.

As described above, the information processing device 10H and the memory device 20H in the memory information protection system 1H generate key information for encryption/decoding using two hardware keys, respectively. Thereby, it is possible to make the third party more difficult to specify the hardware key.

Further, in the random number generating unit 104 of the second embodiment, the virtual random number generated by the computer algorithm is used as the random number. However, the present invention is not limited thereto, and may be generated based on physical phenomena or the like. The random number is used as a random number.

1A, 1B, 1H. . . Memory information protection system

10A, 10B, 10H. . . Information processing device

20, 20H. . . Memory device

100A, 100B. . . All control department

101. . . Command generation unit

102. . . Data acquisition department

103. . . Command release detection department

104. . . Random number generation department

105. . . Control register

110A, 110B, 110H. . . Memory control unit

111, 211. . . Hardware key

112, 212, 112H, 212H. . . Key generation unit

113, 213, 113H, 213H. . . Data conversion circuit

151, 153. . . First hardware key

152, 154. . . Second hardware key

120, 220. . . Face

200. . . Memory department

210, 210H. . . Memory control unit

214. . . Command discriminating unit

D1, D2. . . Read data

K1, K2, K3. . . Key information

St1~st8. . . status

Y. . . Yes

N. . . no

Fig. 1 is a view showing the appearance of a memory information protection system.

Fig. 2 is a block diagram showing the functional configuration of the memory information protection system of the first embodiment.

Figure 3 is a diagram showing the state transition of the memory information protection system at the time of data reading.

Fig. 4 is a flow chart showing the operation of the memory information protection system of the first embodiment.

Fig. 5 is a flow chart showing the operation of the memory information protection system of the first embodiment.

Fig. 6 is a block diagram showing the functional configuration of the memory information protection system of the second embodiment.

Fig. 7 is a flow chart showing the initial operation of the memory information protection system after the activation of the second embodiment.

Fig. 8 is a block diagram showing the functional configuration of a memory information protection system according to a modification.

1A. . . Memory information protection system

10A. . . Information processing device

20. . . Memory device

100A. . . All control department

101. . . Command generation unit

102. . . Data acquisition department

103. . . Command release detection department

110A. . . Memory control unit

111, 211. . . Hardware key

112, 212. . . Key generation unit

113, 213. . . Data conversion circuit

120, 220. . . Face

200. . . Memory department

210. . . Memory control unit

214. . . Command discriminating unit

Claims (8)

A memory controller includes: a key generation means for generating a new key information for encrypting/decoding information at a predetermined timing; and a data conversion means for outputting to the memory according to the key information pair The information of the memory device having the predetermined information is encrypted, and the encrypted predetermined information input from the memory device is decoded according to the key information; the fixed hardware key implemented by the hardware; The random number acquisition means for generating the random number generated by the external data, wherein in the data conversion means, each time the key generation means generates new key information, the new key information is used as the key information. The key information update means includes means for shifting a bit string constituting the key information to generate the new key information every predetermined time sequence, wherein the key generation means is When the memory control device is activated, the initial key information is generated using the hardware key and the random number, and the new key information is passed through each Said predetermined timing so that said initial key bit sequence constituting the information acquired sequentially shifted. The memory controller of claim 1, wherein the shifting means comprises a shift register. A memory control device comprising the memory controller of claim 1 or 2. A memory device includes: an indication means for generating key information for encrypting/decoding information at each predetermined time; a key generation means for generating a new key information according to the generation instruction; a memory means, The memory has predetermined information; and the data conversion means encrypts the information as the read object in the predetermined information according to the key information, and decodes the encrypted information input from the external device according to the key information, wherein In the above data conversion means, each time the key generation means generates new key information, the new key information is updated as the key information of the key information, and the indication means is based on the above The initialization command input of the external device performs an initialization instruction of the key generation means, and the key generation means includes shifting a bit string constituting the key information to generate the new key information every predetermined time sequence. a shifting means, wherein the memory device acquires a random number generated by the external device, the key Generating means generating initial key information by using the hardware key and the random value according to the initialization instruction, and The new key information is obtained by sequentially shifting the bit strings constituting the initial key information in accordance with the generation instruction. The memory device of claim 4, wherein the shifting means comprises a shift register. The memory device of claim 4, wherein the instruction means inputs the generation instruction based on a command input from the external device. A memory information protection system includes a memory device that memorizes predetermined information; and a memory control device that corresponds to the memory device; and the memory control device includes: a first key generation means, each predetermined Timing, generating a new first key information for encrypting/decoding information; and first data conversion means for encrypting information output to the memory device based on the first key information, and according to the first The key information decodes the encrypted information input from the memory device; and in the first data conversion means, each time the first key generation means generates a new first key information, The new first key information is updated as key information of the first key information, and the memory device includes second key generation means that generates the same as the first key information in synchronization with the predetermined timing. New second key information; The memory means, the memory has the predetermined information; and the second data conversion means encrypts the information to be read in the predetermined information based on the second key information, and controls the memory from the memory according to the second key information Decoding the encrypted information input by the device; and in the second data conversion means, each time the second key generation means generates new second key information, the new second key information is performed The key information update as the above key information. A method for controlling a memory control device, comprising: a) generating a new key information for encrypting/decoding information at each predetermined timing; b) generating a predetermined information according to the key information pair output to the memory The information of the memory device is encrypted, and the encrypted information input from the memory device is decoded according to the key information; c) the step of obtaining a fixed hardware key implemented by the hardware; And d) obtaining the externally generated hash value; wherein, in the step b) above, each time the new key information is generated in the step a), the new key information is used as the key information. The key information update, the a) step includes: shifting the bit string constituting the key information to generate the new key information at each of the predetermined timings, and the generating key information of the step a) is included in The above memory control device When the device is started, the initial key information is generated by using the hardware key and the random number, and the new key information is sequentially shifted by the bit string constituting the initial key information by each of the predetermined timings. Obtained by bit.