JP2010113615A - Semiconductor system - Google Patents

Abstract

An object of the present invention is to provide a semiconductor system capable of protecting data written to a system memory (main memory section) and preventing illegal duplication of data.
A semiconductor system includes a confidential information processing unit capable of inputting protected information and performing a protection releasing process, a random number generating unit that generates a random number, and a generated random number or Encryption of the information to be protected with the random number by calculating an exclusive OR of the buffer unit 16-2 or 16-2a for storing a seed for generating a random number and the random number and the information to be protected; An exclusive OR unit 17 that performs restoration, a main memory unit 12 that stores information to be protected encrypted by the exclusive OR unit, and information stored in the main memory in the exclusive OR circuit And a control unit 11 that controls to restore and restore the restored information to the reproduction unit 13 or 14.
[Selection] Figure 1

Description

  The present invention relates to a semiconductor system that handles highly confidential information, including protected communication and multimedia processing (playback and recording on media).

  In multimedia technology such as communication, audio and video, encryption technology or its application VPN (abbreviation of Virtual Private Network) or DRM (abbreviation of Digital Right Management) for the purpose of protecting data to be communicated or multimedia content Technology is used. As an important element in these technologies, there is handling on a system that does not cause leakage of confidential information that is information to be protected. The confidential information includes encryption keys, parameters used in processing, an algorithm for releasing protection itself, and data and contents after the protection is released.

  Consider performing the above-described protection processing in a conventional semiconductor system in which protected (encrypted) content data is read from communication or media. This system has a main CPU for managing the system, a system memory for storing data and programs, and playback of video (VIDEO) and audio (AUDIO) content that has been unprotected for analog output. A video module and an audio module that perform processing, and a confidential information processing module that can protect confidential information related to content protection cancellation from a malicious program that may operate on the main CPU. Here, the module refers to a block of each function specialized for various functions according to the characteristics of the system.

  The protection cancellation processing performed in the confidential information processing module is protected by being separated from the main CPU. However, after the protection cancellation processing in the confidential information processing module is completed, it is necessary to temporarily store the protected content (hereinafter referred to as plaintext content) in the system memory when transferring data to other modules. There is a case. Data placed in the system memory may be used by an unauthorized malicious program executed by the main CPU, or data leakage may occur through a debugger tool such as JTAG ICE. Accordingly, there arises a problem of building a system capable of protecting plaintext contents placed in the system memory and prohibiting illegal copying.

By the way, for example, Patent Document 1 discloses a DMA controller capable of efficiently performing data encryption processing and data transfer for security protection.
However, when plaintext content placed in the system memory is protected based on Patent Document 1, random numbers are regenerated based on the transfer destination or transfer source address and the encrypted data of the previous block. Thus, there is a problem that decoding cannot be performed unless processing is performed in order from the head. In addition, there is a problem that it is difficult to deal with, for example, partially excluding encryption and decryption ranges corresponding to the format of each target data.
JP 2007-102468 A

  In view of the above problems, an object of the present invention is to provide a semiconductor system that can protect data written to a system memory and prevent illegal duplication of data.

  According to one aspect of the present invention, a confidential information processing unit capable of inputting protected information, releasing the protection and holding the information, a random number generating unit for generating a random number, and a generated random number or A buffer unit that stores a seed for generating a random number, and encryption of the information to be protected by the random number by calculating an exclusive OR of the random number and the information to be protected held in the confidential information processing unit. And an exclusive OR unit that protects and restores the information by releasing it, a main memory unit that stores information protected by encryption in the exclusive OR unit, and at least access to the main memory unit A control unit that is capable of being accessed and prohibited from accessing the buffer unit, and that the protected information stored in the main memory unit is stored in the buffer unit by returning it to the exclusive OR unit. Semiconductor system and a control unit for controlling the information to be restored by the calculation of the exclusive OR of the by that random number to supply the reproduction unit is provided.

  ADVANTAGE OF THE INVENTION According to this invention, the semiconductor system which can protect the data written in a system memory and can prevent illegal duplication of data, etc. is realizable.

Embodiments of the invention will be described with reference to the drawings.
First, the prior art will be described with reference to FIG.
In a semiconductor system 10 as shown in FIG. 10, a main CPU 11 for managing the system, a system memory 12 for storing data and programs, and video (VIDEO) and audio (AUDIO) contents whose protection has been removed are stored. Confidential information that can protect the confidential information related to the protection cancellation of the content from the video module 13 and the audio module 14 that perform reproduction processing for analog output from a malicious program that may operate on the main CPU 11 And a processing module 15. The confidential information processing module 15 is originally stored separately from other data in order to prevent normal data from being viewed by general users via the system memory or the main CPU. It is provided to keep it.

  The protection cancellation processing performed in the confidential information processing module 15 is protected by being separated from the main CPU 11. However, after the protection cancellation processing in the confidential information processing module 15 is completed, the protection is canceled and the plaintext content is temporarily stored in the system memory 12 when transferring data to other modules such as the video and audio modules 13 and 14. You may need to In such a case, data placed in the system memory 12 may be used by an unauthorized malicious program executed by the main CPU 11, or data leakage may occur through a debugger tool such as JTAG ICE. there is a possibility. This is a flow in which protected data is transferred from the existing programmed data flow to the playback module via the system memory 12 after the protection cancellation processing in the confidential information processing module 15 is completed. This is because. Therefore, in such a data flow, there arises a problem that the plain text content placed in the system memory 12 must be protected (encrypted) and unauthorized copying or the like must be prohibited (prevented).

  Next, in the semiconductor system shown in FIG. 10, processing after protected (encrypted) content data is read into the semiconductor system from communication or media will be considered. The data read into the system memory 12 becomes plain text contents whose protection is canceled by the confidential information CPU 15-1, and is buffered (temporarily stored) in the confidential information internal memory 15-2. Next, as described above, there is a problem of protecting access from the main CPU 11 when writing this plaintext content into the system memory 12. Here, as a specific application, the processing flow and problems will be described taking media playback as an example. First, the flow of content data is as follows.

(1) Content data protected by the DRM technique is taken into the system memory 12 from an external medium such as a DVD or a network which is omitted in FIG.
(2) In order to cancel the protection state, the content data is transferred to the confidential information internal memory 15-2 of the confidential information processing module 15. Subsequently, the protection (encryption) of the content data is actually released by the program executed by the confidential information CPU 15-1. The plaintext content obtained as a result is stored in the confidential information internal memory 15-2.
(3) The stored plaintext content is played back via the system memory 12 via the video and audio playback modules 13 and 14 via the system memory 12 in accordance with an instruction from the main CPU 11.

Here, the basic flow ends. However,
(4) As a function related to playback, when processing plaintext content, some data (interpolation) is used to perform certain processing on the unprotected video and audio data and use them to improve quality. Processing such as creation of frames and sound quality improvement data) may be added.

In the semiconductor system as shown in FIG. 10, the protected plaintext contents are copyable video and audio, and if access to this data through a tool such as JTAG ICE or a malicious program is allowed, Unlawful duplication of valuable data will be circulated in the market.
However, in the prior art, there is no effective protection means for the system memory 12. Therefore, in order to protect the plaintext content during the process (3), a data buffer and a local bus for sending data directly from the confidential information processing module 15 to the reproduction modules 13 and 14 without using the system memory 12. It was necessary to prepare such a data path.

Alternatively, it is necessary to encrypt the plaintext content whose protection is canceled in the confidential information processing module 15 again using an algorithm different from that used for the protection and then output it to the system memory 12.
In the former, although the basic function of the confidential information processing module 15 is not changed, the connection with other modules such as the reproduction modules 13 and 14 is changed depending on the application, and the confidential information processing module 15 Since firmware changes occur, there is a problem that the scalability (scale) of the semiconductor system and the reusability of the design become poor.

  In the latter case, when the encrypted data fetched into the system memory 12 is reproduced, the module responsible for the plaintext content reproduction process needs to further perform the encryption decryption process. This means an increase in the circuit scale of the system and an increase in power consumption of the system. Furthermore, the presence of re-encryption / decryption processing of plaintext content that has been unprotected causes a reduction in processing performance of the system.

  In addition, when the processing as described in (4) above is introduced, if no processing can be performed on the system memory 12, the confidential information processing module 15 has not only a basic function for releasing protection but also a plurality of frames. It is necessary to introduce everything up to application functions such as management and display of plaintext content. At this time, the control and communication procedure between the confidential information processing module 15 and the main CPU 11 greatly depend on the application, and the reusability of the application and driver operating on the main CPU 11 and the firmware operating on the confidential information processing module 15 is reduced. It will drop greatly. Alternatively, a local memory is introduced on the image processing side, and the data on the local memory is processed in accordance with the above (4) by a CPU dedicated to images separated from the main CPU 11, which results in an increase in cost.

  In another conventional technique, the main CPU 11 itself has a built-in memory, and the access to the built-in memory is permitted only in the secure mode of the normal operation mode and the secure mode, which are the two operation modes of the CPU. Although there is a system that protects the data, the use of a sophisticated CPU architecture increases the cost and restricts the memory capacity, and it is also necessary to use a dedicated software service.

  An object of the present invention is to provide means for protecting data written to a system memory in order to solve the above-described problems. If there is a means of protecting the data on the system memory, general-purpose memory can be used as a temporary storage area for plain text content, and the optimum memory size can be selected according to the application of the semiconductor system, so that the cost is also reduced. It is advantageous. In addition, the confidential information processing module is introduced with processing of each single functional element such as a protection release operation on the system memory from the main CPU, processing of unprotected plaintext content, and operations related to data communication with the system memory. The maintainability is improved. For this reason, plain text contents can be protected by a unified mechanism regardless of the variety of applications, and the scalability of the entire secret data protection mechanism can be improved.

[First Embodiment]
FIG. 1 shows a block diagram of a semiconductor system according to a first embodiment of the present invention.
A semiconductor system 10A shown in FIG. 1 includes a main CPU 11, a system memory 12, a video module 13, an audio module 14, a confidential information processing module 15A, a random number generator 16-1, a random number buffer 16-2, and an XOR circuit 17. .
The confidential information processing module 15A, which is a confidential information processing unit, includes a confidential information CPU 15-1, a confidential information internal memory 15-2, and a DMA controller (hereinafter abbreviated as DMAC) 15-3, and is protected from the outside. Information can be input via the system memory 12 to release protection and retain data.

As will be described later, the DMAC 15-3 transfers data between the system memory 12 constituting the semiconductor system 10A and the modules 13 and 14, and the confidential information internal memory 15-2 and the system memory 12 of the confidential information processing module 15A. And a normal mode and a random number mode.
A random number generator 16-1 that is a random number generator generates a random number. This random number is a true random number having no regularity.
A random number buffer 16-2 serving as a buffer unit stores the random numbers generated by the random number generator 16-1.

The XOR circuit 17 serving as an exclusive OR unit encrypts (scrambles) the data to be protected with a random number by calculating the exclusive OR (XOR) between the random number from the random number buffer 16-2 and the data to be protected. ) And restoration (descrambling).
The system memory 12 as the main memory unit is a storage device that can be directly accessed by the main CPU 11, and the protected data taken into the system memory 12 from the outside is once unprotected by the confidential information processing module 15A. Thereafter, when data is reproduced, the data flows through the system memory 12 to the modules 13 and 14 on the reproduction unit side. When data is written back to the system memory 12, in this embodiment, before the data is transferred to the system memory 12, the XOR circuit 17 performs an XOR operation with a random number and encrypts (protects) the data in the protected state. Is sent to the system memory 12 for writing.

  The main CPU 11 as a control unit controls data writing and reading to the system memory 12, data transfer to each function module 15A, 13 and 14 and flow control, and instructions for normal mode and random number mode to the DMAC 15-3. It is possible to perform such control. When the random number mode of the DMAC 15-3 is activated, for example, the protected random number stored in the random number buffer 16-2 is returned to the XOR circuit 17 by returning the protected data stored in the system memory 12 again. Control is performed so that the restored (protection-removed) data based on the XOR operation is supplied to the video module 13 and the audio module 14 which are playback units. The random number buffer area of the random number buffer 16-2 is prohibited from being accessed by the main CPU 11, and the main CPU 11 cannot read a random number that is the source of encryption (scramble) or restoration (descramble). .

The video module 13 and the audio module 14 which are playback units input the data whose protection has been removed via the bus 19, reproduces the data as analog data of images and sounds, and outputs them as images and sounds on the display device.
In the semiconductor system 10A shown in FIG. 1, the protected (encrypted) video data placed in the system memory 12 is a confidential information processing module 15A composed of a confidential information CPU 15-1 and a confidential information internal memory 15-2. After the protection is released through processing performed by the XOR circuit 17, the video module 13 performs further playback processing for playback.

  The DMAC 15-3 transfers data between the system memory 12 and the modules 13 and 14 constituting the semiconductor system 10A, and between the confidential information internal memory 15-2 and the system memory 12 of the confidential information processing module 15A. Equipped to perform data transfer. The DMAC 15-3 reads the random number value from the random mode buffer 16-2 in addition to the transfer target data and the normal mode in which the memory data is transferred, and outputs the result of taking the exclusive OR (XOR) of the data. There are two operation modes, the random number mode.

FIG. 2 shows a data flow in the semiconductor system 10A.
The content data to be reproduced is read into the system memory 12 while being protected from the outside (step S1), and then the normal mode of the DMAC 15-3 is started (step S2). Is taken into the internal memory 15-2 (step S3). Next, the confidential information CPU 15-1 decrypts the protected content data using the protected instructions and data stored in the confidential information internal memory 15-2, and the protection is released. Plain text content is obtained (step S4). This processing result, that is, the plaintext content is set as a result 1.

  Thereafter, the result 1 is encrypted in the random number mode of the DMAC 15-3 and output to the system memory 12 (steps S5 to S9). The output to the system memory 12 is the result of calculating the exclusive OR of the random number output from the random number generator 16-1 and the result 1 by the XOR circuit 17, and this will be referred to as the result 2. .

  The operation of steps S5 to S9 will be described. After the protection release processing in step S4, the random number mode of the DMAC 15-3 is activated for the random number (step S5). When starting the DMAC 15-3 in the random number mode and in the direction of transferring data to the system memory 12, the random number is generated in accordance with the data size of the plaintext content to be protected to be transferred (step S6). The address information is stored in the random number buffer 16-2 (step S7). Then, this random number is XORed with the result 1 and the XOR circuit 17 obtained by normalization, output as a result 2 (step S8), transferred to the system memory 12 and stored (step S9).

  The result 2 stored in the system memory 12 is scrambled by a random number, and the main CPU 11 cannot directly use the scrambled data. That is, the protection (scramble) of plain text content in the system memory 12 is achieved.

  In order to use the result 2 in the video module 13 or the audio module 14, it is necessary to move the result 2 from the system memory 12, so that the random number mode of the DMAC 15-3 is activated again (step S10). Use result 2 to obtain result 1.

  That is, the result 2 is input to the XOR circuit 17, and exclusive OR is again performed with the random value in the random number buffer 16-2 used when obtaining the result 2 from the result 1 (step S11). As a result, the scrambled result 2 is transferred again to the video module 13 as the plain text content output to the confidential information internal memory 15-2, that is, restored to the result 1 (step S12). Finally, after a predetermined playback process related to video playback is performed in the video module 13 (step S13), it is output to a display device (not shown) connected to the video module 13 and played back (step S14).

  A method for managing the random number buffer 16-2 will be described in detail with reference to FIGS. As shown in FIG. 3, the random number buffer 16-2 prepares and manages an area for each functional module related to various plaintext contents. In FIG. 3, N buffer areas are prepared for the area for function 1, the area for function 2,... The size of each buffer area can be determined in advance according to the request of the functional module, and becomes the maximum size of one-time data protection and release processing corresponding to each functional module.

  As described above, until the data is processed in each functional module, [1] from the confidential information internal memory 15-2 to the system memory 12, and [2] from the system memory 12 to the functional module. DMA transfer is performed twice in the random number mode. [1] and [2] can be executed separately when DMA starts. As the setting items for the DMAC 15-3 when setting the transfer of the data related to the function N to [1], the transfer source head address addrN, the transfer size, and the function number N on the system memory 12 are designated. At this time, a random number having a size required for processing is prepared at a predetermined address on the random number buffer 16-2. The head address is also called a start address.

  An address on the random number buffer 16-2 storing a random number generated for calculating the exclusive OR is determined for each function. For the sake of explanation, in FIG. 3, the leading address of the random number buffer 16-2 corresponding to the function N is indicated by rng_addrN. rng_addrN is determined in advance. The random number buffer 16-2 and the system memory 12 have areas corresponding to the same functions 1 to N, and are assigned addresses. Accordingly, if the random number buffer 16-2 and the system memory 12 determine only the top address for each function, the subsequent addresses naturally correspond to each other. That is, for function 1, the start address of the system memory 12 is addr1 and the start address of the random number buffer 16-2 is rng_addr1, and for function 2, the start address of the system memory 12 is addr2 and the start address of the random number buffer 16-2 The address is rng_addr2. The same applies to function 3 and later. Regarding the function N, the start address on the system memory 12 is addrN, and the start address of the random number buffer 16-2 is rng_addrN.

  In FIG. 3, if addr_trans is an address actually used on the system memory 12 in each function, for example, for function 1, the start address on the random number buffer is rng_addr1, and the start address on the system memory is addr1, so on the system memory The actual address on the random number buffer corresponding to the actual address is (addr_trans−addr1) + rng_addr1.

FIG. 4 is a management table of the random number buffer 16-2, and shows the start address for each function on the system memory 12 corresponding to each function area (function 1, function 2,... Function N) of the random number buffer. Yes.
The management table referred to by the DMAC 15-3 is prepared as a random number buffer area or a hardware register, and is stored in association with addrN and N at the time of data transfer of [1]. When transferring [2], the function number N and the transfer start address addr_trans of the scrambled data on the system memory 12 are designated. addr_trans may or may not coincide with the start address addrN of the processing target data in [1]. When there is an offset between addrN and addr_trans, a random number for processing the address data on the corresponding system memory 12 can be obtained by calculating (addr_trans−addrN) + rng_addrN. The management of the address relationship of the random number buffer 16-2 associated with the transfer address shown here is implemented as a function of the DMAC 15-3. As a result, it is possible to release protection of an arbitrary area to be specified from the scrambled data and transfer it to the functional module. In addition, security is improved by limiting the transfer destination of [2] to modules that use plain text content.

  After the transfer of [2] is completed, the random number in the random number buffer 16-2 is no longer necessary, and other data used in the same functional module can be handled again by the operations repeated from [1]. Here, random numbers are managed for each function number, but it is also possible to manage a plurality of buffers per function according to system requirements, or simply manage them as buffer numbers. Furthermore, in the application of this embodiment, by further managing rng_addrN using the management table shown in FIG. 4, it is possible to realize a method for setting the address of the random number buffer 16-2 having an arbitrary size for each function. .

  According to the first embodiment, confidential data in a semiconductor system can be protected by calculating an exclusive OR with a secret random number. This is particularly important as a means for protecting the contents of the system memory, which can be a data transfer buffer between functional modules, from access by the main CPU. At this time, the data protection process can be simplified without taking into account the complicated calculation for processing an algorithm such as a modern encryption technique or the block size (processing unit) based on the encryption algorithm.

Also, by performing exclusive OR calculation simultaneously with DMA transfer, bus access can be reduced, and the size of the exclusive OR calculation and the association between the random number buffer and the processed data can be handled collectively.
Furthermore, random number generation by the random number buffer is automatically performed in conjunction with the transfer target address and size set in the DMAC or the transfer destination function type, and a random number of a necessary size can be automatically generated. And simplification of the procedure.

[Second Embodiment]
FIG. 5 shows a block diagram of a semiconductor system according to the second embodiment of the present invention. Parts having the same functions as those in the first embodiment will be described with the same reference numerals.
The semiconductor system 10B shown in FIG. 5 includes a main CPU 11, a system memory 12, a video module 13, an audio module 14, a confidential information CPU 15-1, a confidential information internal memory 15-2, and a DMA controller (DMAC) 15. -3, a random number generator 16-1, a random number buffer 16-2, and an XOR circuit 17. The apparent configuration is the same as that of the first embodiment of FIG.

  The semiconductor system 10B of the second embodiment differs from the semiconductor system 10A of the first embodiment in that data is written to the system memory 12 when data is transferred from the confidential information internal memory 15-2 to the system memory 12. Rather than scramble all the data to be returned, only a part of the data is written as plain text on the system memory 12, and the part of the data can be read (analyzed) by the main CPU 11.

As an application example of such descrambling, a case is assumed in which, for example, a part of the scrambled plaintext content includes a header or the like for analysis by the application. This is a mechanism for performing processing so that only the header, which is not secret information, can be read by the main CPU 11 without scrambling.
One method is to give some information to the random number generator 16-1 from the confidential information CPU 15-1 or the like and generate 0 instead of the random number for the part to be excluded from scramble and store it in the random number buffer 16-2. By doing so, descrambling is realized. Alternatively, after the random number generator 16-1 generates a random number and stores it in the random number buffer 16-2, the confidential information CPU 15-1 or the like performs control to overwrite 0 in the portion excluding scramble. Thus, descrambling is realized.

The operation of the second embodiment will be described.
In the first embodiment, the processing result (plain culture content) decrypted with the protected instruction placed in the confidential information internal memory 15-2 is called result 1. In the semiconductor system 10B according to the second embodiment, the result 1 of this plain processing is exclusive as shown in FIG. 6 before being output to the system memory 12 as the result 2 scrambled in the random mode of the DMAC 15-3. Among the targets to be logically ORed, the arbitrary pattern for matching with the processing target specific area (for example, the area for function 1) of the random number buffer 16-2 is rewritten to 0. When the value of the random number buffer 16-2 is 0, the result of the exclusive OR operation is the same as the case where the operation is not performed, so that the scrambled area rewritten to 0 can be excluded. Here, the area in the random number buffer 16-2 to be replaced with 0 is determined based on the data structure of the content to be processed. For example, if the content consists of fixed-length D byte data, the area to be replaced with 0 for the i-th (i ≧ 0) packet based on the header size H byte of each data and the random number buffer head address rng_addrN is the address rng_addrN + H byte starting from D × i.

  Regarding the method of designating the area to be replaced with 0, a pattern (for example, each data size D and header size H) is set in the DMAC 15-3, and a random number buffer is stored in the DMAC 15-3 after a random number is generated in the random number buffer 16-2. This is realized by overwriting the value of 16-2, or by overwriting the random number generated in advance in the random number buffer 16-2 dedicated for writing to 0 by the confidential information CPU 15-1. Alternatively, a method can be realized in which pattern information is input to the random number generator 16-1 to generate 0 instead of a random number.

  As described above, since it is complicated to specify the address and size at which the random number buffer 16-2 is rewritten to 0 each time, the area and size that the confidential processing module 15A excludes from scrambling based on the data structure of the content to be processed By prescribing and numbering, the specified content can be simplified. At this time, it is only necessary to specify the above-mentioned number according to the data format.

As a result of these processes, the scrambled data on the system memory 12 is the data that is protected by encryption (scramble) with random numbers as the header and the like necessary for analysis by the main CPU 11 as an application. .
According to the second embodiment, a part of the confidentially processed protected data written back to the system memory 12 is used in plain text by the main CPU, thereby producing an effect of enabling analysis and use of data attributes. . For example, by overwriting a part of random numbers with 0, only a part of the data to be subjected to exclusive OR calculation processing at once is extracted as plain text on the system memory 12 and analyzed. I can do it.

[Third Embodiment]
FIG. 7 shows a block diagram of a semiconductor system according to the third embodiment of the present invention. Parts having the same functions as those in the first embodiment will be described with the same reference numerals.
7 includes a main CPU 11, a system memory 12, a video module 13, an audio module 14, a confidential information CPU 15-1, a confidential information internal memory 15-2, and a DMA controller (DMAC). ) 15-3, a random number generator 16-1a, a seed buffer 16-2a as a buffer unit, and an XOR circuit 17.

  In the embodiments described so far, it is expected that the area of the required random number buffer will increase as the size of the plaintext content increases in parallel processing of a plurality of stream data. In the first and second embodiments, the random numbers are true random numbers, and all random numbers are stored in the random number buffer. However, there is a problem that a large buffer capacity is required accordingly.

  The semiconductor system 10C of the third embodiment is different from the semiconductor system 10A of the first embodiment in that the generated random number itself is not stored in the random number buffer 16-2, but by storing the random number seed. This suppresses the required random buffer size.

  Therefore, the random number generator 16-1a used in the third embodiment is of a type that takes a seed as an initial value of the random number. The random number generator 16-1a proceeds with a round of random number generation using a given seed as a seed. In other words, if a round of random number generation is performed from the same seed, all generated random numbers can be reproduced. That is, if the same seed is given, the same random number can be reproduced.

  In the present embodiment, when outputting from the confidential information processing module 15A, the confidential information CPU 15-1 stores the random number seed in the seed buffer 16-2a prohibited from being read from other than the random number generator 16-1a. . Note that the access from the main CPU 11 is prohibited in the buffer area of the seed buffer 16-2a, and the main CPU 11 cannot read the seed value that is the source of encryption (scramble) or restoration (descramble). .

  Here, the seed value in the seed buffer 16-2a is managed in a table stored in the seed buffer 16-2a as shown in FIG. 8 for each function number N of the function module in which data is finally used. The addresses seed_addr1 to seed_addrN of the seed buffer 16-2a correspond to the functions 1 to N, respectively. That is, the function number corresponds to the seed number (seed address). In the random number generator 16-1a using the seed buffer 16-2a, the same random number value is generated for the same seed. If the seed of which function number (= seed address) is used to determine which random number value of that seed can be determined, the random value for scrambled or removed can also be determined. Such a seed address and a value indicating the number of the seed address can be given from the confidential information CPU 15-1 or an external control unit.

  When performing the data transfer in the random number mode of the DMAC 15-3, the above-mentioned function number is specified at the same time, so that one or more rounds of random number generation using a seed prepared for each function is performed corresponding to the transfer data size, Calculate the exclusive OR with the data to be protected one after another. The calculation result is output as a result of scrambling or decoding. Since the random number generator 16-1a can generate the same random number value again by re-inputting the same seed, the random number value itself is stored by generating the random number every time the random number mode of the DMAC 15-3 is performed. There is no need to do so, and the buffer capacity can be reduced. Here, the correspondence between the address of the system memory 12 to be scrambled and the function number of the seed buffer 16-2a is managed by the table as shown in FIG. 4, as in the first embodiment. In this table, the scrambled start address on the system memory 12 is entered. When starting DMA transfer from an address having an offset from the start, a random number generation process of the number of rounds corresponding to the offset is performed. After skipping the acquisition of random numbers that are not subject to the calculation, exclusive OR is calculated after obtaining the required random numbers.

  Furthermore, in the third embodiment, since there is no random number buffer as in the second embodiment, the buffer data cannot be set to 0 as shown in FIG. Therefore, when it is desired to exclude scrambling, the random number itself must be set to zero. For this purpose, only a part of random numbers to be descrambled is stored or regenerated, and if there is a descrambling request, only part of the data is decrypted using the stored random numbers.

  In order to introduce the control of the scramble target described in the second embodiment, control is performed to set the output of the random number generator 16-1a to 0 in accordance with the format of the plaintext content specified when the DMA is activated. However, if the format is known, only the random value used for the header portion that needs to be excluded from the scramble, for example, is stored only in the confidential information internal memory 15-2, the seed buffer 16-2a, or the confidential information CPU 15-1. A method may be used in which the confidential information processing module 15A performs a service for restoring a part of the scrambled information in the system memory 12 based on a request from the main CPU 11 after being stored in a readable random number buffer or the like. it can.

  According to the third embodiment, when a plurality of stream data are processed in parallel, the required random number buffer area does not increase with an increase in the size of the plaintext content, and the random number buffer can be a small-sized seed buffer. Can be replaced.

[Fourth Embodiment]
FIG. 9 is a block diagram of a semiconductor system according to the fourth embodiment of the present invention. Parts having the same functions as those in the first embodiment will be described with the same reference numerals.
A semiconductor system 10D shown in FIG. 9 includes a main CPU 11, a system memory 12, a video module 13, an audio module 14, a confidential information CPU 15-1, a confidential information internal memory 15-2, and a DMA controller (DMAC) 15. 3, a random number generator 16-1, a random number buffer 16-2, an XOR circuit 17, and a random number management CPU 18.

  The fourth embodiment shown in FIG. 9 shows an example in which a dedicated random number management CPU 18 for controlling the random number generation of the random number generator 16-1 and managing the random number buffer 16-2 is provided. The program and data of the random number management CPU 18 exist in the random number buffer 16-2, and only the random number management CPU 18 can access them.

  After obtaining the plaintext content using the confidential information processing module 15A, the main CPU 11 or the confidential information CPU 15-1 initializes the random number management CPU 18 related to scrambling of the system memory 12. By this initialization, the random number management CPU 18 secures an area necessary for random number or seed value management on the random number buffer 16-2. In addition, in this request, position and size information to be excluded from scramble and format information including these are specified at the same time as necessary. These pieces of management information are managed by the random number management CPU 18 as random number generation identification information. This random number generation identification information is returned to the main CPU 11 directly or via the confidential information CPU 15-1 as a response to the initialization request from the main CPU 11 or confidential information CPU 15-1.

  During normal operation, the scramble requester activates scramble for storing plain text content in the system memory 12 with a random number together with this identification information. After startup, the random number management CPU 18 generates a random number in the random number buffer 16-2 using the identification information. The random number generation is performed by the random number management CPU 18 using the random number generation device 16-1, but the random number management CPU 18 may generate a random number using a software algorithm. At this time, the random number generator 16-1 is not required in this embodiment.

  If identification information having a request for an area to be excluded from scrambling is specified, the random number management CPU 18 sets a part of the random number buffer 16-2 to 0 before calculating the exclusive OR. . In the case of the type using seeds, the random number generated in the round corresponding to the exclusion area is overwritten with 0 in the same manner. The exclusive OR of the generated random number and the plaintext content is calculated by the additional function of the DMAC 15-3 or the random number management CPU 18 according to the setting by the random number management CPU 18.

In addition, for the data transfer and restoration from the scrambled system memory 12, the determination and calculation of the random number information by the identification information is performed in the same manner. However, overwriting with 0 of the random number value depending on the format is not performed again.
Furthermore, if a random number generation function is realized by software random number generation by the random number management CPU 18 and a function for generating a random value of a certain area as 0 is implemented as a software algorithm, a random number generator 16-1 or DMAC 15-3 for format specification It becomes possible to simplify the implementation of the circuit.

  According to the fourth embodiment, by introducing a CPU for random number management, it is possible to perform high-level association and processing between stored random numbers and processing data. In other words, by freely introducing the relationship between modules that use plaintext content and random numbers for scrambling data, including dynamic ones, it is possible to perform complex processing in cooperation with the main CPU side, It is possible to perform control that makes it possible to save the buffer area. Also, random number generation can be performed by the above-described random number management CPU in terms of software, so that the random number generation device can be omitted.

  The present invention described above provides a semiconductor system that protects data written to the system memory in order to protect plaintext contents on the system memory. The semiconductor system includes a random number generator, and stores a random number output from the random number generator or a seed value for generating a random number in a random number buffer area dedicated to the random number generator. Access to the random number buffer area from the main CPU constituting the semiconductor system is prohibited. In the present invention, for protecting confidential information arranged in the system memory, a random number generated in the random number buffer area or a random number generated using a seed stored in the random number buffer area is used. The plaintext content whose protection has been removed by the confidential information processing module is scrambled by taking an exclusive OR with a random number before being output to the system memory. Since the main CPU cannot read the random number or seed value that is the source of the scramble, the plain text content in the system memory can be protected. When using protected (scrambled) data on the system memory, restore the original data by calculating the exclusive OR again with the random number that was exclusive ORed when protecting the plaintext content, Perform necessary processing such as data playback. By permitting the use of random numbers only when transferring data to modules that are permitted to use plaintext, the safety of data protected by the above mechanism is further enhanced. Here, the exclusive OR operation described above is implemented as an additional function of data transfer by a DMA controller (DMAC in FIG. 1) or a random number management CPU (random number management CPU in FIG. 9).

  Advantages of using random numbers to protect plaintext content are that the processing speed is faster than when using an encryption algorithm, and there is no need to consider the block size of the encryption with respect to the size of protection or protection protection. is there. Also, when random numbers are used, even if some random numbers are leaked, the confidential information of the entire system memory will not be in danger immediately, and a cryptographic algorithm that protects all confidential data with one key information is used More resistant to attacks that exploit cryptographic weaknesses. Note that encryption in a normal encryption algorithm indicates scrambling by converting data according to a predetermined rule, but a key is used for encryption and decryption. The key is created based on random numbers. Therefore, confidentiality depends on the confidentiality and management of the key. On the other hand, the random number encryption in the present invention uses the random number itself for encryption (particularly, calculates the exclusive OR with the data to be protected using the true random number), compared with the encryption algorithm. And there is an advantage that high confidentiality can be obtained by simple calculation.

1 is a block diagram showing a semiconductor system according to a first embodiment of the present invention. The flowchart explaining the operation | movement of FIG. The figure explaining the address of the random number buffer of FIG. The figure which shows a random number buffer management table. The block diagram which shows the semiconductor system of the 2nd Embodiment of this invention. The figure which shows the state of the random number buffer after rewriting of FIG. The block diagram which shows the semiconductor system of the 3rd Embodiment of this invention. The figure which shows the seed buffer management table of FIG. The block diagram which shows the semiconductor system of the 4th Embodiment of this invention. The block diagram which shows the structure of the semiconductor system of a prior art.

Explanation of symbols

10A, 10B, 10C, 10D ... Semiconductor system
11 ... Main CPU (control unit)
12 ... System memory (main memory)
13 ... Video module (playback unit)
14 ... Audio module (playback unit)
15A ... Confidential information processing module (confidential information processing section)
15-3 ... DMAC (DMA controller)
16-1, 16-1a ... random number generator (random number generator)
16-2 ... Random number buffer (buffer part)
16-2a ... Seed buffer (buffer part)
17 ... XOR circuit (exclusive OR part)
18. Random number management CPU (random number management control unit)

Claims (5)

A confidential information processing unit capable of inputting protected information, releasing the protection and holding the information;
A random number generator for generating random numbers;
A buffer part for storing the generated random number or a seed for generating the random number;
An exclusive OR operation that protects and restores the information by encrypting the information to be protected by the random number and releasing it by calculating an exclusive OR of the random number and the information to be protected held in the confidential information processing unit. OR part,
A main memory unit for storing information protected by encryption in the exclusive OR unit;
At least a control unit capable of accessing the main memory unit and prohibiting access to the buffer unit, and returning the protected information stored in the main memory unit to the exclusive OR unit, A control unit that controls the reproduction unit to supply information restored by an exclusive OR operation with a random number stored in the buffer unit;
A semiconductor system comprising: A DMA controller that performs data transfer of the buffer unit, the exclusive OR unit, and the main memory unit;
2. The semiconductor system according to claim 1, wherein an exclusive OR operation between the random number and the information to be protected is executed together with DMA transfer of the random number, the information to be protected, and an operation result.   The random number generation by the buffer unit is automatically performed according to a transfer destination address and size set in the DMA controller or a function type of the transfer destination. Semiconductor system. A control unit for random number management for managing the random number;
4. The random number management control unit performs generation of the random number, reservation of a necessary area of the buffer unit and management of a random number storage area, or calculation of an exclusive OR. The semiconductor system according to one.   2. The confidential information processing unit or an external control unit excludes a part of the information to be protected from being scrambled by allowing overwriting of a random number stored in the buffer unit. 5. The semiconductor system according to any one of 1 to 4.

Images