JP2014059635A - Controller and method of preventing data leakage for controller - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a control device and a data leakage prevention method for protecting data that does not flow out data held in an external memory even when a debugger is connected.
A control device includes a microprocessor, a storage unit that holds data including a program executed by the microprocessor, and volatilizes the data when a predetermined command is given, and a debugger that debugs the program 2, a connection detection unit 11 that detects that the debugger 2 is connected to the connection unit 3, and stores a predetermined command when the connection detection unit 11 detects the connection of the debugger 2. And a control unit 5 that gives the unit 7 and volatilizes the data in the storage unit 7.
[Selection] Figure 1

Description

  The present invention relates to a control device including a storage unit and a method for preventing leakage of data stored in the storage unit.

In an embedded system such as a power conversion device, a JTAG (Joint Test Action Group) function is mainly installed as a debugging function.
In various embedded systems as well as general-purpose computer systems such as PCs (Personal Computers), it is important to protect software such as programs and data. However, by using the above-described JTAG, it is possible to freely read out programs and data held in the memory.

  Conventionally, a mechanism has been developed and proposed in which a program or data cannot be read by a third party via a JTAG interface. For example, Patent Document 1 discloses a mechanism in which a security bit is provided in a built-in flash ROM, and by turning on this security bit, the function of the JTAG interface is prohibited and the program held in the flash ROM cannot be read. . Patent Document 2 discloses a mechanism in which, when a debugging device such as ICE is connected to the JTAG interface, a program held in the internal RAM cannot be read by prohibiting access to the internal RAM. .

JP 2002-32267 A. JP 2009-25907 A.

  As described above, protection of programs and data has become important. However, as disclosed in Patent Document 1 and Patent Document 2, a target for preventing reading of programs and data from a JTAG interface has been conventionally used. It is intended for the memory built in the processor. Therefore, it is not intended for an external memory, and it is desired to prevent leakage of programs and data via the JTAG interface even when the external memory is connected to a microprocessor.

  The present invention has been devised in view of the above, and an object of the present invention is to prevent data stored in an external memory or the like from flowing out even when a debugger is connected, that is, a control device and data leakage for protecting data. It is to provide a prevention method.

  The invention according to claim 1 for solving the problem includes a microprocessor, a storage unit that holds data including a program executed by the microprocessor, and volatilizes the data when a predetermined instruction is given; A connection unit for connecting a debugger for debugging a program; a connection detection unit for detecting that the debugger is connected to the connection unit; and when the connection detection unit detects connection of the debugger, the predetermined command And a control unit that volatilizes data stored in the storage unit.

The invention according to claim 2 is the control device according to claim 1, wherein the predetermined command is a command to shift the storage unit to a power-down mode.
According to a third aspect of the present invention, when the predetermined code is given from the microprocessor, the control unit compares the given code with a release code held in advance, and the comparison result is equal. 2. The control device according to claim 1, wherein the output of the predetermined command is canceled.

  According to a fourth aspect of the present invention, the control unit is configured by a programmable device element having an external pin, and when the bit pattern input to the external pin is equal to a release code held in advance, the predetermined command is output. The control device according to claim 1, wherein the control device is released.

  The invention according to claim 5 is a data leakage prevention method of a control device in which data including a program executed by a microprocessor is held in a storage unit having a function of changing a mode, and a debugger for debugging the program When the connection is detected, the storage unit is changed to a power-down mode to volatilize data in the storage unit.

  According to the present invention, when the connection of the debugger is detected, the control unit gives a predetermined command to the storage unit to volatilize the data in the storage unit. For this reason, even when the debugger is connected, it is possible to prevent the data held in the external memory or the like from being leaked, and thus the data held in the external memory or the like can be protected.

The block diagram which shows one Embodiment of the control apparatus which concerns on this invention. The block diagram which shows an example of the control part of the control apparatus which concerns on this invention. 4 is a timing chart showing the refresh operation of the SDRAM. 5 is a timing chart showing the refresh operation of the SDRAM when the debugger according to the present invention is not connected. 6 is a timing chart showing an operation of volatilizing SDRAM data when a debugger according to the present invention is connected.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a block diagram illustrating an example of a control device according to the present invention, and FIG. 2 is a block diagram illustrating an example of a control unit of the control device. Here, the control device refers to, for example, a power conversion device applying power electronics technology.

  In FIG. 1, the control device 1 is connected to a microprocessor 4, a PLD 5, a flash ROM 6, and an SDRAM (Synchronous Dynamic Random Access Memory) 7 via a system bus (address bus 8 and data bus 9). The SDRAM 7 is a synchronous memory that operates in synchronization with a clock. In the present invention, SDR-SDRAM, DDR-SDRAM, DDR2-SDRAM, DDR3-SDRAM and the like are generically named. Input / output signals and commands to / from the SDRAM 7 are standardized by the JEDEC Semiconductor Technology Association (UK: JEDEC Solid State Technology Association).

  The control device 1 has a JTAG port 3 (connection unit) for connecting a debugger 2 (JTAG-ICE (In Circuit Emulator)). The flash ROM 6 holds a program executed by the microprocessor 4, and the program is encrypted in advance. The SDRAM 7 holds a decrypted program obtained by decrypting the encrypted program stored in the flash ROM 6. The microprocessor 4 controls the operation of the entire apparatus with reference to the decrypted program held in the SDRAM 7. Note that the flash ROM 6 and SDRAM 7 include data such as various tables and setting data in addition to programs. As will be described in detail later, the PLD 5 is a programmable device element having an external pin and has a function of protecting data held in the flash ROM 6 and the SDRAM 7. The PLD 5 is also referred to as a control unit.

  The JTAG port 3, the microprocessor 4, and the PLD 5 are connected by a JTAG control signal 10a and a JTAG data input 10b. The JTAG port 3 is connected to the microprocessor 4 through a JTAG data output signal 10c. Further, the microprocessor 4 has lines 10d: control signal READ (read signal), 10e: control signal CSPLD (signal for chip-selecting the PLD), 10k: control signal HOLDREQ (bus release request signal to the microprocessor 4), 10i: It is connected to the PLD 5 via a control signal SDCKE (CK enable input from the microprocessor 4).

  Further, the microprocessor 4 and the external flash ROM 6 are connected by a line 10f: a control signal CSROM (a chip select signal of a memory to be prevented from being read), 10g: a control signal CSRAM (a signal for chip selecting an SDRAM). Further, the microprocessor 4 and the SDRAM 7 are connected by a line 10g: a control signal CSRAM (a signal for chip-selecting SDRAM) and a line 10h: a control signal BUSCLK (a bus clock (SDRAM clock)). The PLD 5 and the SDRAM 7 are connected by a line 10j: a control signal SDCKE2 (CK enable to be output to the SDRAM 7).

  As shown in FIG. 2, the PLD 5 (Programmable Logic Device) has a JTAG connection detection unit 11 (connection detection unit) that detects that the debugger 2 is connected to the JTAG port 3. The PLD 5 includes a software protection function control unit 12 as a function for protecting data held in the SDRAM 7 and the like, and an invalidation determination unit 13 that determines whether to invalidate the function of the software protection function control unit. . The PLD 5 further includes a HOLDREQ output unit 14 that outputs a HOLDREQ signal to the microprocessor 4 and a CKE control unit 15 that receives the SDCKE signal (CK enable) output from the microprocessor 4 and outputs the SDCKE2 signal.

  The JTAG connection detection unit 11 inputs a JTAG control signal and JTAG data, and outputs a connection detection signal. The software protection function control unit receives the connection detection signal output from the JTAG connection detection unit 11 and the invalidation signal from the invalidation determination unit 13 and outputs a protection operation permission signal. The HOLDREQ output unit 14 receives the protection operation permission signal and outputs a HOLDREQ signal to the microprocessor 4. Further, the CKE control unit 15 receives the protection operation permission signal and outputs the SDCKE2 signal to the SRAM 7.

  The operation of the control device 1 having such a configuration will be described in detail below with reference to the timing charts of FIGS. FIG. 3 is a diagram for explaining the operation of the SDRAM 7. CK is a clock input and is the BUSCLK signal of FIG. The SDRAM 7 operates in synchronization with this clock. CKE is a signal for switching to the power-down mode or the self-refresh mode, and corresponds to the SDCKE signal in FIG. The SDCKE signal in FIG. 1 will be described on the assumption that it is directly input to the CKE terminal of the SDRAM 7 in FIG.

  The SDRAM 7 regards the input clock as valid when the CKE signal is asserted (H level), and treats the input clock as invalid when the CKE signal is negated (L level). The SDRAM 7 can suppress power consumption by stopping the clock inside the SDRAM by negating CKE (L level). On the other hand, if left as it is, the contents of the DRAM cell volatilize in about a few seconds at room temperature.

  Therefore, the SDRAM 7 has a self-refresh function so that the contents of the DRAM cell do not volatilize even while CKE is negated. The self-refresh function is performed by giving an SRE (Self Refresh Entry) command to the SDRAM 7 in synchronization with the negation (H → L) of CKE as shown in the timing chart of FIG. On the other hand, the SDRAM 7 cancels the self-refresh function by giving an SRX (Self Refresh Exit) command to the SDRAM 7 in synchronization with CKE assertion (L → H). Note that commands such as SRE and SRX are codes (not shown) that combine control signals (CS / RAS / CAS / WE) supplied to the SDRAM 7.

  In this way, the control device 1 of the present invention utilizes the self-refresh function so that data is not lost even when the SDRAM 7 is in the power-down mode in the normal operation when the debugger is not connected.

  Hereinafter, the data protection function of the control device 1 will be described using the timing charts of FIGS. 4 and 5 and the operation of the PLD 5. 4 and 5 are the same as the signals shown in FIG. 2, but the commands are the same as the commands shown in FIG.

"Operation when debugger 2 is not connected"
When the debugger 2 is not connected to the JTAG port 2, the JTAG connection detection unit 11 of the PLD 5 negates (L) the connection detection signal 10l. When the connection detection signal 101 is negated, the software protection function control unit 12 negates the protection operation permission signal 10n. When the protection operation permission signal 10n is negated, the CKE control unit 15 outputs the SDCKE signal 10i received from the microprocessor 4 as it is as the SDCKE2 signal 10j. In FIG. 4, since the debugger 2 is not connected to the JTAG port 2, the protection operation permission signal 10n is negated, the SDCKE2 signal 10j is asserted when the SDCKE signal 10i is asserted, and is negated when the SDCKE signal 10i is negated. doing.

Thus, when the debugger is not connected to the control device 1 and the protection operation permission signal 10n is negated, the SDCKE signal 10i and the SDCKE2 signal 10j operate in conjunction with each other.
In FIG. 4, the SRE command and the SRX command are given in synchronism with changes in the SDCKE signal 10i and the SDCKE2 signal 10j as in FIG. For this reason, the contents of the DRAM cell do not volatilize. Therefore, the microprocessor 4 can normally read programs and work variables from the flash ROM 6 and the SDRAM 7. By doing so, the microprocessor 4 can execute software processing in accordance with a computer program stored in the SDRAM 7, for example.

"Operation when debugger 2 is connected"
On the other hand, when the debugger 2 is connected to the JTAG port 2, the JTAG connection detection unit 11 of the PLD 5 asserts (H) the connection detection signal 10l. When the connection detection signal 101 is asserted, the software protection function control unit 12 asserts the protection operation permission signal 10n. When the protection operation permission signal 10n is asserted, the CKE control unit 15 forcibly negates the SDCKE2 signal 10j regardless of the state of the SDCKE signal 10i and puts the SDRAM in the power down mode. When the SDCKE2 signal 10j is negated, the SDRAM cell is volatilized within a few seconds, and the data held in the SDRAM 7 becomes indefinite. Accordingly, the microprocessor 4 cannot normally read the program and work variables from the SDRAM 7. By doing so, the present invention can prevent outflow of regular data stored in the SDRAM 7 (that is, data can be protected).

  In FIG. 5, as the debugger 2 is connected to the JTAG port 2, the protection operation permission signal 10n is asserted in the middle, and the SDCKE2 signal 10j is negated in conjunction with this. When the protection operation permission signal 10n is asserted in this way, the SDCKE2 signal 10j is forcibly negated regardless of the state of the SDCKE signal 10i. Therefore, the data held in the SDRAM 7 is volatilized. In the present invention, it is assumed that the debugger 2 is connected when the microprocessor 4 is not operating (for example, before starting the control device 1). That is, the SRE command is not issued when the debugger 2 is connected.

  Next, the operation for releasing data protection will be described. The operation when the debugger 2 is connected is the same as described above, but the data protection state can be canceled if a predetermined condition is satisfied. That is, the invalidation determination unit 13 (FIG. 2) compares a predetermined bit pattern (cancellation code preset in PLD5) with a bit pattern set in an external pin of PLD5, and invalidates if they match. Assert the enable signal 10m. Alternatively, the invalidation determination unit 13 (FIG. 2) as another method compares the above-described predetermined bit pattern with the value (bit pattern) written by the user in the internal register of the PLD 5 via the debugger 2; If they match, the invalidation signal 10m is asserted.

  When the invalidation signal 10m is asserted, the software protection function control unit 12 negates the protection operation permission signal 10n. With the negation of the protection operation permission signal 10n, the SDCKE2 signal 10j is linked with the SDCKE10i. The subsequent operation is the same as when the debugger 2 is not connected. That is, the contents of the DRAM cell are not volatilized. Therefore, the microprocessor 4 can normally read the program and work variables from the flash ROM 6 and the SDRAM 7. By releasing the data protection in this way, the microprocessor 4 can execute software processing according to a computer program stored in the SDRAM 7, for example.

  The control device 1 described above is described as protecting data by shifting the SDRAM 7 to the power-down mode and releasing the self-refresh function (volatilizing the data). Alternatively, the present invention can make use of the HOLDREQ signal of the microprocessor 4. In this method, when the debugger 2 is connected, the HOLDREQ signal is asserted to the microprocessor 4 and the bus use right of the microprocessor 4 is revoked.

  That is, as another method of the present invention, the movement of the PLD 5 is as follows. When the debugger 2 is connected to the JTAG port 2, the JTAG connection detection unit 11 asserts the connection detection signal 10 l, and accordingly, the software protection function control unit 12 asserts the protection operation permission signal 10 n. Based on the assertion of the protection operation permission signal 10n, the HOLDREQ output unit asserts the HOLDREQ signal 10k and supplies it to the microprocessor 4. By doing so, the microprocessor 4 releases the address bus 8 and the data bus 9, so that the microprocessor 4 does not access the flash ROM 6 or the SDRAM 7. Even if such another method is adopted, the present invention can realize data protection.

  Conversely, when the debugger 2 is not connected to the JTAG port 2, the HOLDREQ signal 10k is negated. Accordingly, since the microprocessor 4 can acquire the right to use the bus, the microprocessor 4 can execute access to the flash ROM 6 and the SDRAM 7.

  The “predetermined instruction” in the present invention refers to a signal input to the CKE terminal of the SDRAM 7, that is, a signal intended for mode switching of the SDRAM 7.

DESCRIPTION OF SYMBOLS 1 ... Control apparatus, 2 ... Debugger, 3 ... JTAG port, 4 ... Microprocessor, 5 ... PLD (control part), 6 ... External flash ROM, 7 ... SDRAM, 11 ... JTAG connection detection part, 12 ... Software protection function Control part, 13 ... invalidation determination part, 14 ... HOLDREQ output part, 15 ... CKE control part.

Claims (5)

A microprocessor;
A storage unit that holds data including a program executed by the microprocessor and volatilizes the data when given a predetermined command;
A connection for connecting a debugger for debugging the program;
A connection detection unit for detecting that the debugger is connected to the connection unit;
When the connection detection unit detects the connection of the debugger, the control unit that gives the predetermined command to the storage unit and volatilizes the data in the storage unit;
A control device comprising:   The control device according to claim 1, wherein the predetermined command is a command to shift the storage unit to a power down mode. The controller is
When a predetermined code is given from the microprocessor, the given predetermined code is compared with a release code held in advance, and when the comparison result is equal, the output of the predetermined command is canceled. The control device according to claim 1, wherein: The controller is
The output of the predetermined command is released when the bit pattern input to the external pin is equal to a release code held in advance, and is configured by a programmable device element having an external pin. Control device. A data leakage prevention method for a control device in which data including a program executed by a microprocessor is held in a storage unit having a function of changing a mode
A data leakage prevention method comprising: when detecting that a debugger for debugging the program is connected, changing the storage unit to a power-down mode and volatilizing data in the storage unit.

Images