JP7057675B2 - Semiconductor device and encryption key generation method - Google Patents

Description

The present invention relates to a semiconductor device, particularly a semiconductor device including a storage unit for storing an encryption key for encrypting data, and a method for generating an encryption key.

Currently, semiconductor devices including microcomputers that have the function of encrypting data using an encryption key and restoring the original data by decrypting the encrypted encrypted data using this encryption key are available. It is known (see, for example, Patent Document 1).

The semiconductor device is provided with an EEPROM (Electrically Erasable Programmable Read-Only Memory) as a memory for storing an encryption key.

Japanese Unexamined Patent Publication No. 2014-89640

By the way, the encryption key must not be leaked to a third party, but the encryption key stored in the memory is illegally read by an unauthorized access such as a physical attack or physical analysis from the outside. There was a risk. At this time, the above-mentioned encrypted data is decrypted by the illegally acquired encryption key, which causes data leakage.

Therefore, an object of the present invention is to provide a semiconductor device capable of preventing data leakage due to unauthorized access, and a method for generating an encryption key.

The semiconductor device according to the present invention is a semiconductor device that encrypts data using an encryption key, and includes a random number generation unit that generates a random number and a scramble key generation unit that generates a scramble key whose value changes with the passage of time. , The key holding that scrambles the random number using the scramble key is held as a scrambled encryption key, and outputs the scrambled encryption key descrambled using the scramble key as an encryption key in response to a read request. The key holding unit repeats the process of holding the scrambled encryption key scrambled with the scrambled key as a new scrambled encryption key at predetermined intervals .

Further, the method for generating an encryption key according to the present invention is a method for generating an encryption key used for encrypting data, in which a scramble key whose value changes with the passage of time is generated and a random number is scrambled with the scramble key. Is held in the memory as a scrambled encryption key, and the scrambled encryption key is retained in the memory as a new scrambled encryption key by repeating the process of holding the scrambled encryption key in the memory at predetermined intervals , in response to a read request. Then, the scrambled encryption key held in the memory is descrambled using the scrambled key to obtain an encryption key.

In the present invention, the key holding unit holds a scrambled random number as a scrambled encryption key, and holds the held scrambled encryption key itself scrambled at predetermined intervals as a new scrambled encryption key.

As a result, the scrambled encryption key held in the key holder is scrambled repeatedly at predetermined intervals, and its value changes with the passage of time. Therefore, even if the scrambled encryption key held in the key holding unit is leaked due to unauthorized access from the outside, it is difficult to identify the encryption key itself from this scrambled encryption key. Therefore, it is possible to prevent the leakage of plaintext data even if unauthorized access is performed.

It is a block diagram which shows the structure of the microcomputer 100 as an example of the semiconductor device which concerns on this invention. It is a block diagram which shows the state of the data transfer in the 1st stage performed in the microcomputer 100 when the data is encrypted. It is a block diagram which shows the state of the data transfer in the 2nd stage performed in the microcomputer 100 when the data is encrypted. It is a block diagram which shows the state of the data transfer in the 3rd stage performed in the microcomputer 100 when the data is encrypted. It is a block diagram which shows the state of the data transfer in the 4th stage performed in the microcomputer 100 when the data is encrypted. It is a block diagram which shows the state of the data transfer in the 5th stage performed in the microcomputer 100 when the data is encrypted. It is a block diagram which shows an example of the internal structure of a key storage 22. It is a flowchart which shows the procedure of the holding operation of the encryption key performed in the key storage 22. It is a flowchart which shows the procedure of the reading operation of the encryption key performed in the key storage 22. It is a block diagram which shows the modification of the internal structure of a microcomputer 100. It is a block diagram which shows another example of the internal structure of a key storage 22. FIG. 3 is a block diagram showing a state of data transfer in the first stage performed in the microcomputer 100 shown in FIG. 10 when data is encrypted. It is a block diagram which shows the state of the data transfer in the 2nd stage performed in the microcomputer 100 shown in FIG. 10 when the data is encrypted. It is a block diagram which shows the state of the data transfer in the 3rd stage performed in the microcomputer 100 shown in FIG. 10 when the data is encrypted. It is a block diagram which shows the state of the data transfer in the 4th stage performed in the microcomputer 100 shown in FIG. 10 when the data is encrypted. It is a block diagram which shows the state of the data transfer at the 5th stage performed in the microcomputer 100 shown in FIG. 10 when the data is encrypted. It is a block diagram which shows the state of the data transfer in the 6th stage performed in the microcomputer 100 shown in FIG. 10 when the data is encrypted.

FIG. 1 is a block diagram showing a configuration of a microcomputer 100 included in the semiconductor device according to the present invention.

The microcomputer 100 includes a cryptographic processing unit 12, a random number generation unit 13, a CPU (central processing unit) 14, a RAM (random access memory) 15, a ROM (read only memory) control unit 16, a ROM 17, a secure RAM 19, a secure ROM 20, and a secure. It has a DMAC (direct memory access controller) 21 and a key storage 22.

Further, the microcomputer 100 includes two data buses BS1 and BS8. The microcomputer 100 is capable of data communication with an externally connected device, and transmits or receives various data via the data bus BS1.

The encryption processing unit 12, the random number generation unit 13, the CPU 14, the RAM 15, the ROM control unit 16, the ROM 17, the secure RAM 19, and the key storage 22 are connected to the data bus BS1.

The data bus BS8 is an independent bus that is not connected to the data bus BS1 and is inaccessible from the outside of the microcomputer 100. The data bus BS8 is connected to a random number generation unit 13, a secure RAM 19, a secure ROM 20, a secure DMAC 21, a key storage 22, and an encryption processing unit 12, which are required to be confidential.

The encryption processing unit 12 obtains an encrypted data piece by encrypting the unencrypted plaintext data piece received via the data bus BS1 with an encryption key, and sends the encrypted data piece to the data bus BS1. Further, the encryption processing unit 12 restores the plaintext data piece before encryption by decrypting the encrypted data piece received via the data bus BS1 using this encryption key. The encryption processing unit 12 acquires an encryption key from the key storage 22 before executing such an encryption or decryption process.

The random number generation unit 13 generates a random number whose random number value changes at a predetermined fixed cycle, and sends the random number to the data bus BS8.

The CPU 14 is a central processing unit of the microcomputer 100, and performs various operations or data transfer according to a program stored in the ROM 17.

The RAM 15 is a storage element capable of writing data, and the CPU 14 writes or reads data.

The ROM control unit 16 writes data to the ROM 17, verifies whether or not the data is correctly written, erases the written data, and the like. Further, the ROM control unit 16 makes a write request to the secure DMAC 21.

Program data representing a program executed by the CPU 14 is written in the ROM 17.

The secure RAM 19 stores data received via the data bus BS8 in response to a data write access from the secure DMAC21. Further, the secure RAM 19 reads the data stored in itself in response to the data read access from the secure DMAC 21, and sends the data to the data bus BS8. Further, the secure RAM 19 stores the data received via the data bus BS1 in response to the data write access from the CPU 14. The secure RAM 19 does not accept data read access from the CPU 14.

The secure ROM 20 reads the data stored in the secure ROM 20 in response to the data read access from the secure DMAC 21, and sends the data to the data bus BS8. Further, the secure ROM 20 writes the data received by the secure DMAC 21 via the data bus BS8 when the ROM control unit 16 makes a write request to the secure DMAC 21.

The secure DMAC 21 transfers data between the encryption processing unit 12, the random number generation unit 13, the secure RAM 19, the secure ROM 20, the secure DMAC 21, and the key storage 22 via the data bus BS8.

The key storage 22 generates a scrambled encryption key obtained by scrambling the random numbers generated by the random number generation unit 13, and holds the scrambled encryption key. Further, the key storage 22 reads the held scrambled encryption key in response to the request to read the encryption key, and sends the descrambling applied to the scrambled encryption key to the data bus BS8 as the encryption key. ..

With the above configuration, the microcomputer 100 performs various data processing including encryption and decryption processing of plaintext data using the above-mentioned encryption key according to the program stored in the ROM 17.

Hereinafter, the operation for encrypting the plaintext data stored in the RAM 15 will be described with reference to FIGS. 2 to 6.

First, the secure DMAC 21 transfers the random number generated by the random number generation unit 13 to the key storage 22 via the data bus BS8 as shown by the thick line arrow in FIG. The key storage 22 holds a scrambled random number as a scrambled encryption key.

Next, the secure DMAC 21 makes a request to read the encryption key from the key storage 22, and the encryption key transmitted from the key storage 22 is secured via the data bus BS8 as shown by the thick line arrow in FIG. Transfer to RAM 19. As a result, the secure RAM 19 stores the encryption key.

Next, the secure DMAC 21 reads out the encryption key stored in the secure RAM 19 and transfers the encryption key to the secure ROM 20 via the data bus BS8 as shown by the thick arrow in FIG. As a result, the secure ROM 20 writes the encryption key. That is, every time the encryption processing unit 12 performs encryption, the encryption key used for the encryption is added to the secure ROM 20. Therefore, the history of the used encryption key remains in the secure ROM 20.

Next, the secure DMAC 21 reads out the encryption key stored in the secure RAM 19 and transfers the encryption key to the encryption processing unit 12 via the data bus BS8 as shown by the thick line arrow in FIG. Further, the CPU 14 reads out the plaintext data piece stored in the RAM 15, and transfers the plaintext data piece to the encryption processing unit 12 via the data bus BS1 as shown by the thick line arrow in FIG. The encryption processing unit 12 generates an encrypted data piece by encrypting the transferred plaintext data using the transferred encryption key, and sends the encrypted data piece to the data bus BS1.

Next, the CPU 14 transfers the encrypted data piece generated by the encryption processing unit 12 to the RAM 15 via the data bus BS1 as shown by the thick arrow in FIG. As a result, the RAM 15 stores the transferred encrypted data piece.

In this way, in encrypting the plaintext data, first, as shown in FIG. 2, the secure DMAC 21 transfers the random numbers generated by the random number generation unit 13 to the key storage 22 in the microcomputer 100. At this time, the key storage 22 holds the scrambled random number as a scrambled encryption key. Then, the secure DMAC 21 reads the descrambled encryption key from the key storage 22, stores the encryption key in the secure RAM 19 and the secure ROM 20 as shown in FIGS. 3 and 4, and then stores the encryption key in the secure RAM 19 and the secure ROM 20 as shown in FIG. Is transferred to the encryption processing unit 12.

When decrypting the encrypted data piece stored in the RAM 15 into the original plaintext data piece, the CPU 14 reads the encrypted data piece from the RAM 15 and reads the encrypted data piece from the RAM 15 via the data bus BS1 in the encryption processing unit 12. Transfer to. Further, the secure DMAC 21 reads the encryption key used for encrypting the plaintext data piece from the secure RAM 19 and transfers the encryption key to the encryption processing unit 12 via the data bus BS8. Therefore, the encryption processing unit 12 obtains a plaintext data piece by decrypting the transferred encrypted data piece using the transferred encryption key.

Further, when the encrypted data piece is transmitted to an external device connected to the microcomputer 100, the encryption key corresponding to the encrypted data piece is transmitted together with the encrypted data piece according to a predetermined algorithm.

By the way, the key storage 22 adopts the following configuration in order to prevent leakage of the encryption key due to unauthorized access from the outside.

FIG. 7 is a block diagram showing an example of the internal configuration of the key storage 22.

As shown in FIG. 7, the key storage 22 has a scramble key generation unit 213, a scramble processing unit 214, a storage RAM 215, a register 216, and a timer 217.

The scramble key generation unit 213 generates a random number whose random number value changes with the passage of time as a scramble key SKY, and supplies this to the scramble processing unit 214.

The scramble processing unit 214 takes in the scramble key SKY when the random number generated by the random number generation unit 13 is received via the data bus BS8, and performs a scramble operation (for example, exclusive OR) using this scramble key SKY. Apply to the above random numbers. Then, the scramble processing unit 214 uses the result obtained by the scramble operation as the scramble encryption key SEK, and holds it in the storage RAM 215 in association with the scramble key SKY described above.

Further, the scramble processing unit 214 reads the scramble encryption key SEK held in the storage RAM 215 in response to the timeout signal Tout, and also takes in the scramble key SKY generated by the scramble key generation unit 213. Here, the scramble processing unit 214 generates a new scramble encryption key SEK by performing a scramble operation using the captured scramble key SKY on the scramble encryption key SEK read from the storage RAM 215. Then, the scramble processing unit 214 holds the new scrambled encryption key data SEK in the storage RAM 215 in association with the scramble key SKY.

Further, the scramble processing unit 214 first reads the scrambled encryption key SEK held in the storage RAM 215 and the scrambled key SKY associated with the scrambled encryption key SEK in response to the encryption key read request. .. Next, the scramble processing unit 214 restores the encryption key by performing a descramble operation on the scrambled encryption key SEK using the scramble key SKY, and sends the encryption key to the data bus BS8.

The register 216 holds an operation start signal or an operation stop signal received via the data bus BS1. When the register 216 holds the operation start signal, the register 216 supplies the operation start signal ST for starting the counting operation of the timer 217 to the timer 217. On the other hand, when the operation stop signal is held, the register 216 supplies the operation stop signal STP for stopping the counting operation of the timer 217 to the timer 217.

When the timer 217 receives the clock signal and the operation start signal ST is supplied, the timer 217 starts counting the number of pulses of the clock signal. Here, the timer 217 supplies the timeout signal Tout to the scramble processing unit 214 when the count number reaches a predetermined value. After supplying the timeout signal Tout to the scramble processing unit 214, the timer 217 continues counting the number of pulses of the clock signal from the initial value (for example, zero). That is, the timer 217 supplies the timeout signal Tout to the scramble processing unit 214 at predetermined intervals. When the timer 217 receives the operation stop signal STP, the timer 217 stops the above-mentioned counting operation.

The operation of holding and reading the encryption key performed inside the key storage 22 having the configuration shown in FIG. 7 will be described below.

FIG. 8 is a flowchart showing the procedure of the encryption key holding operation performed in the key storage 22 according to the operation start signal received from the CPU 14 via the data bus BS1. The CPU 14 supplies an operation start signal to the key storage 22 via the data bus BS1 in response to, for example, turning on the power.

First, the register 216 of the key storage 22 supplies the operation start signal ST to the timer 217 to start the counting operation of the timer 217 (step S31). As a result, the timer 217 counts the number of pulses of the clock signal from the initial value.

During this time, the scramble processing unit 214 determines whether or not the timeout signal Tout is supplied from the timer 217 (step S32). The timer 217 supplies the timeout signal Tout to the scramble processing unit 214 when the count number reaches a predetermined value.

When it is determined in step S32 that the timeout signal Tout is not supplied, the scramble processing unit 214 continuously determines whether or not the timeout signal Tout has been supplied.

When it is determined in step S32 that the timeout signal Tout has been supplied, the scramble processing unit 214 reads out the scramble encryption key held in the storage RAM 215 and captures the scramble encryption key, and captures the scramble key SKY (step S33).

Next, the scramble processing unit 214 generates a new scrambled encryption key SEK by performing a scramble operation on the captured scrambled encryption key using the captured scrambled key as described above (step S34).

Next, the scramble processing unit 214 associates the scramble encryption key SEK generated in step S34 with the scramble key SKY used in the scramble operation and holds them in the storage RAM 215 (step S35).

Next, the timer 217 determines whether or not the operation stop signal STP is supplied from the register 216 (step S36).

If it is determined in step S36 that the operation stop signal STP is not supplied, the timer 217 continues the operation of counting the pulse of the clock signal. As a result, the scramble processing unit 214 returns to step S32 described above, and executes the operations of steps S32 to S35 described above again.

Therefore, the scrambled encryption key obtained by scrambling the encryption key is held in the storage RAM 215, and the scrambled encryption key itself held at predetermined intervals is held in the storage RAM 215 as a new scrambled encryption key. The predetermined period, that is, the period from the time when the timer 217 starts counting from the initial value to the time when the timeout signal Tout is transmitted is shorter than the random number change cycle (constant cycle) in the random number generation unit 13. This makes it possible to scramble a single random number generated by the random number generation unit 13 a plurality of times.

Here, when the operation of the key storage 22 is stopped, the CPU 14 supplies an operation stop signal prompting to that effect to the key storage 22 via the data bus BS1. Upon receiving such an operation stop signal, the register 216 of the key storage 22 holds the operation stop signal and supplies the operation stop signal STP to the timer 217. As a result, the operation of holding the encryption key by the key storage 22 is stopped.

The scramble processing unit 214 reads out all the scrambled encryption keys and the scrambled keys held in the storage RAM 215 in response to the power cutoff, and sends them to the data bus BS8. At this time, the secure DMAC 21 transfers all the scrambled encryption keys and the scrambled keys transmitted to the data bus BS8 to the secure ROM 20. Therefore, in response to the power cutoff of the microcomputer 100, all the scrambled encryption keys and scrambled keys held in the storage RAM 215 are written in the secure ROM 20.

FIG. 9 is a flowchart showing the procedure of the encryption key reading operation performed in the key storage 22 in response to the encryption key reading request received from the secure DMAC 21 via the data bus BS8.

First, the scramble processing unit 214 reads out a desired scrambled encryption key from the storage RAM 215 (step S41), and subsequently reads out the scrambled key associated with the scrambled encryption key (step S42).

Next, the scramble processing unit 214 restores the encryption key by performing a descramble operation using the scramble key on the read scramble encryption key to descramble it (step S43).

Then, the scramble processing unit 214 transmits the restored encryption key via the data bus BS8 (step S44).

As described above, the key storage 22 holds a scrambled random number generated by the random number generation unit 13 as a scrambled encryption key. After that, the key storage 22 scrambles the held scrambled encryption key itself at predetermined intervals and holds it as a new scrambled encryption key (S32 to S36).

Further, the key storage 22 first reads the held scrambled encryption key (S41), and then reads out the scrambled key corresponding to the scrambled encryption key (S42) in response to the encryption key read request. Then, the key storage 22 restores the encryption key by descramble the scrambled encryption key using the scramble key (S43), and outputs this.

As described above, since the scrambled encryption key held in the key storage 22 itself is repeatedly scrambled at predetermined intervals, its value changes with the passage of time. Therefore, even if the scrambled encryption key held in the key storage 22 is leaked due to unauthorized access from the outside, the encryption key itself cannot be specified from this scrambled encryption key. Further, the secure RAM 19 and the secure ROM 20 in which the used encryption key is written are not the data bus BS1 that can be accessed from the outside of the microcomputer 100, but the encryption key is read out via the data bus BS8 that cannot be accessed externally. Is done.

Therefore, even if unauthorized access is performed, it is possible to prevent leakage of plaintext data operated by the microcomputer 100.

In the microcomputer 100 shown in FIG. 1, the data bus BS8 which is not connected to the CPU 14 and cannot be accessed externally is used separately from the data bus BS1 which is connected to the CPU 14 and can be accessed externally. We operate high encryption keys.

However, even if only the data bus BS1 is used as the data bus used in the microcomputer 100, it is possible to operate the encryption key with high confidentiality.

FIG. 10 is a block diagram showing a modified example of the internal configuration of the microcomputer 100 made in view of this point.

In the microcomputer 100 shown in FIG. 10, the data bus BS8 is omitted from the configuration shown in FIG. 1, and the bus master enable signal BSE is supplied to each module (12 to 17, 19 to 22). The bus master enable signal BSE is, for example, a binary signal representing one of a logic level 1 representing an enable state and a logic level 0 representing an disabled state.

When the bus master enable signal BSE represents an disabled state, the encryption processing unit 12, the CPU 14, the RAM 15, the ROM control unit 16 and the ROM 17 are connected to the data bus BS1. At this time, the random number generation unit 13, the secure RAM 19, the secure ROM 20, the secure DMAC 21, and the key storage 22 are disconnected from the data bus BS1.

On the other hand, when the bus master enable signal BSE represents the enable state, the encryption processing unit 12, the random number generation unit 13, the secure RAM 19, the secure ROM 20, the secure DMAC 21, and the key storage 22 are connected to the data bus BS1. When the bus master enable signal BSE indicates the enable state, the CPU 14, the RAM 15, the ROM control unit 16 and the ROM 17 are disconnected from the data bus BS1.

Except for the above points, the configurations of the modules (12 to 17, 19 to 22) included in the microcomputer 100 shown in FIG. 10 are the same as those shown in FIG.

FIG. 11 is a block diagram showing an internal configuration of the key storage 22 used in the microcomputer 100 having the configuration shown in FIG. In the configuration shown in FIG. 11, the other configurations and their operations except that the bus connection portion 210 is newly provided are the same as those described with reference to FIGS. 7 to 9.

The bus connection unit 21 receives the bus master enable signal BSE, and when the bus master enable signal BSE represents an enable state, the bus master enable signal BSE connects the scramble processing unit 214 and the register 216 to the data bus BS1. On the other hand, when the bus master enable signal BSE represents an disabled state, the bus connection unit 21 cuts off the connection between the scramble processing unit 214 and the register 216 and the data bus BS1.

It should be noted that the bus connection to other modules (12 to 17, 19 to 21) other than the key storage 22 also switches the connection state (connection or disconnection) with the data bus BS1 as described above according to the bus master enable signal BSE. The part is included. However, the encryption processing unit 12 is always connected to the data bus BS1 regardless of the contents of the bus master enable signal BSE (enabled state, disable state).

Hereinafter, the operation of encrypting the plaintext data piece stored in the RAM 15 in the microcomputer 100 having the configurations shown in FIGS. 10 and 11 will be described with reference to FIGS. 12 to 17.

First, the bus master enable signal BSE is set to the enabled state. As a result, among the modules (12 to 17, 19 to 22), the encryption processing unit 12, the random number generation unit 13, the secure RAM 19, the secure ROM 20, the secure DMAC 21, and the key storage 22 are connected to the data bus BS1. .. Here, the secure DMAC 21 transfers the random number generated by the random number generation unit 13 to the key storage 22 via the data bus BS1 as shown by the thick line arrow in FIG. At this time, the key storage 22 holds a scrambled random number as a scrambled encryption key.

Next, the secure DMAC 21 makes a request to read the encryption key from the key storage 22, and the encryption key read from the key storage 22 is transmitted via the data bus BS1 as shown by the thick line arrow in FIG. And transfer to the secure RAM 19. As a result, the secure RAM 19 stores the encryption key.

Next, the secure DMAC 21 reads out the encryption key stored in the secure RAM 19 as described above, and transfers the encryption key to the secure ROM 20 via the data bus BS1 as shown by the thick line arrow in FIG. As a result, the secure ROM 20 writes the encryption key. That is, every time the encryption processing is performed by the encryption processing unit 12, the encryption key used in the encryption processing is added to the secure ROM 20. Therefore, the history of the used encryption key remains in the secure ROM 20.

Next, the secure DMAC 21 reads out the encryption key stored in the secure RAM 19 and transfers the encryption key to the encryption processing unit 12 via the data bus BS1 as shown by the thick line arrow in FIG.

Next, as shown in FIG. 16, the bus master enable signal BSE is set to the disabled state. As a result, among the modules (12 to 17, 19 to 22), the encryption processing unit 12, the CPU 14, the RAM 15, the ROM control unit 16 and the ROM 17 are connected to the data bus BS1. Here, the CPU 14 reads out the plaintext data piece stored in the RAM 15, and transfers the plaintext data piece to the encryption processing unit 12 via the data bus BS1 as shown by the thick line arrow in FIG. The encryption processing unit 12 generates an encrypted data piece by encrypting the transferred plaintext data using the transferred encryption key.

Then, as shown in FIG. 17, the bus master enable signal BSE is set to the enable state again, and the secure DMAC 21 indicates the encrypted data piece generated by the encryption processing unit 12 as shown by the thick arrow in FIG. Transfer to RAM 15 via the data bus BS1. As a result, the RAM 15 stores the transferred encrypted data piece.

As described above, when the configuration shown in FIG. 10 is adopted as the microcomputer 100, the data bus BS8 becomes unnecessary. Therefore, as compared with the case where the configuration shown in FIG. 1 is adopted, the area for constructing the microcomputer 100 It is possible to reduce the area.

In the above embodiment, the key storage 22 including the storage RAM 215, that is, a volatile semiconductor memory is used as a key holding unit for holding a scrambled encryption key, but the key holding unit is a non-volatile memory or a non-volatile memory. It may be a magnetic or optical recording medium.

In short, the microcomputer 100 having a data encryption function may include the following random number generation unit and key holding unit.

That is, the key holding unit (22) holds the random number generated by the random number generation unit (13) scrambled with the scramble key (SKY) as the scrambled encryption key (SEK). At this time, the key holding unit (22) holds the scrambled encryption key scrambled with the scrambled key at predetermined intervals as a new scrambled encryption key. Further, the key holding unit (22) outputs the scrambled encryption key held by the scrambled key as an encryption key in response to a read request.

12 Cryptographic processing unit 13 Random number generation unit 22 Key storage 213 Scramble key generation unit 214 Scramble processing unit 215 Storage RAM

Claims (8)

A semiconductor device that encrypts data using an encryption key.
A random number generator that generates random numbers, and a random number generator
A scramble key generator that generates a scramble key whose value changes over time,
A key holding unit that holds the random number scrambled using the scramble key as a scrambled encryption key, and outputs the scrambled encryption key descrambled using the scrambled key as an encryption key in response to a read request. And have
The key holder is
A semiconductor device characterized in that a process of holding a scrambled encryption key scrambled with the scrambled key as a new scrambled encryption key is repeated at predetermined intervals . The key holder is
With memory
The random number scrambled with the scramble key is held in the memory as the scramble encryption key, and the scramble key generated by the scramble key generation unit and the scramble key held in the memory are held every predetermined period. Claim 1 is characterized by including a scramble processing unit that captures the scrambled encryption key, scrambles the captured scrambled encryption key with the captured scrambled key, and holds the scrambled encryption key in the memory as a new scrambled encryption key. The semiconductor device described in. The random number generation unit generates the random number whose random number value changes at a predetermined fixed cycle, and generates the random number.
The semiconductor device according to claim 1 or 2, wherein the predetermined period is shorter than the fixed period. The ROM where the program is stored and
A CPU that controls according to the program
RAM and
An encryption processing unit that encrypts data based on the encryption key,
The semiconductor device according to any one of claims 1 to 3, further comprising a DMAC (direct memory access controller) that controls writing and reading to the key holding unit. A first data bus to which the ROM, the CPU, the RAM, and the encryption processing unit are connected.
The random number generation unit, the key holding unit, the DMAC, and a second data bus to which the encryption processing unit is connected are included.
Plaintext data pieces are stored in the RAM.
The CPU transfers the plaintext data piece stored in the RAM to the encryption processing unit via the first data bus.
The DMAC transfers the encryption key read from the key holding unit by the read request to the encryption processing unit via the second data bus.
The encryption processing unit generates an encrypted data piece in which the plaintext data piece received via the first data bus is encrypted with the encryption key received via the second data bus. The semiconductor device according to claim 4, wherein the data is sent to the data bus of 1. Including the first data bus
Receives a bus master enable signal indicating enable or disable
When the bus master enable signal represents the enable, the random number generation unit, the key holding unit, the DMAC, and the encryption processing unit are connected to the first data bus, and the bus master enable signal represents the disable. The semiconductor device according to claim 4, wherein in the case, the ROM, the CPU, the RAM, and the encryption processing unit are connected to the first data bus. Plaintext data pieces are stored in the RAM.
With the bus master enable signal set to a state representing the disable, the CPU transfers the plaintext data piece stored in the RAM to the encryption processing unit via the first data bus.
With the bus master enable signal set to a state representing the enable, the DMAC transfers the encryption key read from the key holding unit by the read request to the encryption processing unit via the first data bus. Transfer and
The encryption processing unit generates an encrypted data piece in which the plaintext data piece received via the first data bus is encrypted with the encryption key received via the first data bus. The semiconductor device according to claim 6, which is characterized. A method of generating an encryption key used to encrypt data.
Generates a scramble key whose value changes over time,
A process of holding a random number scrambled with the scramble key in the memory as a scrambled encryption key and holding the scrambled encryption key scrambled with the scrambled key in the memory as a new scrambled encryption key is performed every predetermined period. While doing it repeatedly
A method for generating an encryption key, which comprises obtaining an encryption key by descrambled the scrambled encryption key held in the memory in response to a read request using the scrambled key.

Images