JPH02155034A - Computer with security function - Google Patents

Abstract

PURPOSE:To prevent the contents of a program or data from being decoded even when they leak out by providing an enciphering means and an encipherment restoring means. CONSTITUTION:A central processing unit 1 provides an arithmetic part 10, a control part 11, an enciphering/restoring part 12, and a key storing part 13, and the program and data are stored into a storage device 2. The enciphering/ restoring part 12 provides a function, which restores a value so that the arithmetic part 10 may interprete an enciphered instruction and the enciphered data on the storage device 2 with the use of a key, and a function, which encipheres the arithmetic result of the arithmetic part 10 with the use of the key at the time of writing into the storage device 2 and stores it to the storage device 2. Thus, even when the program or data in the storage device leak out, the contents of them can be prevented from being decoded, and the confidentiality of the program or the data can be improved.

Description

DETAILED DESCRIPTION OF THE INVENTION [Object of the Invention] (Field of Industrial Application) The present invention relates to a computer with a security function that prevents programs and data from being stolen.

(Prior Art) As shown in FIG. 10, a computer includes an input device 220, an output device 230, a central processing unit 200, and a storage device 21.
0 is the main component.

Input device 220 and output device 230 are used as an interface between humans and computers.

Furthermore, the storage device 210 stores programs including instructions, data, etc. necessary for operating the central processing unit 200.

Further, the central processing unit 200 is a device that controls the computer and performs calculations, and reads a program from the storage device 210, interprets it, and executes it.

Next, the operation of the computer will be explained focusing on the central processing unit 200.

First, the central processing unit 200 takes in an instruction constituting a program from the storage device 2co0 and interprets what kind of instruction this is.

Thereafter, the central processing unit 200 executes this command, and if necessary, takes in various data and instructions from the input device 220, and outputs calculation results etc. from the output device 230. or store data in the storage device 210.

By repeating this operation, the storage device 21
Execute the program stored in 0.

Here, the format in which instructions are stored in the storage device 210 will be explained.

Now, consider a program that stores the following immediate values in a register and performs addition.

The above program is written in assembly language, but when it is stored as a binary image on the storage device 210 so that the central processing unit 200 can interpret it, it becomes as follows.

(Problem to be Solved by the Invention) In a normally used computer as described above, the storage device 2
The instructions stored in 10 are specific to the central processing unit W2O0 and are paired with the operations of the central processing unit 200. Therefore, if the programs are the same, the binary images of the instructions on the storage device 210 will also be the same.

Therefore, if the instruction format and instruction code of the central processing unit 200 are leaked, it becomes impossible to keep the contents of programs and data on the storage device 210 secret.

In view of the above circumstances, the present invention has a security function that can prevent the contents from being deciphered even if the programs and data in the storage device are leaked, thereby increasing the confidentiality of the programs and data. The purpose is to provide a calculator.

[Structure of the invention]

(Means for Solving the Problems) In order to achieve the above object, a computer with a security function according to the present invention is a computer that reads machine language instructions and data on a storage device into a central processing unit and executes them while interpreting them. A storage means for storing a key provided in the central processing unit, and encrypted machine language instructions and data can be read from the storage device using the key stored in the storage means and used by the central processing unit. cipher decoding means for restoring to machine language instructions and data; and encryption means for encrypting data stored in the storage device using a key stored in the storage means and storing it in the storage device. It is characterized by

(Operation) In the above configuration, encrypted machine language instructions and data stored in the storage device are decrypted by the decryption means and executed by the central processing unit, and data is stored from the central processing unit in the storage device. When doing so, the data to be stored is encrypted by the encryption means and then stored.

(Embodiment) FIG. 1 is a block diagram showing a first embodiment of a computer with a security function according to the present invention.

The computer with a security function shown in this figure includes a central processing unit 1, a storage device 2, a human power device 3, an output device 4, and a key input device 5.

The central processing unit 1 includes a calculation section 10, a control section 11, an encryption/restoration section 12, and a key storage section 13, and functions as the central part of the computer.

The storage device 2 is a device in which programs and data are stored, and exchanges programs and data with the encryption/restore unit 12 in the central processing unit 1 under the control of the central processing unit 1.

Further, the input device 3 and the output device 4 receive and receive data from outside the computer and output data from the computer to the outside under control from the central processing unit 1.

The key input device 5 is a device used to set keys necessary for encrypting and decoding the central processing unit 1.

Here, the central processing unit 1 will be explained in more detail.

As shown in FIG. 1, the central processing unit 1 is composed of four parts: a calculation section 10, a control section 11, an encryption/restore section 12, and a key storage section 13.

The calculation unit 10 performs arithmetic operations and logical operations on data provided from the input device 3 and the storage device 2.

The control unit 11 also interprets instructions from the storage device 2 and controls the entire computer.

Further, the encryption/restore unit 12 is located between the storage device 2 and the calculation unit 10, and converts the encrypted instructions and data on the storage device 2 into values using a key so that the calculation unit 10 can interpret them. It has a function of restoring data, and a function of encrypting the result calculated by the calculation unit 10 using a key when writing it to the storage device 2 and storing it in the storage device 2. Furthermore, the encryption/restoration unit 1
2 is configured so that it is possible to select between handling the contents of the storage device 2 as encrypted instructions and data and not handling them as encrypted instructions and data.

The key storage section 13 is a section in which keys used in the encryption/restoration section 12 are stored, and has a function of storing data given as an encryption key from the key input device 5, and a function of storing data given as an encryption key by executing a command. It has the ability to store data.

Next, the operation of this embodiment will be explained with reference to FIGS. 2 to 4.

First, encrypted instructions and data are prepared on the storage device 2 to execute the program.

However, the encryption program used in this case is created by the calculation process shown in the following equation.

Z-XI xor Y・・・・・・(3
) However, Z: encrypted value.

Xl: Value to be encrypted.

Y: Key used for encryption.

Using this equation (3), for example, when assembler (or compiler, etc.) 1.5 processes the source block: RAM and outputs a binary image as shown in Figure 2,
Exclusive OR means 16 in this assembler 15 expansion 1
If we take the exclusive OR of the binary image X1 of the program to be encrypted and the encryption key Y, we get
As a result of this processing, an encrypted binary image Z can be obtained. This binary image Z is stored in the storage device 2.

Furthermore, the value of the key Y used here, "1234", is the same as the key used when executing a program on a computer, and by managing this key Y for each program by the user or O8, security of the computer can be achieved. is improving.

Next, when executing the encrypted program stored in the storage device 2, first, the value "1234" of the key Y used in the above-mentioned encryption process is manually input from the key input device 5. Thereafter, a program execution start command is issued to the central processing unit 1.

When the central processing unit 1 starts execution, each instruction constituting the encrypted program in the storage device 2 is sequentially fetched from the beginning.

After this, this command is executed by the encryption/restorer 1 as shown in FIG.
The arithmetic processing shown in the following equation is performed by the exclusive OR means of 2.

X2=Z xor Y ・=(4) However, Z
: Encrypted instruction value.

X2: Restored instruction value.

Y: Key used for encryption.

In this case, the value X2 obtained by this operation is determined by the above-mentioned assembler ]5
This is the same as the binary image X1 that was the subject of the encryption process.

Xl-X2 (5) Then, the central processing unit 1 executes the binary image X2 obtained by this processing to execute the programmed processing.

As described above, the computer according to the present embodiment has the function of the present invention by restoring encrypted instructions and data on the storage device 2 and using the restored values as instructions inside the solid device 1. Works just like a calculator without.

Also, in this processing process, the central processing unit 1. When it is necessary to store data such as processing results in the storage device 2, the encryption/restoration unit 12 stores a binary image X2 of the data to be stored and an encryption key Y, as shown in FIG. The exclusive OR is taken with this processing result (
The binary image Z) is stored in the storage device 2.

In this way, in this embodiment, the encrypted program stored in the storage device 2 cannot be processed unless the key Y is used, and the original program of this encrypted program is not saved. I did it like this,
Even if a program or data is leaked, it is possible to prevent the contents of the process from being known.

Furthermore, in the embodiment described above, the encryption/restorer 12 is provided with a selection function so that unencrypted programs can also be used, so that unencrypted programs are stored in the storage device 2. You can also process this program when

FIG. 5 is a block diagram showing a second embodiment of a computer with a security function according to the present invention. In this figure, the same parts as those in FIG. 1 are given the same reference numerals.

The computer with a security function shown in this figure is different from the one shown in FIG. As shown in FIG. 6, this key Y is extracted and stored in the key storage unit 13, and the encrypted program is restored and the processing results are encrypted.

Thereby, the value of the key Y can be changed for each program or at any time during the processing process of the program, and the confidentiality of the programs and data stored in the storage device 2 can be further improved.

FIG. 7 is a block diagram showing a third embodiment of a computer with a security function according to the present invention. In this figure, the same parts as those in FIG. 1 are given the same reference numerals.

The difference between the computer with a security function shown in this figure and the one shown in FIG. As shown in FIG. 8, when an interrupt is generated, the arithmetic unit 10c takes out the interrupt address INTAD for this interrupt and the key Y paired with this interrupt address INTAD under the control of the control unit 11. Store it in the key storage unit 13 and write the interrupt address ■NT
The encryption program specified by the AD is restored and the processing results are encrypted.

In this way, the value of the key Y can be changed for each interrupt process, and the confidentiality of programs and data stored in the storage device 2 can be further improved.

Furthermore, in each of the embodiments described above, as shown in FIG. 9, each application 20 such as a program or data executed by a computer is locked. The OS used when executing
The system 21 may be locked.

This makes it possible to enhance the confidentiality of 0821 itself in addition to the application program and data.

〔Effect of the invention〕

As described above, according to the present invention, even if a program or data in a storage device is leaked, the contents can be prevented from being decoded, thereby increasing the confidentiality of the program or data.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing a first embodiment of a computer with a security function according to the present invention, FIG. 2 is a schematic diagram for explaining an example of the operation of the same embodiment, and FIG. 3 is an example of the operation of the same embodiment. FIG. 4 is a schematic diagram for explaining an example of the operation of the same embodiment. FIG. 5 is a block diagram showing a second embodiment of the computer with security function according to the present invention.
The figure is a schematic diagram for explaining an example of the operation of the embodiment shown in FIG. 5, FIG. 7 is a block diagram showing a third embodiment of the computer with security function according to the present invention, and FIG. FIG. 9 is a schematic diagram for explaining an example of the operation of the embodiment, FIG. 9 is a schematic diagram for explaining another embodiment of the computer with security function according to the present invention, and FIG. 10 is a block diagram showing an example of a general computer. It is a diagram. ]6...Central processing unit 2...Storage device 12...Encryption means, decryption means (encryption/recovery section) 13...Storage means (key storage section)

Claims (1)

[Claims] (1) In a computer that executes machine language instructions and data stored in a storage device by importing them into a central processing unit and interpreting them, a storage means for storing keys provided in the central processing unit; a decryptor for reading out encrypted machine language instructions and data from the storage device using a key stored in the storage device and restoring the encrypted machine language instructions and data to machine language instructions and data usable by a central processing unit; and a key stored in the storage device. A computer with a security function, comprising: an encryption means for encrypting data to be stored in the storage device using an encryption method, and storing the encrypted data in the storage device.