JP2010225009A - Real-time clock and electronic device security setting method - Google Patents

Abstract

A real-time clock with improved tamper resistance and improved reliability of time information is provided.
An OTP-ROM in which a unique access code is recorded, a clock register for generating time information, a general-purpose memory for storing at least time information, and a general-purpose memory from outside based on an access signal from the outside. An access control unit 14 that controls access to the access control unit 14. The access control unit 14 compares the user access code included in the access signal with the access code recorded in the OTP-ROM 12, and the two match. In such a case, access to the general-purpose memory 30 is permitted from the outside, and access is prohibited if they do not match.
[Selection] Figure 1

Description

  The present invention relates to a real-time clock and a security setting method for an electronic device, and more particularly to a real-time clock and a security setting method with high tamper resistance.

  Real-time clocks are mounted on electronic devices such as PCs and various portable devices, and are widely used as devices for supplying time information. An example of such a real time clock is disclosed in Patent Document 1. Specifically, an oscillation circuit to which a vibrator is connected, a clock circuit for supplying time information, and a power supply unit are provided, and backup power supply means is provided as necessary.

JP 2008-256574 A

  Although the real-time clock having such a configuration can fulfill the purpose of supplying time information, there is a problem that a clock circuit or the like can be easily accessed by a generally used data input / output method. there were. For this reason, for example, it is possible to tamper with time information recorded in a clock circuit or the like by making probe pins directly contact each terminal of a real-time clock to perform unauthorized access, and tamper resistance is low. It was. Here, the tamper resistance refers to the difficulty of analysis when reading or rewriting data stored in the real-time clock.

  Because of these problems, when using real-time clocks for applications where time information is required to be reliable, such as measuring the operating time of rental equipment or viewing time-limited music / video media, the time information can be easily altered. There is a need for a means to prevent this from happening, but no countermeasures have been taken.

  Accordingly, an object of the present invention is to provide a real-time clock with improved tamper resistance and improved reliability of time information, and to provide a security setting method for an electronic device using the same.

SUMMARY An advantage of some aspects of the invention is to solve at least a part of the problems described above, and the invention can be implemented as the following forms or application examples.
[Application Example 1] One-time programmable memory in which an access code is recorded, a timekeeping unit that has a clock register that generates time information and holds the time information, a storage unit that stores at least the time information, and an external device An access control unit that controls access to the storage unit from the outside based on the access signal of the user, and the access control unit records the user access code included in the access signal and the one-time programmable memory A real-time clock characterized in that the access code is compared with the access code, the access from the outside to the storage unit is permitted if they match, and the access is prohibited if they do not match.
With a real-time clock having such characteristics, tamper resistance can be improved and the reliability of time information can be improved.

  Application Example 2 The real-time clock according to Application Example 1, wherein the access code recorded in the one-time programmable memory includes a read access code and a write access code. clock.

  According to the real-time clock having such a feature, since there are two types of access codes, the tamper resistance can be improved as compared with the case where tampering is maintained with one type of access code.

  [Application Example 3] The real-time clock according to Application Example 1 or Application Example 2, including an OTP-memory access control unit that determines whether the access code can be written to the one-time programmable memory. Real-time clock characterized by

  According to the real-time clock having such characteristics, it is possible to control the writing of the access code to the one-time programmable memory. For this reason, unnecessary writing can be prevented, and the possibility that an access code recorded in the one-time programmable memory is recognized by another person can be reduced.

[Application Example 4] A security setting method for an electronic device including a mounting board, the mounting step of mounting the real-time clock according to any one of Application Examples 1 to 3 on the mounting board, and the mounted real-time clock. And a writing step of writing an access code to the one-time programmable memory.
By having such a feature, the possibility that the access code is known to others can be extremely reduced.

Application Example 5 In the electronic device security setting method according to Application Example 4, the electronic device includes an arithmetic processing device, and the writing step is generated by generating the access code by the arithmetic processing device. And writing the access code to the one-time programmable memory.
By having such a feature, an access code is not guessed based on the user's personal information or the like. For this reason, the possibility of unauthorized access by others can be reduced.

2 is a real-time clock according to the first embodiment. It is a figure which shows the mode of the exchange of the signal which concerns on 1st Embodiment. It is a real time clock concerning a 2nd embodiment. It is a real time clock concerning a 3rd embodiment. It is a figure which shows the exchange of the signal using an I2C bus. It is a real time clock concerning a 4th embodiment.

DESCRIPTION OF EMBODIMENTS Hereinafter, embodiments according to a real-time clock and a security setting method for an electronic device according to the present invention will be described in detail with reference to the drawings.
The real-time clock 10 according to the present embodiment includes an oscillator 32, a clock unit 26, a one-time programmable read-only memory (hereinafter simply referred to as OTP-ROM) 12, an access control unit 14, a data buffer 24, and an SPI interface 22. Configured as a base.

  The oscillator 32 includes a crystal resonator 36 and an oscillation circuit 34. The crystal resonator 36 is configured to vibrate at a predetermined frequency when an electric signal is input via the oscillation circuit 34. A frequency dividing circuit is provided between the time measuring unit 26 and the oscillator 32, which will be described in detail later, and the oscillation circuit 34 amplifies the signal output from the crystal resonator 36 and outputs the amplified signal to the frequency dividing circuit 38. The frequency dividing circuit 38 divides the signal output from the oscillator 32 to generate a 1 second signal of 1 [Hz], a 1/1000 second signal of 1 [Hz], and the like. Output a signal. In the present embodiment, the vibrator constituting the oscillator 32 is the crystal vibrator 36, but there is no problem in carrying out the present invention even if the vibrator is in another form.

  The timer unit 26 includes a clock register 28 and a general-purpose memory 30 that is a general-purpose memory as a storage unit. The general-purpose memory 30 can be composed of, for example, a RAM (Random Access Memory) or an EEPROM (Electrically Erasable Programmable ROM) which is a nonvolatile memory. The timer unit 26 generates time information such as year, month, day, hour, minute, second, day of the week, century, etc. by using the 1 second signal output from the frequency dividing circuit 38. The generated time information is held in the clock register 28. The general-purpose memory 30 stores time information held by the clock register 28, rewrites according to the update information, and stores data other than the time information as necessary.

  The OTP-ROM 12 is a nonvolatile memory that can be written only once. The OTP-ROM 12 can be composed of, for example, a fuse ROM. As the data to be written, a dedicated access code necessary for reading or rewriting data held in the clock register 28 (data stored in the general-purpose memory 30) can be used. For example, the access code storage area is defined as a read access code at address X and a write access code at address Z.

  The access control unit 14 includes an OTP-memory access code comparator 16, a read access code comparator 18, and a write access code comparator 20. The OTP-memory access code comparator 16 stores an access code (hereinafter referred to as a ROM access code) necessary for writing a read access code or a write access code to the OTP-ROM 12, The ROM access code input via the SPI interface 22 to be described in detail later is compared with the recorded ROM access code. If the two match, the access (read access or write access) is appropriate. Therefore, access to the OTP-ROM 12 is permitted, and if they do not match, the access is regarded as illegal and access to the OTP-ROM 12 is rejected.

  Further, the read access code comparator 18 compares the read access code written in the OTP-ROM 12 with the read access code as the user access code input via the SPI interface 22, and the time measuring unit 26. It is determined whether or not it is appropriate to read the data stored in the data buffer 24 to be described later in detail. Specifically, when the read access code input via the SPI interface 22 matches the read access code stored in the OTP-ROM 12, the access is regarded as appropriate, and when the read access code does not match, the access is accessed. Is considered illegal. If the access is deemed appropriate, the data stored in the timer unit 26 is read out, temporarily stored in the data buffer 24, and the temporarily stored data is output via the SPI interface 22. If the access is deemed illegal, data reading is rejected.

  The write access code comparator 20 compares the write access code written in the OTP-ROM 12 with the write access code as the user access code input via the SPI interface 22, and the data buffer 24. It is determined whether or not it is appropriate to write the data temporarily stored in the timing unit 26. Specifically, when the write access code input via the SPI interface 22 matches the write access code stored in the OTP-ROM 12, the access is regarded as appropriate, and the access code is not matched. Considers access illegal. If the access is deemed appropriate, the data temporarily stored in the data buffer 22 is written into the time measuring unit 26. If the access is deemed illegal, data writing is rejected.

  The SPI interface 22 is an interface in which signal lines are greatly reduced by performing reading and writing by serial transmission. Of the four signal ports provided in the SPI interface 22, CE is a chip enable signal port, CLK is a clock signal port, DATA-IN is an input data port, and DATA-OUT is an output data port.

The real-time clock 10 having such a configuration is connected to a CPU (arithmetic processing unit) 40 that controls the system. The CPU 40 may arbitrarily generate a user access code such as the above-described read access code or write access code.
The real-time clock 10 having the above configuration is used by being mounted on a mounting board such as an electronic device.

  The real-time clock 10 mounted on the mounting board is written with a read access code and a write access code to the OTP-ROM 12 by an input from the CPU 40 of the electronic device via the SPI interface.

  At this time, the CPU 40 first inputs a ROM access code for permitting writing to the OTP-ROM 12. The input ROM access code is judged by the OTP-memory access code comparator 16 as to its suitability. When the input ROM access code and the ROM access code recorded in the OTP-memory access code comparator 16 match, access to the OTP-ROM 12 is permitted, and when they do not match, access is prohibited. Is done.

  When the ROM access code is authenticated by the OTP-memory access code comparator 16, the read access code for reading out the write data input from the CPU 40 via the SPI interface 22, that is, the data in the timer unit 26, and the time count A write access code for rewriting data in the unit 26 is written in the OTP-ROM 12.

  The read access code and the write access code are access codes used to read or rewrite data recorded in the time measuring unit 26. The read access code comparator 18 and the write access code comparator 20 Are compared to determine whether access is appropriate for each action. For this reason, the read access code and the write access code are recorded in the OTP-ROM 12 as unique values, so that the data recorded in the timer unit 26 (specifically, recorded in the general-purpose memory 30 in the timer unit 26). The tamper resistance is improved. As for access to the OTP-ROM 12, the access code for writing may be widely disclosed to the user, but it is necessary to make an agreement that the access code for reading is not disclosed or reading is prohibited. This is because if the OTP-ROM 12 is accessed and the stored read access code or write access code is read, the tamper performance cannot be maintained.

  Data writing to the time measuring unit 26 and data reading from the time measuring unit 26 are performed via the data buffer 24. That is, in the case of data writing, when the write access code input via the SPI interface 22 is authenticated by the write access code comparator 20, the data input to the data buffer 24 is stored at the specified address. It is written in a register or general-purpose memory 30. In the case of data reading, when the read access code input via the SPI interface 22 is authenticated by the read access code comparator 18, the data at the designated address is read to the data buffer 24. The read data is output to the CPU 40 side via the SPI interface 22.

  In the present embodiment, for example, the mode setting is performed with the first 4 bits of the input signal, that is, the selection is set to read or write, and the address on the general-purpose memory 30 to be read or written with the subsequent 4 bits specify. After that, read data or write data is input / output in units of 8 bits. Note that when reading and writing are continuously performed, the address designation may be set to auto increment. During circulation, the address “F” is followed by “0”.

In this embodiment, the mode setting code is recorded in the OTP-ROM 12 as a read access code or a write access code.
FIG. 2A shows input / output signals at the time of data writing, and FIG. 2B shows input / output signals at the time of data reading. FIG. 2 shows an example in which the write access code is “0001” and the read access code is “1001” in binary notation.

  From FIG. 2, the CE is set to “Hi” at the time of writing and reading, that is, after a predetermined voltage is applied to the CE port, a mode code, that is, an access code is input. I can read that.

  In FIG. 2, 0 and 1 (Low, Hi) are not clearly shown for the address and data signals, but the example of FIG. 2A shows a case where the data N is written to the address N in the general-purpose memory 30. The example of FIG. 2B is an example in the case of reading data N recorded at the address N in the general-purpose memory 30. In FIG. 2, Hi-Z (high impedance) means a state where the output of the circuit is not electrically connected, that is, a state where there is no electrical signal.

  Next, a second embodiment according to the real-time clock of the present invention will be described with reference to FIG. Note that most of the configuration of the real-time clock according to the present embodiment is the same as that of the real-time clock 10 according to the first embodiment shown in FIG. Therefore, portions having the same function are denoted by reference numerals obtained by adding 100 to the drawings, and detailed description thereof will be omitted.

  The present embodiment is characterized in that an access code comparison error counter 142 is provided. The clock register 128 is provided with an item for setting an error detection flag when the access code comparison error counter 142 detects an error. The error detection flag can be held in the clock register 128 as information of at least 1 bit that is “0” when no error is detected and “1” when an error is detected, for example.

  With such a configuration, it is possible to recognize whether or not unauthorized access to the general-purpose memory 130 has been attempted. Other configurations are the same as those of the real-time clock 10 according to the first embodiment described above.

  Next, a third embodiment according to the real-time clock of the present invention will be described with reference to FIG. Note that most of the configuration of the real-time clock according to the present embodiment is the same as that of the real-time clock according to the first embodiment shown in FIG. Therefore, portions having the same function are denoted by reference numerals obtained by adding 200 to the drawings, and detailed description thereof will be omitted.

The difference is that the real-time clock 110 according to the present embodiment uses I ² C (registered trademark) as a serial bus. For this reason, the I ² C interface 222a is adopted as the interface. Note that there are ^two I ² C (registered trademark) input / output ports: an SCL (serial clock) port and an SDA (serial data) port.

  In this embodiment, a timer circuit 244 connected to the clock register 228 and an alarm circuit 246 are provided. Each output signal of the timer circuit 244 and the alarm circuit 246 is used as an interrupt signal for a control unit such as the CPU 240.

Each of the timer circuit 244 and the alarm circuit 246 has a time setting function, and a time signal from the clock register 228 is input. Then, when the input signal coincides with the set time, the signal is output.
By providing such a function, when the CPU 240 runs away, an interrupt signal can be output to stop the runaway.

  The I2C interface 222a does not have a chip select port (CE in the first and second embodiments) of a normal logic device. For this reason, in a device using the I2C bus, a unique device number for each model is stored in an IC (not shown), and by transmitting the device number as a slave address via the I2C bus at the start of communication, chip select Will be performed. The receiving device responds to subsequent communication only when the input slave addresses match.

Note that reading and writing of data using the I2C interface 222a is performed according to the following procedure (see FIG. 5).
First, the CPU 240 sends a data communication start condition (1). Next, the CPU 240 sends out a slave address of the real-time clock 210 and a code for determining read or write (2). Thereafter, the CPU 240 confirms the acknowledge from the real time clock 210 (3). Acknowledgment here means confirmation response.

  After confirming the acknowledge, the CPU 240 sends the address of the data read from the real time clock 210 (4), and confirms the acknowledge from the real time clock 210 (5). Thereafter, the CPU 240 sends out the start condition again (6). Next, the CPU 240 selects the slave address and read or load code of the real-time clock 210 in the read mode (7). The RTC 210 confirms the acknowledge (8). Data recorded at the address specified in (4) is read from the real-time clock 210 (9). The CPU 240 sends an acknowledge to the real time clock 210 (10). If necessary, data is read by repeating (9) and (10) (11). The CPU 240 sends an acknowledge of “1” (12). Thereafter, the CPU 240 sends a stop condition (13).

  Even when writing to and reading from the time measuring unit 226 is performed in the above-described process, a read access code and a write access code are recorded in the OTP-ROM 112 and are used. Since tampering is improved, it can be regarded as a part of the present invention.

  Next, a fourth embodiment according to the real-time clock of the present invention will be described with reference to FIG. Note that most of the configuration of the real-time clock according to the present embodiment is the same as that of the real-time clock 210 according to the third embodiment shown in FIG. Therefore, portions having the same function are denoted by reference numerals obtained by adding 100 to the reference numerals in FIG. 4 and detailed description thereof will be omitted.

  The real-time clock 310 according to the present embodiment is characterized in that an access code comparison error counter 342 is provided. The clock register 328 includes an item for setting an error detection flag when the access code comparison error counter 342 detects an error.

  With such a configuration, it is possible to recognize whether or not unauthorized access to the general-purpose memory 330 has been attempted. Other configurations are the same as those of the real-time clock 210 according to the third embodiment described above.

  10... Real-time clock, 12... OTP-ROM, 14... Access control unit, 16 ... OTP-memory access code comparator, 18 .... Read access code comparator, 20. Write access code comparator, 22 ......... SPI interface, 24 ......... Data buffer, 26 ......... Timekeeping unit, 28 ...... Clock register, 30 ......... General memory, 32 ......... Oscillator, 34 ... ...... Oscillator circuit 36... Crystal oscillator 38... Divider circuit 40.

Claims (5)

A one-time programmable memory in which an access code is recorded;
A time counter having a clock register for generating time information and holding the time information;
A storage unit for storing at least the time information;
An access control unit that controls access to the storage unit from the outside, based on an access signal from the outside;
With
The access control unit compares the user access code included in the access signal with the access code recorded in the one-time programmable memory, and if they match, the access to the storage unit from the outside is performed. A real-time clock characterized in that if it does not match, the access is prohibited. The real-time clock according to claim 1,
The real-time clock, wherein the access code recorded in the one-time programmable memory includes a read access code and a write access code. The real-time clock according to claim 1 or 2,
A real-time clock comprising an OTP-memory access control unit for determining whether or not the access code can be written to the one-time programmable memory. A security setting method for an electronic device including a mounting board,
A mounting step of mounting the real-time clock according to any one of claims 1 to 3 on a mounting board;
A writing step of writing an access code to the one-time programmable memory of the mounted real-time clock;
A security setting method for an electronic device, comprising: The electronic device security setting method according to claim 4,
The electronic device includes an arithmetic processing unit,
In the writing step, the access code is generated by the arithmetic processing unit, and the generated access code is written in the one-time programmable memory.

Images