JP4783451B2 - Secure processor - Google Patents

Description

  The present invention relates to a method for ensuring the safety of an information processing system such as a computer. More specifically, the present invention relates to a secure processor capable of preventing malicious code operation in a computer, various processor-embedded devices, and the like. The present invention relates to a processor program.

  In a system using a processor, the operation can be described by a program, and the flexibility of the operation is greater than that of a system in which everything is configured by hardware, and it is easy to implement various types of functions. Because of these features, processors are used in many systems such as personal computers, PDAs, mobile phones, and information appliances. Along with their widespread use, processing that requires a high level of security, such as electronic commerce, is also widely performed. It has come to be. Various system measures such as encryption of line data and user authentication have been taken to strengthen security, but in recent years not only system level safety but also the spread of computer viruses and unauthorized access etc. Therefore, software level and processor level safety is a problem.

  For example, various types of processor-embedded devices such as mobile phones and information home appliances are connected to a network, so that there is a high possibility that these devices will receive the same threat from the outside as against personal computers. If you look closely at unauthorized intrusion, the cause is that malicious execution code runs in the terminal. It is important to prevent malicious and undesired code from running on the processor, but in the past, there were not enough measures on the processor side to prevent malicious code from running on the processor. There is a problem that a secure software execution environment is not provided.

  Next, in the past, for example, when data or instruction execution codes are stored in the main storage device or secondary storage device, encryption is performed to ensure safety and encryption is performed for actual instruction execution. It is also possible to decrypt the processed data, store it in the cache memory in the processor, and execute the processing. In such a case, the hardware that performs the cryptographic processing is mounted on a separate chip from the processor chip. However, since it is used externally, there is a problem that the cryptographic processing performance such as processing speed is lowered.

  In such encryption processing, the encryption key used for encryption of data and the like is determined on the encryption processing side on the externally attached chip, and the type of instruction executed on the processor side and the supervisor / user Corresponds to the instruction being executed because the execution unit on the processor side cannot specify the key to be used for encryption and decryption, regardless of the mode distinction or the access address of data or instruction fetch. As a result, there is a problem that an appropriate encryption key cannot be selected.

There are the following documents as conventional techniques related to the safety of such software execution environment.
Patent Document 1: Japanese Patent Laid-Open No. 2002-353960 “Code Execution Device and Code Distribution Method”
This document discloses a code execution device that authenticates an encrypted execution code, confirms the validity of the encryption code, fetches an instruction corresponding to the encryption code, and executes it as a secure task Has been.

  However, in this code execution device, there is no relationship between the process corresponding to the execution code and the key used for authentication, for example, a malicious operation is performed on the operating system (OS), and another authentication key is assigned to the program. If assigned, the problem that malicious code would work as a result could not be solved.

JP 2002-353960 A

  A first problem of the present invention is that, based on the storage contents of a memory that stores encrypted instruction codes in a non-rewritable format, for example, the execution codes of programs stored in a secondary storage device one after another It is to provide a secure processor capable of performing authentication and performing a reliable operation in a step-by-step manner to expand the range of reliable applications.

  The second problem of the present invention is that a cryptographic processing block is provided on the same chip as a processor, for example, to improve cryptographic processing performance, and a key to be used for encryption / decryption of data and execution code by an instruction being executed. It is to be selectable.

  The third problem of the present invention is that the execution code is authenticated using the authentication key corresponding to the process at the timing when the execution code of the process is stored in the main memory, and only the execution code that has been successfully authenticated can be executed. This is to improve the safety of information processing by the processor.

  FIG. 1 is a block diagram showing the principle configuration of the secure processor of the present invention. In the figure, the secure processor 1 of the present invention comprises a unique key storage means 2, an instruction code storage means 3, an authentication processing means 4, and an encryption processing means 5.

  The unique key storage means 2 stores a key unique to the core for executing the instruction code in the secure processor, for example, a CPU unique key. The instruction code storage means 3, for example, the encrypted ROM code area is an encrypted instruction. The code is stored in a non-rewritable format, and the authentication processing means 4 authenticates the instruction code including the instruction code stored in the instruction code storage means 3 using the unique key, and the encryption processing means 5 encrypts data input and output between the core and an external memory.

  In the embodiment of the invention, the encryption processing means 5 can encrypt the authenticated instruction code and store the encrypted instruction code in a storage device connected to the secure processor 1 in units of pages, for example, main memory, or authentication processing means. Authentication information can also be added to the instruction code 4 to be authenticated.

  Next, in the secure processor 1 in FIG. 1, a secure core that executes only the instruction code authenticated by the authentication processing means 4 as a core for executing the instruction code, and a normal core that executes a normal instruction code that is not authenticated. It can also be provided.

  In this case, the secure core is booted (started up) using the encrypted instruction code stored in the instruction code storage means 3, and the normal core boot means causes the secure core to boot the normal core after the boot is completed. In addition, the normal core monitoring means for monitoring the operation of the normal core after booting the normal core and detecting the abnormal state or branching to the specific processing when the secure core detects an abnormal state. It can also be provided.

  Next, a program for a secure processor according to the present invention includes a procedure for performing startup processing using a program in a memory in which an encrypted instruction code is stored in a non-rewritable format, and an instruction code stored in the memory. Including an authentication processing block for performing an authentication process of an instruction code including a key, a key management process for managing a processor-specific key, and a key in which a key used for an encryption / decryption process of an instruction code authenticated by the authentication processing block is stored Necessary for executing an authentication-processed program including a procedure for setting up operation processing for a table, a procedure for performing authentication processing of a program on a secondary storage using an authentication processing block, and a started operating system And a procedure for performing an operation as a key processing monitor for executing key processing.

  The secure processor of the present invention includes an instruction execution means for executing an instruction, for example, an execution unit, and a load / store control means for controlling the load / store of data to an external memory in response to a command from the instruction execution means, for example, a load And a cryptographic processing means for performing encryption / decryption of data between the store unit, the load / store control means and the external memory, for example, an encryption circuit and a decryption circuit, and the instruction execution means is executing The key to be used for data encryption / decryption is designated to the encryption processing means in response to the instruction.

  In an embodiment of the invention, the secure processor further includes key storage means for storing a plurality of keys, for example, a key table memory, and the instruction execution means specifies a key number for specifying the key to the key storage means And the key storage means can give the key to be used for data encryption / decryption to the encryption processing means corresponding to the key number.

  The secure processor further includes key storage means for storing a key to be used for decrypting the instruction fetch data loaded from the outside. When the instruction execution means is in the instruction fetch state, the key storage means is the encryption processing means. Can also be given a key to be used to decrypt the fetched instruction.

  The secure processor of the present invention includes an instruction execution means for executing an instruction, a load / store control means for controlling loading / store of data to / from an external memory in response to a command from the instruction execution means, and a load / store control means. Encryption processing means for encrypting / decrypting data between the external memory and the external memory, the instruction execution means corresponding to the access address of the data / instruction fetch by the instruction being executed in the encryption processing means On the other hand, a signal for designating data and a key to be used for encryption / decryption of instructions is given.

  In an embodiment of the invention, the secure processor further includes key storage means for storing a plurality of keys, the instruction execution means outputs a logical address as the access address, and the key storage means has the logical address. Corresponding to the above, a key to be used for encryption / decryption can be given to the encryption processing means.

  Alternatively, the secure processor further includes key storage means for storing a plurality of keys, and the load / store control means outputs a physical address as an access address corresponding to a command given from the instruction execution means, and stores the key. It is also possible for the means to give a key to be used for encryption / decryption to the encryption processing means corresponding to the physical address.

  The secure processor of the present invention includes a secure process for comparing with a secure process identifier corresponding to a page in which a secure page flag indicating that the execution code is correctly authenticated prior to execution of the process corresponding to the execution code. Secure process (context) identifier generating means for generating the identifier when the process generation instruction is issued, and process information holding means for holding the generated secure process identifier as information related to the process, for example, context information And a storage unit.

  In the embodiment of the invention, authentication information is given to the execution code corresponding to the above-mentioned process, and an authentication key for executing code authentication performed during the lifetime of the process in which the process information holding means is generated is provided. It can also be held.

  The secure processor stores an execution code corresponding to the above-described process in an empty page of the memory, stores a secure process identifier in a buffer in the processor in association with the address of the page, and then authenticates each page. Authenticating the execution code using, and when authentication is successful, can further comprise an authentication means for setting a secure page flag in the buffer.

  Alternatively, the secure processor includes a secure process identifier stored in the above-mentioned buffer prior to the actual execution of the execution code, the corresponding secure page flag being set, and a process information holding unit. A memory that compares the secure process identifier corresponding to the instruction code that is held and that is to be executed, and permits the instruction execution unit that executes the instruction to access the page on the memory in which the execution code is stored when the two match Access control means may be further provided.

  The secure processor can also include a secure core that executes only an authenticated execution code and a normal core that executes an unauthenticated normal execution code as cores each including an instruction execution unit and a cache. .

  Further, the secure processor further includes a direct memory access unit that performs an operation necessary for authenticating the execution code in parallel with storing the execution code in the memory, and holds the result of the operation and gives the result to the authentication unit. it can.

  Next, the secure processor program of the present invention is a program used by a computer for page-in a page including an execution code into the memory, and requests the direct memory access mechanism in the computer to transfer the page to the memory. The page that stores the execution code in the page table entry in the computer's translation lookaside buffer after the transfer is successful, prior to execution of the process corresponding to the execution code in that page, is correct. It is an identifier for comparing with a secure process identifier corresponding to a page for which a secure page flag indicating authentication has been set, and includes a secure process identifier generated when a generation instruction for the process is issued, The procedure for setting the data for that page, And authentication over di-, is a set of page table entries of the secure page flag indicating successful authentication as to execute the steps of requesting the hardware in the computer.

  Further, the secure processor program of the present invention is a program used by a computer for authenticating a page including an execution code, and a procedure for performing a hash operation on the page read into the memory and the page are added to the page. The procedure for decrypting the authentication information, the procedure for comparing the hash operation result and the decryption result, and when a match is detected as the comparison result, the page table entry in the translation lookaside buffer of the computer And a procedure for setting a secure page flag indicating that the authentication of the page is successful.

  According to the present invention, an encrypted instruction code in a non-rewritable format held in a processor is used as a basic trust point, for example, a program including an operating system is authenticated, and the range of reliable programs is increased. By expanding, the security level of the system can be essentially improved.

  Further, according to the present invention, the cryptographic processing block is provided in, for example, the same chip as the processor, so that the cryptographic processing performance can be improved and the data and the execution code can be encrypted according to the instruction being executed. . Corresponding to the command being executed, for example, the encryption level can be changed, and the security level as the system can be improved.

  Further, according to the present invention, the instruction code is authenticated before the execution of the instruction code, and a match between the process identifier corresponding to the process for which the secure page flag is set and the process identifier of the process being executed is detected. By executing the process, it is possible to prevent the execution code executed maliciously on the processor, and a safe software execution environment is provided.

It is a principle block diagram of the cure processor of the present invention. It is a block diagram which shows the basic composition of the processor in a 1st Example. It is a basic processing flowchart of a processor in the 1st example. It is a flowchart of the process by a code | cord | chord authentication process block and an encryption process block. It is a processing flowchart of a cryptographic processing block when different keys are specified for an instruction area and a data area. It is explanatory drawing of the storage system of the encryption key encrypted with the public key. It is a storage process flowchart of the encryption key encrypted with the public key. It is explanatory drawing of the storage method of the encryption key to which the signature of the certification authority was given. It is a storage process flowchart of the encryption key provided with the signature of the certificate authority. It is a processing flowchart at the time of illegal command detection. It is a flowchart of the key change process with respect to the instruction | command stored in the data area. It is a block diagram which shows the basic composition of the processor in a 2nd Example. It is a basic processing flowchart of a processor in the 2nd example. It is a block diagram which shows the basic composition of a processor provided with a secure core and a normal core. It is a basic flowchart of the process in the processor of FIG. It is explanatory drawing of the stop control system of the operation | movement of the normal core by the secure core in the processor of FIG. It is a flowchart of the stop control process of the operation | movement of the normal core by the secure core in the processor of FIG. It is a block diagram of a processor including a key generation mechanism corresponding to a secure core. It is explanatory drawing of the specific example of the key processing system in the processor of FIG. It is a block diagram which shows the basic composition of the processor in a 3rd Example. It is a block diagram of the configuration of a processor having a key table memory in the third embodiment. It is a block diagram which shows the structure of the processor in the instruction access state in the 3rd Example. It is a block diagram of a processor including a key selection register for a key table memory. It is a block diagram of the configuration of a processor that is in an instruction access state and includes a key selection register for a key table memory. It is a figure which shows the structural example of a key table memory. It is a block diagram which shows the structural example of an encryption circuit and a decoding circuit. It is a figure which shows the structural example of the encryption circuit with a data overtaking function, and a decoding circuit. It is explanatory drawing of the read modify write system corresponding to the load store unit of a cash through system. It is a block diagram which shows the basic composition of the processor in a 4th Example. It is a block diagram of a processor including a key table memory to which a logical address is given. It is a block diagram of a processor including a key table memory to which a physical address is given. It is a figure which shows the structural example (the 1) of the key table memory in a 4th Example. It is a figure which shows the structural example (the 2) of the key table memory in a 4th Example. It is a figure which shows the structural example (the 3) of the key table memory in a 4th Example. It is a block diagram which shows the structure of a processor provided with the key table memory to which a logical address and a physical address are given. FIG. 36 is a configuration block diagram of a processor including a key selection register for giving an address selection instruction to the key table memory of FIG. 35. It is a figure which shows the structural example of the key table memory in FIG. 35, FIG. It is a block diagram which shows the structure of the processor by which a key table is provided in a memory management unit. It is explanatory drawing of the data access system in FIG. It is explanatory drawing of the data access system in case the key table is attached to the address map register. It is a block diagram which shows the structure of the processor which switches a key according to the ON / OFF state of a memory management unit. It is explanatory drawing of the encryption / decryption system which switches a key according to the ON / OFF state of a memory management unit. It is explanatory drawing of the input / output signal of the execution unit in the 3rd and 4th Example. It is a detailed block diagram of the processor system in a 5th Example. It is explanatory drawing of a secure context identifier production | generation system. It is explanatory drawing of the secure context identifier production | generation method. It is explanatory drawing of a secure context identifier extinction system. It is explanatory drawing of the authentication information added to the execution code. It is explanatory drawing of the storage method to the authentication key register | resistor of a public key. It is a flowchart of the storing process to the authentication key register | resistor of a public key. It is explanatory drawing of the storage method to the authentication key register | resistor of the encrypted common key. It is a storage process flowchart to the authentication key register | resistor of the encrypted common key. It is explanatory drawing of the processing system at the time of page-in to a physical memory. It is a process flowchart at the time of page-in to a physical memory. It is a block diagram which shows the structure of an authentication part. It is an operation | movement flowchart of an authentication part. It is explanatory drawing of the access check system by the memory access control part at the time of the page utilization in a 5th Example. It is a figure explaining the operation example of a memory access control part. It is a process flowchart of the memory access control part at the time of instruction fetch. It is a figure explaining the access control system at the time of page use from a secure core and a normal core. It is a block diagram of a processor provided with a mode register for switching between a secure mode and a normal mode. It is a block diagram which shows the structure of secure DMA. It is a flowchart of the data transfer process by secure DMA. It is a flowchart of the process at the time of page-in by OS. It is explanatory drawing of the context information encryption system in a 7th Example. It is explanatory drawing of the decoding method of context information. It is explanatory drawing of the alteration detection information addition system with respect to context information. It is explanatory drawing of the alteration detection system with respect to context information. It is explanatory drawing of the encryption system of context information for secure operations. It is explanatory drawing of the alteration detection information addition system with respect to context information for secure operation | movement. It is explanatory drawing of the encryption method of a page table entry. It is explanatory drawing of the decoding method of a page table entry. It is explanatory drawing of the falsification detection information addition system to a page table entry. It is explanatory drawing of the falsification detection system with respect to a page table entry. It is a figure explaining the loading to the computer of the program for implement | achieving this invention.

Hereinafter, embodiments of the present invention will be described in detail. First, an overall configuration of a secure processor of the present invention and an outline of the processing will be described as a first embodiment.
FIG. 2 is a block diagram showing the basic configuration of the secure processor as the first embodiment. In the figure, a processor 10 includes a core 11 including an execution unit and a cache, command processing with an external interface, encryption processing block 12 for performing encryption and decryption of bus data (program code or data), and instruction code authentication. Code authentication processing block 13 for performing the encryption, the encryption ROM code area 14 in which the most basic program used at the time of starting the processor is encrypted and stored, and the decryption of the program stored in the code area 14 The CPU unique key 15 for performing the above is provided. The operation of the encryption processing block 12 will be described in detail in a third embodiment to be described later, and the operation of the code authentication processing block 13 will be described in more detail in a fifth embodiment.

  Commands and data are exchanged between the core 11 and the cryptographic processing block 12 and a key for encryption is controlled. Also, authentication between the core 11 and the code authentication processing block 13 is performed. An interface is provided. Further, it is assumed that the encryption processing block 12 and the code authentication processing block 13 execute access to the main memory 17 and the code authentication processing block 13 executes access to the secondary storage 18.

  FIG. 3 is an overall process flowchart of the secure processor in the first embodiment. In FIG. 2, when the power is turned on, the core 11 shown in FIG. 2 decrypts the program stored in the encrypted ROM code area 14 using the CPU unique key 15 in step S1, and executes a boot (startup) process. . Since it is a built-in ROM, alteration of the program is inherently physically difficult, but even if it is altered by some method, the program is encrypted, and meaningful alteration is difficult. Therefore, if the boot can be performed correctly, it can be determined that the program has not been tampered with, and the program stored in the encryption ROM code area 14 can be said to be absolutely reliable. It can be defined as a reliable trust point.

  For the encryption ROM code area 14, when the AES (Advanced Encryption Standard) method, which has a higher secret strength than the DES (Data Encryption Standard) method that performs 64-bit unit encryption, is used. It can also be external rather than inside the processor. In that case, the same ciphertext is always output for the same plaintext so that the encryption key cannot be estimated corresponding to the frequently occurring pattern such as the instruction code NOP and the data pattern ALL0 / ALL1. It is also possible to use modes other than ECB (Electric Codebook).

  Subsequently, in step S2, provided in the encryption processing block 12, an operation process for a key table (memory) described later, a key management process for generating a public key and a secret key using the CPU unique key 15, and a code authentication process The setup of block 13 and the like are executed, and the contents of these processes are defined as similar trust points.

  Subsequently, an authentication process for the program stored in the secondary storage 18 is performed in step S3. In the first embodiment, general programs including an operating system (OS) are stored on the secondary storage 18 such as via a hard disk or a network, and authentication processing for these programs is executed. This authentication process will be further described later.

  A group of programs for executing the above-described key table operation processing is made into a library and is called a key processing monitor. Access to the secure hardware 20 such as the cryptographic processing block 12, the code authentication processing block 13, and the CPU unique key 15 is restricted to the section in which the key processing monitor is operating in step S4. A state in which the key processing monitor operates and the secure hardware 20 can be accessed is referred to as an access level 1. Access level 1 is realized by hardware that monitors whether the program counter points to the address of the key processing monitor in step S4 in the fixed area.

  Compared with the access level 1, the operations by the general program including the OS described above are classified into the access level 2 or the access level 3. In the first embodiment, the OS is classified into access level 2, and when the OS or the like is activated in step S5, the authenticated program is executed in step S6. The authenticated program at access level 2 can request key processing to step S4 at access level 1, that is, the key processing monitor, via the key processing monitor such as encryption of its own space, data encryption and decryption. Can be done indirectly. As described above, even if the program is from the outside of the CPU, the authenticated one is positioned as the access level 2 and can perform key processing, but all keys other than the public key or the secure hardware 20 are directly accessed. Therefore, even if some trouble occurs in the level 2 program, the key information excluding the public key does not leak to the outside.

  The execution of the unauthenticated program at the access level 3 is performed after the activation of the OS or the like at step S5 in step S7. The program at the access level 3 accesses all keys other than the public key and the key processing monitor. It is not possible to make a request for key processing to the client. Note that the processing from step S4 to step S7 is executed using inter-process communication between programs of each access level.

  As described above, in the first embodiment, first, the basic trust point of the program is established at the time of successful boot processing performed using the program stored in the encryption ROM code area 14 when the processor is started up. After that, by extending the range of programs that can be trusted while authenticating various programs including the OS using the trust points, the purpose of the processor itself to improve the security level of the system in stages is achieved. The In addition, after the operation is started, code and data can be encrypted for each authentication unit, and sufficient reliability can be maintained with respect to maintaining confidentiality between programs. In the first embodiment, the method of realizing the access level 1 processing as software executed by the processor core has been described. However, part or all of the level 1 processing is performed as microcode or wired logic. It can also be realized.

  FIG. 4 is a flowchart showing an outline of processing by the code authentication processing block 13 and the encryption processing block 12 of FIG. In the figure, it is assumed that the processing by the encryption processing block is performed in step S11 following the processing by the code authentication processing block in step S10.

  In FIG. 4, first, in step S12, for example, a code authentication process for a program stored in the main memory 17 or the secondary memory 18 is executed. Details of this processing will be described later. In step S13, it is determined whether the authentication has succeeded or failed. If the authentication has failed, a stop process for code execution is executed in step S14.

  If the authentication is successful, processing by the cryptographic processing block is started, and it is determined in step S16 whether or not a key for encryption is designated, for example, in units of pages. In S17, a random key is generated using a random number generator or the like, and if it is specified, the specified key is extracted in Step S18. Here, the case where the key is not specified includes the case where the page is newly generated. The case where the key is specified means that the generated page is once paged out and then paged in again. And storage of encrypted pages from the outside. After the key is determined, an encrypted page entry, that is, a page table entry (PTE) in a translation lookaside buffer (TLB), which will be described later, is generated in step S19, and an encrypted page is allocated to code or data. Is encrypted.

  FIG. 5 is an overall flowchart of code authentication and its encryption processing when different encryption keys are assigned to the instruction area and data area of the same process and code encryption is performed. In FIG. 4, step S10, that is, the processing by the code authentication processing block is the same as in FIG.

  If the code authentication is successful in FIG. 5, it is determined in step S21 whether or not an instruction key as a key for the instruction area is specified. If there is no specification, a random key is generated in step S22 and there is a specification. In step S23, the designated key is extracted. In step S24, the random key or the designated key is used to generate an encrypted instruction page table entry, that is, a PTE, and the encrypted page is assigned to the instruction area. The command area is encrypted.

  Thereafter, in step S26, it is determined whether or not a data key is designated as an encryption key for the data area. If there is no designation, a random key is generated in step S27, and if designated, it is designated in step S28. In step S29, a page table entry for the data is generated, an encrypted page is allocated, and encryption for the data area is executed.

  Next, the encryption key acquisition operation in the first embodiment will be described with reference to FIGS. FIG. 6 and FIG. 7 are flowcharts of an example of the internal configuration of a processor and its processing in an example of encryption key acquisition operation (part 1). In this example, the processor-specific RSA private key is held in advance in the processor in a secure manner, the corresponding RSA public key is output to the outside of the processor by some method, and the encryption key given from the outside is determined by this public key. It shall be encrypted. That is, for example, an encryption key for encryption and decryption in units of pages is a common key, and re-encryption with a public key is indispensable for maintaining its confidentiality.

  FIG. 6 shows the configuration of the processor 10 for executing the encryption key setting process inside the processor. The encryption key setting unit 21, the decryption unit 22, the processor-specific RSA private key 23, A translation lookaside buffer (TLB) 24 is provided, and a logical address table 25, a physical address table 26, and a key table 27 corresponding to the aforementioned page table entry (PTE) are provided in the TLB. ing. Then, an encryption key setting request including an encryption key encrypted with the processor-specific RSA public key is given to the encryption key setting unit 21 from the outside.

  FIG. 7 is a flowchart of the encryption key acquisition process. When processing is started in the figure, an encryption key setting request is accepted by the encryption key setting unit 21 in step S31, and the encrypted encryption key received by the decryption unit 22 in step S32 uses the processor-specific RSA private key 23. In step S33, the encryption key decrypted by the encryption key setting unit 21 is stored in the key table 27 in the TLB 24, and the process ends.

  FIG. 8 is a configuration example of the processor in the encryption key acquisition operation example (part 2). In FIG. 6, compared with FIG. 6 in the first example, a signature verification unit 28 is provided in the processor 10 in place of the decryption unit 22, and the certificate authority public key is used instead of the processor-specific RSA private key 23. The certificate authority certificate 29 is stored. It is assumed that the certificate authority certificate 29 is recorded in the processor so that the unauthorized replacement cannot be performed, and the encryption key setting unit 21 is provided with an encryption including an encryption key signed by the certificate authority. It is assumed that a key setting request is given.

  FIG. 9 is a flowchart of processing in the encryption key acquisition operation example (part 2). When the processing is started in the figure, first, the encryption key is received together with the signature by the encryption key setting unit 21 in step S36, and the encryption key received by the signature verification unit 28 in step S37 uses the signature and the CA public key. In step S38, it is determined whether or not the verification is successful. If the verification is successful, the encryption key received by the encryption key setting unit 21 is stored in the key table 27 in the TLB 24 in step S39. If the verification fails, the process is immediately terminated. Further, in order to further improve the reliability of the encryption key, it is naturally possible to combine the first operation example, that is, maintaining the confidentiality of the encryption key and the second operation example, that is, the identification of the encryption key. .

  FIG. 10 is a flowchart of illegal instruction handling processing when an illegal instruction is detected while executing an instruction in the encrypted instruction area in the first embodiment. If an illegal instruction is detected in step S41 in the figure, it is determined in step S42 whether or not the illegal instruction is an instruction in an encrypted page. If the illegal instruction is an instruction in an unencrypted page, step S43 is determined. In step S44, it is determined that the instruction has been tampered with. If the instruction is determined to be an instruction in the encrypted page, a process lockdown or Then, processing such as cancellation of pending processing is executed, and execution of the instruction code is stopped.

  FIG. 11 shows that when different encryption keys are assigned to the instruction area and the data area of the same process as described in FIG. 5, for example, the instruction is executed prior to the execution of the instruction code stored in the data area. It is a flowchart of the key change process for preventing detecting as an illegal command. Such storage of the instruction code in the data area occurs at the time of execution of a programmed IO (PIO), that is, a copy of the instruction by the program.

  In FIG. 11, first, it is assumed that the instruction code is copied to the data area by the PIO in step S46, and the key change process is started in step S47. In this process, the data PTE corresponding to the data page in which the instruction is stored in step S48 is read, and after the encryption key stored in the entry is extracted in step S49, the PTE is deleted, and in step S50. Using the contents of the data PTE, that is, the encryption key, an instruction PTE in which the encryption key is stored in, for example, the key table 27 of FIG. 6 is generated, and after the instruction PTE is written to the TLB in step S51, step S52 is performed. Then, branching to the area where the instruction is copied is performed, and the subsequent processing, that is, execution processing of the instruction stored in the copy area is performed.

  Thus, in the first embodiment, as described with reference to FIG. 2, only one core 11 including an execution unit and a cache is provided in the processor 10, and the core 11 operates as a secure processor as a secure core. In a system called multi-processor system or multi-core system, for example, a plurality of cores are classified into a secure core that executes a secure operation and a normal core that executes a normal operation. Can also be shared. Such a processor system will now be described as a second embodiment.

  FIG. 12 is a block diagram of the basic configuration of the processor as the second embodiment. Compared with FIG. 2 showing the first embodiment in FIG. 2, a secure core 31 and a normal core 32 are provided in place of the core 11, and these two cores 31, 32 and the cryptographic processing block 12, and A bus interface 33 is provided between the code authentication processing block 13, key control is performed between the secure core 31 and the cryptographic processing block 12, and authentication control is performed between the secure core 31 and the code authentication processing block 13. Further, the CPU unique key 15 is different from the secure core 31 only in that it is connected. That is, in the second embodiment, basically, the encryption processing block 12, the code authentication processing block 13, and the CPU unique key 15 as the secure hardware 20 described in FIG. There is a special feature.

  In the second embodiment, access to the secure hardware 20 is limited to the secure core 31 only. In the first embodiment, there is room for user software to intervene in the operation of the key processing monitor in step S4 of FIG. 2 as a secure operation. For this reason, as described above, access restriction by hardware monitoring of the program counter is performed. However, in the second embodiment, there is no such software intervention, and a problem due to a software bug does not occur.

  In the first embodiment, for example, it is necessary to share the access levels in a time division manner using the same core. However, in the second embodiment, since the cores are different, the access level switching point The amount of processing required for software such as register clearing in the system is also reduced.

  FIG. 13 is a basic processing flowchart of the processor in the second embodiment. The processing will be described focusing on processing different from that in FIG. 3 in the first embodiment. Assuming that the secure core 31 and the normal core 32 in FIG. 12 are basically in an equal relationship, each core uses a program stored in the encryption ROM code area 14 when the power is turned on. Execute the boot process. That is, as described above, the program encrypted using the CPU unique key 15 in the boot process by the secure core is decrypted in step S1, and the boot process is executed. If this boot process is successful, the state is defined as the basic trust point of the program as described above, and the secure core then continues to operate exclusively as a key process monitor, for example.

  On the other hand, the normal core 32 is mainly in charge of processing corresponding to the access level 2 such as OS. In step S3 of FIG. 13, the power is turned on on the normal core 32 side in response to the authentication process of the program on the secondary storage being executed on the secure core side, and the program in the encrypted ROM code area 14 is turned on in step S55. The boot process is executed. At this point, assuming that the program in the encrypted ROM code area 14 is absolutely reliable by the secure core 31, the boot process on the normal core side basically ends without any problem. The startup process of the OS or the like in step S5 is subsequently executed.

  FIG. 14 is a block diagram of the configuration of the processor in the case where the normal core is controlled by the secure core so that the secure core and the normal core are not in an equal relationship but the security is strictly applied in the second embodiment. It is. Compared to FIG. 12 in which the secure core 31 and the normal core 32 are basically in an equal relationship, the components of the processor are the same, but a core control signal is given from the secure core 31 to the normal core 32. Is different. Specific examples of the core control signal include a reset signal and an interrupt signal.

  FIG. 15 is a flowchart of the overall processing by the processor of FIG. In the figure, on the secure core 31 side, system auditing is performed in addition to the key table operation processing, key management processing, and authentication processing block setup instead of step S2 in step S57 following the boot processing in step S1. In this system audit, whether or not the system configuration has been changed and whether or not the program on the secondary storage has been changed is verified, and it is confirmed that there is no problem in the system security function and the system configuration.

  Thereafter, in step S58, the normal core is activated from the secure core 31 side. In response to this, on the normal core 32 side, activation processing using the program stored in the encrypted ROM code area 14 is executed in step S59. The The subsequent processing is the same as in FIG. 3, for example.

  FIG. 16 is an explanatory diagram of a normal core stop control process as one of the control processes of the normal core 32 by the secure core 31 in the processor of FIG. In the figure, for example, in the execution of the authenticated program in step S6 on the normal core side, the secure core 31 side is requested to perform key processing for authentication of data and the like, and in the operation of the key processing monitor in step S4, When a violation of the security standard is detected, processing by the normal core 32, that is, execution of the authenticated program in step S6 and execution of the unauthenticated program in step S7 are stopped by an instruction from the secure core 31 side. The

  FIG. 17 is a flowchart of the control process of the normal core 32 by the secure core 31 in FIG. On the secure core 31 side, the boot process is executed in step S61. When the process is completed in step S62, the activation control to the normal core 32 side is performed, the normal core is activated in step S63, and released in step S64. Normal processing that does not require a key other than the key or authentication processing is executed on the normal core side. The secure core 31 always performs authentication / monitoring processing using the monitoring information sent from the normal core 32 in step S65. In step S66, it is determined whether an error has occurred. The processing after step S65 is continued, and if an error occurs, a stop request or interruption to the normal core 32 side is performed to stop the processing on the normal core 32 side. For the normal core control by the secure core, the reset signal is used as an example as described above. However, as another method, an NMI (non-maskable interrupt) for the CPU can also be used.

  FIG. 18 is a block diagram showing the configuration of a processor having a key generation mechanism in the second embodiment. In the figure, in addition to the configuration of FIG. 12, a key generation mechanism 34 is provided.

  FIG. 19 is an explanatory diagram of key generation by the secure core and encryption processing using the generated key in the second embodiment. In the figure, a secure core 31 in the processor generates a public key Ke, N and a secret key Kd35 using a CPU unique key 15 and a key generation mechanism 34. For example, a public key Ke, N via a normal core 32 is generated. Shall be notified to the outside. At this time, the secret key Kd is not passed to the normal core 32 side, and the normal core 32 cannot execute a key process other than the public key as described above.

  For example, when the ciphertext C encrypted using the public key and the original text P is input to the normal core 32, the normal core 32 does not hold the secret key Kd, so the secure core 31 is requested to perform decryption processing. To do. The secure core 31 decrypts the original text P using the secret key Kd.

  Next, a third embodiment of the present invention will be described. FIG. 20 is a block diagram of the basic configuration of the processor in the third embodiment. In the figure, the processor 40 includes an execution unit 41, a load store unit 42, an encryption circuit 43, and a decryption circuit 44, and the load store unit 42 includes a cache memory 45 and a memory management unit 46.

  The third embodiment is basically a processor that executes a secure operation in the same manner as the first and second embodiments described above. However, the cryptographic processing block in the first embodiment is provided inside the processor 40. Similarly to the encryption circuit 43 that encrypts the store data and the decryption circuit 44 that decrypts the load data including the fetched instruction, the execution unit 41 sends the store encryption key and the load data. There is a basic feature in that a decryption key is designated.

  In the third embodiment of FIG. 20, a plaintext as a command and store data is given from the execution unit 41 to the load / store unit 42, and a plaintext is loaded from the load / store unit 42 to the execution unit 41. Data is given. Of these, the command is given to the main memory and the secondary memory described in FIG. 2 through the load store unit 42, for example, but the store data as plaintext is given to the encryption circuit 43 as encrypted store data. For example, the encrypted load data output to the main memory and input from the main memory, for example, is decrypted by the decryption circuit 44 and supplied to the load store unit 42 as load data as plain text.

  FIG. 21 is a block diagram showing the configuration of a processor having a key table memory for storing an encryption key and a decryption key in the third embodiment. In the figure, a key table memory 47 stores an encryption key for encrypting store data, and a key table memory 48 stores a decryption key for decrypting load data. The execution unit 41 gives a key number instruction for storing and an instruction to update the encryption key for storing to the key table memory 47, and an instruction for a key number for loading to the key table memory 48. An instruction to update the decryption key for loading is given. The configuration of the key table memory will be described later.

  FIG. 22 is a block diagram showing a configuration of a processor including a key table memory for storing an instruction fetch decryption key for decrypting an instruction fetched in the third embodiment. In the figure, the execution unit 41 performs, for example, an instruction access state process for fetching an instruction stored in the main memory. For example, the instruction fetch data is given to the decoding circuit 44 as load data from the main memory. At this time, the execution unit 41 gives an instruction access status flag to the key table memory 48, and the decryption circuit 44 decrypts the instruction fetch data using the decryption key for instruction fetch output from the key table memory 48, The instruction fetch data as plain text is given to the execution unit 41 via the load / store unit 42. The execution unit 41 gives an instruction to update the instruction fetch decryption key to the key table memory 48 as necessary.

  FIG. 23 is a configuration block diagram of a processor including a key selection register for giving an instruction of a key number to be used for the key table memory in the third embodiment. In the figure, a key selection register 51 for giving a key number for store key to the key table memory 47 between the key table memory 47 for storing the store encryption key and the execution unit 41, and a key for storing the decryption key for load A key selection register 52 is provided between the table memory 48 and the execution unit 41 to give a key number for loading to the key table memory 48. The execution unit 41 gives an instruction to update the store key selection register to the key selection register 51, and gives an instruction to update the load key selection register to the key selection register 52.

  That is, in FIG. 21, the execution unit 41 outputs a key number instruction corresponding to each execution instruction, whereas in FIG. 23, a register update instruction is given for each section of the instruction, and the next update is performed. Until the instruction is given, encryption / decryption is performed using the same key. It is to be noted that both a path for directly giving a key number instruction from the execution unit to the key table memory and a path via the key selection register are provided. For example, the execution unit 41 instructs which path in response to the execution instruction. It is naturally possible to adopt a configuration in which a signal indicating whether to use is given to the key table memory.

  FIG. 24 is a block diagram showing the configuration of a processor including a key selection register corresponding to the instruction access state of the execution unit in the third embodiment. In FIG. 22, as in FIG. 22, the execution unit 41 is in an instruction access state to be fetched from main memory, for example, and an instruction access state flag is given from the execution unit 41 to the key selection register 52. Correspondingly, the key selection register 52 gives an instruction fetch key number instruction to the key table memory 48 that stores the instruction fetch decryption key.

  FIG. 25 is an explanatory diagram of a configuration example of the key table memory in the third embodiment. In the figure, the key table memory stores an encryption key and its attribute in correspondence with each other, and a key number instruction is given directly from the execution unit 41 or via the key selection register. It is used as a read address, and an encryption key or a decryption key is given together with designation information of an encryption method for the encryption circuit 43 or the decryption circuit 44 and attribute data indicating whether encryption is possible. The key update number instruction given from the execution unit 41 is used as a write address, and key update data is written.

  The attribute data of each entry indicates entry validity / invalidity, encryption on / off, encryption method, encryption mode, and the like, and the encryption key depends on the specified encryption method. Note that the data for instructing encryption on / off corresponds to an instruction for loading and storing plaintext data without performing encryption / decryption, as will be described later.

  FIG. 26 is an explanatory diagram of a configuration example of the encryption circuit and the decryption circuit in the third embodiment. For example, the decoding circuit 44 shown in FIG. 20 basically includes a decoding pipe 55 and a bus arbiter 57, and the decoding pipe 55 operates in response to input of command information from the execution unit 51 via the command buffer 59. The decryption pipe 55 is an N-stage pipe for decrypting, for example, encrypted data input from the main memory via the bus into plaintext data, and this N-stage pipe is a conceptual example of one stage of common key encryption processing. A certain process 56 is connected in N stages. The plain text data output from the decryption pipe 55 is stored, for example, in the cache memory 45 of FIG. 20 via the bus arbiter 57.

  The encryption circuit 43 is basically composed of an encryption pipe 60 and a bus arbiter 61. For example, 32-bit plain text data is given from the cache memory 45 to the encryption pipe 60, and the encryption data encrypted by the N-stage pipe using the encryption key specified by the execution unit 41 is output. The encrypted data is given to, for example, a bus connected to the main memory via the bus arbiter 61. The operation of the encryption pipe 60 is controlled by command information given from the execution unit 41 via the command buffer 59 in the same manner as the decryption pipe 55. The basic structure of processing at each stage of the encryption pipe 60 is the same as that in the decryption pipe 55. Furthermore, various encryption methods such as AES128, DES, and SC2000 can be used as the encryption method. As the AES method, specifications of AES192 and AES256 are also defined.

  For example, the bus arbiter 61 performs arbitration for the bus connected to the main storage device or the secondary storage device, and is basically irrelevant to the operation of the secure processor in the present invention.

  In FIG. 27, not all data is encrypted in the third embodiment, but part of the data is kept as plain text data, for example, encryption with data overtaking function for input / output to / from main memory. It is a block diagram which shows the structure of a circuit and a decoding circuit. In this figure, the basic configurations of the encryption circuit and the decryption circuit are the same as those in FIG. 26. However, for example, on the encryption circuit side, data that does not need to be encrypted among plaintext data provided from the cache memory 45. Is directly supplied to the bypass selector 63 without passing through the encryption pipe 60, and is stored in one of the plurality of bypass buffers 64 together with the encrypted data output from the encryption pipe 60, via the bus arbiter 61. For example, it is given to a bus connected to the main memory.

  Selection of plaintext data or encrypted data by the bypass selector 63 is also controlled by command information from the execution unit 41 via the command buffer 59. Since processing by the encryption pipe 60 takes time, plain text data that does not need to be encrypted can be given to the main memory side by overtaking the encrypted data under the control of the bypass selector 63. In FIG. 27, the key necessary for encryption is given to the encryption pipe 60 via the key register 69.

  For example, unencrypted plaintext data among the data from the bus connected to the main memory is directly supplied to the bypass selector 66 without passing through the decryption pipe 55 and bypassed together with the plaintext data decrypted by the decryption pipe 55. The data is stored in one of the plurality of bypass buffers 67 by the selector 66 and output to the cache memory 45 via the bus arbiter 57.

  FIG. 28 is an explanatory diagram of the read-modify-write method for supporting the write-through cache method in the third embodiment. When the cache memory 45 employs the write-through method, if a cache miss occurs during storage, the data is not stored in the cache memory 45 but is stored in the main memory as it is. If the data to be stored is, for example, only 1 byte, 1 byte data is stored in the main memory. However, in the third embodiment, the store data is basically stored in the main memory after being encrypted by the encryption circuit 43. In general, a certain amount of data is stored as store data in the encryption process. Even if data of only 1 byte is encrypted and stored in the main memory, correct decryption is difficult.

  For example, when it is necessary to store 1 byte of data in the main memory, the load / store unit 42 in FIG. 28 loads data of a length necessary for the encryption process from the main memory, and stores the loaded data and the store. A read-modify-write operation is performed in which 1-byte data to be combined is encrypted, and the combined data is encrypted and stored in the main memory.

  That is, for example, if a cache store instruction (1) for storing 1-byte data in the cache is determined as a cache miss in (2), a load as a command is loaded from the cache memory 45 to the main memory in (3). In (4), plain text load data is stored in the read-modify-write (RMW) buffer 71 via the decryption circuit 44, and data to be stored is given to the RMW buffer 71 in (5). Data obtained by combining the data to be stored and the load data is provided to the encryption circuit 43 in 6), and a store as a command is issued to the main memory in (7).

  Next, a fourth embodiment of the present invention will be described. In the fourth embodiment, the execution unit 41 specifies the encryption key used by the encryption circuit and the decryption key used by the decryption circuit in the third embodiment. In contrast, the execution unit 41 specifies an access address of data to be stored or loaded when an instruction is executed by the execution unit 41, and an encryption key or a decryption key is selected according to the address. Yes.

  FIG. 29 is a block diagram of the basic configuration of the processor in the fourth embodiment. In addition to the execution unit 41, the encryption circuit 43, and the decryption circuit 44, the processor 40 provides the store encryption key to the encryption circuit 43 corresponding to the address given from the execution unit 41, and decrypts the load. A key table memory 73 is provided for providing the encryption key to the decryption circuit 44.

  FIG. 30 is a block diagram showing the configuration of a processor in which a key is selected corresponding to a logical address of store data or load data specified by an execution unit. Unlike FIG. 29, the processor 40 includes a key table memory 74 for storing a store encryption key and a key table memory 75 for storing a load decryption key, as well as a cache memory 45, a memory management unit. For example, a load store unit 42 including 46 is provided as in FIG. The address given from the execution unit 41 to the load store unit 42, that is, the address of the store data or the load data is a logical address, and this logical address is given to the key table memory 74 or 75 to store an encryption key, or A load decryption key is selected and applied to the encryption circuit 43 or the decryption circuit 44, respectively. The execution unit 41 gives an instruction to update the store encryption key to the key table memory 74, and gives an instruction to update the decryption key for load to the key table memory 75.

  FIG. 31 is a block diagram showing a configuration of a processor in which a key is selected corresponding to a physical address of data in the fourth embodiment. Compared to FIG. 30, the physical address of the store data or the physical address of the load data is given from the load / store unit 42 to each of the key table memories 74 and 75, and the store encryption is corresponding to the address. The encryption key is given to the encryption circuit 43, and the decryption key for loading is given to the decryption circuit 44, respectively.

  FIG. 32 is a block diagram of the key table memory in the fourth embodiment. When this figure is compared with FIG. 25 in the third embodiment, when 32 bits from the 0th bit to the 31st bit are given as the data access address from the execution unit side, the encryption key stored as the read address becomes the encryption key. It is selected and given to the encryption circuit 43 or the decryption circuit 44 together with the encryption attribute. When a different key is used for every 4 kbytes as the read address of the memory, the encryption key is selected using the 12th to 31st bits of the address. As will be described later, this 4 kbyte corresponds to the size of one page in the main memory, for example. If this 4 kbyte is called an encryption address unit, the entry data in the key table memory includes an address tag excluding the total number of entries × address unit. For example, if the total number of entries is 32 (5 bits), the 17th to 31st bits of the address are tags.

  FIG. 33 is an explanatory diagram of a key table memory having a plurality of ways in the third embodiment. In the figure, the key table memory is composed of a plurality of tables from the key table 1 to the key table 4, and is stored in one of the four tables corresponding to the access address given from the execution unit side. The key and the encryption attribute are selected and given to the encryption circuit 43 or the decryption circuit 44.

  FIG. 34 is an explanatory diagram of a configuration example of a key table memory using an associative memory method. In the figure, the access address 32 bits is classified into one of the target address ranges corresponding to each of the encryption keys stored by the comparison / selector 77, and the encryption key corresponding to the range is selected and encrypted together with the encryption attribute. To the decoding circuit 43 or the decoding circuit 44. In FIG. 34, the address tag excluding the address unit is included in the entry regardless of the total number of entries. When the address unit is 4 kbytes, the 12th to 31st bits of the address are tags.

  FIG. 35 is a block diagram showing the configuration of a processor that selects a key corresponding to either a logical address or a physical address of data in the fourth embodiment. In the figure, a logical address of data is given to the key table memories 74 and 75 from the execution unit 41, and a physical address is given to the key table memory 74 from the load store unit 42, and store data is given to the key table memory 74 from the execution unit 41. Are selected, and the key table memory 75 is given a load data logical address and physical address selection instruction. In response to these selection instructions, a key corresponding to either a logical address or a physical address is selected and provided to the encryption circuit 43 and the decryption circuit 44.

  FIG. 36 is a configuration example of a processor including a key selection register that gives a selection instruction of a logical address and a physical address to the key table memory. Compared with FIG. 35, key selection registers 78 and 79 are provided between the execution unit 41 and the key table memories 74 and 75, respectively, and a logical address and physical address selection instruction for store data and a logical for load data are provided. An instruction for selecting an address and a physical address is output to the key table memories 74 and 75. The execution unit 41 gives an instruction to update the key selection register to the key selection registers 78 and 79, respectively.

  FIG. 37 shows a configuration example of the key table memory in FIG. 35 and FIG. In the figure, the key table memory includes a physical address key table and a logical address key table, and outputs a physical key and a logical key corresponding to the physical address and the logical address, respectively, and a key selection instruction from the execution unit 41 side. Alternatively, either the physical key or the logical key is output to the encryption circuit 43 or the decryption circuit 44 together with the encryption attribute by the physical / logical key selection unit 81 in response to the selection instruction from the key selection register.

  FIG. 38 shows a configuration example of a processor provided in the memory management unit (MMU) 46 in the load / store unit 42 using the contents of the key table memory as a key table in the fourth embodiment.

  FIG. 39 and FIG. 40 are explanatory diagrams of the storage format of the key information in the memory management unit and the cache memory access method. In general, the translation lookaside buffer (TLB) in the MMU 46 stores the correspondence between the logical address and the physical address in each entry corresponding to each page in the physical memory, for example. In 39, key information corresponding to the page is stored in each entry of the TLB. For example, when the data access address is a logical address, the entry having the same logical address is selected, and the attribute and access of the data corresponding to the entry are selected. The attribute is checked by the attribute check 83, and the command generated by the cache command generation 84 is sent to the cache memory 45.

  On the cache memory 45 side, a tag is searched according to the content of the received command, and in the case of a cache hit, a data response is immediately returned to the execution unit 41 side. 43, a command corresponding to the tag is issued to the encryption / decryption bus interface 85 including the decryption circuit 44. At this time, the key information and physical address read from the entry are used. For example, response data from the main memory is decrypted and stored in the cache memory, and a data response is returned to the execution unit 41.

  FIG. 40 is an explanatory diagram of a key information storage format when an address map register (AMR) instead of TLB is provided in the memory management unit. In the figure, information corresponding to the stored contents of the TLB is stored not in the memory but in a register. For example, the page size can be made variable, and a large data area can be covered by one entry.

  FIG. 41 shows that the execution unit 41 gives an encryption key to the encryption circuit 43 and the decryption key is sent to the decryption circuit 44 when the memory management unit (MMU) inside the load / store unit is in an operation stop state, that is, in an OFF state. FIG. In the figure, the ON / OFF signal of the MMU is given to the encryption circuit 43 and the decryption circuit 44. When the signal is OFF, the encryption circuit 43 and the decryption circuit 44 are the keys given from the execution unit 41. When the signal is ON, Encryption or decryption processing is executed using a key given from the TLB 87 or the AMR 88 inside the memory management unit 46.

  FIG. 42 is an explanatory diagram of a key switching method in the encryption circuit and the decryption circuit of FIG. In the figure, the configurations of the encryption circuit and the decryption circuit are basically the same as those in FIG. 26 in the third embodiment, but a key selector 90 is added to the value of the MMUON / OFF signal given from the execution unit. Accordingly, when the key is OFF, the key given from the execution unit is selected by the key selector 90 and either the TLB or the key given from the AMR is selected when the key is ON, and given to the encryption pipe 60 and the decryption pipe 55.

  FIG. 43 is an explanatory diagram of input / output signals of the execution unit in the third embodiment and the fourth embodiment. First, in FIG. 20 in the third embodiment, the load decryption key, the store encryption key, the store data, and the command are output signals, and the load data is an indispensable signal (circle mark), and the access address, load The store status signal is a signal (Δ mark) that exists structurally.

  For FIG. 21, the output signal of the load key number instruction instead of the load decryption key and the store key number instruction instead of the store encryption key are essential. In FIG. 21, since the update to the key table memory is equivalent to the register access from the viewpoint of the execution unit, the register related input / output signals are also essential.

For FIG. 22, an input / output signal corresponding to the instruction access state is required, and an execution state signal is required as an output signal and instruction fetch data is essential as an input signal.
In FIGS. 23 and 24, since the key selection register is used in addition to FIGS. 20 and 21, input / output signals related to the register are also essential.

  In the following, the description will be simplified, and the characteristic part will be described. In FIG. 21 + FIG. 22 + FIG. 23, in addition to the input / output signals when the three figures are combined, whether the process corresponds to the supervisor or the user. In this case, a supervisor user state signal and a context, that is, a process ID (identifier) data is added. These supervisor / user status signal and context ID data are used for selecting an encryption key and a decryption key in addition to a key number instruction signal output from the execution unit in the third embodiment.

  FIG. 29 and subsequent figures correspond to the fourth embodiment, and an access address to data is an indispensable output signal. In FIGS. 35 and 36, a key for selecting either a logical address or a physical address is used. A selection instruction signal is output.

  For FIG. 38, since a key table is added to the TLB inside the memory management unit, a register-related signal is a signal that exists structurally, and a supervisor user status signal and context ID data are included. The added case is shown. These added signals are also used for selecting an encryption key and a decryption key together with an access address, as in the third embodiment.

  For FIG. 41, a case where a key output from the execution unit corresponding to the value of the state signal indicating ON / OFF of the memory management unit (MMU) is used, and a key output from the TLB, for example, is used. In some cases, supervisor / user status signals and context ID data are also added, and all input / output signals are indispensable.

  As described above, in the third and fourth embodiments, since the key for encrypting / decrypting data and instruction code is designated by the execution unit, encryption processing is performed at a level corresponding to the instruction to be executed. It is also possible. Also, by specifying an encryption / decryption key using a key selection register or an access address, encryption processing can be performed in program units or access units, and can be used properly according to various situations.

  Next, a fifth embodiment of the present invention will be described. As the fifth embodiment, for example, a more detailed configuration for realizing the secure operation of the secure processor as the first embodiment is shown, and the process (program) reliability point is expanded corresponding to the configuration. Operations such as setting an authentication key for authentication and process authentication will be described in detail.

  FIG. 44 is a diagram showing the functional configuration required in the processor for explaining the fifth embodiment. In FIG. 2, a processor 100 is connected to a physical memory 101, for example, a main memory 17 in FIG. 2, and an I / O device 102, for example, a secondary memory 18.

  The processor 100 performs a memory access control unit 105 that controls access to the physical memory 101 and the I / O device 102, an instruction interpretation unit 106 that interprets an instruction to be executed, authentication of a page in which an execution code is stored, and the like. Authentication unit 107 to perform, for example, encryption / decryption to perform encryption / decryption of a page after authentication, signature generation / verification unit 108, secure context identifier that generates a secure context identifier corresponding to the process, that is, the context when the process is generated An identifier generation unit 109, a secure context identifier annihilation unit 110 that annihilates a corresponding identifier when the process disappears, a processor unique key 111 used for encryption, for example, authentication information corresponding to a physical page stored in the physical memory 101 Authentication information primary storage 112 to store, It is equipped with a secure DMA113 for performing a direct memory access at the time of memory access.

  The processor 100 further includes, for example, a translation lookaside buffer (TLB) 114 and a context information storage unit 115 described with reference to FIG. In the TLB 114, for example, a page table entry (PTE) 122 indicating a correspondence between a logical address and a physical address in association with a physical page is stored, and the context information storage unit 115 holds a value of a program counter ( Counter) 117, a secure context identifier register 118 for storing a secure context identifier, an authentication key register 119 for storing a key necessary for authentication, and a register group 120.

  The physical memory 101 stores, for example, execution codes in units of physical pages 124, and the I / O device 102 stores execution codes and data in a format in which authentication information 126 is added in units of pages 125. ing. In the seventh embodiment, the authentication of the execution code of the context (process) in which the secure context identifier is stored in the secure context identifier register 118 is performed using the authentication key stored in the authentication key register 119.

  FIG. 45 is an explanatory diagram of a method for generating a secure context identifier corresponding to a context when a program operating on the processor, for example, a program used by a user is started and a context generation instruction is issued. The context generation instruction is given to the instruction interpretation unit 106 in the processor, a secure context identifier is generated by the secure context identifier generation unit 109 corresponding to the interpretation result, and the value is set in the secure context identifier register 118. In the fifth embodiment, the setting of the value in the secure context identifier register 118 is made possible only by this method. This makes it impossible to falsify the secure context identifier and impersonate other contexts. The context is basically a concept in object-oriented programming, and more generally corresponds to a process, that is, an execution state of a program. In the fifth embodiment, the term context is used instead of a process.

  FIG. 46 is an explanatory diagram of a specific method for generating a secure context identifier. For the generation, a random number generator 127 can be used as shown in the figure, or a monotonically increasing counter 128 can be used. The probability that the same value is generated as a random number is not 0, and the counter value will be the same value after a round. Therefore, it is not possible to guarantee uniqueness as an identifier, but a secure context identifier with a sufficiently long bit length should be used. Can substantially prevent problems.

  Alternatively, as shown in the figure, the secure context identifier may be generated by combining the existing context ID of the processor and the output of the random number generator 127 by the combining unit 129 or combining with the output of the monotonically increasing counter 128. . Note that the existing context ID is an arbitrary value set by the OS, for example, and generally does not guarantee uniqueness.

  FIG. 47 is an explanatory diagram of the secure context identifier disappearance method. In the figure, when a program operating on the processor issues a context disappearance instruction, the processor invalidates the contents of the secure context identifier register 118. The invalidation method may be 0 clear, or a register storage area for valid / invalid may be provided in the register, and the flag may be set invalid.

  FIG. 48 is an explanatory diagram of the authentication information 126 added to the execution code 125 in page units in FIG. A key for authenticating the execution code 125 using the authentication information 126 is stored in the authentication key register 119 inside the context information 115 in the processor. For example, when an electronic signature by RSA is used as the authentication information, the authentication key is an RSA public key, and SHA (secure hash algorithm) -1 HMAC (hash-based message authentication code) of a common key system is used. In this case, the authentication key has a value of 20 bytes.

  The key is stored in the authentication key register 119 when the context is generated by the OS, that is, when the context information is initialized, and at the same time, the validity of the authentication key is checked. If the authentication key itself is generated by a malicious person and the authentication information corresponding to the malicious execution code is generated by the key, the authentication process itself succeeds without any problems, and the authentication function by the processor Will not work. Therefore, how to ensure the authenticity of the authentication key is an important issue.

  FIG. 49 is an explanatory diagram of a key setting method for the authentication key register when the authentication key is a public key. In the figure, it is assumed that the authentication key is an RSA public key, and the certificate authority certificate, that is, the certificate authority public key 134 is embedded in, for example, a processor at the time of factory shipment, and thereafter cannot be replaced or changed. Shall. The authentication key to be set in the authentication key register 119 is given as a certificate key setting command to the processor at the time of context generation, for example, in a form with a signature by the certificate authority private key. After being interpreted and verified by the signature verification unit 108, it is stored in the authentication key register 119. As a result, only the public key with the certificate authority's certificate is set in the authentication key register.

  FIG. 50 is a flowchart of the authentication key setting process in FIG. First, in step S71, an instruction key setting command is fetched by the command interpretation unit 106 in step S71, and the public key fetched by the signature verification unit 108 is verified using the signature and the certificate authority public key in step S72, and verified in step S73. If successful, the public key included in the setting instruction fetched by the instruction interpretation unit 106 is stored in the authentication key register 119. If the verification fails, the process is immediately terminated. To do.

  51 shows a key setting method when the authentication key is a common key, and FIG. 52 is a flowchart of the key setting process. When a common key is used as a certification key, it is necessary to receive the authentication key by a secure method from the side that adds the authentication information to the execution code. Here, it is assumed that the HMAC key encrypted using the RSA public key is received together with the authentication key setting command, decrypted by the decryption unit 108 using the processor-specific RSA private key 137 on the processor side, and stored in the authentication key register 119. Shall.

  In the flowchart of FIG. 52, first, in step S76, the instruction interpretation unit 106 fetches the authentication key setting instruction, and in step S77, the encrypted HMAC key included in the instruction is decrypted using the processor-specific RSA private key 137. And the HMAC key decrypted in step S78 is stored in the authentication key register 119 by the instruction interpretation unit 106, and the process is terminated.

  FIG. 53 is a page for storing the execution code of a context in which a secure context identifier has already been generated in the main memory, that is, the physical page of the physical memory 101, and enabling the execution of processing by authenticating the physical page. FIG. 54 is a flowchart of processing in this page-in.

  In this page-in process, first, after the execution code is stored in the physical page and various data in the page table entry (PTE) is set by the OS, a context, that is, an authentication unit 107 is set from the OS. A request to set a secure page flag field as a physical page authentication request is made. After the physical page is authenticated by the authentication unit 107 in response to the request, the flag of the secure page flag field is set. It becomes possible.

  When the process is started in the process flowchart of FIG. 54, the execution code is stored in the empty physical page by the OS in step S80, and the start address of the physical page and the start address of the corresponding logical page are physically set by the OS in step S81. An address and a logical address are set in the PTE inside the TLB, and the value of the secure context identifier is set in the PTE in step S82. For example, as described with reference to FIGS. 45 and 46, it is assumed that the secure context identifier generated when the context generation instruction is issued and stored in the secure context identifier register 118 can be read by the OS. Set the identifier to PTE.

  Thereafter, in step S83, the OS sets the read / write attribute, etc. for the page to the PTE as necessary, and in step S84, the OS requests the authenticating unit 107 as hardware to set the secure page flag field. Is done. It should be noted that the OS itself is already authenticated, and the setting of the secure page flag field is basically the job of the OS, but here the flag setting request from the authenticated OS to the hardware. Is done.

  In step S85, authentication processing by the authentication unit 107 is executed. Details of this processing will be described later. In this process, the physical page is authenticated using the authentication key of the context corresponding to the secure context identifier and the authentication information stored in the authentication information primary storage unit 112, and whether or not the authentication is successful in step S86. If the determination is successful, the flag in the secure page flag field is set, and the PTE can be used thereafter. On the other hand, if it fails, the flag of the field is reset, the PTE is disabled, and recovery or error processing by the OS is performed in step S89.

  For example, the processing in FIG. 54 is intended for a processor whose value can be directly set for the PTE in the TLB. For example, in a processor in which a value is set in the PTE on the main memory and the TLB serves as its cache. The processes from step S80 to step S83 are performed on the PTE in the main memory, and the operations after step S84 are performed at the timing when the contents are cached in the TLB.

  55 is a configuration example of the authentication unit 107 in FIG. 53, and FIG. 56 is a flowchart of the authentication processing in step S85 in FIG. Here, it is assumed that the SHA-1 hash value is calculated from the entire page and compared with the decryption result of the electronic signature. As shown in FIG. 56, it is naturally possible to realize the operation of the authentication unit 107 not as hardware but as software processing.

  In FIG. 55, the physical page 125 is divided into 64 bytes each and is given to the SHA-1 hash calculator 140, and the hash value of the entire page is calculated and given to the comparator 142. On the other hand, the RSA electronic signature stored in the authentication information primary storage unit 112 is given to the RSA decoder 141 together with the RSA public key stored in the authentication key register 119, and the decrypted hash value as an output thereof is output by the comparator 142. If they match with the output of the SHA-1 hash calculator 140, they are determined to be successful, and if they do not match, they are determined to be failed.

  In the authentication processing of FIG. 56, first, a physical page is read in 64-byte units in step S90, a hash operation is performed in step S91, and it is determined whether or not the page end has been reached in step S92. The process after step S90 is repeated.

  If the end has been reached, the digital signature is decrypted using the RSA public key in step S93, the decryption result and the hash operation result are compared in step S94, and if they match, the secure page flag is determined in step S95. If the fields are set and they do not match, the secure page flag field is reset in step S96, and the process ends.

  As described above, in the fifth embodiment, the execution code is authenticated when the execution code is paged into the physical memory (main memory), and the secure page flag indicating that the authentication is successful is set.

  Next, memory access control at the time of execution of an instruction on a physical page in the present invention will be described as a sixth embodiment. FIG. 57 is an explanatory diagram of a memory access control method when executing an instruction on a physical page. In the figure, the secure context identifier register 118 contains a meaningful value, the secure page flag field of the PTE 122 is set, and the identifier value stored in the secure context identifier register 118 and the PTE 122 When the context identifier values match, execution of the instruction on the physical page 124 is permitted. This control is performed by the memory access control unit 105. Note that it is assumed that the data read / write attribute and supervisor attribute for the physical page are not directly related to the contents of the present invention and are separately performed.

  FIG. 58 is an explanatory diagram of an operation example of the memory access control unit 105. In the figure, it is assumed that the content of the thick one-dot chain line corresponds to the memory access control unit 105, and the secure page flag field and the secure context identifier are included as attribute data of the PTE inside the TLB 114.

  Similarly to FIG. 39, for example, when an access using a logical address as an access address is performed, the attribute data of the PTE selected by the address is read, compared with the access attribute and the attribute check 146, and the check result is OK. If there is, the cache command generation 147 is performed using the physical address read in correspondence with the logical address and the attribute check result. For example, the tag 148 in the cache memory 45 in FIG. In this case, the data response is returned as it is, and in the case of a cache miss, for example, data loaded from the main memory is stored in the cache memory via the queue and the bus interface 149 and the data response is returned to the execution unit. .

  FIG. 59 is a processing flowchart of the memory access control unit 105 at the time of instruction fetch. When a logical address for instruction fetch is output by the instruction execution unit 144 of FIG. 57, PTE attribute data corresponding to the logical address specified in step S98 is selected, and in step S99, the current context, that is, the current execution is executed. It is checked whether the context to be secured is a secure context, i.e. has a valid secure context identifier. If it is a secure context, it is checked in step S100 whether or not the secure page flag field (SPF) of the PTE corresponding to that context is set. If it is set, in step S101, the current context is secured. It is determined whether or not the context identifier, that is, the identifier stored in the secure context identifier register 118 matches the secure context identifier stored in the PTE.

  If they match, in step S102, for example, a read / write attribute or a supervisor attribute as a page attribute corresponding to the context is checked. If OK, a physical address for instruction fetch in step S103. Is generated to output to the cache, and the process ends.

  If the current context does not have a valid secure context identifier in step S99, it is determined in step S104 whether or not the secure page flag field (SPF) in the corresponding PTE is set. If not, a secure context identifier is not set, and an execution code similar to the conventional one that is not authenticated is to be processed, and the process proceeds to step S102. If the determination result in steps S100 and S101 is No, if the determination result in step S104 is Yes, or if the determination result in step S102 is No, error processing is performed in step S105 and processing is performed. finish. Note that here, processing to decompose the logical address into the top address of the logical page and the offset value in the page and processing to add the top address of the physical page and the offset value are necessary. There is no direct relationship with the present invention, and a description thereof is omitted.

  FIG. 60 is an explanatory diagram of a memory access control method in a processor provided with a secure core and a normal core. In the figure, the normal core 152 performs only the same processing as the conventional processing unrelated to the processing by the encryption processing block 12 and the code authentication processing block 13 as in FIG. 12 in the first embodiment. Can execute a secure operation including an authentication control of a code authentication processing block, including an operation control by an encryption processing block not described in FIG.

  60, the use of a physical page corresponding to the PTE in which the secure page flag field is set is permitted from the secure core 151 by the control of the memory access control unit 105, but the page cannot be used from the normal core. Control is performed.

  44, the code authentication processing block controlled from the secure core includes a memory access control unit 105, and includes an authentication unit 107, encryption / decryption, signature generation / verification unit 108, secure context identifier generation unit 109, secure context identifier. It corresponds to the extinguishing unit 110, the processor unique key 111, the authentication information primary storage unit 112, the secure DMA 113, the secure context identifier register 118, the authentication key register 119, and the secure page flag field and secure context identifier inside the PTE 122.

  In FIG. 60, the secure core 151 executes the authentication process, executes only the execution code in the physical page whose secure page flag field is set to PTE, and the normal core 152 executes only the normal code that is not authenticated. However, it is also possible to configure the normal core to execute the authenticated code in addition to the normal code.

  FIG. 61 is a configuration block diagram of a processor including a core that switches between a secure mode and a normal mode. In the figure, a mode register 155 is provided in the core 154, and a page in which the secure page flag field is set can be used only in the secure mode. Note that switching between the secure mode and the normal mode may be performed using an interrupt as a trigger, for example, as in switching between the normal user mode and the kernel mode, or other methods may be used.

  FIG. 62 is an explanatory diagram of a page data transfer method to the physical memory 101 by the secure DMA 113 in FIG. 44 as a memory access control method, and FIG. 63 is a flowchart of data transfer processing by the secure DMA 113. For example, in the page-in process of FIGS. 53 and 54, the execution code is authenticated after the page data as the execution code is stored in the physical page. In the authentication process, processing such as calculation of a hash value is performed. In this case, the hash value is calculated for each transfer unit of page data, and the operation of holding the result as an intermediate result of the hash operation is repeated. At the end of the transfer, the hash operation is terminated, and the result is This is used for authentication processing.

  62, the secure DMA 113 includes a transfer management unit 157 that receives the transfer source address, transfer destination address, and transfer size of data from the core 154, a data reader 158 that reads data from the I / O device 102, and a hash calculation that performs hash calculation. 159, a data writer 160 that writes page data to the physical memory 101, and a physical page head address holding unit 161 that holds the head address of the physical page and a hash value for the page.

  When the processing is started in FIG. 63, the program running on the core 154, generally the transfer management unit 157 that has received an instruction such as the transfer source address from the OS, sends the data reader 158 from the I / O device 102. Next, reading of the next 64 bytes of data is instructed. In step S111, 64 bytes of data is read by the data reader 158. In step S112, the transfer management unit 157 instructs the hash calculator 159 to perform a hash operation. In step S113, a hash operation is performed by the hash calculator 159, and the intermediate result is held therein. In step S114, the transfer management unit 157 writes 64-byte data to the physical memory 101 to the data writer 160. Instructed to write data in step S115 In step S116, it is determined whether or not the data transfer for one page has been completed. If not, the process from step S110 is repeated and the process ends. If so, the transfer management unit 157 gives a pair of a physical page head address and a hash value as a transfer destination address to the holding unit 161 and ends the process.

  FIG. 64 is a process flowchart at the time of code execution including control of memory access. This figure is typically a flowchart of processing at the time of page-in by the OS, and the feature of the present invention is in processing surrounded by a thick line. When the processing is started, first, in step S120, the secure DMA 113 is instructed about the transfer source / destination address, the transfer size, etc., and in step S121, it is determined whether or not the transfer is successful. 54. After various information is set in the PTE in the TLB as in steps S81 to S83 in FIG. 54, the secure page flag field is requested in step S123 as in step S84, and authentication processing by the authentication unit is executed. In step S124, it is determined whether or not the flag has been successfully set. If successful, the process is terminated. If the transfer fails in step S121, or if the set fails in step S124, the process ends immediately.

  As described above, according to the sixth embodiment, access to an execution code that has already been successfully authenticated is permitted after the secure context identifier and the secure page flag field are checked.

  Finally, a seventh embodiment of the present invention will be described with reference to FIGS. In the seventh embodiment, for example, when saving context information and PTE corresponding to a context switch to, for example, main memory, encryption for protecting data or addition of alteration detection information is performed. For example, in the first embodiment, the authenticated execution code is encrypted and stored in the physical memory. However, in the seventh embodiment, for example, context information is encrypted and stored in the physical memory.

  FIG. 65 is an explanatory diagram of the context information encryption method. In the figure, all of the context information stored in the context information storage unit 115 described with reference to FIG. 44 is encrypted by the encryptor 165 using the processor unique key 111 and stored in the physical memory 101 as the encrypted context information 166. Is done.

  FIG. 66 is an explanatory diagram of a context information decoding method corresponding to FIG. The encrypted context information 166 stored in the physical memory 101 is decrypted by the decryptor 168 using the processor unique key 111 at a time point required by the context switch, and stored in the context information storage unit 115.

  FIG. 67 is an explanatory diagram of a method for adding falsification detection information to context information. In the figure, for the context information stored in the context information storage unit 115, falsification detection information 170 is generated by the falsification detection information generator 169 using the processor unique key 111 and stored in the physical memory 101 together with the context information. The

  68 is an explanatory diagram of a falsification detection method for context information using falsification detection information corresponding to FIG. In the figure, the falsification detection using the processor unique key 111 is performed by the falsification detector 172 using the falsification detection information 170 added to the context information.

  FIG. 69 illustrates a context in which context information necessary for secure operation and normal context information are distinguished from context information stored in the context information storage unit 115, and only the secure operation context information 175 is encrypted. It is explanatory drawing of an information encryption system. In this method, normal context information 176, that is, context information such as an existing context ID is handled without being encrypted as in the past so that the core part of the processor is not changed as much as possible, and the authentication key register 119 is used. The content stored in the secure context identifier register 118 is encrypted as secure operation context information 175.

  As the existing context ID, for example, it is possible to store the same value as the secure context identifier as the operation of the OS. For example, when the OS is rewritten with malicious code, there is no guarantee that the values of the two identifiers will be the same, but by configuring the processor to be operable only when the values are the same, If it is not the same value, it will fall to the safe side that it will not work, and no problem will occur.

  In FIG. 69, only the secure operation context information 175 is encrypted by the encryptor / decryptor 174 using the processor unique key 111 and stored in the physical memory 101 as the encrypted context information 177. The normal context information 176 is the plaintext context. Information 176 is stored in the physical memory 101 as it is.

  FIG. 70 is an explanatory diagram of a context information storage method in which falsification detection information is added to the secure operation context information 175 and stored in the physical memory 101. In the figure, the falsification detection information generator / falsification detector 179 generates the falsification detection information 180 for the secure operation context information 175 using the processor unique key 111, and the secure operation context information 175 and the normal operation context information 175 are stored in the physical memory 101. Context information, that is, plaintext context information 176 is stored. In this example, the program counter value and the register group value as normal context information are not encrypted. However, in order to further improve the reliability, such normal context information is also included. Of course, it is also possible to add encryption or alteration detection information.

  FIG. 71 to FIG. 74 are explanatory diagrams of the protection method for the stored contents of the page table entry (PTE) 122. FIG. 71 shows the PTE encryption method, and the stored contents of the PTE 122, that is, the values of the secure page flag field, the secure context identifier, the logical address, and the physical address are encrypted by the encryptor 165 using the processor unique key 111. The encrypted PTE 183 is stored in the page table 182 in the physical memory.

  FIG. 72 is an explanatory diagram of the decryption method of the encrypted PTE corresponding to FIG. In the figure, the encrypted PTE 183 stored in the physical memory 101 is decrypted by the decoder 168 using the processor unique key 111 and stored as PTE inside the TLB 114.

  FIG. 73 is an explanatory diagram of a falsification detection information addition method for PTE, and FIG. 74 is an explanatory diagram of a falsification detection method for PTE. In FIG. 73, the falsification detection information generator 169 generates falsification detection information 185 for the PTE 122 using the processor unique key 111 and stores it in the page table 182 together with the PTE 122.

  In FIG. 74, falsification detection for the PTE 122 stored in the page table 182 is performed by the falsification detector 172 using the falsification detection information 185 and the processor unique key 111.

  As described above, in the seventh embodiment, the context information and PTE used by the secure processor are also processed for encryption and tampering detection, thereby further improving the security of information processing.

  Although the details of the secure processor and the secure processor program of the present invention have been described above, the secure processor can be a basic element of a general computer system. FIG. 75 is a block diagram showing the configuration of such a computer system, that is, a hardware environment.

  75, the computer system includes a central processing unit (CPU) 200, a read only memory (ROM) 201, a random access memory (RAM) 202, a communication interface 203, a storage device 204, an input / output device 205, and a portable storage medium reading device. 206, and a bus 207 to which all of these are connected.

  Various types of storage devices such as a hard disk and a magnetic disk can be used as the storage device 204, and such a storage device 204 or ROM 201 is used in FIGS. 3 to 5, 7, 9 to 11, and the like. The program shown in the flowchart, the program of claims 7, 19, and 20 of the claims of the present invention are stored, and such a program is executed by the CPU 200, whereby the secure processor in the present embodiment is stored. Operation, encryption key setting, code recognition processing, encryption processing, and the like are possible.

  Such a program is stored in, for example, the storage device 204 from the program provider 208 via the network 209 and the communication interface 203, or stored in the portable storage medium 210 that is commercially available and distributed, It can also be set in the reading device 206 and executed by the CPU 200. Various types of storage media such as CD-ROM, flexible disk, optical disk, magneto-optical disk, and DVD can be used as the portable storage medium 210, and a program stored in such a storage medium is read by the reading device 206. By reading, the operation of the secure processor in the present embodiment becomes possible.

(Appendix 1)
A processor comprising a core for executing instruction codes,
Key storage means for storing a key unique to the core;
Instruction code storage means for storing the encrypted instruction code in a non-rewritable format;
Authentication processing means for authenticating an instruction code including the instruction code stored in the instruction code storage means by using the unique key or an authenticated key by the unique key;
A secure processor comprising: encryption processing means for encrypting data input / output between the core and the outside.
(Appendix 2)
The secure processor according to appendix 1, wherein the encryption processing means encrypts the instruction code authenticated by the authentication processing means and stores it in a storage device connected to the secure processor in units of pages.
(Appendix 3)
An illegal instruction execution stop means is provided for stopping execution of the encrypted instruction code for each page when an illegal instruction is detected when executing the encrypted instruction code for each page stored in the storage device. The secure processor according to appendix 2.
(Appendix 4)
The secure processor according to appendix 1, wherein authentication information is added to an instruction code to be authenticated by the authentication processing means.
(Appendix 5)
The secure code according to appendix 4, wherein when the encryption key is specified in the authentication information, the encryption processing means further encrypts the instruction code using the specified key. Processor.
(Appendix 6)
The secure processor according to appendix 4, wherein when the encryption key is not specified in the authentication information, the encryption processing means further encrypts the instruction code using an arbitrary page key.
(Appendix 7)
The encryption processing means encrypts the data of the same process corresponding to the authenticated instruction code using an encryption key different from the encryption key for the instruction code. The described secure processor.
(Appendix 8)
The secure processor according to appendix 7, wherein an encryption key for the instruction code is used instead of the different encryption key when executing an instruction code stored in a data storage area in a storage device connected to the secure processor .
(Appendix 9)
In the secure processor,
The secure processor according to appendix 1, further comprising code execution stop processing means for stopping execution of an instruction code for which authentication by the authentication processing means has failed.
(Appendix 10)
As the core,
A secure core that executes only the instruction code authenticated by the authentication processing means;
The secure processor according to claim 1, further comprising a normal core that can execute a normal instruction code that is not authenticated by the authentication processing unit.
(Appendix 11)
The secure core is booted using the encrypted instruction code stored in the instruction code storage means,
The secure processor according to claim 10, further comprising normal core boot means for causing the secure core to boot the normal core after the boot is completed.
(Appendix 12)
The secure core includes normal core monitoring means for monitoring the operation of the normal core after the normal core is booted and detecting an abnormal state, and causing the normal core to stop operating or branch to a specific process. The secure processor according to appendix 11, characterized by:
(Appendix 13)
The secure processor according to claim 10, wherein the secure core provides a core control signal to the normal core to control the operation of the normal core.
(Appendix 14)
The secure processor according to appendix 10, wherein access to the core unique key is permitted for the secure core and prohibited for the normal core.
(Appendix 15)
15. The secure processor according to appendix 14, further comprising key generation means for generating a public key / private key pair and a common key using the core unique key under the control of the secure core.
(Appendix 16)
The secure core notifies the public key generated by the key generation means via the normal core to the outside,
16. The secure processor according to appendix 15, wherein an original text encrypted with the public key is received from outside via a normal core, and the original text is decrypted using the secret key.
(Appendix 17)
The secure processor according to appendix 16, wherein the original text is a key used for encrypting information.
(Appendix 18)
A program used by a core executing instruction code in a processor,
A procedure for starting the own core using a program in a memory in which an encrypted instruction code is stored in a non-rewritable format;
An authentication processing block for performing an authentication process of an instruction code including an instruction code stored in the memory, a key management process for managing the core-specific key, and an encryption / encryption of the instruction code authenticated by the authentication processing block A procedure for setting up an operation process for a key table in which a key used for the decryption process is stored;
A procedure for performing authentication processing of a program on secondary storage using the authentication processing block;
Causing the computer to execute a procedure for performing an operation as a key processing monitor for executing processing including key processing for encryption / decryption of the instruction code when the authenticated processing program including the activated operating system is executed. Program for secure core.
(Appendix 19)
A program used by a core executing instruction code in a processor,
Using the program in the memory in which the encrypted instruction code is stored in a non-rewritable format, the procedure for starting the own core,
Instructions for booting the operating system;
As an execution process of the authenticated program by executing a program authenticated by an authentication processing block that performs an authentication process of an instruction code including an instruction code stored in the memory or an unauthenticated program in the processor The computer executes a procedure for executing processing that may include a key processing request to a key processing monitor that executes key processing including processing using a key for encryption / decryption, corresponding to the authenticated execution code. A program for a normal core characterized by being executed.
(Appendix 20)
An instruction execution means for executing the instruction;
Load / store control means for controlling data load / store to an external memory in response to a command from the instruction execution means;
Encryption processing means for encrypting / decrypting data between the load / store control means and an external memory,
A secure processor, wherein the instruction execution means designates a key to be used for data encryption / decryption to the encryption processing means in response to an instruction being executed.
(Appendix 21)
The processor further comprises key storage means for storing a plurality of keys,
The instruction execution means outputs a key number designating the key to the key storage means, and the key storage means performs data encryption / decryption to the encryption processing means corresponding to the key number. 21. The secure processor according to appendix 20, wherein a key to be used is provided.
(Appendix 22)
The secure processor further comprises key storage means for storing a key to be used for decrypting the instruction fetch data loaded from the outside,
The secure processor according to appendix 20, wherein the key storage means gives the decryption key to the encryption processing means when the instruction execution means is in the instruction fetch state.
(Appendix 23)
In the secure processor,
Key storage means for storing a plurality of keys;
Key number storage means for storing a key number for designating the key, outputted by the instruction execution means,
The appendix 20 characterized in that the key storage means provides the encryption processing means with a key to be used for the data encryption / decryption in correspondence with a key number given from the key number storage means. Secure processor.
(Appendix 24)
In the secure processor,
Key storage means for storing a plurality of keys including a key to be used for decrypting instruction fetch data loaded from the outside;
Key number storage means for storing a key number of a key to be used for decryption of instruction fetch data loaded from the outside,
When the instruction execution means is in the instruction fetch state, the key storage means corresponds to the key number output from the key number storage means, and the encryption processing means assigns a key to be used for decrypting the instruction fetch data. Item 20. The secure processor according to appendix 20, wherein
(Appendix 25)
The secure processor according to appendix 20, wherein the instruction execution means outputs a supervisor / user switching signal corresponding to the instruction in addition to the key number as a signal for designating the key.
(Appendix 26)
The secure processor according to appendix 20, wherein the instruction execution means outputs an identifier of a process including an instruction being executed in addition to a key number as a signal for designating the key.
(Appendix 27)
The load / store control means includes:
Write-through cache memory,
Appendix 20 further comprising a read-modify-write unit that combines data to be stored in an external memory and data loaded from the external memory via the cryptographic processing unit and applies the combined data to the cryptographic processing unit. Secure processor.
(Appendix 28)
In the secure processor,
The data processing apparatus further comprises a data bypass means for transferring plaintext data between the load / store control means and the external memory without bypassing the encryption processing means and performing encryption / decryption. The secure processor according to appendix 20.
(Appendix 29)
An instruction execution means for executing the instruction;
Load / store control means for controlling data load / store to an external memory in response to a command from the instruction execution means;
Encryption processing means for encrypting / decrypting data between the load / store control means and an external memory,
The instruction execution means provides a signal for designating a key to be used for data encryption / decryption to the encryption processing means in correspondence with an access address of data / instruction fetch by an instruction being executed. A secure processor.
(Appendix 30)
The processor further comprises key storage means for storing a plurality of keys,
The instruction execution means outputs a logical address as the access address to the key storage means, and the key storage means performs the encryption processing on the data encryption / decryption key corresponding to the logical address. The secure processor according to appendix 29, wherein the secure processor is provided to the means.
(Appendix 31)
A key storage means for storing a plurality of keys in the secure processor;
The load / store control means outputs a physical address as the access address to the key storage means in response to a command given from the instruction execution means, and the key storage means corresponds to the physical address. 30. The secure processor according to appendix 29, wherein the data encryption / decryption key is given to the encryption processing means.
(Appendix 32)
The secure processor further comprises key storage means for storing a plurality of keys corresponding to each of the logical address and the physical address as the access address,
An instruction from the instruction execution means indicating which of a physical address as the access address given from the load / store control means to the key storage means and a logical address given from the instruction execution means should be selected 30. The secure processor according to appendix 29, wherein the key for data encryption / decryption corresponding to the address selected by the key storage means is provided to the encryption processing means.
(Appendix 33)
In the secure processor,
Key storage means for storing a plurality of keys corresponding to each of a logical address and a physical address as the access address;
Address selection instruction storage means for storing data of an address selection instruction that is output by the instruction execution means and that indicates whether a key corresponding to a logical address or a physical address should be given to the cryptographic processing means;
The key storage means provides the encryption processing means with a key corresponding to either a logical address or a physical address as the data encryption / decryption key according to the stored contents of the address selection instruction storage means. The secure processor according to appendix 29.
(Appendix 34)
The load / store control means further comprises key storage means for storing a plurality of keys corresponding to the access addresses;
The load / store control means selects a key stored in the key storage means corresponding to an access address given during instruction execution from the instruction execution means, and uses the key as the data encryption / decryption key. The secure processor according to appendix 29, wherein the secure processor is provided to the cryptographic processing means.
(Appendix 35)
The instruction execution means provides the encryption processing means with a signal indicating ON / OFF of the key storage means and a signal for giving a key to be used for data encryption / decryption when the key storage means is OFF And
In response to the ON / OFF signal, the encryption processing means encrypts / decrypts the key given from the key storage means when the key storage means is ON, and the key given from the instruction execution means when the key storage means is OFF. 35. The secure processor according to appendix 34, wherein the secure processor is used as an encryption key.
(Appendix 36)
30. The secure processor according to appendix 29, wherein the instruction execution means outputs a supervisor / user switching signal corresponding to a command being executed in addition to the access address as a signal for designating the key.
(Appendix 37)
The secure processor according to appendix 29, wherein the instruction execution means outputs an identifier of a process including an instruction being executed in addition to the access address as a signal for designating the key.
(Appendix 38)
The load / store control means includes:
Write-through cache memory,
The supplementary note 29, further comprising: a read-modify-write unit that combines data to be stored in an external memory and data loaded from the external memory via the cryptographic processing unit and supplies the combined data to the cryptographic processing unit. Secure processor.
(Appendix 39)
The secure processor further includes data bypass means for transferring plaintext data without bypassing the encryption processing means between the load / store control means and the external memory without performing encryption / decryption. Item 34. The secure processor according to appendix 29.
(Appendix 40)
Prior to execution of a process corresponding to an execution code, a secure process identifier for comparison with a secure process identifier corresponding to a page in which a secure page flag indicating that the page storing the execution code is correctly authenticated is set Secure process identifier generation means for generating the process generation instruction when it is issued;
A secure processor comprising: process information holding means for holding the generated secure process identifier as information related to the process.
(Appendix 41)
41. The secure processor according to appendix 40, further comprising secure process identifier erasing means for erasing the generated secure process identifier held in the process information holding means when the process disappears.
(Appendix 42)
Authentication information is given to the execution code corresponding to the process,
41. The secure processor according to appendix 40, wherein the process information holding means further holds an authentication key for execution code authentication performed during the lifetime of the generated process.
(Appendix 43)
43. The secure processor according to appendix 42, wherein the authentication information given to the execution code is page unit information in a memory.
(Appendix 44)
Execution code corresponding to the process is stored in an empty page in the memory, and the secure process identifier is stored in a buffer in the processor in association with the address of the page, and then the execution using the authentication key for each page 44. The secure processor according to appendix 43, further comprising authentication means for setting the secure page flag in the buffer when code authentication is successful.
(Appendix 45)
In the secure processor,
A secure process identifier stored in the buffer prior to the actual execution of the execution code, the secure process identifier corresponding to the secure page flag being set, and held in the process information holding means and executed A memory access control unit that compares a secure process identifier corresponding to an instruction code to be executed and permits an instruction execution unit that executes the instruction to access a page on the memory in which the execution code is stored when the two match 45. The secure processor according to appendix 44, further comprising:
(Appendix 46)
In the secure processor,
The apparatus further comprises a direct memory access unit that performs an operation necessary for authentication of the execution code in parallel with storing the execution code in a memory, holds the result of the operation, and gives the result to the authentication unit. The secure processor according to appendix 44.
(Appendix 47)
In the secure processor, an encryption / decryption key unique to the processor;
When the secure page flag stored in the buffer, the secure process identifier, and the address information of the memory page storing the execution code are saved outside or restored from the outside, the processor unique key is used to store the information. 45. The secure processor according to appendix 44, further comprising: encryption processing means for performing encryption / decryption of.
(Appendix 48)
In the secure processor,
A key specific to the processor;
When the information of the address of the memory page storing the secure page flag, the secure process identifier, and the execution code stored in the buffer is saved to the outside, falsification detection information for the information is stored using the processor unique key. 45. The secure processor according to appendix 44, further comprising: falsification detection means for performing falsification detection on the information using the unique key upon generation and assignment and returning from the outside.
(Appendix 49)
In the secure processor, each core includes an instruction execution unit and a cache,
A secure core that executes only the authenticated executable code;
41. The secure processor according to appendix 40, further comprising a normal core that executes the unauthenticated normal execution code.
(Appendix 50)
The secure processor according to appendix 49, wherein the normal core executes the authenticated code in addition to the normal code.
(Appendix 51)
In the secure processor,
The core having the execution unit and the cache memory is set to either a secure mode in which only the authenticated execution code is executed or a normal mode in which only a normal execution code that is not authenticated is executed. Further comprising mode designation means,
The secure processor according to appendix 40, wherein the core executes either a secure mode or a normal mode in response to the instruction.
(Appendix 52)
In the secure processor,
An encryption / decryption key specific to the processor;
An encryption processing means for encrypting / decrypting the information using the processor unique key when the information including the secure process identifier is saved outside or restored from the outside, held in the process information holding means 41. The secure processor according to appendix 40, further comprising:
(Appendix 53)
In the secure processor,
A key specific to the processor;
When the information including the secure process identifier held in the process information holding unit is saved to the outside, falsification detection information for the information is generated and attached using the processor unique key, and the information is restored from the outside. 41. The secure processor according to appendix 40, further comprising a falsification detection unit that detects falsification of the information using the unique key.
(Appendix 54)
A program used by a computer that pages a page containing executable code into memory,
Requesting the direct memory access mechanism in the computer to transfer the page to memory;
After the transfer is successful, the page table entry in the translation lookaside buffer of the computer correctly authenticates the page that stores the execution code prior to execution of the process corresponding to the execution code in the page. An identifier for comparing with a secure process identifier corresponding to a page in which a secure page flag indicating that the process has been set is included, and includes a secure process identifier generated when the process generation instruction is issued, How to set up data about the page,
A program for a secure processor, which causes a computer to execute authentication of the page and a procedure for requesting hardware to set a secure page flag indicating success of the authentication to the page table entry.
(Appendix 55)
A storage medium used by a computer that pages a page containing executable code into memory,
Requesting the direct memory access mechanism in the computer to transfer the page to memory;
After the transfer is successful, the page table entry in the translation lookaside buffer of the computer correctly authenticates the page that stores the execution code prior to execution of the process corresponding to the execution code in the page. An identifier for comparing with a secure process identifier corresponding to a page in which a secure page flag indicating that the process has been set is included, and includes a secure process identifier generated when the process generation instruction is issued, Setting up data about the page;
Computer readable storing a program for a secure processor that causes a computer to execute authentication of the page and a step of requesting hardware to set a secure page flag indicating success of the authentication to the page table entry. Portable storage medium.
(Appendix 56)
A program used by a computer that authenticates a page containing an execution code,
A procedure for performing a hash operation on the page read into the memory;
A procedure for decrypting the authentication information given to the page;
A procedure for comparing the hash operation result and the decryption result;
When a match is detected as a result of the comparison, the computer sets a secure page flag indicating that the page has been successfully authenticated in a page table entry in the translation lookaside buffer of the computer. A program for a secure processor that is executed by the program.
(Appendix 57)
A storage medium used by a computer for authenticating a page including an execution code,
Performing a hash operation on the page read into memory;
Decrypting the authentication information given to the page;
Comparing the hash operation result with the decryption result;
When a match is detected as a result of the comparison, setting a secure page flag in the page table entry in the translation lookaside buffer of the calculator to indicate that the page has been successfully authenticated. A computer-readable portable storage medium storing a program for a secure processor to be executed.

10, 40, 100 Processor 11, 154 Core 12 Encryption processing block 13 Code authentication processing block 14 Encryption ROM code area 15 CPU unique key 17 Main memory 18 Secondary storage 20 Secure hardware 21 Encryption key setting unit 22 Decoding unit 23, 137 Processor-specific RSA private key 24, 114 Translation Lookaside Buffer (TLB)
25 Logical address table 26 Physical address table 27 Key table 28 Signature verification unit 29, 134 Certificate authority certificate (certificate authority public key)
31, 151 Secure core 32, 152 Normal core 34 Key generation mechanism 41 Execution unit 42 Load store unit 43 Encryption circuit 44 Decryption circuit 45 Cache memory 46 Memory management unit 47, 48, 73, 74, 75 Key table memory 51, 52, 78, 79 Key selection register 71 Read modify write buffer 88 Address map register (AMR)
101 Physical Page 102 I / O Device 105 Memory Access Control Unit 106 Instruction Interpretation Unit 107 Authentication Unit 108 Encryption / Decryption, Signature Generation / Verification Unit 109 Secure Context Identifier Generation Unit 110 Secure Context Identifier Termination Unit 111 Processor Unique Key 112 Authentication Information Primary storage unit 113 secure DMA
115 Context Information Storage Unit 117 Program Counter 118 Secure Context Identifier Register 119 Authentication Key Register 120 Register Group 124 Physical Page 125 Page 126 Authentication Information 140 SHA-1 Hash Calculator 141 RSA Decoder 142 Comparator 144 Instruction Execution Unit 155 Mode Register 165 Encryptor 168 Decryptor 169 Tamper Detection Information Generator 172 Tamper Detector 174 Encryptor / Decryptor 179 Tamper Detection Information Generator / Tamper Detector

Claims (3)

An instruction execution means for executing the instruction;
Load / store control means for controlling data load / store to an external memory in response to a command from the instruction execution means;
Encryption processing means for encrypting / decrypting data between the load / store control means and an external memory,
It said instruction execution means, to the encryption processing means in response to the instruction being executed, and characterized by specifying the instruction-dependent or instruction section different keys for each of the key to be used for data encryption / decryption Secure processor. The processor further comprises key storage means for storing a plurality of keys,
The instruction execution means outputs a key number designating the key to the key storage means, and the key storage means performs data encryption / decryption to the encryption processing means corresponding to the key number. 2. The secure processor according to claim 1, wherein a key to be used is provided. The secure processor further comprises key storage means for storing a key to be used for decrypting the instruction fetch data loaded from the outside,
2. The secure processor according to claim 1, wherein when the instruction execution means is in an instruction fetch state, the key storage means gives the decryption key to the encryption processing means.

Images