Semiconductor devices, semiconductor systems, and non-transitory computer-readable media

Abstract

The present application relates to a semiconductor device, a semiconductor system, and a program. A semiconductor device and the like for maintaining a desired function while suppressing unauthorized access is provided. The semiconductor device includes a main control device and a sub-control device. The main control device includes: a main memory for storing a main program for receiving an external signal; and a trigger signal output circuit for outputting a trigger signal when an abnormal signal processing different from a preset signal processing is performed. The sub-control device is coupled to the main control device and includes a trigger signal acquisition circuit for obtaining a trigger signal and a sub-program output circuit for outputting a sub-program to the main control device based on the obtained trigger signal.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] The disclosure of Japanese Patent Application No. 2018-207093 filed on November 2, 2018 including specification, drawings and abstract is incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure relates to a semiconductor device, a semiconductor system, and a program. Background Art

[0004] In recent years, various devices have the function of communicating with the outside, such as Internet connection. Having the communication function with the outside is helpful for updating software and sharing data, but there is a problem of danger caused by unauthorized access from third parties, etc. For this reason, it is necessary to have a device and system with the function of communicating with the outside that can avoid the danger caused by unauthorized access.

[0005] For example, a function called memory protection (or region protection) is implemented in a semiconductor device. Memory protection has a function of detecting access different from access to a preset address space, that is, unauthorized access. A user of a semiconductor device can use detection of unauthorized access as a trigger to protect a system on which the semiconductor device is mounted.

[0006] More specifically, when the consistency of the control program stored in the microcontroller is not verified, the program switching device described in, for example, Japanese Unexamined Patent Application Publication No. 2004-348546 executes another control program stored in the microcomputer. In addition, the device described in Japanese Unexamined Patent Application Publication No. 11 / 338783 has a function of prohibiting the main microcomputer from operating when a sub-microcomputer for monitoring unauthorized access detects an abnormality in a nonvolatile memory. Summary of the invention

[0007] If the semiconductor device receives unauthorized access, it may have been tampered with by the unauthorized access. That is, the reliability of the software stored in the semiconductor device itself cannot be ensured. However, in the device described in Japanese Unexamined Patent Application Publication No. 11 / 338783, if there is unauthorized access to the storage unit storing the control program, there is a possibility of unauthorized access to another control program, so the reliability cannot be said to be safe. In addition, the device described in Patent Document 1 prohibits the operation of the main microcomputer after unauthorized access, so the subsequent function of the device cannot be continued.

[0008] Other objects and novel features will become apparent from the description of this specification and the accompanying drawings.

[0009] According to one embodiment, a semiconductor device includes a main control device and a sub-control device. The main control device includes: a main memory for storing a main program for receiving an external signal; and a trigger signal output circuit for outputting a trigger signal when an abnormal signal process different from a preset signal process is executed. The sub-control device is connected to the main control device and includes a trigger signal acquisition circuit for acquiring a trigger signal and a sub-program output circuit for outputting a sub-program to the main control device based on the acquired trigger signal.

[0010] According to one embodiment, a plurality of semiconductor devices having a main control device and a sub-control device are communicably connected to each other, and one of the plurality of semiconductor devices transmits a notification to another semiconductor device based on a trigger signal.

[0011] According to one embodiment, a program for causing a computer to execute a semiconductor device protection method. The semiconductor device protection method includes: a trigger signal output step for outputting a trigger signal to a sub-control device when signal processing is different from a preset signal processing in a main control device. In addition, the semiconductor device protection method includes: a sub-program output step for outputting a sub-program to the main control device based on the trigger signal in the sub-control device.

[0012] According to the above-described embodiments, it is possible to provide a semiconductor device or the like for maintaining a required function while suppressing unauthorized access. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 is a diagram of a breathing assistance system according to a first embodiment.

[0014] Figure 2 is a schematic configuration diagram of a semiconductor device according to a first embodiment.

[0015] Figure 3 is a diagram showing a specific example of the abnormality detection circuit according to the first embodiment.

[0016] Figure 4 is a diagram showing a configuration example of an abnormality detection circuit in a main control device.

[0017] Figure 5 is a flowchart showing the processing of the semiconductor device according to the first embodiment.

[0018] Figure 6 : is a diagram showing a state after program rewriting of the breathing assistance system according to the first embodiment.

[0019] Figure 7 is a diagram showing the connection of the semiconductor device and the rewriting device according to the first embodiment.

[0020] Figure 8 is a schematic diagram of a semiconductor device used in a modified example of the first embodiment.

[0021] Fig. 9 2 is a diagram showing a state after the program of the breathing assistance apparatus according to the second embodiment is rewritten.

[0022] Fig.10 is a schematic configuration diagram of a semiconductor system according to a modified example of the second embodiment.

[0023] Fig.11 is a flowchart showing a process of a semiconductor device according to a modified example of the second embodiment.

[0024] Fig.12 is a schematic configuration diagram of a semiconductor device according to a third embodiment.

[0025] Fig.13 is a flowchart showing the processing of the semiconductor device according to the third embodiment. DETAILED DESCRIPTION

[0026] For clear explanation, the following description and drawings are appropriately omitted and simplified. In addition, the elements described as function blocks for performing various processes in the drawings can be configured as CPU (central processing unit), memory and other circuits in hardware, and can be implemented by programs loaded into the memory in software. Therefore, it will be appreciated by those skilled in the art that these function blocks can be implemented in various ways by separate hardware, separate software or a combination thereof, and the present invention is not limited to any of them. In the drawings, the same elements are represented by the same reference numerals, and their repeated descriptions are omitted as required.

[0027] With reference to the drawings, a first embodiment will be described below. Figure 1 is a diagram of a breathing assistance system according to a first embodiment. Figure 1 The respiratory assistance system 1 shown in is a device for assisting the patient's respiratory operation when the patient is in a state where it is difficult for the patient to breathe on his own. The respiratory assistance system 1 has a communication function and is communicably connected to the server 800 via a network 900. An administrator who manages the respiratory assistance system 1 can manage information about the state of the respiratory assistance system 1 acquired by the server 800. The administrator can also update the program of the respiratory assistance system 1 using the server 800.

[0028] The breathing assistance system 1 mainly includes a breathing assistance device 10, a sensor 12, a pump 13, a display device 15, and an input device 16. First, the sensor 12, the pump 13, the display device 15, and the input device 16 will be described.

[0029] The sensor 12 acquires information required to operate the breathing assistance system 1 and provides the acquired information to the breathing assistance device 10. The information acquired by the sensor 12 includes a plurality of pieces of information such as an operating state, for example, the rotation speed of the pump 13 or the breathing intensity of the patient.

[0030] The pump 13 is a pump device for assisting the patient's breathing. The pump 13 has an inlet, an exhaust port, and a motor 14. The motor 14 is interposed between the inlet and the exhaust port, and delivers the air inhaled from the inlet to the exhaust port. The motor 14 is connected to the breathing assistance device 10 and operates in response to instructions from the breathing assistance device 10.

[0031] The display device 15 is, for example, a display device having a display unit, and displays a drive circuit for driving the display unit. The display device 15 displays, for example, the operating state of the respiratory assistance system 1, the state of the patient acquired via the sensor 12, etc. The input device 16 includes, for example, a keyboard, a touch panel, a switch, etc., and receives instructions from a user who uses the respiratory assistance device 10.

[0032] Next, the breathing assistance device 10 will be described. The breathing assistance device 10 mainly includes a communication device 11 and a semiconductor device 100. The breathing assistance device 10 is connected to a sensor 12, a pump 13, a display device 15, and an input device 16 in a wired or wireless manner.

[0033] The communication device 11 is a device for external communication with the outside of the respiratory assistance system 1. External communication is an operation of sending and / or receiving information according to a process determined to be outside the device or board including the communication device 11, and does not include communication of the input / output device constituting the device. That is, the communication device 11 accesses the network 900 and sends and receives predetermined data. The communication device 11 performs external communication in cooperation with the semiconductor device 100. The network 900 is, for example, a telephone line (which is a public network line) or an Internet line. The communication device 11 and the network 900 can be connected to each other by wire or wirelessly.

[0034] The semiconductor device 100 controls the operation and function of the components of the breathing assistance system 1. The semiconductor device 100 mainly includes a main control device 110 and a sub-control device 120. The main control device 110 is an arithmetic device including a CPU (Central Processing Unit). The main control device 110 stores a main program, and sends instructions and receives data to each component according to the processing of the main program. The sub-control device 120 is an arithmetic device called an MPU (Microcontroller Unit). The sub-control device 120 stores a sub-program as a backup program, connects the sub-program to the main control device 110, and provides the sub-program to the main control device 110 when a preset condition is reached.

[0035] The semiconductor device 100 is, for example, an integrated circuit chip, in which the main control device 110 and the sub-control device 120 are independent of each other, and the integrated circuit chip is formed on a single substrate. In addition, the semiconductor device 100 may be, for example, a PoP (package stack), in which the main control device 110 and the sub-control device 120 are chips of independent integrated circuits, and each integrated circuit is further stacked as a chip. Since the main control device 110 has a function of realizing external communication, it can receive unauthorized access as described above. On the other hand, it is preferred that the sub-control device 120 does not have a wire for controlling external communication. In addition, it is preferred that the sub-control device 120 does not have a wire that is affected by unauthorized access even in communication with the main control device 110.

[0036] Next, refer to Figure 2 , the semiconductor device 100 included in the breathing assistance device 10 will be described in detail. Figure 2 1 is a schematic configuration diagram of a semiconductor device according to the first embodiment. The main control device 110 is connected to the communication device 11 and controls external communication performed by the communication device 11. The main control device 110 is connected to the sensor 12, the motor 14, the display device 15, and the input device 16 to appropriately send and receive signals.

[0037] The main control device 110 includes, as main components, an external communication interface 111, a main memory 112, an abnormality detection circuit 114, a trigger signal output circuit 115, and a response circuit 116. The external communication interface 111 is an interface for sending and receiving signals to and from the communication device 11.

[0038] The main memory 112 is a rewritable nonvolatile storage device such as a flash memory, FeRAM (Ferroelectric Random Access Memory), or EPROM (Erasable Programmable Read Only Memory). The main memory 112 stores a main program in a program storage area 113. The main program is a program for realizing a function for performing the operation of the respiratory assistance system 1 in which the semiconductor device 100 is installed. The main program includes a function of sending and receiving signals via the external communication interface 111 using external communication.

[0039] The abnormality detection circuit 114 detects abnormal processing such as unauthorized access from signal processing performed in the main control device 110 and generates a trigger signal based on the detection. The trigger signal generated by the abnormality detection circuit 114 is not generated by software but by hardware settings in the main control device 110.

[0040] Will refer to Figure 3 A specific example of the abnormality detection circuit is described. Figure 31 is a diagram showing a specific example of an abnormality detection circuit according to the first embodiment. The abnormality detection circuit 114 acquires a signal related to an operation execution address from an area where processing is being executed, and when the address where processing is being executed does not receive access permission, outputs a trigger signal indicating that abnormal processing is being executed.

[0041] The abnormality detection circuit 114 mainly includes an address space information register 114A, an access permission information register 114B, and a comparator 114C. The address space information register 114A acquires a signal related to a processing execution address, and outputs a signal related to an address space corresponding to the acquired signal to the comparator 114C. The access permission information register 114B stores information on whether access to each address space of the main control device 110 is permitted. The comparator 114C compares information on an address space corresponding to an address that has been processed with information on access permission to the address space, and outputs a trigger signal when access to the address space to be accessed is not permitted.

[0042] For example, Figure 3 The abnormality detection circuit 114 shown is also called a memory protection unit or a region protection unit. The abnormality detection circuit 114 monitors the address accessed in the signal processing (such as executing an instruction, reading or writing) in the main control device 110. With such a configuration, since the abnormality detection circuit 114 outputs a trigger signal according to the signal of the address being processed, abnormal signal processing can be detected by hardware (circuit wiring) without the intervention of software.

[0043] Next, refer to Figure 4 , an exemplary configuration of the abnormality detection circuit 114 in the main control device 110 will be described. Figure 4 : is a diagram showing an example of the configuration of an abnormality detection circuit in a main control device. Figure 4 In the embodiment, the main control device 110 includes an abnormality detection circuit 114, a CPU 117, an output setting register 118, a logic circuit 119, and a terminal T1.

[0044] As reference Figure 3 As described above, when an abnormal signal processing is detected, the abnormality detection circuit 114 provides a trigger signal to the logic circuit 119. The CPU 117 is an operation unit of the main control device 110, and provides a predetermined signal to the output setting register 118. Here, the predetermined signal is a signal when the CPU 117 detects an access abnormality. When the output setting register 118 receives the predetermined signal from the CPU 117, the output setting register 118 generates a trigger signal in response to the predetermined signal, and provides the generated trigger signal to the logic circuit 119.

[0045] The logic circuit 119 receives the trigger signal from the abnormality detection circuit 114 and the output setting register 118, respectively, and sends the logical sum of the received trigger signals to the terminal T1. With such a configuration, the main control device 110 can directly send the trigger signal from the abnormality detection circuit 114 to the terminal T1 and output the trigger signal, or can output the trigger signal through a signal generated by the CPU 117. It should be understood that the trigger signal output from the abnormality detection circuit 114 can be amplified by an amplifier, or can be output through a protection circuit including a noise filter or a diode.

[0046] Back to Figure 2 , the configuration of the main control device 110 will be described. The trigger signal output circuit 115 outputs a trigger signal to the sub-control device 120. That is, the trigger signal output circuit 115 includes a terminal that is an interface for providing a trigger signal from the main control device 110 to the sub-control device 120.

[0047] After receiving the request signal from the request circuit 122 of the sub-control device 120, the response circuit 116 outputs a response signal to the request signal to the sub-control device 120. The response circuit 116 also acquires the sub-program provided from the sub-control device 120 after outputting the response signal.

[0048] Next, the sub-control device 120 will be described. The sub-control device 120 is connected to the main control device 110, and when the main control device 110 detects abnormal signal processing according to a preset condition, the sub-program is provided to the main control device 110. The sub-control device 120 includes a trigger signal obtaining circuit 121, a request circuit 122, a sub-program output circuit 123, and a sub-memory 124.

[0049] The trigger signal acquisition circuit 121 acquires a trigger signal output from the trigger signal output circuit 115 of the main control device 110. The trigger signal acquisition circuit 121 includes a terminal, which is an interface for receiving a trigger signal. The trigger signal acquisition circuit 121 also has a function of receiving a trigger signal to perform interrupt processing and start processing of a request circuit. When the trigger signal acquisition circuit 121 acquires a trigger signal from the main control device 110, the request circuit 122 outputs a request signal requesting the main control device 110 to transmit a subroutine. When a response signal is received from the main control device 110, the subroutine output circuit 123 transmits the subroutine to the main control device 110.

[0050] The sub-memory 124 is a rewritable non-volatile storage device, such as a flash memory, or a non-rewritable non-volatile storage device, such as a mask ROM (read-only memory). The sub-memory 124 stores a sub-program in the program storage area 125. The sub-program is a program that deletes at least the external communication function from the main program. That is, when the respiratory assistance system 1 executes the sub-program, external communication is not performed.

[0051] Next, Figure 5 A process when the semiconductor device 100 detects an abnormal signal process is shown. Figure 5 1 is a flowchart showing the semiconductor device processing of the first embodiment. The processing shown in the figure is called the main program rewriting routine S10. When the semiconductor device 100 detects the abnormal signal processing, the main program rewriting routine S10 is started. In other words, for example, the main control device 110 receives unauthorized access via the network 900, and when the abnormality detection circuit 114 detects the abnormal signal processing by the unauthorized access, the main program rewriting routine S10 is started. Figure 5 Processing shown.

[0052] First, when the abnormality detection circuit 114 detects an access abnormality, the main control device 110 provides a trigger signal to the sub-control device 120 in operation S11. Upon receiving the trigger signal, the sub-control device 120 starts interrupt processing.

[0053] Then, the sub-control device 120 provides a reset signal to the main control device 110. Upon receiving the reset signal from the sub-control device 120, the main control device 110 stops executing a main program of the main control device 110 and resets the main control device 110 in operation S12.

[0054] In operation S13, the sub-control device 120 sets the main control device 110 to the rewrite mode. Specifically, the sub-control device 120 provides a signal from Lo to Hi (or from Hi to Lo), for example, to a predetermined program rewrite terminal of the main control device 110. As a result, the main control device 110 transitions to the program rewrite mode.

[0055] Next, the sub-control device 120 cancels the resetting of the main control device 110 (S14). In operation S15, by cancelling the resetting operation by the sub-control device 120, the main control device 110 is activated in the rewrite mode.

[0056] In operation S16, the sub-control device 120 transmits a rewrite request signal to the main control device 110. In operation S17, the sub-control device 120 transmits a subroutine to the main control device 110. In this case, the sub-control device 120 waits for the main control device 110 to return a response signal in response to the request signal, receives the response signal from the main control device 110, and then transfers to the following steps.

[0057] In operation S17, the sub-control device 120 sends the sub-program to the main control device 110. Upon receiving the sub-program from the sub-control device 120, the main control device 110 stores the sub-program in the program storage area 113 of the main memory 112. At this time, the main control device 110 erases the main program and stores the sub-program. That is, the program in the program storage area is rewritten from the main program to the sub-program. As a result, instead of the program that may have been tampered with by unauthorized access, the semiconductor device 100 stores a secure sub-program in the main memory.

[0058] Next, after the subprogram is stored in the main memory 112, the subcontrol device 120 resets the main control device 110 in operation S18. In operation S19, the subcontrol device 120 cancels the program rewriting mode and cancels the reset of the main control device 110. When the reset is canceled, the main control device 110 starts the operation of the rewritten subprogram.

[0059] The above has described the rewriting process of the program in the semiconductor device 100. In step S17, a process of transmitting the subroutine after a preset time has elapsed may be performed without receiving a response signal.

[0060] Next, refer to Figure 6 , the system after executing the above-mentioned program rewriting process will be described. Figure 6 : is a diagram showing a state after program rewriting of the breathing assistance system according to the first embodiment.

[0061] exist Figure 6 In the respiratory assistance system 1 shown, the program of the main control device 110 is rewritten from the main program to the subroutine. As a result, the operation of the communication device 11 of the respiratory assistance system 1 is stopped. Therefore, the respiratory assistance system 1 is in a state where it cannot perform external communication via the network 900. In addition, in addition to external communication, the respiratory assistance system 1 can perform the same functions as before the program was rewritten. Therefore, even after receiving some unauthorized access from the outside, the respiratory assistance system 1 can eliminate risks such as software falsification and maintain its function as a respiratory assistance device.

[0062] Next, refer to Figure 7 , a configuration for rewriting a program of the main control device 110 from the outside will be described. Figure 7 1 is a diagram showing the connection of the semiconductor device and the rewriting device according to the first embodiment. In the diagram, the semiconductor device 100 has a connector 100N, and the connector 100N is connected to the rewriting device 700. The configuration of the semiconductor device 100 is connected by internal wirings L10 to L16.

[0063] The internal wiring of the semiconductor device 100 will be described below. The internal wiring L10 is a wiring for the main control device 110 to provide a trigger signal to the sub-control device 120. The internal wiring L11 is a wiring for performing communication in which the main control device 110 is on the receiving side (Rx) and the sub-control device 120 is on the transmitting side (Tx). The internal wiring L12 is a wiring for performing communication in which the main control device 110 is on the transmitting side (Tx) and the sub-control device 120 is on the receiving side (Rx). The main control device 110 can receive a subroutine from the sub-control device 120 via the internal wirings L10 to L12.

[0064] Internal wiring L13 is wiring connecting internal wiring L11 and connector 100N. When a program is provided from rewriting device 700 to main control device 110, the program and the like are transmitted from rewriting device 700 as a transmitting side (Tx) to main control device 110 as a receiving side (Rx) via internal wiring L13 and L11.

[0065] Internal wiring L14 is wiring that connects internal wiring L12 and connector 100N. When a program is provided from rewriting device 700 to main control device 110, a response signal or the like is transmitted from main control device 110 on the transmitting side (Tx) to rewriting device 700 on the receiving side (Rx) via internal wiring L14 and L12.

[0066] The internal wiring L15 connects the GND terminal of the sub-control device 120 and the connector 100N. The internal wiring L16 connects the reset terminal of the sub-control device 120 to the connector 100N.

[0067] Next, the rewriting device 700 will be described. The rewriting device 700 is a device connected to the semiconductor device 100 for rewriting a program to the main control device 110. The rewriting device 700 has a connector 700N detachable from the connector 100N of the semiconductor device 100, and is connected to the wirings L13 to L16 so as to be energized.

[0068] The rewriting device 700 has a wiring L70 that connects the wiring L15 and the wiring L16. Therefore, when the rewriting device 700 is connected to the semiconductor device 100, the reset terminal of the sub-control device is fixed to the potential of the ground terminal. As a result, the sub-control device 120 is reset, and does not send and receive signals to and from the main control device 110. Note that, as an example, the potential of the GND terminal is fixed to the GND terminal, and the potential of the wire L15 can be determined so that at least the Rx terminal and the Tx terminal of the sub-control device 120 are in a high impedance state.

[0069] After the sub-control device 120 is reset, the rewriting device 700 sends and receives a predetermined signal to and from the main control device 110 via the wires L13 and L14, and sends the program stored in the rewriting device 700 to the main control device 110. Upon receiving the program from the rewriting device 700, the main control device 110 stores the received program in the main memory. With the above configuration, the semiconductor device 100 can rewrite the program stored in the main control device 110 by the rewriting device 700 even after the program of the main control device 110 is rewritten as a sub-program and external communication is not performed.

[0070] Although the first embodiment has been described above, the configuration of the respiratory assistance system 1 and the semiconductor device 100 included in the respiratory assistance system 1 according to the first embodiment is not limited to the above configuration. For example, the function of the communication device 11 may be included in the semiconductor device 100. Instead of the communication device 11, the respiratory assistance device 10 may include an external signal receiving device for receiving an external signal. The external signal receiving device is a device that receives a signal input to the respiratory assistance device 10 and provides the received signal to the semiconductor device 100, and is, for example, a memory card reader, a bus communication connector, etc. When the respiratory assistance device 10 has such a configuration, the external communication interface 111 included in the semiconductor device 100 has a function of receiving a signal corresponding to the external signal receiving device. When the respiratory assistance device has such a configuration, the subroutine stored in the sub-control device has a function of not accepting an external signal, rather than a function of not accepting external communication.

[0071] The semiconductor device 100 described in the first embodiment is applicable not only to the respiratory assistance system 1 but also to any device and system using a communication function. For example, the semiconductor device 100 according to the first embodiment can be applied to various devices called IoT (Internet of Things). The semiconductor device 100 according to the first embodiment can be applied to mobile phones, home appliances, commercial devices, medical devices, etc. having a communication function.

[0072] The sub-control device 120 may be an arithmetic device having the same configuration as that of the main control device 110, but the sub-control device 120 may select an integrated circuit having a relatively smaller circuit size than that of the main control device 110. With such a configuration, a semiconductor device or the like can be provided which protects the semiconductor device from abnormal processing due to unauthorized access and maintains the required functions while suppressing cost increases. External communication is not limited to the above examples, and may be communication conforming to a standard such as Bluetooth (registered trademark), USB (Universal Serial Bus), or Wi-Fi Direct that is not via a public network line.

[0073] In the breathing assistance system 1 according to the first embodiment, if the main control device 110 is attacked by unauthorized access through external communication, the reliability of the software operating in the main control device 110 cannot be guaranteed. Therefore, after the abnormality detection circuit 114 detects the abnormal signal processing, the processing for outputting the trigger signal by hardware without the intervention of software is performed. With such a configuration, the first embodiment can reliably notify the sub-control device of the abnormality caused by the attack from outside the system. The subroutine stored in the main control device 110 instead of the main program after the abnormal signal processing is detected is a subroutine that deletes the communication function from the main program. As a result, the breathing assistance system 1 can eliminate the possibility of being attacked via communication while reliably maintaining and continuing the functions that should have worked. Therefore, according to the first embodiment, a semiconductor device or the like can be provided for maintaining the required functions while suppressing unauthorized access.

[0074] Next, refer to Figure 8 , a modified example of the first embodiment will be described. Figure 8 is a schematic diagram of a semiconductor device used in a modified example of the first embodiment. Figure 8 The respiratory assistance system 1 shown is Figure 2 The semiconductor device 100 shown is different from the semiconductor device 101 in the configuration.

[0075] The semiconductor device 101 includes a main control device 110, a sub-control device 220, and a storage device 130. The sub-control device 220 is different from the sub-control device 120 of the first embodiment in that it has a memory control circuit 126 instead of a sub-memory 124. The memory control circuit 126 reads predetermined information from the storage device 130 connected to the sub-control device 120, and provides the read information to the sub-program output circuit 123.

[0076] The storage device 130 is a storage device having a program storage area 131, and is a non-rewritable non-volatile memory. Examples of the non-rewritable non-volatile memory are PROM (Programmable Read Only Memory) and mask ROM. The storage device 130 is connected to the sub-control device 220, and provides predetermined information to the sub-control device 220 in response to a request from the memory control circuit 126.

[0077] Since the storage device 130 is constituted by a non-volatile memory that is not rewritable, when the semiconductor device 100 receives unauthorized access, the main program of the main control device 110 can be reliably rewritten into a subroutine prepared in advance.

[0078] In addition, according to the modified example of the first embodiment, since the sub-control device 220 does not include a sub-memory for storing the main program, it can be configured to be relatively inexpensive. Therefore, according to the modified example of the first embodiment, a semiconductor device or the like for maintaining a desired function while suppressing unauthorized access can be provided.

[0079] Next, refer to Fig. 9 , the second embodiment will be described. Fig. 9 1 is a diagram showing a state after the program of the breathing assistance device according to the second embodiment is rewritten. The breathing assistance system 2 according to the second embodiment is different from the breathing assistance system 1 according to the first embodiment in the function implemented by the subroutine after receiving unauthorized access. More specifically, the breathing assistance system 2 is limited to the function of the communication device in which the main control device 110 pre-sets the communication device, which is rewritten as a subroutine.

[0080] After the main control device 110 detects abnormal signal processing due to unauthorized access, the breathing assistance system 2 receives the subprogram from the subcontrol device 120, stores the received subprogram in the main control device 110, and restarts the main control device 110. The subprogram has a control command for fixing the operation of the communication device 11 to a preset subsequent operation, rather than a function of controlling the communication device 11 that the main program has been executed.

[0081] First, the main control device 110 instructs the communication device 11 to send information to a preset external device (eg, a management device) indicating that abnormal signal processing has been detected. Here, the specified mode executed by the respiratory assistance system 2 may be any mode as long as it is preset with respect to the receiving side.

[0082] On the other hand, the main control device 110 instructs the communication device 11 not to send any signal via the network 900 to the main control device 110. As a result, the main control device 110 rewritten as a subroutine does not accept a signal from the outside. Therefore, the breathing assistance system 2 can avoid attacks from the outside.

[0083] The breathing assistance system 2 also indicates to the user that an abnormality has occurred through a subroutine executed after detecting abnormal signal processing. For example, the breathing assistance system 2 displays on the display device 15 to notify the user that abnormal signal processing has been detected and therefore no signal received from the outside is accepted.

[0084] With the above configuration, the breathing assistance system 2 related to the second embodiment can appropriately notify the external system (eg, the server 800 used by the administrator) and the user of system abnormality while avoiding unauthorized access from the outside.

[0085] It should be noted that the communication device 11 can receive instructions indicating that an abnormality has occurred relative to the outside from the command generated by the subroutine as described above, but it can also be implemented by other configurations. For example, the communication device 11 can be configured to receive a trigger signal from the main control device 110 and implement the above-mentioned function in response to the received trigger signal. With such a configuration, since the respiratory assistance system 2 can exhibit a function of not accepting communications from the outside after receiving unauthorized access and before rewriting the program, attacks from the outside can be quickly avoided. The communication device 11 can be included in the semiconductor device 100, or the main control device 110 can have the function of the communication device 11.

[0086] Next, a modified example of the second embodiment will be described. Fig.10 900 is a schematic configuration diagram of a semiconductor system according to a modified example of the second embodiment. In the modified example of the second embodiment, a plurality of semiconductor devices are communicably connected to each other via a network 900 .

[0087] exist Fig.10 In the embodiment, the semiconductor system 20 has semiconductor devices 100A, 100B, and 100C. The semiconductor devices 100A-100C are connected to a network 900 and are communicably connected to each other.

[0088] The semiconductor device 100A includes a communication device 11A, a main control device 110A, and a sub-control device 120A as main components, and each component has the same Fig. 9 The configuration and functions of the semiconductor device 100 in the described breathing assistance system 2 are the same as those of the semiconductor device 100. However, the communication device 11A has a function of notifying the other semiconductor devices 100B and 100C of the detection of abnormal signal processing when abnormal signal processing is detected by receiving unauthorized access.

[0089] In addition, the semiconductor device 100A has a function of rewriting the program of the main control device 110A by receiving a notification when another semiconductor device 100B (or 100C) notifies another semiconductor device 100B (or 100C) that abnormal signal processing has been detected. That is, the main control device 110A also outputs a trigger signal to the sub-control device 120A by receiving a signal indicating that abnormal signal processing has been detected from another semiconductor device. Such a function can be realized by, for example, a configuration in which the CPU 117 generates a trigger signal under predetermined conditions, such as Figure 4 The semiconductor devices 100B and 100C respectively have the same configuration and function as the semiconductor device 100A.

[0090] For example, Fig.10As shown, if the semiconductor device 100A receives unauthorized access 99A via the network 900, if the main control device 110 detects abnormal signal processing through the unauthorized access, the semiconductor device 100A notifies the semiconductor device 100B through communication 99B that the abnormal signal processing has been detected. At the same time, the semiconductor device 100A notifies the semiconductor device 100C of the fact that the abnormal signal processing has been detected through communication 99C. The semiconductor device 100B, which has received the notification that the abnormal signal processing has been detected from the semiconductor device 100A, outputs a trigger signal to the sub-control device 120B through the main control device 110B. As a result, the semiconductor device 100B performs a process of rewriting the program of the main control device 110B into a subroutine. Similarly, the semiconductor device 100C performs a process of the main control device 110C outputting a trigger signal to the sub-control device 120C to rewrite the program of the main control device 110C into a subroutine.

[0091] Next, refer to Fig.11 , a modified example process of the second embodiment will be described. Fig.11 1 is a flowchart showing the semiconductor device processing according to the modified example of the second embodiment. The semiconductor devices constituting the semiconductor system 20 perform the processing shown in the figure. For convenience, the following description will be as the processing performed by the semiconductor device 100A, but the semiconductor devices 100B and 100C also perform the same processing.

[0092] First, after detecting abnormal signal processing, the semiconductor device 100A determines whether the abnormal signal processing to be output to the sub-control device 120A is caused by the abnormal signal processing detected by the main control device 110A of the semiconductor device 100A, that is, whether the abnormality is its own abnormality (step S20).

[0093] When it is determined that the abnormality is the own abnormality (step S20: Yes), the semiconductor device 100A executes a transaction to notify the other semiconductor device of the abnormality (step S21). Then, in order to rewrite its own main program, the reference Figure 5 The main program described rewrites routine S10 (routine S10).

[0094] On the other hand, when receiving an abnormal signal process from another semiconductor device, the semiconductor device 100A does not judge that the abnormal signal process is its own abnormality (step S20: No). In this case, the semiconductor device 100A executes a main program rewriting routine for rewriting its own main program (routine S10) without notifying other devices.

[0095] As described above, when any semiconductor device constituting the semiconductor system 20 receives unauthorized access and detects abnormal signal processing, the semiconductor system 20 notifies another semiconductor device of the abnormal signal processing and rewrites the program of the corresponding semiconductor device. As a result, unauthorized attacks from the outside can be avoided in advance not only in the semiconductor device that has received unauthorized access but also in the semiconductor device that has not received unauthorized access. That is, according to the modified example of the second embodiment, a semiconductor device or the like for maintaining a desired function while suppressing unauthorized access to the entire system can be provided.

[0096] Next, a third embodiment will be described. The structure of a respiratory assistance system 3 according to the third embodiment is different from that of the respiratory assistance system according to the first embodiment. Fig.12 is a schematic configuration diagram of a semiconductor device according to a third embodiment.

[0097] The semiconductor device 103 according to the present embodiment is different from the semiconductor device 100 according to the first embodiment in that it has a switch 17 between the main control device 110 and the sub-control device 120. The switch 17 is a switch for allowing or not allowing the trigger signal output from the main control device 110 to be transmitted to the sub-control device 120.

[0098] Considering that the main control device 110 may have been tampered with by unauthorized access, the switch 17 is preferably configured not to be affected by the software operation of the main control device 110. That is, the switch 17 is, for example, a mechanical switch composed of a combination of mechanical components, or a switch composed of a combination of electrical components such as transistors. In the semiconductor device 103, the switch 17 is in an off state as an initial setting, that is, a state in which the trigger signal output by the main control device 110 is not sent to the sub-control device 120. When the user accepts the operation of switching the state of the switch from off to on, the switch 17 is in a state in which the trigger signal is sent to the sub-control device 120. That is, even when abnormal signal processing is detected, the semiconductor device 103 does not rewrite the program of the main memory 112 until the user performs the switch switching operation.

[0099] Next, refer to Fig.13 , the processing of the semiconductor device according to the third embodiment will be described. Fig.131 is a flowchart showing the semiconductor device processing according to the third embodiment. First, when the semiconductor device 103 detects abnormal signal processing, processing for indicating the abnormal signal processing is performed in operation S30. Specifically, for example, when the abnormal signal processing is detected, the semiconductor device 103 displays the fact that the abnormal signal processing has been detected on the display device 15. Alternatively, the semiconductor device 103 notifies the user or administrator via the communication device 11 of the fact that the abnormal signal processing has been detected. As a result, the user or the like can select a processing different from the processing of rewriting the program executed by the main control device 110 into the subroutine.

[0100] Next, in operation S31, the semiconductor device 103 receives the operation of the switch 17, and determines the operation based on whether the switch 17 is turned on. That is, when the user turns on the switch (step S31: Yes), the trigger signal of the semiconductor device 103 is sent from the main control device 110 to the sub-control device 120. As a result, the semiconductor device 103 executes the main program rewriting routine in the above-mentioned step S10. After completing the main program rewriting routine S10, the semiconductor device 103 ends the processing.

[0101] In the state, when the user does not turn on the switch (step S31: No), the semiconductor device 103 determines whether another process has been accepted (step S32). Here, the other process is a process different from the process of rewriting the main program stored in the main control device 110 into the sub-program stored in the sub-control device 120. For example, the semiconductor device 103 can refer to Figure 7 The rewriting device 700 described rewrites the program of the main memory. That is, the user can connect the rewriting device 700 to the semiconductor device 103 instead of operating the switch 17. Alternatively, instead of operating the switch 17, the user can perform a process of diagnosing whether the semiconductor device 103 has been tampered with. Alternatively, the user can perform an operation of turning off the breathing assistance system 3 instead of operating the switch 17. When the semiconductor device 103 receives such another process (S32: Yes), the process shown in the figure is terminated, and the process enters another process. On the other hand, when the semiconductor device 103 does not accept another process (step S32: No), the process returns to step S31 and accepts the operation of the switch 17.

[0102] As described above, according to the processing related to the third embodiment, the semiconductor device 103 can provide the user with an opportunity to select a process different from the process of rewriting the program executed by the main control device 110 as a subroutine. As a result, the semiconductor device 103 can perform the check, restoration, etc. of the main program without rewriting the main program of the main control device 110 to the subroutine. That is, the semiconductor device 103 can receive the restoration process, etc. without deleting the communication function.

[0103] The third embodiment has been described above. According to the third embodiment, a semiconductor device or the like can be provided which maintains a required function without fixing the process after detecting an abnormal signal process such as unauthorized access, and at the same time suppresses the occurrence of a system failure due to the unauthorized access or the like.

[0104] Moreover, various types of non-transitory computer-readable media can be used to store the above-mentioned program and provide it to the computer. Non-transitory computer-readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (e.g., floppy disks, magnetic tapes, hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROM (read-only memory) CD-R, CD-R / W, solid-state memory (e.g., mask ROM, PROM and EPROM (erasable PROM), flash ROM and RAM (random access memory)). The program can also be provided to the computer via various types of temporary computer-readable media. Examples of temporary computer-readable media include electrical signals, optical signals, and electromagnetic waves. Temporary computer-readable media can provide the program to the computer via wired or wireless communication paths (e.g., wires and optical fibers).

[0105] Although the invention made by the inventors has been specifically described based on the embodiments, the present invention is not limited to the embodiments that have been described, and needless to say, various modifications can be made without departing from the gist thereof. That is, the above-mentioned semiconductor device can be applied to various devices having a communication function.

Claims

1. A semiconductor device comprising: Main control device, including: A main memory, used for storing a main program, wherein the main program is used for receiving an external signal; a trigger signal output circuit for outputting a trigger signal when abnormal signal processing different from preset signal processing is performed, and A sub-control device is coupled to the main control device, and the sub-control device includes: A trigger signal obtaining circuit, used for obtaining the trigger signal; a subroutine output circuit, the subroutine output circuit being used to output a subroutine to the main control device based on the obtained trigger signal; and a reset terminal, the reset terminal being used to keep the sub-control device in a non-operating state; Wherein, the main control device includes a program update circuit, and the program update circuit is used to receive an update of a program stored in the main memory when the sub-control device is in a non-operating state.

2. The semiconductor device according to claim 1, further comprising: The external signal obtaining circuit is used to obtain the external signal, wherein the external signal is obtained through external communication with the outside.

3. The semiconductor device according to claim 2, in, The external signal obtaining circuit obtains the external signal received through external communication using a public communication network.

4. The semiconductor device according to claim 2, in, The external signal obtaining circuit obtains the external signal received through external communication according to a predetermined standard.

5. The semiconductor device according to claim 1, in, The subroutine output circuit included in the sub-control device outputs a subroutine that does not accept the external signal to the main control device based on the obtained trigger signal.

6. The semiconductor device according to claim 1, in, The sub-control device further comprises: a request circuit, which is used to output a request signal when the sub-control device obtains the trigger signal, wherein the request signal is used to request the main control device to transmit the sub-program.

7. The semiconductor device according to claim 6, in, The main control device further includes: a response circuit for outputting a response signal to the request signal to the sub-control device after receiving the request signal from the sub-control device, and for obtaining the sub-program after outputting the response signal.

8. The semiconductor device according to claim 7, in, When the subroutine output circuit receives the response signal from the main control device, the subroutine output circuit outputs the subroutine to the main control device.

9. The semiconductor device according to claim 8, further comprising: a sub-storage device for storing the sub-program, The sub-control device includes a memory control circuit for controlling the sub-storage device and for providing the sub-program stored in the sub-storage device to the sub-program output circuit.

10. The semiconductor device according to claim 1, in, The main control device includes an abnormality detection circuit for changing an output voltage when abnormal signal processing is performed, and The trigger signal output circuit outputs the trigger signal based on a voltage change of the abnormality detection circuit.

11. The semiconductor device according to claim 1, in, When acquiring the sub-program, the main control device rewrites the main program stored in the main memory to the sub-program.

12. The semiconductor device according to claim 11, in, The main control device further includes an indication circuit configured to output an indication signal when the trigger signal is output, the indication signal indicating that the trigger signal has been output.

13. The semiconductor device according to claim 12, in, The designation circuit transmits the designation signal to the outside via a communication device.

14. The semiconductor device according to claim 12, in, The main control device outputs the trigger signal to the sub-control device by receiving the designation signal from another semiconductor device.

15. The semiconductor device according to claim 12, further comprising: A transmission switch is used to allow the transmission of the trigger signal to the sub-control device.

16. The semiconductor device according to claim 1, further comprising: a communication device for performing external communication and providing the external signal to the main control device, and When the main program in the main memory is rewritten to the subprogram, the main control device instructs the communication device not to provide the external signal to the main control device.

17. The semiconductor device according to claim 16, in, When the main program of the main memory has been rewritten to the subprogram, the main control device instructs the communication device to send an indication signal, the indication signal indicating that the main program of the main memory has been rewritten to the subprogram, the indication signal indicating that the main program has been rewritten to a preset destination.

18. A semiconductor system comprising a plurality of semiconductor devices communicatively coupled to each other, each semiconductor device comprising: Main controller, including: a main memory, for storing a main program, wherein the main program is used to receive an external signal; and a trigger signal output circuit for outputting a trigger signal when a signal processing different from a preset signal processing is performed, and a sub-controller coupled to the main controller, and comprising: A trigger signal obtaining circuit, used for obtaining the trigger signal; a subroutine output circuit, configured to output a subroutine to the main controller based on the obtained trigger signal; and a reset terminal, the reset terminal being used to keep the sub-controller in a non-operating state; The main controller includes a program update circuit, which is used to receive an update of the program stored in the main memory when the sub-controller is in a non-operating state. Among them, one semiconductor device among the plurality of semiconductor devices sends a notification to another semiconductor device based on the trigger signal.

19. A non-transitory computer-readable medium storing a program, wherein when the program is executed by a computer, the computer executes a semiconductor device protection method, the semiconductor device protection method comprising: A main program storage step, for storing a main program in a main memory in a main control device, wherein the main program is used to receive an external signal; a subroutine storing step for storing the subroutine in a sub-control device coupled to the main control device; a trigger signal output step for outputting a trigger signal to the sub-control device when a signal processing different from a preset signal processing is performed in the main control device; as well as a subroutine output step, for outputting the subroutine to the main control device in the sub-control device based on the trigger signal; a resetting step for maintaining the sub-control device in a non-operating state; as well as Wherein, when the sub-control device is in a non-operating state, an update of a program stored in the main memory is received.

Images