Semiconductor device

Abstract

The invention relates to a semiconductor device. A semiconductor device is protected from fault attack (FIA). A reset data transfer controller (RDTC) performs N data transfers, transfers data (DT) stored in a first memory (MEM1a) to a main register (REGm) during a first data transfer, and transfers data (DT) stored in the first memory (MEM1a) to a sub-register (REG) during an Nth data transfer. A comparison circuit CMP1 determines a match / mismatch between data DTm transferred to a main register REGm and data DT transferred to a sub-register REG, and outputs a determination result signal RS indicating a determination result. When it is determined that the result signal RS indicates a match, the system controller SYSC activates the processor PRC, and when it indicates a mismatch, the reset data transfer controller RDTC is caused to perform N data transfers again.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] The disclosure of Japanese Patent Application No. 2023-178393 filed on October 16, 2023, including the specification, drawings and abstract, is incorporated herein by reference in its entirety. Technical Field

[0003] The present invention relates to a semiconductor device, for example, a semiconductor device equipped with a processor. Background Art

[0004] The disclosed techniques are listed below.

[0005] [Non-patent document 1]

[0006] "Secure Application Programming in the Presence of Side-Channel Attacks", [Online], [Accessed September 26, 2023], Internet <URL:https: / / riscureprodstorage.blob.core.windows.net / production / 2017 / 08 / Riscure_Whitepaper_Side_Channel_Patterns.pdf>

[0007] Non-patent document 1 in "4.6 FAULT.DOUBLECHECK" discloses a method for implementing a countermeasure against a fault attack (FIA: fault injection attack) using software. Specifically, it discloses a method for using software to double-check the identity of data read at a specific time point and data read after a fixed period of time when using important data. Summary of the invention

[0008] For example, in a semiconductor device equipped with a processor or the like, or in other words, in a semiconductor chip, when the chip is started, it is possible to perform various initial settings for the entire chip by transferring predetermined data from a nonvolatile memory to a register. This type of transfer operation is also called reset transfer. In the initial setting items transferred by reset, a secure protection state can be included. After completing various initial settings by this type of reset transfer, the processor starts.

[0009] On the other hand, as one of the methods of fault injection attack (FIA), for example, a method of reversing important data indicating a secure protection state is mentioned. For example, if such a fault attack is performed during reset transfer, the secure protection state may be changed, thereby allowing unauthorized control of the semiconductor chip and causing important data to be tampered with or leaked. As a countermeasure against fault attacks, as shown in non-patent document 1, a method of performing a double check using software is known. However, such a method can be applied after the processor has been started and is in a state where software can be executed, but is difficult to apply during reset transfer.

[0010] The embodiments described later are made in consideration of these problems, and other problems and novel features will become apparent from the description of this specification and the accompanying drawings.

[0011] A semiconductor device according to one embodiment includes a processor formed on a semiconductor chip; a memory controller including a memory unit, a register unit, and a comparison circuit; a reset data transfer controller that performs data transfer from the memory unit to the register unit when the chip is started; and a system controller. The memory unit has a first memory in which data necessary for the initial setting of the semiconductor chip is stored. The register unit has a first register referenced during the initial setting of the semiconductor chip and a second register for verifying the first register. The reset data transfer controller performs N data transfers, transferring the data stored in the first memory to the first register at the first data transfer, and transferring the data stored in the first memory to the second register at the Nth data transfer. The comparison circuit determines a match / mismatch between the data transferred to the first register and the data transferred to the second register, and outputs a determination result signal indicating the determination result. If the determination result signal indicates a match, the system controller starts the processor, and if the determination result signal indicates a mismatch, causes the reset data transfer controller to perform N data transfers again.

[0012] According to one embodiment, a semiconductor device may be protected from a fault injection attack (FIA). BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 is a block diagram showing a schematic configuration example of main parts of the semiconductor device according to the first embodiment.

[0014] Figure 2 It is shown Figure 1 A sequence diagram showing an example of schematic operations when a chip in a semiconductor device is started up.

[0015] Figure 3AIt is shown Figure 1 A flowchart showing an example of detailed processing contents when a chip is started up in a semiconductor device shown.

[0016] Figure 3B It is schematically indicated Figure 3A The diagram shows the processing content shown and illustrates an example of a signal transmission path inside a semiconductor device.

[0017] Figure 4 It is shown Figure 2 and Figure 3A A flowchart showing an example of detailed processing contents in the reset transfer processing shown.

[0018] Figure 5 is a block diagram showing a schematic configuration example of main parts of a semiconductor device according to the second embodiment.

[0019] Figure 6 is shown as being stored in Figure 5 A schematic diagram of an example of information in a first memory.

[0020] Fig. 7A It is shown Figure 5 A flowchart showing an example of detailed processing contents when a chip is started up in a semiconductor device shown.

[0021] Figure 7B It is schematically indicated Fig. 7A The diagram shows the processing content shown and illustrates an example of a signal transmission path inside a semiconductor device. DETAILED DESCRIPTION

[0022] In the following embodiments, for convenience, the description may be divided into multiple parts or embodiments when necessary. Unless otherwise specified, these are not independent of each other; on the contrary, one may be related to another as a modification, detail, supplementary description, etc. of part or all of it. In addition, in the following embodiments, when the number of elements, etc. (including the number of elements, values, quantities, ranges, etc.) is mentioned, unless otherwise specified or clearly limited to a specific number in principle, it is not limited to the specific number, and may be more or less than the specific number.

[0023] Furthermore, in the following embodiments, it goes without saying that constituent elements (including element steps, etc.) are not necessarily essential unless they are specifically stated or considered to be obviously essential in principle. Similarly, in the following embodiments, when referring to the shapes, positional relationships, etc. of components, unless specifically stated or considered not to be the case in principle, it is assumed that those shapes, etc. that are substantially approximate or similar to those shapes are included. The same applies to the above-mentioned numerical values ​​and ranges.

[0024] Furthermore, the circuit elements constituting each functional block of the embodiment are not particularly limited but are formed on a semiconductor substrate such as single crystal silicon by known integrated circuit technology including CMOS (Complementary Metal Oxide Semiconductor).

[0025] Hereinafter, the embodiments are described in detail with reference to the accompanying drawings. In all the drawings used to explain the embodiments, components having the same function are represented by the same reference numerals, and their repeated description is omitted. In addition, in the following embodiments, unless particularly necessary, the description of the same or similar components will not be repeated in principle.

[0026] (First Embodiment) <Overview of Semiconductor Device>

[0027] Figure 1 1 is a block diagram showing a schematic configuration example of main components of the semiconductor device according to the first embodiment. Figure 1 As shown, the semiconductor device according to the first embodiment has a semiconductor chip CHP, such as a SoC (system on chip), on which a plurality of circuits are formed. The plurality of circuits include a power-on controller POC, a processor PRC, a reset data transfer controller RDTC, a memory controller MEMC, various peripheral circuits PERI, and a system controller SYSC.

[0028] The various peripheral circuits PERI include various circuits required for the semiconductor device, such as a communication interface circuit with the outside of the chip, an analog-to-digital converter, a digital-to-analog converter, etc. The system controller SYSC controls the power-on controller POC, the processor PRC, the memory controller MEMC, the reset data transfer controller RDTC, and the various peripheral circuits PERI, thereby controlling, for example, the operation sequence of the entire semiconductor chip CHP.

[0029] The power-on controller POC releases the reset state of the entire semiconductor chip CHP in response to powering the semiconductor chip CHP or in response to a reset signal from an external reset terminal. The processor PRC is, for example, a CPU (central processing unit) and may also include a GPU (graphics processing unit) or a DSP (digital signal processor).

[0030] The memory controller MEMC includes a memory unit MEMU, a register unit REGU and a comparison circuit CMP1. The memory controller MEMC mainly controls access to the memory unit MEMU or the register unit REGU. The memory unit MEMU includes, for example, a first memory MEM1a, a volatile memory RAM such as an SRAM (static random access memory), and a non-volatile memory NVM such as an MRAM (magnetoresistive RAM) and a flash memory. The register unit REGU includes a main register (first register) REGm and a sub-register (second register) REG.

[0031] For example, a program is stored in the nonvolatile memory NVM. Such a program is copied from the nonvolatile memory NVM to the volatile memory RAM. The processor PRC executes the program copied to the volatile memory RAM. The first memory MEM1a is composed of a nonvolatile memory that allows writing only once, in other words, is not rewritable, such as a fuse ROM (read only memory), an OTP (one-time programmable)-ROM, etc. The first memory MEM1a pre-stores data necessary for the initial setting of the semiconductor chip CHP, that is, initial setting data.

[0032] The initial setting data includes important data indicating the security protection state, etc. As a specific example, the initial setting data may include a setting value of a protection bit for a command, a setting value of a protection bit for booting firmware, that is, a value determining whether protection is enabled or disabled. The reset data transfer controller RDTC performs data transfer, that is, reset transfer from the memory unit MEMU to the register unit REGU, when the semiconductor chip CHP is started.

[0033] As will be described in detail later, the reset data transfer controller RDTC transfers the data (i.e., initial setting data) stored in the first memory MEM1a to the main register REGm or the sub-register REG through N data transfers, where N is an integer greater than or equal to 2. The reset data transfer controller RDTC includes a random number generation circuit RNG for generating a value of N, i.e., the number of these data transfers, through a random number.

[0034] Here, during the initial setting of the semiconductor chip CHP, the data DTm transmitted to the main register REGm is referenced by, for example, the processor PRC or the system controller SYSC. On the other hand, the sub-register REG is provided for verifying the data DTm of the main register REGm. That is, the comparison circuit CMP1 within the memory controller MEMC determines the match / mismatch between the data DTm transmitted to the main register REGm and the data DT transmitted to the sub-register REG. Then, the comparison circuit CMP1 outputs a determination result signal RS indicating the determination result to the system controller SYSC.

[0035] Figure 2 It is shown in Figure 1 The semiconductor chip CHP performs the following operations at the time of chip startup: Figure 2 In this reset sequence, the semiconductor chip CHP sequentially performs a power-on process (step S101), a reset transfer process (step S102), a processor startup determination process (step S103), and a processor startup process (step S104).

[0036] In the power-on process (step S101), the power-on controller POC releases the reset state of the semiconductor chip CHP. In the reset transfer process (step S102), the reset data transfer controller RDTC performs data transfer from the memory unit MEMU to the register unit REGU, that is, reset transfer of the initial setting data. In the processor startup determination process (step S103), the system controller SYSC determines whether the reset transfer has been correctly performed. Then, if the reset transfer has been correctly performed, in the processor startup process (step S104), the system controller SYSC starts the processor PRC.

[0037] In this type of reset sequence, if a glitch attack (FIA) is performed during the reset transmission, there is a risk that the data DTm in the main register REGm may be destroyed. For example, if the enable signal is attacked, the main register REGm itself cannot receive data and therefore cannot retain the correct data. If the address signal is attacked, the correspondence between the data stored in the first memory MEM1a and the data stored in the main register REGm is wrong, and as a result, the main register REGm cannot retain the correct data. If the data signal is attacked, the main register REGm receives incorrect data and therefore cannot retain the correct data.

[0038] Therefore, if the data DTm in the main register REGm is destroyed, and the setting of the above-mentioned protection bit is changed, for example, unauthorized control of the semiconductor chip CHP may be caused, thereby causing potential external software leakage or tampering. In addition, in particular, from the perspective of the ease of determining the timing of the attack, the reset transmission process (step S102) may become vulnerable to a fault attack. That is, the attacker can arbitrarily determine the start timing of step S101, for example, using an external reset terminal, and can also relatively easily grasp the start timing of the reset transmission process (step S102) executed immediately thereafter.

[0039] Therefore, in the method of the first embodiment, if Figure 2 As shown, by performing N data transfers (steps S102[1]-S102[N]) during the reset transfer process (step S102), the semiconductor chip CHP is protected from a fault attack. Here, since the value of N is a random number, the duration Trt of the reset transfer process (step S102) varies according to the value of N. It should be noted that the countermeasure method shown in non-patent document 1 is a software-based method and is applicable after the processor startup process (step S104).

[0040] <Detailed Operation of Semiconductor Equipment>

[0041] Figure 3AIt is shown Figure 1 A flowchart showing an example of detailed processing contents when a chip is started up in a semiconductor device shown. Figure 3B It is schematically indicated Figure 3A The diagram shows the processing content shown and illustrates an example of a signal transmission path inside a semiconductor device. Figure 3B Shows from Figure 1 Some examples of configurations of semiconductor chips CHP extraction are shown.

[0042] exist Figure 3A and Figure 3B In the embodiment, for example, the power-on controller POC releases the reset state of the semiconductor chip CHP in response to the power supply to the semiconductor chip CHP or the reset signal from the external reset terminal (step S201). The system controller SYSC starts the memory unit MEMU in response to the release of the reset state (step S202). Specifically, the system controller SYSC supplies power to the first memory MEM1a and the like, and makes the first memory MEM1a accessible. The processing of steps S201 and S202 corresponds to the power-on processing (step S101).

[0043] Then, the reset data transfer controller RDTC performs N data transfers, namely N reset transfers (step S203). Figure 3B As shown, at the first data transfer, the reset data transfer controller RDTC transfers the data DT stored in the first memory MEM1a, specifically, the initial setting data, to the main register REGm.

[0044] On the other hand, from the second to the Nth data transfer, the reset data transfer controller RDTC transfers the data DT stored in the first memory MEM1a (i.e., the same initial setting data as the first time) to the sub-register REG. In other words, if the value of N is an integer greater than or equal to 3, the reset data transfer controller RDTC sequentially rewrites the data DT stored in the first memory MEM1a to the sub-register REG from the second to the Nth data transfer. The process of step S203 corresponds to the reset transfer process (step S102).

[0045] Next, the system controller SYSC performs FIA error checking (step S204). Figure 3B As shown, first, the comparison circuit CMP1 determines the match / mismatch between the data DTm transmitted to the main register REGm and the data DT transmitted to the sub-register REG. Therefore, the comparison circuit CMP1 uses the data DT transmitted to the sub-register REG for the Nth time to verify the validity of the data DTm transmitted to the main register REGm for the first time.

[0046] Then, the comparison circuit CMP1 outputs a determination result signal RS indicating the determination result to the system controller SYSC. In the case where the determination result signal RS indicates a mismatch (step S204: there is an error), the system controller SYSC initializes the reset transfer (step S205). Specifically, the system controller SYSC clears the value of each register contained in the memory controller MEMC and the reset data transfer controller RDTC, including the register unit REGU. Thereafter, the system controller SYSC returns to step S203, and causes the reset data transfer controller RDTC to perform N data transfers again.

[0047] On the other hand, if the determination result signal RS from the comparison circuit CMP1 indicates a match (step S204: no error), the system controller SYSC starts the processor PRC by releasing the reset state of the processor PRC and other actions (step S206). In addition, after performing N data transfers again via the reset data transfer controller RDTC after step S205, if the determination result signal RS indicates a match, the system controller SYSC also starts the processor PRC. The processing of steps S204 and S205 corresponds to the processor start determination processing (step S103), and the processing of step S206 corresponds to the processor start processing (step S104).

[0048] Therefore, the semiconductor chip CHP determines the existence of the FIA ​​error by verifying the validity of the first transmitted data DTm using the data DT transmitted for the Nth time during the reset transmission. If the FIA ​​error is not detected, the semiconductor chip CHP starts the processor PRC. If the FIA ​​error is detected, it does not start the processor PRC. By not starting the processor PRC, the semiconductor device cannot be illegally controlled, protecting the semiconductor device from the fault attack (FIA).

[0049] On the other hand, using this type of method, the conditions under which FIA error detection may be missed are: (A) if the attack is carried out during both the first data transfer and the Nth data transfer, and (B) if the data changes caused by the attack are the same. It is generally believed that the probability of satisfying conditions (A) and (B) at the same time is very low. In particular, by sequentially changing the target timing of the attack using the random number N, the probability of satisfying conditions (A) and (B) at the same time becomes very low. Therefore, if the initial setting data is destroyed by the fault attack (FIA) during the reset transfer, it can be detected with a high probability.

[0050] It is also possible to sequentially verify the validity of the first transmitted data DTm using each data transmitted from the second time to the Nth time. In this case, it is basically possible to verify whether a fault attack has been carried out during the reset transmission. However, in this method, FIA errors can be over-detected. That is, even if a fault attack has been carried out, there is no particular problem if the first transmitted data DTm is valid data. From this point of view, Figure 3A and Figure 3B As shown, a method of using the Nth transmitted data DT to verify the validity of the first transmitted data DTm is desirable.

[0051] Furthermore, here, in the sub-register REG, during the data transfer from the second time to the Nth time, the data DT from the first memory MEM1a is sequentially rewritten. As a result, for example, compared with the case where a plurality of sub-registers corresponding to the data transfer from the second time to the Nth time are provided, the area of ​​the register can be reduced. In a fault attack, not only the data in the target register but also the data stored in the source memory can be attacked. Figure 1 In the illustrated configuration example, since the first memory MEM1a as the source is a non-rewritable memory, data in the source memory is not destroyed.

[0052] Figure 4 It is shown Figure 2 and Figure 3A The reset data transfer controller RDTC includes, for example, executing the following steps: Figure 4 The sequencer circuit shown in the figure is processed. Figure 4 In step S301, the reset data transfer controller RDTC waits for a reset transfer start command from the system controller SYSC.

[0053] When the reset data transfer controller RDTC receives the reset transfer start command (step S301: Yes), it generates a random number as the value of N using the random number generation circuit RNG (step S302). The reset data transfer controller RDTC also initializes the transfer count n to zero (step S303).

[0054] Subsequently, the reset data transfer controller RDTC sets the source to the first memory MEM1a, specifically, to the address storing the initial setting data in the first memory MEM1a (step S304). The reset data transfer controller RDTC also sets the destination to the main register REGm, specifically, for example, to the address assigned to the main register REGm (step S305).

[0055] With such settings, the reset data transfer controller RDTC performs data transfer and updates the transfer count n (step S306). Specifically, the reset data transfer controller RDTC performs read access to the first memory MEM1a at the source and writes the read data to the main register REGm at the destination by enabling it.

[0056] Subsequently, the reset data transfer controller RDTC changes the destination to the sub-register REG, specifically, for example, to the address assigned to the sub-register REG (step S307). Using the changed settings, the reset data transfer controller RDTC performs data transfer and updates the transfer count n (step S308). Then, the reset data transfer controller RDTC repeats the process of step S308 until the transfer count n reaches N (step S309: No).

[0057] On the other hand, when the transfer count n reaches N (step S309: Yes), the reset data transfer controller RDTC outputs a reset transfer completion notification to the system controller SYSC (step S310). Note that the information on the source and destination in steps S304, S305, and S307 is, for example, fixedly determined in advance on the circuit.

[0058] <Main Effects of the First Embodiment>

[0059] As described above, in the method of the first embodiment, the main register REGm, the sub-register REG and the comparison circuit CMP1 are used to detect whether there is an FIA error in the data stored in the main register REGm. If there is no FIA error, the processor PRC is activated. As a result, typically, the semiconductor device can be protected from the fault attack (FIA).

[0060] (Second Embodiment) <Potential Problems>

[0061] In the method of the first embodiment described above, in order to prevent data corruption in the memory at the source, the memory at the source, that is, the first memory MEM1a, is composed of an OTP-ROM or the like that cannot be rewritten. On the other hand, if the memory at the source is composed of a rewritable nonvolatile memory, even if the data itself in the memory is corrupted, the identity of the data transferred to the register can be maintained unchanged, so that the FIA ​​error is not detected. Therefore, it is necessary to take some measures to prevent data corruption from occurring in the memory at the source.

[0062] <Schematic Configuration of Semiconductor Device>

[0063] Figure 5 is a block diagram showing an example of a main configuration of a semiconductor device according to the second embodiment. Figure 6 is shown as being stored in Figure 5Schematic diagram of an example of information in the first memory (MEM1b) in. Figure 5 The semiconductor chip CHP shown is Figure 1 The configuration examples shown differ in the following points.

[0064] As a first difference, the memory unit MEMU includes a first memory MEM1b, a second memory MEM2 and a volatile memory RAM. Figure 1 Unlike the case of the first memory MEM1b, the first memory MEM1b is composed of a rewritable nonvolatile memory NVM, such as a flash memory, MRAM, etc. The second memory MEM2 is composed of a nonvolatile memory that allows only a single write, in other words, a non-rewritable nonvolatile memory, such as a fuse ROM, OTP-ROM, etc.

[0065] like Figure 6 As shown, the first memory MEM1b stores data DT, more specifically, initial setting data, and an error correction code ECC added to the data DT in the address area AR1. The error correction code ECC is uniquely determined by performing a predetermined operation on the data DT. In addition, the first memory MEM1b stores a recovery count RR in the address area AR2, which will be described later, and stores a program in the address area AR3. Similar to Figure 1 In this case, the program is copied to a volatile memory RAM such as an SRAM and executed by the processor PRC.

[0066] As a second difference, the reset data transfer controller RDTC further includes an ECC (Error Checking and Correcting) decoder ECC_DEC and a comparison circuit (second comparison circuit) CMP2. The reset data transfer controller RDTC performs data transfer from the memory unit MEMU to the register unit REGU via the ECC decoder ECC_DEC during reset transfer.

[0067] At this time, the ECC decoder ECC_DEC determines whether error correction is possible based on the error correction code ECC added to the data DT (i.e., the initial setting data). If error correction is possible, for example, in the case of a 1-bit error, the ECC decoder ECC_DEC transfers the error-corrected data DT to the register unit REGU. On the other hand, if error correction is not possible, for example, in the case of a 2-bit error, the ECC decoder ECC_DEC outputs an ECC error signal EER to the system controller SYSC.

[0068] The comparison circuit CMP2 determines whether the recovery count RR stored in the first memory MEM1b has reached a preset recovery count upper limit value RRlmt. Here, the recovery count upper limit value RRlmt is stored in the second memory MEM2. If the recovery count RR reaches the upper limit value RRlmt, the comparison circuit CMP2 outputs a recovery error signal RER to the system controller SYSC. Although the details will be described later, the system controller SYSC controls so that when the ECC error signal EER or the recovery error signal RER is input, at least the processor PRC is not activated.

[0069] As a third different point, the data recovery unit DREU is provided outside the semiconductor chip CHP. In detail, the data recovery unit DREU is provided, for example, in an advanced device that manages the semiconductor chip CHP within a predetermined system including the semiconductor chip CHP. The data recovery unit DREU retains backup data of the data DT. Then, the data recovery unit DREU transmits the backup data to the system controller SYSC in response to a data recovery request from the semiconductor chip CHP, particularly from the system controller SYSC. Therefore, even if it is impossible to correct an error, the system controller SYSC can correctly recover the secondary data DT.

[0070] <Detailed Operation of Semiconductor Equipment>

[0071] Fig. 7A It is shown Figure 5 A flowchart showing an example of detailed processing contents when a chip is started up in a semiconductor device shown. Figure 7B It is schematically indicated Fig. 7A The diagram shows the processing content shown and illustrates an example of a signal transmission path inside a semiconductor device. Figure 7B Shows from Figure 5 Some configuration examples extracted from the semiconductor chip CHP are shown.

[0072] exist Fig. 7A and Figure 7B In the process from step S401 to step S403, Figure 3A and Figure 3B The processes from step S201 to step S203 are the same as shown. In short, the power-on controller POC releases the reset state of the semiconductor chip CHP (step S401). In response, the system controller SYSC starts the first memory MEM1b and the second memory MEM2, etc. (step S402).

[0073] Then, the reset data transfer controller RDTC performs N data transfers, that is, N reset transfers (step S403). Figure 7BAs shown, during the first data transfer, the reset data transfer controller RDTC transfers the data DT stored in the first memory MEM1b to the main register REGm via the ECC decoder ECC_DEC.

[0074] At this time, the ECC decoder ECC_DEC determines the presence of an error, and if an error exists, it determines whether error correction is possible based on the error correction code ECC added to the data DT. Then, if there is an error that can be corrected, the ECC decoder ECC_DEC transfers the error-corrected data DT to the main register REGm. On the other hand, if there is an uncorrectable error, the ECC decoder ECC_DEC outputs an ECC error signal EER to the system controller SYSC.

[0075] On the other hand, from the second to the Nth data transfer, the reset data transfer controller RDTC transfers the data DT (i.e., the same initial setting data as the first time) stored in the first memory MEM1b to the sub-register REG via the ECC decoder ECC_DEC. At this time, the processing content of the ECC decoder ECC_DEC is the same as that during the first data transfer. Similarly, the transferred data DT is sequentially rewritten in the sub-register REG, as Figure 3B the case.

[0076] Subsequently, the system controller SYSC checks whether the recovery count RR has reached the upper limit RRlmt through a recovery count check (step S404). That is, the system controller SYSC determines whether it has received a recovery error signal RER from the comparison circuit (second comparison circuit) CMP2. If the recovery count RR has reached the upper limit RRlmt (step S404: RR = RRlmt), the system controller SYSC initializes the reset transfer (step S405) in the same way as in Figure 3A step S205 and returns to step S403.

[0077] On the other hand, if the recovery count RR has not reached the upper limit RRlmt (step S404: RR < RRlmt), the system controller SYSC performs an FIA error check (step S406) based on the judgment result signal RS from the comparison circuit (first comparison circuit) CMP1 in the same way as in Figure 3A step S204. Here, if there is an FIA error (step S406: there is an error), the system controller SYSC returns to step S403 (step S405) after initializing the reset transfer in the same way as in Figure 3A the case.

[0078] On the other hand, if there is no FIA error (step S406: no error), the system controller SYSC performs an ECC error check (step S407). Specifically, in step S403, the system controller SYSC determines whether it receives an ECC error signal EER from the ECC decoder ECC_DEC during the N reset transfers. Here, if the ECC error signal EER is received (step S407: there is an error), the system controller SYSC performs a data recovery process during which the recovery count RR is also updated (step S408).

[0079] Specifically, if Figure 7B As shown, if the system controller SYSC receives the ECC error signal EER, it sends a data recovery request to the data recovery unit DREU to repair the data DT stored in the first memory MEM1b. In response, the system controller SYSC obtains recovery information, i.e., the correct data that has been backed up, from the data recovery unit DREU. The system controller SYSC updates the data DT and the error correction code ECC in the first memory MEM1b with the correct data, and also updates the recovery count RR.

[0080] On the other hand, Fig. 7A In the process of FIG. 104 , when the ECC error signal EER is not input (step S407: no error), the system controller SYSC activates the processor PRC (step S409). That is, the system controller SYSC activates the processor PRC only when the determination result signal RS from the comparison circuit CMP1 indicates a match, without inputting the ECC error signal EER. The process from step S404 to step S408 corresponds to the processor activation determination process (step S103). The process of step S409 corresponds to the processor activation process (step S104).

[0081] Using this type of method, even if the data DT in the first memory MEM1b is corrupted by a fault attack (FIA), the processor PRC can be activated under the condition that the corruption can be corrected by error correction and no FIA error is generated from the comparison circuit CMP1. On the other hand, if uncorrectable corruption occurs in the data DT in the first memory MEM1b due to a fault attack, or if the comparison circuit CMP1 generates an FIA error, the processor PRC will not be activated. This allows the semiconductor device to be appropriately protected from the fault attack.

[0082] For example, an attacker may perform multiple fault attacks on the first memory MEM1b under different conditions to find a desired damage method. In this case, if irreparable damage occurs in the data DT in the first memory MEM1b, the semiconductor device may be recovered from the fault state by performing data recovery and then restarting the semiconductor device. However, if recovery is allowed indefinitely, the attacker may perform fault attacks on the first memory MEM1b indefinitely under varying conditions, increasing the possibility of finding a desired damage method.

[0083] Therefore, here, the maximum number of recovery times RRlmt is set. When the number of recovery times RR reaches the maximum value RRlmt, activation of the processor PRC is prohibited thereafter. On the other hand, for example, if the maximum value RRlmt itself is rewritten to a large value, the maximum value RRlmt is effectively invalidated. Therefore, it is expected that the maximum value RRlmt is stored in the second memory MEM2 that cannot be rewritten.

[0084] In addition, Fig. 7A In the process of FIG. 4 , if the number of recovery times RR reaches the maximum value RRlmt, an infinite loop occurs in the processing of steps S404, S405 and S403. This ensures that the processor PRC is at least not activated, thereby protecting the semiconductor device. On the other hand, in Fig. 7A In the above, it is assumed that, for example, an error is detected by another error detection function not shown during the occurrence of such an infinite loop, and appropriate measures are taken. However, without using such another error detection function, the system controller SYSC can, for example, notify an external chip of a serious error, and terminate the processing if the number of recovery times RR reaches the maximum value RRlmt in step S404.

[0085] <Main Effects of the Second Embodiment>

[0086] As described above, by using the method of the second embodiment, the semiconductor device can be protected from fault attacks (FIA) in a manner similar to the first embodiment. In addition, protection can be achieved even when a rewritable non-volatile memory is applied to the memory of the source. That is, not only limited to the destination register, but also in the case of a fault attack on the memory of the source, appropriate protection can be achieved.

[0087] Although the invention made by the present inventors has been specifically described based on the embodiments, the present invention is not limited to the above-mentioned embodiments, and it goes without saying that various modifications can be made without departing from the gist thereof.

Claims

1. A semiconductor device comprising: A semiconductor chip having a plurality of circuits formed thereon; The plurality of circuits include: processor, A memory controller, the memory controller includes a memory unit, a register unit and a comparison circuit, a reset data transfer controller that performs data transfer from the memory unit to the register unit at the start-up of the semiconductor chip, and a system controller, controlling the processor, the memory controller and the reset data transfer controller, wherein the memory unit includes a first memory storing data necessary for the initial setting of the semiconductor chip, wherein the register unit includes a first register referenced during the initial setup of the semiconductor chip and a second register for verifying the first register, wherein the reset data transfer controller performs N data transfers, wherein N is an integer greater than or equal to 2, and the reset data transfer controller transfers the data stored in the first memory to the first register in the first data transfer, and transfers the data stored in the first memory to the second register in the Nth data transfer, wherein the comparison circuit determines a match / mismatch between the data transferred to the first register and the data transferred to the second register, and outputs a determination result signal indicating the determination result to the system controller, and Wherein if the determination result signal indicates a match, the system controller starts the processor, and if the determination result signal indicates a mismatch, causes the reset data transfer controller to perform the N-times data transfer again.

2. The semiconductor device according to claim 1, wherein after causing the reset data transfer controller to perform the N-times data transfer again, if the determination result signal indicates a matching semiconductor device, the system controller activates the processor.

3. The semiconductor device according to claim 2, The reset data transfer controller includes a random number generation circuit that generates a value of N as a random number each time the N data transfers are performed.

4. The semiconductor device according to claim 2, If the value of N is an integer greater than or equal to 3, the reset data transfer controller sequentially rewrites the data stored in the first memory to the second register from the second data transfer to the Nth data transfer.

5. The semiconductor device according to claim 1, The first memory is composed of a non-volatile memory that can only be written once.

6. A semiconductor device comprising: A semiconductor chip having a plurality of circuits formed thereon; The plurality of circuits include processor, A memory controller, the memory controller comprising a memory unit, a register unit and a first comparison circuit, a reset data transfer controller including an ECC decoder, and performing data transfer from the memory unit to the register unit via the ECC decoder at the start-up of the semiconductor chip, and a system controller, controlling the processor, the memory controller and the reset data transfer controller, wherein the memory unit includes a first memory storing data necessary for initial setting of the semiconductor chip, wherein the register unit includes a first register referenced during the initial setup of the semiconductor chip and a second register for verifying the first register, wherein the reset data transfer controller performs N data transfers, wherein N is an integer greater than or equal to 2, the reset data transfer controller transfers the data stored in the first memory to the first register via the ECC decoder in the first data transfer, and transfers the data stored in the first memory to the second register via the ECC decoder in the Nth data transfer, wherein the ECC decoder determines whether error correction is possible based on an error correction code added to the data, transmits the data after error correction if error correction is possible, and outputs an ECC error signal to the system controller if error correction is not possible, wherein the first comparison circuit determines a match / mismatch between the data transferred to the first register and the data transferred to the second register, and outputs a determination result signal indicating the determination result to the system controller, and Wherein, if the determination result signal indicates a mismatch, the system controller causes the reset data transfer controller to perform the N data transfers again, outputs a data recovery request for repairing the data stored in the first memory to the external output of the semiconductor chip upon receiving the ECC error signal, and if the determination result signal indicates a match, starts the processor without inputting the ECC error signal.

7. The semiconductor device according to claim 6, wherein the system controller stores the number of restore operations performed in response to the data restore request in the first memory, The memory unit further includes a second memory, wherein the second memory stores a preset upper limit of the number of restoration times. wherein the reset data transfer controller further comprises a second comparison circuit that determines whether the number of recovery times stored in the first memory has reached the upper limit stored in the second memory, and outputs a recovery error signal to the system controller if the number of recovery times has reached the upper limit. The system controller performs control so that at least the processor is not started when the recovery error signal is received.

8. The semiconductor device according to claim 6, wherein after causing the reset data transfer controller to perform the N-times data transfer again, if the determination result signal indicates a match, the system controller starts the processor without inputting the ECC error signal.

9. The semiconductor device according to claim 8, The reset data transfer controller further includes a random number generation circuit, which generates a value of N as a random number each time the N data transfers are performed.

10. The semiconductor device according to claim 8, If the value of N is an integer greater than or equal to 3, the reset data transfer controller sequentially rewrites the data stored in the first memory to the second register from the second data transfer to the Nth data transfer.

11. The semiconductor device according to claim 6, The first memory is composed of a rewritable non-volatile memory.

12. The semiconductor device according to claim 7, The first memory is composed of a non-volatile memory that can be rewritten, and the second memory is composed of a non-volatile memory that can be written only once.

Images