Semiconductor device, control method of semiconductor device, and control program of semiconductor device

Abstract

To provide a semiconductor device which realizes a high speed processing, and provide a control method of the semiconductor device.SOLUTION: According to an embodiment, a semiconductor device 100 comprises: a storage part 110 that houses at least any one of a plain sentence and a cipher sentence; a cipher processing part 140 that performs an arithmetic processing containing a cipher processing and a decoding processing; and a hash processing part 150 that performs a hash arithmetic processing. Data stored in the storage part 110 is transferred to the cipher processing part 140 in each pre-arithmetic processed data of a first arithmetic unit. The cipher processing part 140 generates post-arithmetic processed data by adopting the arithmetic processing, the post-arithmetic processed data of the first arithmetic unit to be generated is transferred to the hash processing part 150. The hash processing part 150 makes the post-arithmetic processed data of a second arithmetic unit to be adopted to the hash arithmetic processing. The post-arithmetic processed data of the first arithmetic unit or the post-arithmetic processed data of the second arithmetic unit is transferred to the storage part 110. The arithmetic processing or the hash arithmetic processing are performed in parallel.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present disclosure relates to a semiconductor device, a control method for a semiconductor device, and a control program for a semiconductor device. [Background technology]

[0002] An overview of the mechanism of Secure Boot is described in Figure 1 of Non-Patent Document 1. As shown in Figure 1, the Secure Boot sequence includes the following steps.

[0003] Step 1. Reset your device.

[0004] Step 2. The device will execute Mask ROM, and if the device security is enabled, secure boot will be executed.

[0005] Step 3. Mask ROM loads certificates and content from external flash.

[0006] Step 4. Mask ROM parses the root key certificate and extracts the root key. The root key hash is calculated and the known root key hash (H BK ) If the key is correct, proceed to the next step.

[0007] Step 5. Mask ROM compares the hash of the boot key in the Secure Boot Content Certificate with the Secure Boot key hash in the Root Key Certificate (verified in the previous step). If the check is successful, it uses the public key to verify the signature of the Secure Boot Content Certificate. If the Secure Boot Content Certificate is valid, it uses the data in the content certificate to calculate the validity and integrity of the next boot stage. If all validations are correct, it jumps to the next boot stage. [Prior art documents] [Non-patent literature]

[0008] [Non-Patent Document 1] : "Introduction to Secure Boot in the Automotive MCU RH850 and Automotive SOC R-Car that Realize Root of Trust #3", [online], December 21, 2021, [Retrieved May 1, 2023], Internet <https: / / www.renesas.com / jp / ja / blogs / achieving-root-trust-secure-boot-automotive-rh850-and-r-car-devices-part-3> Summary of the Invention [Problem to be solved by the invention]

[0009] In Figure 1, "Optionally decrypt data with K CE " indicates the decryption process of the encryption processing unit. Also, "Check root key with H" in step 4 in Figure 1 BK In the verification process such as "Decryption" in step 1 and "Content Verification" in step 5, the first process of the verification is a hash calculation by a hash processing unit. In this way, when a hash calculation is performed after a decryption process, the processing time may become longer. There is a demand for speeding up processes such as secure boot.

[0010] Other objects and novel features will become apparent from the description of this specification and the accompanying drawings. [Means for solving the problem]

[0011] According to one embodiment, a semiconductor device includes a memory unit that stores at least one of plaintext and ciphertext, a cryptographic processing unit that performs arithmetic processing including encryption processing of the plaintext and decryption processing of the ciphertext, and a hash processing unit having a buffer, the hash processing unit performing a hash calculation process to calculate a hash value, wherein pre-processing data including at least one of the plaintext and the ciphertext stored in the memory unit is transferred to the cryptographic processing unit for each first operation unit of the cryptographic processing unit, the cryptographic processing unit applies the arithmetic processing to the transferred pre-processing data for the first operation unit to generate post-processing data including at least one of the ciphertext and the plaintext for the first operation unit, and The post-operation processing data for a first operation unit is transferred to the hash processing unit, the hash processing unit stores the transferred post-operation processing data for the first operation unit in the buffer and applies the hash operation process to the post-operation processing data for a second operation unit of the hash processing unit, the post-operation processing data for the first operation unit or the post-operation processing data for the second operation unit is transferred to the memory unit, the operation process and the hash operation process are performed in parallel, the operation process, the hash operation process, and the transfer of the post-operation processing data to the memory unit are repeated multiple times, and the hash value corresponding to the post-operation processing data obtained by operating the pre-operation processing data is output to the memory unit.

[0012] According to one embodiment, a method for controlling a semiconductor device includes a storage unit that stores at least one of plaintext and ciphertext, a cryptographic processing unit that performs arithmetic processing including encryption processing of the plaintext and decryption processing of the ciphertext, and a hash processing unit having a buffer, the hash processing unit performing a hash calculation process to calculate a hash value, the method including a first step of causing the cryptographic processing unit to transfer pre-operation-processing data including at least one of the plaintext and the ciphertext stored in the storage unit for each first operation unit of the cryptographic processing unit, a second step of causing the cryptographic processing unit to apply the arithmetic processing to the transferred pre-operation-processing data for the first operation unit, and generating the first operation unit of post-operation-processing data including at least one of the ciphertext and the plaintext, and a third step of causing the hash processing unit to transfer the processed data for the first operation unit generated by the hash processing unit, a fourth step of causing the buffer of the hash processing unit to store the transferred processed data for the first operation unit, a fifth step of causing the hash processing unit to apply the hash calculation process to the processed data for the second operation unit of the hash processing unit, and a sixth step of causing the hash processing unit to transfer the processed data for the first operation unit or the processed data for the second operation unit to the storage unit, and further comprising a step of performing the second step and the fifth step in parallel, repeating the first step to the fifth step a plurality of times, and outputting the hash value corresponding to the processed data obtained by processing the pre-operation data to the storage unit.

[0013] According to one embodiment, a control program for a semiconductor device includes a storage unit that stores at least one of plaintext and ciphertext, a cryptographic processing unit that performs arithmetic processing including encryption processing of the plaintext and decryption processing of the ciphertext, and a hash processing unit having a buffer, the hash processing unit performing a hash calculation process to calculate a hash value, the control program including a first step of causing the cryptographic processing unit to transfer pre-operation-processing data including at least one of the plaintext and the ciphertext stored in the storage unit for each first operation unit of the cryptographic processing unit, a second step of causing the cryptographic processing unit to apply the arithmetic processing to the transferred pre-operation-processing data for the first operation unit, and generating the first operation unit of post-operation-processing data including at least one of the ciphertext and the plaintext, and The method further comprises causing a computer to execute a third step of transferring post-operation-processing data for a first operation unit to the hash processing unit, a fourth step of storing the transferred post-operation-processing data for the first operation unit in the buffer of the hash processing unit, a fifth step of causing the hash processing unit to apply the hash operation process to the post-operation-processing data for a second operation unit of the hash processing unit, and a sixth step of transferring the post-operation-processing data for the first operation unit or the post-operation-processing data for the second operation unit to the storage unit, and further causing the computer to execute the second step and the fifth step in parallel, repeating the first step to the fifth step a plurality of times, and outputting to the storage unit the hash value corresponding to the post-operation-processing data obtained by operating the pre-operation-processing data. Effect of the Invention

[0014] According to the embodiment, it is possible to provide a semiconductor device, a control method for a semiconductor device, and a control program for a semiconductor device that can realize high-speed processing. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a diagram illustrating an example of an outline of a secure boot mechanism. [Diagram 2] FIG. 1 is a block diagram illustrating a semiconductor device according to a comparative example. [Diagram 3] 11 is a sequence diagram illustrating the operation of a semiconductor device according to a comparative example. [Figure 4] 1 is a block diagram illustrating a semiconductor device according to a first embodiment. [Diagram 5] 4 is a sequence diagram illustrating the operation of the semiconductor device according to the first embodiment. FIG. [Figure 6] 1 is a block diagram illustrating a semiconductor device according to a first modified example of the first embodiment. FIG. [Figure 7] 3 is a sequence diagram illustrating the main parts of the operation of the semiconductor device of the first embodiment. FIG. [Figure 8] 11 is a sequence diagram illustrating a main part of the operation of the semiconductor device according to Modification 2 of Embodiment 1. FIG. [Figure 9] FIG. 11 is a block diagram illustrating a semiconductor device according to a second embodiment. [Figure 10] FIG. 11 is a block diagram illustrating a semiconductor device according to a first modified example of the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] For clarity of explanation, the following description and drawings have been omitted or simplified as appropriate. In addition, in each drawing, the same elements are given the same reference numerals, and duplicate explanations are omitted as necessary.

[0017] First, in <Comparative Example>, a semiconductor device according to the comparative example is described. Then, in <Problems newly found by the inventor>, problems newly found by the inventor for the semiconductor device of the comparative example are described. Then, in <Embodiment 1> and <Embodiment 2>, a semiconductor device and a control method thereof according to each embodiment are described. In each embodiment, a <Modification> is also described. Note that the semiconductor device according to the comparative example is also included in the scope of the technical ideas of the embodiments.

[0018] <Comparative Example> A semiconductor device according to a comparative example will be described. FIG. 2 is a block diagram illustrating a semiconductor device 1 according to a comparative example. As shown in FIG. 2, the semiconductor device 1 includes a memory unit (Memory) 10, a transfer unit (Direct Memory Access Controller, DMAC) 20, a control unit (Central Processing Unit, CPU) 30, an encryption processing unit (Advanced Encryption Standard, AES) 40, a hash processing unit (Secure Hash Algorithm, SHA) 50, and a bus (Bus) 60. The names in parentheses of each unit are examples and are not meant to be limited thereto. The same applies to the names in parentheses of each unit below. The bus 60 connects the memory unit 10, the transfer unit 20, the control unit 30, the encryption processing unit 40, and the hash processing unit 50 so that they can communicate with each other.

[0019] The storage unit 10 stores data including at least one of plaintext and ciphertext. The storage unit 10 may store ciphertext obtained by encrypting plaintext and plaintext obtained by decrypting ciphertext, or may store a hash value of the plaintext and a hash value of the ciphertext. The storage unit 10 is connected to a bus 60 in a communicable state. The storage unit 10 is capable of communicating with the transfer unit 20, the control unit 30, the encryption processing unit 40, and the hash processing unit 50 via the bus 60.

[0020] The transfer unit 20 transfers data. The transfer unit 20 is connected to the bus 60 in a communicable state. The transfer unit 20 can communicate with the storage unit 10, the control unit 30, the cryptographic processing unit 40, and the hash processing unit 50 via the bus 60. The transfer unit 20 transfers data including at least one of plaintext and ciphertext stored in the storage unit 10 to the cryptographic processing unit 40. When transferring data stored in the storage unit 10 to the cryptographic processing unit 40, the transfer unit 20 may transfer data for each calculation unit of the cryptographic processing unit 40 to the cryptographic processing unit 40. The calculation unit of the cryptographic processing unit 40 is called a first calculation unit. The first calculation unit is, for example, 16 bytes. The first calculation unit is not limited to 16 bytes and may be changed depending on the performance of each part of the semiconductor device 1.

[0021] Hereinafter, data before being subjected to arithmetic processing in the cryptographic processing unit 40 is referred to as pre-processing data. Thus, the pre-processing data includes at least one of plaintext and ciphertext stored in the memory unit 10. Data after being subjected to arithmetic processing in the cryptographic processing unit 40 is referred to as post-processing data. Thus, the post-processing data includes at least one of ciphertext obtained by encrypting plaintext in the cryptographic processing unit 40, and plaintext obtained by decrypting ciphertext in the cryptographic processing unit 40. The memory unit 10 stores the pre-processing data and the post-processing data.

[0022] The transfer unit 20 transfers pre-processing data and post-processing data. The transfer unit 20 transfers the pre-processing data stored in the memory unit 10 to the cryptographic processing unit 40 for each first calculation unit via the bus 60. As a result, the pre-processing data including at least one of plaintext and ciphertext stored in the memory unit 10 is transferred to the cryptographic processing unit 40 for each first calculation unit.

[0023] The control unit 30 controls the storage unit 10, the transfer unit 20, the encryption processing unit 40, and the hash processing unit 50. The control unit 30 is connected to the bus 60 in a communicable state. The control unit 30 is capable of communicating with the storage unit 10, the transfer unit 20, the encryption processing unit 40, and the hash processing unit 50 via the bus 60. The control unit 30 includes a processor such as a CPU. The processor of the control unit 30 can control the semiconductor device 1 by executing a control program that programs a control method for the semiconductor device 1.

[0024] The cryptographic processing unit 40 performs arithmetic processing including encryption processing of plaintext and decryption processing of ciphertext. The cryptographic processing unit 40 is connected to the bus 60 in a communicable state. The cryptographic processing unit 40 can communicate with the storage unit 10, the transfer unit 20, the control unit 30, and the hash processing unit 50 via the bus 60. The cryptographic processing unit 40 applies arithmetic processing to pre-processing data for a first calculation unit transferred from the storage unit 10. As a result, the cryptographic processing unit 40 generates post-processing data for the first calculation unit including at least one of ciphertext and plaintext that have been subjected to arithmetic processing. The cryptographic processing unit 40 includes a bus port (Bus I / F, bus interface) 41, an AES core 43, a buffer (Buffer) 44, and a register (REG) 45.

[0025] The bus port 41 inputs pre-operation data and outputs post-operation data to and from the bus 60. The cryptographic processing unit 40 receives pre-operation data of the first operation unit at the bus port 41. The cryptographic processing unit 40 outputs post-operation data of the first operation unit from the bus port 41 to the bus 60.

[0026] The AES core 43 actually performs arithmetic processing, including encryption and decryption, on the pre-operation data received at the bus port 41. The AES core 43 outputs the processed post-operation data to the buffer 44. The processed post-operation data is output from the buffer 44 to the bus 60 via the bus port 41.

[0027] The transfer unit 20 transfers the post-operation processing data for the first operation unit generated in the cryptographic processing unit 40 to the storage unit 10 via the bus 60. Therefore, the post-operation processing data for the first operation unit generated in the cryptographic processing unit 40 is transferred to the storage unit 10 via the bus 60. The transfer of pre-operation processing data to the cryptographic processing unit 40, the operation processing in the cryptographic processing unit 40, and the transfer of the post-operation processing data to the storage unit 10 are sequentially and repeatedly performed for each pre-operation processing data for the first operation unit for the entire pre-operation processing data stored in the storage unit 10.

[0028] The hash processing unit 50 performs a hash calculation process to calculate a hash value. The hash processing unit 50 is connected to the bus 60 in a communicable state. The hash processing unit 50 is capable of communicating with the storage unit 10, the transfer unit 20, the control unit 30, and the cryptographic processing unit 40 via the bus 60. The hash processing unit 50 has a bus port 51, a SHA core 53, a buffer 54, a register 55, and an internal buffer 58. The bus port 51 inputs post-processing data and outputs hash values ​​between the bus 60 and the hash processing unit 50. The post-processing data received via the bus port 51 is stored in the buffer 54.

[0029] The buffer 54 sequentially stores the post-calculation processing data for the first calculation unit generated by the cryptographic processing unit 40. The buffer 54 stores the post-calculation processing data until it becomes the calculation unit of the hash processing unit 50. The calculation unit of the hash processing unit 50 is called the second calculation unit. The second calculation unit is, for example, 64 bytes. Note that the second calculation unit is not limited to 64 bytes and may be changed depending on the performance of each part of the semiconductor device 1. The buffer 54 outputs the post-calculation processing data for the second calculation unit to the SHA core 53.

[0030] The SHA core 53 actually performs hash calculation on the post-calculation data of the second calculation unit received from the buffer 54. The SHA core 53 stores the hash value of the post-calculation data in the internal buffer 58. The SHA core 53 updates the hash value stored in the internal buffer 58 for each post-calculation data of the second calculation unit. The SHA core 53 updates the hash value for each post-calculation data of the second calculation unit until calculation of the hash value for the post-calculation data corresponding to the entire pre-calculation data stored in the storage unit 10 is completed. The SHA core 53 outputs the calculated hash value to the bus 60 via the bus port 51.

[0031] In this way, the hash processing unit 50 sequentially stores the transferred post-operation data of the first operation unit in the buffer 54. Then, the hash processing unit 50 applies hash calculation processing to the post-operation data of the second operation unit. A hash value corresponding to the entire post-operation data is output to the bus 60. The transfer unit 20 transfers the hash value calculated in the hash processing unit 50 to the storage unit 10 via the bus 60. Therefore, a hash value corresponding to the post-operation data obtained by processing the entire pre-operation data is output to the storage unit 10. The hash calculation processing of the post-operation data in the hash processing unit 50 and the update of the hash value in the internal buffer 58 are repeatedly performed on the entire post-operation data for each post-operation data of the second operation unit.

[0032] Next, the operation of the semiconductor device 1 according to the comparative example will be described. Fig. 3 is a sequence diagram illustrating the operation of the semiconductor device 1 according to the comparative example. As shown in Fig. 3, the control unit 30 performs initial setting (step S11). Then, the control unit 30 starts the transfer of various data to the transfer unit 20, the arithmetic processing in the encryption processing unit 40, and the hash processing in the hash processing unit 50 (step S12), as described below.

[0033] First, the control unit 30 causes the cryptographic processing unit 40 to perform a loop of calculation processing. Specifically, the control unit 30 causes the transfer unit 20 to read pre-calculation processing data for the first calculation unit from the storage unit 10 (step S13). Next, the control unit 30 causes the transfer unit 20 to write the pre-calculation processing data for the first calculation unit that has been read to the cryptographic processing unit 40 (step S14). In this manner, the pre-calculation processing data including at least one of plaintext and ciphertext stored in the storage unit 10 is sequentially transferred to the cryptographic processing unit 40 for each first calculation unit.

[0034] Next, the control unit 30 causes the cryptographic processing unit 40 to apply arithmetic processing to the pre-arithmetic processing data of the first calculation unit (step S15), whereby the cryptographic processing unit 40 generates post-arithmetic processing data of the first calculation unit.

[0035] Next, the control unit 30 causes the transfer unit 20 to read the post-operation-processing data for the first calculation unit from the encryption processing unit 40 (step S16). Next, the control unit 30 causes the transfer unit 20 to write the read post-operation-processing data for the first calculation unit to the storage unit 10 (step S17). In this manner, the control unit 30 causes the post-operation-processing data for the first calculation unit to be transferred to the storage unit 10. The control unit 30 repeats the calculation process of the encryption processing unit 40 in steps S13 to S17 for each pre-operation-processing data for the first calculation unit, and performs the process on the entire pre-operation-processing data stored in the storage unit 10.

[0036] Next, the control unit 30 causes the hash calculation process loop of the hash calculation process of the hash calculation process unit 50. Specifically, the control unit 30 causes the transfer unit 20 to read the post-calculation-processed data for the first calculation unit from the storage unit 10 (step S18). Next, the control unit 30 causes the transfer unit 20 to write the read post-calculation-processed data for the first calculation unit to the hash calculation process unit 50 (step S19).

[0037] Next, the control unit 30 causes the hash processing unit 50 to apply a hash calculation process to the post-calculation data of the second calculation unit (the first calculation unit stored until it becomes the second calculation unit) (step S20). As a result, the hash processing unit 50 updates the hash value stored in the internal buffer 58 for each post-calculation data of the second calculation unit. The control unit 30 repeats the hash calculation process of steps S18 to S20 for each post-calculation data of the second calculation unit, and performs it on the entire post-calculation data.

[0038] Next, the control unit 30 causes the transfer unit 20 to read the hash value calculated by the hash calculation unit 50 from the hash calculation unit 50 (step S21). Next, the control unit 30 causes the transfer unit 20 to write the hash value read from the hash calculation unit 50 to the storage unit 10 (step S22).

[0039] In this way, the semiconductor device 1 of Comparative Example 1 performs arithmetic processing on the pre-processing data stored in the storage unit 10 using the transfer unit 20 and the encryption processing unit 40. Then, the semiconductor device 1 outputs the processed post-processing data to the storage unit 10. Also, the semiconductor device 1 performs hash calculation processing on the post-processing data stored in the storage unit 10 using the transfer unit 20 and the hash processing unit 50. Then, the semiconductor device 1 outputs the calculated hash value to the storage unit 10.

[0040] <New problem discovered by the inventor> The semiconductor device 1 of the comparative example performs a loop of hash calculation processing in the hash processing unit 50 after a loop of calculation processing in the encryption processing unit 40. In this way, when the hash calculation processing is performed after the encryption processing and the decryption processing, the processing time may become longer.

[0041] Such a semiconductor device 1 of the comparative example has difficulty in meeting the required time for secure boot of a program size assumed in a predetermined hardware (HW) configuration. As an example, the semiconductor device 1 of the comparative example requires a predetermined time for secure boot according to the assumed program size. On the other hand, when the time from power-up to the start of communication acceptance is specified as a product, the required time allocated for secure boot may be shorter than the above-mentioned predetermined time when the start-up time of other systems is taken into consideration. Therefore, it is difficult for the semiconductor device 1 of the comparative example to meet the required time for secure boot.

[0042] With each generation of semiconductor device, the target program size becomes larger. Meanwhile, the requirement for startup time remains the same. For this reason, it is becoming relatively difficult to meet the required time. Therefore, it is difficult for the semiconductor device 1 of the comparative example to realize high-speed processing.

[0043] <Embodiment 1> Next, the semiconductor device of this embodiment will be described. In the semiconductor device of this embodiment, the encryption processing unit transfers data after sequential arithmetic processing to the storage unit and the hash processing unit. The hash processing unit performs hash calculations in parallel with arithmetic processing including encryption and decryption. This realizes high-speed processing. Since the encryption processing unit and the hash processing unit have different arithmetic units, the semiconductor device of this embodiment is provided with a buffer and a mechanism for synchronizing timing.

[0044] 4 is a block diagram illustrating the semiconductor device 100 according to the first embodiment. As shown in FIG. 4, the semiconductor device 100 includes a storage unit 110, a transfer unit 120, a control unit 130, an encryption processing unit 140, a hash processing unit 150, a bus 160, and a connection path (Direct path) 170. The connection path 170 connects the encryption processing unit 140 and the hash processing unit 150 so that they can communicate with each other. The connection path 170 is a path different from the bus 160.

[0045] The storage unit 110, the transfer unit 120, the control unit 130, and the bus 160 have the same functions as the storage unit 10, the transfer unit 20, the control unit 30, and the bus 60 described above, respectively.

[0046] First, an overview of the cryptographic processing unit 140 will be described. The cryptographic processing unit 140 performs arithmetic processing including encryption processing of plaintext and decryption processing of ciphertext, similar to the cryptographic processing unit 40 described above. In this embodiment, the transfer unit 120 transfers the post-arithmetic processing data of the first calculation unit generated in the cryptographic processing unit 140 to the storage unit 110 and also transfers it to the hash processing unit 150. In other words, the post-arithmetic processing data of the first calculation unit generated in the cryptographic processing unit 140 is transferred to the storage unit 110 and the hash processing unit 150.

[0047] The post-calculation-processing data for the first calculation unit generated in the cryptographic processing unit 140 is output to the bus 160 and the connection path 170. The storage unit 110 receives the post-calculation-processing data for the first calculation unit from the cryptographic processing unit 140 via the bus 160. The hash processing unit 150 receives the post-calculation-processing data for the first calculation unit via the connection path 170. The hash processing unit 150 performs a hash calculation process on the post-calculation-processing data received via the connection path 170.

[0048] Next, the cryptographic processing unit 140 will be described in detail. The cryptographic processing unit 140 includes a bus port 141, an AES core 143, a buffer 144, a register 145, a control circuit 146, and a controller 147. The bus port 141 inputs pre-operation data and outputs post-operation data to and from the bus 60. The cryptographic processing unit 140 receives pre-operation data of a first operation unit at the bus port 141. The cryptographic processing unit 140 outputs post-operation data of the first operation unit from the bus port 141 to the bus 60.

[0049] The AES core 143 actually performs arithmetic processing on the pre-operation data received via the bus port 141. The AES core 143 outputs the processed post-operation data to the buffer 144. The processed data is output from the buffer 144 to the bus port 141 and the control circuit 146. The control circuit 146 outputs the processed data to the connection path 170 depending on the value of the register 145. For example, when the value of the register 145 is a predetermined value, the control circuit 146 outputs the processed data to the connection path 170. On the other hand, when the value of the register 145 is another value, the control circuit 146 does not output the processed data to the connection path 170.

[0050] In this way, the cryptographic processing unit 140 has a switching means for switching, by a predetermined setting, between a mode in which the post-processing data is output only to the bus 160 and a mode in which the post-processing data is output to the bus 160 and the connection path 170. The switching means includes, for example, a control circuit 146. When the controller 147 receives a wait signal from the monitor 157 of the hash processing unit 150, it stops the output of the post-processing data to at least one of the bus 160 and the connection path 170.

[0051] Next, a description will be given of the hash processor 150. The hash processor 150 performs a hash calculation process to calculate a hash value. The hash processor 150 includes a bus port 151, a SHA core 153, a buffer 154, a register 155, a selection circuit 156, a monitor 157, and an internal buffer 158.

[0052] The bus port 151 inputs and outputs the post-processing data and outputs the hash value to and from the bus 160. The hash processing unit 150 receives the post-processing data of the first calculation unit at the bus port 151. The post-processing data received at the bus port 151 is output to the selection circuit 156.

[0053] The selection circuit 156 has a plurality of input terminals and one output terminal. One input terminal of the selection circuit 156 is connected to the bus port 151. The other input terminal of the selection circuit 156 is connected to the connection path 170. The selection circuit 156 receives the post-operation processing data of the first operation unit from the bus port 151 and the connection path 170. Depending on the value of the register 155, the selection circuit 156 outputs to the buffer 154 either the post-operation processing data input from the bus port 151 or the post-operation processing data input from the connection path 170.

[0054] In this way, the hash processing unit 150 has a switching means for switching between a mode in which the hash calculation process is performed on the processed data received via the bus 160 and a mode in which the hash calculation process is performed on the processed data received via the connection path 170, according to a predetermined setting. The switching means includes, for example, a selection circuit 156. The monitor 157 monitors the storage status of the buffer 154. When additional processed data cannot be stored in the buffer 154, the monitor 157 outputs a wait signal to the cryptographic processing unit 140.

[0055] The buffer 154 sequentially stores the post-calculation-processing data for the first calculation unit output from the selection circuit 156. Therefore, the hash processing unit 150 stores the post-calculation-processing data for the first calculation unit transferred from the cryptographic processing unit 140 in the buffer 154. The buffer 154 stores the post-calculation-processing data until it becomes the second calculation unit. The buffer 154 outputs the post-calculation-processing data for the second calculation unit to the SHA core 153.

[0056] The SHA core 153 actually performs hash calculation on the post-calculation data of the second calculation unit received from the buffer 154. The SHA core 153 stores the hash value of the post-calculation data in the internal buffer 158. The SHA core 153 updates the hash value stored in the internal buffer 158 for each post-calculation data of the second calculation unit. The SHA core 153 updates the hash value for each post-calculation data of the second calculation unit until the calculation of the hash value for the entire post-calculation data corresponding to the entire pre-calculation data stored in the storage unit 10 is completed. The SHA core 153 outputs the calculated hash value to the bus 160 via the bus port 151.

[0057] In this way, the hash processing unit 150 applies the hash calculation process to the post-calculation data of the second calculation unit. A hash value corresponding to the entire post-calculation data is output to the bus 160. The transfer unit 120 transfers the hash value calculated in the hash processing unit 150 to the storage unit 110 via the bus 160. Therefore, a hash value corresponding to the entire post-calculation data obtained by performing the calculation on the entire pre-calculation data is output to the storage unit 110.

[0058] In the semiconductor device 100 of this embodiment, the arithmetic processing of the cryptographic processor 140 and the hash calculation processing of the hash processor 150 are performed in parallel. The capacity of the buffer 154 of the hash processor 150 is larger than the capacity of the buffer 144 of the cryptographic processor 140. For example, the capacity of the buffer 154 of the hash processor 150 is 64 bytes, and the capacity of the buffer 144 of the cryptographic processor 140 is 16 bytes. Therefore, the capacity of the buffer 154 of the hash processor 150 is four times the capacity of the buffer 144 of the cryptographic processor 140. In this way, by making the capacity of the buffer 154 of the hash processor 150 larger than the capacity of the buffer 144 of the cryptographic processor 140, the arithmetic processing of the cryptographic processor 140 and the hash calculation processing of the hash processor 150 can be performed in parallel by matching the timing of the arithmetic processing of the cryptographic processor 140 and the hash calculation processing of the hash processor 150.

[0059] Furthermore, the calculation process of the cryptographic processing unit 140, the hash calculation process of the hash processing unit 150, and the transfer of the post-processing data to the storage unit 110 are repeated multiple times. Specifically, the calculation process is performed on the entire pre-processing data stored in the storage unit 110, and is repeated multiple times until a hash value of the entire post-processing data that has been processed is calculated.

[0060] The storage unit 110 repeatedly transfers the post-operation data of the first operation unit for each post-operation data of the first operation unit. Thus, as a result of repeatedly performing the hash operation on the entire pre-operation data, the storage unit 110 can acquire the entire post-operation data corresponding to the entire pre-operation data. Furthermore, the hash processing unit 150 repeatedly performs hash operation processing on each post-operation data of the second operation unit to update the operation result. Thus, as a result of repeatedly performing hash operation processing on the entire post-operation data, the hash processing unit 150 calculates a hash value of the entire post-operation data. The hash processing unit 150 outputs a hash value corresponding to the entire post-operation data to the storage unit 110. As a result, the storage unit 110 stores the entire post-operation data and its hash value.

[0061] Next, an operation of the semiconductor device 100 according to the embodiment 1 will be described. Fig. 5 is a sequence diagram illustrating the operation of the semiconductor device 100 according to the embodiment 1. As shown in Fig. 5, in the semiconductor device 100 of this embodiment, the arithmetic process of the encryption processing unit 140 and the hash arithmetic process of the hash processing unit 150 are performed in parallel.

[0062] Steps S111 to S117 are similar to the above-mentioned steps S11 to S17, respectively.

[0063] The control unit 130 causes the transfer unit 120 to write the post-calculation-processing data for the first calculation unit generated by the cryptographic processing unit 140 to the hash processing unit 150 (step S118). Therefore, in steps S116 and S118, the same post-calculation-processing data for the first calculation unit is transferred. Note that the control unit 130 may cause the cryptographic processing unit 140 to transfer the post-calculation-processing data for the first calculation unit to the hash processing unit 150. The hash processing unit 150 causes the buffer 154 to store the transferred post-calculation-processing data for the first calculation unit.

[0064] In step S118, the post-processing data for the first calculation unit may be output to the connection path 170. On the other hand, in steps S116 and S117, the post-processing data for the first calculation unit may be output to the bus 160.

[0065] Next, the control unit 130 causes the hash processing unit 150 to apply the hash calculation process to the post-calculation-processed data of the second calculation unit (step S119). Note that the control unit 130 may cause the hash processing unit 150 to perform the hash calculation process on the post-calculation-processed data received via the connection path 170. The hash processing unit 150 updates the hash value stored in the internal buffer 158 for each post-calculation-processed data of the second calculation unit.

[0066] The control unit 130 repeats steps S113 to S119 multiple times. The transfer unit 120 reads the hash value calculated by the hash processing unit 150 for the entire post-processing data from the hash processing unit 150 (step S120), and writes it to the storage unit 110 (step S121). In this manner, a hash value corresponding to the entire post-processing data obtained by processing the entire pre-processing data is output to the storage unit 110.

[0067] Next, the effects of this embodiment will be described. The semiconductor device 1 of this embodiment also outputs the post-calculation processing data generated by the cryptographic processing unit 140 to the hash processing unit 150. This allows the calculation process of the cryptographic processing unit 140 and the hash calculation process of the hash processing unit 150 to be performed in parallel. This makes it possible to realize high-speed processing of the semiconductor device 100.

[0068] For example, as in the semiconductor device 1 of the comparative example, when the calculation process of the encryption processing unit 140 and the hash calculation process of the hash processing unit 150 are performed separately, the time required for AES decryption and the time required for SHA calculation are calculated separately. However, by performing them in parallel as in the present embodiment, for example, a process that requires a short time is performed while a process that requires a long time is being executed, and the effect of shortening the processing time can be expected.

[0069] Furthermore, the semiconductor device 100 has a connection path 170 that connects the encryption processing unit 140 and the hash processing unit 150, so that the transfer of the post-processing data can be accelerated. The semiconductor device 100 also has a control circuit 146 that switches the output destination of the post-processing data to only the bus 160, or to the bus 160 and the connection path 170. Therefore, the output destination of the post-processing data can be changed depending on the situation so that high-speed processing can be performed.

[0070] Furthermore, the hash calculation unit 150 has a selection circuit 156 that switches between performing hash calculation on the processed data received via the bus 160 and performing hash calculation on the processed data received via the connection path 170. Therefore, the destination of the processed data can be changed depending on the situation so that high-speed processing can be performed.

[0071] Moreover, the hash processing unit 150 has a monitor 157 that monitors the storage status of the buffer 154. Therefore, since the output of the post-processing data to the cryptographic processing unit 140 can be stopped depending on the storage status of the buffer 154, it is possible to prevent the buffer 154 from overflowing.

[0072] <Variation 1> Next, a first modification of the first embodiment will be described. The semiconductor device of this modification includes a plurality of buses. FIG. 6 is a block diagram illustrating a semiconductor device 101 according to the first modification of the first embodiment. As shown in FIG. 6, the semiconductor device 101 of this modification includes a bus 161 and a bus 162. That is, instead of the bus 160 of the first embodiment, the semiconductor device 101 includes the bus 161 and the bus 162. The bus 161 is different from the bus 162.

[0073] The bus 161 is a path along which pre-processing data is transferred from the storage unit 110 to the crypto-processing unit 140. The bus 162 is a path along which post-processing data is transferred from the crypto-processing unit 140 to the storage unit 110.

[0074] According to this modification, the bus 161 through which pre-processing data is transferred from the storage unit 110 to the crypto-processing unit 140 can be different from the bus 162 through which post-processing data is transferred from the crypto-processing unit 140 to the storage unit 110. Thus, the pre-processing data and the post-processing data can be transferred via dedicated buses, respectively, thereby speeding up the processing. Also, mutual influence between the pre-processing data and the post-processing data can be suppressed.

[0075] <Variation 2> Next, a second modification of the first embodiment will be described. In this modification, instead of receiving the first computation unit's worth of computation-processed data from the encryption processing unit 140, the storage unit 110 receives the second computation unit's worth of computation-processed data from the hash processing unit 150. Fig. 7 is a sequence diagram illustrating an example of a main part in the operation of the semiconductor device 100 of the first embodiment. Fig. 8 is a sequence diagram illustrating an example of a main part in the operation of the semiconductor device 102 according to the second modification of the first embodiment. Fig. 7 is a diagram for comparison with this modification.

[0076] 7, in the semiconductor device 100 described above, the control unit 130 causes the transfer unit 120 to transfer the post-processing data for the first calculation unit from the encryption processing unit 140 to the storage unit 110 (steps S116 and S117). Thus, the post-processing data for the first calculation unit is transferred to the storage unit 110.

[0077] 8, in the semiconductor device 102 of this modification, the control unit 130 causes the transfer unit 120 to transfer the post-calculation-processing data for the second calculation unit from the hash processing unit 150 to the storage unit 110 (step S119a). Thus, the post-calculation-processing data for the second calculation unit is transferred to the storage unit 110.

[0078] According to this modification, since the post-processing data for the second calculation unit is transferred from the hash processing unit 150, it is possible to reduce the frequency with which the post-processing data is transferred to the storage unit 110. As a result, it is possible to improve the efficiency of processing.

[0079] <Embodiment 2> Next, a semiconductor device according to a second embodiment will be described. The semiconductor device according to this embodiment uses a plurality of bus ports instead of the connection path 170 of the first embodiment. Fig. 9 is a block diagram illustrating a semiconductor device 200 according to the second embodiment. As shown in Fig. 9, the semiconductor device 200 includes a storage unit 210, a transfer unit 220, a control unit 230, an encryption processing unit 240, a hash processing unit 250, and a bus 260.

[0080] The storage unit 210, the transfer unit 220, the control unit 230, and the bus 260 have the same functions as the storage unit 110, the transfer unit 120, the control unit 130, and the bus 160 described above, respectively.

[0081] The cryptographic processing unit 240 includes a bus port 241, a bus port 242, an AES core 243, a buffer 244, a register 245, and a control circuit 246. The cryptographic processing unit 240 is different from the cryptographic processing unit 140 described above in that it includes a plurality of bus ports 241 and 242, and the output destination of the control circuit 246 is different. Specifically, the output destination of the control circuit 246 is the bus port 242. Therefore, the control circuit 246 outputs the post-operation data of the first operation unit generated by the cryptographic processing unit 240 to the bus port 242 depending on the value of the register 245. The bus port 242 outputs the post-operation data of the first operation unit to the bus 260.

[0082] In this way, the encryption processing unit 240 has a switching means for switching, according to a predetermined setting, between a mode in which post-processing data is output to only one of the bus port 241 and the bus port 242, and a mode in which post-processing data is output to the bus port 241 and the bus port 242. The switching means includes, for example, a control circuit 246.

[0083] The post-calculation-processing data output from the bus port 241 to the bus 260 is transferred to the storage unit 210. The post-calculation-processing data output from the bus port 242 to the bus 260 is transferred to the hash processing unit.

[0084] The hash processing unit 250 includes a bus port 251, a SHA core 253, a buffer 254, and an internal buffer 258. The hash processing unit 250 differs from the previously described hash processing unit 150 in that there is no selection circuit 156 between the bus port 251 and the buffer 254. Therefore, the post-processing data is stored in the buffer 254 via the bus 260 and the bus port 251. The hash processing unit 250 performs hash calculation processing on the post-processing data received via the bus port 242 and the bus 260.

[0085] According to the semiconductor device 200 of this embodiment, the encryption processing unit 240 has the bus port 241 and the bus port 242, and therefore it is possible to separate any one of the input of pre-processed data from the storage unit 210, the output of post-processed data to the storage unit 210, and the output of post-processed data to the hash processing unit 250. This allows the input and output of each data to be performed in parallel through different bus ports. This makes it possible to speed up the processing of the semiconductor device 200.

[0086] <Variation 1> Next, a first modification of the second embodiment will be described. The semiconductor device of this modification includes a plurality of buses. FIG. 10 is a block diagram illustrating a semiconductor device 201 according to the first modification of the second embodiment. As shown in FIG. 10, the semiconductor device 201 of this modification includes a bus 261 and a bus 262. That is, instead of the bus 260 of the second embodiment, the semiconductor device 201 includes the bus 261 and the bus 262. The bus 261 is different from the bus 262.

[0087] The bus 261 is a path along which pre-processing data is transferred from the storage unit 210 to the crypto-processing unit 240, and post-processing data is transferred from the crypto-processing unit 240 to the hash processing unit 250. The bus 262 is a path along which post-processing data is transferred from the crypto-processing unit 240 to the storage unit 210. Note that for the transfer of pre-processing data from the storage unit 210 to the crypto-processing unit 240, the transfer of post-processing data from the crypto-processing unit 240 to the hash processing unit 250, and the transfer of post-processing data from the crypto-processing unit 240 to the storage unit 210, the optimal buses 261 and 262 may be selected as appropriate depending on the situation so as to perform high-speed processing.

[0088] According to this modification, the bus 261, through which pre-processing data is transferred to the crypto-processing unit 240 and the post-processing data is transferred to the hash processing unit 250, can be made different from the bus 262, through which the post-processing data is transferred from the crypto-processing unit 240 to the storage unit 210. Thus, the pre-processing data and the post-processing data can be transferred by their own buses, respectively, and the processing speed of the semiconductor device 201 can be increased.

[0089] The disclosure made by the present inventor has been specifically described based on the embodiment, but the present disclosure is not limited to the embodiment and the modified example, and can be modified in various ways without departing from the gist of the disclosure. For example, as shown below, a control program for causing a computer to execute a control method for a semiconductor device is also within the scope of the technical idea of ​​the present embodiment and the modified example. The storage units 110 and 210 may store the processes performed by each component of the semiconductor device 100 and 200, etc. as a program. The control units 130 and 230 may load the program from the storage units 110 and 210 into a memory and execute the program. In this way, the control units 130 and 230 realize the functions of each component of the semiconductor device 100 and 200, etc.

[0090] The control program of the semiconductor device may be stored on a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, the computer-readable medium or tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD-ROM, digital versatile disc (DVD), Blu-ray® disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The time measurement program may be transmitted on a transitory computer-readable medium or a communication medium. By way of example and not limitation, the transitory computer-readable medium or the communication medium includes electrical, optical, acoustic or other forms of propagated signals.

[0091] (Appendix 1) A storage unit that stores at least one of plaintext and ciphertext; a cryptographic processing unit that performs computational processing including encryption processing of the plaintext and decryption processing of the ciphertext; a hash processing unit having a buffer, the hash processing unit performing a hash calculation process for calculating a hash value; A control program for a semiconductor device comprising: a first step of transferring pre-processing data including at least one of the plaintext and the ciphertext stored in the storage unit to the cryptography processing unit for each first calculation unit of the cryptography processing unit; a second step of causing the cryptographic processing unit to apply the arithmetic process to the transferred pre-operation data of the first operation unit, thereby generating the first operation unit of post-operation process data including at least one of the ciphertext and the plaintext; a third step of transferring the generated post-operation-processing data of the first operation unit to the hash processing unit; a fourth step of storing the transferred post-operation-processed data of the first operation unit in the buffer of the hash processing unit; a fifth step of causing the hash calculation unit to apply the hash calculation process to the post-calculation-processed data of a second calculation unit of the hash calculation unit; a sixth step of transferring the post-operation-processing data of the first operation unit or the post-operation-processing data of the second operation unit to the storage unit; on the computer, The second step and the fifth step are performed in parallel; Repeating the first step to the fifth step a number of times; and outputting, to the storage unit, the hash value corresponding to the processed data obtained by processing the pre-processed data. A control program for a semiconductor device. (Appendix 2) The semiconductor device includes: a bus that connects the storage unit, the encryption processing unit, and the hash processing unit so as to be able to communicate with each other; a connection path that connects the encryption processing unit and the hash processing unit so as to be able to communicate with each other, the connection path being different from the bus; Further equipped with In the third step, outputting the post-operation-processing data of the first operation unit to the connection path; In the sixth step, outputting the post-operation-processing data of the first operation unit to the bus; In the fifth step, causing the hash processing unit to perform the hash calculation process on the post-calculation data received via the connection path; 2. A control program for the semiconductor device according to claim 1. (Appendix 3) the encryption processing unit has a switching means for switching between a mode in which the post-processing data is output only to the bus and a mode in which the post-processing data is output to the bus and the connection path, according to a predetermined setting; A control program for the semiconductor device according to claim 2. (Appendix 4) the hash calculation processing unit has a switching unit that switches between a mode in which the hash calculation processing is performed on the post-processing data received via the bus and a mode in which the hash calculation processing is performed on the post-processing data received via the connection path, according to a predetermined setting. A control program for the semiconductor device according to claim 2. (Appendix 5) the hash processing unit includes a monitor for monitoring a storage status of the buffer, the monitor outputting a wait signal to the encryption processing unit when the additional post-processing data cannot be stored in the buffer; the encryption processing unit has a controller that stops outputting the processed data to at least one of the bus and the connection path when the wait signal is received; A control program for the semiconductor device according to claim 4. (Appendix 6) The bus is a first bus through which the pre-processing data is transferred from the storage unit to the encryption processing unit; a second bus different from the first bus, through which the post-processing data is transferred from the cryptographic processing unit to the storage unit; Including, A control program for the semiconductor device according to claim 2. (Appendix 7) the semiconductor device further includes a bus that connects the storage unit, the encryption processing unit, and the hash processing unit so that they can communicate with each other; the encryption processing unit includes a plurality of bus ports for inputting the pre-processing data and outputting the post-processing data between the bus and the bus; the plurality of bus ports include a first bus port and a second bus port; In the sixth step, transferring the post-processing data output from the first bus port to the bus to the storage unit; In the third step, The post-processing data output from the second bus port to the bus is transferred to the hash processing unit; In the fifth step, causing the hash processing unit to perform the hash calculation process on the post-calculation data received via the second bus port and the bus; 2. A control program for the semiconductor device according to claim 1. (Appendix 8) the encryption processing unit has a switching means for switching between a mode in which the post-processing data is output to only one of the first bus port and the second bus port and a mode in which the post-processing data is output to the first bus port and the second bus port, according to a predetermined setting. A control program for the semiconductor device according to claim 7. (Appendix 9) The bus is a first bus through which the pre-processing data is transferred from the storage unit to the cryptographic processing unit and through which the post-processing data is transferred from the cryptographic processing unit to the hash processing unit; a second bus different from the first bus, through which the post-processing data is transferred from the cryptographic processing unit to the storage unit; Including, A control program for the semiconductor device according to claim 7. (Appendix 10) The semiconductor device includes: a transfer unit that transfers the pre-processing data and the post-processing data; a control unit that controls the storage unit, the encryption processing unit, and the hash processing unit; Further equipped with 2. A control program for the semiconductor device according to claim 1. [Explanation of symbols]

[0092] 1, 100, 101, 102, 200, 201 Semiconductor device 10, 110, 210 storage section 20, 120, 220 Transfer section 30, 130, 230 Control unit 40, 140, 240 Encryption processing unit 41, 141, 241, 242 Bus ports 43, 143, 243 AES Core 44, 144, 244 buffers 45, 145, 245 Registers 50, 150, 250 Hash processing unit 51, 151, 251 Bus port 53, 153, 253 SHA cores 54, 154, 254 buffers 55, 155 Registers 58, 158, 258 internal buffer 60, 160, 161, 162, 260, 261, 262 Bus 146, 246 Control circuit 147 Controller 156 Selection Circuit 157 Monitor 170 Connection Paths

Claims

1. A storage unit that stores at least one of plaintext and ciphertext; a cryptographic processing unit that performs computational processing including encryption processing of the plaintext and decryption processing of the ciphertext; a hash processing unit having a buffer, the hash processing unit performing a hash calculation process for calculating a hash value; Equipped with pre-processing data including at least one of the plaintext and the ciphertext stored in the storage unit is transferred to the cryptography processing unit for each first computation unit of the cryptography processing unit; the encryption processing unit applies the arithmetic process to the transferred pre-operation data of the first operation unit to generate post-operation process data including at least one of the ciphertext and the plaintext, for the first operation unit; The generated post-operation-processed data of the first operation unit is transferred to the hash processing unit; the hash calculation unit stores the transferred post-calculation-processed data of the first calculation unit in the buffer, and applies the hash calculation process to the post-calculation-processed data of the second calculation unit in the hash calculation unit; the post-operation-processing data of the first operation unit or the post-operation-processing data of the second operation unit is transferred to the storage unit; the calculation process and the hash calculation process are performed in parallel, the calculation process, the hash calculation process, and the transfer of the post-calculation-processed data to the storage unit are repeated a number of times; the hash value corresponding to the processed data obtained by processing the pre-processing data is output to the storage unit. Semiconductor device.

2. a bus that connects the storage unit, the encryption processing unit, and the hash processing unit so as to be able to communicate with each other; a connection path that connects the encryption processing unit and the hash processing unit so as to be able to communicate with each other, the connection path being different from the bus; Further equipped with the post-processing data generated by the encryption processing unit is output to the bus and the connection path; the hash calculation processing unit performs the hash calculation process on the post-calculation data received via the connection path. The semiconductor device according to claim 1 .

3. the encryption processing unit has a switching means for switching between a mode in which the post-processing data is output only to the bus and a mode in which the post-processing data is output to the bus and the connection path, according to a predetermined setting; The semiconductor device according to claim 2 .

4. the hash calculation processing unit has a switching unit that switches between a mode in which the hash calculation processing is performed on the post-processing data received via the bus and a mode in which the hash calculation processing is performed on the post-processing data received via the connection path, according to a predetermined setting. The semiconductor device according to claim 2 .

5. the hash processing unit includes a monitor for monitoring a storage status of the buffer, the monitor outputting a wait signal to the encryption processing unit when the additional post-processing data cannot be stored in the buffer; the encryption processing unit has a controller that stops output of the processed data to at least one of the bus and the connection path when the wait signal is received; The semiconductor device according to claim 4.

6. The bus is a first bus through which the pre-processing data is transferred from the storage unit to the encryption processing unit; a second bus different from the first bus, through which the post-processing data is transferred from the cryptographic processing unit to the storage unit; Including, The semiconductor device according to claim 2 .

7. a bus that connects the storage unit, the encryption processing unit, and the hash processing unit so that they can communicate with each other; the encryption processing unit includes a plurality of bus ports for inputting the pre-processing data and outputting the post-processing data between the bus and the bus; the plurality of bus ports include a first bus port and a second bus port; The post-processing data output from the first bus port to the bus is transferred to the storage unit, The post-processing data output from the second bus port to the bus is transferred to the hash processing unit, the hash processing unit performs the hash calculation process on the post-calculation data received via the second bus port and the bus. The semiconductor device according to claim 1 .

8. the encryption processing unit has a switching means for switching between a mode in which the post-processing data is output to only one of the first bus port and the second bus port and a mode in which the post-processing data is output to both the first bus port and the second bus port, according to a predetermined setting. The semiconductor device according to claim 7.

9. The bus is a first bus through which the pre-processing data is transferred from the storage unit to the cryptographic processing unit and through which the post-processing data is transferred from the cryptographic processing unit to the hash processing unit; a second bus different from the first bus, through which the post-processing data is transferred from the cryptographic processing unit to the storage unit; Including, The semiconductor device according to claim 7.

10. a transfer unit that transfers the pre-processing data and the post-processing data; a control unit that controls the storage unit, the encryption processing unit, and the hash processing unit; Further equipped with The semiconductor device according to claim 1 .

11. A storage unit that stores at least one of plaintext and ciphertext; a cryptographic processing unit that performs computational processing including encryption processing of the plaintext and decryption processing of the ciphertext; a hash processing unit having a buffer, the hash processing unit performing a hash calculation process for calculating a hash value; A method for controlling a semiconductor device comprising: a first step of transferring pre-processing data including at least one of the plaintext and the ciphertext stored in the storage unit to the cryptography processing unit for each first computation unit of the cryptography processing unit; a second step of causing the cryptographic processing unit to apply the arithmetic process to the transferred pre-operation data of the first operation unit, thereby generating the first operation unit of post-operation process data including at least one of the ciphertext and the plaintext; a third step of transferring the generated post-operation-processed data of the first operation unit to the hash processing unit; a fourth step of storing the transferred post-operation-processed data of the first operation unit in the buffer of the hash processing unit; a fifth step of causing the hash calculation unit to apply the hash calculation process to the post-calculation-processed data of a second calculation unit of the hash calculation unit; a sixth step of transferring the post-operation-processing data of the first operation unit or the post-operation-processing data of the second operation unit to the storage unit; Equipped with The second step and the fifth step are performed in parallel; Repeating the first step to the fifth step a number of times; The method further includes a step of outputting the hash value corresponding to the post-processing data obtained by processing the pre-processing data to the storage unit. A method for controlling a semiconductor device.

12. The semiconductor device includes: a bus that connects the storage unit, the encryption processing unit, and the hash processing unit so as to be able to communicate with each other; a connection path that connects the encryption processing unit and the hash processing unit so as to be able to communicate with each other, the connection path being different from the bus; Further equipped with In the third step, outputting the post-operation-processing data of the first operation unit to the connection path; In the sixth step, outputting the post-operation-processing data of the first operation unit to the bus; In the fifth step, causing the hash processing unit to perform the hash calculation process on the post-calculation data received via the connection path; The method for controlling a semiconductor device according to claim 11.

13. the encryption processing unit has a switching means for switching between a mode in which the post-processing data is output only to the bus and a mode in which the post-processing data is output to the bus and the connection path, according to a predetermined setting; The method for controlling a semiconductor device according to claim 12.

14. the hash calculation processing unit has a switching unit that switches between a mode in which the hash calculation processing is performed on the post-processing data received via the bus and a mode in which the hash calculation processing is performed on the post-processing data received via the connection path, according to a predetermined setting. The method for controlling a semiconductor device according to claim 12.

15. the hash processing unit includes a monitor for monitoring a storage status of the buffer, the monitor outputting a wait signal to the encryption processing unit when the additional post-processing data cannot be stored in the buffer; the encryption processing unit has a controller that stops outputting the processed data to at least one of the bus and the connection path when the wait signal is received; The method for controlling a semiconductor device according to claim 14.

16. The bus is a first bus through which the pre-processing data is transferred from the storage unit to the encryption processing unit; a second bus different from the first bus, through which the post-processing data is transferred from the cryptographic processing unit to the storage unit; Including, The method for controlling a semiconductor device according to claim 12.

17. the semiconductor device further includes a bus that connects the storage unit, the encryption processing unit, and the hash processing unit so that they can communicate with each other; the encryption processing unit includes a plurality of bus ports for inputting the pre-processing data and outputting the post-processing data between the bus and the bus; the plurality of bus ports include a first bus port and a second bus port; In the sixth step, transferring the post-processing data output from the first bus port to the bus to the storage unit; In the third step, The post-processing data output from the second bus port to the bus is transferred to the hash processing unit; In the fifth step, causing the hash processing unit to perform the hash calculation process on the post-calculation data received via the second bus port and the bus; The method for controlling a semiconductor device according to claim 11.

18. the encryption processing unit has a switching means for switching between a mode in which the post-processing data is output to only one of the first bus port and the second bus port and a mode in which the post-processing data is output to both the first bus port and the second bus port, according to a predetermined setting. The method for controlling a semiconductor device according to claim 17.

19. The bus is a first bus through which the pre-processing data is transferred from the storage unit to the cryptographic processing unit and through which the post-processing data is transferred from the cryptographic processing unit to the hash processing unit; a second bus different from the first bus, through which the post-processing data is transferred from the cryptographic processing unit to the storage unit; Including, The method for controlling a semiconductor device according to claim 17.

20. A storage unit that stores at least one of plaintext and ciphertext; a cryptographic processing unit that performs computational processing including encryption processing of the plaintext and decryption processing of the ciphertext; a hash processing unit having a buffer, the hash processing unit performing a hash calculation process for calculating a hash value; A control program for a semiconductor device comprising: a first step of transferring pre-processing data including at least one of the plaintext and the ciphertext stored in the storage unit to the cryptography processing unit for each first computation unit of the cryptography processing unit; a second step of causing the cryptographic processing unit to apply the arithmetic process to the transferred pre-operation data of the first operation unit, thereby generating the first operation unit of post-operation process data including at least one of the ciphertext and the plaintext; a third step of transferring the generated post-operation-processed data of the first operation unit to the hash processing unit; a fourth step of storing the transferred post-operation-processed data of the first operation unit in the buffer of the hash processing unit; a fifth step of causing the hash calculation unit to apply the hash calculation process to the post-calculation-processed data of a second calculation unit of the hash calculation unit; a sixth step of transferring the post-operation-processing data of the first operation unit or the post-operation-processing data of the second operation unit to the storage unit; Run the following on your computer: The second step and the fifth step are performed in parallel; Repeating the first step to the fifth step a number of times; and causing the computer to further execute a step of outputting, to the storage unit, the hash value corresponding to the processed data obtained by processing the pre-processing data. A control program for a semiconductor device.

Images