Semiconductor device
The semiconductor device addresses the vulnerability to glitch attacks during reset transfer by using a comparison circuit and multiple data transfers to verify data integrity, effectively protecting against unauthorized control and data leakage.
Patent Information
- Application Number
- JP2023178393
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2023-10-16
- Publication Date
- 2025-04-28
AI Technical Summary
Semiconductor devices are vulnerable to glitch attacks (FIA) during reset transfer, which can alter or leak important data, and existing software-based countermeasures are ineffective during this phase.
The semiconductor device incorporates a processor, a memory controller with a comparison circuit, and a reset data transfer controller that performs multiple data transfers to verify the integrity of initial setting data by comparing it across multiple registers, thereby detecting and mitigating glitch attacks.
This solution effectively protects semiconductor devices from glitch attacks by ensuring data integrity during reset transfer, preventing unauthorized control and data leakage, and maintaining the security protection state.
Smart Images
Figure 2025068455000001_ABST
Abstract
Description
[Technical field]
[0001] The present invention relates to a semiconductor device, for example, a semiconductor device equipped with a processor. [Background technology]
[0002] "4.6 FAULT.DOUBLECHECK" in Non-Patent Document 1 describes a method of implementing a countermeasure against glitch attacks (FIA: Fault Injection attack) using software. Specifically, when using important data, the method describes a method of using software to double-check the identity of data read at a certain point in time and data read after a certain time. [Prior art documents] [Non-patent literature]
[0003] [Non-Patent Document 1] “Secure Application Programming in the presence of Side Channel Attacks”, [online], [Retrieved September 26, 2023], Internet <URL:https: / / riscureprodstorage.blob.core.windows.net / production / 2017 / 08 / Riscure_Whitepaper_Side_Channel_Patterns.pdf> Summary of the Invention [Problem to be solved by the invention]
[0004] For example, in a semiconductor device equipped with a processor or the like, in other words, a semiconductor chip, various initial settings of the entire chip may be performed by transferring predetermined data from a non-volatile memory to a register when the chip is started. Such a transfer operation is also called a reset transfer. The initial setting items by the reset transfer may include the security protection state. The processor starts up after completing various initial settings by such a reset transfer.
[0005] On the other hand, one of the methods of glitch attack (FIA) is, for example, a method of inverting important data indicating the security protection state. If such a glitch attack is performed during reset transfer, for example, the security protection state may change, allowing unauthorized control of a semiconductor chip, which may result in tampering or leakage of important data. As a countermeasure against glitch attacks, a method of performing a double check using software is known, as shown in Non-Patent Document 1. However, this method can be applied at the stage when the software is ready to be executed after the processor is started up, but is difficult to apply during reset transfer.
[0006] The embodiments described below have been made in consideration of the above, and other problems and novel features will become apparent from the description of this specification and the accompanying drawings. [Means for solving the problem]
[0007] A semiconductor device according to an embodiment includes a processor, a memory controller including a memory unit, a register unit, and a comparison circuit, which are formed on a semiconductor chip, a reset data transfer controller that executes data transfer from the memory unit to the register unit when the chip is started, and a system controller. The memory unit has a first memory in which data required for the initial setting of the semiconductor chip is stored. The register unit has a first register that is referred to in the initial setting of the semiconductor chip, and a second register for verifying the first register. The reset data transfer controller executes N data transfers, and transfers data stored in the first memory to the first register during the first data transfer, and transfers data stored in the first memory to the second register during the N data transfer. The comparison circuit determines whether the data transferred to the first register and the data transferred to the second register match / mismatch, and outputs a determination result signal that indicates the determination result. The system controller starts the processor when the determination result signal indicates a match, and causes the reset data transfer controller to execute N data transfers again when the determination result signal indicates a mismatch. Effect of the Invention
[0008] According to one embodiment, a semiconductor device can be protected against glitch attacks (FIA). [Brief description of the drawings]
[0009] [Figure 1] FIG. 1 is a block diagram showing a schematic configuration example of a main part of a semiconductor device according to a first embodiment. [Diagram 2] FIG. 2 is a sequence diagram showing a schematic operation example at the time of starting up the chip in the semiconductor device shown in FIG. [Figure 3A] FIG. 3A is a flow chart showing an example of detailed processing contents at the time of chip startup in the semiconductor device shown in FIG. [Figure 3B] FIG. 3B is a diagram illustrating the process contents shown in FIG. 3A, and is a diagram illustrating an example of a signal transmission path within the semiconductor device. [Figure 4] FIG. 4 is a flow diagram showing an example of detailed processing contents of the reset transfer processing shown in FIG. 2 and FIG. 3A. [Diagram 5] FIG. 5 is a block diagram showing a schematic configuration example of a main part of a semiconductor device according to the second embodiment. [Figure 6] FIG. 6 is a schematic diagram showing an example of information stored in the first memory in FIG. [Figure 7A] FIG. 7A is a flow chart showing an example of detailed processing contents at the time of chip startup in the semiconductor device shown in FIG. [Figure 7B] FIG. 7B is a diagram illustrating the process contents shown in FIG. 7A, and is a diagram illustrating an example of a signal transmission path within the semiconductor device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
[0010] In the following embodiments, when necessary for convenience, the description will be divided into multiple sections or embodiments, but unless otherwise specified, they are not unrelated to each other, and one is a partial or complete modification, detail, supplementary explanation, etc. of the other. Furthermore, in the following embodiments, when the number of elements, etc. (including the number, numerical value, amount, range, etc.) is mentioned, it is not limited to the specific number, and may be more or less than the specific number, unless otherwise specified or clearly limited in principle to a specific number.
[0011] Furthermore, in the following embodiments, the components (including element steps, etc.) are not necessarily essential unless otherwise specified or considered to be obviously essential in principle. Similarly, in the following embodiments, when referring to the shape, positional relationship, etc. of components, etc., it is intended to include those that are substantially similar or similar to the shape, etc., unless otherwise specified or considered to be obviously not essential in principle. The same applies to the above numerical values and ranges.
[0012] Furthermore, although not particularly limited, the circuit elements constituting each functional block of the embodiment are formed on a semiconductor substrate such as single crystal silicon by known integrated circuit technology such as CMOS (complementary metal oxide semiconductor).
[0013] Hereinafter, the embodiments will be described in detail with reference to the drawings. In all the drawings for explaining the embodiments, the same reference numerals are used for the members having the same functions, and the repeated explanations are omitted. In the following embodiments, the explanations of the same or similar parts will not be repeated as a rule unless it is particularly necessary.
[0014] (First embodiment) <Outline of semiconductor device> Fig. 1 is a block diagram showing a schematic configuration example of a main part of a semiconductor device according to a first embodiment. As shown in Fig. 1, the semiconductor device according to the first embodiment has a semiconductor chip CHP such as a SoC (System on Chip) on which a plurality of circuits are formed. The plurality of circuits include a power-on controller POC, a processor PRC, a reset data transfer controller RDTC, a memory controller MEMC, various peripheral circuits PERI, and a system controller SYSC.
[0015] The various peripheral circuits PERI include various circuits according to the functions required of the semiconductor device, such as a communication interface circuit with the outside of the chip, an analog-digital converter, a digital-analog converter, etc. The system controller SYSC controls the power-on controller POC, the processor PRC, the memory controller MEMC, the reset data transfer controller RDTC, and the various peripheral circuits PERI, thereby controlling, for example, the operation sequence of the entire semiconductor chip CHP.
[0016] The power-on controller POC releases the reset state of the entire semiconductor chip CHP in response to power-on of the semiconductor chip CHP or in response to a reset signal from an external reset terminal. The processor PRC is, for example, a CPU (Central Processing Unit), and may further include a GPU (Graphics Processing Unit) and a DSP (Digital Signal Processor).
[0017] The memory controller MEMC includes a memory unit MEMU, a register unit REGU, and a comparison circuit CMP1. The memory controller MEMC mainly controls access to the memory unit MEMU or the register unit REGU. The memory unit MEMU includes, for example, a first memory MEM1a, a volatile memory RAM such as an SRAM (Static Random Access Memory), and a non-volatile memory NVM such as an MRAM (Magnetoresistive RAM) or a flash memory. The register unit REGU includes a main register (first register) REGm and a sub-register (second register) REGs.
[0018] The non-volatile memory NVM stores, for example, programs and the like. The programs and the like are copied from the non-volatile memory NVM to the volatile memory RAM. The processor PRC executes the programs copied to the volatile memory RAM. The first memory MEM1a is configured of, for example, a non-volatile memory that can be written only once, in other words, cannot be rewritten, such as a fuse ROM (Read Only Memory) or an OTP (One Time Programmable)-ROM. Data required for initial setting of the semiconductor chip CHP, i.e., initial setting data, is stored in advance in the first memory MEM1a.
[0019] The initial setting data includes important data that indicates the security protection state, etc. As a specific example, the initial setting data may include a setting value of a protection bit for a command, a setting value of a protection bit for a boot firmware, i.e., a value that determines whether protection is enabled / disabled, etc. The reset data transfer controller RDTC executes data transfer from the memory unit MEMU to the register unit REGU, i.e., reset transfer, when the semiconductor chip CHP is started up.
[0020] Although details will be described later, the reset data transfer controller RDTC transfers data stored in the first memory MEM1a, i.e., initial setting data, to the main register REGm or sub-register REGs by N data transfers, where N is an integer equal to or greater than 2. The reset data transfer controller RDTC includes a random number generation circuit RNG to generate the value N, which is the number of data transfers, as a random number.
[0021] Here, the data DTm transferred to the main register REGm is referred to in the initial setting of the semiconductor chip CHP, for example, by the processor PRC, the system controller SYSC, etc. On the other hand, the sub-register REGs is provided to verify the data DTm of the main register REGm. That is, the comparator circuit CMP1 in the memory controller MEMC judges whether the data DTm transferred to the main register REGm matches or does not match the data DTs transferred to the sub-register REGs. Then, the comparator circuit CMP1 outputs a judgment result signal RS indicating the judgment result to the system controller SYSC.
[0022] Fig. 2 is a sequence diagram showing a schematic operation example at the time of chip startup in the semiconductor device shown in Fig. 1. At the time of chip startup, the semiconductor chip CHP executes a reset sequence as shown in Fig. 2. In the reset sequence, the semiconductor chip CHP executes power-on processing (step S101), reset transfer processing (step S102), processor startup determination processing (step S103), and processor startup processing (step S104) in this order.
[0023] In a power-on process (step S101), the power-on controller POC releases the reset state of the semiconductor chip CHP. In a reset transfer process (step S102), the reset data transfer controller RDTC executes data transfer from the memory unit MEMU to the register unit REGU, i.e., reset transfer of the initial setting data. In a processor startup determination process (step S103), the system controller SYSC determines whether the reset transfer has been executed normally. Then, if the reset transfer has been executed normally, in a processor startup process (step S104), the system controller SYSC starts up the processor PRC.
[0024] In such a reset sequence, if a glitch attack (FIA) occurs during reset transfer, the data DTm in the main register REGm, which is the transfer destination, may be destroyed. For example, if the enable signal is attacked, the main register REGm cannot take in the data itself, and as a result, cannot hold the correct data. If the address signal is attacked, the correspondence between the data stored in the first memory MEM1a and the data stored in the main register REGm is incorrect, and as a result, the main register REGm cannot hold the correct data. If the data signal is attacked, the main register REGm takes in incorrect data, and as a result, cannot hold the correct data.
[0025] In this way, if the data DTm of the main register REGm is destroyed and, for example, the set value of the protection bit described above is changed, the semiconductor chip CHP can be illegally controlled, which may result in software leaking to the outside or being tampered with. In particular, the reset transfer process (step S102) may be vulnerable to a glitch attack in terms of the ease of determining the timing of the attack. That is, an attacker can arbitrarily determine the start timing of step S101 by using, for example, an external reset terminal, and can easily grasp to some extent the start timing of the reset transfer process (step S102) executed immediately thereafter.
[0026] Therefore, in the method of the first embodiment, as shown in FIG. 2, data transfers (steps S102[1]-S102[N]) are performed N times in the reset transfer process (step S102) to protect the semiconductor chip CHP from glitch attacks. Here, the value of N is a random number, so the period Trt of the reset transfer process (step S102) changes according to the value of N. Note that the countermeasure method shown in Non-Patent Document 1 is a software-based method that can be applied after the processor startup process (step S104).
[0027] <Detailed operation of semiconductor device> Fig. 3A is a flow diagram showing an example of detailed processing contents at the time of chip startup in the semiconductor device shown in Fig. 1. Fig. 3B is a diagram showing a schematic representation of the processing contents shown in Fig. 3A, and is a diagram showing an example of a signal transmission path inside the semiconductor device. Fig. 3B shows a partial configuration example extracted from the semiconductor chip CHP shown in Fig. 1.
[0028] 3A and 3B, the power-on controller POC releases the reset state of the semiconductor chip CHP in response to, for example, power-on to the semiconductor chip CHP or a reset signal from an external reset terminal (step S201). The system controller SYSC starts the memory unit MEMU in response to the release of the reset state (step S202). Specifically, the system controller SYSC supplies power to the first memory MEM1a and the like, making the first memory MEM1a accessible. The processes of steps S201 and S202 correspond to the power-on process (step S101).
[0029] Next, the reset data transfer controller RDTC executes N data transfers, i.e., N reset transfers (step S203). Specifically, as shown in Fig. 3B, the reset data transfer controller RDTC transfers the data DT stored in the first memory MEM1a, specifically, the initial setting data, to the main register REGm during the first data transfer.
[0030] On the other hand, the reset data transfer controller RDTC transfers the data DT stored in the first memory MEM1a, i.e., the same initial setting data as the first time, to the sub-register REGs during the second to Nth data transfers. In other words, when the value of N is an integer equal to or greater than 3, the reset data transfer controller RDTC sequentially overwrites the data DT stored in the first memory MEM1a to the sub-register REGs during the second to Nth data transfers. The process of step S203 corresponds to the reset transfer process (step S102).
[0031] Next, the system controller SYSC executes an FIA error check (step S204). Specifically, as shown in Fig. 3B, first, the comparator circuit CMP1 judges whether the data DTm transferred to the main register REGm matches or does not match the data DTs transferred to the sub-register REGs. In this way, the comparator circuit CMP1 verifies the validity of the data DTm transferred to the main register REGm for the first time, using the data DTs transferred to the sub-register REGs for the Nth time.
[0032] Then, the comparison circuit CMP1 outputs a judgment result signal RS indicating the judgment result to the system controller SYSC. If the judgment result signal RS indicates a mismatch (step S204: there is an error), the system controller SYSC initializes the reset transfer (step S205). Specifically, the system controller SYSC clears the values of each register included in the memory controller MEMC and the reset data transfer controller RDTC, including the register unit REGU. After that, the system controller SYSC returns to step S203 and causes the reset data transfer controller RDTC to execute the data transfer N times again.
[0033] On the other hand, when the determination result signal RS from the comparison circuit CMP1 indicates a match (step S204: no error), the system controller SYSC starts the processor PRC by releasing the reset state of the processor PRC (step S206). The system controller SYSC also starts the processor PRC if the determination result signal RS indicates a match after causing the reset data transfer controller RDTC to execute data transfer N times again through step S205. The processes of steps S204 and S205 correspond to the processor start-up determination process (step S103). The process of step S206 corresponds to the processor start-up process (step S104).
[0034] In this way, the semiconductor chip CHP verifies the validity of the data DTm transferred the first time in the reset transfer by using the data DTs transferred the Nth time to determine the presence or absence of an FIA error. Then, the semiconductor chip CHP starts the processor PRC when it does not detect an FIA error, and does not start the processor PRC when it detects an FIA error. By not starting the processor PRC, the semiconductor device cannot be controlled illegally, and the semiconductor device can be protected from glitch attacks (FIA).
[0035] On the other hand, when using this method, the condition for an FIA error to go undetected is when (A) an attack is carried out during both the first data transfer and the Nth data transfer, and (B) the changes in data caused by the attack are identical. The probability of condition (A) and condition (B) being satisfied simultaneously is generally considered to be low. In particular, by successively changing the timing of the attack target using the random number N, the probability of condition (A) and condition (B) being satisfied simultaneously becomes significantly low. As a result, if the initial setting data is destroyed by a glitch attack (FIA) during a reset transfer, it can be detected with a high probability.
[0036] It is also possible to verify the validity of the data DTm transferred the first time sequentially using each of the data transferred the second time to the Nth time. In this case, it is practically possible to verify whether a glitch attack has occurred during the reset transfer period. However, in such a method, FIA errors may be detected excessively. That is, even if a glitch attack has occurred, no particular problem occurs as long as the data DTm transferred the first time is valid data. From this point of view, a method of verifying the validity of the data DTm transferred the first time using the data DTs transferred the Nth time, as shown in FIG. 3A and FIG. 3B, is desirable.
[0037] In addition, in this embodiment, the sub-register REGs is sequentially overwritten with the data DT from the first memory MEM1a during the second to Nth data transfers. As a result, the area of the register can be reduced, for example, compared to a case where a plurality of sub-registers corresponding to the second to Nth data transfers are provided. In addition to the data in the destination register, a glitch attack can also attack the data stored in the source memory. In the configuration example shown in FIG. 1, the first memory MEM1a, which is the source, is a non-rewritable memory, so the data in the source memory is not destroyed.
[0038] Fig. 4 is a flow diagram showing an example of detailed processing contents in the reset transfer process (step S102) shown in Fig. 2 and Fig. 3A. The reset data transfer controller RDTC includes, for example, a sequencer circuit that executes the process shown in Fig. 4. In Fig. 4, the reset data transfer controller RDTC waits for a reset transfer start command from the system controller SYSC (step S301).
[0039] When the reset data transfer controller RDTC receives a reset transfer start command (step S301: Yes), it generates a random number N using the random number generation circuit RNG (step S302). In addition, the reset data transfer controller RDTC initializes the number of transfers n to zero (step S303).
[0040] Next, the reset data transfer controller RDTC sets the transfer source to the first memory MEM1a, specifically, to an address in the first memory MEM1a where the initial setting data is stored (step S304).The reset data transfer controller RDTC also sets the transfer destination to the main register REGm, specifically, to an address assigned to the main register REGm (step S305).
[0041] Then, using such settings, the reset data transfer controller RDTC executes data transfer and updates the number of transfers n (step S306). In detail, the reset data transfer controller RDTC performs read access to the first memory MEM1a of the transfer source, and writes the read data to the main register REGm of the transfer destination by enabling the main register REGm.
[0042] Next, the reset data transfer controller RDTC changes the transfer destination to the sub-register REGs, specifically, for example, an address assigned to the sub-register REGs (step S307). The reset data transfer controller RDTC executes data transfer using the changed settings and updates the number of transfers n (step S308). Then, the reset data transfer controller RDTC repeats the process of step S308 until the number of transfers n reaches N (step S309: No).
[0043] On the other hand, if the number of transfers n reaches N (step S309: Yes), the reset data transfer controller RDTC outputs a reset transfer completion notification to the system controller SYSC (step S310). Note that the information on the transfer source and transfer destination in steps S304, S305, and S307 is, for example, fixedly determined in advance on a circuit.
[0044] <Main Effects of the First Embodiment> As described above, in the method of the first embodiment, in the reset transfer, the presence or absence of an FIA error in the data stored in the main register REGm is detected using the main register REGm, the sub-register REGs, and the comparison circuit CMP1. Then, if there is no FIA error, the processor PRC is started. As a result, typically, the semiconductor device can be protected from glitch attacks (FIA).
[0045] (Second embodiment) <Problems to be solved> In the method of the first embodiment described above, in order to prevent data destruction in the source memory, the source memory, i.e., the first memory MEM1a, is configured with a non-rewritable OTP-ROM or the like. On the other hand, if the source memory is configured with a rewritable non-volatile memory, even if the data itself of the memory is destroyed, the identity of the data transferred to the register is maintained, so that an FIA error is not detected. For this reason, some measure is required in case data destruction occurs in the source memory.
[0046] <Schematic configuration of semiconductor device> Fig. 5 is a block diagram showing a schematic configuration example of a main part of a semiconductor device according to a second embodiment. Fig. 6 is a schematic diagram showing an example of information stored in a first memory (MEM1b) in Fig. 5. The semiconductor chip CHP shown in Fig. 5 is different from the configuration example shown in Fig. 1 in the following points.
[0047] The first difference is that the memory unit MEMU includes a first memory MEM1b, a second memory MEM2, and a volatile memory RAM. Unlike the case of FIG. 1, the first memory MEM1b is configured with a rewritable nonvolatile memory NVM such as a flash memory, MRAM, etc. The second memory MEM2 is configured with a nonvolatile memory such as a fuse ROM, OTP-ROM, etc. that can be written only once, in other words, cannot be rewritten.
[0048] As shown in Fig. 6, the first memory MEM1b stores data DT, specifically initial setting data, and an error correction code ECC added to the data DT in an address area AR1. The error correction code ECC is uniquely determined by performing a predetermined calculation on the data DT. The first memory MEM1b also stores a recovery count RR (described later) in an address area AR2, and stores a program in an address area AR3. The program is copied to a volatile memory RAM such as an SRAM, as in the case of Fig. 1, and executed by the processor PRC.
[0049] As a second difference, the reset data transfer controller RDTC further includes an ECC (Error Check and Correction) decoder ECC_DEC and a comparison circuit (second comparison circuit) CMP2. During reset transfer, the reset data transfer controller RDTC executes data transfer from the memory unit MEMU to the register unit REGU via the ECC decoder ECC_DEC.
[0050] At this time, the ECC decoder ECC_DEC judges whether or not the error can be corrected based on the error correction code ECC added to the data DT, i.e., the initial setting data. If the error can be corrected, for example, in the case of a 1-bit error, the ECC decoder ECC_DEC transfers the data DT after the error correction to the register unit REGU. On the other hand, if the error cannot be corrected, for example, in the case of a 2-bit error, the ECC decoder ECC_DEC outputs an ECC error signal EER to the system controller SYSC.
[0051] The comparator circuit CMP2 judges whether the number of recoveries RR stored in the first memory MEM1b has reached a preset upper limit value RRlmt of the number of recoveries. The upper limit value RRlmt of the number of recoveries is stored in the second memory MEM2 here. When the number of recoveries RR has reached the upper limit value RRlmt, the comparator circuit CMP2 outputs a recovery error signal RER to the system controller SYSC. Note that, although details will be described later, when the system controller SYSC receives an ECC error signal EER or a recovery error signal RER, it controls so that at least the processor PRC is not started.
[0052] As a third difference, a data recovery unit DREU is provided outside the semiconductor chip CHP. In detail, the data recovery unit DREU is provided in, for example, a higher-level device that manages the semiconductor chip CHP in a predetermined system including the semiconductor chip CHP. The data recovery unit DREU holds backup data of the data DT. Then, the data recovery unit DREU transmits the backup data to the system controller SYSC in response to a data recovery request from the semiconductor chip CHP, in detail, the system controller SYSC. This allows the system controller SYSC to correctly restore the data DT even if the data DT becomes an error-correctable state.
[0053] <Detailed operation of semiconductor device> Fig. 7A is a flow diagram showing an example of detailed processing contents at the time of chip startup in the semiconductor device shown in Fig. 5. Fig. 7B is a diagram showing a schematic representation of the processing contents shown in Fig. 7A, and is a diagram showing an example of a signal transmission path inside the semiconductor device. Fig. 7B shows a partial configuration example extracted from the semiconductor chip CHP shown in Fig. 5.
[0054] In Figures 7A and 7B, the processes from step S401 to step S403 are the same as the processes from step S201 to step S203 shown in Figures 3A and 3B. Briefly, the power-on controller POC releases the reset state of the semiconductor chip CHP (step S401). In response to this, the system controller SYSC starts up the first memory MEM1b and the second memory MEM2, etc. (step S402).
[0055] Next, the reset data transfer controller RDTC executes N data transfers, that is, N reset transfers (step S403). Specifically, as shown in Fig. 7B, the reset data transfer controller RDTC transfers the data DT stored in the first memory MEM1b to the main register REGm via the ECC decoder ECC_DEC during the first data transfer.
[0056] At this time, the ECC decoder ECC_DEC judges whether there is an error and, if there is an error, whether the error can be corrected based on the error correction code ECC added to the data DT. If there is a correctable error, the ECC decoder ECC_DEC transfers the data DT after the error correction to the main register REGm. On the other hand, if there is an uncorrectable error, the ECC decoder ECC_DEC outputs an ECC error signal EER to the system controller SYSC.
[0057] On the other hand, during the second to Nth data transfers, the reset data transfer controller RDTC transfers the data DT stored in the first memory MEM1b, i.e., the same initial setting data as the first data transfer, to the sub-register REGs via the ECC decoder ECC_DEC. The processing contents of the ECC decoder ECC_DEC at this time are the same as those in the first data transfer. Also, the transferred data DT is sequentially overwritten in the sub-register REGs, as in the case of FIG. 3B.
[0058] Next, the system controller SYSC checks whether the recovery count RR has reached the upper limit value RRlmt by checking the number of recovery times (step S404). That is, the system controller SYSC determines whether it has received the recovery error signal RER from the comparison circuit (second comparison circuit) CMP2. When the recovery count RR reaches the upper limit value RRlmt (step S404: RR = RRlmt), the system controller SYSC initializes the reset transfer in the same manner as in step S205 in FIG. 3A (step S405) and returns to step S403.
[0059] On the other hand, when the recovery count RR has not reached the upper limit value RRlmt (step S404: RR < RRlmt), the system controller SYSC executes an FIA error check based on the determination result signal RS from the comparison circuit (first comparison circuit) CMP1 in the same manner as in step S204 in FIG. 3A (step S406). Here, when there is an FIA error (step S406: error exists), the system controller SYSC returns to step S403 after initializing the reset transfer (step S405) in the same manner as in the case of FIG. 3A.
[0060] On the other hand, when there is no FIA error (step S406: error does not exist), the system controller SYSC executes an ECC error check (step S407). Specifically, the system controller SYSC determines whether it has received the ECC error signal EER from the ECC decoder ECC_DEC during the N reset transfers in step S403. Here, when the ECC error signal EER is received (step S407: error exists), the system controller SYSC executes data recovery processing and updates the recovery count RR therein (step S408).
[0061] Specifically, as shown in Fig. 7B, when the system controller SYSC receives an ECC error signal EER, it transmits a data recovery request to the data recovery unit DREU to recover the data DT stored in the first memory MEM1b. In response to this, the system controller SYSC obtains recovery information, i.e., correct backed-up data, from the data recovery unit DREU. The system controller SYSC updates the data DT and the error correction code ECC in the first memory MEM1b with the correct data, and also updates the number of recoveries RR.
[0062] 7A, when the ECC error signal EER is not input (step S407: no error), the system controller SYSC starts the processor PRC (step S409). That is, the system controller SYSC starts the processor PRC only when the judgment result signal RS from the comparison circuit CMP1 indicates a match without inputting the ECC error signal EER. Note that the processes from step S404 to step S408 correspond to the processor startup judgment process (step S103). The process of step S409 corresponds to the processor startup process (step S104).
[0063] By using such a method, even if the data DT in the first memory MEM1b is destroyed by a glitch attack (FIA), if the destruction is error correctable, the processor PRC can be started on the condition that no FIA error is generated from the comparison circuit CMP1. On the other hand, if the data DT in the first memory MEM1b is destroyed by a glitch attack in an error correctable manner, or if an FIA error is generated from the comparison circuit CMP1, the processor PRC is not started. This makes it possible to appropriately protect the semiconductor device from glitch attacks.
[0064] Here, for example, an attacker may perform glitch attacks on the first memory MEM1b many times while changing conditions in order to search for a desired method of destruction. In this case, if an error that cannot be corrected occurs in the data DT in the first memory MEM1b, the semiconductor device can be recovered from the failure state by restarting the semiconductor device after performing data recovery. However, if recovery is permitted infinitely, the attacker can perform glitch attacks on the first memory MEM1b infinitely while changing conditions, which increases the possibility of finding a desired method of destruction.
[0065] Therefore, here, an upper limit value RRlmt of the number of recoveries is set. When the number of recoveries RR reaches the upper limit value RRlmt, the processor PRC is prohibited from starting thereafter. On the other hand, for example, when the upper limit value RRlmt itself is rewritten to a larger value, the upper limit value RRlmt is essentially invalidated. For this reason, it is desirable that the upper limit value RRlmt be stored in the second memory MEM2 that cannot be rewritten.
[0066] Also, in Fig. 7A, when the number of recoveries RR reaches the upper limit value RRlmt, an infinite loop occurs in the processing of steps S404, S405, and S403. As a result, at least the processor PRC is not started, so that the semiconductor device can be protected. On the other hand, in Fig. 7A, when such an infinite loop occurs, it is assumed that an error is detected by, for example, another error detection function (not shown) and appropriate measures are taken. However, without using such another error detection function, the system controller SYSC may notify the outside of the chip that a serious error has occurred when the number of recoveries RR reaches the upper limit value RRlmt in step S404, for example, and end the processing.
[0067] <Main Effects of the Second Embodiment> As described above, by using the method of the second embodiment, the semiconductor device can be protected from glitch attacks (FIA) in the same manner as in the first embodiment. Furthermore, protection can be realized even when a rewritable non-volatile memory is applied to the source memory. That is, appropriate protection can be realized even when a glitch attack is performed on the source memory, not limited to the destination register.
[0068] The invention made by the inventor has been specifically described above based on an embodiment, but it goes without saying that the present invention is not limited to the above embodiment and can be modified in various ways without departing from the gist of the invention. [Explanation of symbols]
[0069] CHP Semiconductor Chip CMP1, CMP2 comparison circuit DT Data ECC Error Correcting Code ECC_DEC ECC Decoder EER ECC Error Signal MEM1a, MEM1b First memory MEM2 Second memory MEMC Memory Controller MEMU Memory Unit PRC Processor RDTC Reset Data Transfer Controller REGU Register Unit REGm Main register REGs Sub-registers RER Recovery Error Signal RNG Random number generation circuit RR Recovery Count RRlmt Upper limit of recovery count RS judgment result signal SYSC System Controller
Claims
1. A semiconductor device having a semiconductor chip on which a plurality of circuits are formed, The plurality of circuits include A processor; a memory controller including a memory unit, a register unit and a comparison circuit; a reset data transfer controller that transfers data from the memory unit to the register unit when the semiconductor chip is started up; a system controller for controlling the processor, the memory controller, and the reset data transfer controller; Equipped with the memory unit has a first memory in which data necessary for initial setting of the semiconductor chip is stored; the register unit includes a first register referenced in an initial setting of the semiconductor chip, and a second register for verifying the first register; the reset data transfer controller executes N data transfers, N being an integer equal to or greater than 2, and transfers the data stored in the first memory to the first register during a first data transfer, and transfers the data stored in the first memory to the second register during an N data transfer; the comparison circuit determines whether the data transferred to the first register and the data transferred to the second register match or not, and outputs a determination result signal indicative of the determination result to the system controller; the system controller starts up the processor when the determination result signal indicates a match, and makes the reset data transfer controller execute the N data transfers again when the determination result signal indicates a mismatch; Semiconductor device.
2. 2. The semiconductor device according to claim 1, the system controller causes the reset data transfer controller to execute the N data transfers again, and then starts up the processor if the determination result signal indicates a match. Semiconductor device.
3. 3. The semiconductor device according to claim 2, the reset data transfer controller has a random number generation circuit that generates a value of N as a random number every time the N number of data transfers are executed; Semiconductor device.
4. 3. The semiconductor device according to claim 2, the reset data transfer controller sequentially overwrites the data stored in the first memory to the second register during a second to Nth data transfer, when a value of N is an integer equal to or greater than 3; Semiconductor device.
5. 2. The semiconductor device according to claim 1, The first memory is composed of a non-volatile memory that can be written only once. Semiconductor device.
6. A semiconductor device having a semiconductor chip on which a plurality of circuits are formed, The plurality of circuits include A processor; a memory controller including a memory unit, a register unit and a first comparison circuit; a reset data transfer controller including an ECC decoder, the reset data transfer controller executing data transfer from the memory unit to the register unit via the ECC decoder when the semiconductor chip is started up; a system controller for controlling the processor, the memory controller, and the reset data transfer controller; Equipped with the memory unit has a first memory in which data necessary for initial setting of the semiconductor chip is stored; the register unit includes a first register referenced in an initial setting of the semiconductor chip, and a second register for verifying the first register; the reset data transfer controller executes N data transfers, N being an integer equal to or greater than 2, and during a first data transfer, transfers the data stored in the first memory to the first register via the ECC decoder, and during an Nth data transfer, transfers the data stored in the first memory to the second register via the ECC decoder; the ECC decoder determines whether or not an error can be corrected based on an error correction code added to the data, and if the error can be corrected, transfers the data after the error correction, and if the error cannot be corrected, outputs an ECC error signal to the system controller; the first comparison circuit determines whether the data transferred to the first register and the data transferred to the second register match or not, and outputs a determination result signal indicative of the determination result to the system controller; The system controller includes: If the determination result signal indicates a mismatch, the reset data transfer controller is caused to execute the N data transfers again; when the ECC error signal is input, a data recovery request for recovering the data stored in the first memory is output to an outside of the semiconductor chip; booting up the processor when the determination result signal indicates a match without inputting the ECC error signal; Semiconductor device.
7. 7. The semiconductor device according to claim 6, the system controller stores in the first memory the number of recoveries executed in response to the data recovery request; The memory unit further includes a second memory in which a preset upper limit value of the number of recoveries is stored, the reset data transfer controller further has a second comparison circuit that determines whether the number of recoveries stored in the first memory has reached the upper limit value stored in the second memory, and outputs a recovery error signal to the system controller when the number of recoveries has reached the upper limit value; the system controller controls at least the processor not to be started when the recovery error signal is input; Semiconductor device.
8. 7. The semiconductor device according to claim 6, the system controller causes the reset data transfer controller to execute the N data transfers again, and then starts up the processor when the determination result signal indicates a match without inputting the ECC error signal; Semiconductor device.
9. 9. The semiconductor device according to claim 8, the reset data transfer controller further includes a random number generation circuit that generates a value of N as a random number every time the N number of data transfers are executed. Semiconductor device.
10. 9. The semiconductor device according to claim 8, the reset data transfer controller sequentially overwrites the data stored in the first memory to the second register during a second to Nth data transfer, when a value of N is an integer equal to or greater than 3; Semiconductor device.
11. 7. The semiconductor device according to claim 6, The first memory is composed of a rewritable non-volatile memory. Semiconductor device.
12. 8. The semiconductor device according to claim 7, the first memory is composed of a rewritable non-volatile memory, The second memory is composed of a non-volatile memory that can be written only once. Semiconductor device.