Semiconductor device, encryption device, and electronic apparatus

Abstract

To achieve a semiconductor device which has high security against both a power analysis attack and an electromagnetic field analysis attack and supplies power to an encryption circuit.SOLUTION: A semiconductor device (101) supplies power to an encryption circuit (102) and comprises: a voltage generation unit (1) including a series regulator (5) and a shunt regulator (6); and a control unit (2) which switches the shunt regulator (6) between an on state and an off state at random.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to a semiconductor device, a cryptographic device, and an electronic device.

Background Art

[0002] As specific methods of side-channel attacks that utilize information leakage from semiconductor devices, power analysis attacks and electromagnetic field analysis attacks are known. A power analysis attack is to estimate secret information by analyzing changes in power consumption. An electromagnetic field analysis attack is to estimate secret information by analyzing changes in the electromagnetic field radiated from a target device.

[0003] In a power analysis attack, by utilizing the fact that the power consumption of a cryptographic circuit that performs at least one of data encryption and data decryption is correlated with the processing content of the cryptographic circuit, the temporal change in power consumption that occurs during the operation of the circuit is measured, and the waveform is processed and processed to estimate secret information such as a secret key. As power analysis attacks, simple power analysis (SPA) that estimates a cryptographic key or the like by analyzing one or more measured power waveforms, differential power analysis (DPA) that estimates a cryptographic key or the like by statistically processing the difference in power waveforms, and correlation power analysis (CPA) that estimates a cryptographic key or the like by calculating the correlation value of the Hamming distance from the estimated key are known.

[0004] Since electromagnetic analysis attacks can analyze local power changes in semiconductor devices through electromagnetic fields, they have become a greater threat in recent years than power analysis attacks. In electromagnetic analysis attacks, analysis can be performed from data obtained using an electromagnetic field probe or the like. A method that uses an electromagnetic field instead of power in simple power analysis is simple electromagnetic analysis (SEMA). A method that uses an electromagnetic field instead of power in differential power analysis is differential electromagnetic analysis (DEMA). A method that uses an electromagnetic field instead of power in correlation power analysis is correlation electromagnetic analysis (CEMA).

[0005] As a countermeasure against side-channel attacks, Non-Patent Document 1 discloses a technique of connecting a shunt-type LDO to an encryption circuit to keep the current supplied from the power line constant and suppress the leakage of side-channel information. LDO is an abbreviation for Low Drop Out and is a type of regulator.

Prior Art Documents

Non-Patent Documents

[0006]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0007] In the technology disclosed in Non-Patent Document 1, there is a risk of low security against electromagnetic field analysis attacks. This is because a change in the current value of a local part that operates to keep the consumption current constant in a shunt type LDO may become side channel information. As an example of a combination of a local part and a change in the current value of the local part, a combination of a shunt resistor and a shunt current flowing through the shunt resistor can be cited.

[0008] In recent years, the sensitivity of electromagnetic field probes has also improved. For this reason, even if the change in the consumption current value by the shunt type LDO becomes small, there is a risk that an encryption key or the like may be estimated from a change in the local electromagnetic field of the semiconductor device by increasing the sensitivity of the electromagnetic field probe.

Means for Solving the Problems

[0009] A semiconductor device according to one aspect of the present disclosure is a semiconductor device that supplies power to an encryption circuit, and includes a voltage generation unit including a series regulator and a shunt regulator, and a control unit that randomly switches between an on state and an off state of the shunt regulator.

Effects of the Invention

[0010] According to one aspect of the present disclosure, it is possible to realize a semiconductor device or the like that supplies power to an encryption circuit and has high security against both power analysis attacks and electromagnetic field analysis attacks.

Brief Description of the Drawings

[0011]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Mode for Carrying Out the Invention

[0012] A mode for carrying out the present disclosure will be described. For convenience of explanation, members having the same functions as the members described above may be denoted by the same reference numerals, and the description thereof may not be repeated.

[0013] 〔Embodiment 1〕 FIG. 1 is a block diagram showing a schematic configuration of an encryption device 201 according to Embodiment 1 of the present disclosure. The encryption device 201 includes a semiconductor device 101 and an encryption circuit 102. The encryption circuit 102 is powered by the semiconductor device 101. The encryption circuit 102 performs at least one of data encryption and data decryption. That is, the encryption circuit 102 may perform only one of data encryption and data decryption, or may perform both data encryption and data decryption. The semiconductor device 101 is included in the scope of the present disclosure, and the encryption device 201 is also included in the scope of the present disclosure.

[0014] According to the operation content of the encryption circuit 102, the current value flowing through at least a part of the semiconductor device 101 changes, and this change in the current value can be side-channel information.

[0015] The semiconductor device 101 supplies power to an encryption circuit 102 that performs at least one of data encryption and data decryption. The semiconductor device 101 includes a voltage generation unit 1, a control unit 2, a random number generation circuit 3, and a random pattern generation circuit 4.

[0016] The voltage generation unit 1 has a series regulator 5, a shunt regulator 6, a current feedback circuit 7, a power supply terminal 51, and an output terminal 52. The control unit 2 randomly switches the on state and the off state of the shunt regulator 6.

[0017] The randomness in this embodiment is preferably true randomness, but may be pseudo-randomness realized by a well-known technique. The random number in this embodiment is preferably a true random number, but may be a pseudo-random number realized by a well-known technique.

[0018] One end of the series regulator 5 is connected to the power supply terminal 51. The other end of the series regulator 5 is connected to the output terminal 52. One end of the shunt regulator 6 is connected between the power supply terminal 51 and the series regulator 5. The other end of the shunt regulator 6 is connected to the control unit 2. The current feedback circuit 7 is connected between the series regulator 5 and the shunt regulator 6. The power supply terminal 51 is connected to a power supply (not shown). The output terminal 52 is connected to the encryption circuit 102.

[0019] The series regulator 5 and the shunt regulator 6 operate to convert the voltage (voltage value VCC) input from the power supply circuit 103 to the power supply terminal 51 into the voltage (voltage value VDD) output from the output terminal 52. An example of the series regulator 5 is a series LDO, and an example of the shunt regulator 6 is a shunt LDO. The voltage (voltage value VDD) output from the output terminal 52 is applied to the encryption circuit 102.

[0020] When the shunt regulator 6 is in the on state, the current feedback circuit 7 flows a current corresponding to the output current of the series regulator 5 to the shunt regulator 6.

[0021] FIG. 2 is a circuit diagram showing a configuration example of the voltage generation unit 1 according to Embodiment 1 of the present disclosure. The series regulator 5 includes a transistor 53 and an operational amplifier 54. The shunt regulator 6 includes a shunt resistor 55, resistors 56 to 58, a transistor 59, and an operational amplifier 60. The current feedback circuit 7 includes transistors 61 to 65 and a current source 66.

[0022] A specific example of the method in which the control unit 2 randomly switches between the on state and the off state of the shunt regulator 6 is as follows. The control unit 2 outputs a signal in which high and low randomly switch as an enable signal EN, and supplies the enable signal EN to the enable terminal 67 of the operational amplifier 60. When the enable signal EN supplied to the enable terminal 67 is high, the operational amplifier 60 is enabled, and the shunt regulator 6 is turned on. When the enable signal EN supplied to the enable terminal 67 is low, the operational amplifier 60 is disabled, and the shunt regulator 6 is turned off.

[0023] In this way, the control unit 2 may randomly switch between the on state and the off state of the shunt regulator 6 by randomly switching between enabling and disabling the operational amplifier 60 provided in the shunt regulator 6.

[0024] In the on state of the shunt regulator 6, in accordance with the current flowing from the transistor 53 of the series regulator 5, the shunt regulator 6 maintains equilibrium while reducing the shunt current stored in advance. Thereby, the voltage generation unit 1 performs an operation of keeping the current value seen from the power supply terminal 51 constant. In the off state of the shunt regulator 6, only the series regulator 5 operates.

[0025] When randomly switching between the on state and the off state of the shunt regulator 6, both the current value seen from the power supply terminal 51 and the value of the shunt current randomly change. Thereby, it is possible to realize a semiconductor device 101 that supplies power to a cryptographic circuit and has high security against both power analysis attacks and electromagnetic field analysis attacks.

[0026] FIG. 3 is a timing chart showing an example of a current waveform seen from the power supply terminal 51 and an analysis result by a power analysis attack when power is supplied to the cryptographic circuit 102 by the series regulator 5.

[0027] When power is supplied to the encryption circuit 102 by the series regulator 5, the current value seen from the power supply terminal 51 changes depending on the operation of the encryption circuit 102. In other words, a pattern corresponding to the private key appears in the current waveform seen from the power supply terminal 51. Therefore, when power is supplied to the encryption circuit 102 by the series regulator 5, it is possible to estimate the private key through a power analysis attack. The analysis result of the power analysis attack is a pattern of 0s and 1s shown in FIG. 3 that matches the private key.

[0028] FIG. 4 is a timing chart showing an example of a current waveform seen from the power supply terminal 51 when power is supplied to the encryption circuit 102 by the shunt regulator 6. In FIG.

[0029] When power is supplied to the encryption circuit 102 by the shunt regulator 6, the current value seen from the power supply terminal 51 becomes nearly constant due to the shunt effect, making it difficult to estimate the private key through a power analysis attack.

[0030] FIG. 5 is a timing chart showing an example of the waveform of a shunt current and an example of the analysis result of an electromagnetic field analysis attack when power is supplied to the encryption circuit 102 by the shunt regulator 6. In FIG.

[0031] When power is supplied to the encryption circuit 102 by the shunt regulator 6, a pattern corresponding to the private key appears, albeit slightly, in the current waveform of the shunt resistor 55 built into the shunt regulator 6. Therefore, when power is supplied to the encryption circuit 102 by the shunt regulator 6, it is possible to estimate the private key through an electromagnetic field analysis attack by acquiring data on the current waveform of the shunt resistor 55 using a highly sensitive electromagnetic field probe. The analysis result of the electromagnetic field analysis attack is a pattern of 0s and 1s shown in Figure 5, which matches the private key.

[0032] FIG. 6 is a timing chart showing an example of a current waveform as seen from power supply terminal 51 and an analysis result by a power analysis attack when the semiconductor device 101 supplies power to the encryption circuit 102. FIG. 7 is a timing chart showing an example of a waveform of a shunt current and an analysis result by an electromagnetic field analysis attack when the semiconductor device 101 supplies power to the encryption circuit 102. In FIGS. 6 and 7, "-" means that 0 and 1 cannot be correctly estimated by analysis.

[0033] When the semiconductor device 101 supplies power to the encryption circuit 102, the current waveform as seen from the power supply terminal 51 corresponds to FIG. 3 during the OFF period of the shunt regulator 6. When the semiconductor device 101 supplies power to the encryption circuit 102, the current waveform as seen from the power supply terminal 51 is clamped by the shunt current during the ON period of the shunt regulator 6.

[0034] From the following viewpoints (1) to (3), when the semiconductor device 101 supplies power to the encryption circuit 102, it is difficult to estimate the secret key by a power analysis attack from the current waveform as seen from the power supply terminal 51.

[0035] (1) The amount of change in the current value as seen from the power supply terminal 51 is large between the ON state and the OFF state of the shunt regulator 6.

[0036] (2) Each time the semiconductor device 101 supplies power to the encryption circuit 102, the current waveform as seen from the power supply terminal 51 is different. When such current waveforms are traced multiple times, the content of the information that can be obtained each time is different, so the value as side-channel information is almost zero.

[0037] (3) When the semiconductor device 101 supplies power to the encryption circuit 102, the current waveform as seen from the power supply terminal 51 corresponds to information with some information missing from the secret key.

[0038] When power is supplied to the encryption circuit 102 by the semiconductor device 101 from the following viewpoints (A) and (B), it is difficult to estimate the secret key by electromagnetic field analysis attack from the waveform of the shunt current.

[0039] (A) Each time power is supplied to the encryption circuit 102 by the semiconductor device 101, the waveform of the shunt current is different. When such waveforms are traced multiple times, the content of the information that can be obtained each time of tracing is different, so the value as side-channel information is almost zero.

[0040] (B) In the off state of the shunt regulator 6, since no shunt current flows, the waveform of the shunt current when power is supplied to the encryption circuit 102 by the semiconductor device 101 corresponds to information with some information missing from the secret key.

[0041] Here, regarding the mechanism for keeping the current seen from the power supply terminal 51 constant when the shunt regulator 6 included in the voltage generation unit 1 of the present application is in the on state, it will be described using mathematical formulas together with the relationship between the current feedback circuit 7, the shunt regulator 6, and the series regulator 5.

[0042] Let the difference between the potential V0 on the shunt resistor 55 side and the potential V1 on the transistor 64 side in the resistor 56 be ΔV. Assume that the resistance value of the shunt resistor 55 is Rs and the resistance value of the resistor 56 is 128Rs (128 times the resistance value Rs). Assume that the size of the transistor 61 is 1 / 128 of the size of the transistor 53. Let the value of the current flowing through the series regulator 5, in other words, the value of the current flowing through the transistor 53, be Ireg. Let the value of the current flowing through the transistors 64 and 65 be Ireg / 128 (1 / 128 of the current value Ireg). In these cases, the following mathematical formula (1) holds.

[0043] ΔV = V0 - V1 = (Ireg / 128)×128Rs = Ireg×Rs ···(1) When the current value Ireg is 0, the shunt current Is is represented by the following mathematical formula (2) using the voltage value VCC.

[0044] Is = (VCC - V1) / Rs ···(2) Based on the following mathematical formula (3), the shunt current Is´ is defined.

[0045] Is´ = (VCC - V1 - ΔV) / Rs = (VCC - V1 - Rs×Ireg) / Rs = ((VCC - V1) / Rs) - Ireg ···(3) Referring to the above mathematical formulas (2) and (3), the following mathematical formula (4) holds.

[0046] Is´ = Is - Ireg ···(4) In the semiconductor device 101, when a load current with a current value of Ireg flows through the series regulator 5, the value of the shunt current decreases by that amount. In the semiconductor device 101, the current change associated with the load current is canceled out, and the current value seen from the power supply terminal 51 can be kept constant.

[0047] In the above, an example of feeding back a current with a current value of 1 / 128 of the current value Ireg has been described with reference to mathematical formulas (1) to (4), but the ratio of 1 / 128 may be changed according to the characteristics of the encryption device 201. For example, the ratio may be 1 / 64. When the ratio is 1 / 64, the resistance value of the resistor 56 may be 64Rs (64 times the resistance value Rs).

[0048] Generally, in a circuit that does not take countermeasures against side-channel attacks, there is a risk that the secret key may be estimated by a power analysis attack, so various countermeasures have been devised. As one of these methods, a method of clamping the power supply voltage by a shunt type LDO is considered. This method has the effect of suppressing the variation of the current that appears at the power supply terminal, which is the measurement target of the power analysis attack, so it becomes difficult to estimate the secret key.

[0049] However, different from power analysis attacks, in electromagnetic field analysis attacks, by applying an electromagnetic field probe to any location on the semiconductor chip, changes in the voltage value or current value of a local part can be captured as changes in the electric field or magnetic field. Therefore, while the shunt-type LDO is operating, by applying an electromagnetic field probe to a local part such as the shunt resistor built into the shunt-type LDO, it is possible to observe changes in the minute current value flowing through the shunt resistor. The change in the minute current value flowing through the shunt resistor corresponds to the secret key, and there is a risk that the secret key can be estimated from this waveform. In recent years, since the sensitivity of electromagnetic field probes has also improved, electromagnetic field analysis attacks pose a greater threat than power analysis attacks.

[0050] Therefore, in the semiconductor device 101, the on-state and off-state of the shunt regulator 6 are controlled using a random pattern signal or the like according to a random number. Thereby, a function can be realized that corresponds to randomly omitting some information from the secret key each time.

[0051] Even if the radiated electromagnetic field signal is analyzed, it has almost no value as side-channel information.

[0052] For example, when a power analysis attack is performed from the power supply terminal 51, the side-channel information associated with the power change is scrambled by a random pattern, and different patterns appear each time even if measured multiple times, making it difficult to estimate the secret key.

[0053] Also, even if a change in the current value in a local part such as the shunt resistor 55 is captured by an electromagnetic field analysis attack, due to the change in the current value of the shunt regulator 6 operating randomly, only information with some information missing from the secret key can be obtained. Therefore, even for the information obtained by measuring the change in the current value in the local part multiple times, it has almost no value as side-channel information. Thus, it becomes difficult to estimate the secret key even if a side-channel attack is performed.

[0054] The control unit 2 may operate the shunt regulator 6 in each of a first operation mode in which the shunt regulator 6 is maintained in an on state and a second operation mode in which the shunt regulator 6 is maintained in an off state. Throughout the period of the first operation mode, the enable signal EN supplied to the enable terminal 67 may be fixed high, so that the operational amplifier 60 may be fixed in an enabled state. Throughout the period of the second operation mode, the enable signal EN supplied to the enable terminal 67 may be fixed low, so that the operational amplifier 60 may be fixed in a disabled state.

[0055] The control unit 2 may operate the shunt regulator 6 in the first operation mode or the second operation mode during the operation of the encryption circuit 102 in the low security mode. The control unit 2 may randomly switch the on state and the off state of the shunt regulator 6 during the operation of the encryption circuit 102 in the high security mode.

[0056] When the encryption circuit 102 does not perform an encryption process or a decryption process, etc., during the operation of the encryption circuit 102 in the low security mode, there is no need to randomly switch the on state and the off state of the shunt regulator 6. Therefore, during the operation of the encryption circuit 102 in the low security mode, by operating the shunt regulator 6 in the first operation mode or the second operation mode, the operation of the semiconductor device 101 can be simplified.

[0057] The semiconductor device 101 may include a random number generation circuit 3 that generates a random number and a random pattern generation circuit 4 that generates a random pattern according to the random number generated by the random number generation circuit 3. The control unit 2 may switch the on state and the off state of the shunt regulator 6 according to the random pattern generated by the random pattern generation circuit 4. Thereby, a configuration in which the control unit 2 randomly switches the on state and the off state of the shunt regulator 6 can be easily realized.

[0058] The random number generation circuit 3 is preferably a circuit that generates true random numbers, but it may also be a well-known pseudo-random number circuit that generates pseudo-random numbers.

[0059] FIG. 8 is a circuit diagram showing a configuration example of the random number generation circuit 3. The random number generation circuit 3 may be an analog random number generation circuit such as a self-running 1-bit random number generation circuit 1001, or it may be an M-sequence generation circuit 1002. The M-sequence length in the M-sequence generation circuit 1002 shown in FIG. 8 is 2 7 -1 = 127, but the M-sequence length in the M-sequence generation circuit is not limited to 127.

[0060] The self-running 1-bit random number generation circuit 1001 includes a circuit 72 formed by connecting 4 to 6 sets of circuits 71 each consisting of a resistor 68, an inverter 69, and a capacitor 70 in series, and a level shifter 73 connected to the output terminal of the circuit 72. The M-sequence generation circuit 1002 includes a shift register 74 formed by connecting 7 D flip-flops in series, and an XOR circuit 75 connected to the shift register 74.

[0061] Including the self-running 1-bit random number generation circuit 1001 and the M-sequence generation circuit 1002 respectively, the random number generation circuit 3 can be realized by well-known techniques, so detailed descriptions thereof are omitted.

[0062] FIG. 9 is a circuit diagram 1003 showing a configuration example of the random pattern generation circuit 4 and a timing chart 1004 of the output signal of the random pattern generation circuit 4. The random pattern generation circuit 4 includes a D flip-flop 76. The D terminal of the D flip-flop 76 is connected to the output terminal of the random number generation circuit 3. The signal output from the Q terminal of the D flip-flop 76 is supplied to the control unit 2. A clock is input to the CK terminal of the D flip-flop 76. The random pattern generation circuit 4 generates a random pattern according to the random number generated by the random number generation circuit 3 input to the D terminal, and outputs this random pattern from the Q terminal to the control unit 2.

[0063] The clock input to the CK terminal of the D flip-flop 76 may be synchronized with the operation clock of the encryption circuit 102. The operation timing of the random pattern generation circuit 4 may be synchronized with the operation timing of the encryption circuit 102. As a result, there is no need to prepare a circuit that generates the clock input to the CK terminal of the D flip-flop 76 separately from the circuit that generates the operation clock of the encryption circuit 102, so the configuration of the semiconductor device 101 can be simplified.

[0064] The clock input to the CK terminal of the D flip-flop 76 and the operation clock of the encryption circuit 102 may be asynchronous. The operation timing of the random pattern generation circuit 4 may be asynchronous with the operation timing of the encryption circuit 102.

[0065] FIG. 10 is a circuit diagram 1005 showing a configuration example of the control unit 2 and a timing chart 1006 of the output signal of the control unit 2. The control unit 2 includes a multiplexer 77. The first input terminal of the multiplexer 77 is connected to the output terminal of the random pattern generation circuit 4. A signal fixed to high or a signal fixed to low is input to the second input terminal of the multiplexer 77. A selection signal is input to the multiplexer 77, and in the multiplexer 77, according to this selection signal, it is determined whether to output the signal input to the first input terminal or the signal input to the second input terminal. The signal output from the multiplexer 77 corresponds to the enable signal EN supplied to the enable terminal 67.

[0066] In the random pattern input of the timing chart 1006, the control unit 2 outputs, as the enable signal EN, a signal that randomly switches the on state and the off state of the shunt regulator 6 according to the random pattern input to the first input terminal of the multiplexer 77. In the high input of the timing chart 1006, the control unit 2 outputs, as the enable signal EN, a signal that operates the shunt regulator 6 in the first operation mode according to the signal fixed to high input to the second input terminal of the multiplexer 77. In the low input of the timing chart 1006, the control unit 2 outputs, as the enable signal EN, a signal that operates the shunt regulator 6 in the second operation mode according to the signal fixed to low input to the second input terminal of the multiplexer 77. A part of the timing chart 1006 also shows the on state and the off state of the shunt regulator 6 in accordance with the timing.

[0067] The control unit 2 may be configured by hardware or may be configured by software.

[0068] The shunt regulator 6 may have a shunt resistor 55 with a variable resistance value, which is connected to a power supply terminal 51 to which an input voltage to the voltage generation unit 1 is applied. As a result, the value of the shunt current becomes variable, making it more difficult to estimate the secret key by an electromagnetic field analysis attack and enabling the security against the electromagnetic field analysis attack to be enhanced.

[0069] By randomly switching (X) and (Y), the waveforms of both the current seen from the power supply terminal 51 and the current in a local part (e.g., the shunt resistor 55) can be disturbed. Therefore, a highly secure cryptographic device 201 can be realized against both power analysis attacks and electromagnetic field analysis attacks.

[0070] (X) In the on state of the shunt regulator 6, since the shunt regulator 6 operates, the current value seen from the power supply terminal 51 becomes constant, and the current value of the local part may become slightly responsive to the operation content of the cryptographic circuit 102.

[0071] (Y) In the off state of the shunt regulator 6, only the series regulator 5 operates, so the current value seen from the power supply terminal 51 can correspond to the operation content of the encryption circuit 102, and the current value of the local part becomes constant.

[0072] [Embodiment 2] FIG. 11 is a block diagram showing a schematic configuration of the encryption device 201 according to Embodiment 2 of the present disclosure. FIG. 12 is a circuit diagram showing a configuration example of the voltage generation unit 1 according to Embodiment 2 of the present disclosure. As in Embodiment 2 of the present disclosure, the shunt regulator 6 may be connected to the output terminal of the series regulator 5, and in this case, it may not have the resistor 56 (see FIG. 2).

[0073] [Embodiment 3] FIG. 13 is a block diagram showing a schematic configuration of the electronic device 301 according to Embodiment 3 of the present disclosure. The electronic device 301 including the encryption device 201 is also included in the scope of the present disclosure. Examples of the electronic device 301 include an authentication device (e.g., IC card and SIM card), a wireless communication device of a mobile phone, a wireless communication device for satellite communication, and an IoT device for Internet connection. IC is an abbreviation for Integrated Circuit. SIM is an abbreviation for Subscriber Identity Module. IoT is an abbreviation for Internet of Things. All devices that handle encryption can be an example of the electronic device 301.

[0074] [Summary] The semiconductor device according to Aspect 1 of the present disclosure is a semiconductor device that supplies power to an encryption circuit, and includes a voltage generation unit including a series regulator and a shunt regulator, and a control unit that randomly switches between the on state and the off state of the shunt regulator.

[0075] In the semiconductor device according to Embodiment 2 of the present disclosure, in Embodiment 1, the control unit operates the shunt regulator by a first operation mode for maintaining the shunt regulator in an on state and a second operation mode for maintaining the shunt regulator in an off state, respectively.

[0076] In the semiconductor device according to Embodiment 3 of the present disclosure, in Embodiment 2, when the control unit operates in the low security mode of the encryption circuit, the control unit operates the shunt regulator by the first operation mode or the second operation mode, and when the control unit operates in the high security mode of the encryption circuit, the control unit randomly switches the on state and the off state of the shunt regulator.

[0077] The semiconductor device according to Embodiment 4 of the present disclosure includes, in any one of Embodiments 1 to 3, a random number generation circuit that generates a random number and a random pattern generation circuit that generates a random pattern according to the random number, and the control unit switches the on state and the off state of the shunt regulator according to the random pattern.

[0078] In the semiconductor device according to Embodiment 5 of the present disclosure, in Embodiment 4, the operation timing of the random pattern generation circuit is synchronized with the operation timing of the encryption circuit.

[0079] The semiconductor device according to Embodiment 6 of the present disclosure includes, in any one of Embodiments 1 to 5, a current feedback circuit in which the voltage generation unit passes a current corresponding to the output current of the series regulator to the shunt regulator in an on state of the shunt regulator.

[0080] The semiconductor device according to Embodiment 7 of the present disclosure includes, in any one of Embodiments 1 to 6, a shunt regulator having a shunt resistor with a variable resistance value connected to a terminal to which an input voltage to the voltage generation unit is applied.

[0081] The semiconductor device according to aspect 8 of the present disclosure is, in any one of aspects 1 to 7, wherein the shunt regulator is connected to the output terminal of the series regulator.

[0082] The encryption device according to aspect 9 of the present disclosure is, in any one of aspects 1 to 8, comprising the semiconductor device and an encryption circuit powered by the semiconductor device.

[0083] The electronic device according to aspect 10 of the present disclosure is, in aspect 9, comprising the encryption device.

[0084] The present disclosure is not limited to the above-described embodiments, and various modifications are possible within the scope shown in the claims. Embodiments obtained by appropriately combining the technical means disclosed in different embodiments are also included in the technical scope of the present disclosure. Furthermore, by combining the technical means disclosed in each embodiment, new technical features can be formed.

Description of Reference Numerals

[0085] 1 Voltage generation unit 2 Control unit 3 Random number generation circuit 4 Random pattern generation circuit 5 Series regulator 6 Shunt regulator 7 Current feedback circuit 55 Shunt resistor 101 Semiconductor device 102 Encryption circuit 201 Encryption device 301 Electronic device

Claims

1. A semiconductor device that supplies power to an encryption circuit, comprising: a voltage generation unit including a series regulator and a shunt regulator; a control unit that randomly switches between an on state and an off state of the shunt regulator.

2. The semiconductor device according to claim 1, wherein the control unit operates the shunt regulator in each of a first operation mode in which the shunt regulator is maintained in an on state and a second operation mode in which the shunt regulator is maintained in an off state.

3. The control unit operates the shunt regulator in the first operation mode or the second operation mode when the encryption circuit operates in a low security mode, The semiconductor device according to claim 2, wherein the control unit randomly switches between an on state and an off state of the shunt regulator when the encryption circuit operates in a high security mode.

4. a random number generation circuit that generates a random number; a random pattern generation circuit that generates a random pattern according to the random number, The semiconductor device according to claim 1, wherein the control unit switches between an on state and an off state of the shunt regulator according to the random pattern.

5. The semiconductor device according to claim 4, wherein the operation timing of the random pattern generation circuit is synchronized with the operation timing of the encryption circuit.

6. The semiconductor device according to claim 1, wherein the voltage generation unit has a current feedback circuit that causes a current corresponding to an output current of the series regulator to flow to the shunt regulator when the shunt regulator is in an on state.

7. The semiconductor device according to claim 1, wherein the shunt regulator has a shunt resistor with a variable resistance value, which is connected to a terminal to which an input voltage to the voltage generation unit is applied.

8. The semiconductor device according to claim 1, wherein the shunt regulator is connected to an output terminal of the series regulator.

9. An encryption device comprising the semiconductor device according to any one of claims 1 to 8, and an encryption circuit powered by the semiconductor device.

10. An electronic device comprising the encryption device according to claim 9.

Images