Semiconductor device

Abstract

To provide a method of restricting access from the outside to software in a semiconductor device in which the software is stored in a nonvolatile memory.SOLUTION: A semiconductor device X includes a nonvolatile memory 2x, a restriction control circuit 8, and a communication circuit 4 connected to the restriction control circuit 8 and configured to access the nonvolatile memory 2x via the restriction control circuit 8. The nonvolatile memory 2x includes a first storage area 5 configured to be accessible from the communication circuit 4 via the restriction control circuit 8, and a second storage area 9 storing restriction parameters. The restriction control circuit 8 is configured to switch to either a first state for blocking access of the communication circuit 4 to the first storage area 5, or a second state for permitting access of the communication circuit 4 to the first storage area 5 in accordance with the restriction parameter.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The invention disclosed herein relates to a semiconductor device. [Background technology]

[0002] Conventionally, semiconductor devices equipped with software such as a microcomputer, as described in Patent Document 1, have had certain restrictions imposed on them so that the software cannot be accessed from outside after it has been shipped from the factory after going through the production process. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2023-24053

[0004] [overview] In the semiconductor device described above, there is room for further study regarding the method of restricting access to the software from the outside.

[0005] The semiconductor device disclosed herein includes a nonvolatile memory, a limiting control circuit, and a communication circuit. The communication circuit is connected to the limiting control circuit and configured to establish communication with the nonvolatile memory via the limiting control circuit. The nonvolatile memory includes a first storage area accessible from the communication circuit via the limiting control circuit and a second storage area storing a limiting parameter. The limiting control circuit is configured to be switchable between a first state that blocks access to the first storage area from the communication circuit and a second state that allows access to the first storage area from the communication circuit, depending on the limiting parameter. [Brief explanation of the drawings]

[0006] [Figure 1] FIG. 1 is a diagram showing a semiconductor device Y according to a comparative example. [Figure 2] FIG. 2 is a diagram showing a semiconductor device X according to the present disclosure.

[0007] [Detailed explanation] <Regarding Semiconductor Device Y of Comparative Example> First, the semiconductor device Y will be described as a comparative example to the semiconductor device X of the present disclosure. Next, problems with the comparative example will be described, followed by a description of the semiconductor device X of the present disclosure.

[0008] 1 is a diagram showing a semiconductor device Y according to a comparative example. The semiconductor device Y is a semiconductor integrated circuit (=IC [Integrated Circuit]) mounted on a predetermined electronic device. The semiconductor device Y includes a microcomputer 1, a nonvolatile memory 2y, a readout circuit 3, and a communication circuit 4.

[0009] The microcomputer 1 is configured to control predetermined functions of an electronic device in which the semiconductor device Y is mounted. The microcomputer 1 operates in accordance with firmware FW, which will be described later.

[0010] The nonvolatile memory 2y is an EEPROM (Electrically Erasable Programmable ROM) that can store data in a nonvolatile manner. The nonvolatile memory 2y has a firmware area 5. The firmware area 5 is assigned a memory address as an area where firmware FW is stored.

[0011] The firmware FW stored in the firmware area 5 may be either provisional or formal. Specifically, provisional firmware FW is stored during the production stage before the semiconductor device Y is shipped from the factory. On the other hand, formal firmware FW is stored when the semiconductor device Y is shipped from the factory.

[0012] The provisional firmware FW is configured to be accessible from outside the semiconductor device Y. The formal firmware FW is configured to restrict access from outside the semiconductor device Y.

[0013] Official firmware FW may be configured so that it cannot be accessed from the outside at all. However, it is possible to set access permissions that allow access when certain conditions are met. When setting such access restrictions, the official firmware FW is programmed to include program information that defines the access restriction settings.

[0014] Before shipping from the factory, temporary firmware FW is stored in the firmware area 5 so that the firmware area 5 can be accessed from outside as required for manufacturing. On the other hand, at the shipping stage from the factory, the temporary firmware FW is deleted and the official firmware FW is stored in the firmware area 5 to prevent malicious reading, modification, deletion, etc. of the firmware FW.

[0015] The read circuit 3 is connected between the microcomputer 1 and the nonvolatile memory 2y. The read circuit 3 is configured to access the firmware area 5 at a predetermined timing (for example, when the microcomputer 1 is started up, or when an instruction to read the firmware FW is received from the microcomputer 1, etc.) and read the firmware FW. The microcomputer 1 executes the firmware FW read by the read circuit 3.

[0016] The read circuit 3 includes a temporary storage device 3a and a downloader 3b. The temporary storage device 3a is a volatile memory (e.g., SRAM (Static RAM) or DRAM (Dynamic RAM)) that can temporarily store predetermined data. The downloader 3b accesses the firmware area 5, reads out the firmware FW, and stores it in the temporary storage device 3a. The microcomputer 1 reads the firmware FW from the temporary storage device 3a and executes it.

[0017] The communication circuit 4 is connected to the nonvolatile memory 2y. The communication circuit 4 is configured to access (write / read data to) the nonvolatile memory 2y in response to a communication signal S1 (more specifically, a command code and an address code included in the communication signal S1) input from outside the semiconductor device Y.

[0018] The communication circuit 4 includes an interface 6 and a controller circuit 7. The interface 6 has an external terminal T1 for establishing communication with the outside of the semiconductor device Y. The interface 6 is configured to comply with, for example, the LIN (Local Interconnect Network) communication standard. The interface 6 inputs a communication signal S2 to the controller circuit 7 in response to a communication signal S1 input to the external terminal T1.

[0019] The controller circuit 7 is connected between the interface 6 and the nonvolatile memory 2y. The controller circuit 7 uses a general communication means (e.g., I 2 The firmware area 5 is accessed by a method conforming to serial communication such as I / O [Inter-Integrated Circuit] communication, SPI [Serial Peripheral Interface] communication, or parallel communication.

[0020] In response to the communication signal S2, the controller circuit 7 accesses (writes / reads data to / from) a predetermined address (address code included in the communication signal S2) of the nonvolatile memory 2y in accordance with the communication signal S2.

[0021] Specifically, the control signal S3 is generated in response to the communication signal S2 and input to the nonvolatile memory 2y. The control signal S3 is a digital signal composed of binary logic levels (= high level or low level). In response to the input control signal S3, the nonvolatile memory 2y writes data included in the control signal S3 to itself or outputs predetermined data stored therein to the controller circuit 7.

[0022] <Considerations on access restrictions to firmware area 5> Incidentally, a semiconductor device that restricts external access to the firmware area 5, such as the semiconductor device Y described above, must store different firmware FW before and after shipment from the factory in the firmware area 5. This may result in a decrease in production efficiency.

[0023] Furthermore, when the official firmware FW is stored in the firmware area 5, as described above, access to the firmware area 5 from outside the semiconductor device Y is restricted. If the official firmware FW is programmed so that it cannot be accessed from outside at all, the semiconductor device Y cannot be analyzed even without malicious intent. This results in restrictions such as being unable to analyze defects (failures, malfunctions, etc.) in the semiconductor device Y that occur after shipping from the factory.

[0024] Furthermore, when setting access restrictions that basically block external access and allow only specific access, there is a demand for specifying the content of the access restrictions for each user, rather than specifying them uniformly. However, to meet such a demand, it is necessary to program official firmware FW that includes different program information depending on the content of the access restrictions for each user, and to change the firmware FW stored in the firmware area 5 for each user. This leads to a decrease in production efficiency of the semiconductor device Y and an increase in manufacturing costs.

[0025] To address such problems, the semiconductor device X of the present disclosure allows external access to the firmware area 5 while imposing predetermined access restrictions, thereby making it possible to suppress a decrease in production efficiency and an increase in manufacturing costs. The semiconductor device X according to each embodiment of the present disclosure will be described in detail below. Note that the semiconductor device X according to each embodiment of the present disclosure includes configurations in common with the semiconductor device Y described above. For this reason, the same reference numerals are used to designate the common configurations, and descriptions thereof will be omitted.

[0026] <Regarding the semiconductor device X according to the embodiment of the present disclosure> 2 is a diagram showing a semiconductor device X according to an embodiment of the present disclosure. The semiconductor device X is a semiconductor integrated circuit (IC) mounted on a predetermined electronic device. The semiconductor device X includes a microcomputer 1, a nonvolatile memory 2x, a read circuit 3, a communication circuit 4, and a limit control circuit 8.

[0027] The nonvolatile memory 2x includes a firmware area 5 (first storage area) and a parameter area 9 (second storage area). The parameter area 9 is assigned a memory address as an area in which a limit parameter Pm (described later) is stored.

[0028] The restriction control circuit 8 is connected between the communication circuit 4 and the nonvolatile memory 2x. The restriction control circuit 8 is configured to block / allow access of the communication circuit 4 to the firmware area 5. Specifically, the restriction control circuit 8 is configured as follows.

[0029] The limit control circuit 8 is configured to switch between a first state and a second state according to the state of the parameter area 9 (more specifically, according to the limit parameter Pm stored in the parameter area 9). The first state is a state in which access to the firmware area 5 of the communication circuit 4 is blocked. The second state is a state in which access to the firmware area 5 of the communication circuit 4 is permitted. When the limit control circuit 8 is in the second state, the communication circuit 4 is able to access the firmware area 5 via the limit control circuit 8.

[0030] <Regarding the limiting parameter Pm> The restriction parameter Pm is a parameter that specifies the content of access restrictions to the firmware area 5 from outside the semiconductor device X. In other words, the restriction parameter Pm is a parameter that specifies the content of access to be blocked or allowed with respect to access to the firmware area 5 from the communication circuit 4.

[0031] For example, a case will be described in which the restriction parameter Pm stored in the parameter area 9 specifies an access restriction that basically blocks access to the firmware area 5 from outside the semiconductor device X and allows only access that satisfies predetermined conditions.

[0032] In this case, the restriction control circuit 8 reads out the communication signal S2 input to the communication circuit 4 and the restriction parameter Pm stored in the parameter area 9. The restriction control circuit 8 then determines whether the read communication signal S2 matches the condition for permitting access (or the condition for blocking access) defined in the restriction parameter Pm. If the restriction control circuit 8 blocks access, it enters the first state, and if it permits access, it enters the second state.

[0033] In this case, for example, the restriction control circuit 8 can be configured to enter a second state (a state in which access to the firmware area 5 of the communication circuit 4 is permitted) if the communication signal S2 contains a predetermined code (for example, a so-called magic code), and enter a first state (a state in which access to the firmware area 5 of the communication circuit 4 is blocked) if the communication signal S2 does not contain a predetermined code.

[0034] Next, a case will be described in which the restriction parameter Pm stored in the parameter area 9 specifies an access restriction that blocks all access to the firmware area 5 from outside the semiconductor device X. In this case, when the restriction control circuit 8 reads the restriction parameter Pm, the first state is entered regardless of the code included in the communication signal S2. At this time, the restriction control circuit 8 may be configured not to read the communication signal S2.

[0035] <Detailed configuration of limit control circuit 8> The limiting control circuit 8 includes a control circuit 10 and a limiting circuit 11 .

[0036] The control circuit 10 is connected between the interface 6 and the parameter area 9. The control circuit 10 is configured to be able to access the parameter area 9. The control circuit 10 receives a communication signal S2 from the interface 6. The control circuit 10 outputs a control signal S4 in accordance with at least the limit parameter Pm among the communication signal S2 and the limit parameter Pm stored in the parameter area 9. The control signal S4 is a digital signal composed of binary logic levels (= high level or low level).

[0037] When blocking access of the communication circuit 4 to the firmware area 5, the control circuit 10 causes the control signal S4 to fall to a low level. Conversely, when allowing access of the communication circuit 4 to the firmware area 5, the control circuit 10 causes the control signal S4 to rise to a high level.

[0038] Specifically, the control circuit 10 reads the limiting parameter Pm from the parameter area 9 and determines whether the code included in the communication signal S2 received by the control circuit 10 matches the code defined in the limiting parameter Pm. If they match, the control circuit 10 raises the control signal S4 to high level. If they do not match, the control signal S4 drops to low level.

[0039] If the restriction parameter Pm specifies an access restriction that prevents any access from outside the semiconductor device X, the control circuit 10 drops the control signal S4 to a low level based on the read restriction parameter Pm, regardless of the code contained in the communication signal S2.

[0040] The limiting circuit 11 is connected between the controller circuit 7 and the firmware area 5. The limiting circuit 11 has a first terminal a, a second terminal b, and a third terminal c.

[0041] The first terminal a is connected to the controller circuit 7. The second terminal b is connected to the control circuit 10. The third terminal c is connected to the nonvolatile memory 2x.

[0042] The first terminal a receives an input of a control signal S3, the second terminal b receives an input of a control signal S4, and the third terminal c outputs a control signal S5, which will be described later.

[0043] The limiting circuit 11 is an AND gate having a first terminal a and a second terminal b as input stages and a third terminal c as output stage. The limiting circuit 11 generates a control signal S5 in response to a control signal S3 input to the first terminal a and a control signal S4 input to the second terminal b, and outputs the control signal S5 from the third terminal c. Specifically, when the control signal S4 input to the second terminal b is at a high level, the logical level of the control signal S5 matches the logical level of the control signal S3.

[0044] The aforementioned phrase "the communication circuit 4 accesses the firmware area 5 via the restriction control circuit 8" can be interpreted as follows: That is, a control signal S5 corresponding to the control signal S3 generated by the communication circuit 4 is input to the nonvolatile memory 2x, and the communication circuit 4 is allowed to access the firmware area 5 in a manner corresponding to the control signal S3 (=communication signal S2). At this time, the control signal S3 is input to the firmware area 5. When writing data to the firmware area 5, the data included in the control signal S5 is written to the firmware area 5, and when reading data from the firmware area 5, the data stored in the firmware area 5 is output from the firmware area 5 in accordance with the data included in the control signal S5.

[0045] On the other hand, when the logic level of the control signal S4 input to the second terminal b is low, a low-level control signal S5 is output from the third terminal c regardless of the logic level of the control signal S3 input to the first terminal a. As a result, access to the firmware area 5 of the communication circuit 4 is not established (=access is blocked).

[0046] As described above, the access restriction to the communication circuit 4 to the firmware area 5 is based on the state of the parameter area 9 (more specifically, based on the restriction parameter Pm stored in the parameter area 9). That is, the content of the access restriction is determined by the restriction parameter Pm regardless of the program information of the firmware FW. Therefore, it is possible to store the same firmware FW in the firmware area 5 before and after shipment from the factory, and change only the restriction parameter Pm stored in the parameter area 9. That is, it is no longer necessary to prepare different firmware FW before and after shipment from the factory. Therefore, the semiconductor device X can suppress a decrease in production efficiency.

[0047] Furthermore, it is not necessary to program different firmware FW depending on the content of the access restriction. Therefore, the semiconductor device X can suppress a decrease in productivity and an increase in manufacturing costs while enabling various access restrictions to be set.

[0048] <Modification> The present invention is not limited to the above-described embodiment, and various modifications are possible without departing from the spirit of the present invention. For example, in the above-described embodiment, the microcomputer 1 executes the firmware read by the read circuit 3, but this is not limited to this. For example, the read circuit 3 can be omitted, and the microcomputer 1 can be directly connected to the nonvolatile memory 2x. In this case, the microcomputer 1 directly accesses the nonvolatile memory 2x and executes the firmware FW stored in the firmware area 5.

[0049] Furthermore, although the limiting circuit 11 is described as an AND gate, this is not limiting and other logic gates (e.g., NAND gates, NOR gates, XOR gates, XNOR gates, etc.) can be used. Even when a logic gate other than an AND gate is used, the limiting circuit 11 is configured so that in the first state (a state in which the communication circuit 4 is blocked from accessing the firmware area 5), ​​the control signal S5 (= a digital signal input to the firmware area 5) is at a low level regardless of the control signal S3 (= a digital signal input to the limiting circuit 11 by the communication circuit 4 in response to the communication signal S2). Furthermore, in the second state (a state in which the communication circuit 4 is allowed to access the firmware area 5), ​​the control signal S5 is configured to have the same logic level as the control signal S3.

[0050] <Additional Notes> The semiconductor device (X) disclosed in the specification includes a nonvolatile memory (2), a limiting control circuit (8), and a communication circuit (4) connected to the limiting control circuit (8) and configured to be able to access the nonvolatile memory (2) via the limiting control circuit (8). The nonvolatile memory (2) includes a first storage area (5) configured to be able to access the communication circuit (4) via the limiting control circuit (8), and a second storage area (9) in which a limiting parameter (Pm) is stored. The limiting control circuit (8) is configured to be switchable between a first state in which the communication circuit (4) blocks access to the first storage area (5) and a second state in which the communication circuit (4) allows access to the first storage area (5) depending on the limiting parameter (Pm) (first configuration).

[0051] In a semiconductor device (X) according to a first configuration, the communication circuit (4) may include an interface (6) configured to receive a communication signal (S1) from the outside, and a controller circuit (7) that accesses a first storage area (5) via a limit control circuit (8) based on the communication signal (S1) received by the interface (6), and the limit control circuit (8) may include a limit circuit (11) connected between the first storage area (5) and the controller circuit (7) and configured to be switchable between a first state and a second state, and a control circuit (10) connected to the limit circuit (11) and the second storage area (9) and configured to switch the limit circuit (11) between the first state and the second state according to a limit parameter (Pm) (second configuration).

[0052] In the semiconductor device (X) according to the second configuration, the control circuit (10) may be configured to switch the limiting circuit (11) between a first state and a second state in response to the communication signal (S1) together with the limiting parameter (Pm) (third configuration).

[0053] In the semiconductor device (X) according to the third configuration, the control circuit (10) may be configured to switch from the first state to the second state in response to a predetermined command code included in the communication signal (S1) (fourth configuration).

[0054] A semiconductor device (X) according to any of the second to fourth configurations may be configured such that the controller circuit (7) inputs a first control signal (S3) based on the communication signal (S1) to the limiting circuit (11), the control circuit (10) inputs a second control signal (S4) according to the communication signal (S1) and the limiting parameter (Pm) to the limiting circuit (11), and the limiting circuit (11) includes a first terminal (a) that receives the input of the first control signal (S3) from the controller circuit (7), a second terminal (b) that receives the input of the second control signal (S4) from the control circuit (11), and a third terminal (c) that inputs a third control signal (S5) based on the logical value of the first control signal (S3) input to the first terminal (a) and the logical value of the second control signal (S4) input to the second terminal (b) to the first storage area (5) (fifth configuration).

[0055] In a semiconductor device (X) according to a fifth configuration, the communication signal (S1) is a signal conforming to serial communication, and the limiting circuit (11) is preferably configured as a logic gate having the first terminal (a) and the second terminal (b) as an input stage and the third terminal (c) as an output stage (sixth configuration). [Explanation of symbols]

[0056] 1 microcomputer 2. Non-volatile memory 2x non-volatile memory 2y Non-volatile memory 3 Readout circuit 3a Temporary storage 3b Downloader 4. Communication Circuits 5 Firmware area 6 Interface 7 Controller Circuit 8 Limiting control circuit 9 Parameter Area 10 Control circuit 11 Limiting Circuit 21y Non-volatile memory FW Firmware Pm limit parameters S1 communication signal S2 communication signal S3 control signal S4 control signal S5 control signal T1 external terminal X Semiconductor Devices Y Semiconductor Devices a 1st terminal b 2nd terminal c 3rd terminal

Claims

1. a non-volatile memory; a limiting control circuit; a communication circuit coupled to the limit control circuit and configured to establish communication with the non-volatile memory via the limit control circuit; Including, The nonvolatile memory includes: a first storage area configured to be accessible from the communication circuit via the limiting control circuit; a second storage area in which the limiting parameters are stored; Including, The limit control circuit is configured to: a first state in which access to the first storage area of ​​the communication circuit is blocked; a second state in which the communication circuit is permitted to access the first storage area; The semiconductor device is configured to be switchable between the above two modes.

2. The communication circuit an interface configured to receive a communication signal from an external device; a controller circuit that accesses the first storage area via the restriction control circuit based on the communication signal received by the interface; Including, The limiting control circuit a limiting circuit connected between the first storage area and the controller circuit and configured to be switchable between the first state and the second state; a control circuit coupled to the limiting circuit and the second storage area, configured to switch the limiting circuit between the first state and the second state in response to the control parameter; The semiconductor device according to claim 1 , comprising:

3. The semiconductor device according to claim 2 , wherein the control circuit switches the limiting circuit between the first state and the second state in response to the communication signal together with the limiting parameter.

4. 4. The semiconductor device according to claim 3, wherein the control circuit switches the control circuit from the first state to the second state in response to a predetermined command code included in the communication signal.

5. the controller circuit inputs a first control signal based on the communication signal to the limiting circuit; the control circuit inputs a second control signal to the limiting circuit in response to the communication signal and the limiting parameter; The limiting circuit a first terminal that receives the first control signal from the controller circuit; a second terminal that receives an input of the second control signal from the control circuit; a third terminal that inputs a third control signal to the first storage area, the third control signal being based on the logical value of the first control signal input to the first terminal and the logical value of the second control signal input to the second terminal; 5. The semiconductor device according to claim 2, further comprising:

6. the communication signal is a signal conforming to serial communication, 6. The semiconductor device according to claim 5, wherein the limiting circuit is a logic gate configured such that the first terminal and the second terminal serve as an input stage and the third terminal serves as an output stage.

Images