Secure boot device and secure boot method

Abstract

A method of using a PUF that allows a product or system to continue operating without compromising its availability. [Solution] The secure boot device comprises a generation means, an encryption means, a storage means, a determination means, and a decryption means, and when encrypting a target program, the generation means divides the operating conditions for generating an encryption key into multiple bands and generates an encryption key for each operating condition for each band, the encryption means generates an encrypted program using the generated encryption key, and the storage means stores each encrypted program, and when decrypting the target program, the determination means determines from the read addresses associated with each band.

Description

[Technical Field]

[0001] The technology disclosed in this specification relates to secure boot using a PUF. [Background technology]

[0002] Advances in reverse engineering technology have made it increasingly difficult to safely store or preserve information such as the individual identification ID of a product or system, or encryption key information used in the product or system, in the memory of a semiconductor chip.

[0003] To counter reverse engineering techniques, there is a technology that uses the variations in semiconductor chip manufacturing to output data from a physically unclonable function (PUF) circuit, which uses the output data as an individual identification ID or encryption key information, preventing it from being read as memory data. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 6827032 [Patent Document 2] Special Publication No. 2022-527757 [Non-patent literature]

[0005] [Non-Patent Document 1] Ken Sugawara, "Trends in Cryptographic Hardware Research and Development: Physically Unclonable Functions," Institute for Monetary and Economic Studies, Bank of Japan, October 2020, Internet<URL:https: / / www.imes.boj.or.jp / research / papers / japanese / kk39-4-2.pdf> [Non-patent document 2] "Secure Boot and Trusted Boot," Internet <URL:https: / / learn.microsoft.com / ja-jp / windows / security / operating-system-security / system-security / trusted-boot> Summary of the Invention [Problem to be solved by the invention]

[0006] Methods for implementing PUF circuits include the arbiter PUF and SRAM (Static Random Access Memory) PUF, which are introduced in Non-Patent Document 1 (p. 34, 3. PUF Implementation Examples). The former utilizes the individual differences in the time it takes for a signal to travel through the circuit, while the latter utilizes the individual differences in the characteristics of the transistors that make up the SRAM memory cells.

[0007] As such, because PUF circuits take advantage of variations that occur during the manufacturing of semiconductor chips, it is difficult to make the output of a PUF circuit identical between different semiconductor chips. This makes it possible to use the output of a PUF circuit as an individual identification ID or cryptographic key information.

[0008] However, because PUF circuits utilize variations that occur during the manufacturing of semiconductor chips, it is unavoidable that even with the same semiconductor chip, the PUF circuit may output data with different values ​​depending on environmental conditions such as operating voltage, operating temperature, and ambient temperature, or changes over time.

[0009] For example, when attempting to use a PUF for boot processing equivalent to the secure boot described in Non-Patent Document 2, depending on the ambient temperature, it may take a long time to start up the product or system, or the product or system may not start up depending on the power supply environment. To prevent such situations, highly reliable PUF technology is required.

[0010] Patent Document 1 discloses a cryptographic device that includes a statistical unit that performs statistical testing and determines that the PUF circuit is functioning correctly if the statistical parameters of the PUF circuit satisfy the criteria of the statistical testing.

[0011] Furthermore, Patent Document 2 discloses an ID generation method that includes a plurality of PUF circuits, performs a reproduction test on the plurality of PUF circuits, and excludes PUF circuits that fail the test.

[0012] In both cases, the aim is to improve the reliability of the PUF, but it requires the implementation of multiple PUF circuits in advance, and they do not actually prevent or address the issue of different data values ​​being output from the PUF circuit.

[0013] The technology disclosed in this specification has been made in consideration of the problems described above, and is a technology for using PUFs that allows products or systems to continue operating without compromising their availability. [Means for solving the problem]

[0014] A secure boot device that is a first aspect of the technology disclosed in the present specification comprises: generation means for generating an encryption key for encrypting or decrypting a target program using a physically cloning-resistant function; encryption means for generating an encrypted program by encrypting the target program using the encryption key; storage means for storing the encrypted program; determination means for determining a read address for reading the encrypted program from the storage means; and decryption means for regenerating the target program by decrypting the encrypted program read from the storage means according to the read address using the encryption key; when encrypting the target program, the generation means divides the operating conditions for generating the encryption keys into a plurality of bands, generates the encryption keys respectively under the operating conditions for each band, the encryption means generates the encrypted program using the generated encryption keys, and the storage means stores each of the encrypted programs; when decrypting the target program, the determination means determines the read address from among the read addresses associated with each band. [Effects of the Invention]

[0015] According to at least the first aspect of the technology disclosed in the present specification, even if the operating conditions for generating a cryptographic key for decrypting an encrypted program change and the generated cryptographic key changes, the target program can be correctly regenerated by decrypting the encrypted program corresponding to the cryptographic key generated under the corresponding operating conditions, thereby enabling the product or system to continue operating without impairing its availability.

[0016] Furthermore, objects, features, aspects, and advantages associated with the technology disclosed herein will become more apparent from the detailed description and accompanying drawings set forth below. [Brief explanation of the drawings]

[0017] [Figure 1] FIG. 10 is a diagram illustrating an example of processing performed before shipping of a secure boot device according to an embodiment. [Figure 2] FIG. 10 is a diagram illustrating an example of a process performed at the time of startup of a secure boot device according to an embodiment. [Figure 3] FIG. 10 is a diagram illustrating an example of operating condition information according to the embodiment. [Figure 4] FIG. 10 is a diagram illustrating an example of dividing a target program into two areas. [Figure 5] 3 is a diagram illustrating a schematic example of a hardware configuration when the secure boot device shown in FIGS. 1 and 2 is actually operated. FIG. [Figure 6] 3 is a diagram illustrating a schematic example of a hardware configuration when the secure boot device shown in FIGS. 1 and 2 is actually operated. FIG. [Figure 7] 10 is a flowchart illustrating an example of an operation during encryption of a secure boot device according to an embodiment. [Figure 8] 10 is a flowchart illustrating an example of the operation of the secure boot device during decryption according to the embodiment. [Figure 9] 10 is a flowchart illustrating an example of the operations of the secure boot device according to the embodiment at the time of determination and notification. DETAILED DESCRIPTION OF THE INVENTION

[0018] Hereinafter, embodiments will be described with reference to the accompanying drawings. In the following embodiments, detailed features are shown for the purpose of explaining the technology, but these are merely examples and are not necessarily essential features for enabling the embodiments to be implemented.

[0019] The drawings are schematic, and for the sake of convenience, components may be omitted or simplified as appropriate. The relative sizes and positions of components shown in different drawings are not necessarily accurately depicted and may be changed as appropriate. Hatching may also be used in drawings such as plan views that are not cross-sectional views to facilitate understanding of the embodiments.

[0020] In the following description, the same components are denoted by the same reference numerals, and their names and functions are also the same. Therefore, detailed descriptions of them may be omitted to avoid duplication.

[0021] Furthermore, in the description given in this specification, when a certain component is described as "comprising," "including," or "having," unless otherwise specified, this is not an exclusive expression that excludes the presence of other components.

[0022] Furthermore, although ordinal numbers such as "first" or "second" may be used in the descriptions in this specification, these terms are used for convenience to facilitate understanding of the contents of the embodiments, and the contents of the embodiments are not limited to the order that may result from these ordinal numbers.

[0023] <Embodiment> The secure boot device and the secure boot method according to this embodiment will be described below.

[0024] <About the configuration of the secure boot device> Fig. 1 is a diagram showing an example of processing performed by a secure boot device according to this embodiment before shipping, and Fig. 2 is a diagram showing an example of processing performed by a secure boot device according to this embodiment at startup.

[0025] 1, the configuration for pre-shipment processing of the secure boot device includes generation means 1 that generates an encryption key 2 for performing encryption or decryption using a physically unclonable function (PUF) circuit using a PUF, encryption means 3 that encrypts a secure boot target program (target program 4) using the encryption key 2, determination means 6 that determines, based on information on operating conditions (operating condition information 7), an address for storing or reading out an encrypted program 5 generated by encrypting the target program 4 (storage address 8a for storage in pre-shipment processing), and storage means 9 that stores the encrypted program 5 in a non-volatile memory (not shown here) or the like in accordance with the storage address 8a determined based on the operating condition information 7. Note that, although not shown in FIG. 1, the secure boot device may also include other components than those shown in FIG. 2.

[0026] On the other hand, as shown in the example of Figure 2, the configuration for processing at startup after shipment of the secure boot device includes a generation means 1, a determination means 6 that determines an address for storing or reading out the encrypted program 5 (a read address 8b for reading in the startup processing) based on operating condition information 7, a storage means 9 that reads out the encrypted program 5 from a non-volatile memory (not shown here) according to the read address 8b determined based on the operating condition information 7, a decryption means 10 that decrypts the encrypted program 5 read out from the storage means 9 according to the read address 8b using an encryption key 2 to regenerate the target program 4, and a determination means 11 that determines whether the target program 4 decrypted by the decryption means 10 has been correctly decrypted.

[0027] The measuring means 12, storage means 15 and determination means 16 shown in FIG. 2 may be further provided in the above configuration.

[0028] In FIG. 1, the process up to the point where the encrypted program 5 is stored in the storage means 9 is carried out before the secure boot device according to this embodiment is shipped as a product or system (mounted in the product or system).

[0029] On the other hand, Figure 2 shows the secure boot processing that is performed during the boot process when the secure boot device according to this embodiment is started up after being shipped as a product or system, from the point where the encrypted program 5 read from the storage means 9 is correctly decrypted using the encryption key 2 so that it can be used in the subsequent boot process.

[0030] In the above case, since the generation means 1 generates the encryption key 2 using a PUF circuit, for example, if the guaranteed range of ambient temperatures at which the secure boot device of this embodiment operates as a product or system is 10°C or higher and 40°C or lower, and the PUF circuit operates stably only within this guaranteed range (temperature band), if the secure boot device is started up in a temperature band outside the guaranteed range, such as 5°C or 45°C, the generation means 1 may not generate the encryption key 2 as expected, and the encrypted program 5 may not be correctly decrypted into the target program 4.

[0031] This may result in the boot process taking a long time to complete due to retries from the generation of encryption key 2, or the boot process may not be completed, making it impossible to operate the product or system.

[0032] To prevent this from happening, in the secure boot device according to this embodiment, the generating means 1 prepares in advance a plurality of encryption keys 2 that can be generated according to the operating conditions of the generating means 1 (step ST01 in FIG. 7), and the encryption means 3 prepares a plurality of encryption programs 5 corresponding to each encryption key 2 (step ST02 in FIG. 7). The generated plurality of encryption programs 5 are then stored in the storage means 9 (step ST03 in FIG. 7). Here, FIG. 7 is a flowchart showing an example of the operation of the secure boot device according to this embodiment during encryption.

[0033] On the other hand, when decrypting the encrypted program 5, the generating means 1 generates the encryption key 2 for decryption (step ST11 in FIG. 8). Then, the determining means 6 determines the read address 8b based on the operating condition information 7 (step ST12 in FIG. 8), and reads out the encrypted program 5 stored in the storing means 9 in accordance with the read address 8b (step ST13 in FIG. 8). Then, the decrypting means 10 decrypts the encrypted program 5 corresponding to the encryption key 2 generated under the same operating conditions, using the encryption key 2 for decryption (step ST14 in FIG. 8). Here, FIG. 8 is a flowchart showing an example of the operation at the time of decryption of the secure boot device according to this embodiment.

[0034] By doing as described above, even if a different encryption key 2 is generated according to differences in the operating conditions of the generation means 1 each time the product or system is started up, the target program 4 can be correctly reproduced by decrypting the encrypted program 5 corresponding to the encryption key 2 generated by the generation means 1 under the same operating conditions as those under which the encryption key 2 for decryption was generated by the generation means 1, so that the target program 4 can be correctly reproduced. Here, in order to read out the encrypted program 5 corresponding to the encryption key 2 generated under the same operating conditions from the storage means 9, the determination means 6 determines the read address 8b based on the operating condition information 7, but even if the operating condition information 7 is not used, it is only necessary to sequentially determine the read addresses 8b for reading out the multiple encrypted programs 5 stored in the storage means 9 by the determination means 6, and read out the encrypted programs 5 from the storage means 9 in order.

[0035] For example, if the guaranteed range of ambient temperature is 10°C or higher and 40°C or lower, it is easier to divide the temperature range into, for example, 5°C or higher and 25°C or lower and 25°C or higher and 45°C or lower and obtain a cryptographic key 2 that is stable over the long term in each range, rather than expanding the range to, for example, 5°C or higher and 45°C or lower and ensuring that the same cryptographic key 2 can be obtained stably.

[0036] Therefore, preparing a plurality of encryption keys 2 and corresponding encryption programs 5 in advance, as in the secure boot device according to this embodiment, is advantageous in terms of manufacturing costs as well.

[0037] Fig. 3 is a diagram showing an example of operating condition information 7 according to this embodiment. In Fig. 3, the operating condition information 7 is organized in a matrix table. In Fig. 3, bands 1-1 to nm are collectively referred to as a plurality of bands 19.

[0038] 3, among the multiple bands 19, the operating conditions of voltage range 1 and temperature range 1 are band 1-1, and the operating conditions of voltage range n and temperature range m are band nm. In other words, the operating condition information 7 includes information indicating the range of the operating conditions for each band.

[0039] For example, if the rated voltage is 3.3V and the PUF circuit can only operate stably within a range of ±0.3V, and if the output of the PUF circuit is likely to be different between 3.0V or higher and 3.3V or lower and 3.3V or higher and 3.6V or higher, then there are only two voltage ranges, 1 and 2, and for example, voltage range 1 would be 3.0V or higher and 3.3V or lower, and voltage range 2 would be 3.3V or higher and 3.6V or lower. Furthermore, if the temperature ranges are, for example, three, with temperature range 1 being -10°C or higher and +10°C or lower, temperature range 2 being +10°C or higher and +40°C or lower, and temperature range 3 being +40°C or higher and +75°C or lower, then the multiple bands 19 will be six in total, from band 1-1 to band 2-3, and if stable PUF circuit output can be obtained in each of these six bands and each encryption key 2 can be generated stably, then by preparing six corresponding encryption programs 5 in advance, in this example, even if the secure boot device of this embodiment is shipped as a product or system within the rated voltage range of 3.3V±0.3V and the ambient temperature range of -10°C or higher and +75°C or lower, the product or system can continue to operate without compromising availability.

[0040] In this embodiment, we are not concerned with the method of obtaining a stable output from the PUF circuit for each prepared band or the evaluation method, but it is necessary to prepare multiple bands 19 in which each cryptographic key 2 can be stably generated according to the adopted PUF circuit or the means for improving its reliability, the operating environment expected for the product or system, or the range and band in which operation must be guaranteed.

[0041] In the above example, six bands are set using a matrix of voltage and temperature, but the setting parameters may be voltage alone or temperature alone, or other factors that affect other PUF circuits may be incorporated. Also, only bands within the guaranteed operating range of voltage and temperature may be set, or bands outside the guaranteed operating range of voltage and temperature may be included.

[0042] Furthermore, if the same encryption key 2 corresponds to different bands, by grouping these bands together, the size of the non-volatile memory (not shown here) required in the storage means 9 can be reduced and the processing time related to secure boot can be shortened.

[0043] <Regarding the first modified example> Next, the operation when the measuring means 12 is provided will be described with reference to FIG.

[0044] The measurement means 12 measures at least one of the operating voltage and the ambient temperature when the generation means 1 generates the encryption key 2 using the PUF circuit. The measurement result 13 including the operating voltage or the ambient temperature measured by the measurement means 12 is input to the determination means 6.

[0045] The determining means 6 determines a read address 8 b for reading the encrypted program 5 based on the operating condition information 7 and the measurement result 13 .

[0046] Regarding the pre-shipment processing shown in FIG. 1, for example, an encryption program 5 corresponding to each of the multiple bands 19 is generated using a stabilized power supply (not shown here) and a thermostatic bath (not shown here), information on the voltage range and temperature range of each band is input to a determination means 6 as operating condition information 7, and the determination means 6 determines a storage address 8a for storing the encryption program 5 for the corresponding band, so that each band and the encryption program 5 can be stored in correspondence with each other in a storage means 9.

[0047] 2, it is not known which band among the multiple bands 19 the encryption key 2 generated by the generation means 1 corresponds to. Therefore, the determination means 6 determines the read address 8b for reading the encrypted program 5 from the storage means 9 based on the measurement result 13 input from the measurement means 12 in addition to the operating condition information 7. That is, by taking the measurement result 13 into consideration when determining the read address 8b in step ST12 in FIG. 8, it is possible to determine the read address 8b for reading the encrypted program 5 corresponding to the encryption key 2 generated under the same operating conditions as the encryption key 2 for decryption.

[0048] Without using the measurement means 12 and the measurement results 13, the target program 4 can be obtained by sequentially outputting the read addresses 8b for each band in the determination means 6, sequentially reading the encrypted program 5 from the storage means 9, and repeating the read operation until the determination means 11 determines that the decryption has been successful.

[0049] For example, by reading out the encrypted programs 5 in order starting from the encrypted programs 5 corresponding to the band including the rated voltage or the recommended ambient temperature, it is possible to suppress an increase in the time required for secure boot or boot processing.

[0050] However, by taking into consideration the measurement result 13, the determining means 6 can determine which band among the multiple bands 19 the encryption key 2 generated by the generating means 1 corresponds to, and can therefore determine the read address 8b for reading the encrypted program 5 from the storage means 9. Therefore, the processing time for secure boot can be shortened compared to when the encrypted program 5 is read out sequentially from the storage means 9.

[0051] The measuring means 12 may be a sensor built into the CPU chip on which the secure boot device according to this embodiment is implemented, or may be a sensor placed outside the CPU chip within the product according to this embodiment.

[0052] However, in the processing performed before the secure boot device according to this embodiment is shipped as a product or system (installed in the product or system), it is necessary that the same values ​​as the voltage and temperature set or reproduced in the stabilized power supply (not shown here) and the thermostatic chamber (not shown here) are obtained as the measurement result 13.

[0053] <Regarding the second modified example> Next, the operation will be described in the case where the measuring means 12, the storage means 15, and the determining means 16 are provided with reference to Fig. 2. Fig. 9 is a flowchart showing an example of the operation of the secure boot device according to this embodiment at the time of determination and notification.

[0054] The storage means 15 stores failure information 14 for each of the multiple bands 19. Here, the failure information 14 is information output from the determination means 11 indicating the result of determining whether the target program 4 has been correctly decoded by the decoding means 10.

[0055] The determination means 16 holds one or more threshold values ​​18, and determines whether the value of the failure information 14 for each of the multiple bands 19 input from the storage means 15 is equal to or greater than the threshold value 18. Here, the threshold value 18, for example, specifies the number of decoding failures or the decoding failure frequency for each of the multiple bands 19. If the value of the failure information 14 is equal to or greater than the threshold value 18, the determination means 16 outputs notification information 17 to an external notification means (not shown) to instruct notification. Here, the notification information 17 is information indicating the band for which the value of the failure information 14 is equal to or greater than the threshold value 18, or the threshold value 18 used for comparison.

[0056] At this time, the determination means 11 refers to the read address 8b generated by the determination means 6 based on the measurement result 13 to determine which band of the multiple bands 19 the encrypted program 5 for which the decryption means 10 decrypted, and adds to the failure information 14 the information regarding which band of the multiple bands 19 the encrypted program 5 for.

[0057] When the encrypted program 5 is decrypted in the decryption means 10, the determination means 11 determines whether the encrypted program 5 has been correctly decrypted (step ST21 in FIG. 9). Then, the determination result indicating whether the encrypted program 5 has been correctly decrypted is stored in the storage means 15 as failure information 14 (step ST22 in FIG. 9). The failure information 14 indicates the determination result of the decrypted encrypted program 5 for each of the multiple bands 19.

[0058] Next, the decision means 16 refers to the failure information 14 and decides whether or not the number of decoding failures or the decoding failure frequency is equal to or greater than the threshold value 18 for each of the plurality of bands 19 (step ST23 in FIG. 9).

[0059] If the number of decoding failures or the decoding failure frequency is equal to or greater than threshold value 18, determination means 16 outputs notification information 17 to external notification means (not shown here) to instruct notification (step ST24 in FIG. 9). On the other hand, if the number of decoding failures or the decoding failure frequency is less than threshold value 18, the operation is terminated.

[0060] In addition, the judgment means 16 can output notification information 17 if there is one or more bands for which the information indicated by the failure information 14 is equal to or greater than the threshold value 18, but it may also be configured to output notification information 17 only if there are multiple bands for which the information indicated by the failure information 14 is equal to or greater than the threshold value 18.

[0061] By doing so, it is possible to notify a user who uses the secure boot device in a product or system that the encryption key 2 is becoming unable to be correctly generated due to aging. Also, by notifying a vendor or manufacturer that provides the secure boot device according to this embodiment as a product or system, it is possible to urge them to update the encryption keys 2 for some or all of the bands among the multiple bands 19 for which the encryption key 2 is becoming unable to be correctly generated due to aging.

[0062] The notification may be sent only to the user, vendor, or manufacturer, or if the product or system is connected to the Internet or cloud, the encryption key 2 may be automatically updated in response to the notification information 17.

[0063] The encryption key 2 can be updated by the same process as that performed by the generation means 1 and encryption means 3 shown in Fig. 1. In this case, the encryption key 2 and encryption program 5 corresponding to at least one of the multiple bands 19 shown in Fig. 3 are regenerated. In this way, the encryption key 2 and encryption program 5 can be obtained stably even in a state where decryption fails due to aging or the like.

[0064] Next, an example of dividing the target program 4 into two areas will be described with reference to Fig. 4. Here, Fig. 4 is a diagram showing an example of dividing the target program into two areas.

[0065] 4, the target program 4 includes an area 4a having the minimum size required for encryption and decryption within the target program 4, and an area 4b other than area 4a. Area 4a includes an identifier 20 for determining whether decryption has been performed correctly.

[0066] 4, the area 4a is shown to be located at the beginning of the target program 4, but it is arbitrary to determine which part of the target program 4 is the area 4a. In addition, it is arbitrary to determine where in the area 4a the identifier 20 is set, and the contents and size of the identifier 20.

[0067] When the secure boot device according to this embodiment is started up as a product or a system, it is necessary to repeat the decryption process of the encrypted program 5 as many times as the number of bands 19. As in the case where the above-described measurement means 12 is provided, the encrypted program 5 to be decrypted is identified based on the measurement result 13 obtained when the PUF circuit is operating, thereby shortening the processing time for the secure boot. In addition, the processing time for the secure boot can be shortened by decrypting only the part of the encrypted program 5 that corresponds to the area 4a using the decryption means 10, and determining whether the decryption was successful based on the contents of the identifier 20 using the determination means 11.

[0068] In this embodiment, an example is described in which a target program 4 is encrypted and decrypted when a PUF is used to generate an encryption key 2 used in secure boot processing, but other methods for secure boot may also be used.

[0069] The technology described in this embodiment can also be applied when generating an encryption key 2 for encryption / decryption processes other than secure boot, or when using a PUF to generate an individual identification ID for a product.

[0070] <Hardware configuration of the secure boot device> 5 and 6 are diagrams illustrating a schematic example of a hardware configuration when the secure boot device shown in FIGS. 1 and 2 is actually operated.

[0071] Note that the hardware configurations illustrated in Figures 5 and 6 may not match the numbers and other details of the configurations illustrated in Figures 1 and 2, but this is because the configurations illustrated in Figures 1 and 2 represent conceptual units.

[0072] Therefore, at least the following cases can be envisaged: a configuration illustrated in Figures 1 and 2 is made up of multiple hardware configurations illustrated in Figures 5 and 6; a configuration illustrated in Figures 1 and 2 corresponds to a part of the hardware configuration illustrated in Figures 5 and 6; and further, multiple configurations illustrated in Figures 1 and 2 are provided in a single hardware configuration illustrated in Figures 5 and 6.

[0073] Figure 5 shows the hardware configuration for realizing the generation means 1, encryption means 3, decision means 6, storage means 9, decryption means 10, judgment means 11, measurement means 12, memory means 15, judgment means 16, etc. in Figures 1 and 2, including a processing circuit 1102A that performs calculations, a memory device 1103 that can store information, and a measurement device 1106A that can measure physical quantities, etc., such as a sensor or analyzer.

[0074] Figure 6 shows the hardware configuration for realizing the generation means 1, encryption means 3, decision means 6, storage means 9, decryption means 10, judgment means 11, measurement means 12, memory means 15, and judgment means 16 in Figures 1 and 2, including a processing circuit 1102B that performs calculations and a measurement device 1106B that can measure physical quantities, such as a sensor or analyzer.

[0075] The storage means 9 and the memory means 15 are realized by the storage device 1103 or another storage device (not shown here).

[0076] The storage device 1103 may be, for example, a memory (recording medium) including a volatile or non-volatile semiconductor memory such as a hard disk drive (i.e., HDD), random access memory (i.e., RAM), read only memory (i.e., ROM), flash memory, erasable programmable read only memory (EPROM), and electrically erasable programmable read-only memory (EEPROM), a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, or a DVD, or any recording medium that will be used in the future.

[0077] The processing circuit 1102A may execute a program stored in the storage device 1103, an external CD-ROM, an external DVD-ROM, an external flash memory, etc. That is, it may be, for example, a central processing unit (CPU), a microprocessor, a microcomputer, or a digital signal processor (DSP).

[0078] When the processing circuit 1102A executes a program stored in the storage device 1103, an external CD-ROM, an external DVD-ROM, or an external flash memory, the generation means 1, the encryption means 3, the determination means 6, the decryption means 10, the judgment means 11, and the determination means 16 are realized by software, firmware, or a combination of software and firmware, in which the program stored in the storage device 1103 is executed by the processing circuit 1102A. Note that the functions of the generation means 1, the encryption means 3, the determination means 6, the decryption means 10, the judgment means 11, and the judgment means 16 may be realized, for example, by a plurality of processing circuits working together.

[0079] The software and firmware may be written as a program and stored in the storage device 1103. In this case, the processing circuit 1102A realizes the above functions by reading and executing the program stored in the storage device 1103. In other words, the storage device 1103 may store a program that, when executed by the processing circuit 1102A, results in the above functions being realized.

[0080] The processing circuit 1102B may also be dedicated hardware, i.e., for example, a single circuit, multiple circuits, a programmed processor, a parallel programmed processor, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination thereof.

[0081] When the processing circuit 1102B is dedicated hardware, the generating means 1, the encrypting means 3, the determining means 6, the decrypting means 10, the judging means 11, and the judging means 16 are realized by the operation of the processing circuit 1102B. Note that the functions of the generating means 1, the encrypting means 3, the determining means 6, the decrypting means 10, the judging means 11, and the judging means 16 may be realized by separate circuits or by a single circuit.

[0082] In addition, the functions of the generation means 1, encryption means 3, decision means 6, decryption means 10, judgment means 11, and judgment means 16 may be partially realized in processing circuit 1102A, which executes a program stored in memory device 1103, and partially realized in processing circuit 1102B, which is dedicated hardware.

[0083] Furthermore, the measuring means 12 is realized by the measuring device 1106A or the measuring device 1106B.

[0084] <Effects of the above-described embodiments> Next, examples of effects obtained by the above-described embodiments will be described. Note that in the following description, the effects will be described based on the specific configurations exemplified in the above-described embodiments, but these may be replaced with other specific configurations exemplified in the present specification as long as the same effects are obtained. In other words, for convenience, only one of the corresponding specific configurations may be described as a representative below, but the representatively described specific configuration may be replaced with another corresponding specific configuration.

[0085] According to the embodiment described above, the secure boot device includes a generation unit 1, an encryption unit 3, a storage unit 9, a determination unit 6, and a decryption unit 10. The generation unit 1 generates an encryption key 2 for encrypting or decrypting a target program using a physically cloning-resistant function. The encryption unit 3 generates an encrypted program 5 by encrypting a target program 4 using the encryption key 2. The storage unit 9 stores the encrypted program 5. The determination unit 6 determines a read address 8b for reading the encrypted program 5 from the storage unit 9. The decryption unit 10 regenerates the target program 4 by decrypting the encrypted program 5 read from the storage unit 9 according to the read address 8b using the encryption key 2. Here, when encrypting the target program 4, the generation unit 1 divides the operating conditions for generating the encryption key 2 into a plurality of bands, generates an encryption key 2 for each operating condition for each band, the encryption unit 3 generates an encrypted program 5 using the generated encryption key 2, and the storage unit 9 stores each encrypted program 5. When decrypting the target program 4, the determination unit 6 determines the read address from among the read addresses 8b associated with each band.

[0086] With this configuration, even if a different encryption key 2 is generated depending on the operating conditions when decrypting the encrypted program 5, the target program 4 can be correctly regenerated by decrypting the encrypted program 5 corresponding to the encryption key 2 generated under the corresponding operating conditions. Therefore, even if the same encryption key 2 is not generated due to changes in the operating voltage or ambient temperature when secure boot is performed, the impact on the availability of the product or system can be reduced.

[0087] Furthermore, even if other configurations shown as examples in this specification are appropriately added to the above configuration, that is, even if other configurations in this specification that were not mentioned as the above configuration are appropriately added, the same effect can be achieved.

[0088] Furthermore, according to the embodiment described above, the determination means 6 has operating condition information indicating the range of operating conditions for each band and information on read addresses 8b associated with each band, acquires measurement results of the operating conditions when decrypting the target program 4, and determines the read address 8b corresponding to the band among the multiple bands to which the measurement results apply. With this configuration, the operating conditions of the encryption key 2 corresponding to the encrypted program 5 stored in the storage means 9 are identified by referring to the operating condition information 7, and the encrypted program 5 corresponding to the encryption key 2 generated under the same operating conditions as the encryption key 2 to be generated for decryption can be decrypted, thereby efficiently regenerating the target program 4.

[0089] According to the embodiment described above, the operating condition information 7 includes information dividing at least one of the operating voltage and ambient temperature when the generating unit generates the encryption key into multiple bands 19. The multiple bands 19 include at least one band 19 including a rated voltage for the operating voltage and at least one band 19 including a temperature range in which operation is guaranteed for the ambient temperature. The encryption unit 3 generates the corresponding encrypted program 5 using each encryption key 2. This configuration prevents loss of product or system availability even when the operating environment or operating conditions change by preparing encryption keys 2 and corresponding encrypted programs 5 that can be generated in multiple bands. Furthermore, by setting a band including at least one of a rated voltage and an ambient temperature at which the same encryption key 2 value is most likely to be generated, and by setting other voltage bands or temperature bands at which different encryption keys 2 are likely to be generated for each encryption key 2 value, the target program 4 can be efficiently regenerated to accommodate a wide range of operating voltages or ambient temperatures. In addition, by first decrypting the encrypted program 5 corresponding to the voltage band (or temperature band) including the rated voltage (or the temperature range in which operation is guaranteed), the increase in the time required for secure boot can be suppressed.

[0090] Furthermore, according to the embodiment described above, the secure boot device includes a measurement means 12 for measuring, as operating condition information 7, at least one of the operating voltage and the ambient temperature when the generation means 1 generates the encryption key 2 when secure boot is performed. With this configuration, at least one of the voltage and the temperature when the PUF operates is measured when secure boot is performed, and the decryption means 10 preferentially decrypts the encrypted program 5 that corresponds to the operating conditions of the voltage band or temperature band that includes that voltage value or temperature value, thereby making it possible to suppress an increase in the time required for secure boot.

[0091] Furthermore, according to the embodiment described above, the secure boot device includes a determination unit 11 for determining whether the regenerated target program 4 has been correctly decrypted and outputting the determination result as failure information 14, and a determination unit 16 for determining whether an external notification is necessary based on the failure information 14. With this configuration, by sending an external notification based on the failure information 14, the encryption key 2 can be regenerated and prepared before all encrypted programs 5 become undecryptable due to aging of the PUF. It is unlikely that all encryption keys 2 will be simultaneously reproduced due to aging, and secure boot can be completed by retrying the generation of the encryption key 2 several times. However, as aging progresses, the number of retries to generate the encryption key 2 increases, and the impact on the availability of the device or system becomes significant. By sending the above notification before such a situation occurs and having the product or system vendor take action (regenerate the encryption key 2), the reliability of the product or system can be improved and its lifespan extended.

[0092] Furthermore, according to the embodiment described above, the target program 4 has a first area, which is an area of ​​a size required for encryption and decryption, and a second area, which is an area other than the first area. Here, the first area corresponds, for example, to area 4a. The second area corresponds, for example, to area 4b. An identifier 20 indicating whether the target program 4 has been correctly decrypted is placed in area 4a. Then, the determination means 11 determines whether the regenerated target program 4 has been correctly decrypted based on the identifier 20. With this configuration, when secure boot is performed, it is easy to determine whether the encrypted program 5 has been successfully decrypted, thereby suppressing an increase in the time required for secure boot.

[0093] According to the embodiment described above, in the secure boot method, an encryption key 2 for encrypting or decrypting a target program is generated using a physically cloning-resistant function, and the target program 4 is encrypted using the encryption key 2 to generate an encrypted program 5. The encrypted program 5 is then stored in the storage means 9. A read address 8b for reading the encrypted program 5 from the storage means 9 is determined. The encrypted program 5 read from the storage means 9 according to the read address 8b is then decrypted using the encryption key 2 to regenerate the target program 4. Here, when encrypting the target program 4, the operating conditions for generating the encryption key 2 are divided into a plurality of bands, an encryption key 2 is generated for each operating condition for each band, an encrypted program 5 is generated using the generated encryption key 2, and the storage means 9 stores each encrypted program 5. When decrypting the target program 4, the encrypted program 5 is decrypted using the encryption key 2 according to the read address 8b determined from the read addresses 8b associated with each band, to regenerate the target program 4.

[0094] With this configuration, even if a different encryption key 2 is generated depending on the operating conditions when decrypting the encrypted program 5, the target program 4 can be correctly regenerated by decrypting the encrypted program 5 corresponding to the encryption key 2 generated under the corresponding operating conditions.

[0095] Unless otherwise specified, the order in which the processes are performed can be changed.

[0096] Furthermore, even if other configurations shown as examples in this specification are appropriately added to the above configuration, that is, even if other configurations in this specification that were not mentioned as the above configuration are appropriately added, the same effect can be achieved.

[0097] <Modifications of the above-described embodiments> In the embodiments described above, the dimensions, shapes, relative positional relationships, and implementation conditions of each component may be described, but these are merely examples in all aspects and are not limiting.

[0098] Thus, numerous variations and equivalents not shown are contemplated within the scope of the technology disclosed herein, including, for example, the modification, addition, or omission of at least one component.

[0099] Furthermore, unless a contradiction arises, when it is stated in the above-described embodiments that "one" component is provided, "one or more" of that component may also be provided.

[0100] Furthermore, each component in the embodiments described above is a conceptual unit, and the scope of the technology disclosed in this specification includes cases where one component is made up of multiple structures, cases where one component corresponds to part of a structure, and even cases where multiple components are provided in one structure.

[0101] Furthermore, the descriptions in this specification are incorporated by reference for all purposes related to the present technology, and none of them are admitted to be prior art.

[0102] Furthermore, each component described in the above-described embodiments is envisioned as software or firmware, as well as corresponding hardware, and as software it is referred to as, for example, a "unit" or "means," and as hardware it is referred to as, for example, a "processing circuit" (circuitry).

[0103] Furthermore, the technology disclosed in this specification may also be in a form in which each component is distributed across multiple devices, that is, in a form such as a system that is a combination of multiple devices.

[0104] Various aspects of the present disclosure are summarized below as appendices.

[0105] (Appendix 1) a generating means for generating an encryption key for encrypting or decrypting a target program using a physically cloning-resistant function; an encryption means for generating an encrypted program by encrypting the target program using the encryption key; a storage means for storing the encrypted program; a determination means for determining a read address for reading the encrypted program from the storage means; a decryption means for decrypting the encrypted program read from the storage means according to the read address using the encryption key to regenerate the target program, When encrypting the target program, the generating means divides the operating conditions for generating the encryption key into a plurality of bands, generates the encryption key under the operating conditions for each band, the encryption means generates the encrypted program using the generated encryption key, and the storage means stores each of the encrypted programs, When the target program is decrypted, the determining means determines a read address from among the read addresses associated with each band. Secure boot device.

[0106] (Appendix 2) the determining means has operating condition information indicating the range of the operating conditions for each of the bands and information on the read addresses associated with each of the bands, acquires a measurement result of measuring the operating conditions when the target program is decrypted, and determines the read address corresponding to the band among the plurality of bands to which the measurement result applies; 2. The secure boot device of claim 1.

[0107] (Appendix 3) the operating condition information indicating the range of the operating condition for each band includes information in which at least one of an operating voltage and an ambient temperature when the generating means generates the encryption key is divided into a plurality of bands, the plurality of bands include at least one band including a rated voltage in the case of the operating voltage and a temperature range in which operation is guaranteed in the case of the ambient temperature; the encryption means generates the corresponding encrypted program using each of the encryption keys; 3. The secure boot device according to claim 1 or 2.

[0108] (Appendix 4) a measuring unit for measuring at least one of an operating voltage and an ambient temperature when the generating unit generates the encryption key, as operating condition information indicating the range of the operating condition for each band; 4. The secure boot device according to claim 1.

[0109] (Appendix 5) the determining means selects and outputs the read address corresponding to one of the plurality of bands, and changes the read address corresponding to another band and outputs the selected read address until the regenerated target program is correctly decoded. 2. The secure boot device of claim 1.

[0110] (Appendix 6) a determination means for determining whether the regenerated target program has been correctly decrypted and outputting a determination result as failure information; The system further includes a determination unit for determining whether or not a notification to an external device is necessary based on the failure information. 6. The secure boot device according to any one of claims 1 to 5.

[0111] (Appendix 7) the target program has a first area that is an area of ​​a size required for encryption and decryption, and a second area that is an area other than the first area, placing an identifier in the first area that indicates whether the target program has been correctly decrypted; the determining means determines whether the regenerated target program has been correctly decrypted based on the identifier. 7. The secure boot device of claim 6.

[0112] (Appendix 8) generating an encryption key for encrypting or decrypting the target program using a physically cloning-resistant function; generating an encrypted program by encrypting the target program using the encryption key; storing the encrypted program in a storage means; determining a read address for reading the encrypted program from the storage means; regenerating the target program by decrypting the encrypted program read from the storage means according to the read address using the encryption key; When encrypting the target program, the operating conditions for generating the encryption key are divided into a plurality of bands, the encryption key is generated under the operating conditions for each band, the generated encryption key is used to generate the encrypted program, and the storage means stores each of the encrypted programs, When decrypting the target program, the encrypted program is decrypted using the encryption key in accordance with the read address determined from the read addresses associated with each band, thereby regenerating the target program. Secure Boot method. [Explanation of symbols]

[0113] 1 generation means, 2 encryption key, 3 encryption means, 4 target program, 4a area, 4b area, 5 encrypted program, 6 determination means, 7 operating condition information, 8a storage address, 8b read address, 9 storage means, 10 decryption means, 11 judgment means, 12 measurement means, 13 measurement result, 14 failure information, 15 storage means, 16 judgment means, 17 notification information, 18 threshold, 19 bandwidth, 20 identifier, 1102A processing circuit, 1102B processing circuit, 1103 storage device, 1106A measurement device, 1106B measurement device.

Claims

1. a generating means for generating an encryption key for encrypting or decrypting a target program using a physically cloning-resistant function; an encryption means for generating an encrypted program by encrypting the target program using the encryption key; a storage means for storing the encrypted program; a determination means for determining a read address for reading the encrypted program from the storage means; a decryption means for decrypting the encrypted program read from the storage means according to the read address using the encryption key to regenerate the target program, When encrypting the target program, the generating means divides the operating conditions for generating the encryption key into a plurality of bands, generates the encryption key under the operating conditions for each band, the encryption means generates the encrypted program using the generated encryption key, and the storage means stores each of the encrypted programs, When the target program is decrypted, the determining means determines a read address from among the read addresses associated with each band. Secure boot device.

2. the determining means has operating condition information indicating the range of the operating conditions for each of the bands and information on the read addresses associated with each of the bands, acquires a measurement result of measuring the operating conditions when the target program is decrypted, and determines the read address corresponding to the band among the plurality of bands to which the measurement result applies; The secure boot device according to claim 1 .

3. the operating condition information indicating the range of the operating condition for each band includes information in which at least one of an operating voltage and an ambient temperature when the generating means generates the encryption key is divided into a plurality of bands, the plurality of bands include at least one band including a rated voltage in the case of the operating voltage and a temperature range in which operation is guaranteed in the case of the ambient temperature; the encryption means generates the corresponding encrypted program using each of the encryption keys; The secure boot device according to claim 1 or 2.

4. a measuring unit for measuring at least one of an operating voltage and an ambient temperature when the generating unit generates the encryption key, as operating condition information indicating the range of the operating condition for each band; The secure boot device according to claim 1 or 2.

5. the determining means selects and outputs the read address corresponding to one of the bands, and changes the read address corresponding to another band until the regenerated target program is correctly decoded, and outputs the selected read address. The secure boot device according to claim 1 .

6. a determination means for determining whether the regenerated target program has been correctly decrypted and outputting a determination result as failure information; The system further includes a determination unit for determining whether or not a notification to an external device is necessary based on the failure information. The secure boot device according to claim 1 or 5.

7. the target program has a first area that is an area of ​​a size required for encryption and decryption, and a second area that is an area other than the first area, placing an identifier in the first area that indicates whether the target program has been correctly decrypted; the determining means determines whether the regenerated target program has been correctly decrypted based on the identifier. The secure boot device according to claim 6 .

8. generating an encryption key for encrypting or decrypting the target program using a physically cloning-resistant function; generating an encrypted program by encrypting the target program using the encryption key; storing the encrypted program in a storage means; determining a read address for reading the encrypted program from the storage means; regenerating the target program by decrypting the encrypted program read from the storage means according to the read address using the encryption key; When encrypting the target program, the operating conditions for generating the encryption key are divided into a plurality of bands, the encryption key is generated under the operating conditions for each band, the generated encryption key is used to generate the encrypted program, and the storage means stores each of the encrypted programs, When decrypting the target program, the encrypted program is decrypted using the encryption key in accordance with the read address determined from the read addresses associated with each band, thereby regenerating the target program. Secure Boot method.

Images