Semiconductor device and authentication method

Abstract

To improve the tamper resistance of semiconductor devices against physical attacks. [Solution] The semiconductor device according to this disclosure includes a transition circuit that transitions a state at a predetermined Hamming distance according to the result of comparing a value to be authenticated with a reference value, and a determination circuit that determines the validity of the authentication by determining whether the Hamming distance between the state before the transition and the state after the transition matches the predetermined Hamming distance.

Description

Technical Field

[0001] The present disclosure relates to a semiconductor device and an authentication method, and more particularly, to a semiconductor device and an authentication method for determining the validity of authentication.

Background Art

[0002] Cryptography for secure communication or data confidentiality has been widely used in everyday information devices such as IC (Integrated Circuit) cards. In recent years, the importance of cryptography has also increased in ECUs (Electronic Control Units) that electronically control various parts inside automobiles. In particular, the threat of exploiting functions not supported for customer use (hereinafter also referred to as non-supported functions) has become serious. Non-supported functions are, for example, test functions or debug functions used in the semiconductor development phase. In general, countermeasures are taken to protect against threats by using the security functions of semiconductor devices. An example of a security function is ID (identification) authentication.

[0003] However, there is a possibility that non-supported functions may be exploited by tampering with the authentication flag through a physical attack targeting physical vulnerabilities. Physical attacks are, for example, fault injection attacks such as power glitches, clock glitches, or electromagnetic wave irradiation.

[0004] Figure 1 shows an example of a fault injection attack. The ID authentication mechanism shown in Figure 1 includes a comparator and a flip-flop (FF). The comparator receives an ID input value and an ID expectation value as input. The ID input value is the value entered for authentication, such as a password or authentication code. The ID expectation value is the value that is compared with the ID input value to perform authentication. The comparator compares the ID input value and the ID expectation value bit by bit. The comparator outputs a voltage indicating the comparison result for each bit. The output from the comparator is input as data to the FF. The FF outputs an authentication flag indicating assert or negate, depending on the output from the comparator that is input bit by bit. In this case, if a fault injection attack is performed on the FF, the FF outputs an assert as the authentication flag, regardless of the output from the comparator. Depending on the authentication flag indicating assert, entry to an unsupported function is made. In this way, there was a possibility that unsupported functions could be exploited by performing incorrect authentication through an attack.

[0005] As a related technology, Non-Patent Document 1 discloses a digital detector for detecting electromagnetic pulse injection, which is an example of fault injection. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] D. El-Baze, J.-B. Rigaud, and P. Maurine (2016). A Fully-Digital EM Pulse Detector. In Design, Automation & Test in Europe Conference & Exhibition (DATE), pages 439-444. IEEE, 2016 [Overview of the project] [Problems that the invention aims to solve]

[0007] There is a need to improve the tamper resistance of semiconductor devices to physical attacks. Other challenges and novel features will become apparent from the description and accompanying drawings herein. [Means for solving the problem]

[0008] A semiconductor device according to one aspect of the present disclosure includes a transition circuit that transitions a state at a predetermined Hamming distance according to the result of comparing a value to be authenticated and a reference value, and a determination circuit that determines the validity of authentication by determining whether the Hamming distance between the state before the transition and the state after the transition matches the predetermined Hamming distance.

[0009] A method for authenticating a semiconductor device according to one aspect of the present disclosure includes determining the validity of the authentication by transitioning a state at a predetermined Hamming distance according to the result of comparing a value to be authenticated with a reference value, and determining whether the Hamming distance between the state before the transition and the state after the transition matches the predetermined Hamming distance. [Effects of the Invention]

[0010] This disclosure provides a test method and information processing apparatus for a semiconductor device that can improve the tamper resistance of the semiconductor device to physical attacks. [Brief explanation of the drawing]

[0011] [Figure 1] This figure shows an example of a fault injection attack. [Figure 2] This figure shows an example of a binary counter transitioning through 4-bit states. [Figure 3] This figure shows an example of a Johnson counter transitioning through a 3-bit state. [Figure 4] This is a block diagram showing an example configuration of a semiconductor device according to Embodiment 1. [Figure 5] This flowchart shows a typical example of processing performed by the semiconductor device according to Embodiment 1. [Figure 6]This is a block diagram showing an example configuration of a semiconductor device according to Embodiment 2. [Figure 7] This is a block diagram showing an example configuration of the authentication function IP according to Embodiment 2. [Figure 8] This is a timing chart showing an example of the operation of a semiconductor device according to Embodiment 2. [Figure 9] This is a block diagram showing an example configuration of a semiconductor device according to Embodiment 3. [Figure 10] This is a block diagram showing an example configuration of the authentication function IP according to Embodiment 3. [Figure 11] This is a timing chart showing an example of the operation of a semiconductor device according to Embodiment 3. [Modes for carrying out the invention]

[0012] The embodiments will be described below with reference to the drawings. Note that the drawings are simplified. The technical scope of the embodiments should not be narrowed based on the drawings. Also, the same elements in multiple drawings are denoted by the same reference numerals. Repetitive explanations will be omitted where appropriate.

[0013] In the following embodiments, the description will be divided into multiple sections or embodiments where necessary for convenience. However, unless otherwise specified, the multiple sections or embodiments are not unrelated to each other. One section or embodiment is a modification, application example, detailed explanation, supplementary explanation, etc., of part or all of the other section or embodiment. Also, in the following embodiments, when referring to the number of elements (including number, numerical value, quantity, range, etc.), the number of elements is not limited to a specific number unless otherwise specified. The configurations or processes shown in each embodiment can be combined with the configurations or processes shown in other embodiments as appropriate.

[0014] Furthermore, in the following embodiments, components (including operation steps) are not essential unless specifically stated or considered to be clearly essential in principle. The shape or positional relationship of components includes those that are approximate or similar to the mentioned shape or positional relationship, unless specifically stated. The number of elements (including the number of pieces, numerical values, quantities, ranges, etc.) also includes numbers that are approximate or similar to the mentioned number, unless specifically stated.

[0015] <Premise Explanation of the Present Disclosure> Hereinafter, the relationship between the attack and the Hamming distance of the state in the present disclosure will be described. The Hamming distance is the number of positions where the symbols at the same position are different when bit strings of the same length are compared. In the present disclosure, the following is assumed as the attacker's attack ability against the semiconductor device. The attacker can cause a bit error in data having a plurality of bit values in one attack. A bit error means a process of illegally rewriting (tampering) a single bit value in the data or a plurality of bit values of the same value in the data to different bit values. For example, a bit error means tampering with one or more "0"s in the data to "1", or tampering with one or more "1"s in the data to "0". However, the attacker cannot illegally rewrite each of a plurality of bit values with different values in the data in one attack. For example, assume that "F0h" is the data to be attacked. At this time, the attacker can tamper with the data to "00h" or "FFh" by one attack. However, the attacker cannot tamper with the data to "0Fh" by one attack. In the present disclosure, the above-described attack is assumed as a realistically assumed attack.

[0016] In addition, in the present disclosure, a state machine that transitions states at a predetermined Hamming distance in response to an external input is also assumed. The predetermined Hamming distance is any integer greater than or equal to 1. As a specific example of realizing the state machine, a binary counter and a Johnson counter are listed here. However, as the counter, other types of counters (for example, Gray code counters) may be used. Also, the Hamming distance at which the counter transitions states is not limited to 1 or 2. The Hamming distance may be any distance greater than or equal to 3. Also, the number of transitions until the state returns to the initial state by repeating the state transition is arbitrary.

[0017] FIG. 2 is a diagram showing an example in which a binary counter transitions 4-bit states. (a1) First, the binary counter transitions the state from the initial state A1 “0001” to the state B1 “0010” in response to an external input. (b1) Next, the binary counter transitions the state from the state B1 “0010” to the state C1 “0100” in response to an external input. (c1) Next, the binary counter transitions the state from the state C1 “0100” to the state D1 “1000” in response to an external input. (d1) Next, the binary counter transitions the state from the state D1 “1000” to the state A1 “0001” in response to an external input. Note that the Hamming distance “2” separates each of between the state A1 and the state B1, the state B1 and the state C1, the state C1 and the state D1, and the state D1 and the state A1. Thereafter, when there is an external input, the binary counter returns to (a1) and executes a state transition.

[0018] Figure 3 shows an example of a Johnson counter transitioning through 3-bit states. (a2) First, the Johnson counter transitions from the initial state A2 "000" to state B2 "100" in response to an external input. (b2) Next, the Johnson counter transitions from state B2 "100" to state C2 "110" in response to an external input. (c2) Next, the Johnson counter transitions from state C2 "110" to state D2 "111" in response to an external input. (d2) Next, the Johnson counter transitions from state D2 "111" to state E2 "011" in response to an external input. (e2) Next, the Johnson counter transitions from state E2 "011" to state F2 "001" in response to an external input. (f2) Next, the Johnson counter transitions from state F2 "001" to state A2 "000" in response to an external input. Note that the distance between states A2 and B2, B2 and C2, C2 and D2, D2 and E2, E2 and F2, and F2 and A2 is each a Hamming distance of "1". Subsequently, if there is an external input, the Johnson counter returns to (a2) and executes a state transition.

[0019] This disclosure improves the integrity of authentication against attacks by utilizing the characteristics of the counters described above. As a specific example, let's assume that an attack is performed on the binary counter shown in Figure 2. Here, we assume the following two types of bit errors that may occur as a result of the attack. (A) When a bit error can occur only at the bit position where a bit change in the state occurs during a state transition. (B) When a bit error occurs at all bit positions of the state during a state transition.

[0020] First, let's consider (A). In Figure 2, the bit positions of the state that change when transitioning from state A "0001" to state B "0010" are bit0 and bit1. In the first case, let's assume that an attacker performs an attack that induces a bit error that changes the bit value "1" to "0". In this case, since bit0 of state A is "1", state A "0001" is altered to state "0000". The Hamming distance between state A and the altered state is "1". In the second case, let's assume that an attacker performs an attack that induces a bit error that changes the bit value "1" to "0". In this case, since bit1 of state A is "0", state A "0001" is altered to state "0011". The Hamming distance between state A and the altered state is "1". Therefore, in both the first and second cases, the Hamming distance between the tampered state and the original state A deviates from the Hamming distance "2" that should be satisfied.

[0021] In the first case in (B), we assume that the attacker performs an attack that induces a bit error, changing the bit value "1" to "0". This attack is performed when transitioning from state A "0001" to state B "0010" in Figure 2. In this case, state A "0001" is altered to state "0000". The Hamming distance between state A and the altered state becomes "1". In the second case, we assume that the attacker performs an attack that induces a bit error, changing the bit value "0" to "1". State A "0001" is altered to state "1111". The Hamming distance between state A and the altered state becomes "3". Therefore, in both the first and second cases, the Hamming distance between the altered state and the original state A deviates from the Hamming distance of "2" that should be satisfied.

[0022] In case (A) or (B), assume the existence of a circuit that compares the Hamming distance between the state before the transition and the state after the transition with the Hamming distance that should be satisfied. In this case, the circuit can determine that the data has been tampered with by an attacker by determining that the Hamming distance between the two states is different from the Hamming distance that should be satisfied. In Figure 2, even in transitions other than the transition from state A to state B, the circuit can compare the Hamming distance in the case of tampering with the Hamming distance that should be satisfied. The circuit can use the result of the comparison to determine whether or not the data has been tampered with by an attacker.

[0023] <Embodiment 1> Figure 4 is a block diagram showing an example configuration of a semiconductor device H1 according to Embodiment 1. The semiconductor device H1 includes a transition circuit 10 and a determination circuit 20.

[0024] The transition circuit 10 receives the result of a comparison between the value to be authenticated and the reference value. The value to be authenticated is a value of one or more bits that is subject to authentication. The reference value has the same number of bits as the value to be authenticated. The reference value is a value that is authenticated when compared with the value to be authenticated. The comparison result indicates whether all or part of the value to be authenticated and all or part of the value to be authenticated have the same value. For example, each of the value to be authenticated and the reference value may be divided into predetermined bit lengths. The comparison result may show the result of comparing the divided bit values ​​of the value to the divided bit values ​​of the reference value corresponding to the divided bit values ​​of the value to be authenticated, for each divided bit value.

[0025] The transition circuit 10 transitions the state at a predetermined Hamming distance according to the comparison result. The predetermined Hamming distance is, for example, a Hamming distance specific to the counter that constitutes the transition circuit 10. The predetermined Hamming distance is any Hamming distance of 1 or more. The transition circuit 10 outputs information about the state before the transition and information about the state after the transition to the determination circuit 20.

[0026] The determination circuit 20 determines the validity of authentication by determining whether the Hamming distance between the state before the transition and the state after the transition matches a predetermined Hamming distance. As stated in the "Premise Explanation of This Disclosure," if the transition circuit 10 is attacked, it is likely that the Hamming distance over which the state is transitioned by the transition circuit 10 will not match the predetermined Hamming distance. Therefore, if the Hamming distance over which the state is transitioned by the transition circuit 10 does not match the predetermined Hamming distance, the determination circuit 20 determines that authentication is not valid. On the other hand, if the Hamming distance over which the state is transitioned by the transition circuit 10 matches the predetermined Hamming distance, the determination circuit 20 determines that authentication is valid.

[0027] [Explanation of the processing flow] Figure 5 is a flowchart illustrating a typical process of semiconductor device H1. The overview of the processes of semiconductor device H1 will be explained by referring to the flowchart in Figure 5. Note that explanations of parts of each process that have already been described will be omitted as appropriate.

[0028] First, the transition circuit 10 transitions the state at a predetermined Hamming distance according to the comparison result between the value to be authenticated and the reference value (step S11). The determination circuit 20 determines whether the Hamming distance between the state before the transition and the state transitioned to in step S11 matches the predetermined Hamming distance (step S12). If the Hamming distance in the transition matches the predetermined Hamming distance (Yes in step S12), the determination circuit 20 determines that authentication is valid (step S13). If the Hamming distance in the transition does not match the predetermined Hamming distance (No in step S12), the determination circuit 20 determines that authentication is not valid (step S14).

[0029] [Explanation of effects] The determination circuit 20 determines whether the Hamming distance between the state before the transition and the state after the transition matches a predetermined Hamming distance in order to determine the validity of the authentication. As stated in the "Explanation of Premise of This Disclosure," in the event of a realistically conceivable attack, the Hamming distance between the state before the transition and the state after the transition is not expected to match the predetermined Hamming distance. Therefore, the semiconductor device H1 can accurately determine the validity of the authentication. In other words, the semiconductor device H1 can improve its resistance to tampering against physical attacks.

[0030] The following embodiments disclose specific examples of the semiconductor device H1 described in Embodiment 1. However, the specific examples of the semiconductor device H1 shown in Embodiment 1 are not limited to those shown below. Furthermore, the configuration and processing of the semiconductor device H1 described below are illustrative and not limiting.

[0031] <Embodiment 2> [Explanation of the structure] Figure 6 is a block diagram showing an example configuration of semiconductor device H2 according to Embodiment 2. The semiconductor device H2 is mounted on a substrate as a SoC (System on a Chip). The semiconductor device H2 includes a CPU (Central Processing Unit) 110, memory 120, OTP (One Time Programmable) 130, debug IF (Interface) 140, authentication function IP (Intellectual Property) 150, debug function IP 160, and other function IP 170. The individual parts of the semiconductor device H2 will be described below.

[0032] The CPU 110 controls the operation of the debug function IP160 and other functions IP170 by executing a program stored in memory 120. The CPU 110 also controls the operation of the debug function IP160 and other functions IP170 by outputting control signals via bus B1.

[0033] OTP130 stores the expected ID value for authentication. The expected ID value is a pre-configured 8-bit (1-byte) value. The expected ID value is a reference value that is compared with the input ID value (input ID value) by the authentication function IP150. OTP130 outputs the expected ID value to the authentication function IP150.

[0034] The debug IF140 receives an ID value input to the semiconductor device H2 for authentication. The input ID value is an 8-bit target value that is compared with the ID reference value. However, the number of bits in the input ID value and ID reference value are not limited to 8 bits. The input ID value and ID reference value may have any number of bits. The debug IF140 outputs the input ID value to the authentication function IP150 and the debug function IP160.

[0035] The authentication function IP150 compares the input ID value with the expected ID value. Depending on the comparison result, the authentication function IP150 changes whether to enable or disable the authentication flag. If the authentication flag is enabled, the authentication function IP150 outputs an asserted authentication flag. If the authentication flag is disabled, the authentication function IP150 outputs a negated authentication flag. A detailed explanation of the authentication function IP150 will be provided later.

[0036] The debug function IP160 performs debugging based on the input ID value and authentication flag. If the authentication flag is asserted, the debug function IP160 allows entry to the debug function. On the other hand, if the authentication flag is negated, the debug function IP160 denies entry to the debug function. The other function IP170 is an IP that performs functions other than the authentication function.

[0037] Figure 7 is a block diagram showing an example configuration of the authentication function IP150. The authentication function IP150 receives an input ID value, an expected ID value, and a clock signal. The authentication function IP150 includes a comparator circuit 151 and an authentication flag generator 152. The parts of the authentication function IP150 will be described below.

[0038] The comparison circuit 151 includes memories 153A and 153B, and comparators 154A to 154D. Memory 153A receives the input ID value from the debug IF 140. Memory 153B receives the expected ID value from the OTP 130. Memory 153A stores the expected ID value bit by bit. Memory 153B stores the expected ID value bit by bit.

[0039] Comparator 154A is input with bits [7] and [6] from memory 153A and bits [7] and [6] from memory 153B. Comparator 154B is input with bits [5] and [4] from memory 153A and bits [5] and [4] from memory 153B. Comparator 154C is input with bits [3] and [2] from memory 153A and bits [3] and [2] from memory 153B. Comparator 154A is input with bits [1] and [0] from memory 153A and bits [1] and [0] from memory 153B. In this way, each comparator 154 is input with the bit values ​​of a predetermined part of the input ID value and the bit values ​​of a predetermined part of the ID expected value corresponding to the bits of the predetermined part of the input ID value. Furthermore, each comparator 154 receives bit values ​​obtained by dividing the input ID value into identical 2-bit lengths, and bit values ​​obtained by dividing the ID expectation value into identical 2-bit lengths.

[0040] Comparator 154A compares the 2-bit value of the input ID value with the 2-bit value of the expected ID value. If the input bit values ​​match, comparator 154A forwards a comparison result flag indicating assertion to the authentication flag generator 152. If the input bit values ​​do not match, comparator 154A forwards a comparison result flag indicating negate to the authentication flag generator 152. Each comparator 154 other than comparator 154A also compares the 2-bit value of the input ID value with the 2-bit value of the expected ID value. If the input bit values ​​match, each comparator 154 forwards a comparison result flag indicating assertion to the authentication flag generator 152. If the input bit values ​​do not match, each comparator 154 forwards a comparison result flag indicating negate to the authentication flag generator 152. Hereinafter, the comparison result flag indicating an assertion output by comparator 154A will be referred to as assert flag A, and the comparison result flag indicating an assertion output by comparator 154B will be referred to as assert flag B. Furthermore, the comparison result flag indicating an assertion output by comparator 154C will be referred to as assert flag C, and the comparison result flag indicating an assertion output by comparator 154D will be referred to as assert flag D.

[0041] In Figure 7, each comparator 154 outputs a high-active signal as a comparison result flag indicating assertion. However, each comparator 154 may also output a low-active signal as a comparison result flag indicating assertion. As a variation, each comparator 154 may compare the 1-bit value of the input ID value with the 1-bit value of the expected ID value. As another example, each comparator 154 may compare multiple values ​​of 3 bits or more of the input ID value with multiple values ​​of 3 bits or more of the expected ID value. Furthermore, the number of bits of the input ID value and expected ID value compared by each comparator 154 do not have to be the same.

[0042] The authentication flag generator 152 has a counter circuit 155 and a determination circuit 156. The counter circuit 155 has a binary counter that transitions between 5-bit states. The counter circuit 155 functions as a state machine that transitions between states with a Hamming distance of "2". The state transitions are described below.

[0043] (i) First, when the counter circuit 155 receives assert flag A, it transitions the state from state I "00001" to state II "00010", which is a Hamming distance of "2". State I is the initial state. (ii) Next, when the counter circuit 155 receives assert flag B, it transitions the state from state II "00010" to state III "00100", which is a Hamming distance of "2". (iii) Next, when the counter circuit 155 receives assert flag C, it transitions the state from state III "00100" to state IV "01000", which is a Hamming distance of "2". (iv) Next, when the counter circuit 155 receives assert flag D, it transitions the state from state IV "01000" to state V "10000", which is a Hamming distance of "2". When the state of the counter circuit 155 transitions to state V "10000", it returns the state to state I "00001". Subsequently, if the counter circuit 155 receives assert flag A, it returns to (i) and executes a state transition. However, if the counter circuit 155 receives a comparison result flag indicating negate, it does not execute a state transition. The Hamming weights of states I through V are all "1". Note that the Hamming weight of a state indicates the number of "1" bits in that state.

[0044] The counter circuit 155 transitions the state at a predetermined Hamming distance according to the comparison result of each comparator 154. When a state transition occurs in any of (i) to (iv), the counter circuit 155 outputs information about the transitioned state to the determination circuit 156. The information for the initial state, state I, is stored in the determination circuit 156 beforehand.

[0045] The determination circuit 156 receives information about the state after the transition from the counter circuit 155 when a state transition occurs in any of (i) to (iv). The determination circuit 156 calculates the Hamming distance between the state before the transition and the state after the transition. The determination circuit 156 determines whether the calculated Hamming distance is 2 or not.

[0046] If the Hamming distance is determined to be 2 in any of (i) to (iii), the determination circuit 156 determines that the state transition was successful. The determination circuit 156 does not execute any processing and remains in a waiting state until the next state transition occurs. If the Hamming distance is determined to be 2 in (iv), the determination circuit 156 determines that the authentication flag is valid. On the other hand, if the Hamming distance is not 2 in any of (i) to (iv), the determination circuit 156 determines that the state transition was invalid. Specifically, the determination circuit 156 determines that the state transition was invalid due to a fault injection attack on the clock signal. The determination circuit 156 then determines that the authentication flag is invalid. In this manner, the determination circuit 156 determines the integrity of the authentication.

[0047] If the authentication flag is determined to be valid, the authentication function IP150 outputs an assert as the authentication flag. On the other hand, if the authentication flag is determined to be invalid, the authentication function IP150 outputs a negate as the authentication flag. When the authentication flag is asserted, the semiconductor device H2 can enter into a predetermined function. Conversely, when the authentication flag is negated, the semiconductor device H2 cannot enter into a predetermined function. Therefore, in the event of a fault injection attack, the semiconductor device H2 can be prevented from entering into a predetermined function.

[0048] Figure 8 is a timing chart showing an example of the operation of semiconductor device H2. The operation of semiconductor device H2 will be described below in chronological order with reference to Figures 7 and 8. (1) to (8) in Figure 7 correspond to (1) to (8) below. Note that explanations of the operation of parts that have already been described will be omitted as appropriate.

[0049] (1) First, the power supply to semiconductor device H2 is turned on. A clock signal for operation is supplied to semiconductor device H2. After the power is turned on, the expected ID value stored in OTP130 is loaded into the authentication function IP150. The expected ID value is stored in memory 153A.

[0050] (2) The input ID value is also input to the authentication function IP150 via the debug IF140. At timing t0 or later in Figure 8, the enable signal for loading from the debug IF140 to memory 153B is turned on. In response to the enable signal being turned on, the input ID value is stored in memory 153B in bit order.

[0051] (3) At each clock cycle, each bit value of the input ID value and each bit value of the corresponding ID expectation value are input to the comparator 154 of the authentication function IP150. Between timings t0 and t1, the comparator 154A receives the 2-bit value of the input ID value and the 2-bit value of the corresponding ID expectation value. At timing t1, the comparator 154A compares the two-bit values ​​that were input to it.

[0052] (4) If the input bit values ​​match, comparator 154A transfers a comparison result flag indicating assertion (assertion flag A) to authentication flag generator 152. If the input data do not match, comparator 154A transfers a comparison result flag indicating negate to authentication flag generator 152.

[0053] (5) When the counter circuit 155 receives assert flag A, it transitions the state from state I "00001" to state II "00010", which is a Hamming distance of "2". The counter circuit 155 outputs the information of state II to the determination circuit 156.

[0054] (6) The determination circuit 156 receives information about state II from the counter circuit 155 as information about the state after the transition. The determination circuit 156 calculates the Hamming distance between state I, which is the state before the transition, and state II, which is the state after the transition. The determination circuit 156 determines whether the calculated Hamming distance is 2 or not. If the determination circuit 156 determines that the Hamming distance is 2, it determines that the state transition has occurred normally. The determination circuit 156 does not execute any processes and remains in a waiting state until the next state transition occurs. On the other hand, if the determination circuit 156 determines that the Hamming distance is not 2, it determines that the state transition has occurred illegally. The determination circuit 156 then determines that the authentication flag is invalid.

[0055] (7)(6) Assume that the state transition was determined to have occurred successfully. Comparator 154B performs the same processing as comparator 154A as shown in (3) and (4). Comparator 154B compares the two input bits at timing t2. Then, counter circuit 155 performs the same processing as shown in (5) in response to receiving assert flag B. Determination circuit 156 performs the same processing as shown in (6) when it receives information of state III as information of the transitioned state. Comparators 154C and 154D also perform the same processing as shown in (3) to (6). Comparator 154C compares the two input bits at timing t3. Comparator 154D also compares the two input bits at timing t4.

[0056] Furthermore, at timing t4 and beyond, the enable signal for loading from debug IF140 to memory 153B is turned off. In response to the enable signal being turned off, the storage of the input ID value to memory 153B is stopped.

[0057] If the process in (7) is performed for comparator 154D, the determination circuit 156 calculates the Hamming distance between state IV, the state before the transition, and state V, the state after the transition. The determination circuit 156 determines whether the calculated Hamming distance is 2 or not. If it determines that the Hamming distance is 2, the determination circuit 156 determines that the authentication flag is valid. On the other hand, if it determines that the Hamming distance is not 2, the determination circuit 156 determines that the state transition was performed illegally.

[0058] (8) If the authentication flag is determined to be valid, the authentication function IP150 outputs assert as the authentication flag. On the other hand, if the authentication flag is determined to be invalid, the authentication function IP150 outputs negate as the authentication flag. If the authentication flag is asserted, the debug function IP160 allows entry to the debug function. On the other hand, if the authentication flag is negate, the debug function IP160 denies entry to the debug function.

[0059] [Explanation of effects] As described above, each comparator 154 compares the bit values ​​obtained by dividing the input ID value with the bit values ​​obtained by dividing the ID expected value corresponding to the bit values ​​obtained by dividing the input ID value. The counter circuit 155 transitions the state at a predetermined Hamming distance according to the comparison result of each comparator 154. Each time the state transitions, the determination circuit 156 can determine whether the Hamming distance at which the state transition occurred matches a predetermined Hamming distance. Therefore, the semiconductor device H2 can strictly determine the validity of authentication. The semiconductor device H2 can suppress unauthorized entries into the debugging function.

[0060] Furthermore, in the event of a fault injection attack, the Hamming distance between the state before the transition and the state after the transition is likely to be "1," as described in the "Premise Explanation of This Disclosure." If the counter circuit 155 transitions the state with a Hamming distance of "1," the judgment circuit 156 may incorrectly determine that the state transition was successful, even in the event of a fault injection attack. However, the counter circuit 155 can transition the state with a Hamming distance of 2 or more. Therefore, even in the event of a fault injection attack, the possibility of the judgment circuit 156 incorrectly determining that the state transition was successful can be reduced.

[0061] In the above example, the determination circuit 156 determines whether the state transition was successful by determining the Hamming distance between the state before the transition and the state after the transition. However, the determination circuit 156 may also determine whether the state transition was successful by further using the Hamming weight of the state after the transition.

[0062] The following is a detailed explanation. The determination circuit 156 calculates the Hamming distance between the state before the transition and the state after the transition when a state transition occurs in any of (i) to (iv). The determination circuit 156 determines whether the calculated Hamming distance is 2 or not. If it determines that the Hamming distance is not 2, the determination circuit 156 determines that the state transition was performed incorrectly.

[0063] If the Hamming distance is determined to be 2, the determination circuit 156 further compares the Hamming weight of the actual transitioned state with the Hamming weight of the original transitioned state. In this example, the Hamming weight of the original transitioned state is "1". Note that the Hamming weight of the original transitioned state may be stored in the memory of the determination circuit 156. The determination circuit 156 performs the Hamming weight comparison by referring to the memory. In this example, the Hamming weight of the state is "1" regardless of the state.

[0064] If the Hamming weight of the actual state after the transition is the same as the Hamming weight of the intended state after the transition, the determination circuit 156 determines that the state transition was successful. The determination circuit 156 will not execute any processing and will remain in a waiting state until the next state transition occurs. On the other hand, if the determination circuit 156 determines that the Hamming weight of the actual state after the transition is not the same as the Hamming weight of the intended state after the transition, the determination circuit 156 determines that the state transition was invalid.

[0065] For example, let's assume a fault injection attack occurs when a state transitions from state I to state II. Let's assume that the attack causes the state to change from state I "00001" to state "00111". In this case, the judgment circuit 156 calculates the Hamming distance between the state before the transition and the state after the transition as "2". If no judgment is performed on the Hamming weight, the judgment circuit 156 will determine that the state transition occurred normally, even though an attack occurred.

[0066] However, the determination circuit 156 performs a Hamming weight check and determines that the Hamming weight of the actual transitioned state is not the same as the Hamming weight of the original transitioned state. Therefore, the determination circuit 156 can determine that the state transition was performed incorrectly.

[0067] Furthermore, although unlikely, it is conceivable that in an attack, bit errors may occur only at bit positions where no bit changes occur in the state. However, even in such cases, the determination circuit 156 can determine that a state transition has been illegitimate by performing a Hamming weight determination.

[0068] The determination circuit 156 may first compare the Hamming weight of the actual state after the transition with the Hamming weight of the original state after the transition. If the Hamming weight of the actual state after the transition is the same as the Hamming weight of the original state after the transition, the determination circuit 156 performs a Hamming distance determination. If the Hamming distance is 2, the determination circuit 156 determines that the state transition was performed normally. On the other hand, if the Hamming weight before the state transition is not the same as the Hamming weight after the transition, or if the Hamming distance is not 2, the determination circuit 156 determines that the state transition was performed incorrectly.

[0069] In this way, by having the determination circuit 156 perform a determination on the Hamming weight, the semiconductor device H2 can determine the validity of authentication more accurately. Therefore, the tamper resistance of the semiconductor device H2 to physical attacks is further improved.

[0070] Note that the Hamming distance at which the counter circuit 155 transitions states is not limited to 2, but may be 1 or any integer greater than or equal to 3. Also, the Hamming weights of all states that the counter circuit 155 can transition to may all be the same value. As mentioned above, the Hamming weights of all states may all be "1", or they may be values ​​greater than or equal to "2". Alternatively, the Hamming weights of all possible states may have different values. However, if the Hamming weights of all possible states are the same value, the determination circuit 156 can use the same value as the Hamming weight of the original transitioned state. Therefore, the determination circuit 156 can perform all determinations with a simple configuration.

[0071] Alternatively, instead of comparing the Hamming weight of the actual state after the transition with the Hamming weight of the original state after the transition, the determination circuit 156 may perform the following determination: The determination circuit 156 calculates the difference between the Hamming weight of the state before the transition and the Hamming weight of the state after the transition.

[0072] If the Hamming distance that the counter circuit 155 uses to transition states is even, the determination circuit 156 determines whether the calculated difference is even or not. If the calculated difference is even, the determination circuit 156 determines that the state transition was performed normally. On the other hand, if the determination circuit 156 determines that the calculated difference is odd, it determines that the state transition was performed incorrectly.

[0073] On the other hand, if the Hamming distance that the counter circuit 155 uses to transition states is odd, the determination circuit 156 determines whether the calculated difference is odd or not. If the calculated difference is odd, the determination circuit 156 determines that the state transition was performed normally. On the other hand, if the determination circuit 156 determines that the calculated difference is even, it determines that the state transition was performed incorrectly.

[0074] When a state transition occurs normally, the parity of the Hamming distance when the counter circuit 155 transitions the state matches the parity of the difference in Hamming weights between the states before and after the transition. However, when a state transition occurs incorrectly, the parity of the Hamming distance when the counter circuit 155 transitions the state may not match the parity of the difference in Hamming weights between the states before and after the transition. Thus, by having the determination circuit 156 perform a determination on the Hamming weights, the semiconductor device H2 can determine the validity of the authentication more accurately.

[0075] The determination circuit 156 may also perform the determination of the calculated Hamming distance and Hamming weight each time that one of the comparators 154A to 154D outputs a comparison result flag. In another example, the determination circuit 156 performs the determination of the calculated Hamming distance and Hamming weight when some of the comparators 154A to 154D output a comparison result flag. The determination circuit 156 performs either the determination of the calculated Hamming distance or the determination of the Hamming weight when another comparator 154 outputs a comparison result flag.

[0076] <Embodiment 3> [Explanation of the structure] Figure 9 is a block diagram showing an example configuration of semiconductor device H3 according to Embodiment 3. The semiconductor device H3 includes a CPU 110, memory 120, OTP 130, debug IF 140, debug function IP160, other function IP170, TRNG (True Random Number Generator) 210, and authentication function IP220. The descriptions of the CPU 110, memory 120, OTP 130, debug IF 140, debug function IP160, and other function IP170 are the same as those described in Embodiment 2, so they will be omitted. The TRNG 210 and authentication function IP220, which are unique configurations of the semiconductor device H3, will be described below.

[0077] TRNG210 generates a random value and outputs it to the authentication function IP220. However, a random number generator other than TRNG may be used as the random number generator. The authentication function IP220 uses the random value received from TRNG210 to determine the bit length of the division between the input ID value and the expected ID value to be compared.

[0078] Figure 10 is a block diagram showing an example configuration of the authentication function IP220. The authentication function IP220 receives input ID values, expected ID values, a clock signal, and random values. The authentication function IP220 includes a comparator circuit 221 and an authentication flag generator 222.

[0079] The comparison circuit 221 includes memories 223A and 223B, and comparators 224A to 224D. Memory 223A receives the input ID value from the debug IF 140. Memory 223B receives the expected ID value from the OTP 130. Memory 223A stores the expected ID value bit by bit. Memory 223B stores the expected ID value bit by bit.

[0080] The authentication function IP220 determines the length of the bit values ​​of the input ID value and the expected ID value to be compared for each comparator 224 using a random value. The authentication function IP220 determines the bit length of each comparator 224 according to the random value, for example by referring to a table stored inside the authentication function IP220. Figure 10 shows an example in which the bit values ​​of the input ID value and the expected ID value are divided into "1 bit", "2 bits", "2 bits", and "3 bits" by a random value.

[0081] Specifically, comparator 224A is input with the bit number [7] in memory 223A and the bit number [7] in memory 223B. Comparator 224B is input with the bits number [6] and [5] in memory 223A and the bits number [6] and [5] in memory 223B. Comparator 224C is input with the bits number [4] and [3] in memory 223A and the bits number [4] and [3] in memory 223B. Comparator 224A is input with the bits number [2], [1] and [0] in memory 223A and the bits number [2], [1] and [0] in memory 223B.

[0082] Comparator 224A compares the 3-bit value of the input ID value with the 3-bit value of the expected ID value. If the input bit values ​​match, comparator 224A forwards a comparison result flag indicating assertion to the authentication flag generator 222. If the input bit values ​​do not match, comparator 224A forwards a comparison result flag indicating negate to the authentication flag generator 222. Each comparator 224 other than comparator 224A also compares the bit values ​​of the input ID value with the bit values ​​of the expected ID value. If the input bit values ​​match, each comparator 224 forwards a comparison result flag indicating assertion to the authentication flag generator 222. If the input bit values ​​do not match, each comparator 224 forwards a comparison result flag indicating negate to the authentication flag generator 222.

[0083] As described above, by using random values, the bit lengths of the input ID values ​​and expected ID values ​​to be compared are determined randomly. In other words, the comparison points of the input ID values ​​and expected ID values ​​in each comparator 224 are randomly specified by random values.

[0084] The authentication flag generator 222 includes a counter circuit 225 and a determination circuit 226. The operation of the counter circuit 225 and the determination circuit 226 is the same as the operation of the counter circuit 155 and the determination circuit 156 in Embodiment 2, so it will be omitted.

[0085] Figure 11 is a timing chart showing the operation of semiconductor device H3. The operation of semiconductor device H3 will be described chronologically below with reference to Figures 10 and 11. (11) to (19) in Figure 10 correspond to (11) to (19) below. Note that explanations of the operation of parts already described will be omitted as appropriate.

[0086] (11) First, the power supply to semiconductor device H3 is turned on. A clock signal for operation is supplied to semiconductor device H3. After the power is turned on, the expected ID value stored in OTP130 is loaded into the authentication function IP220. The expected ID value is stored in memory 223A. Furthermore, a random value generated by TRNG210 is loaded into the authentication function IP220.

[0087] (12) The authentication function IP220 determines the bit length of the division of the input ID value and the expected ID value that each comparator 224 will compare, according to a random value. In this example, the bit lengths of the division of the input ID value and the expected ID value that each comparator 224 will compare are "1 bit", "2 bits", "2 bits", and "3 bits".

[0088] (13) The input ID value is also input to the authentication function IP220 via the debug IF140. At timing t0 or later in Figure 11, the enable signal for loading from the debug IF140 to memory 223B is turned on. In response to the enable signal being turned on, the input ID value is stored in memory 223B in bit order.

[0089] (14) At each clock cycle, each bit value of the input ID value and each bit value of the corresponding ID expectation value are input to the comparator 224 of the authentication function IP220. Between timings t0 and t1, the comparator 224A receives the value of one bit of the input ID value and the value of one bit of the corresponding ID expectation value. At timing t1, the comparator 224A compares the input bit values.

[0090] (15) If the input bit values ​​match, comparator 224A transfers a comparison result flag indicating assertion (assertion flag A) to authentication flag generator 222. If the input data do not match, comparator 224A transfers a comparison result flag indicating negate to authentication flag generator 222.

[0091] (16) When the counter circuit 225 receives assert flag A, it transitions the state from state I "00001" to state II "00010", which is a Hamming distance of "2". The counter circuit 225 outputs the information of state II to the determination circuit 226. The information of state I, which is the initial state, is stored in the determination circuit 226 beforehand.

[0092] (17) The determination circuit 226 receives information about state II from the counter circuit 225 as information about the state after the transition. The determination circuit 226 calculates the Hamming distance between state I, which is the state before the transition, and state II, which is the state after the transition. The determination circuit 226 determines whether the calculated Hamming distance is 2 or not. A detailed explanation of the determination is omitted as it is as described in (6) of Embodiment 2.

[0093] Assume that the state transition was determined to have occurred successfully in (18) and (17). Comparator 224B performs the same processing as comparator 224A as shown in (14) and (15). Comparator 224B compares the two input bits at timing t2. Then, counter circuit 225 performs the same processing as shown in (16) in response to receiving assert flag B. Determination circuit 226 performs the same processing as shown in (17) when it receives information for state III as information for the transitioned state. Comparators 224C and 224D also perform the same processing as shown in (14) to (17). Comparator 224C compares the two input bits at timing t3. Comparator 224D compares the three input bits at timing t4.

[0094] Furthermore, at timing t4 and beyond, the enable signal for loading from debug IF140 to memory 223B is turned off. In response to the enable signal being turned off, the storage of the input ID value into memory 223B is stopped.

[0095] If the process in (18) is performed for comparator 224D, the determination circuit 226 calculates the Hamming distance between state IV, the state before the transition, and state V, the state after the transition. The determination circuit 226 determines whether the calculated Hamming distance is 2 or not. If it determines that the Hamming distance is 2, the determination circuit 226 determines that the authentication flag is valid. On the other hand, if it determines that the Hamming distance is not 2, the determination circuit 226 determines that the state transition was performed illegally.

[0096] (19) If the authentication flag is determined to be valid, the authentication function IP220 outputs assert as the authentication flag. On the other hand, if the authentication flag is determined to be invalid, the authentication function IP220 outputs negate as the authentication flag. As shown in (8) of Embodiment 2, the debug function IP160 sets whether to allow or deny entry to the debug function according to the authentication flag.

[0097] [Explanation of effects] As described above, the semiconductor device H3 includes a TRNG210 that randomly determines a predetermined bit length for dividing the input ID value and the expected ID value. Since the bit length used for division changes dynamically, it becomes difficult for an attacker to predict effective attack points in the comparison between the input ID value and the expected ID value. Therefore, the semiconductor device H3 can further improve its resistance to tampering against physical attacks.

[0098] Although the present invention has been specifically described above based on embodiments, it goes without saying that the present invention is not limited to the above embodiments and can be modified in various ways without departing from its essence. For example, it goes without saying that the various variations of semiconductor device H2 described in Embodiment 2 can also be applied to semiconductor device H3. [Explanation of Symbols]

[0099] H1, H2, H3 semiconductor equipment 10 Transition circuit 20 Judgment circuit 110 CPU 120 memory 130 OTP 140 Debug IF 150, 220 Authentication Function IP 151 Comparison circuit 152 Authentication Flag Generator 153 memory 154 Comparator 155 Counter Circuit 156 Judgment circuit 160 Debugging Function IP 170 Other Functions IP 210 TRNG

Claims

1. A transition circuit that transitions the state at a predetermined Hamming distance according to the comparison result between the value to be authenticated and the reference value, A determination circuit that determines the validity of authentication by determining whether the Hamming distance between the state before the transition and the state after the transition matches the predetermined Hamming distance, A semiconductor device equipped with a semiconductor device.

2. The system further comprises a plurality of comparators that divide each of the target value and the reference value into predetermined bit lengths, and compare the divided bit values ​​of the target value with the divided bit values ​​of the reference value corresponding to the divided bit values ​​of the target value for each divided bit value. The transition circuit transitions the state at a predetermined Hamming distance according to the comparison result for each bit value. The semiconductor device according to claim 1.

3. The system further includes a random number generator that randomly determines the predetermined bit length for dividing each of the target value and the reference value. The semiconductor device according to claim 2.

4. The determination circuit further uses the Hamming weights of the transitioned state to determine the validity of the authentication. The semiconductor device according to claim 1.

5. The determination circuit further determines whether the Hamming weight of the actual transitioned state is the same as the Hamming weight of the original transitioned state, thereby determining the validity of the authentication. The semiconductor device according to claim 4.

6. The predetermined Hamming distance is an even number, The determination circuit further determines whether the difference between the Hamming weight of the state before the transition and the Hamming weight of the state after the transition is even, thereby determining the validity of the authentication. The semiconductor device according to claim 4.

7. The predetermined Hamming distance is an odd number, The determination circuit further determines whether the difference between the Hamming weight of the state before the transition and the Hamming weight of the state after the transition is odd, thereby determining the validity of the authentication. The semiconductor device according to claim 4.

8. The predetermined Hamming distance is 2 or more. The semiconductor device according to claim 1.

9. Depending on the comparison result between the value to be authenticated and the reference value, the state is transitioned at a predetermined Hamming distance. The validity of the authentication is determined by determining whether the Hamming distance between the state before the transition and the state after the transition matches the predetermined Hamming distance. Authentication methods for semiconductor devices.

10. The aforementioned semiconductor device is Each of the target value and the reference value is divided into predetermined bit lengths, and the divided bit values ​​of the target value and the divided bit values ​​of the reference value corresponding to the divided bit values ​​of the target value are compared for each divided bit value. Depending on the comparison result for each bit value, the state is transitioned at a predetermined Hamming distance. The authentication method according to claim 9.

11. The semiconductor device randomly determines the predetermined bit length for dividing each of the target value and the reference value. The authentication method according to claim 9.

12. The semiconductor device further uses the Hamming weights of the transitioned states to determine the validity of the authentication. The authentication method according to claim 9.

13. The semiconductor device determines the validity of the authentication by further determining whether the Hamming weight of the actual state after the transition is the same as the Hamming weight of the original state after the transition. The authentication method according to claim 12.

14. The predetermined Hamming distance is an even number, The semiconductor device determines the validity of the authentication by further determining whether the difference between the Hamming weight of the state before the transition and the Hamming weight of the state after the transition is even. The authentication method according to claim 12.

15. The predetermined Hamming distance is an odd number, The semiconductor device determines the validity of the authentication by further determining whether the difference between the Hamming weight of the state before the transition and the Hamming weight of the state after the transition is odd or not. The authentication method according to claim 12.

16. The predetermined Hamming distance is 2 or more. The authentication method according to claim 9.

Images