Information processing device

Abstract

Even if a power interruption occurs during a secure area update, the system can still boot normally. [Solution] The information processing device includes a flash memory comprising a non-secure area where a user program is stored, a security program area where a security program for verifying the integrity of the non-secure area is stored, and a plurality of secure areas each comprising a security program address area where the start address of the security program area is stored and a revision area where the revision number is stored; a revision processing unit that determines whether or not there is an abnormality in each of the plurality of secure areas based on the revision number; and a reset vector control unit that, if any of the plurality of secure areas is determined to be abnormal, selects the start address stored in the security program address area of ​​the secure area determined to be normal as a reset vector.

Description

Technical Field

[0001] The present disclosure relates to an information processing apparatus.

Background Art

[0002] Patent Document 1 discloses a microcontroller device including a main memory unit, storing a function program in the main memory unit and executing the same, a security control unit that performs security control on a usage request for the stored content of the main memory unit, a non-modifiable storage unit that non-modifiably stores a security setting program for setting a mode of the security control based on system information and the system information, and a security setting program execution unit that, when activated, reads the security setting program from the non-modifiable storage unit and executes the same prior to execution of the function program.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

[0004] [Summary]

[0005] In a microcomputer equipped with a security function, a flash memory (non-volatile memory) is provided with a rewritable non-secure area for storing user programs and data, a secure area for storing data used in security processing, and a security program area for storing a program for verifying the integrity of the non-secure area (user programs and data).

[0006] The secure area and the security program area are tamper-proof areas, and in the secure area, only authenticated users can update data. In the security program area, erasure and rewriting are not possible during normal operation. After the microcontroller starts up, the program in the security program area is executed by the CPU via the flash memory control unit, and the integrity of the non-secure area is verified. Expected value data and other information necessary for integrity verification are loaded from the secure area and processed by the security control unit and the CPU. After confirming that the non-secure area is safe through the above verification, the user program is executed. Therefore, the start address of the security program area is specified in the reset vector area's vector (reset vector).

[0007] Normally, the reset vector area is allocated to the non-secure area. However, if the non-secure area (user program) is tampered with, and the reset vector is also tampered with to the user program's address, the execution of the security program after startup will be skipped, and the tampered user program will be executed. Therefore, at startup, data stored in the tamper-proof secure area (security program address area) is loaded, and the reset vector control unit selects and uses this loaded data as the reset vector. While it is possible to set the reset vector to a hardware-fixed value, the method of storing and loading it from the secure area is applied to accommodate the extended specifications of the security program area and to allow users to configure it flexibly.

[0008] In conventional methods, if the microcontroller's power is momentarily interrupted due to noise or other factors during a secure area update, the secure area update will not be performed correctly. As a result, there is a possibility that the data in the security program address area may also contain abnormal data. In this case, after power is restored, the security program will not run, and the system will not boot properly.

[0009] This disclosure is made in view of the above circumstances and aims to provide an information processing device that can start up normally even if a momentary power interruption occurs during a secure area update.

[0010] The information processing device according to this disclosure includes a flash memory comprising: a non-secure area where a user program is stored; a security program area where a security program for verifying the integrity of the non-secure area is stored; and a plurality of secure areas each comprising a security program address area where the start address of the security program area is stored and a revision area where a revision number is stored; a revision processing unit for determining whether or not there is an abnormality in each of the plurality of secure areas based on the revision number; and a reset vector control unit that, if any of the plurality of secure areas is determined to be abnormal, selects the start address stored in the security program address area of ​​the secure area determined to be normal as a reset vector. [Brief explanation of the drawing]

[0011] [Figure 1] Figure 1 is a block diagram of an information processing device. [Figure 2] Figure 2 is a block diagram of the reset vector control unit. [Figure 3] Figure 3 is a block diagram of the revision processing unit. [Figure 4] Figure 4 is a flowchart of the processes performed by the information processing device. [Detailed explanation]

[0012] An example of an embodiment of the disclosed technology will be described below with reference to the drawings.

[0013] Figure 1 is a block diagram of the information processing device 10 according to this embodiment. As shown in Figure 1, the information processing device 10 includes a flash memory 12, a CPU 14, a reset vector control unit 16, a revision processing unit 18, a security control unit 20, and a flash memory control unit 22.

[0014] The flash memory 12 includes a non-secure area NS, secure areas S0 and S1, and a security program area SP.

[0015] The non-secure area NS is a rewritable area for storing user programs and data. Furthermore, the non-secure area NS is an area that can be directly erased, rewritten, and read from the CPU 14.

[0016] Secure area S0 is an area that stores data used for security processing and is tamper-proof. Secure area S0 cannot be directly accessed from CPU 14.

[0017] Furthermore, the secure area S0 is an area that can be accessed by the security control unit 20 via deletion, rewriting, and reading by the CPU 14 upon request from the security control unit 20. Deletion and rewriting of the secure area S0 are only possible for users who have successfully authenticated. Also, when updating the data in the secure area S1, the data in the secure area S0 is retained and serves as a backup area. The update includes updating various data such as encryption keys stored in the secure area S1. The same applies to updating the secure area S0.

[0018] Secure area S1 is an area that stores data used for security processing and is tamper-proof. Secure area S1 cannot be directly accessed from CPU 14.

[0019] Also, the secure area S1 is an area where access for erasure, rewriting, and reading can be performed from the security control unit 20 by requesting from the CPU 14. Regarding erasure and rewriting of the secure area S1, only the user who has successfully authenticated is allowed. Also, when updating the secure area S0, the data in the secure area S1 is retained and it also serves as a backup area.

[0020] The security program area SP is an area having tamper resistance for storing a security program for verifying the integrity of the non-secure area NS. Also, the security program area SP is an area where erasure and rewriting are impossible from the CPU 14 and the security control unit 20 during normal operation. Also, the security program area SP is an area where reading from the CPU 14 via the flash memory control unit 22 is possible.

[0021] The non-secure area NS has a reset vector area RV. The reset vector area RV is an area where the start address of the security program area SP storing the security program accessed and executed by the CPU 14 immediately after the information processing apparatus 10 is started is stored as a reset vector.

[0022] The secure area S0 includes a security program address area A0 and a revision area R0.

[0023] The security program address area A0 is an area for storing the start address of the security program area SP used as a reset vector.

[0024] The revision area R0 is an area for storing the revision number of the secure area S0.

[0025] The revision number includes a magic number of a fixed value consisting of a plurality of bits indicating that the secure area has been updated to set the revision, and a serial number indicating the number of rewrites.

[0026] The secure area S1 includes a security program address area A1 and a revision area R1.

[0027] The security program address area A1 is an area for storing the start address of the security program area SP used as a reset vector.

[0028] The revision area R1 is an area for storing the revision number of the secure area S1.

[0029] The CPU 14 is connected to a reset vector control unit 16, a revision processing unit 18, a security control unit 20, and a flash memory control unit 22 via a data bus 24.

[0030] As shown in FIG. 2, the reset vector control unit 16 includes a register RG1, a determination circuit 30, and a reset vector selection circuit 32.

[0031] In the register RG1, during the startup of the information processing apparatus 10, the address stored in the security program address area A0 of the secure area S0 selected based on the result of the revision processing by the revision processing unit 18 described later or the address stored in the security program address area A1 of the secure area S1 is stored. Note that writing from the CPU 14 to the register RG1 is not possible, and only reading is possible.

[0032] The determination circuit 30 determines whether the register value stored in register RG1, i.e., the start address of the security program used as the reset vector, points within the address range of the security program area SP. If the start address points within the address range of the security program area SP, it outputs a determination signal of "1". If the start address points outside the address range of the security program area SP, it outputs a determination signal of "0".

[0033] Furthermore, the determination circuit 30 determines whether the data read from the reset vector area RV of the non-secure area NS, i.e., the reset vector, indicates the address range of the security program area SP. The determination circuit 30 outputs a determination signal of "1" if the reset vector indicates the address range of the security program area SP, and outputs a determination signal of "0" if the reset vector indicates an address outside the address range of the security program area SP.

[0034] Based on the verification result flag TF output from the revision processing unit 18 and the determination signal output from the determination circuit 30, the reset vector selection circuit 32 outputs to the CPU 14 either a reset vector read from the reset vector area RV or the start address of the security program stored in register RG1 as a reset vector. As a result, the CPU 14 accesses the reset vector output from the reset vector control unit 16 and executes the program.

[0035] As shown in Figure 3, the revision processing unit 18 includes registers RG2, RG3, RG4, and a comparison and verification circuit 40.

[0036] The revision processing unit 18 reads data from the revision area R0 of the secure area S0 and stores it in register RG2 while the information processing device 10 is starting up, and also reads data from the revision area R1 of the secure area S1 and stores it in register RG3.

[0037] The comparison and verification circuit 40 generates a comparison result flag CF and a verification result flag TF based on the data stored in registers RG2 and RG3, and stores them in register RG4.

[0038] As shown in Figure 3, the verification result flag TF includes the R0 abnormality flag RF0, the R1 abnormality flag RF1, and the identical flag SF.

[0039] The R0 anomaly flag RF0 is a flag that becomes "1" when the magic number stored in revision area R0 is an anomaly, and "0" when it is normal.

[0040] The R1 abnormality flag RF1 is a flag that becomes "1" when the magic number stored in revision area R1 is abnormal, and "0" when it is normal.

[0041] The identical flag SF is a flag that is set to "1" if the magic number stored in revision area R0 and the magic number stored in revision area R1 are both normal, but the serial numbers are the same, and to "0" if the serial numbers are not the same.

[0042] The comparison and verification circuit 40 determines that secure area S0 is the latest and sets the comparison result flag CF to "0" if both the R0 abnormality flag RF0 and the R1 abnormality flag RF1 are "0" and the serial number stored in register RG2 is greater than the serial number stored in register RG3. On the other hand, if the serial number stored in register RG3 is greater than the serial number stored in register RG2, it determines that secure area S1 is the latest and sets the comparison result flag CF to "1".

[0043] Furthermore, the comparison and verification circuit 40 sets the comparison result flag CF to "0" if the serial number stored in register RG2 and the serial number stored in register RG3 are the same.

[0044] Furthermore, the comparison verification circuit 40 sets the comparison result flag CF to "0" if both the R0 abnormality flag RF0 and the R1 abnormality flag RF1 are "1".

[0045] Furthermore, the comparison verification circuit 40 sets the comparison result flag CF to "1" if the R0 abnormality flag RF0 is "1" and the R1 abnormality flag RF1 is "0". On the other hand, the comparison verification circuit 40 sets the comparison result flag CF to "0" if the R0 abnormality flag RF0 is "0" and the R1 abnormality flag RF1 is "1".

[0046] The verification result flag TF stored in register RG4 is output to the reset vector control unit 16. The comparison result flag CF stored in register RG4 is output to the security control unit 20. Note that it is not possible to write to registers RG2, RG3, and RG4 from the CPU 14; only reading is possible.

[0047] The security control unit 20 receives requests from the CPU 14 and performs security processing. The security control unit 20 also performs calculations such as erasure, rewriting, reading, and integrity verification on the secure areas S0 and S1.

[0048] The flash memory control unit 22 controls the address and data of the flash memory 12 during program execution, erasure, and rewriting.

[0049] Next, the processes performed by the information processing device 10 will be explained with reference to the flowchart shown in Figure 4. The processes shown in Figure 4 are executed when the power to the information processing device 10 is turned on or when the information processing device 10 is reset, and then after the internal regulator and oscillator circuit that generate the power supply for the logic circuit (not shown) are started up.

[0050] The initial state is assumed to be when the following data has been written to each area of ​​the flash memory 12, and the process shown in Figure 4 is then executed.

[0051] The non-secure area NS stores user programs and data.

[0052] The revision area R0 of the secure area S0 stores "1" as the initial value for the fixed magic number and serial number.

[0053] The revision area R1 of the secure area S1 stores "0" as the initial value for the fixed magic number and serial number.

[0054] The security program address fields A0 and A1 store the start address of the security program field SP.

[0055] In step S100, the comparison and verification circuit 40 of the revision processing unit 18 reads the revision number stored in the revision area R0 into register RG2.

[0056] In step S101, the comparison and verification circuit 40 of the revision processing unit 18 reads the revision number stored in the revision area R1 into register RG3.

[0057] In step S102, the comparison and verification circuit 40 of the revision processing unit 18 generates a comparison result flag CF and a verification result flag TF based on the revision numbers stored in registers RG2 and RG3, and outputs them to register RG4.

[0058] In step S103, the comparison verification circuit 40 of the revision processing unit 18 determines whether the comparison result flag CF is "0", that is, whether the secure area S0 is the latest version. If the comparison result flag CF is "0", the process proceeds to step S104; if the comparison result flag CF is "1", the process proceeds to step S105.

[0059] In step S104, the determination circuit 30 of the revision processing unit 18 reads the security program address stored in the security program address area A0 and stores it in register RG1.

[0060] In step S105, the determination circuit 30 of the revision processing unit 18 reads the security program address stored in the security program address area A1 and stores it in register RG1.

[0061] In step S106, the determination circuit 30 of the revision processing unit 18 determines whether the start address of the security program used as a reset vector stored in register RG1 is within the address range of the security program area SP. If the start address is within the address range of the security program area SP, it outputs a determination signal of "1". If the start address is outside the address range of the security program area SP, it outputs a determination signal of "0".

[0062] In step S107, CPU14 starts up.

[0063] In step S108, the reset vector selection circuit 32 of the reset vector control unit 16 reads the reset vector stored in the reset vector area RV.

[0064] In step S109, the reset vector selection circuit 32 of the reset vector control unit 16 determines whether the determination signal output from the determination circuit 30 in step S106 is "1". If the determination signal is "1", the process proceeds to step S110; if the determination signal is "0", the process proceeds to step S111.

[0065] In step S110, the reset vector selection circuit 32 of the reset vector control unit 16 outputs the reset vector stored in register RG1 to the CPU 14.

[0066] In step S111, the reset vector selection circuit 32 of the reset vector control unit 16 outputs the reset vector read from the reset vector area RV in step S108 to the CPU 14.

[0067] In step S112, the CPU 14 executes the security program stored in the reset vector output from the reset vector selection circuit 32 of the reset vector control unit 16.

[0068] In step S113, CPU 14 executes the user program. Note that updates to secure areas S0 and S1 may occur while this user program is running.

[0069] Steps S100 to S111 are executed by hardware, while steps S112 and S113 are executed by software.

[0070] The following describes specific examples of situations where a momentary power interruption does not occur.

[0071] For example, suppose secure area S1 is updated. In this case, secure area S0 is not included in the update and is retained as backup data.

[0072] When secure area S1 is updated, a fixed value is written to the magic number as the revision number, and the serial number is incremented to "2". Note that, as a constraint of the operational specifications, the revision number must be written at the end of the secure area update.

[0073] After updating secure area S1, a system reset is performed to apply the updated settings. This executes the process shown in Figure 4, and secure area S1 is processed as the latest revision. Then, in the next update, secure area S0 is updated with secure area S1 as the backup area, and its serial number is incremented. In this way, unless there is a power interruption, secure areas S0 and S1 are updated alternately, and the backup area switches alternately.

[0074] Next, we will explain specific examples of situations where a momentary power interruption occurs.

[0075] Suppose a power interruption occurs during an update of secure area S0 or secure area S1. Here, the power interruption may occur either before the revision number is rewritten, or after the revision number is rewritten.

[0076] First, let's explain what happens when a momentary power interruption occurs before the revision number is rewritten.

[0077] If a power interruption occurs during the update of secure area S1, revision area R1 of secure area S1 will be erased. This is because, as mentioned earlier, the revision number is rewritten at the end of the update. Secure area S0 holds the normal data as a backup.

[0078] In this case, in step S102 of Figure 4, only the revision number of secure area S1 is abnormal, so the comparison result flag is "0" and the verification result flag is "1" only for the R1 abnormal flag RF1.

[0079] The determination in step S103 is positive because the comparison result flag is "0". Therefore, the process proceeds to step S104, and the reset vector stored in the security program address area A0 of the secure area S0 is stored in register RG1.

[0080] In step S106, the reset vector stored in register RG1 indicates the address range of the security program area SP, so the determination signal becomes "1".

[0081] The determination in step S109 is that the determination signal is "1", so the process proceeds to step S110. In step S110, the reset vector stored in register RG1 is selected, and in step S112, the security program is executed.

[0082] In this way, even if a momentary power interruption occurs during the update of secure area S1, the security program selected by the reset vector stored in the security program address area A0 of secure area S0 will be executed, and the information processing device 10 will start up safely.

[0083] After the security program is executed, the user program is executed in step S113. The CPU 14 reads the R0 abnormality flag RF0 and the R1 abnormality flag RF1 to determine whether there is an abnormality or not, and then proceeds to update the secure area S1 again.

[0084] Next, we will explain the case where a momentary power interruption occurs after the revision number has been rewritten.

[0085] The revision number is rewritten at the end of the secure area update. Therefore, a momentary power interruption after the revision number is rewritten means that the power interruption occurs after the update is complete. Consequently, the operation after power is restored is the same as when there is no power interruption.

[0086] Next, we will explain the case where the revision numbers of both secure areas S0 and S1 are abnormal.

[0087] Basically, as long as one of the secure areas is used as a backup area, both secure areas should not become abnormal. However, the system is configured to safely start up even if both secure areas S0 and S1 become abnormal.

[0088] If both secure areas S0 and S1 become abnormal, in step S102 of Figure 4, the comparison result flag will be "0", and the verification result flags will be "1" for both the R0 abnormality flag RF0 and the R1 abnormality flag RF1.

[0089] In step S103, since the comparison result flag is "0", the process proceeds to step S104, and the reset vector stored in the security program address area A0 of secure area S0 is stored in register RG1. However, although the reset vector is stored in register RG1, the reset vector stored in register RG1 is not used because both the revision numbers of secure areas S0 and S1 are determined to be abnormal.

[0090] In step S106, since both the R0 abnormality flag RF0 and the R1 abnormality flag RF1 are "1", the judgment signal is forcibly set to "0".

[0091] In step S108, CPU14 starts up.

[0092] In step S109, since the determination signal is "0", the process proceeds to step S111, and the reset vector stored in the reset vector area RV of the non-secure area NS is selected.

[0093] In step S112, the security program corresponding to the reset vector selected in step S111 is executed.

[0094] In this way, even if both secure areas S0 and S1 become abnormal, the security program corresponding to the reset vector stored in the reset vector area RV of the non-secure area NS is executed, so the information processing device 10 is started up safely.

[0095] In step S113, the user program is executed. Here, the CPU 14 reads the R0 abnormality flag RF0 and the R1 abnormality flag RF1 to determine whether there is an abnormality or not, and can then update the secure area.

[0096] Next, we will explain the case where the revision numbers of both secure areas S0 and S1 are the same.

[0097] In this case, in step S102 of Figure 4, the comparison result flag will be "0" and the revision identical flag will be "1".

[0098] In step S103, since the comparison result flag is "0", the process proceeds to step S104, and the reset vector stored in the security program address area A0 of the secure area S0 is stored in register RG1.

[0099] In step S106, the reset vector stored in register RG1 indicates the address range of the security program area SP, so the determination signal becomes "1".

[0100] The determination in step S109 is that the determination signal is "1", so the process proceeds to step S110. In step S110, the reset vector stored in register RG1 is selected, and in step S112, the security program is executed.

[0101] In step S113, the user program is executed. Here, the CPU 14 reads the revision identity flag SF to determine the status and can then update the secure area.

[0102] Thus, in this embodiment, even if a momentary power interruption occurs when updating secure areas S0 and S1, and at least one of secure areas S0 and S1 is abnormal, the information processing device 10 can be safely started after power is restored.

[0103] Furthermore, abnormalities in secure areas S0 and S1 can be automatically detected by hardware while the information processing device 10 is running.

[0104] Furthermore, since abnormalities are automatically detected by hardware without the need for software, the startup time of the information processing device 10 can be shortened.

[0105] The embodiments described above are merely illustrative, and any modifications or improvements may be applied.

[0106] Furthermore, one or more elements included in one of the above multiple embodiments can be combined with one or more elements included in other embodiments of the above multiple embodiments.

[0107] (Additional notes) (Additional note 1) An insecure area where user programs are stored, A security program area containing a security program for verifying the integrity of the aforementioned insecure area, A plurality of secure areas, each having a security program address area where the start address of the security program area is stored and a revision area where the revision number is stored, Flash memory equipped with, A revision processing unit that determines whether or not there is an abnormality based on the revision number for each of the plurality of secure areas, If any of the multiple secure areas is determined to be abnormal, the reset vector control unit selects the start address stored in the security program address area of ​​the secure area that was determined to be normal as the reset vector. Equipped with an information processing device. (Additional note 2) The non-secure area includes a reset vector area in which the start address is stored, If the reset vector control unit determines that all of the multiple secure areas are abnormal, it selects the start address stored in the reset vector area as the reset vector. The information processing device described in Appendix 1. (Additional note 3) If the reset vector control unit determines that all of the multiple secure areas are free of abnormalities, it selects the start address stored in the security program address area of ​​the secure area that has been recently updated as the reset vector. The information processing device described in Appendix 1 or Appendix 2. (Additional note 4) The revision number includes a serial number that is incremented each time the secure area is updated. The reset vector control unit selects the start address stored in the security program address area of ​​the secure area that has been recently updated, based on the serial number, as the reset vector. The information processing device described in Appendix 3. (Additional note 5) The revision number includes a fixed magic number, The revision processing unit determines whether or not there is an abnormality in each of the plurality of secure areas based on the magic number. An information processing device as described in any one of the appendices 1 to 4. [Explanation of Symbols]

[0108] 10 Information Processing Devices 12 Flash Memory 16 Reset Vector Control Unit 18 Revision Processing 20 Security Control Unit 22 Flash Memory Control Unit 24 data bus 30 Judgment circuit 32 Reset Vector Selection Circuit 40 Comparison and Verification Circuit A0, A1 Security Program Address Area NS Nonsecure Area R0, R1 revision area RG1, RG2, RG3, RG4 registers RV Reset Vector Region S0, S1 Secure Area SP Security Program Area

Claims

1. An insecure area where user programs are stored, A security program area containing a security program for verifying the integrity of the aforementioned insecure area, A plurality of secure areas, each having a security program address area where the start address of the security program area is stored and a revision area where the revision number is stored, Flash memory equipped with, A revision processing unit that determines whether or not there is an abnormality based on the revision number for each of the plurality of secure areas, If any of the multiple secure areas is determined to be abnormal, the reset vector control unit selects the start address stored in the security program address area of ​​the secure area that was determined to be normal as the reset vector. Equipped with an information processing device.

2. The non-secure area includes a reset vector area in which the start address is stored, If the reset vector control unit determines that all of the multiple secure areas are abnormal, it selects the start address stored in the reset vector area as the reset vector. The information processing apparatus according to claim 1.

3. If the reset vector control unit determines that all of the multiple secure areas are free of abnormalities, it selects the start address stored in the security program address area of ​​the secure area that has been recently updated as the reset vector. The information processing apparatus according to claim 1.

4. The revision number includes a serial number that is incremented each time the secure area is updated. The reset vector control unit selects the start address stored in the security program address area of ​​the secure area that has been recently updated, based on the serial number, as the reset vector. The information processing apparatus according to claim 3.

5. The revision number includes a fixed magic number, The revision processing unit determines whether or not there is an abnormality in each of the plurality of secure areas based on the magic number. The information processing apparatus according to any one of claims 1 to 4.

Images