Software update system and method

Abstract

The purpose of the present disclosure is to provide a software update system and a software update method that are capable of securely performing updates at low cost while saving resources. A software update system according to the present disclosure comprises a update software generation device and a CPU, wherein: the update software generation device includes a storage address conversion unit that converts either a storage address that is stored in a memory of the CPU and allocated to at least each instruction code in assembler code or machine code of update software, or a storage address that is stored in the memory and allocated to each item of data in a data area defined by at least a constant and a structure within the update software, into a storage address different from the original normal storage address; and the CPU includes a storage address reverse conversion unit that converts the different storage address resulting from the conversion by the storage address conversion unit back to the normal storage address.

Description

[Technical field]

[0001] The present disclosure relates to a software update system and a software update method for updating software used in a microcomputer or a CPU (Central Processing Unit). [Background technology]

[0002] With the advancement of IoT (Internet of Things) technology, home appliances that were previously used independently are now equipped with communication functions and connected to the Internet, allowing users to operate home appliances or check their operating status from outside the home using smartphones. Embedded microcomputers or CPUs (hereafter, both will be referred to as "CPUs") used to control home appliances can be targets of computer viruses, just like CPUs for personal computers, smartphones, or tablet devices. Therefore, software updates are required not only to improve the functionality of the application software for controlling home appliances that runs on the CPU, but also to avoid vulnerabilities found in driver software that realizes the communication functions that run on the CPU installed in home appliances, the OS (Operating System) that runs the above-mentioned software (including what is called firmware) and other software such as the control application software, or boot loader.

[0003] On the other hand, the CPUs used in home appliances, or the control boards for home appliances that have CPUs installed, are generalized, just like in the case of personal computers, and it is easy to copy and manufacture these hardware. If latecomer manufacturers have the price competitiveness to manufacture hardware cheaply and can obtain control application software without developing it, they will be able to invest resources in developing control application software with higher added value, which will give them an advantage in the market for that home appliance. Therefore, it is necessary to protect the control application software, which increases the added value of home appliances and maintains the price of home appliances, from being stolen or reverse engineered by third parties. Countermeasures against software theft, piracy, and reverse engineering are important not only for home appliances, but for all embedded devices with software update functions.

[0004] Generally, even if the CPU used in an embedded device has low processing power, it has a function to prohibit reading software stored in non-volatile areas such as Flash memory inside the CPU by connecting a debugger from outside, as shown in Non-Patent Document 1 (Figure 2.11 on page 33). Therefore, even if a commercially available embedded device is disassembled, it is difficult to read or copy the software inside the CPU, and the risk of software being stolen or used due to disassembly is low.

[0005] In IoT devices, for example, as shown in Non-Patent Document 2 (Figure 1 on page 12), software is updated from an update file server on a wide area network such as the Internet via a communication gateway. At this time, as shown in Non-Patent Document 2 (Table 1 on page 10), an encrypted data format with a hash or signature is used as the update file to ensure the confidentiality and integrity of the software to be updated. In addition, in order to install the update file, the CPU in the IoT device must verify the hash or signature and decrypt and expand it into an update image.

[0006] If an update file server on the Internet is not used, it is possible to use an encryption function provided as a utility program of a commercially available tool (Flash Programmer) for writing software to a CPU, as shown in, for example, Non-Patent Document 3. In this case, the decryption process is performed on a personal computer that runs the commercially available tool, which has the advantage that the CPU used in the embedded device such as an IoT device does not require memory resources and processing power to perform the decryption process.

[0007] For example, Patent Document 1 discloses a communication method for updating software of a peripheral device of a personal computer with Motorola S-data using the personal computer.

[0008] For example, Patent Document 2 discloses a system in which software with redundant processing code added for obfuscation in the form of source code is delivered to each client's personal computer via a communication line. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] JP 2007-219915 A [Patent Document 2] JP 2005-266887 A [Non-patent literature]

[0010] [Non-Patent Document 1] Renesas Electronics, "Renesas Flash Programmer V3.08 Flash Writing Software User's Manual," Rev.3.00, July 2021 [Non-Patent Document 2] Critical Consumer Device Security Council, "IoT Device Security Implementation Guidelines Software Update Function," Version 1.0, December 1, 2020 [Non-Patent Document 3] “Renesas Flash Programmer (Programming GUI) Renesas Flash Programmer V3”, [online], Renesas Electronics, [searched on January 11, 2022], Internet <URL : https: / / www.renesas.com / jp / ja / software-tool / renesas-flash-programmer-programming-gui#code> Summary of the Invention [Problem to be solved by the invention]

[0011] In Non-Patent Document 1, when software needs to be updated, there is a possibility that the software to be updated may be stolen or used as an update file on the communication path or while being handled by humans, and this must be avoided.

[0012] Non-Patent Document 2 (page 13, (10)) explains that in use cases where the processing performance of an IoT device is low, a communication gateway may be responsible for part of the software update process, but the communication gateway may be manufactured by a different manufacturer from the IoT device that is the target of the software update, and it is assumed that confidentiality and integrity cannot be guaranteed. Also, CPUs used in embedded devices such as IoT devices often do not have sufficient memory resources and processing power to execute signature verification and decryption processes, and the adoption of a high-performance CPU is likely to result in increased product costs.

[0013] In Non-Patent Document 3, a maintenance service worker with a commercially available tool and a work terminal such as a personal computer is dispatched to the location where the IoT product is installed, or the work is entrusted to an operator who configures or operates the entire system including the IoT device, so passwords must be shared, distributed, and managed. Therefore, it is difficult to guarantee confidentiality, and it cannot be said to be a sufficient measure against theft or theft of update software.

[0014] The purpose of Patent Document 1 is to strengthen countermeasures against tampering by making it difficult to detect missing data records of Motorola S Data on the communication path and to find the method of calculating the sum value prepared for each record, so the addresses, instruction codes, and data operands themselves in the data records are left as they are. Therefore, it is possible to make the software usable as it is by simply reassigning the original sum value of the Motorola S Data, and it does not provide a countermeasure against theft, appropriation, or reverse engineering.

[0015] In Patent Document 2, from the perspective of reverse engineering, although it requires some effort to decipher the obfuscation, it is possible to reuse and operate the software as is even if redundant processing has been added, and therefore it does not provide a countermeasure against theft or piracy.

[0016] The present disclosure has been made to solve such problems, and has an object to provide a software update system and a software update method that enable safe updates at low cost and with resource saving. [Means for solving the problem]

[0017] In order to solve the above problems, a software update system according to the present disclosure is a software update system including an update software generation device that generates update software for updating software running on a CPU (Central Processing Unit), and a CPU that updates software using the update software generated by the update software generation device, wherein the update software generation device has a storage address conversion unit that converts a storage address stored in a memory on the CPU, which is assigned to at least one instruction code in an assembler code or machine code of the update software, into a storage address different from a normal storage address, and the CPU has a storage address inverse conversion unit that converts the different storage address converted by the storage address conversion unit back into the normal storage address, the update software generation device further includes a register number conversion unit that converts a register number of a general-purpose register used in an instruction code in the assembler code or machine code of the update software into a register number usable by the CPU, and the CPU further includes a register number inverse conversion unit that converts the register number usable by the CPU converted by the register number conversion unit back to the original register number, When the register number conversion unit converts to a register number usable by the CPU before the storage address conversion unit converts to a different storage address, the register number inverse conversion unit converts the register number usable by the CPU back to the original register number after the storage address inverse conversion unit converts back to a regular storage address, and when the register number conversion unit converts to a register number usable by the CPU after the storage address conversion unit converts to a different storage address, the register number inverse conversion unit converts back to the original register number before the storage address inverse conversion unit converts back to the regular storage address. . Effect of the Invention

[0018] According to the present disclosure, updates can be performed safely at low cost and with fewer resources.

[0019] The objects, features, aspects, and advantages of the present disclosure will become more apparent from the following detailed description and the accompanying drawings. [Brief description of the drawings]

[0020] [Figure 1] 1 is a block diagram showing an example of a configuration of a software update system according to a first embodiment. [Diagram 2] 4 is a diagram showing an example of conversion of a storage address by a storage address conversion unit according to the first embodiment; FIG. [Diagram 3]4 is a diagram showing an example of insertion of a dummy code by a dummy code inserting unit according to the first embodiment; FIG. [Figure 4] 4 is a diagram showing an example of conversion of register numbers by a register number conversion unit according to the first embodiment; FIG. [Diagram 5] 11 is a diagram showing an example of conversion of an operand address by an operand address conversion unit according to the first embodiment; FIG. [Figure 6] FIG. 4 is a diagram showing an example of data conversion by a data conversion unit according to the first embodiment. [Figure 7] FIG. 11 is a block diagram showing an example of the configuration of a software update system according to a second embodiment. [Figure 8] FIG. 2 is a diagram showing an example of a hardware configuration of the software update system according to the first and second embodiments. [Figure 9] FIG. 2 is a diagram showing an example of a hardware configuration of the software update system according to the first and second embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] <Embodiment 1> FIG. 1 is a block diagram showing an example of the configuration of a software update system according to the first embodiment.

[0022] As shown in Fig. 1, the software update system includes an embedded device 1, a personal computer 8 (update software generation device), and an update file server 6. The personal computer 8 and the update file server 6 are connected via an upload path 9. The embedded device 1 and the update file server 6 are connected via a download path 10. The upload path 9 and the download path 10 go via the Internet. The update file server 6 is a server for distributing update software 30 to the embedded device 1.

[0023] <Personal Computer 8> The personal computer 8 includes a build section 3, a conversion processing section 5, and an upload section 7.

[0024] The build unit 3 performs processes such as compiling and linking the source code of the software to be updated.

[0025] The upload unit 7 uploads the converted software (update software 30) generated by the conversion processing unit 5 to the update file server 6 via an upload path 9.

[0026] The conversion processing unit 5 includes a memory unit 13, a determination unit 14, a difference generation unit 17, a storage address conversion unit 19, a register number conversion unit 21, an operand address conversion unit 23, a data conversion unit 25, a dummy code generation unit 27, and a dummy code insertion unit 29.

[0027] The storage unit 13 stores the current processing contents or program and function information (current inverse conversion information 15) related to the inverse conversion processing unit 11 included in the CPU 2. The determination unit 14 determines the update contents (new processing contents, next inverse conversion information 16) of the inverse conversion processing unit 11 itself when performing the next software update.

[0028] The difference generation unit 17 generates difference update software, which is software that partially updates only the difference in the inverse conversion processing unit 11, from the difference between the current inverse conversion information 15 stored in the storage unit 13 and the next inverse conversion information 16 determined by the determination unit 14. Then, the difference generation unit 17 merges the generated software with the update software 4 generated by the build unit 3. The difference generation unit 17 outputs the merged update software 18 to the storage address conversion unit 19.

[0029] Storage address conversion unit 19 converts storage addresses in update software 18 with conversion contents that are restored to the original storage addresses when reversely converted according to current reverse conversion information 15. Specifically, storage address conversion unit 19 converts storage addresses stored in memory on CPU 2 that are allocated to at least one instruction code in the assembler code or machine code of update software 18, or storage addresses stored in memory that are allocated to each data in a data area defined by at least constants and structures in update software 18, into storage addresses different from normal storage addresses. Storage address conversion unit 19 outputs update software 20 with the converted storage addresses to register number conversion unit 21.

[0030] The register number conversion unit 21 converts the register numbers in the update software 20 with conversion contents that restore the register numbers in the instruction code to their original register numbers when reversely converted according to the current reverse conversion information 15. Specifically, the register number conversion unit 21 converts the register numbers of general-purpose registers or floating-point registers used in instruction codes in the assembler code or machine code of the update software 20 into register numbers that can be used by the CPU. The register number conversion unit 21 outputs the update software 22 with the converted register numbers to the operand address conversion unit 23.

[0031] The operand address conversion unit 23 converts the operand address or immediate data in the update software 22 with conversion content such that the operand address or immediate data in the instruction code is restored to the original operand address or immediate data when reversely converted according to the current reverse conversion information 15. Specifically, the operand address conversion unit 23 converts the operand address or immediate data used in the instruction code in the assembler code or machine code of the update software 22. The operand address conversion unit 23 outputs the update software 24 in which the operand address or immediate data has been converted to the data conversion unit 25.

[0032] Data conversion unit 25 converts the values ​​of each piece of data in a data area in update software 24 with conversion content such that, when reversely converted according to current reverse conversion information 15, the values ​​of each piece of data in a data area defined by constants, structures, etc. are restored to their original data values. Specifically, data conversion unit 25 converts the values ​​of each piece of data in a data area defined by at least constants and structures in update software 24. Data conversion unit 25 outputs update software 26 in which the values ​​of each piece of data have been converted to dummy code insertion unit 29.

[0033] The dummy code generating unit 27 generates an instruction code or an arbitrary data string as a dummy code. The dummy code generating unit 27 outputs the generated dummy code 28 to the dummy code inserting unit 29. Specifically, the dummy code generating unit 27 generates an instruction code or a data string in the assembler code or machine code of the update software as the dummy code.

[0034] The dummy code insertion unit 29 inserts the dummy code 28 into an unused storage address in the update software 26. Specifically, the dummy code insertion unit 29 inserts the dummy code 28 generated by the dummy code generation unit 27 into a storage address that is not used in the update software 26, or into a storage address that has become unused by being converted into a different storage address by the storage address conversion unit 19. The dummy code insertion unit 29 outputs the update software 30 into which the dummy code 28 has been inserted to the upload unit 7.

[0035] <Embedded device 1> The embedded device 1 includes a CPU 2. The CPU 2 includes an inverse conversion processing unit 11 and an update unit 12. The embedded device 1 is a target for software update. The CPU 2 is one of the components that make up the embedded device 1, and is mounted on the same chip as a memory (not shown) that stores instruction sequences that make up programs and functions in the software, or data to be processed by the software. The inverse conversion processing unit 11 performs an inverse conversion of the conversion process performed by the conversion processing unit 5, and restores the update software 4 before the conversion process. The update unit 12 updates the software used in the CPU 2 with the update software 4 restored by the inverse conversion processing unit 11.

[0036] The inverse conversion processing unit 11 includes a dummy code removal unit 31, a data inverse conversion unit 32, an operand address inverse conversion unit 33, a register number inverse conversion unit , a storage address inverse conversion unit 35, and a difference update unit .

[0037] The dummy code removal unit 31 removes all of the dummy codes 28 inserted by the dummy code insertion unit 29 from the update software 30 downloaded from the update file server 6 via the download path 10. The dummy code removal unit 31 outputs the update software 26 from which the dummy codes 28 have been removed to the data inverse conversion unit 32. The update software 26 output from the dummy code removal unit 31 corresponds to the update software 26 output from the data conversion unit 25.

[0038] The data inverse conversion unit 32 performs an inverse conversion of the conversion performed by the data conversion unit 25 on the update software 26 restored by the dummy code removal unit 31, and restores the value of each data in the data area. The data inverse conversion unit 32 outputs the update software 24 with the restored values ​​of each data to the operand address inverse conversion unit 33. The update software 24 output from the data inverse conversion unit 32 corresponds to the update software 24 output from the operand address conversion unit 23.

[0039] The operand address inverse conversion unit 33 performs an inverse conversion of the conversion performed by the operand address conversion unit 23 on the update software 24 restored by the data inverse conversion unit 32, thereby restoring the operand address or immediate data. The operand address inverse conversion unit 33 outputs the update software 22 with the operand address or immediate data restored to the register number inverse conversion unit 34. The update software 22 output from the operand address inverse conversion unit 33 corresponds to the update software 22 output from the register number conversion unit 21.

[0040] The register number inverse conversion unit 34 performs an inverse conversion of the conversion performed by the register number conversion unit 21 on the update software 22 restored by the operand address inverse conversion unit 33, thereby restoring the register numbers. The register number inverse conversion unit 34 outputs the update software 20 with the restored register numbers to the storage address inverse conversion unit 35. The update software 20 output by the register number inverse conversion unit 34 corresponds to the update software 20 output by the storage address conversion unit 19.

[0041] The storage address inverse conversion unit 35 performs an inverse conversion of the conversion performed by the storage address conversion unit 19 on the update software 20 restored by the register number inverse conversion unit 34, and restores the storage address. The storage address inverse conversion unit 35 outputs the update software 18 with the restored storage address to the difference update unit 36. The update software 18 output by the storage address inverse conversion unit 35 corresponds to the update software 18 output by the difference generation unit 17.

[0042] The difference update section 36 extracts and removes the difference update software merged by the difference generation section 17 , and generates update software 4 that is exactly the same as the update software 4 generated by the build section 3 .

[0043] The update unit 12 updates the inverse conversion processing unit 11 itself (updates the software used by the CPU 2) when the processing of the inverse conversion processing unit 11 required for the current software update is completed.

[0044] FIG. 2 is a diagram showing an example of storage address conversion by the storage address conversion unit 19. As shown in FIG.

[0045] As shown in Figure 2, before and after the conversion of the storage address, the address value shown as an 8-digit HEX value is converted and rearranged in ascending order (see the part surrounded by a solid line in the figure). The conversion rule for the storage address is, for example, assuming that the third digit from the left is not used in the converted storage address, the value of the third digit from the left is replaced with the value of the lowest digit at the right end, and the lowest digit that is a 4-byte boundary value is converted as follows: 0 → C, 4 → 0, 8 → 8, C → 4. In this case, the address can be restored by replacing the value of the lowest digit with the value of the third digit from the left in the converted storage address and setting the value of the third digit from the left to 0.

[0046] 3 is a diagram showing an example of insertion of dummy codes by the dummy code insertion unit 29. For arrangement addresses 0100002C, 0100004C, 01400030, 01800038, 01C0003C, and 01C00044 before the insertion of the dummy codes, examples after the insertion of the dummy codes are omitted.

[0047] Figure 3 shows an example of a rule for inserting dummy codes with addresses of 0, 4, or 8 in the least significant digits, because if the third digit from the left in the example of Figure 2 is 0, the least significant digit is only C and there are no 0, 4, or 8. Similarly, if the third digit from the left is 4, dummy codes with addresses of 4, 8, or C are inserted; if the third digit from the left is 8, dummy codes with addresses of 0, 4, or C are inserted; and if the third digit from the left is C, dummy codes with addresses of 0, 8, or C are inserted. In the example of Figure 3, if the third digit value is 0, any least significant digit other than C is removed; if the third digit value is 4, any least significant digit other than 0 is removed; if the third digit value is 8, any least significant digit other than 8 is removed; and if the third digit value is C, any least significant digit other than 4 is removed.

[0048] When the storage address conversion unit 19 is executed first, it is possible to make it difficult to grasp the number of functions in the update software by appropriately using an STS instruction indicating the start of a function or an RTS instruction indicating the end of a function as dummy code. When the storage address conversion unit 19 is executed later, multiple functions that perform meaningless operations in the embedded device 1 may be stored as dummy code in an area not used by the update software 4.

[0049] FIG. 4 is a diagram showing an example of conversion of register numbers by the register number conversion unit 21. As shown in FIG.

[0050] In the example in Figure 4, general-purpose register R0 is converted to R1, R2 to R3, and R3 to R2. However, in cases such as "@R2" and "@R1", where the value stored in the general-purpose register is referenced as an address rather than the value itself being used to execute an instruction, the conversion rule also allows no conversion to be done. In the example in Figure 4, it is possible to restore the data by changing R3 back to R2 and R2 back to R3.

[0051] FIG. 5 is a diagram showing an example of conversion of an operand address by the operand address conversion unit 23. As shown in FIG.

[0052] In the example of Fig. 5, it can be determined that the label "L37" is the base address of the stack area of ​​this function, so it is converted to a base address other than L37. In the example of Fig. 5, if the stored address is converted by the stored address conversion unit 19, L37 becomes unknown, but if the stored address has been restored by the stored address inverse conversion unit 35, L37 is known and can be restored.

[0053] FIG. 6 is a diagram showing an example of data conversion by the data conversion unit 25. As shown in FIG.

[0054] In the example in Figure 6, if the constant value in the stack area is -1 (FFFFFFFF), it is converted to +1 (00000001), and other values ​​are converted by looking at the addresses in the stack area in ascending order and round-shifting to the left in 8-bit units.In the example in Figure 6, if it is +1, it is converted to -1, and it can be restored by round-shifting to the right in ascending order in 8-bit units.

[0055] <Modification> The above describes the case of assembler code, but the same processing can be performed on assembler code converted into machine code, or on machine code converted into a data format such as Motorola S data for writing to CPU 2. In addition, the format for writing to CPU 2 need only match the specifications of CPU 2 and is not limited to Motorola S data.

[0056] In the above, a case where the processing of the conversion processing unit 5 is performed on the personal computer 8 has been described, but the present invention is not limited to the personal computer 8.

[0057] In the above, an example is described in which the processes of the register number conversion unit 21, the operand address conversion unit 23, the data conversion unit 25, and the dummy code insertion unit 29 are performed after the process of the storage address conversion unit 19, but each process may be performed before the process of the storage address conversion unit 19. The combination or order is arbitrary, such as performing some of the conversion or inverse conversion processes before the process of the storage address conversion unit 19, or not performing some of the conversion or inverse conversion processes. However, for example, if the conversion rule is such that the register number is converted taking into account the values ​​of the register numbers in the preceding and following instruction codes, the arrangement of the preceding and following instruction codes changes before and after the process of the storage address conversion unit 19, so that the processing order of the dummy code removal unit 31, the data inverse conversion unit 32, the operand address inverse conversion unit 33, the register number inverse conversion unit 34, and the storage address inverse conversion unit 35 in the inverse conversion processing unit 11 that performs processing on the CPU 2 must also be changed.

[0058] In the above, the case where the process of the inverse conversion processing unit 11 is performed in a series of software update processes has been described, but it may be performed in a boot loader that operates when the power is turned on, or may be executed by returning to the execution order before conversion just before actually executing the software on the CPU 2. Also, the rules for conversion or inverse conversion may be changed depending on the type of software, such as the OS, boot loader, program that performs inverse conversion, function, or application software. Several patterns of inverse conversion functions may be prepared, and the rules for conversion or inverse conversion may be changed midway according to a predetermined rule.

[0059] 1 shows a case where there is one update file server 6, but a configuration in which multiple update file servers 6 are installed to distribute the load may also be adopted. In addition, the process of the dummy code removal unit 31 may be such that, for example, a rule for the communication channel or port number for sending the dummy code is determined in advance, and update software data sent via a specific communication channel or port number is discarded.

[0060] In the above, the configuration in which the software executed by the CPU and the memory that stores the data processed by the software are implemented on the same chip as the CPU has been described as an example, but the present invention is not limited to this. For example, in a CPU implemented as a CPU core in an FPGA (Field Programmable Gate Array), the memory that stores the software and data may be implemented on the same FPGA chip.

[0061] <Effects> From the above, even if the update software 30 downloaded by the embedded device 1 from the update file server 6 is of a content that cannot be used as is, the update software 4 can be restored by performing reverse conversion in the reverse conversion processing unit 11 on the CPU 2 according to rules known only to the designer, making it possible to perform a safe update at low cost and with fewer resources.

[0062] Conventionally, the software of the embedded device 1 has been updated by uploading update software 4 generated by the build unit 3 to the update file server 6 and then downloading it from the embedded device 1 side. Since the upload path 9 is via the Internet, conventionally, the communication path between the upload unit 7 on the personal computer 8 and the update file server 6 has been protected by SSL (Secure Sockets Layer) / TLS (Transport Layer Security) or the like to prevent theft, tampering, and reverse engineering of the software on the communication path.

[0063] In contrast, in the first embodiment, the conversion processing unit 5 converts the storage address, register number, operand address or immediate data, and each data value in the data area of ​​the CPU 2 according to a rule known only to the designer of the software, and the reverse conversion processing unit 11, which is processed on the CPU 2, performs reverse conversion according to a rule known only to the designer, thereby restoring the software 4 to realize software update of the CPU 2. Since the storage address, register number, operand address or immediate data, and each data value in the data area of ​​the CPU 2 are in a converted state, they cannot be used as they are even if they are stolen on the communication path. Therefore, it is not necessary for the CPU 2 on the embedded device 1 to perform signature verification and decryption processing required for SSL / TLS. Since restoration is not easy unless the rules of conversion / reverse conversion are known, it can be executed even on a CPU for embedded devices with limited memory resources and processing power, and is an effective method for preventing reverse engineering.

[0064] In addition, the code used to detect tampering and its calculation method are converted / reconverted according to rules known only to the designer, making them difficult to identify. Therefore, a simple checksum is sufficient without the need to calculate a hash value, making it easier to detect tampering and also preventing tampering.

[0065] In the case of the C language, software is composed of a combination of multiple functions. For each function, a specific assembler instruction is used fixedly when the function is called or when returning from the function, but in the processing inside the function, the desired function is realized by combining the assembler instructions available to the CPU in a specific order. In this case, even if the assembler instructions used in a certain function are stored one by one in random order, it is easy to find the correct execution order of the instructions from the numbers of the general-purpose registers used in each assembler instruction and the configuration of the stack area used by each function, and if the function realized by the function is known, it is possible to find the correct execution order of the instructions in a shorter time.

[0066] However, if it is not known how many functions there are in the entire software, what the functional division of each function is, how many assembler instructions each function consists of, the size of the stack area, or the order in which the data and address information is stored in the stack area, then if the order across functions is changed, it will be difficult to accurately restore each function or correctly reproduce the function structure.

[0067] For example, even if you know that a function is 10 lines long and is made up of a combination of 6 instructions, including overlaps, you can still determine in what order the instructions are executed, and even if there is only one function, there are 6 combinations. 10 Also, when encrypting and decrypting, if the key does not match, the code cannot be recognized as an assembler code or a mot file, so if the key matches, the correct answer is immediately known. However, since each assembler instruction runs correctly on the CPU, if you try to find the correct answer by brute force, you need to prepare the embedded device you want to copy and brute force it. 10The correct execution order of the commands cannot be found unless the correct software is written and its operation is verified. Some of the programs may be close to the correct answer, or may perform the same operation as the correct answer under certain conditions, so it is thought that the actual verification of operation will require time. However, by verifying in parallel on multiple machines, it is possible to verify one pattern in one second, including the time it takes to write the software, and it is said that it will take 6 10 Even if we assume that we can find the correct answer in half the patterns, it will take 11 months.

[0068] If operation verification takes more than one second, or if the combination involves more than 10 lines of functions or six or more instructions, it is likely to take more than a year. In reality, software is composed of multiple functions, so in the case of home appliances and other products for which new products are released every year, by setting conversion / reverse conversion rules that are known only to the software designer, it is possible to prevent the software from being misused and stolen, or reverse engineered, without the need for encryption and decryption processes or the concealment of communication routes.

[0069] <Embodiment 2> FIG. 7 is a block diagram showing an example of the configuration of a software update system according to the second embodiment.

[0070] 7, the work terminal 41 is connected to the embedded device 1 via a jig 42. The embedded device 1 and the personal computer 8 shown in FIG. 7 are the same as the embedded device 1 and the personal computer 8 shown in FIG.

[0071] The work terminal 41 is a work terminal used by a worker (not shown) who performs maintenance services to visit the site where the embedded device 1 is installed and update the software.

[0072] The jig 42 is a jig for connecting the embedded device 1 and the work terminal 41 and for writing software into the CPU 2 in the embedded device 1.

[0073] The delivery route 43 is a route for delivering the update software 30 generated by the personal computer 8 to the work terminal 41 .

[0074] The delivery route 43 may be, for example, a case where the update software is attached to an e-mail and delivered via the Internet, or a case where the update software is delivered via a medium such as a USB (Universal Serial Bus) memory. For this reason, in the past, it was necessary to encrypt the update software to protect against theft on the Internet or loss of the USB memory. However, since the encrypted software needs to be decrypted on the work terminal, there is a limit to the management of the decrypted update software.

[0075] In contrast, in the present disclosure, as described in the first embodiment, the update software 30 generated by the personal computer 8 is in a state in which the storage address, register number, operand address or immediate data, and each data value in the data area on the CPU 2 have been converted. Therefore, even if stolen on the delivery route 43, it cannot be used as is, and since the method allows for restoration processing on the CPU 2, there is no need to restore the state of the update software 4 on the work terminal 41. As in the first embodiment, the second embodiment can also be executed on a CPU for embedded devices with limited memory resources and processing power, and is an effective method for preventing theft or reverse engineering.

[0076] <Hardware configuration> The functions of the build unit 3, determination unit 14, difference generation unit 17, storage address conversion unit 19, register number conversion unit 21, operand address conversion unit 23, data conversion unit 25, dummy code generation unit 27, dummy code insertion unit 29, and upload unit 7 in the personal computer 8 shown in Figure 1 are realized by a processing circuit. That is, the personal computer 8 performs processes such as compiling and linking the source code of the software to be updated, determines the update contents (next inverse conversion information 16) of the inverse conversion processing unit 11 itself when performing the next software update, generates difference update software, which is software that partially updates only the difference of the inverse conversion processing unit 11, from the difference between the current inverse conversion information 15 stored in the storage unit 13 and the next inverse conversion information 16 determined by the determination unit 14, converts the storage address in the update software 18 with conversion contents that are restored to the original storage address when inversely converted according to the current inverse conversion information 15, converts the register number in the update software 20 with conversion contents that are restored to the original register number when inversely converted according to the current inverse conversion information 15, and converts the current inverse conversion information 15 with conversion contents that are restored to the original register number when inversely converted according to the current inverse conversion information 15. The present invention includes a processing circuit for converting an operand address or immediate data in an update software 22, which is a conversion content in which an operand address or immediate data in an instruction code is restored to the original operand address or immediate data when the operand address or immediate data in the update software 22 is converted inversely according to the current inverse conversion information 15, which is a conversion content in which a value of each data in a data area defined by constants and structures is restored to the original data value when the operand address or immediate data in the instruction code is converted inversely according to the current inverse conversion information 15, which is a conversion content in which a value of each data in a data area in an update software 24 is restored to the original data value when the operand address or immediate data in the instruction code is converted inversely according to the current inverse conversion information 15, which is a conversion content in which a value of each data in a data area defined by constants and structures is restored to the original data value, which generates an instruction code or an arbitrary data string as a dummy code, which inserts a dummy code 28 into an unused storage address in the update software 26, and which uploads the software after the conversion process (update software 30) generated by the conversion processing unit 5 to an update file server 6 via an upload path 9. The processing circuit may be a dedicated hardware, or may be a processor (also called a CPU, central processing unit, processing unit, arithmetic unit, microprocessor, microcomputer, or DSP (Digital Signal Processor)) that executes a program stored in a memory.

[0077] When the processing circuit is a dedicated hardware, the processing circuit 51 corresponds to, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination of these, as shown in Fig. 8. Each function of the build unit 3, the determination unit 14, the difference generation unit 17, the storage address conversion unit 19, the register number conversion unit 21, the operand address conversion unit 23, the data conversion unit 25, the dummy code generation unit 27, the dummy code insertion unit 29, and the upload unit 7 may be realized by the processing circuit 51, or each function may be realized by one processing circuit 51.

[0078] 9, the functions of the build unit 3, the determination unit 14, the difference generation unit 17, the storage address conversion unit 19, the register number conversion unit 21, the operand address conversion unit 23, the data conversion unit 25, the dummy code generation unit 27, the dummy code insertion unit 29, and the upload unit 7 are realized by software, firmware, or a combination of software and firmware. The software or firmware is written as a program and stored in the memory 53. The processor 52 realizes each function by reading and executing the program recorded in the memory 53.That is, the personal computer 8 performs processes such as compiling and linking the source code of the software to be updated, and performs the following steps: a step of determining update contents (next inverse conversion information 16) of the inverse conversion processing unit 11 itself when performing the next software update; a step of generating difference update software, which is software that partially updates only the difference of the inverse conversion processing unit 11, from the difference between the current inverse conversion information 15 stored in the storage unit 13 and the next inverse conversion information 16 determined by the determination unit 14; a step of converting a stored address in the update software 18 with conversion contents that are restored to the original stored address when inversely converted according to the current inverse conversion information 15; a step of converting a register number in the update software 20 with conversion contents that are restored to the original register number when inversely converted according to the current inverse conversion information 15; The computer includes a memory 53 for storing a program that results in the execution of the steps of: converting an operand address or immediate data in the update software 22 with conversion content in which the operand address or immediate data in the update software 22 is restored to the original operand address or immediate data, converting the value of each data area in the update software 24 with conversion content in which the value of each data area defined by constants and structures, etc. is restored to the original data value when reversely converted according to the current reverse conversion information 15, generating an instruction code or an arbitrary data string as a dummy code, inserting a dummy code 28 into an unused storage address in the update software 26, and uploading the post-conversion software (update software 30) generated by the conversion processing unit 5 to the update file server 6 via an upload path 9. These programs can also be said to cause a computer to execute the procedures or methods of the build unit 3, the determination unit 14, the difference generation unit 17, the storage address conversion unit 19, the register number conversion unit 21, the operand address conversion unit 23, the data conversion unit 25, the dummy code generation unit 27, the dummy code insertion unit 29, and the upload unit 7.Here, the memory may be, for example, a non-volatile or volatile semiconductor memory such as RAM (Random Access Memory), ROM (Read Only Memory), flash memory, EPROM (Erasable Programmable Read Only Memory), EEPROM (Electrically Erasable Programmable Read Only Memory), a magnetic disk, a flexible disk, an optical disk, a compact disk, a DVD (Digital Versatile Disc), or any storage medium that will be used in the future.

[0079] In addition, with regard to each function of the build unit 3, the determination unit 14, the difference generation unit 17, the storage address conversion unit 19, the register number conversion unit 21, the operand address conversion unit 23, the data conversion unit 25, the dummy code generation unit 27, the dummy code insertion unit 29, and the upload unit 7, some of the functions may be realized by dedicated hardware, and other functions may be realized by software or firmware.

[0080] Thus, the processing circuitry may implement the functions described above through hardware, software, firmware, or a combination of these.

[0081] Although the hardware configuration of the personal computer 8 in FIG. 1 has been described above, the same applies to the hardware configuration of the embedded device 1 shown in FIG.

[0082] Within the scope of the present disclosure, the embodiments can be freely combined, and each embodiment can be modified or omitted as appropriate.

[0083] Although the present disclosure has been described in detail, the above description is illustrative in all respects and is not restrictive. It is understood that countless variations not illustrated can be envisioned. [Explanation of symbols]

[0084] 1 embedded device, 2 CPU, 3 build section, 4 update software, 5 conversion processing section, 6 update file server, 7 upload section, 8 personal computer, 9 upload path, 10 download path, 11 inverse conversion processing section, 12 update section, 13 memory section, 14 determination section, 15 current inverse conversion information, 16 next inverse conversion information, 17 difference generation section, 18 update software, 19 storage address conversion section, 20 update software, 21 register number conversion section, 22 update software, 23 operand address conversion section, 24 update software, 25 data conversion section, 26 update software, 27 dummy code generation section, 28 dummy code, 29 dummy code insertion section, 30 update software, 31 dummy code removal section, 32 data inverse conversion section, 33 operand address inverse conversion section, 34 register number inverse conversion section, 35 storage address inverse conversion section, 36 difference update section, 41 Work terminal, 42 fixture, 43 delivery route, 51 processing circuit, 52 processor, 53 memory.

Claims

1. A software update system including: an update software generation device that generates update software that updates software that runs on a CPU (Central Processing Unit); and a CPU that updates the software using the update software generated by the update software generation device, the update software generation device has a storage address conversion unit that converts a storage address, which is assigned to at least one instruction code in an assembler code or a machine code of the update software and is stored in a memory on the CPU, into a storage address different from a regular storage address; the CPU has a storage address inverse conversion unit that converts the different storage address converted by the storage address conversion unit back to the regular storage address; the update software generation device further includes a register number conversion unit that converts a register number of a general-purpose register used in an instruction code in an assembler code or a machine code of the update software into a register number usable by the CPU; the CPU further includes a register number inverse conversion unit that converts the register numbers that can be used by the CPU and that have been converted by the register number conversion unit back to the original register numbers; When the register number conversion unit converts the register number into a register number usable by the CPU before the storage address conversion unit converts the register number into the different storage address, the register number inverse conversion unit converts the register number usable by the CPU back to the original register number after the storage address inverse conversion unit converts the register number into the normal storage address, A software update system in which, when the register number conversion unit converts to a register number usable by the CPU after the storage address conversion unit converts to the different storage address, the register number inverse conversion unit converts the register number usable by the CPU back to the original register number before the storage address inverse conversion unit converts it back to the normal storage address.

2. 2. The software update system according to claim 1, wherein the register number conversion unit converts a register number of a floating-point register used in an instruction code in an assembler code or a machine code of the update software into a register number usable by the CPU.

3. 2. The software update system according to claim 1, wherein the storage address conversion unit converts storage addresses stored in the memory allocated to each data in a data area defined by at least constants and structures in the update software into storage addresses different from normal storage addresses.

4. The update software generation device includes: a dummy code generating unit that generates an instruction code or a data string in an assembler code or a machine code of the update software as a dummy code; a dummy code inserting unit that inserts the dummy code generated by the dummy code generating unit into a storage address that is not used in the update software, or into a storage address that has become unused due to conversion to the different storage address by the storage address converting unit; and The CPU further includes a dummy code removal unit that removes the dummy code inserted by the dummy code insertion unit, When the dummy code insertion unit inserts the dummy code before the storage address conversion unit converts the different storage address, the dummy code removal unit removes the dummy code after the storage address inverse conversion unit converts the storage address into the regular storage address, 2. The software update system of claim 1, wherein when the dummy code insertion unit inserts the dummy code after the storage address conversion unit converts to the different storage address, the dummy code removal unit removes the dummy code before the storage address inverse conversion unit returns to the normal storage address.

5. the update software generation device further includes an operand address conversion unit that converts an operand address or immediate data used in an instruction code in an assembler code or a machine code of the update software, The CPU further includes an operand address inverse conversion unit that converts the operand address or the immediate data converted by the operand address conversion unit back to the original operand address or the immediate data, the operand address conversion unit converts the operand address or the immediate data before or after the storage address conversion unit converts the operand address or the immediate data to the different storage address; 5. The software update system according to claim 1, wherein the operand address inverse conversion unit restores the original operand address or immediate data before or after the storage address inverse conversion unit restores the regular storage address.

6. the update software generation device further includes a data conversion unit that converts values ​​of each data in a data area defined by at least a constant and a structure in the update software; The CPU further includes a data inverse conversion unit that converts each of the data converted by the data conversion unit back to the original data, The data conversion unit converts a value of each of the data before or after the storage address conversion unit converts the data to the different storage address, The software update system according to claim 1 , wherein the data inverse conversion unit restores each of the data to its original state before or after the storage address inverse conversion unit restores the data to the regular storage address.

7. The update software generation device includes: A storage unit that stores current processing content in the CPU; A determination unit that determines new processing content in the CPU; a difference generation unit that generates difference update software that partially updates only the difference between the current processing content stored in the storage unit and the new processing content determined by the determination unit, and merges the difference update software into the update software; and The software update system according to claim 1 , wherein the CPU removes the difference update software merged by the difference generation unit and restores the original update software.

8. A software updating method in a software updating system including an update software generating device that generates update software to update software that runs on a CPU (Central Processing Unit), and a CPU that updates the software using the update software generated by the update software generating device, comprising: the update software generation device converts a storage address, which is assigned to at least one instruction code in an assembler code or a machine code of the update software and is stored in a memory on the CPU, into a storage address different from a regular storage address; The CPU converts the different storage address converted by the update software generation device back to the regular storage address, the update software generation device converts register numbers of general-purpose registers used in instruction codes in assembler code or machine code of the update software into register numbers usable by the CPU; the CPU converts the register numbers usable by the CPU, which have been converted by the update software generation device, back to the original register numbers; When the update software generation device converts the register number usable by the CPU before converting the different storage address, the CPU returns the register number usable by the CPU to the original register number after converting the address back to the regular storage address; A software update method in which, when the update software generation device converts the different storage address into a register number usable by the CPU, the CPU returns the register number usable by the CPU to the original register number before returning to the normal storage address.

Images