Processor circuit, version control method, and version control program
The processor circuit with dual counters in non-volatile memory efficiently manages firmware versions, reducing memory needs and ensuring secure rollback, thereby improving debugging efficiency and preventing unauthorized changes.
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Patents
- Current Assignee / Owner
- FUJITSU LTD
- Filing Date
- 2022-07-06
- Publication Date
- 2026-06-02
Smart Images
Figure 0007868431000001 
Figure 0007868431000002 
Figure 0007868431000003
Abstract
Description
Technical Field
[0001] The present invention relates to a processor circuit, a version management method, and a version management program.
Background Art
[0002] In order to protect firmware from rollback attacks, a method is known in which the version of the firmware is stored in an OTP (One Time Programmable) memory and the version can be updated only in the increasing direction. For example, the version of the firmware is held as a major version in the OTP memory and as a minor version in the non-volatile memory (see, for example, Patent Document 1).
Prior Art Documents
Patent Documents
[0003]
Patent Document 1
Summary of the Invention
Problems to be Solved by the Invention
[0004] However, when protecting firmware from rollback attacks by managing the version of the firmware using an OTP memory, it is not easy to roll back the firmware to an older version. For this reason, for example, when a problem occurs in the firmware, it is not easy to conduct tests while switching the version, and the debugging efficiency of the firmware decreases.
[0005] For example, by providing a plurality of counters for managing the version in the OTP memory and switching the counter used for version management, it becomes possible to easily roll back the firmware to an older version. However, in this case, it is necessary to provide counters more than the assumed number of switches, and the capacity of the OTP memory increases.
[0006] In one aspect, the present invention aims to reduce the amount of memory required for a counter that manages software versions. [Means for solving the problem]
[0007] From one perspective, the processor circuit is a processor circuit that manages the version of the software to be started, and includes a non-volatile memory that holds a first counter value of a first counter and a second counter value of a second counter, and a startup control unit that updates the first counter value and maintains the second counter value when the software version is increased, maintains the first counter value and updates the second counter value when the software version is decreased, and starts the software when the version of the software to be started is equal to a version verification check value indicated by the difference between the first counter value and the second counter value. [Effects of the Invention]
[0008] This allows for a reduction in the amount of memory required for the software version counter. [Brief explanation of the drawing]
[0009] [Figure 1] This is a block diagram showing an example of a motherboard equipped with a processor circuit in one embodiment. [Figure 2] Figure 1 is an explanatory diagram illustrating an example of managing firmware version updates using the counter. [Figure 3] Figure 1 is a flowchart illustrating an example of the firmware update operation by the processor circuit. [Figure 4] This is a block diagram showing an example of a motherboard equipped with a processor circuit in another embodiment. [Figure 5] Figure 4 is an explanatory diagram illustrating an example of managing firmware version updates using the counter. [Figure 6]This is a diagram showing another example of the counter in the embodiment described above. [Figure 7] This is a block diagram showing an example of a motherboard equipped with a processor circuit in another embodiment. [Modes for carrying out the invention]
[0010] The embodiments will be described below with reference to the drawings.
[0011] Figure 1 shows an example of a motherboard on which a processor circuit in one embodiment is mounted. The processor circuit 10 shown in Figure 1 is, for example, a CPU (Central Processing Unit). The processor circuit 10 is mounted on the motherboard 100 together with a firmware storage area 20 on which firmware 22 is stored. Firmware 22 is an example of software.
[0012] The processor circuit 10 and the firmware storage area 20 may each be mounted on the motherboard 100 in the form of separate chips, or they may be mounted on the motherboard 100 as an integrated chip. For example, the motherboard 100 is mounted on an information processing device such as a server, supercomputer, or PC (Personal Computer) to realize the functions of the information processing device.
[0013] The firmware 22 stored in the firmware storage area 20 is executed by a CPU core or the like mounted on the processor circuit 10. While not particularly limited, for example, the firmware storage area 20 is allocated within electrically rewritable memory such as flash memory, allowing the firmware to be overwritten. The firmware storage area 20 may also be allocated within the memory where one or both of the OS (Operating System) and / or application programs executed by the processor circuit 10 are stored.
[0014] The processor circuit 10 includes a version storage unit 12, a version verification unit 14, and a write control unit 16. The version verification unit 14 and the write control unit 16 are examples of startup control units. The version storage unit 12 has counters 12a and 12b used to manage the version of the firmware 22. For example, the version storage unit 12 is provided in on-chip OTP (One Time Programmable) memory. The version storage unit 12 is an example of non-volatile memory. Counter 12a is an example of a first counter, and counter 12b is an example of a second counter.
[0015] For example, since the OTP memory stores bit information in each of its multiple E-fuses, the information written to each bit (E-fuse) of the OTP memory cannot be rewritten. In other words, the OTP memory can only write the value of each of its multiple bits once. In this embodiment, the OTP memory cannot reset the value of a bit to "0" after it has been written "1". For this reason, for example, in counter 12a, the number of bits holding "1" increases each time the version is incremented.
[0016] The counter values CNTa for counter 12a and CNTb for counter 12b are indicated by the number of bits set to "1". The check value for version verification is indicated by the difference between counter values CNTa and CNTb (CNTa-CNTb). The check value indicates the version of the bootable firmware 22. An example of using counters 12a and 12b is explained in Figure 2. Counter value CNTa is an example of the first counter value, and counter value CNTb is an example of the second counter value.
[0017] When the firmware verification unit 14 starts the firmware 22 held in the firmware storage area 20, it compares the version of the firmware 22 to be started with the check value of the version held in the version storage unit 12. Then, based on the comparison between the version of the firmware 22 and the difference between the counter values CNTa and CNTb, the firmware verification unit 14 determines whether to perform normal startup processing, version upgrade processing, or error processing (stopping of startup) of the firmware.
[0018] When the version of the firmware 22 to be started is greater than the difference between the counter values CNTa and CNTb, the firmware verification unit 14 issues an instruction to the write control unit 16 to increase the counter value CNTa of the counter 12a. When the version of the firmware 22 to be started is equal to the difference between the counter values CNTa and CNTb, the firmware verification unit 14 causes the processor circuit 10 to perform the startup processing of the firmware 22. When the version of the firmware 22 to be started is less than the difference between the counter values CNTa and CNTb, the firmware verification unit 14 notifies the error processing unit etc. of the processor circuit 10 of the occurrence of an error.
[0019] The write control unit 16 controls the write operations of the counters 12a and 12b. Based on an instruction from the firmware verification unit 14, the write control unit 16 performs a write operation to update the counter value CNTa of the counter 12a. Also, when the write control unit 16 performs a rollback process to lower the version of the firmware 22, it performs the write operation of the counter 12b and updates the counter value CNTa based on a dedicated procedure for writing to the counter 12b. For example, the dedicated procedure for writing to the counter 12b is password authentication or public key authentication etc. Note that the dedicated procedure for writing to the counter 12b is not limited to password authentication or public key authentication etc., and biometric authentication etc. may also be used. By adopting the dedicated procedure for writing to the counter 12b, the security against rollback of the firmware 22 can be ensured.
[0020] For example, the operations of the version verification unit 14 and the writing control unit 16 are realized by a version management program executed by the processor circuit 10. And a version management method is realized by executing the version management program. Also, the error processing unit may be realized by an error processing program executed by the processor circuit 10. Note that one or more of the version verification unit 14, the writing control unit 16, and the error processing unit may be realized by hardware.
[0021] FIG. 2 shows an example of managing the update of the firmware version using the counters 12a and 12b in FIG. 1. The operations shown in FIG. 2 show an example of a version management method implemented by the version verification unit 14 and the writing control unit 16. Also, the operations shown in FIG. 2 show an example of the operations by a version management program executed by the processor circuit 10.
[0022] The counter values CNTa and CNTb of the counters 12a and 12b are increased by setting the bit values one by one from the least significant bit to the most significant bit. Rewriting the bit value from "1" to "0" is not possible. The check value of the firmware version set in the version storage unit 12 is indicated by the difference (CNTa - CNTb) between the counter values CNTa and CNTb. The "4'b" or "5'b" shown at the beginning of the counter values CNTa and CNTb indicates 4 bits or 5 bits of a binary number, respectively.
[0023] FIG. 2(A) shows an example of the operations of the counters 12a and 12b when increasing the firmware version (check value). In FIG. 2(A), the version of the firmware 22 is sequentially updated from "0" to "4" from the state A0 to the state A4. Since the counter value CNTb of the counter 12b is maintained at "0", the counter value CNTa indicates the check value. And when the counter value CNTa matches the firmware 22 to be started, the firmware 22 is started.
[0024] Figure 2(B) shows an example of the operation of counters 12a and 12b when a problem occurs after upgrading the firmware 22 version and the version (check value) is rolled back to the previous version. When the version (check value) is rolled back, before starting firmware 22, the counter value CNTb of counter 12b is incremented by the difference between the current version and the version after the rollback.
[0025] In the initial state B0 shown in Figure 2(B), the counter value CNTa is "4'b0111=3", so the bootable firmware 22 version is "3". In this example, to revert to the previous version, the counter value CNTb is increased by "1", from "4'b0000" in state B0 to "4'b0001" in state B1. By increasing the counter value CNTb by "1", the bootable firmware 22 version becomes "2".
[0026] As described above, updating the counter value CNTb is performed by transitioning to a rollback-only state using password authentication or public key authentication, etc., to ensure security. However, if a dedicated state for secure testing or device debugging is available, the counter value CNTb may be updated according to that procedure.
[0027] Subsequently, when starting firmware 22 version "3", the counter value CNTa is increased by "1" from "4'b0111" in state B1 to "4'b1111" in state B2. As a result, the check value held in the version storage unit 12 returns to "3", and firmware 22 version "3" becomes available for startup.
[0028] Figure 2(C) shows an example of the operation of counters 12a and 12b when the number of bits in counters 12a and 12b is one bit greater than in Figure 2(B). States C0 to C2 in Figure 2(C) are the same as states B0 to B2 in Figure 2(B), except that the number of bits in counters 12a and 12b is different. By increasing the number of bits in counters 12a and 12b by one bit, even when reverting to the previous version, the bootable firmware 22 version can then be updated up to "4".
[0029] Note that if the version (check value) is reverted, the maximum check value that can be represented by the counter values CNTa and CNTb will decrease. For example, with the 4-bit counter 12a shown in Figure 2(B), the version cannot be set to "4". With the 4-bit counter 12a shown in Figure 2(C), the version cannot be set to "5". For this reason, the number of bits in counters 12a and 12b is designed to match the maximum number of versions and the maximum number of rollbacks, taking into account the expected firmware operation conditions. In Figure 2, the number of bits in counters 12a and 12b is set to 4 bits or 5 bits, but the number of bits in counters 12a and 12b can be set to any value corresponding to the maximum number of firmware version updates.
[0030] Figure 3 shows an example of the firmware update operation flow by the processor circuit 10 in Figure 1. Based on the fact that the device on which the motherboard 100 is installed has been started up, the processor circuit 10 starts the firmware startup process shown in Figure 3.
[0031] First, in step S10, the write control unit 16 determines whether or not it has received a special procedure for writing to the counter 12b. If the write control unit 16 receives a special procedure, it proceeds to step S12; otherwise, it proceeds to step S14 to perform the normal firmware startup process.
[0032] In step S12, the write control unit 16 performs authentication processing using a dedicated procedure, and based on the success of the authentication process, updates the counter value CNTb of counter 12b to the specified value, and terminates the process shown in Figure 3. After counter 12b is updated, the device on which the motherboard 100 is installed is restarted. As a result, the process shown in Figure 3 is performed again after the counter 12b has been updated.
[0033] In step S14, the version verification unit 14 reads the version of the firmware 22 to be started from the firmware storage area 20. Next, in step S16, the version verification unit 14 compares the read version with the difference (CNTa-CNTb; check value) between the counter values CNTa and CNTb read from counters 12a and 12b.
[0034] Next, in step S18, if the version verification unit 14 reads a version greater than the difference (CNTa-CNTb), it moves the process to step S20 to match the check value held in the version storage unit 12 with the version of the firmware 22 to be started. If the version verification unit 14 reads a version equal to the difference (CNTa-CNTb), it moves the process to step S22 because the firmware 22 read from the firmware storage area 20 is startable. If the version verification unit 14 reads a version less than the difference (CNTa-CNTb), it detects an error in the firmware 22 startup process and moves the process to step S24 to stop the startup of the firmware 22.
[0035] In step S20, the version verification unit 14 notifies the write control unit 16 of the difference between the version of the firmware 22 to be started and the check value (CNTa-CNTb). Based on the received difference, the write control unit 16 increments the counter value CNTa of counter 12a until the check value (CNTa-CNTb) becomes equal to the version of the firmware 22. After step S20, the process moves to step S22. In step S22, the version verification unit 14 completes the version management process, instructs the processor circuit 10 to start the firmware 22, and terminates the process shown in Figure 3. After the firmware 22 is started, for example, the OS is started.
[0036] In step S24, the version verification unit 14 instructs the processor circuit 10 to stop the startup of firmware 22. The version verification unit 14 also outputs an error to the error processing unit of the processor circuit 10, informing it that an error has occurred and instructing it to stop the startup of the device on which the motherboard 100 is mounted, and the process shown in Figure 3 ends (startup failure). This prevents the startup of an incorrect version of firmware 22.
[0037] In this embodiment, the write control unit 16 updates one of the two counters CNTa and CNTb, which are provided in the version storage unit 12 (a non-volatile memory), when increasing the version, and updates the other when decreasing the version. This allows for multiple version increases and decreases using the two counters CNTa and CNTb. As a result, the memory capacity required to manage the version of software such as firmware can be reduced.
[0038] The version can be increased by increasing the counter value CNTa, and the version can be decreased by increasing the counter value CNTb. For this reason, version upgrades and downgrades can be easily managed by using a check value, which is the difference between the counter values CNTa and CNTb of counters 12a and 12b provided in the OTP memory. For example, if the version of the firmware 22 to be started is greater than the check value, the version can be easily upgraded by updating the counter value CNTa until the check value and the version of the firmware 22 to be started become equal.
[0039] The version verification unit 14 detects an error in the firmware 22 startup process and stops the firmware 22 startup if the version of the firmware 22 to be started is smaller than the difference (CNTa-CNTb). This prevents the startup of an incorrect version of firmware 22.
[0040] The counter value CNTb used when rolling back a version is updated based on a dedicated procedure for writing counter 12b, such as authentication processing, thus ensuring both security and operability in firmware version management. Here, operability includes, for example, the ability to quickly roll back the version and perform testing when a problem occurs with the firmware, thereby suppressing a decrease in firmware debugging efficiency. In contrast, if equipment replacement is required to perform a firmware rollback, a quick rollback becomes difficult.
[0041] Furthermore, devices such as servers equipped with the motherboard 100 are often connected to a network and are therefore vulnerable to cyberattacks via the network. In such cases, unauthorized rollback of firmware 22 can be suppressed, reducing the possibility of malfunctions such as the device becoming infected with a computer virus. As a result, the reliability of devices such as servers equipped with the motherboard 100 can be suppressed.
[0042] Figure 4 shows an example of a motherboard on which a processor circuit in another embodiment is mounted. Elements similar to those in Figure 1 are denoted by the same reference numerals, and detailed explanations are omitted. The processor circuit 10A shown in Figure 4 is, for example, a CPU, and is mounted on the motherboard 100A together with a firmware storage area 20 on which firmware 22 is stored.
[0043] Motherboard 100A has the same configuration as motherboard 100 in Figure 1, except that it is equipped with processor circuit 10A instead of processor circuit 10 in Figure 1. Processor circuit 10A has the same configuration as processor circuit 10 in Figure 1, except that it has version storage unit 12A instead of version storage unit 12 in Figure 1.
[0044] The version storage unit 12A is the same as the version storage unit 12 in Figure 1, except that counter 12c is installed instead of counter 12b in Figure 1. Counter 12c generates the counter value CNTc. The version storage unit 12A is an example of non-volatile memory. Counter 12a, which holds the counter value CNTa, is an example of first non-volatile memory. Counter 12c, which holds the counter value CNTc, is an example of second non-volatile memory.
[0045] For example, counter 12c is provided using non-volatile memory such as flash memory, where the value of each of the multiple bits can be rewritten multiple times. Therefore, counter 12c can operate as a normal binary counter, and the counter value CNTc is represented in binary. Consequently, it is possible to save bits compared to counter 12b in Figure 1, where the counter value CNTb is represented by the number of bits set to "1". In other words, the memory resources used for counter 12c can be further reduced compared to Figure 1. For example, when counting from "0" to "4", counter 12b in Figure 1 uses 4 bits, but counter 12c only uses 3 bits. Also, if counter 12c has 4 bits, it can count from "0" to "15".
[0046] When using non-volatile memory such as flash memory for counter 12c, the value of a bit that has been written to "1" can be reset to "0". However, writing to counter 12c is performed by the write control unit 16 using a dedicated procedure for writing to counter 12c, such as password authentication or public key authentication. Therefore, it is possible to prevent unauthorized values from being written to counter 12c and to prevent unauthorized rollback of the firmware. Note that the dedicated procedure for writing to counter 12c is not limited to password authentication or public key authentication.
[0047] Figure 5 shows an example of managing firmware version updates using counters 12a and 12c from Figure 4. Detailed explanations of operations similar to those in Figure 2 are omitted. Figure 5(A) shows an example of the operation of counters 12a and 12c when a problem occurs after upgrading the firmware 22 version and the version is rolled back two versions. Similar to Figure 2(B), when rolling back the version, the counter value CNTc of counter 12c is incremented by the difference between the current version and the version to be rolled back before the firmware 22 is started.
[0048] In this example, to revert to the previous version by two, the counter value CNTc is increased by "2", from "4'b0000" in state A0 to "4'b0010" in state A1. This makes the difference between counter values CNTa and CNTc "1", allowing firmware 22 version "1" to be booted. Note that in the initial state A0, the counter value CNTa is "5'b00111" "3", so the bootable firmware 22 version is "3".
[0049] The firmware update operation flow by the processor circuit 10A in Figure 4 is the same as in Figure 3. Therefore, the counter value CNTa of counter 12a is updated during the normal startup of firmware 22 if the version of firmware 22 is greater than the check value which is the difference between counter values CNTa and CNTc. Also, since OTP memory is used for counter 12a, it is only updated in the upward direction. Therefore, even if counter 12a is updated maliciously, for example, it will only be updated to a value greater than the current version, and the device will not be able to start after the update. Furthermore, since the counter value CNTc can only be updated in step S12 in Figure 3, the counter value CNTc of counter 12c is prohibited from being updated under any conditions during the normal startup of firmware 22. Thus, the security of the device regarding the firmware version can be ensured.
[0050] Subsequently, when firmware 22 version "2" is started again, the counter value CNTa is updated from "5'b00111" in state A1 to "5'b01111" in state A2. As a result, the version held in the version storage unit 12 is set to "2". Furthermore, when firmware 22 version "3" is started again, the counter value CNTa is updated from "5'b01111" in state A2 to "5'b11111" in state A3. As a result, the version held in the version storage unit 12 is set to "3". In Figure 5, the number of bits in counters 12a and 12c is designed to match the maximum version and maximum rollback count, taking into account the expected firmware operation conditions.
[0051] Figure 6 shows another example of the counter in the embodiment described above. In Figure 6(A), the counter 12a(OTP) in Figure 1 has 96 bits, and the counter 12b(OTP) in Figure 1 has 32 bits. This allows for a maximum of 32 rollback versions. Furthermore, even when the maximum number of rollbacks is performed, it is possible to support up to 64 versions.
[0052] Figure 6(B) shows that the counter 12a (OTP) in Figure 4 has 96 bits, and the counter 12c (flash memory) in Figure 4 has 6 bits. Since the counter value CNTc of counter 12c is represented in binary, it can be set to a value from "0" to "63" which is equivalent to or even better than the rollback that can be achieved with counter 12b. This makes it possible to reduce memory resources.
[0053] In this embodiment as well, the same effects as those of the embodiments described above can be obtained. For example, the two counters CNTa and CNTc allow for multiple version upgrades and downgrades, thereby reducing the memory capacity required to manage software versions such as firmware. Version upgrades and downgrades can be easily managed by using the check value, which is the difference between the counter values CNTa and CNTc of counters 12a and 12c.
[0054] Furthermore, in this embodiment, since the counter 12c is provided using non-volatile memory such as flash memory that can operate as a normal binary counter, the number of bits used can be reduced compared to the counter 12b in Figure 1. As a result, the memory resources used for the counter 12c can be further reduced compared to Figure 1.
[0055] Figure 7 shows an example of a motherboard equipped with a processor circuit in another embodiment. Elements similar to those in Figure 1 are denoted by the same reference numerals, and detailed explanations are omitted. The motherboard 100B shown in Figure 7 includes a CPU 10B, a firmware storage area 20, and a TPM (Trusted Platform Module) 30 containing various security functions. Motherboard 100A is similar to the motherboard 100 in Figure 1, except that it is equipped with a CPU 10B instead of the processor circuit 10 and newly includes a TPM 30. In this embodiment, the motherboard 100B operates as a processor circuit. Hereafter, the motherboard 100B will also be referred to as the processor circuit 100B.
[0056] CPU 10B is similar to the processor circuit 10 in Figure 1, except that it has a version storage unit 12B instead of the version storage unit 12 in Figure 1. The version storage unit 12B is equipped only with a counter 12b (on-chip OTP memory) that generates the counter value CNTb. The version storage unit 12B is an example of non-volatile memory.
[0057] In this embodiment, the counter 12a is mounted on the TPM 30, which is a security chip that includes security functions. Therefore, when the firmware 22 held in the firmware storage area 20 is started, the version verification unit 14 reads and compares the counter value CNTa held in the counter 12a in the TMP 30 with the counter value CNTb held in the counter 12b of the version storage unit 12. The firmware update operation by the CPU 10B in Figure 7 is the same as in Figures 2 and 3.
[0058] As shown in Figure 7, for example, if the TPM30 is already installed on the motherboard 100B, the counter 12a can be implemented using the TPM30, thus reducing the resources required to install the counter 12a. In this way, the counter 12a (OTP) can be installed in any location accessible from the version verification unit 14, thus lowering the barrier to incorporating the firmware 22 version verification method into the motherboard 100B.
[0059] In this embodiment as well, the same effects as those of the embodiments described above can be obtained. For example, the two counters CNTa and CNTb allow for multiple version upgrades and downgrades, thereby reducing the memory capacity required to manage software versions such as firmware. Version upgrades and downgrades can be easily managed by using the check value, which is the difference between the counter values CNTa and CNTb of counters 12a and 12b.
[0060] Furthermore, in this embodiment, if the TPM 30 is already installed on the motherboard 100B, the counter 12a can be implemented using the TPM 30, reducing the resources required to install the counter 12a. Since the counter 12a (OTP) can be installed in any location accessible from the version verification unit 14, the barrier to incorporating the firmware 22 version verification method into the motherboard 100B can be lowered.
[0061] The features and advantages of the embodiments will become clear from the detailed description above. This is intended to be so as not to deviate from the spirit and scope of the claims, that the features and advantages of the embodiments described above are included. Furthermore, any improvement and modification should be readily conceivable to a person with ordinary skill in the art. Therefore, there is no intention to limit the scope of inventive embodiments to those described above, and it is also possible to rely on appropriate improvements and equivalents that fall within the scope disclosed in the embodiments. [Explanation of symbols]
[0062] 10, 10A, 10B Processor Circuits 12, 12A, 12B Version Storage Section 12a, 12b, 12c counters 14 Version Verification Department 16 Writing Control Unit 20 Firmware storage area 22 Firmware 30 TPM 100, 100A, 100B Motherboards CNTa, CNTb, CNTc counter values
Claims
1. A processor circuit that manages the version of the software to be launched, A non-volatile memory that holds the first counter value of the first counter and the second counter value of the second counter, The software includes a startup control unit that updates the first counter value and maintains the second counter value when upgrading the software version, maintains the first counter value and updates the second counter value when downgrading the software version, and starts the software when the version of the software to be started is equal to a version verification check value indicated by the difference between the first counter value and the second counter value. Processor circuit.
2. The non-volatile memory that holds the first counter value and the second counter value is capable of writing each of its multiple bit values only once. The startup control unit writes a value to one of the multiple bits of the first counter when it increments the software version by one. The aforementioned check value is represented by the difference between the number of bits in which a value is written to the first counter and the number of bits in which a value is written to the second counter. The processor circuit according to claim 1.
3. The startup control unit updates the first counter value when the version of the software to be started is greater than the check value, until the check value and the version of the software to be started become equal. The processor circuit according to claim 1 or claim 2.
4. The startup control unit stops the startup of the software if the version of the software to be started is smaller than the check value. The processor circuit according to claim 1 or claim 2.
5. The startup control unit updates the counter value of the second counter based on the success of the authentication process. The processor circuit according to claim 1 or claim 2.
6. The non-volatile memory includes a first non-volatile memory that holds the first counter value and a second non-volatile memory that holds the second counter value. The first non-volatile memory is capable of writing the value of each of the multiple bits only once. The second non-volatile memory described above allows the value of each of the multiple bits to be rewritten multiple times. The processor circuit according to claim 1.
7. The first counter is mounted on a security chip that includes security functions. The processor circuit according to claim 1 or claim 2.
8. A version control method by a processor circuit that manages the version of software to be launched, having a non-volatile memory that holds the first counter value of a first counter and the second counter value of a second counter, When upgrading the software version, the first counter value is updated and the second counter value is maintained. When downgrading the software version, the first counter value is maintained and the second counter value is updated. The software is launched when the version of the software to be launched is equal to a version verification check value, which is the difference between the first counter value and the second counter value. Version control methods.
9. A version control program executed by a processor circuit that manages the version of the software to be launched, having a non-volatile memory that holds the first counter value of the first counter and the second counter value of the second counter, When upgrading the software version, the first counter value is updated and the second counter value is maintained. When downgrading the software version, the first counter value is maintained and the second counter value is updated. The software is launched when the version of the software to be launched is equal to a version verification check value, which is the difference between the first counter value and the second counter value. A version control program that causes the processor circuit to execute the processing.