Processor, processing method, and processing device

Abstract

The present technology relates to a processor, a processing method, and a processing device that make it possible to increase resistance to attacks from the outside. The processor performs falsification check on the basis of scrambled data that is obtained by scrambling prescribed data by using processing data generated by using an address and that is read from a memory in which the scrambled data is stored in the address. The processor descrambles the scrambled data from which falsification has not been detected by the falsification check, and executes processing corresponding to the prescribed data obtained by said descrambling. The present technology can be applied to processors such as CPUs.

Description

Processor, processing method, and processing device

[0001] The present technology relates to a processor, a processing method, and a processing device, and more particularly to a processor, a processing method, and a processing device that can increase resistance to external attacks, for example.

[0002] Patent Document 1 describes a technology for protecting data on a bus and in a memory by using encrypted data, and also describes a technology for duplicating a central processing unit (CPU) and performing an integrity check on the data.

[0003] U.S. Patent No. 10,389,521

[0004] There is a demand for processors such as central processing units (CPUs) to be highly resistant to external attacks at low cost, that is, for example, by suppressing increases in circuit area and overhead.

[0005] The present technology has been developed in light of such circumstances, and is intended to increase resistance to external attacks.

[0006] The processor of the present technology is a processor that includes: a check unit that performs a tampering check based on scrambled data obtained by scrambling specified data using processing data generated using an address, the scrambled data being read from a memory stored at the address; a descramble unit that descrambles the scrambled data for which no tampering was detected by the tampering check; and an execution unit that executes processing corresponding to the specified data obtained by the descrambling.

[0007] The processing method of the present technology is a processing method including: a processor performing a tampering check based on scrambled data obtained by scrambling specified data using processing data generated using an address, the scrambled data being read from a memory stored at the address; descrambling the scrambled data for which no tampering was detected by the tampering check; and executing processing corresponding to the specified data obtained by the descrambling.

[0008] The processing device of the present technology is a processing device that includes a check unit that performs a tampering check based on scrambled data obtained by scrambling specified data using processing data generated using an address, the scrambled data being read from a memory stored at the address, and a descramble unit that descrambles the scrambled data for which no tampering has been detected by the tampering check.

[0009] In this technology, scrambled data obtained by scrambling predetermined data using processing data generated using an address is read from a memory stored at the address, and a tampering check is performed based on the scrambled data. Then, the scrambled data for which no tampering is detected by the tampering check is descrambled.

[0010] The processor and processing unit may be separate devices or may be internal blocks that make up a single device.

[0011] 1 is a diagram illustrating an overview of an example configuration of an image sensor to which the present technology can be applied. FIG. 2 is a block diagram illustrating an example configuration of a first embodiment of a microcomputer to which the present technology is applied. FIG. 3 is a block diagram illustrating an example configuration of a tampering prevention processing unit 42. FIG. 4 is a diagram illustrating an example operation of the tampering prevention processing unit 42 immediately after startup of the CPU 31. FIG. 5 is a diagram illustrating an example generation of a mask as processing data by the processing data generation unit 52. FIG. 6 is a diagram illustrating an example generation of scrambled data to be written to the ROM of the memory 32. FIG. 7 is a diagram illustrating an example of loading and executing a scrambled program into the RAM of the memory 32. FIG. 8 is a timing chart illustrating an example process of reading data from the memory 32. FIG. 9 is a timing chart illustrating an example process of writing data to the memory 32. FIG. 10 is a diagram illustrating a first method of tampering check by the check unit 54. FIG. 11 is a diagram illustrating a second method of tampering check by the check unit 54. FIG. 12 is a diagram illustrating a third method of tampering check by the check unit 54. FIG. 13 is a diagram illustrating a first example of tampering check of read data based on whether read data matches an expected data value. FIG. 14 is a diagram further illustrating the first example of tampering check of read data based on whether read data matches an expected data value. Fig. 1 is a diagram illustrating a second example of a read data tampering check based on whether the read data matches an expected data value. Fig. 2 is a diagram further illustrating a second example of a read data tampering check based on whether the read data matches an expected data value. Fig. 3 is a block diagram illustrating a configuration example of a second embodiment of a microcomputer to which the present technology is applied. Fig. 4 is a block diagram illustrating a configuration example of a third embodiment of a microcomputer to which the present technology is applied.

[0012] <Outline of image sensors to which this technology can be applied>

[0013] FIG. 1 is a diagram showing an outline of a configuration example of an image sensor to which the present technology can be applied.

[0014] Fig. 1A shows a schematic configuration example of a non-stacked image sensor. As shown in Fig. 1A, the image sensor 10 has a single die (semiconductor substrate) 11. The die 11 is equipped with a pixel region 12 in which pixels are arranged in an array, a control circuit 13 that drives the pixels and performs various other controls, and a logic circuit 14 that processes signals.

[0015] 1B and 1C show a schematic configuration example of a stacked image sensor. As shown in Fig. 1B and 1C, the image sensor 20 is configured as a single semiconductor chip by stacking two dies, a sensor die 21 and a logic die 24, which are electrically connected.

[0016] In FIG. 1B, the sensor die 21 is equipped with the pixel region 12 and the control circuit 13, and the logic die 24 is equipped with the logic circuit 14 including a signal processing circuit that performs signal processing.

[0017] In FIG. 1C, the pixel region 12 is mounted on the sensor die 21, and the control circuit 13 and the logic circuit 14 are mounted on the logic die 24.

[0018] The present technology can be applied to the non-stacked image sensor 10 and the stacked image sensor 20 described above. Furthermore, the present technology can be applied to a two-layer image sensor 20 in which two dies are stacked, as well as a three-layer or more image sensor in which three or more dies are stacked. For example, when the present technology is applied to a three-layer image sensor, the third die can be equipped with, for example, a memory that stores data for signal processing in the logic circuit 14. An image sensor to which the present technology is applied can be installed in, for example, a camera, a mobile terminal (handheld terminal), or various other devices.

[0019] Furthermore, the present technology can be applied to various processors, such as CPUs and DSPs (digital signal processors), that execute programs (each instruction that constitutes a program), in addition to image sensors.

[0020] <First embodiment of a microcomputer to which the present technology is applied>

[0021] FIG. 2 is a block diagram showing a configuration example of a first embodiment of a microcomputer to which the present technology is applied.

[0022] A microcomputer to which the present technology is applied can be mounted, for example, in the logic circuit 14 of the image sensor 10 or 20 in FIG.

[0023] 2, the microcomputer 30 has a CPU 31, a memory 32, and a peripheral device 33. The CPU 31 to the peripheral device 33 are connected to a bus, and can exchange data (including programs, control signals, etc.) with each other via the bus.

[0024] The CPU 31 performs various processes such as signal processing by reading (fetching) a sequence of instructions, which is a program, from the memory 32 (via the bus) and executing it. In this specification, an instruction includes an opcode and, if necessary, an operand.

[0025] The memory 32 is configured, for example, by a ROM (read only memory) or a RAM (random access memory), and stores data necessary for the operation of the CPU 31. The data necessary for the operation of the CPU 31 includes data to be processed by the CPU 31, data obtained as a result of the processing by the CPU 31, programs executed by the CPU 31, etc.

[0026] The peripheral device 33 is, for example, an external I / F (interface) such as a GPIO (general purpose input output) for exchanging signals with the outside, or a device such as a timer that enhances the functions of the microcomputer 30.

[0027] In recent years, with respect to processors such as the CPU 31, fault injection attacks have been carried out on blocks other than the processor, such as buses and memories, and data on the buses and memories may be tampered with.

[0028] Countermeasures against fault injection attacks on buses and memories include, for example, providing a fault detection mechanism that duplicates buses and memories, or using ECC (Error-correcting code), i.e., correcting errors in data stored in memory using ECC.

[0029] The method of providing a fault detection mechanism requires duplication of not only the bus and memory but also each peripheral device connected to the bus, which has a significant impact on circuit area and power consumption. The method using ECC can deal with fault injection attacks on memory (which can result in data tampering), but it is difficult to deal with fault injection attacks on the bus. In addition, ECC-related processing incurs a large overhead.

[0030] Therefore, the CPU 31 has a tampering prevention processing unit 42. The tampering prevention processing unit 42 can increase resistance to external attacks, such as fault injection attacks on buses and memories, at low cost (by suppressing increases in circuit area and overhead).

[0031] The CPU 31 includes a CPU core 41 and a tamper-proof processing unit 42 .

[0032] The CPU core 41 accesses the bus and further the memory 32 via the anti-tamper processing unit 42. The CPU core 41 functions as an execution unit that reads data stored in the memory 32 and executes processing corresponding to the data. For example, if the data read from the memory 32 is an instruction that constitutes a program, the CPU core 41 executes the instruction. The CPU core 41 also writes data to the memory 32 as necessary.

[0033] The tamper prevention processing unit 42 uses a bus scramble function to perform tamper prevention processing against fault injection attacks (data tampering caused by) on the bus accessed by the CPU core 41 and the memory 32. The bus scramble function is a function that scrambles (encrypts) plain data to be exchanged via the bus, rather than exchanging the data that is originally to be exchanged as plain data.

[0034] In order for the tamper prevention processing unit 42 to perform tamper prevention processing, plain text data, for example, scrambled data in which each instruction constituting a program is scrambled, is stored (written) in the ROM or RAM of the memory 32 as necessary.

[0035] The anti-tampering processing unit 42 descrambles the scrambled data stored in the memory 32 when the CPU core 41 fetches an instruction from the memory 32, thereby restoring the instruction to plain text data. The CPU core 41 executes the instruction that has been restored to plain text data by descrambling in the anti-tampering processing unit 42.

[0036] The tamper-proof processing unit 42 performs a tamper check to determine whether the scrambled data has been tampered with by a fault injection attack on the bus and memory 32 before or after, or both before and after, descrambling the scrambled data.

[0037] In the tamper check after descrambling, the anti-tamper processor 42 checks the scrambled data for tampering by determining whether the descrambled result (plaintext data) of the scrambled data is an undefined instruction not defined in the CPU 31. If the descrambled result of the scrambled data is a defined instruction defined in the CPU 31, the anti-tamper processor 42 determines that tampering has not been detected and outputs the defined instruction to the CPU core 41. The CPU core 41 executes (uses) the defined instruction from the anti-tamper processor 42. On the other hand, if the descrambled result of the scrambled data is an undefined instruction, the anti-tamper processor 42 determines that tampering has been detected and outputs an error signal. The tamper check, which is performed to determine whether the descrambled result of the scrambled data is an undefined instruction, is useful when the proportion (number) of binaries that are undefined instructions is high (when the proportion of binaries that are defined instructions is low) in the space of the processor instruction set (ISA: Instruction Set Architecture).

[0038] In the tamper check before descrambling, the tamper prevention processor 42 checks the scrambled data for tampering based on the scrambled data.

[0039] Here, in memory 32, the scrambled data obtained by scrambling plain data (predetermined data) such as instructions using processing data (for example, a mask or tag, which will be described later) generated using the address ad is stored (written) at that address ad.

[0040] As described above, plaintext data is scrambled using processing data generated using the address where the scrambled data of the plaintext data (scrambled data obtained by scrambling the plaintext data) is stored. Therefore, even if the scrambled data of plaintext data of the same instruction is stored at a different address, the data will be different. Therefore, each piece of scrambled data obtained by scrambling each instruction constituting a program (almost never) matches other scrambled data. Therefore, tampering check can be performed by checking whether the scrambled data matches other scrambled data stored at a different address from the address of the scrambled data. If the scrambled data does not match other scrambled data, it is determined that tampering has not been detected, and the tampering prevention processor 42 outputs the definition command to the CPU core 41. The CPU core 41 executes the definition command from the tampering prevention processor 42. On the other hand, if the scrambled data matches other scrambled data, it is determined that tampering has been detected, and the tampering prevention processor 42 outputs an error signal.

[0041] Here, as a countermeasure against fault injection attacks on buses and memories, a method of providing a fault detection mechanism that duplicates buses, memories, etc. targets all fault injection attacks on buses and memories. In other words, the method of providing a fault detection mechanism aims to deal with tampering with all signals, including control signals (timing) on ​​the bus, as well as tampering with data on the bus or memory. For example, in processors used in cases where safety is the top priority, such as processors for autonomous driving, dealing with all fault injection attacks on buses and memories takes priority over cost.

[0042] On the other hand, processors may be applied to cases such as image sensors where safety is not a priority but rather the need to prevent the instructions constituting the program from being rewritten with unintended instructions, resulting in unintended processing or the prevention of intended processing. Such processors are required to deal with tampering of bus and memory data, but are not required to deal with tampering of all signals, including bus control signals. Rather than dealing with tampering of all signals, including bus control signals, it is more important to deal with tampering of bus and memory data at low cost.

[0043] The tampering countermeasure processing unit 42 can increase resistance to external attacks at low cost, that is, for example, can counter data tampering caused by fault injection attacks on buses and memories while minimizing increases in circuit area and overhead.

[0044] The implementation of the tampering prevention processing unit 42 can be varied. That is, in Fig. 2, the CPU 31 has the tampering prevention processing unit 42 built in, but the tampering prevention processing unit 42 can be provided outside the CPU 31. That is, in Fig. 2, the tampering prevention processing is performed inside the CPU 31, but the tampering prevention processing can be performed outside the CPU 31.

[0045] <Configuration example of tampering prevention processing unit 42>

[0046] FIG. 3 is a block diagram showing an example of the configuration of the tampering prevention processing unit 42. As shown in FIG.

[0047] The anti-tampering processor 42 includes an address decoder 51, a processing data generator 52, a scramble processor 53, and a checker 54.

[0048] The address decoder 51 is supplied with an address output by the CPU core 41. For example, the CPU core 41 outputs an address of the memory 32 in which data to be read is stored, or an address of the memory 32 in which data to be written is stored (hereinafter collectively referred to as a read / write address). For example, the CPU core 41 outputs an address of the memory 32 in which an instruction (scrambled data) to be read in an instruction fetch is stored. Furthermore, for example, the CPU core 41 outputs an address of the memory 32 in which an instruction (scrambled data) constituting a program to be executed or installed by the CPU core 41 is written. The address decoder 51 outputs the read / write address from the CPU core 41 to the processing data generation unit 52 and also outputs it to the memory 32 via the bus. Furthermore, the address decoder 51 decodes the read / write address from the CPU core 41 and outputs the resulting decoded value to the processing data generation unit 52.

[0049] The address decoder 51 decodes the read / write address into a decode value that indicates whether or not to generate processing data to be used in the scrambling process of the scramble processor 53. For example, the address at which the processing data is generated is set in advance, and the read / write address is decoded according to that setting.

[0050] When the decoded value from the address decoder 51 indicates that processing data should be generated, the processing data generation unit 52 generates processing data using the read / write address from the address decoder 51 and outputs it to the scramble processing unit 53. The processing data generated using the read / write address may be used for tampering check by the check unit 54, and the processing data generated by the processing data generation unit 52 is also output to the check unit 54. That is, the processing data generated using the read / write address includes, for example, a mask and a tag, which will be described later, and when a tag is used as the processing data, the tag is used for tampering check by the check unit 54.

[0051] The scramble processing unit 53 functions as a scramble unit that scrambles (encrypts) data and a descramble unit that descrambles (decrypts (decodes) the code). Scrambling and descrambling are collectively referred to as scramble processing.

[0052] It should be noted that the scramble processing unit 53 may be replaced by a scramble unit having a scrambling function and a descramble unit having a descrambling function. The scramble processing unit 53 may also be configured without a scrambling function. If the scramble processing unit 53 does not have a scrambling function, it is not possible to scramble data by scrambling data within the CPU 31.

[0053] The scramble processing unit 53 is supplied with write data to be written to the memory 32, which is output by the CPU core 41. For example, when writing write data to the memory 32, the CPU core 41 outputs the write data as well as a read / write address to which the write data should be written.

[0054] When the decoded value obtained by decoding the read / write address of the write data indicates that processing data should be generated, the scramble processing unit 53 scrambles the write data using the processing data generated using the read / write address of the write data, which is supplied from the processing data generation unit 52, and outputs the resulting scrambled data via the bus to the memory 32. In the memory 32, the scrambled data output by the scramble processing unit 53 is written to the read / write address output by the address decoder 51.

[0055] On the other hand, if the decoded value obtained by decoding the read / write address of the write data indicates that processing data will not be generated, the scramble processing unit 53 outputs the write data via the bus to the memory 32. In the memory 32, the write data output by the scramble processing unit 53, i.e., plaintext data, is written to the read / write address output by the address decoder 51.

[0056] Furthermore, the scramble processing unit 53 is supplied with read data read from the memory 32 via the bus and the check unit 54. For example, the read data stored in the read / write address output by the address decoder 51 is read from the memory 32 and supplied to the scramble processing unit 53 via the bus and the check unit 54.

[0057] When the decoded value obtained by decoding the read / write address of the read data indicates that processing data is to be generated, the processing data generated using the read / write address of the read data is supplied to the scramble processing unit 53 from the processing data generation unit 52. In this case, the read data is scrambled data obtained by scrambling plaintext data. The scramble processing unit 53 descrambles the scrambled data as the read data using the processing data, and outputs the resulting plaintext data to the CPU core 41. The CPU core 41 executes a process corresponding to the plaintext data from the scramble processing unit 53, for example, an instruction as the plaintext data.

[0058] On the other hand, if the decoded value obtained by decoding the read / write address of the read data indicates that processing data is not to be generated, the read data is plaintext data. The scramble processing unit 53 outputs the plaintext data as the read data to the CPU core 41. The CPU core 41 executes processing corresponding to the plaintext data from the scramble processing unit 53.

[0059] The scrambling performed by the scramble processor 53 can be, for example, an operation expressed by a function identical to an inverse function. For example, the scrambling can be an exclusive OR (XOR) with the processing data used as a mask. In this case, both the scrambling and the descrambling are an exclusive OR with the mask as the processing data. That is, the scrambling is an exclusive OR with the mask as the processing data and the plaintext data as the write data. The descrambling is an exclusive OR with the mask as the processing data and the scrambled data as the read data.

[0060] Furthermore, when the exclusive OR with a mask as processing data is employed for scrambling and descrambling, the processing data generation unit 52 can generate a mask as processing data using the read / write address when the decoded value of the address decoder 51 indicates that processing data is to be generated, and can generate an all-zero mask as the processing data mask when the decoded value of the address decoder 51 indicates that processing data is not to be generated. Furthermore, the scrambling unit 53 can always perform scrambling using the processing data regardless of the decoded value of the address decoder 51. In this case, when the decoded value of the address decoder 51 indicates that processing data is not to be generated, the scrambling unit 53 performs an exclusive OR between the data and the all-zero mask. Therefore, the result of the scrambling is the data to be scrambled as is, and the scrambling is equivalent to performing no processing at all.

[0061] In the following, for the sake of simplicity, it is assumed that the decoded value of the address decoder 51 always represents the generation of processing data, and that the memory 32 stores scrambled data.

[0062] The check unit 54 is supplied via the bus with the read data read from the memory 32. For example, the scrambled data stored in the read / write address output by the address decoder 51 is read from the memory 32 as read data and supplied to the check unit 54 via the bus.

[0063] The check unit 54 checks the read data for tampering based on the scrambled data as the read data. There are various methods for checking tampering based on scrambled data, as will be described later. Among these methods, there is a method that uses the processing data generated by the processing data generation unit 52.

[0064] If no tampering is detected, the check unit 54 outputs the scrambled data as read data to the scramble processing unit 53. Therefore, the scramble processing unit 53 descrambles the scrambled data for which no tampering is detected.

[0065] Furthermore, if tampering is detected, the check unit 54 does not output the scrambled data as read data to the scramble processing unit 53 (it restricts the output of the scrambled data to the scramble processing unit 53) and outputs an error signal. If the check unit 54 outputs an error signal, for example, the microcomputer 30 undergoes a system reset. If the check unit 54 outputs an error signal, it can also, for example, generate an interrupt to the CPU core 41 to cause it to take necessary recovery measures.

[0066] In addition to checking for tampering based on the scrambled data, the check unit 54 can also check for tampering of the scrambled data as read data by determining whether the plaintext data obtained as a result of descrambling the scrambled data is an undefined command, as described with reference to the tampering prevention processing unit 42 in FIG. 2. In this case, the check unit 54 outputs the scrambled data as read data to the scramble processing unit 53, which descrambles the scrambled data into plaintext data. The check unit 54 then checks for tampering by determining whether the plaintext data obtained as a result of descrambling is an undefined command.

[0067] If no tampering is detected, that is, if the plaintext data is a definition command, the check unit 54 causes the scramble processing unit 53 to output the definition command to the CPU core 41. The CPU core 41 executes the definition command from the scramble processing unit 53.

[0068] On the other hand, if tampering is detected, that is, if the plaintext data is an undefined command, the check unit 54 does not allow the scramble processing unit 53 to output the undefined command to the CPU core 41, and outputs an error signal.

[0069] <Example of Operation of Tampering Prevention Processing Unit 42>

[0070] FIG. 4 is a diagram illustrating an example of the operation of the tamper-prevention processing unit 42 immediately after the CPU 31 is started up.

[0071] In FIG. 4, the following is assumed.

[0072] The ROM of the memory 32 stores scramble data (hereinafter also referred to as instruction scramble data) that scrambles each instruction that constitutes a program to be executed immediately after startup of the CPU 31. The CPU 31 (CPU core 41) executes the program immediately after startup. Therefore, the CPU 31 sequentially outputs the addresses of the scramble data for each instruction that constitutes the program during instruction fetching.

[0073] The scrambled data of the instructions stored in the ROM of the memory 32 is generated by scrambling using the address of the scrambled data. That is, the scrambled data of the instructions as plain text data is generated by scrambling, for example, by taking the exclusive OR of a mask as processing data generated using the address of the scrambled data and the instruction as plain text data. Because the mask is generated using the address of the scrambled data of the instructions, even if the instructions are the same, the scrambled data stored at different addresses will (almost) never be the same.

[0074] Therefore, tampering check of read data can be performed by checking whether scrambled data as read data read from the ROM of memory 32 matches other scrambled data stored at an address different from the address of the read data. For example, tampering check of read data can be performed by checking whether scrambled data as read data matches other scrambled data read from the ROM of memory 32 immediately before the read data. In this case, it is desirable to confirm in advance that the scrambled data of instructions stored in the ROM of memory 32 does not match other scrambled data read from the ROM of memory 32 immediately before the scrambled data.

[0075] When the CPU 31 starts up, the CPU core 41 sequentially outputs the addresses of the scrambled data of each instruction that constitutes the program to be executed immediately after startup. The addresses output by the CPU core 41 are supplied to the memory 32, which then performs memory access to read the scrambled data from the memory 32. In the memory 32, the scrambled data stored at the address from the CPU core 41 is read as read data and supplied to the check unit 54.

[0076] In step S11, in the tampering prevention processing unit 42, the processing data generation unit 52 acquires (generates) a fixed value as a seed of, for example, 32 bits, which is the source of processing data.

[0077] In step S12 , the processing data generation unit 52 generates a mask as processing data using the address (read / write address) and seed output by the CPU core 41 , and outputs the mask to the scramble processing unit 53 .

[0078] With regard to the scrambled data read as read data in the first memory access among the memory accesses for reading scrambled data of each instruction constituting the program, the check unit 54 outputs the read data to the scramble processing unit 53.

[0079] In step S13, the scramble processing unit 53 descrambles the scrambled data as read data from the check unit 54 using the mask as processing data from the processing data generation unit 52. For example, the descrambling involves performing an exclusive OR (XOR) operation between the scrambled data as read data and the mask as processing data. The scramble processing unit 53 then outputs the data (plaintext data) obtained by descrambling to the check unit 54.

[0080] In step S14, the check unit 54 checks whether the read data has been tampered with based on the data obtained by descrambling from the scramble processing unit 53.

[0081] The current read data, which is the read data read from the memory 32 and is currently the target of the tampering check, is the read data read in the first memory access. The read data read in the first memory access does not have the previous read data, which is the read data read from the memory 32 immediately before it. Therefore, it is difficult to check the tampering of the read data by determining whether the scrambled data of the current read data matches other scrambled data of the previous read data. Therefore, when the current read data is the read data read in the first memory access, the check unit 54 checks the tampering of the current read data by determining whether the data is an undefined command based on the data (descramble result) obtained by descrambling the scrambled data of the current read data. Note that the tampering of the read data read in the first memory access may also be checked by determining whether the data matches the read data to be read in the next memory access.

[0082] If tampering (fault injection attack) is detected in the tampering check in step S14, that is, if the data obtained by descrambling is an undefined command, the check unit 54 outputs an error signal in step S15. In response to the output of the error signal, for example, a system reset of the microcomputer 30 or an interrupt is generated.

[0083] On the other hand, if no tampering is detected in the tampering check in step S14, i.e., if the data obtained by descrambling is a definition command, in step S16, the check unit 54 causes the scramble processing unit 53 to output the data obtained by descrambling, i.e., the definition command as plaintext data, to the CPU core 41. As a result, the definition command as plaintext data is executed (used) by the CPU core 41.

[0084] Thereafter, the second and subsequent memory accesses among the memory accesses for reading the scrambled data of the instructions constituting the program are sequentially performed. The scrambled data as read data read in the second and subsequent memory accesses is checked for tampering before being output from the check unit 54 to the scramble processing unit 53.

[0085] That is, first, in step S17 , the processing data generation unit 52 generates a mask as processing data using the address (read / write address) and seed output by the CPU core 41 , and outputs it to the scramble processing unit 53 .

[0086] In step S18, the check unit 54 checks whether the current read data has been tampered with, based on the scrambled data as the current read data read from the ROM of the memory 32. For example, the check unit 54 checks whether the current read data has been tampered with by checking whether the scrambled data as the current read data matches other scrambled data as the previously read data.

[0087] If tampering is detected in the tampering check in step S18, i.e., if the current read data matches the previous read data, the check unit 54 outputs an error signal in step S15, as described above.

[0088] On the other hand, if no tampering is detected in the tampering check in step S18, i.e., if the current read data does not match the previous read data, the current read data is descrambled in step S19. That is, the check unit 54 outputs scrambled data as the current read data for which no tampering has been detected to the scramble processing unit 53. The scramble processing unit 53 descrambles the scrambled data as the read data from the check unit 54 using the mask as processing data from the processing data generation unit 52.

[0089] After that, in step S16, the scramble processing unit 53 outputs the instruction as plaintext data obtained by descrambling to the CPU core 41. As a result, the instruction as plaintext data is executed by the CPU core 41.

[0090] <Mask generation example>

[0091] FIG. 5 is a diagram for explaining an example of generation of a mask as processing data by the processing data generation unit 52. In FIG.

[0092] In FIG. 5, the following is assumed.

[0093] In the scramble processing unit 53, scrambling and descrambling, which involves calculating an exclusive OR with a mask, are performed on, for example, 32-bit data. In the memory 32, for example, 8 bits (1 byte) of data are stored per address. Access to the memory 32, i.e., reading and writing of data, is performed, for example, in units of 32 bits (1 word). For example, in one data read / write operation in the memory 32, 32 bits of data stored in four consecutive addresses are read / written. When reading / writing 32 bits of data stored in four consecutive addresses, for example, the smallest address of the four addresses is designated as the read / write address. In this case, the lowest two bits of the read / write address are always 0. The address of the memory 32 is, for example, composed of 32 bits.

[0094] The processing data generation unit 52 calculates the exclusive OR of the 32-bit seed and the 32-bit address serving as the read / write address of the scrambled data, and obtains the 32-bit calculation result of the exclusive OR. As described above, since the lowest 2 bits of the 32-bit read / write address are always 0, when calculating the exclusive OR of the seed and the read / write address, the lowest 2 bits are not used in the calculation of the exclusive OR, and the seed value can be used as the calculation result as is.

[0095] The processing data generation unit 52 performs Sbox permutation on every four bits of the 32-bit result of the exclusive OR. Furthermore, the processing data generation unit 52 performs a predetermined matrix operation using the result of the Sbox permutation and a matrix, and uses the 32-bit data obtained as a result of the matrix operation as a 32-bit mask as processing data.

[0096] <Example of scrambled data generation>

[0097] FIG. 6 is a diagram for explaining an example of generation of scramble data to be written to the ROM of the memory 32. In FIG.

[0098] First, for example, a sequence of 32-bit instructions (32'hxxxxxxxx) that make up a program as plaintext data is generated in association with a 32-bit address (addr) where the scrambled data of the instructions is written (stored).

[0099] For each instruction (the scrambled data thereof), a 32-bit mask (32'hyyyyyyyy) is generated as processing data using the address where the scrambled data of that instruction is written.

[0100] For each instruction, the instruction as plaintext data is scrambled using the mask for that instruction, i.e., the instruction and the mask are exclusive-ORed to generate 32-bit scrambled data (32'hzzzzzzzz).

[0101] The above process is performed using, for example, a script, etc., so that scramble data is generated in advance and written to the ROM of the memory 32.

[0102] Hereinafter, the scrambled data (series of scrambled data) of instructions that make up a program will also be referred to as a scrambled program.

[0103] The CPU 31 executes the scramble program written in advance in the ROM of the memory 32 while checking for tampering, for example, as explained with reference to FIG.

[0104] <Example of loading a scramble program into RAM>

[0105] FIG. 7 is a diagram for explaining an example in which the scramble program is loaded into the RAM of the memory 32 and executed.

[0106] The scramble program can be written in advance in the ROM of the memory 32 and executed, or can be loaded from the outside into the RAM and executed.

[0107] In this case, an external I / F serving as one of the peripheral devices 33 communicates with the outside to receive a scramble program from the outside. The scramble program from the outside is loaded into the RAM of the memory 32 and remapped as necessary.

[0108] The CPU 31 can execute the scramble program loaded (stored) in the RAM of the memory 32 in the same way as a scramble program written in advance in the ROM of the memory 32 .

[0109] <Processing of reading and writing data from / to memory 32>

[0110] FIG. 8 is a timing chart illustrating an example of a process for reading data from the memory 32. In FIG.

[0111] The CPU core 41 outputs a read request for requesting the reading of data to the tamper-proof processing unit 42. The read request includes a ROM or RAM address of the memory 32 as the read / write address of the data to be read (read data).

[0112] The tamper-proof processing unit 42 outputs a read request from the CPU core 41 to the memory 32. The memory 32 reads data (read data) from the read / write address included in the read request (read data set).

[0113] The anti-tampering processor 42 also outputs the read / write address included in the read request from the CPU core 41 to the processing data generator 52 (address set). The processing data generator 52 generates a mask using the read / write address and outputs it to the scramble processor 53.

[0114] Meanwhile, the memory 32 outputs the scrambled data as read data to the tamper-proof processing unit 42. The tamper-proof processing unit 42 performs a tampering check on the read data based on the scrambled data as read data from the memory 32. If no tampering is detected in the tampering check, the tamper-proof processing unit 42 descrambles the scrambled data as read data using a mask in the scramble processing unit 53. The tamper-proof processing unit 42 outputs plaintext data obtained as a result of the descrambling to the CPU core 41.

[0115] The memory 32 outputs the read data to the tampering prevention processing unit 42, and then outputs a response to the tampering prevention processing unit 42. The tampering prevention processing unit 42 outputs the response from the memory 32 to the CPU core 41. When the CPU core 41 receives the response from the tampering prevention processing unit 42, a series of processes for reading one piece of read data from the memory 32 is completed. The series of processes for reading one piece of read data from the memory 32 includes reading scrambled data as read data from the memory 32, checking the read data for tampering, and descrambling the scrambled data as read data for which no tampering was detected.

[0116] FIG. 9 is a timing chart illustrating an example of a process for writing data to the memory 32. In FIG.

[0117] The CPU core 41 outputs a write request for writing data to the anti-tamper processing unit 42. The write request includes an address in the RAM of the memory 32 as the read / write address of the data to be written (write data).

[0118] The tamper-proof processing unit 42 outputs a write request from the CPU core 41 to the memory 32 .

[0119] The anti-tampering processor 42 also outputs the read / write address included in the write request from the CPU core 41 to the processing data generator 52 (address set). The processing data generator 52 generates a mask using the read / write address and outputs it to the scramble processor 53.

[0120] The CPU core 41 outputs the plaintext data as the write data to the tampering prevention processing unit 42. The tampering prevention processing unit 42 uses a mask to scramble the plaintext data as the write data from the CPU core 41. The tampering prevention processing unit 42 outputs the scrambled data (or the scrambled write data) obtained as a result of the scrambling to the memory 32.

[0121] The memory 32 writes the scrambled data (or the write data) from the anti-tamper processing unit 42 to the read / write address (RAM address) included in the write request from the anti-tamper processing unit 42 (RAM data write).

[0122] After writing the scrambled data, the memory 32 outputs a response to the tampering prevention processing unit 42. The tampering prevention processing unit 42 outputs the response from the memory 32 to the CPU core 41. When the CPU core 41 receives the response from the tampering prevention processing unit 42, a series of processes for writing one piece of write data to the memory 32 is completed. The series of processes for writing one piece of write data to the memory 32 is the scrambling of the write data and the writing of the scrambled data obtained as a result of the scrambling to the memory 32.

[0123] <Example of tampering check>

[0124] FIG. 10 is a diagram illustrating a first method of checking for tampering by the checking unit 54. In FIG.

[0125] In the first method, read data is read from the memory 32, and the scrambled data serving as the read data is descrambled using a mask serving as processing data generated using the read / write address of the read data. Then, a tampering check of the read data is performed based on whether the plaintext data obtained as a result of the descrambling is an undefined command.

[0126] If the plaintext data obtained as a result of descrambling is an undefined command, the tamper-proof processing unit 42 determines that tampering has been detected and outputs an error signal. On the other hand, if the plaintext data obtained as a result of descrambling is not an undefined command (if it is a defined command), the tamper-proof processing unit 42 determines that tampering has not been detected and outputs the command (defined command) as the plaintext data obtained as a result of descrambling to the CPU core 41. The CPU core 41 executes that command.

[0127] By checking whether the plaintext data obtained as a result of descrambling is an undefined command, it is possible to confirm whether the read data has been tampered with (changed) by a fault injection attack on the memory 32 or the bus.

[0128] FIG. 11 is a diagram illustrating a second method of checking for tampering by the checking unit 54. In FIG.

[0129] In the second method, read data is read from the memory 32, and the scrambled data as the read data is compared with other scrambled data as read data read from other addresses. Then, a tampering check of the read data is performed based on whether the scrambled data as the read data matches the other scrambled data.

[0130] For example, in the second method, the tampering check of the current read data is performed by checking whether the scrambled data as the current read data read from the memory 32 matches other scrambled data as the previous read data read from the memory 32 last time.

[0131] If the current read data matches the previous read data, it is determined that tampering has been detected, and the tamper-proof processing unit 42 outputs an error signal. On the other hand, if the current read data does not match the previous read data, it is determined that tampering has not been detected, and the tamper-proof processing unit 42 descrambles the scrambled data as the current read data using a mask as processing data generated using the read / write address of the current read data. The instruction as plain text data obtained as a result of the descrambling is output from the tamper-proof processing unit 42 to the CPU core 41, and is executed by the CPU core 41.

[0132] By checking whether the current read data matches the previous read data, it is possible to confirm whether the read data has been tampered with by a fault injection attack on the memory 32 or the bus.

[0133] When checking for tampering by checking whether the current read data matches the previous read data, it is desirable to confirm in advance that the scrambled data of the instruction stored in memory 32 does not match other scrambled data read from memory 32 immediately before that scrambled data, as explained in FIG. 4.

[0134] FIG. 12 is a diagram illustrating a third method of checking for tampering by the check unit 54. In FIG.

[0135] In the third method, a tampering check of the read data is performed by checking whether the scrambled data (all or part) as read data read from memory 32 matches the expected data value, which is the data value expected for the scrambled data (all or part).

[0136] If the scrambled data as read data does not match the expected data value, it is determined that tampering has been detected, and the tamper-proof processing unit 42 outputs an error signal. On the other hand, if the scrambled data as read data matches the expected data value, it is determined that tampering has not been detected, and the tamper-proof processing unit 42 descrambles the scrambled data as the current read data. The instruction as plain text data obtained as a result of the descrambling is output from the tamper-proof processing unit 42 to the CPU core 41, and is executed by the CPU core 41.

[0137] FIG. 13 is a diagram illustrating a first example of a read data tamper check based on whether the read data matches an expected data value.

[0138] 13, the check unit 54 stores a fixed value generation data table. In the fixed value generation data table, fixed value generation data (random data) is registered in association with each address of the scrambled data of an instruction stored in the memory 32. The fixed value generation data is data of the same number of bits as the instruction as plaintext data for which the scrambled data is written in the memory 32, for example, 32 bits.

[0139] The fixed value generation data, together with the read / write address, is used to generate a mask as processing data used to scramble the instruction as plaintext data. The fixed value generation data is data for scrambling the instruction as plaintext data using the mask, i.e., for converting the scrambled data obtained by performing an exclusive OR operation on the mask and the instruction as plaintext data into a fixed value as an expected data value.

[0140] The fixed value generation data is set so that the scrambled data obtained by scrambling the instruction (predetermined data) as plain data before being scrambled into scrambled data using a read / write address A of the scrambled data of the instruction and a mask for the read / write address A as processing data generated using the fixed value generation data associated with the read / write address A becomes a predetermined fixed value as an expected data value.

[0141] The fixed value as the expected data value may be all 0's, all 1's, or any other arbitrary value. For example, the same value may be used for all products, regardless of the product to which the microcomputer 30 is applied. Furthermore, for example, a different value may be used for each product or for each individual product.

[0142] After the fixed value generation data is set and a fixed value generation data table is generated in which the fixed value generation data is registered in association with read / write addresses, a mask is generated for each read / write address as 32-bit processing data using the fixed value generation data table. The mask for read / write address A as 32-bit processing data is generated using the 32-bit read / write address A and the 32-bit fixed value generation data associated with that read / write address A.

[0143] The mask for read / write address A is generated, for example, by performing an Sbox permutation every four bits on the exclusive OR of read / write address A and the fixed value generation data associated with that read / write address A, and then performing a matrix operation using the result of the Sbox permutation and a matrix.

[0144] A 32-bit plaintext instruction, for which scrambled data is to be written at read / write address A, is scrambled using the mask for read / write address A. That is, the plaintext instruction is scrambled by performing an exclusive OR operation between the plaintext instruction, for which scrambled data is to be written at read / write address A, and the mask for read / write address A. The 32-bit scrambled data obtained as a result of the scrambling is confirmed to be a fixed value as an expected data value, and then written to read / write address A in memory 32.

[0145] In addition, in the memory 32, the scrambled data written to the read / write addresses associated with the fixed value generation data registered in the fixed value generation data table is a fixed value as an expected data value. Therefore, it is possible to simply write a predetermined fixed value as an expected data value to the read / write addresses associated with the fixed value generation data registered in the fixed value generation data table without scrambling the instruction as plaintext data. In this case, it is desirable to generate a mask for each write address and use the mask to descramble the fixed value as the expected data value, i.e., to perform an exclusive OR operation between the mask and the fixed value as the expected data value, and to confirm in advance that the descrambled result (the result of the exclusive OR operation) obtained by this operation matches the instruction as plaintext data.

[0146] FIG. 14 is a diagram further illustrating a first example of checking for tampering of read data based on whether the read data matches an expected data value.

[0147] In the tamper check of FIG. 14, read data is read from the memory 32, and the tamper check of the read data is performed by checking whether the scrambled data as the read data matches a fixed value as an expected data value.

[0148] If the scrambled data as read data does not match the fixed value as the expected data value, it is determined that tampering has been detected, and the tamper-proof processing unit 42 outputs an error signal. On the other hand, if the scrambled data as read data matches the fixed value as the expected data value, it is determined that tampering has not been detected, and the tamper-proof processing unit 42 descrambles the scrambled data as read data using a mask as processing data. Here, the mask as processing data is generated using the read / write address of the read data and fixed value generation data associated with the read / write address of the read data in the fixed value generation data table. The instruction as plaintext data obtained as a result of descrambling is output from the tamper-proof processing unit 42 to the CPU core 41 and executed by the CPU core 41.

[0149] According to the tampering check in Fig. 14, it is possible to check whether the read data has been tampered with by a fault injection attack on the memory 32 or the bus. Furthermore, in the tampering check in Fig. 14, the mask used for descrambling is generated using fixed value generation data associated with the read / write address of the read data, so that for each read / write address, it is possible to indirectly check that the intended command is executed by detecting no tampering of the read data read from that read / write address.

[0150] FIG. 15 is a diagram illustrating a second example of checking whether read data has been tampered with based on whether the read data matches an expected data value.

[0151] 15, the command as plaintext data is scrambled using a tag as processing data output from the processing data generator 52 to the scramble processor 53. For example, the command as plaintext data is scrambled by adding (concatenating) a tag to (the beginning or end of) the command as plaintext data. For example, the scrambled data obtained as a result of scrambling is 32-bit data in which an 8-bit tag is added to the beginning of the 24-bit command as plaintext data.

[0152] The tag is generated as processing data by using the read / write address of the scrambled data of the instruction as plaintext data in the processing data generation unit 52. For example, the tag is generated by performing Sbox permutation on the read / write address of the scrambled data of the instruction as plaintext data, and then performing a matrix operation using the result of the Sbox permutation and a matrix.

[0153] In FIG. 15, the scrambled data described above, that is, data in which a tag is added to an instruction as plaintext data, is written to the memory 32.

[0154] The tampering check is performed by comparing the leading 8-bit tag portion of the scrambled data, which is part of the scrambled data as read data read from the memory 32, with the expected data value. That is, the tampering check is performed to determine whether the tag portion of the scrambled data as read data read from the memory 32 matches the expected data value. The expected data value here is a tag generated as processing data by the processing data generation unit 52 using the read / write address of the read data. The tag as processing data is output from the processing data generation unit 52 to the check unit 54 and is used as the expected data value for the tampering check.

[0155] FIG. 16 is a diagram further illustrating a second example of checking for tampering of read data based on whether the read data matches an expected data value.

[0156] In the tamper check of FIG. 16, read data is read from the memory 32, and the tamper check of the read data is performed by checking whether the tag portion of the scrambled data as the read data matches the tag as the expected data value.

[0157] If the tag portion of the scrambled data as read data does not match the tag as the expected data value, it is determined that tampering has been detected, and the tamper-proof processor 42 outputs an error signal. On the other hand, if the tag portion of the scrambled data as read data matches the tag as the expected data value, it is determined that tampering has not been detected, and the tamper-proof processor 42 descrambles the scrambled data as read data by deleting the tag portion of the scrambled data. The instruction as plaintext data obtained as a result of the descrambling is output from the tamper-proof processor 42 to the CPU core 41, and is executed by the CPU core 41.

[0158] According to the tampering check of FIG. 16, it is possible to check whether read data has been tampered with by a fault injection attack on the memory 32 or the bus.

[0159] Furthermore, in the tampering check of FIG. 16, it is possible to confirm whether the read data is the data read from the intended address. That is, the scrambled data as the read data is the data obtained by adding a tag as the processing data generated using the read / write address of the read data to the command as the plaintext data. When a fault injection attack is performed on the address bus and the intended address, that is, the address output by the CPU core 41, is tampered with to an unintended address, the tag portion of the read data read from the unintended address does not match the tag generated using the intended address. Therefore, tampering is detected in the tampering check of FIG. 16.

[0160] According to the tampering check of FIG. 16, even if the read data of an unintended address is the data obtained by scrambling the same command as the read data of the intended address, when the intended address is tampered with to an unintended address and the read data is read from the unintended address, tampering can be detected. On the other hand, for example, in the method using ECC, when the command of an unintended address is the same command as the command of the intended address, when the intended address is tampered with to an unintended address and the command is read from the unintended address, tampering cannot be detected. As described above, the tampering check of FIG. 16 is superior to the method using ECC in that tampering can be detected when the read data of an unintended address is the data obtained by scrambling the same command as the read data of the intended address and the read data is read from the unintended address.

[0161] Also, according to the tampering check of FIG. 16, the integrity check of the memory 32 can be performed.

[0162] That is, when writing write data, a tag generated using the read / write address of the write data is added to the write data, and the write data as plain text data is scrambled to produce scrambled data, which is then written to the memory 32. Thereafter, the tampering check of Fig. 16 is performed on the scrambled data written to the memory 32, thereby making it possible to perform an integrity check on the scrambled data written to the memory 32. The integrity check using the tampering check of Fig. 16 is advantageous over methods that use encryption algorithms such as AES in that it does not incur latency.

[0163] As described above, the tampering prevention processing unit 42 performs a tampering check based on the scrambled data read from the memory 32, where the scrambled data obtained by scrambling plain text data using processing data generated using the address is stored at the address, and descrambles the scrambled data for which no tampering was detected by the tampering check. This makes it possible to increase resistance to external attacks at low cost, that is, by suppressing increases in circuit area and overhead, for example.

[0164] That is, the anti-tamper processing unit 42 can deal with fault injection attacks on buses and memories without duplicating the buses, memories, etc., and the impact of increased circuit area and power consumption is small. Furthermore, the anti-tamper processing unit 42 can be configured with a combinational circuit without using a sequential circuit (flip-flop). By configuring the anti-tamper processing unit 42 with a combinational circuit and performing scrambling and descrambling using, for example, exclusive OR, the processing of the anti-tamper processing unit 42 can be performed without additional latency. Furthermore, the processing of the anti-tamper processing unit 42 does not cause overhead for the CPU core 41 and does not affect (have no impact on) the performance of the CPU core 41.

[0165] <Second embodiment of a microcomputer to which the present technology is applied>

[0166] FIG. 17 is a block diagram showing a configuration example of a second embodiment of a microcomputer to which the present technology is applied.

[0167] In the figure, parts corresponding to those in FIG. 2 are given the same reference numerals, and the description thereof will be omitted below as appropriate.

[0168] 17, a microcomputer 130 includes a memory 32, a peripheral device 33, and a CPU 131. The memory 32, the peripheral device 33, and the CPU 131 are connected to a bus.

[0169] 2 in that it includes a memory 32 and a peripheral device 33. However, the microcomputer 130 differs from the microcomputer 30 in that it includes a CPU 131 instead of the CPU 31.

[0170] The CPU 131 has a dual lockstep configuration. A processor with a dual lockstep configuration has two processor cores, called a primary and a secondary, and synchronizes the clocks of the two processor cores to have each perform the same processing. The processor then compares the processing results of the two processor cores, and if the processing results are the same, it treats the processing results as valid processing results. If the processing results are different, it determines that an error has occurred and takes some kind of recovery measure.

[0171] The CPU 131 has two processor cores, ie, CPU cores 141P and 141S. The CPU 131 also has delay units 146P and 146S, and a check unit 147.

[0172] In the CPU 131, the CPU core 141P as a primary and the CPU core 141S as a secondary perform the same processing (execution of the same command) with a specific number of cycles, for example, two cycles, shifted from each other.

[0173] The CPU core 141P has a tamper-proof processing unit 142P similar to the tamper-proof processing unit 42 (FIG. 3). The CPU core 141S also has a tamper-proof processing unit 142S similar to the tamper-proof processing unit 42.

[0174] The tampering prevention processors 142P and 142S perform the same processing as the tampering prevention processor 42. That is, the tampering prevention processors 142P and 142S generate the same processing data using the same read / write addresses and perform the same scrambling processing using the same processing data. Furthermore, the tampering prevention processors 142P and 142S perform the same tampering check based on the scrambled data as read data read from the memory 32.

[0175] The delay unit 146P delays the processing result (the execution result of the instruction) of the CPU core 141P by a predetermined number of cycles corresponding to a specific number of cycles, for example, one cycle, and outputs the result to the check unit 147. The delay unit 146S, like the delay unit 146P, delays the data input to the CPU core 141S by a predetermined number of cycles and outputs the data to the CPU core 141S.

[0176] The check unit 147 compares the processing result of the CPU core 141P received from the delay unit 146P with the processing result of the same processing of the CPU core 141S received from the CPU core 141S, and outputs an error signal if they do not match.

[0177] According to the CPU 131, similarly to the CPU 31, the resistance to external attacks can be improved by the tamper check performed by the tampering processing units 142P and 142S.

[0178] Furthermore, in the CPU 131, for example, if a fault injection attack is made inside the CPU cores 141P and / or 141S, the processing results of the CPU cores 141P and 141S will no longer match. In this case, an error signal is output from the check unit 147. Therefore, by taking appropriate recovery measures when an error signal is output, it is possible to prevent malfunctions such as disabling of security functions when an attack is made inside the CPU cores 141P and / or 141S.

[0179] As described above, the CPU 131 with a dual lockstep configuration can also deal with attacks on the inside of the CPU cores 141P and / or 141S, and can further increase resistance to external attacks.

[0180] <Third embodiment of a microcomputer to which the present technology is applied>

[0181] FIG. 18 is a block diagram showing a configuration example of a third embodiment of a microcomputer to which the present technology is applied.

[0182] In the figure, parts corresponding to those in FIG. 2 are given the same reference numerals, and the description thereof will be omitted below as appropriate.

[0183] 18, the microcomputer 230 has a memory 32, a peripheral device 33, a tamper-proof processing unit 42, and a CPU 231. The memory 32, the peripheral device 33, and the tamper-proof processing unit 42 are connected to a bus, and the CPU 231 is connected to the tamper-proof processing unit 42.

[0184] 2 in that it includes a memory 32 and a peripheral device 33. However, the microcomputer 230 differs from the microcomputer 30 in that it includes a CPU 231 instead of the CPU 31.

[0185] The CPU 231 is configured in the same manner as the CPU 31 (FIG. 2). However, although the CPU 31 incorporates the tampering prevention processing unit 42, the CPU 231 does not incorporate a block corresponding to the tampering prevention processing unit 42. Therefore, the CPU 231 differs from the CPU 31, which incorporates the tampering prevention processing unit 42, in that it does not incorporate a block corresponding to the tampering prevention processing unit 42.

[0186] In the microcomputer 230 , the CPU 231 does not incorporate a block corresponding to the tamper-proof processing unit 42 , so the tamper-proof processing unit 42 is provided externally to the CPU 231 .

[0187] The microcomputer 230 performs the same processing as the microcomputer 30 except that the anti-tampering processing unit 42 is external to the CPU 231, and therefore can achieve the same effects as the microcomputer 30.

[0188] It should be noted that the embodiments of the present technology are not limited to the above-described embodiments, and various modifications are possible within the scope of the present technology.

[0189] For example, the present technology can be configured as a cloud computing system in which a single function is shared and processed collaboratively by a plurality of devices via a network.

[0190] Furthermore, each step described in the above flowchart can be executed by one device, or can be shared and executed by a plurality of devices.

[0191] Furthermore, when one step includes multiple processes, the multiple processes included in that one step can be executed by one device or can be shared and executed by multiple devices.

[0192] Furthermore, the effects described in this specification are merely examples and are not limiting, and other effects may also be present.

[0193] The present technology can have the following configurations.

[0194] <1> A processor comprising: a check unit that performs a tampering check based on scrambled data read from a memory at an address, the scrambled data being obtained by scrambling predetermined data using processing data generated using the address; a descramble unit that descrambles the scrambled data for which no tampering is detected by the tampering check; and an execution unit that executes processing corresponding to the predetermined data obtained by the descrambling. <2> The processor described in <1>, wherein the scrambled data is data obtained by scrambling the predetermined data using a mask as the processing data generated using the address of the scrambled data. <3> The processor described in <2>, wherein the check unit performs the tampering check by checking whether the scrambled data matches other scrambled data stored at a different address from the address of the scrambled data. <4> The processor described in <3>, wherein the check unit performs the tampering check by checking whether the scrambled data matches the other scrambled data read immediately before the scrambled data. <5> The processor according to any one of <2> to <4>, wherein the descrambling unit descrambles the scrambled data using a mask as the processing data generated using an address of the scrambled data. <6> The processor according to <1>, wherein the checking unit performs the tampering check by determining whether the scrambled data matches an expected data value that is a data value expected for the scrambled data. <7> The processor according to <6>, wherein the fixed value generation data is set so that the scrambled data obtained by scrambling the specified data before scrambling it into the scrambled data using a mask as the processing data generated using the address of the scrambled data and fixed value generation data associated with the address becomes a predetermined fixed value, and the scrambled data is the fixed value.<8> The processor according to <7>, wherein the check unit performs the tampering check by determining whether the scrambled data matches the fixed value as the expected data value, using the fixed value as the expected data value. <9> The processor according to <7> or <8>, wherein the descrambling unit descrambles the scrambled data by using a mask as the processing data generated using the address of the scrambled data and the fixed value generation data associated with the address. <10> The processor according to <6>, wherein the scrambled data is data in which a tag as the processing data generated using the address of the scrambled data is added to the predetermined data. <11> The processor according to <10>, wherein the check unit performs the tampering check by determining whether the tag included in the scrambled data matches the tag as the expected data value, generated using the address of the scrambled data. <12> The processor according to <10> or <11>, wherein the descrambling unit descrambles the scrambled data by deleting the tag from the scrambled data. <13> The processor according to <1>, further comprising a processing data generation unit that generates the processing data. <14> The processor according to <13>, further comprising a scrambling unit that scrambles the write data using the processing data generated by the processing data generation unit using an address of the write data to be written to the memory, and configured to write the scrambled data obtained by the scrambling to the address of the write data. <15> The processor according to any of <1> to <14>, wherein the checking unit performs the tampering check by determining whether a descrambled result of the scrambled data is an undefined instruction. <16> The processor according to any of <1> to <15>, wherein the checking unit outputs an error signal when tampering is detected by the tampering check. <17> The processor according to any of <1> to <16>, wherein the predetermined data is an instruction constituting a program.<18> The processor according to any one of <1> to <17>, which has a dual lockstep configuration. <19> A processing method including: a processor performing a tampering check based on scrambled data obtained by scrambling predetermined data using processing data generated using an address, the scrambled data being read from a memory where the address has been stored, descrambling the scrambled data for which no tampering has been detected by the tampering check, and executing processing corresponding to the predetermined data obtained by the descrambling. <20> A processing device including: a check unit that performs a tampering check based on the scrambled data obtained by scrambling predetermined data using processing data generated using an address, the scrambled data being read from a memory where the address has been stored, and a descrambling unit that descrambles the scrambled data for which no tampering has been detected by the tampering check.

[0195] 10 Image sensor, 11 Die, 12 Pixel area, 13 Control circuit, 14 Logic circuit, 20 Image sensor, 21 Sensor die, 24 Logic die, 30 Microcomputer, 31 CPU, 32 Memory, 33 Peripheral device, 41 CPU core, 42 Tamper-proof processing unit, 51 Address decoder, 52 Processing data generation unit, 53 Scrambling unit, 54 Check unit, 130 Microcomputer, 131 CPU, 141P, 141S CPU core, 142P, 142S Tamper-proof processing unit, 146P, 146S Delay unit, 147 Check unit, 230 Microcomputer, 231 CPU

Claims

1. A processor comprising: a check unit that performs a tamper check based on scrambled data obtained by scrambling specified data using processing data generated using an address, the scrambled data being read from a memory stored at the address; a descramble unit that descrambles the scrambled data for which no tampering has been detected by the tamper check; and an execution unit that executes processing corresponding to the specified data obtained by the descrambling.

2. The processor according to claim 1, wherein the scrambled data is data obtained by scrambling the predetermined data using a mask as the processing data that is generated using an address of the scrambled data.

3. The processor according to claim 2, wherein the check unit performs the tampering check by determining whether the scrambled data matches other scrambled data stored at an address different from the address of the scrambled data.

4. The processor according to claim 3, wherein the check unit performs the tampering check by determining whether the scrambled data matches the other scrambled data read immediately before the scrambled data.

5. The processor according to claim 2, wherein the descrambling unit descrambles the scrambled data using a mask as the processing data that is generated using an address of the scrambled data.

6. The processor according to claim 1, wherein the checking unit performs the tampering check by determining whether the scrambled data matches an expected data value that is a data value expected for the scrambled data.

7. The processor of claim 6, wherein the fixed value generation data is set so that the scrambled data obtained by scrambling the specified data before scrambling it into the scrambled data using a mask as the processing data generated using the address of the scrambled data and the fixed value generation data associated with that address becomes a predetermined fixed value, and the scrambled data is the fixed value.

8. The processor according to claim 7, wherein the checking unit performs the tampering check by determining whether the scrambled data matches the fixed value as the expected data value.

9. The processor according to claim 7, wherein the descrambling unit descrambles the scrambled data using a mask as the processing data generated using the address of the scrambled data and the fixed value generation data associated with that address.

10. The processor according to claim 6, wherein the scrambled data is data obtained by adding a tag as the processing data generated using the address of the scrambled data to the predetermined data.

11. The processor according to claim 10, wherein the checking unit performs the tampering check by determining whether the tag included in the scrambled data matches the tag as the expected data value generated using the address of the scrambled data, using the tag as the expected data value.

12. The processor according to claim 10, wherein the descrambling unit descrambles the scrambled data by removing the tag from the scrambled data.

13. The processor according to claim 1, further comprising a processing data generation unit that generates the processing data.

14. The processor according to claim 13, further comprising a scrambling unit that scrambles the write data using the processing data generated by the processing data generating unit using the address of the write data to be written to the memory, and is configured to write the scrambled data obtained by the scrambling to the address of the write data.

15. The processor according to claim 1, wherein the check unit performs the tampering check by determining whether the descrambled result of the scrambled data is an undefined instruction.

16. The processor according to claim 1, wherein the check unit outputs an error signal when tampering is detected by the tampering check.

17. The processor according to claim 1, wherein the predetermined data is instructions that constitute a program.

18. The processor of claim 1, in a dual lockstep configuration.

19. A processing method comprising: a processor performing a tampering check based on scrambled data obtained by scrambling specified data using processing data generated using an address, the scrambled data being read from a memory stored at the address; descrambling the scrambled data for which no tampering was detected by the tampering check; and executing processing corresponding to the specified data obtained by the descrambling.

20. A processing device comprising: a check unit that performs a tamper check based on scrambled data obtained by scrambling specified data using processing data generated using an address, the scrambled data being read from a memory stored at the address; and a descramble unit that descrambles the scrambled data for which no tampering has been detected by the tamper check.

Images