BRIEF DESCRIPTIONS OF THE DRAWINGS
FIG. 1 is a flow chart showing an example of a method for detecting a control flow error according to the present invention;
FIG. 2 is a flow chart for explaining a division of code blocks in the method for detecting a control flow error;
FIG. 3 is a flow chart showing another example of a method for detecting a control flow error according to the present invention;
FIG. 4 is a flow chart showing another example of a method for detecting a control flow error according to the present invention;
FIG. 5 is a flow chart showing another example of a method for detecting a control flow error according to the present invention
FIG. 6 is a flow chart showing another example of a method for detecting a control flow error according to the present invention;
FIG. 7 is a block diagram showing a configuration example of a microcomputer as an example of a computer according to the present invention;
FIG. 8 is a block diagram showing another configuration example of a microcomputer as an example of a computer according to the present invention;
FIG. 9 is a block diagram showing another configuration example of a microcomputer as an example of a computer according to the present invention;
FIG. 10 is an explanatory diagram of a status of use of a stack at occurrence of an interrupt in the microcomputer;
FIG. 11 is another explanatory diagram of a status of use of the stack at occurrence of an interrupt in the microcomputer;
FIG. 12 is a block diagram showing a configuration example of a computer system on which a compiler is operated; and
FIG. 13 is a flow chart showing a process by the compiler.
DESCRIPTIONS OF THE PREFERRED EMBODIMENTS
In FIG. 7, a microcomputer as an example of a computer according to the present invention is shown. This microcomputer 7000 is to be used for carrying out a method for detecting control flow error according to the present invention, and though it is not limited specifically, it is formed on a semiconductor substrate such as a single crystal silicon substrate or the like, by known manufacturing technologies of semiconductor integrated circuit.
The microcomputer 7000 shown in FIG. 7 includes: a computer (CPU) 7001 such as a central processing unit or the like that interprets and executes an instruction fetched via a bus 7006; a memory 7002 that can store the stream of instructions to be executed by the CPU 7001; a memory for code block ID 7004 that can store code block IDs; a comparator 7003 that can compare the output data of the memory for code block ID 7004 and the data fetched via the bus 7006; and a computing unit 7005 that can perform a operation processing of the output data of the memory for code block ID 7004 and the data fetched via the data bus 7006. The output data of the computing unit 7005 is transmitted to the memory for code block ID 7004, and, the output data of the comparator 7003 is supplied to the CPU 7001 via the bus 7006. The comparison result in the comparator 7003 is taken as a control flow error detection result, and in the CPU 7001, on the basis of the control flow error detection result, necessary measures such as suspending of instruction interpretation processing, interrupt and the like are made.
Next, the control flow error detection in the microcomputer 7000 of the above configuration is explained in details.
In FIG. 2, the basic configuration example of a program to be executed in the microcomputer 7000 of the above configuration.
As shown in FIG. 2, the program to be executed in the microcomputer 7000 of the above configuration divided beforehand under specified conditions has a plurality of code blocks 1 to 4. The above code blocks 1 to 4 are units into which a program is divided with at least at a portion where the control flow branches and a portion where the control flows join together taken as borders. In the example shown in FIG. 2, at least the portion where the control flow branches under a condition 1 (1002), and the portion where the process 2 (1003) and the process 3 (1004) join together are borders of the code blocks. Further, an entrance of a subroutine is a point where plural portions call and the control flows join together. Accordingly, the entrance of the subroutine is the border of code blocks. In the same manner, when the process of subroutine is completed, and returns to the program at the calling side, the entrance is the point to return to different calling sources, therefore it is also a border of code block.
In FIG. 1, the flow of the method of detecting control flow error is shown. As explained already with reference to FIG. 2, the program is divided into a plurality of code blocks, and code block IDs are allotted to respective code blocks. Further, “cbid” in FIG. 1 indicates a variable for accessing the memory for code block ID 7004, and “BLOCK1, BLOCK2, BLOCK3” are each an expected value of the code block ID allotted beforehand to the code block, and also a constant. “DIFFi_j” is the differential value of code block in the case of a transition from code block j to code block i, and the relation with the expected value of the code block ID is expressed by the following equation.
DIFFi—j=BLOCKi−BLOCKj
In other words, a new code block ID can be obtained by adding the differential value in the computing unit 7005. Herein, the differential value is an example of the code block operation value in the present invention. Further, in the present example, when the program shown in FIG. 1 is executed, cbid is initialized by the expected value BLOCK1 of the code block ID corresponding to the code block 1 (1011). The execution of the program is started from START (1001), and first it is judged whether the value stored in the memory for code block ID 7004 is identical to the expected value or not (2001). This judgment is made by the comparator 7003. Then, in the case when the value is different from the expected value in the judgment at the step 2001 (YES), it is judged that calling is not made in the regular procedure, and it is judged as an error (2002). In this case, in the CPU 7001, necessary measures such as suspending of the instruction interpretation processing, and the like are made. Further, in the case where it is judged that the value is not different from the expected value (NO) in the judgment at the step 2001, it is judged whether the condition 1 is established or not (1002). This judgment may be also made by the comparator 7003. In this judgment, in the case when it is judged that the condition 1 is established (YES), the procedure is transited to the code block 3 (1013). Further, in the judgment at the step 1002, in the case when it is judged that the condition 1 is not established (NO), the procedure is transited to the code block 2 (1012). When the transition to the code block 2 is made, first in the computing unit 7005, the differential value DIFF2_1 is added to cbid, and the value stored in the memory for code block ID 7004 is made so as to be equal to the expected value of the code block 2 (2003). Subsequently, the process 2 (1003) as the primary process is carried out in the CPU 7001, thereafter, it is checked whether the value stored in the memory for code block ID 7004 is identical to the expected value BLOCK2 or not (2005). This judgment is made by the comparator 7003. In the comparison at the step 2005, in the case where the value stored in the memory for code block ID 7004 is not identical to the expected value BLOCK3 (YES), it is judged as an error, and in the CPU 7001, necessary measures such as suspending of the instruction interpretation processing, interrupt and the like are made. In the case of a transition from other place than the code block 1 to the code block 2 is made for some reason, the value stored in the memory for code block ID 7004 is supposed to be other than BLOCK1, and in this case, since the value of the code block ID calculated in the updating process (2003) is not identical to BLOCK2, it is judged as an error. Further, in the case where the value stored in the memory for code block ID 7004 is identical to BLOCK1 albeit transition is made from other place than the code block 1 to the code block 2, by the same check carried out in the code block before the transition, it is judged as an error.
Before transiting to the code block 4, a process (2009) to add DIFF4_2 to cbid and update it so that the value to be stored in cbid becomes identical to BLOCK4 is carried out, and the procedure is transited to the code block 4 (1014).
In the same manner, also in the code block 3 (1013), updating (2004) of the value of the memory for code block ID 7004, a primary process 3 (1004), checking (2006) of the value stored in the memory for code block ID are carried out. In the case where integrity is lost, it is judged as an error (2008), and in the CPU 7001, necessary measures such as suspending of the instruction interpretation processing, interrupt and the like are made.
Further, before transition to the code block 4 (1014), a process (2010) to add DIFF4_3 to cbid so that the value of cbid becomes identical to BLOCK4 is carried out, and the procedure is transited to the code block 4 (1014). Just after the transaction to the code block 4 (1014), checking (2011) of integrity of the value of cbid is carried out by the comparator 7003, and in the case when the value of cbid is different from BLOCK4, it is judged as an error (2012).
The updating of cbid in the memory for code block ID 7004 is carried out by use of the differential value in this manner, therefore, even in the case where execution control flows join together, it is possible to easily confirm integrity by once of inspection.
Further, in the transition from the code block 2 (1012) to the code block 4 (1014), the checking (2005) of integrity of cbid in the code block 2 (1012) can be passed only when cbid is BLOCK2, and further the updating process of cbid is adding (2009) of the differential value, accordingly, what can pass the integrity check (2011) of cbid of the code block 4 (1014) is only the case where cbid changes from BLOCK2 to BLOCK4. In the same manner, the transition from the code block 3 (1013) to the code block 4 (1014) becomes correct only in the case where cbid can pass the integrity check (2011) of cbid of the code block 4 (1014), that is, only the case where cbid changes from BLOCK3 to BLOCK4. Accordingly, also in the case where control flows joint together, in the code block at the interflow destination, it is not necessary to carry out the individual check per interflow source.
According to the above example, the following operation effects can be obtained.
(1) The updating of cbid in the memory for code block ID 7004 is carried out by use of the differential value in this manner, therefore, even in the case where execution control flows join together, it is possible to easily confirm integrity by once of inspection.
(2) In concrete, with regard to a program having complicated control flows including branches and interflows of control flows, the code block ID value of the code block now under execution is stored in the memory for code block ID 7004, and at every transition of execution control among code blocks, by use of the differential value between the code block ID at the transition destination and the code block ID at the transition source, the ID value stored in the memory for code block ID 7004 is updated. Therefore, in the case when a transition is not carried out in the correct sequence, the value stored in the memory for code block ID 7004 is not identical to the expected value of the code block ID of the code block that is executed actually, and accordingly, when the code block ID stored in the memory for code block ID 7004 is inspected, an error is detected by the comparator 7003. At the moment of updating of the code block ID value stored in the memory for code block ID 7004, the code block ID of the code block at the transition destination is not substituted, but updating is made by use of the differential value between the code block at the transition source and that at the transition destination, therefore, if either the differential value or the ID value stored in the memory for code block ID 7004, or both thereof are erroneous, it does not become identical with the code block ID of the code block at the transition destination. Once the value of the code block ID stored into the memory for code block ID becomes a wrong value, it does not become a correct value in later updating process of the code block ID either, therefore, even if in the case when the process to check the value of the code block ID overlooks an error for some reason, for example due to external disturbance, the error is detected in the inspection of the code block ID to be carried out later. And in the case where the error occurs, in the CPU 7001, necessary measures against attacks such as suspending of the instruction interpretation processing, interrupt and the like are made.
(3) By the operation effect of the above (2), it is possible to provide the highly reliable microcomputer 7000.
In FIG. 3, another flow of the method for detecting control flow error is shown.
In the case where a subroutine is included as shown in FIG. 3, the control flow error detection is carried out as described below.
In a code block 1 (3011), it is judged whether the condition 1 is established or not (3002), and in a code block 2 (3012), a process 2 (3003) is carried out, and in a code block 3 (3013), a process 3 (3004) is carried out, and in a code block 4 (3014), it is judged whether the condition 4 is established or not (3005). In a code block 5 (3015), a process 5 (3006) is carried out.
In the subroutine, there exist return instructions (3007, 3008, 3009) to surely return the control to the call source, and the code block 6 (3016) of the block where these plural return instructions exist is handled as a same block. Therefore, as shown in FIG. 4, when only information of two code blocks of the head code block (4011) and the block (4013) where the return instruction exists is already known from the outside, regardless of a transition among code blocks 4012 existing or not, it is possible to perform the updating of the code block ID and the error check at the moment to call the subroutine.
In FIG. 5, the division of the subroutine to the code block viewed from the outside and an allotment example of the code block ID are shown.
To the head block (5011) of the subroutine, BLOCK2 is allotted as the code block, and the code block ID of the code block 3 (5012) including all the return instructions is BLOCK3.
In FIG. 6, a process flow of the program at the calling side to call the subroutine is shown.
Now suppose that BLOCK1 is allotted to the code block ID of the code block 1 (6011) just before calling the subroutine shown in FIG. 5, and BLOCK4 is allotted to the code block 4 (6014) after calling the subroutine as the code block ID. The code blocks 2, 3 are code blocks that are determined depending on the subroutine. Herein, cbid indicates a variable for accessing the memory for code block ID, “DIFFi_j” is the differential value of code block in the case of a transition from code block j to code block i, and the relation with the expected value of the code block ID is expressed by the following equation.
DIFFi—j=BLOCKi−BLOCKj
While the code block 1 (6011) in FIG. 6 is executed correctly, the value of cbid becomes BLOCK1. Before calling the subroutine, in the computing unit 7000, a process (6001) to add DIFF2_1 to cbid is carried out so that the value of cbid becomes identical to the code block ID of the code block at the head of the subroutine, then the subroutine is called out (6002). In the case when the subroutine is executed in the correct execution route, the value of cbid becomes identical to BLOCK3 that is the code block ID of the code block (5012) where the return instruction from the subroutine exists, and accordingly, in the comparator 7003, it is checked whether the value of cbid is identical to BLOCK3 (6003), and if it is not identical, it is judged as an error (6004).
In FIG. 8, another configuration example of the microcomputer 7000 as an example of a computer according to the present invention is shown.
The microcomputer 7000 shown in FIG. 8 is greatly different from one shown in FIG. 7 in that a computing unit 8005 for updating the value of the memory for code block ID 7004 has a function to output the comparison result as a flag 8010 so as to be used as comparison means for checking the integrity between the value stored in the memory for code block ID 7004, and the expected value of the code block ID now under execution.
A sequence of instructions 7007 to become the detection objective of the control flow error is stored in a memory 7002, and the sequence of instructions is divided into, for example, a plurality of code blocks as shown in FIG. 1, and includes sequences of instructions for value update (2003, 2009, 2010) and for carrying out inspection (2001, 2005, 2006, 2011) of the memory for code block ID 7004. The sequence of instructions 7007 stored in the memory 7002 goes through a bus 7006, and is sent to a CPU 7001, and initializes the value of the memory for code block ID 7004 via the bus 7006. When the value of the memory for code block ID 7004 is updated along with the transition between code blocks, the differential value is transmitted from the CPU 7001 to the computing unit 8005 via the bus 7006, and the computing unit 8005 computes a new code block ID by use of the transmitted differential value and the value stored in the memory for code block ID 7004, and stores the computational result into the memory for code block ID 7004.
The computing unit 8005, in addition to the updating of the value stored in the memory for code block ID 7004, compares the value of the memory for code block ID 7004 and the expected value of the code block ID sent via the bus 7006 from the CPU 7001, and outputs the result of whether they are identical or not as a flag 8010. The CPU 7001, in accordance with the output result of the flag 8010 by the computing unit 8005, continues the execution interpretation process in the case where the expected value and the actual ID value are identical, and takes necessary measures such as suspending of the instruction interpretation processing, interrupt and the like in the case where the expected value and the value stored in the memory for code block ID 7004 are different.
In FIG. 9, still another configuration example of the microcomputer 7000 as an example of a computer according to the present invention is shown.
A microcomputer 7000 shown in FIG. 9 is greatly different from one shown in FIG. 8 in that a memory for code block ID 9004 is packaged in a CPU 7001, and a computing unit 9005 for updating the value of the memory for code block ID 9004 is packed in the CPU 7001. In this case, the memory for code block ID 9004 may be constructed by a general-purpose register and the like. Further, the computing unit 9005 may be designed also to be used as a general-purpose computing unit used in other normal computation processes than the computation of the value of code block ID. Further, this computing unit 9005 has a function to output the comparison result as a flag 9010 so as to be used for checking the integrity between the value stored in the memory for code block ID 9004 and the expected value of the code block ID now under execution.
A sequence of instructions 9007 to become the detection objective of the control flow error is stored in a memory 7002, and the sequence of instructions is divided into, for example, a plurality of code blocks as shown in FIG. 1, and includes sequences of instructions for value update (2003, 2009, 2010) and for carrying out an inspection (2001, 2005, 2006, 2011) of the memory for code block ID 9004. The sequence of instructions stored in the memory 7002 goes through a bus 7006, and is sent to a CPU 7001, and initializes the value of the memory for code block ID 9004 via the bus 7006. When the value of the memory for code block ID is updated along the transition between code blocks, the differential value stored expressively in the sequence of instructions 9007 in the memory 7002 is transmitted to the computing unit 9005 via an internal bus 9008, and the computing unit 9005 computes a new code block ID by use of the transmitted differential value and the value stored in the memory for code block ID 9004, and stores the code block ID again in the memory for code block ID 9004.
The computing unit 9005, in addition to the updating of the value stored in the memory for code block ID 9004, compares the value of the memory for code block ID 9004 and the expected value of the code block ID expressively stored in the sequence of instructions 9007 in the memory 7002, and outputs the result of whether they are identical or not as a flag 9010. The CPU 7001, in accordance with the output result of the flag 9010 by the computing unit 9005, continues the execution interpretation process in the case where the expected value and the actual ID value are identical, and takes necessary measures such as suspending of the instruction interpretation processing, interrupt and the like in the case where the expected value and the value stored in the actual memory for code block ID are different.
In FIG. 10 and FIG. 11, condition of use of stack at occurrence of an interrupt in the above microcomputer 7000 is shown.
In FIG. 10, the address of the head of a used area 11004 is shown by a stack pointer 11005. The address lower than the address which is indicated by the stack pointer 11005 is a free area 11001. At occurrence of an interrupt, the value of program counter and the code block ID value stored in the memory for code block ID are stored in the address indicated by the stack pointer 11005. The value of the stack pointer 11005 is changed for only the area used for storing the program counter value and the code block value. The condition where the program counter value and the code block value are stored in the memory is shown in FIG. 11. In the case of recovery from the interrupt process, the code block ID 11002 and the program counter 11003 are fetched from the address that is indicated by the stack pointer 11005, and the code block ID is stored in the memory for code block ID, and the program counter is stored in the program counter, and the process is continued from the next instruction at the moment of occurrence of the interrupt.
Next, a compiler for generating object codes to be executed in the above microcomputer 7000 is explained.
In FIG. 12, a computer system 1300 on which the compiler is operated is shown.
The computer system shown in FIG. 12 includes a hard disk 13010, a computer 13020, and a reader writer 13030. In the hard disk 13010, a compiler 13011 and a source program 13012 are stored. The compiler 13011 is read into the computer 13020 and executed, the source program 13012 is compiled. By this compiling, an object code 13013 (executable program) having tamper resistance is generated from the source program, and stored in the hard disk 13010. And this object code 13013 is written in the memory 7002 (refer to FIG. 7 to FIG. 9) in the microcomputer 7000, as a program to be executed by the microcomputer 7000 built in, for example, a card 13040. The memory 7002 is not limited specifically, but it is a flash memory, where onboard writing by the reader writer 13030 is available.
In FIG. 13, a process flow of the compiler 13011 is shown.
A source program (10001) is syntax analyzed by a normal syntactic analysis (10002), and divided into code blocks by an extract code block (10003), with branches, interflows of control flow as borders at least. When code blocks are extracted, in addition to branches, interflows of control flow, code blocks may be divided into further smaller units. To the divided code blocks, by an assign code block ID (10004), allotment of expected value of code block ID is carried out respectively. It is preferable that the expected value of code block ID becomes a unique value in difference code block, however, there may be duplication in expected values of code block ID. For example, the code block ID may be allotted by a method that is expected to have a low possibility of duplication, by use of, for example, ordinary hash function or the like. Finally, by an insert processes for updating and checking code block (10005), adding of codes so as to make the updating process of code block ID and the integrity check process appear in the executable program. At this moment, the updating process of code block ID must be added to all the transitions between different code blocks, but the integrity check process of code block ID may not appear in all the code blocks. By a process to generate executable object code (10006) by ordinary method, an object code (10007) having means of fault detection by code block ID is generated.
In the foregoing, the invention made by the inventors of the present invention has been concretely described. However, it is needless to say that the present invention is not limited to the description and various modifications and alterations can be made within the scope of the present invention.
For example, the updating process of block ID in FIG. 1 may be carried out by modular multiplication in modulo a prime number P. In the case where the value of code block ID transits from block A to block B, the value of C shown in the following equation is modular multiplied, and thereby the code block ID can be updated from A to B.
B=C·A mod P
In this case, if it stands that 0<A<P and 0<B<P, the value of C always exists. The value of C is also 0<C<P, and can be calculated by the following equation.
C=B·A
−1 mod P
In this case, A−1 mod P is an inverse element of A modulo P, and if P is a prime number and it stands that 0<A<P, the inverse element always exists. Since B is 0<B<P, the values of B and A−1 exist as 0<C<P. Further, A−1 mod P can be calculated efficiently by use of Extended Euclidean algorithm.
A calculation example is shown below.
For example, now suppose A=12345, B=7987, P=65537, then the calculation is as shown below.
A
−1 mod P=12345−1 mod 65537=31651
Accordingly, the value of C becomes as the following.
C=B·A
−1 mod P=20328
Thus, the product of modular multiplication with the prime number P as modulo is taken as the code block operation value, and the product of modular multiplication with the value stored in the memory for code block ID device and the prime number P of the differential value as modulo is calculated, and the value of code block ID is updated, and thereby the same operation effect as the above example may be obtained.
In the explanations made heretofore, the invention made by the present inventors has been explained with the case applied to a microcomputer as the field of the invention, however, the present invention is not limited to this, but the present invention may be applied widely to various computers.
Patent Application
20070255980
