Patent Application
20080215955
This application is based upon and claims the benefit of priority from the prior Japanese Patent Application No. 2007-038293 filed on Feb. 19, 2007; the entire contents of which are incorporated herein by this reference.
1. Field of the Invention
The present invention relates to a semiconductor storage device including a memory configured to store data to be protected.
2. Description of the Related Art
Following diffusion of the Internet, deals on a network from mobile terminal devices such as personal computers and cell-phones are increasing, and it is required to secure safe communication by means of cryptographic technology. In particular, attention is focused on an IC card which is more difficult to counterfeit and has higher security than a magnetic card.
As for the IC card, however, various attack techniques are announced against cryptographic implementation, and so countermeasures against the attack techniques are essential.
Failure-based analysis can be named as one of the methods of attacking the IC card. This method purposely changes a bit pattern of data inside the IC card by physical means from outside the IC card during calculation of cryptography and generates an error in a calculation result so as to analyze a cryptographic key which is confidential information.
As for an example of the attack by the failure-based analysis, the attack technique against an RSA decoding scheme using Chinese remainder theorem (hereinafter referred to as CRT) is known, which has been announced by Boneh et al. (refer to D. Boneh, R. A. DeMillo and R. J. Lipton, “On the Importance of Checking Computations” Submitted to Eurocrypt '97 for instance).
Of the attack techniques against the RSA decoding scheme using the CRT, a technique of tampering with memory contents is known. There is a method of detecting that the memory contents have been tampered with, which utilizes an error detecting code (EDC) (refer to Japanese Patent Laid-Open No. 2003-51817 for instance).
The method renders tampering with a data portion of a memory detectable by an error detection circuit.
However, the attack made by an attacker for the sake of attempting the failure-based analysis is not limited to directly tampering with the data portion of the memory. There is also a method, for instance, of attacking an address decoder, changing a memory address and causing a memory address different from a correct memory address to be accessed and thereby causing a system of a memory card IC to read out improper data which is not expected by the system.
As for the attack method of attacking the address decoder, reading out the improper data and putting the IC in a failed state, there is a problem that the attack is not detectable by the method of Japanese Patent Laid-Open No. 2003-51817.
Therefore, it is desirable that the error is detectable even when the system thus reads the unexpected improper data.
A semiconductor storage device according to an aspect of the present invention includes: a memory configured to store data at a first address and store an error detecting code corresponding to the data at a second address which is set up in a predetermined relation with the first address and different from the first address; and address storage unit configured to store information on address relation between the first address and the second address.
A semiconductor storage device according to an aspect of the present invention includes: a memory configured to store combination data having mutually different first data and second data divided at a first address and store an error detecting code corresponding to the first or second data at a second address which is set up in a predetermined relation with the first address and different from the first address; and an address storage portion configured to store information on address relation between the first address and the second address.
A semiconductor storage device according to an aspect of the present invention includes: a first memory configured to store data at a first address; a second memory configured to store an error detecting code corresponding to the data at a second address which is set up in a predetermined relation with the first address and different from the first address; and an address storage portion configured to store information on address relation between the first address and the second address.
Hereafter, embodiments of the present invention will be described with reference to the drawings.
The IC card chip 1 shown in
The coprocessor 4 has an ancillary function of the CPU 3, and performs arithmetic processing of a large calculation amount such as modular exponentiation division of RSA. The RAM 5 is used as a work area for the CPU 3 to perform processing such as readout and writing, and is also used, for instance, to hold information on a halfway result of cryptographic processing. The ROM 6 is a memory readable from the CPU 3, and has programs for operational control of the CPU 3 such as a cryptographic processing program stored therein.
The EEPROM 7 is a nonvolatile and electrically rewritable memory capable of readout and writing from the CPU 3. The EEPROM 7 has confidential data such as a secret key used when the cryptographic processing stored (held) therein is performed together with an error detecting code corresponding to the data so as to be at different memory addresses.
The following will describe the data and the error detecting code corresponding to the data by taking the case of the EEPROM 7 as a common memory. Without such limitation, however, the data and the error detecting code may also be stored in separate memories. For instance, it is also possible to prepare a first memory and a second memory which are physically separate and store the data in a memory cell of the first memory and store the corresponding error detecting code in a memory cell of the second memory.
To be able to handle the first memory and the second memory which are separate as one memory, the memory cell of the first memory and the memory cell of the second memory may be managed as memory cells of a comprehensive memory at a common memory address. In this case, the data and the corresponding error detecting code are also stored in the memory cells of different memory addresses.
The error check circuit 8 is a circuit configured to check whether or not there is an error of the data read out from the memory to be protected, such as the EEPROM 7. And the data and the error detecting code read out from the memory are captured by the error check circuit 8 first. As a result of verification (checking) whether the data matches the error detecting code corresponding to the data, the data is transmitted to the CPU 3 or the coprocessor 4 via the bus 10 if no error has occurred.
In the case where an error has occurred as a result of the verification, an error detecting signal is outputted. And in this case, the CPU 3 and the like do not allow the cryptographic processing and the like to be performed so as to secure protection of the data or confidentiality of the data.
The following will describe the case of the EEPROM 7 as the memory. However, the following may also be applied to the ROM 6 and the RAM 5.
As shown in
In this case, the data and the error detecting code corresponding to the data are stored at different memory addresses. Therefore, the CPU 3 performs a readout process to the EEPROM 7 multiple times in order to read out the data and the error detecting code corresponding to the data.
The error check circuit 8 has an error check function for checking whether or not there is an error in the data read out by verifying the data with the error detecting code corresponding to the data.
The error check circuit 8 further includes a data/error detecting code storage address control circuit 13 as an address storage unit configured to store memory address-related information as a pair of the memory address of each individual data stored in the EEPROM 7 and the memory address at which the error detecting code corresponding to the data is stored.
According to the present embodiment, the data/error detecting code storage address control circuit 13 is provided within the error check circuit 8. Without such limitation, however, the data/error detecting code storage address control circuit 13 may also be provided outside the error check circuit 8.
And in the case of storing the data and the error detecting code corresponding to the data in the EEPROM 7, they are stored at different memory addresses according to the memory address-related information stored in the data/error detecting code storage address control circuit 13 respectively.
As a matter of course, it is also possible to store the data and the corresponding error detecting code at different memory addresses and then create the information indicating the memory address relation thereof.
In the example shown in
For instance, if a memory address Addr at which data Mdataij is stored is ij (in the decimal system), a memory address Addr at which a corresponding error detecting code EDC (Mdij) is stored is ij+1.
The information on the memory addresses in the relation is stored in the data/error detecting code storage address control circuit 13. In the following, the memory address ij is indicated as Addrij, and the corresponding error detecting code of the data Mdataij is indicated as EDC (Mdij).
According to the present embodiment, the memory cell of the EEPROM 7 has the data Mdataij stored on an upper-order bit side for instance of the memory address Addrij as a set with the error detecting code EDC (Mdij−1) corresponding to data Mdataij−1 shifted by one memory address stored on a lower-order bit side.
To be more specific, the memory cell of each memory address Addrij has a data set {Mdataij, EDC (Mdij−1)} stored therein.
And in the case where a data readout instruction is given to the semiconductor storage device 11 via the CPU 3, the error check circuit 8 verifies the data and the error detecting code corresponding to the data as mentioned above. As for each of the error detecting codes, a parity symbol, a CRC symbol or the like is widely used. Without such limitation, however, an arbitrary symbol or the like capable of detecting the error of the data may be utilized.
In the case where two EEPROMs 7a and 7b which are physically different are prepared as the EEPROM 7 as the memory, the two EEPROMs are similarly applicable by reading the memory cell on the upper-order bit side as the memory cell of the EEPROM 7a for instance where the data is stored and reading the memory cell on the lower-order bit side as the memory cell of the EEPROM 7b where the error detecting code corresponding to the data is stored respectively.
Next, the operation of the IC card chip 1 on which the semiconductor storage device 11 according to the present embodiment is provided will be described.
As mentioned above, a description will be given as to the state where the EEPROM 7 of the semiconductor storage device 11 has the data and the error detecting code corresponding to the data stored and held at different memory addresses.
In this case, the information on the memory addresses in the EEPROM 7 at which the data and the error detecting code are held is included in the data/error detecting code storage address control circuit 13 in the error check circuit 8 for instance.
The entire operation will be described based on
If a data readout operation is started by a data readout instruction, the memory addresses on data readout are outputted from the CPU 3 as shown in step S1.
The memory addresses are also inputted to the data/error detecting code storage address control circuit 13 in the error check circuit 8. The data/error detecting code storage address control circuit 13 transmits a readout request signal to the CPU 3 on data readout.
As shown in step S2, the memory addresses from the CPU 3 are inputted to the address decoder 12 of the EEPROM 7. The data set is read out from the memory cell of the corresponding memory address from the EEPROM 7 via the address decoder 12.
As shown in step S3, the read data set is transmitted to the error check circuit 8, and is stored in a register or the like in the error check circuit 8.
The example of
And the memory address Addr01: [001] is outputted from the CPU 3 to the address decoder 12 of the EEPROM 7. A corresponding data set {Mdata01, EDC (Md00)} is read out from the EEPROM 7 and stored in the error check circuit 8.
If the read data set {Mdata01, EDC (Md00)} is stored in the error check circuit 8, the data/error detecting code storage address control circuit 13 in the error check circuit 8 outputs a readout end flag signal (on data readout) to the CPU 3.
As shown in
In
In the concrete example shown in
If the memory address Addr02 [010] is inputted, the CPU 3 outputs the memory address Addr02 [010] to the address decoder 12 of the EEPROM 7 (step S2 of
And as shown in
And as shown in
If the data set {Mdata02, EDC (Md01)} on error detecting code readout is stored in the register or the like of the error check circuit 8, the data/error detecting code storage address control circuit 13 transmits the readout end flag signal to the CPU 3.
Thus, in the process of step S4 following step S3 of
And the error check circuit 8 determines whether or not the verification is OK, that is, whether or not there is an error in the data according to the verification result as indicated in step S7. In the case where it is determined that there is no error in the data by the determination, the error check circuit 8 outputs the data to the bus 10 as shown in step S8.
In the case where it is determined that there is an error, as shown in step S8, the error check circuit 8 does not output the data to the bus 10 but outputs the error detecting signal to the bus 10 and the like.
In the concrete example shown in
And the error check circuit 8 determines whether or not the verification result is OK as shown in step S7 of
The example shown in
According to the present embodiment, as mentioned above, the data and the error detecting code corresponding to the data are stored at the different memory addresses shifted by one in the EEPROM 7 as the memory.
And when reading out the data, it is possible to verify whether or not there is an error by reading out the data held in the EEPROM 7 and the error detecting code stored at a different memory address respectively and then verifying the data and the error detecting code.
For that reason, even in the case where an attacker attacks the address decoder 12 and tampers with the memory addresses in order to attempt failure-based analysis of an encryption key, the tampering is detectable as an error. In the case where the attacker attacks the data in order to attempt the failure-based analysis of the encryption key, the error is detectable as in the conventional cases and so a description thereof will be omitted.
Hereafter, the operation in the case of tampering with the memory addresses will be described by using
Even in this case, the process is performed at first according to the processing from step S1 of the flowchart shown in
And the memory address Addr01 [001] is inputted to the data/error detecting code storage address control circuit 13 of the error check circuit 8.
The memory address Addr01 [001] is also outputted to the address decoder 12 of the EEPROM 7. As shown in
And a data set {Mdata03, EDC (Md02)} of the memory address Addr03 [011] is read out from the EEPROM 7 and stored in the error check circuit 8.
As above, the memory address Addr01 [001] is inputted to the data/error detecting code storage address control circuit 13. And as shown in
As for the second time, the second bit of the address decoder 12 is fixed at ‘1.’ Therefore, the corresponding data set {Mdata02, EDC (Md01)} is read out from the memory address Addr02 [010] of the EEPROM 7, and the data set {Mdata02, EDC (Md01)} is stored in the error check circuit 8.
In this case, the error check circuit 8 checks whether or not there is an error as to the first-time data Mdata03 and second-time error detecting code EDC (Md01). And in this case, the error check circuit 8 determines that there is an error and outputs the error detecting signal.
According to the present embodiment thus operating, the error is detected and the error detecting signal is outputted by the error check circuit 8 so that tampering with the memory addresses by the attacker is also detectable.
Other than the situation where the memory addresses are artificially changed such as the case where the memory addresses are tampered with by the attacker, it is also possible to detect the error by the same operation in the case where an error simply occurs to the memory addresses during operation of the IC and the memory addresses are changed so that wrong data is read.
Consequently, it is possible to improve reliability of the memory and resistance against the attack on the IC card such as the failure-based analysis.
As mentioned above, as a characteristic of the present embodiment, the error detecting code is held at a different memory address from the corresponding data, which is not limited to what is shown in
(1) Form of storing the error detecting codes by shifting the memory addresses against placement of the corresponding data
An example of the form of (1) is shown in
In the example of
(2) Form of storing the error detecting codes in the memory in inverse order to the placement of the corresponding data
An example of the form of (2) is shown in
As for the error detecting code corresponding to each of the data, EDC (Md07) is stored in the memory cell of the memory address [000] and EDC (Md06) is stored at the memory address [001]. Thus, in the form, the error detecting codes are stored in inverse order to the placement of the corresponding data.
In this case, if the memory address of the data Mdata is ij, the memory address of the corresponding error detecting code is 7-(i+j), where the other address value changes depending on one address value in their memory address relation.
To be more specific, the memory address values do not shift one by one (or by one constant) on the whole as shown in
(3) Form of mutually interchanging the error detecting codes and thereby storing them at different memory addresses from the placement of the corresponding data
A first example according to the form of (3) is shown in
In the case of the form in which the error detecting codes are thus mutually interchanged, it is also possible to follow the second example shown in
The example of
To be more precise, EDC (Md04) to EDC (Md07) are stored in the memory cells of the memory addresses [001] to [011], and EDC (Md00) to EDC (Md03) are stored in the memory cells of the memory addresses [100] to [111] respectively.
(4) Form of dividing the data (Mdata) into the upper-order bit side and the lower-order bit side and storing one of the divided data at different memory addresses
An example of the form of (4) is shown in
And the data of the upper-order bit or the lower-order bit is stored at different memory addresses from the error detecting codes EDC (Md00) to EDC (Md07).
In the concrete example of
And the memory address-related information is stored in the data/error detecting code storage address control circuit 13.
The operation from the data set readout to the verification by the error check circuit 8 is basically the same as the aforementioned operational description, where the data and the like are read out by accessing the EEPROM 7 as the memory twice.
Upon the first readout, the upper-order bit data Mdata01_U and the error detecting code EDC (Md01) of the memory address Addr01 [001] for instance are read out from the EEPROM 7 as the memory and stored in the error check circuit 8 as shown on the downside of
Upon the second readout, the lower-order bit data Mdata01_L of the memory address Addr06 [110] is read out from the EEPROM 7 and stored in the error check circuit 8 as shown in
The error check circuit 8 checks whether or not there is an error by performing the verification using the data Mdata01_U and the error detecting code EDC (Md01) read out on the first readout and the data Mdata01_L of the second readout. In the case of
The readouts of
(5) Form including an area which stores only the data and an area which stores only the error detecting codes in the memory cell
An example of the form of (5) is shown in
In other words, the form is configured to store the data in the first memory specified by the first memory address and store the error detecting code corresponding to the data in the second memory specified by the second memory address which is set up in a predetermined relation with the first memory address and different from the first memory address.
In the concrete example of
The operation from the readout to the verification by the error check circuit 8 is basically the same as the aforementioned operational description, where the data and the like are read out by accessing the EEPROM 7 as the memory twice on readout.
As shown in
In the configuration of this case, the error is also detectable in the case where the attacker attacks on the memory addresses or the error occurs to the memory addresses. Thus, the storage form examples of the data and the error detecting codes taken as (1), (2), (3), (4) and (5) have approximately the same advantages as the cases described in
Any storage form other than those taken as (1), (2), (3), (4) and (5) has the same advantages as the present embodiment and belongs to the category of the present invention if the form satisfies the characteristic of storing the error detecting codes at different memory addresses from the corresponding data.
As mentioned above, according to the present embodiment, the data stored in the memory can be protected with a simple configuration. To be more precise, the error is detectable in the case where the error occurs not only to the data of the memory but also to the memory addresses.
Consequently, it is possible to improve the resistance against the attack on a device such as the IC card with the memory mounted thereon of the failure-based analysis or the like, that is, effectively prevent leakage of information and improve reliability of the device.
The above described the case of reading twice as an example of reading out the data and the like from the memory multiple times. It is also possible, however, to have a configuration where the data and the like are read out three or more times so as to further secure confidentiality of the information.
For instance, as in
Thus, it becomes necessary to access the memory three times in order to read out the data and the error detecting codes from the memory three times. And only in the case where the information on a correct correspondence relation is read out at each of the three times, the data is outputted as no error. Thus, the leakage of the data to be protected can be more securely prevented.
A comparison example in the case of using a heretofore known technology will be described in comparison with the above-mentioned embodiment. Hereafter, characteristics in the case of Japanese Patent Laid-Open No. 2003-51817 will be described. As shown in
Bit width of each individual memory is a sum of the bits equivalent to 1 Word of Mdata and check bits of the corresponding Mdata corresponding to a hamming code (the bit width necessary to the check bits is decided by the bit width of 1 Word of Mdata. By way of example, the necessary check bits are 4 bits in the case where Mdata is 8 bits).
As for the technique, in the case of reading Mdata01 held at the memory address Addr [001] ([001] is binary representation here) for instance, the data set {Mdata01, EDC (Md01)} read out from the memory address [001] is captured by the error check circuit and is then checked whether or not there is an error in the read data.
In this case, the error check circuit checks the data and transmits the data as-is to the bus if there is no error. In the case where there is an error in the data, however, the error check circuit outputs the error detecting signal, thereby allowing the tampering with the memory contents by the attacker to be detected.
As shown in
If the data is read out from the memory address [001] in this state, the data set {Mdata01′, EDC (Md01)} is read out and transmitted to the error check circuit, and data verification is executed thereafter. Here, EDC (Md01) is the error detecting code corresponding to the data Mdata01 before the tampering. Therefore, the result of the verification with the data Mdata01′ which has been tampered with is naturally NG (there is an error).
Therefore, according to the method of Patent Document 1, the tampering with the data portion of the memory is detectable by the error check circuit as in
However, the attack made by the attacker for the sake of attempting the failure-based analysis is not limited to directly tampering with the data of the data portion of the memory. There is also a method of changing the memory addresses and causing the memory address different from the correct memory address to be accessed, thereby causing incorrect data to be read out.
As for the attack method of attacking the address decoder, reading out the improper data and putting the IC in a failed state, there is a problem that the attack is not detectable by the method of Patent Document 1.
As an example thereof, thought is given to the case where an attack on the address decoder is made by the attacker when reading Mdata01 held at the memory address [001] as shown in
To read Mdata01, the memory address [001] is specified. However, in the case where the highest-order bit of the memory address is fixed at ‘1’ by the attacker for instance, the value of the memory address changes from [001] (before the tampering) to [101] (after the tampering).
And the data set {Mdata05, EDC (Md05)} of the address [101] actually tampered with is read from the memory instead of the data set {Mdata01, EDC (Md01)} of the memory address [001] which should originally be read out.
The data set {Mdata05, EDC (Md05)} read out in this case is captured by the error check circuit and is then checked whether or not there is an error. However, the data itself has not been tampered with, and ‘EDC (Md05)’ is also a correct error detecting code corresponding to the read data ‘Mdata05.’
For that reason, the verification result of the data set {Mdata05, EDC (Md05)} by the error check circuit becomes “no error” so that the error detecting signal is not outputted.
In comparison, the above-mentioned present embodiment can detect the error in the case where the system reads the unexpected improper data.
Having described the embodiments of the invention referring to the accompanying drawings, it should be understood that the present invention is not limited to those precise embodiments and various changes and modifications thereof could be made by one skilled in the art without departing from the spirit or scope of the invention as defined in the appended claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2007-038293 | Feb 2007 | JP | national |
