JP3234959B2 - Microcomputer and card incorporating the same - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a microcomputer and a card containing the same, and more particularly, to a one-chip microcomputer having a function of maintaining the security of the built-in data, the security of the data is improved. Related to a microcomputer.

[0002]

2. Description of the Related Art A personal authentication card represented by an IC card usually has a one-chip microcomputer, and has the advantage of being multifunctional and highly functional. In particular, I
The C card has recently been put to practical use for an employee ID card or the like. In this case, since it is used within a relatively limited range, such as a time card replacement or a fee settlement in an employee cafeteria, security and other management are easy, and the above-mentioned advantages are effectively used.

FIG. 2 shows a basic configuration of a conventional one-chip microcomputer employed in such an IC card and other various control devices. In FIG. 2, 1 is RO
M-made instruction decoder (ID-ROM),
2 is a ROM (PR) for storing instruction codes.
OG-ROM), 3 is a program counter (PC), 4
Is an arithmetic circuit (ALU). Also, PROG-ROM
2 includes an application program (app) 2a expressed as a series of instruction codes.
Is stored. Usually, other than registers and RAM
And the like are included, but descriptions thereof are omitted to make the description clear.

Under such a configuration, the execution of the application program 2a is mainly performed according to the following procedure.
First, the instruction code B in the PROG-ROM 2 at the address A indicated by the program counter 3 is read. Next, this instruction code B
In response, the instruction decoder 1 decodes it according to the stored contents, and
, A control signal D to the arithmetic circuit 4, and the like. In response to the control signal D, the arithmetic circuit 4 performs arithmetic operations such as addition and shift, and the arithmetic result is held in a register (not shown) or the like. Upon receiving the control signal C, the program counter 3 increments the value of the address A or changes the value of the address A to a jump destination address.

[0005] In this way, a series of instruction codes of the application program 2a are processed one after another via the instruction decoder 1, whereby the application program 2a is executed.
Thereby, for example, various functions as an IC card are performed. As described above, the IC card has a one-chip microcomputer mounted thereon and realizes various functions according to an application program.

However, up to now, due to problems such as cost and security, it has not been widely used as expected. Among these problems, the cost is expected to decrease rapidly due to the effect of mass production once it starts to spread, as with other ICs, etc., and a solution based on economic principles, where demand and supply are related to price, is considered. Be expected.

[0007]

However, such security cannot be expected, and it must be solved purely technically. In particular, in the case of an IC card used as a passbook of a bank, which is expected to be a breakthrough of the spread of the IC card, the demand for security is more severe. For example, is the security of the means for a conventional employee card, in the security measures of the extent to check the encryption and ID of the communication data by software is inadequate. This is because there is a possibility that the instruction group owned by the microcomputer, a so-called instruction set, is understood from the configuration and the stored contents of the instruction decoder according to the architecture, and the code of the application program 2a is read to decode the program contents. Because.

[0008] Therefore, there is a demand for realizing secure security means by hardware means in order to spread IC cards, and further reduce the cost of one-chip microcomputers and further spread them.

An object of the present invention is to solve such a problem of the prior art, and to provide a one-chip microcomputer which can exert a reliable security function by adding a small number of circuits. . Another object of the present invention is to provide a personal authentication card or the like having a built-in microcomputer which requires a confidentiality protection function and which can improve the security.

[0010]

SUMMARY OF THE INVENTION A microcomputer according to the present invention which achieves the above object has a loss command code for losing or invalidating the contents of an instruction decoder (hereinafter referred to as a loss in this specification and claims). A ROM that stores various instruction codes, and a PROM that decodes the instruction code read from the ROM and generates a plurality of control signals including a loss control signal generated in response to the loss command code. A built-in instruction decoder and a write control circuit for writing (or erasing) a predetermined value in the instruction decoder in response to the loss control signal are incorporated in a single chip, and are operated during or as a microcomputer. Crab prescribed security execution conditions By accessing the loss command code of the ROM when satisfied is intended to be sent to the instruction decoder.

[0011]

According to the microcomputer of the present invention having the above-described structure, when the security execution condition is satisfied when the software or the hardware is not controlled normally, for example, the loss control signal is obtained as follows. A loss start signal may be generated. For example, the microcomputer executes an instruction to generate a loss start signal when the microcomputer detects an error in a plurality of passwords or an abnormality by checking means such as a test program. Then, a loss start signal is generated from the instruction decoder, and in response to this, the write control circuit writes predetermined information to or erases the contents of the instruction decoder.

Here, writing from the writing control circuit,
The instruction decoder to be erased is PRO
Since it is M, the contents can be lost by overwriting the instruction decoder or erasing the stored contents.

If the stored contents of the instruction decoder are lost in this manner, the instruction set (the architecture of the microcomputer in a narrow sense) cannot be understood. Therefore, even if the code of the application program is read, the contents and the meaning of the application program are read. It is impossible to decipher the structure, function, etc. In addition, since the instruction decoder is a PROM, writing to the PROM can be performed after completion of the IC, so that even an IC maker cannot decode the instruction.

Therefore, by using a one-chip microcomputer having this configuration, it is possible to realize reliable security by means of hardware. Regarding the circuit scale, the ROM storing the application program occupies a considerable area of the chip area for realizing various functions. On the other hand, the instruction decoder only has to decode a part of normal bits of the instruction code excluding the address part and the like, so that the ratio of the occupied area in the chip is small. Therefore, the instruction decoder is ROM
Therefore, even if the area of the portion is increased instead of the PROM, the influence of the increase in the whole chip is suppressed to a small one.

Further, the write control circuit has a function of losing the contents of the instruction decoder. This write control circuit also has an original write control circuit for the instruction decoder provided for writing data after completion of the IC. A simple erasing circuit is sufficient if a flash memory or the like is used as the PROM. Therefore, the increase in the circuit scale as a whole is insignificant and is not enough to sacrifice other functions.

[0016]

An embodiment will be described with reference to the block diagram of FIG. Here, 2 is a ROM (PROG-ROM) for storing instruction codes, 3 is a program counter (PC), and 4 is an arithmetic circuit (ALU). Further, 11 is an instruction decoder (ID)
-PROM), 12 is a flip-flop, 13 is a write control circuit, 14 is an increment circuit (incrementer), and 15 is an address counter.

The PROG-ROM 2 has an EEPROM
An M or EPROM, which stores an application program (application) 2a expressed as a series of instruction codes and a check program (test) 10 for detecting an abnormal state. It is to be noted that, although other registers, a RAM, a bus line, an interface, and the like are usually included, they are not directly related to the description of the present invention, and thus description thereof will be omitted for clarity.

Most of the check program 10 comprises a conventional check program for checking by collation (including scrambled collation) between an ID number or the like and a secret registration number, for example. As a result, an abnormality is detected by software. If no abnormality is detected, the application program 2a is executed. If an abnormality is detected, an instruction for generating a loss start signal is executed. Also, when an abnormal signal or the like is applied to the hardware via the external terminal of the IC,
Since there is a possibility that the configuration of the program or the circuit is being decoded, this is detected by, for example, an abnormality detection circuit using a voltage detection circuit or the like, and similarly, an instruction for generating a loss start signal is executed. That is,
The check program 10 is a specific example of a determination program for determining whether a security execution condition is satisfied. The instruction may be executed after counting the number of times of abnormality detection a plurality of times.

As described above, the check program 10 basically affects the size of the PROG-ROM 2 because it is sufficient to add and modify the conventional program to execute a specific instruction. Few things. The write control circuit 13 has a register inside and has an external write control signal E.
In response to this, the bus 1
6, write address data and write data are set in the internal register. These data are
The write control circuit 13 sends the signals F1 and F2 to the address counter 15 and the instruction decoder 11, respectively. As a result, the address counter 15 generates the address G, and the stored content corresponding to the instruction set is written into the address of the PROM of the instruction decoder 11 indicated by the address G. When receiving the Q output from the flip-flop 12, the write control circuit 13 controls the incrementer 14 so that one address of “1” or “0” is stored in each address of the instruction decoder 11. Are sequentially written while updating the address counter 15.
The flip-flop 12 is set by a loss start signal from the instruction decoder 11. Further, the write control circuit 13 may be provided with a booster circuit for writing data to the EEPROM.

As a result, the contents stored in the instruction decoder can be written after completion of the IC.
Unlike the case of M, even if the IC maker that manufactured this IC does not have a correspondence table between the instruction set at the time of developing the program and the contents of the ID-ROM, the contents of the application program 2a or the like can be decoded. Is impossible.

Under such a configuration, the execution of the application program 2a and the check program 10 is performed in the steady state in the following procedure. First, a certain address A is set in the program counter 3, and the PROG-ROM 2 at the address A indicated by the program counter 3 is set.
Is read out.

Next, in response to the instruction code B, the instruction decoder 11 decodes the instruction code according to the stored contents and generates, for example, a control signal C to the program counter 3 and a control signal D to the arithmetic circuit 4. . In response to the control signal D, the arithmetic circuit 4 performs arithmetic such as addition and shift, and the arithmetic result is held in a register (not shown) or the like. Upon receiving the control signal C, the program counter 3 increments the value of the address A or changes the value to the jump destination address.

In this manner, a series of instruction codes of the application program 2a and the check program 10 are successively transferred to the instruction decoder 1
1 is processed. Then, the application program 2a and the check program 10 are executed as a series of the processes, and various functions as, for example, an IC card or a controller are performed. When the check program 10 becomes a condition for executing the application program, the check program 10 is executed prior to the condition as described above.

The above is the operation in the normal state. On the other hand, if any abnormality is detected by the check program 10 and it occurs, for example, three times, the check program 10 generates an instruction code H for generating a loss start signal. I do. The abnormality detection is counted by a soft counter provided in a memory (not shown). The instruction code H is decoded by the instruction decoder 11 as one of the instruction codes B. As a result of decoding this, a loss start signal I is generated.

The occurrence event of the loss start signal I is held by the flip-flop 12, and the overwrite control signal J is generated from the flip-flop 12 and sent to the write control circuit 13. Then, the write control circuit 13 writes “1” or “0” into the PROM of the instruction decoder 11 while updating the address G from the address counter 15 via the increment circuit 14 one after another.

In the process of overwriting, a part of the stored contents of the instruction decoder 11 is lost, so that the programs 2a and 10 can no longer be executed normally, but the flip-flop 12 sends the overwriting control signal J to the writing control circuit 13. The write control circuit 1
3 operates and the write control circuit 13 performs writing up to the last address of the instruction decoder 11. As a result, the contents stored in the instruction decoder 11 are completely lost. When the address of the address counter 15 exceeds the last address of the instruction decoder 11, a signal R from the address counter 15 is output.
Resets the flip-flop 12, and the write control circuit 13 stops its operation.

Thus, the instruction set cannot be obtained even by hardware means. Therefore, since an instruction set cannot be obtained, even if the code of the application program is read, it is impossible to decode the contents, meaning, structure, function, etc. of the application program.

It should be noted that the contents of the instruction decoder 11 whose contents have been lost are written by a person having a proper authority to a predetermined terminal of the write control circuit 13 by applying a write control signal E from the outside, and a predetermined I / O of the microcomputer. By inputting write data and a write address to the / O terminal, a correct instruction set is written, so that the contents can be easily recovered.

Although elements added for this security function are clearly indicated by broken lines in FIG. 1, the check program 10 is slightly increased as described above, and the flip-flop 12 and the increment circuit 14
Is a circuit of a slight scale from the current degree of integration of ICs. Further, as described above, the write control circuit 13 and the address counter 15 for invalidating the contents of the instruction decoder also serve as the original write control circuit for the instruction decoder. The size of the instruction decoder 11 is PROG-RO
Since it is much smaller than M2, the increase in circuit scale due to the change from the ROM to the PROM in the instruction decoder 11 is small. Therefore, an increase in the circuit scale of the entire chip can be suppressed to a small amount.

If, for example, a flash memory or the like is used as the PROM for the instruction decoder 11, the stored contents can be erased by one operation. Therefore, the flip-flop 12 and the increment circuit 14 may be replaced by an address counter 15 depending on the configuration of the write control circuit 13. Can also be omitted.

As described above, an example in which an EEPROM and an EPROM are used as the instruction decoder is described here. However, the instruction decoder is a ROM that can write "1" or "0" even once. If it is, the contents can be destroyed by writing "1" or "0" by the write control circuit, so that any PROM may be used.

[0032]

As can be understood from the above description, in the microcomputer having the configuration of the present invention, the instruction decoder is formed as a PROM, and a small number of circuits are added, thereby ensuring the security by hardware means. A configuration of a one-chip microcomputer exhibiting functions can be realized. As a result, IC
This can contribute to the spread of cards and cost reduction of one-chip microcomputers.

[Brief description of the drawings]

FIG. 1 is a block diagram of an embodiment of a one-chip microcomputer according to the present invention.

FIG. 2 is a block diagram of a conventional one-chip microcomputer.

[Explanation of symbols]

1. Instruction decoder (ID-ROM) 2. ROM storing instruction code (PR
OG-ROM), 2a: application program (app), 3: program counter (PC), 4: arithmetic circuit (AL)
U), 10: check program (test), 11: instruction decoder (ID-PRO)
M), 12: flip-flop, 13: write control circuit, 14: increment circuit (incrementer), 15 ...
Address counter.

──────────────────────────────────────────────────続 き Continued on the front page (58) Fields surveyed (Int. Cl. ⁷ , DB name) G06F 15/78 510 G06F 12/14 G06K 17/00 G06K 19/073

Claims (3)

(57) [Claims] 1. A ROM for storing various instruction codes including a loss command code for losing the contents of an instruction decoder, and an instruction code read from the ROM is decoded to respond to the loss command code. PRO that generates multiple control signals, including loss control signals that occur
An M instruction decoder, and a write control circuit for writing a predetermined value to the instruction decoder in response to the loss control signal or for erasing the contents of the instruction decoder. A microcomputer that accesses the lost instruction code in the ROM and sends it to the instruction decoder when a predetermined security execution condition is satisfied either during time or during operation. 2. The system according to claim 1, further comprising a determination program in said ROM for determining whether or not said security execution condition is satisfied, wherein said loss command code is generated when said security execution condition is satisfied. Microcomputer. 3. A ROM for storing various instruction codes including a loss instruction code for losing the contents of an instruction decoder, and an instruction code read from the ROM is decoded to respond to the loss instruction code. PRO that generates multiple control signals, including loss control signals that occur
A card having an M instruction decoder, and a write control circuit for writing a predetermined value to the instruction decoder in response to the loss control signal or for erasing the content thereof, A card which accesses the lost instruction code of the ROM and sends it to the instruction decoder when a predetermined security execution condition is satisfied during an operation in which an IC executes a predetermined process or during the operation.