Semiconductor device, authentication system, and authentication method

Patent metadata

Field	Value
Publication number	US-10949527-B2
Application number	US-201816137346-A
Country	US
Kind code	B2
Filing date	Sep 20, 2018
Priority date	Nov 21, 2017
Publication date	Mar 16, 2021
Grant date	Mar 16, 2021

Abstract

Provided is a semiconductor device which can perform secure data transmission/reception considering functional safety. The semiconductor device includes a hardware security module circuit which performs an authentication process and an error detection circuit used to perform an error detection process at least on first data which is processed in the hardware security module circuit. A memory area associated with the error detection circuit is configured to be accessible only by the hardware security module circuit when the error detection process is performed at least on the first data.

First claim

What is claimed is:

1. A semiconductor device comprising:
a hardware security module circuit which performs an authentication process; and
an error detection circuit used to perform an error detection process at least on first data which is processed in the hardware security module circuit,
wherein a memory area associated with the error detection circuit is configured to be accessible only by the hardware security module circuit when the error detection process is performed at least on the first data,
wherein the semiconductor device further comprises an access control circuit which performs access control over the memory area,
wherein the hardware security module circuit is configured to be able to read or write data from or to the memory area without depending on a specification made by the access control circuit,
wherein, to perform the error detection process on the first data stored in the memory area, the hardware security module circuit brings the memory area into a data readable state and reads the first data from the memory area, and
wherein, when an error is detected in the first data which is read from the memory area and subjected to the error detection process, the hardware security module circuit brings the memory area into a data writable and inexecutable state and erases the first data written in the memory area.

2. The semiconductor device according to claim 1 , wherein the error detection circuit is a hardware circuit dedicated to the hardware security module circuit.

3. The semiconductor device according to claim 1 ,
wherein the access control circuit sets respective states where a read operation to the memory area is enabled or disabled, where a write operation to the memory area is enabled or disabled, and an execute operation to the memory area is enabled or disabled, and
wherein the access control circuit performs control so as to cause a transition from a first state to a second state in which the number of the enabled operations is smaller than in the first state.

4. The semiconductor device according to claim 1 ,
wherein, when target data to be transferred is transferred from a device outside the semiconductor device to the semiconductor device, the hardware security module circuit receives and transmits authentication data associated with the target data to be transferred from and to the device via the memory area to perform mutual authentication with the device,
wherein the error detection circuit performs the error detection process on the authentication data, and
wherein the access control circuit performs access control when the authentication data is written or read to or from the memory area.

5. The semiconductor device according to claim 1 , wherein the hardware security module circuit brings the memory area into a data writable state when the first data in which no error is detected as a result of the error detection process is stored in the memory area.

6. The semiconductor device according to claim 1 ,
wherein, to the first data, at least one of session information and a random number is added, and
wherein the hardware security module circuit is configured such that, when the session information or the random number is falsified, a data transmission/reception sequence does not continue.

7. A semiconductor device, comprising:
a hardware security module circuit which performs an authentication process; and
an error detection circuit used to perform an error detection process at least on first data which is processed in the hardware security module circuit,
wherein a memory area associated with the error detection circuit is configured to be accessible only by the hardware security module circuit when the error detection process is performed at least on the first data,
wherein the semiconductor device further comprises an access control circuit which performs access control over the memory area,
wherein the hardware security module circuit is configured to be able to read or write data from or to the memory area without depending on a specification made by the access control circuit,
wherein, when target data to be transferred is transferred from a device outside the semiconductor device to the semiconductor device, the hardware security module circuit receives and transmits authentication data associated with the target data to be transferred from and to the device via the memory area to perform mutual authentication with the device,
wherein the error detection circuit performs the error detection process on the authentication data,
wherein the access control circuit performs access control when the authentication data is written or read to or from the memory area, and
wherein, when the target data to be transferred is segmented and transferred from the device, the hardware security module circuit performs mutual authentication with the device before the target data to be transferred is transferred, segments the authentication data resulting from addition of error detection data by the device to the whole target data to be transferred and from an authentication process performed by the device on the whole target data to be transferred, receives the segmented authentication data, and performs mutual authentication with the device after the target data to be transferred is transferred.

8. The semiconductor device according to claim 7 , wherein, after the target data to be transferred is transferred, when the authentication of the device is successful, the hardware security module circuit combines segmented encryption data with each other and decrypts the target data to be transferred.

9. The semiconductor device according to claim 7 ,
wherein the authentication data is transmitted from the device without being encrypted, and
wherein the hardware security module circuit performs the mutual authentication without involving encryption and decryption.

10. A semiconductor device, comprising:
a hardware security module circuit which performs an authentication process; and
an error detection circuit used to perform an error detection process at least on first data which is processed in the hardware security module circuit,
wherein a memory area associated with the error detection circuit is configured to be accessible only by the hardware security module circuit when the error detection process is performed at least on the first data,
wherein the semiconductor device further comprises an access control circuit which performs access control over the memory area,
wherein the hardware security module circuit is configured to be able to read or write data from or to the memory area without depending on a specification made by the access control circuit,
wherein, from a server which is communicative with a device outside the semiconductor device, key information used only for communication between the semiconductor device and the device is issued to the semiconductor device via the device,
wherein the hardware security module circuit receives and transmits authentication data associated with the key information from and to the device via the memory area to perform mutual authentication with the server and the device,
wherein the error detection circuit performs an error detection process on the authentication data, and
wherein the access control circuit performs access control when the authentication data is written or read to or from the memory area.

Assignees

• Renesas Electronics Corp

Inventors

• Tanimoto Tadaaki
• Moriyama Daisuke
• Taki Yoshitaka

Classifications

• G06F21/72 Primary

  in cryptographic circuits · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title

• G06F12/1441

  for a range · CPC title

• H04L2209/34

  Encoding or coding, e.g. Huffman coding or error correction · CPC title