Source: https://patents.google.com/patent/WO2011064883A1/en
Timestamp: 2019-09-17 22:10:12
Document Index: 554833741

Matched Legal Cases: ['art 250', 'art 250', 'art 250', 'art 250', 'art 250', 'art 300']

WO2011064883A1 - Memory chip - Google Patents
Memory chip Download PDF
WO2011064883A1
WO2011064883A1 PCT/JP2009/070056 JP2009070056W WO2011064883A1 WO 2011064883 A1 WO2011064883 A1 WO 2011064883A1 JP 2009070056 W JP2009070056 W JP 2009070056W WO 2011064883 A1 WO2011064883 A1 WO 2011064883A1
PCT/JP2009/070056
上林　達
加藤　拓
禎彦 広瀬
新保　淳
2009-11-27 Application filed by 株式会社東芝 filed Critical 株式会社東芝
2009-11-27 Priority to PCT/JP2009/070056 priority Critical patent/WO2011064883A1/en
2011-06-03 Publication of WO2011064883A1 publication Critical patent/WO2011064883A1/en
Disclosed is a semiconductor memory chip (100) that, in order to prevent illicit use of data, via forgery or the like, is provided with: a memory (110) that contains a special region, said special region being a memory region for predetermined data; and a data conversion unit (140). The data conversion unit includes: a key memory unit that stores a second key corresponding to a first key that an external device uses to convert data; a conversion unit that receives write data to be written to the special region, from a controller (200), and uses the second key to convert the write data and generate converted data; and a write unit that writes the converted data to the special region.
The present invention relates to a memory chip.
Semiconductor memory chip formed on a semiconductor die, rather than that typically used in alone, it is used by connecting an external controller and electrically. Access from an external device (such as a writing device and reading and reproducing device) to the data in the memory of the semiconductor memory chip is performed through the controller. A combination of controller and semiconductor memory chips sometimes sold as memory products. For example, items such as an SD memory card is one example (see Non-Patent Document 1). In some cases, to provide a semiconductor memory chip and the controller those bonded with a resin as a SIP (System In Package). Further, when the semiconductor memory chip is used to store the music data or an audio player, there is also that the controller is an integral part of another semiconductor and semiconductor memory chips. In either case, the semiconductor memory chip and the controller are connected directly accessing data in a memory of a semiconductor memory chip is always performed via the controller.
The controller not only mediates access to the data in the semiconductor memory chip, may provide a security feature. For example, in the case of an SD memory card, copyright protection function to the controller has been introduced. Controller authenticates the host device, such as a player or writing device, only when the authentication succeeds, transfers the data stored in the semiconductor memory chip to the host device. Further, the controller only if the authentication succeeds, to record the data received from the writing device to the semiconductor memory chip. Thus, for example, unauthorized players not authenticated can not access the data in the memory card. Thus, data in the memory card is protected from being stolen by an unauthorized player.
If you have implemented a copyright protection function by the controller of the memory card as well, there are further attacks. For example, it is assumed that the video data in the memory card is stored. Copyright protection function with the controller of the memory card, video data which the memory card is stored is protected from reading by unauthorized players. Therefore, it is protected against unauthorized copying of the video data using unauthorized players.
Entity 4C, LLC. " Content Protection For Recordable Media Specification, SD Memory Card Book, Common Part ", Revision 0.961, May. 3, 2007.
However, the attacker opened the package of the memory card, it is possible to read all of the video data from the semiconductor memory chip. Then, copy the video data to another semiconductor memory chip, combined with separately purchased controller, it can also be made in much the replication of counterfeit memory card that contains the video data. Moreover, the video data of counterfeit memory card can be reproduced by similarly authorized players and video data of the normal memory card.
The present invention was made in view of the above, and an object thereof is to provide a memory chip which can prevent illegal use of data by forgery of the memory card.
The present invention is a memory chip that is connected to a controller for controlling reading and writing of data in response to a request of the external device, and a memory including a special area is a storage area of ​​predetermined data, the external device There a key storage unit for storing a second key corresponding to the first key for use in converting the data, the write data to be written into the special area is received from the controller, the write data using the second key a conversion unit for generating the converted conversion data, characterized in that it comprises, a writing unit for writing the converted data into the special area.
Further, the present invention is a memory chip that is connected to a controller for controlling reading and writing of data in response to a request of the external device, and a memory including a special area is a storage area of ​​predetermined data, wherein a key storage unit for external device storing a second key corresponding to the first key for use in converting the data, receives the write data to be written in the special area from the controller, the special area of ​​the write data received a writing unit that writes to, the write data written in the special area, characterized in that it comprises a conversion unit that generates converted data converted by using the second key.
Further, the present invention is a memory chip that is connected to a controller for controlling reading and writing of data in response to a request of the external device, and a memory including a special area is a storage area of ​​predetermined data, wherein using the encryption key shared with the controller, the an encryption unit for generating encrypted encrypted data special area write data written in a portion for sending the encrypted data to the controller, the characterized in that it comprises.
According to the present invention, an effect that it is possible to prevent illegal use of data by forgery of the memory card.
Diagram showing an example of the trust chain. Block diagram of a semiconductor memory chip and the controller of the first embodiment. Diagram illustrating a configuration example of the encryption key sharing unit. Flowchart showing an overall flow of the encryption key sharing process of the first embodiment. Diagram illustrating a configuration example of a sending control unit and a read control unit. Flowchart showing the overall flow of data reading process in the first embodiment. It illustrates a modification of the encryption key sharing unit. Flowchart showing an overall flow of the encryption key sharing process of a modification of the first embodiment. It illustrates a modification of the sending control unit the reading control unit. Flowchart showing the overall flow of data reading process in the modification of the first embodiment. It shows another variation of the sending control unit the reading control unit. Flowchart showing the overall flow of data reading process in another modification of the first embodiment. It shows a state in which writing to write special area. Diagram illustrating a configuration example of a write control unit and a data conversion unit. Flowchart showing an overall flow of write processing in the first embodiment. Figure showing changes of data with minimum data only encryption and decryption constituting. It illustrates a modification of the write control unit and the data conversion unit. Diagram illustrating an example of a data structure of a key storage unit. Flowchart showing an overall flow of write processing in a modified example. It illustrates a modification of the version information. Block diagram of a semiconductor memory chip of the second embodiment. It illustrates an exemplary configuration of a receiving control unit and the writing device of the second embodiment. Flowchart showing an overall flow of write processing according to the second embodiment. Diagram showing an exemplary structure of the data conversion unit according to the second embodiment. Flowchart showing the overall flow of data reading process in the second embodiment. Block diagram of a player and the memory card of the third embodiment. Flowchart illustrating an entire flow of the reproducing process according to the third embodiment. Block diagram of a player and the memory card of the fourth embodiment. Flowchart illustrating an entire flow of the reproducing process according to the fourth embodiment. Diagram showing one configuration example of a next generation power grid of the fifth embodiment. Block diagram illustrating a configuration example of a smart meter.
With reference to the accompanying drawings, illustrating a preferred embodiment of the memory chip according to the present invention in detail.
Memory chip according to the first embodiment (semiconductor memory chip), the semiconductor memory chip to have a security function, incorporating the semiconductor memory chip itself in the trust chain. Accordingly, the semiconductor memory chip is prevented from being used in combination with bad controller. A semiconductor memory chip advanced components, as the controller having the incorrect ID, it can not be easily manufactured and sold.
Here it will be described with reference to FIG. 1, the trust chain. Figure 1 is a diagram illustrating an example of a system incorporating the semiconductor memory chip 100 to the trust chain. The direction of the arrow in Figure 1 indicates the direction of authentication. That is, the semiconductor memory chip 100 authenticates the controller 200, the controller 200 authenticates the writing device 300, the writing unit 300 authenticates the semiconductor memory chip 100. The broken line is optional. Writing device 300 is the starting point of the trust chain, authenticating the controller 200 via the semiconductor memory chip 100 is an object to construct a trust chain of FIG. Since the flow of data between the write device 300 and the semiconductor memory chip 100 is always performed via the controller 200, the authentication of the semiconductor memory chip 100 is an indirect by writing device 300.
In this embodiment, in order to incorporate the semiconductor memory chip 100 to the trust chain, to provide a security feature in the semiconductor memory chip 100 itself. Specifically, it constitutes a special area in a memory of the semiconductor memory chip 100. Special area includes a read special area and writing special area. Reading special area and, among the storage areas in the memory (memory area), only the controller 200 that has been authenticated by the semiconductor memory chip 100 is a memory area set in advance can be read the stored values ​​correctly. Write and special area of ​​the memory region, when the data writing, a memory area predefined to write data subjected to decoding by the data conversion unit (described later).
Further, in this embodiment, in order to incorporate the semiconductor memory chip 100 to the trust chain, it provided a common area in the reading special area and the writing special area. Then, to the common area, to record the essential information to the data utilizing. Be essential information to the data utilizing can be recorded correctly in the common area, i.e., nothing more than the semiconductor memory chip 100 has been authenticated by the writing device 300. The essential information to the data utilizing recorded in the common area, the read correctly by the controller 200, i.e., nothing more than the controller 200 is authenticated by the semiconductor memory chip 100. Thus, the trust chain of FIG. 1 is completed.
Figure 2 is a block diagram showing an example of the configuration of the semiconductor memory chip 100 and the controller 200 of the first embodiment. First, an overview of the functions of the semiconductor memory chip 100. As shown in FIG. 2, the semiconductor memory chip 100 includes a memory 110, an encryption key sharing unit 120, a delivery control unit 130, and a data conversion unit 140, a.
Memory 110 is a storage unit for storing various data. The memory 110, for example, can be configured of a NAND-type flash memory. The memory 110 is not limited thereto, including flash memories of other types, it can be applied to any semiconductor memory composed of semiconductor elements.
Memory 110 includes a code storage unit 111, a reading special area 112, and the writing special area 113, and a common area 114, and a general area 115.
Code storage unit 111, an error correction code of data requested to be written from the writing apparatus 300: storing (ECC error correction code). Incidentally, the code storage unit 111 may comprise a storage unit independently of the memory 110 in the external memory 110.
In Figure 2, each of the reading special area 112 and the writing special area 113, have been shown examples included a region other than the common area 114, if there is at least a common area 114, the structure of each region is in any is there. For example, it may be configured such reading and special area 112 and the writing special area 113 matches (i.e. match the reading special area 112 and the writing special area 113 and either also common region 114).
The general area 115, without passing through the transmission control unit 130 and the data converter 140, representing the area which can be written and read directly from the controller 200.
The encryption key sharing unit 120 holds or generates an encryption key shared with the controller 200. Sending control unit 130 controls processing for transmitting the data read from the memory 110 to the controller 200. Data conversion unit 140 generates a converted data obtained by converting the data from the writing device 300 writes requested through the controller 200. The encryption key sharing unit 120, sending control unit 130 and the data conversion unit 140, is configured in the memory 110 on the same die. Thus, to have a security function in the semiconductor memory chip 100, it is possible to prevent illegal use of data by forgery of the memory card. The encryption key sharing unit 120, will be described in detail later functions of the transmission control unit 130 and the data converter 140,.
Next, a description will be given of the outline of the functions of the controller 200. Controller 200, the encryption key sharing unit 210, a read control unit 220, a writing control section 230, and a common area reading unit 240, the general area writing part 250, a.
The encryption key sharing unit 210 holds or generates an encryption key to be shared with the semiconductor memory chip 100. Read control unit 220, in response to a request from an external device such as a reading device and the reproducing device (not shown), controls the process of reading data from the common area 114 of the semiconductor memory chip 100. Writing control unit 230, in response to a request from an external device such as a writing device 300, controls the process of writing the data in the common area 114 of the semiconductor memory chip 100.
General area reading unit 240 controls the reading of data from the general area 115. That is, when the general area 115 read the data, reading device, to the general area reading unit 240 of the controller 200, inputs the specified page to be read.
General area reading unit 240 reads reads the data of the designated page, the ECC corresponding to the page specified by the code storage unit 111. In general area reading unit 240 checks an error of the page read using ECC. If there is no error, the general area reading unit 240 outputs the data of the page read. If the error can exist to repair general area reading unit 240, and outputs the restored data of the read page. Otherwise, the general area reading unit 240 outputs the error code.
General area writing part 250 controls the data writing into the general area 115. That is, when writing data to the general area 115, the writing unit 300 inputs the data to the general area writing part 250 of the controller 200. At this time, the writing device 300 is also input to the general area writing part 250 specifies the writing destination page (area of ​​the memory).
General area writing part 250 generates the ECC of the input data, among the general area 115, writes the data to the specified page, the generated ECC into the code storage section 111 as ECC for the specified page Record.
Will now be described with reference to FIG. 3 an example of the configuration of the encryption key sharing unit 210 of the encryption key sharing unit 120 and the controller 200 of the semiconductor memory chip 100. As shown in FIG. 3, the encryption key sharing unit 120, KM121 represents a media key (hereinafter, medium of key KM) and holds the MKB (Media Key Block) 122. The MKB 122, for example, described in Non-Patent Document 1. The encryption key sharing unit 210 holds the KD212 representing the device key. The encryption key sharing unit 210 includes a MKB reading unit 211, an MKB processing unit 213, a.
MKB reading unit 211 reads the MKB122 from the encryption key sharing unit 120 of the semiconductor memory chip 100. MKB processing unit 213 performs the MKB process of deriving a media key KM by treatment with a device key KD212 an MKB read.
In the example of FIG. 3, the encryption key sharing unit 120 of the semiconductor memory chip 100 has authenticated the encryption key sharing unit 210 of the controller 200.
Next, will be described with reference to FIG encryption key sharing process for sharing an encryption key with the encryption key sharing unit 120 and the encryption key sharing unit 210 configured as shown in FIG. Figure 4 is a flow chart showing the overall flow of an encryption key sharing process of the first embodiment.
When the controller 200 reads data from the read special area 112 of the semiconductor memory chip 100, first, MKB reading unit 211 of the encryption key sharing unit 210 of the controller 200 reads the MKB122 semiconductor memory chip 100 (step S101). MKB122 is, it is possible to always free to read from the controller 200. MKB reading unit 211 sends the MKB122 read the MKB processing unit 213 (step S102).
MKB processing unit 213 reads the device key KD212 the encryption key sharing unit 210 of the controller 200 is holding, performs MKB processing (step S103). Then, the MKB processing unit 213 determines whether the media key KM has been obtained by the MKB processing (step S104). If the device key KD212 has been disabled by the MKB 122, it can not be obtained correctly media key KM by MKB processing. In this case, MKB processing unit 213 determines that the media key KM has not been obtained (step S104: No), notifies an error to the controller 200 (step S105). Controller 200 is notified of an error, it stops the reading operation.
On the other hand, if the device key KD212 has not been disabled by the MKB 122, the correct media key KM by MKB processing is obtained. In this case, MKB processing unit 213 determines that the media key KM has been obtained (step S104: Yes), sends the obtained media key KM to the reading control unit 220 of the controller 200 (step S106). The semiconductor memory chip 100, the media key KM the encryption key sharing unit 120 stores is sent to the sending control unit 130 (step S107).
It will now be described with reference to FIG. 5 an example of the configuration of the read control unit 220 of the sending control unit 130 and the controller 200 of the semiconductor memory chip 100. As shown in FIG. 5, sending control unit 130 includes a random number generating unit 131, a reading unit 132, and a cryptographic unit 133, and a sending unit 134.
Random number generating unit 131 generates a random number in response to a request from the encryption unit 133. Reading unit 132 reads data of the designated reading target page, and of the data ECC from the memory 110. Encryption unit 133 encrypts using the read data media key KM. Sending unit 134 sends the encrypted data (encrypted data) and the ECC to the data reception unit 221 of the controller 200.
Further, as shown in FIG. 5, the read control unit 220 includes a data receiver 221, a decoder 222, and a error correction section 223. Data receiving unit 221 receives the encrypted data and the ECC from the sending unit 134 of the semiconductor memory chip 100. Decoding unit 222 decodes using the media key KM the received encrypted data. Error correction unit 223, using the received ECC, to check and error correction of the error presence or absence of decoded data.
Will now be described with reference to FIG. 6 for the data reading process for transmitting and receiving the read data to and from the sending control unit 130 and the read control unit 220 configured as shown in Figure 5. Figure 6 is a flow chart showing the overall flow of data reading process in the first embodiment.
Read control unit 220, when the encryption key sharing unit 210 receives the media key KM (Step S201), and enter the media key KM received the decryption unit 222 (step S202). Then, the read control unit 220 sends a data transmission request to the transmission control unit 130. At this time, it sent also to specify the read target page (step S203). Reading unit 132 of the sending control unit 130 reads data of the designated page is input to the encryption unit 133 (step S204). Further, the reading unit 132 reads the ECC corresponding to the read target page from the code storage unit 111, and inputs to the sending unit 134 (step S205).
Next, the encryption unit 133, sends a random number generation request to the random number generating unit 131 (step S206). Random number generating unit 131 sends the encryption unit 133 generates a random number (step S207). Encryption unit 133 obtains the media key KM from the encryption key sharing unit 120 (step S208). Encryption unit 133 concatenates the data and the random number of the designated page, the data obtained by concatenating to produce an encrypted encrypted data D 'in the media key KM (Step S209). Then, the encryption unit 133, sends the encrypted data D 'to the sending unit 134 (step S210). Sending unit 134 sends the inputted input encrypted data D 'and ECC to the data receiving unit 221 of the controller 200 (step S211).
It should be noted that the important data in the reading target page might be part of the page. In such a case, the encryption unit 133, only a portion of the page that contains the critical data may be configured to encrypt. For example, if only the first 48 bytes of the page is important data, the encryption unit 133 may be encrypted only 64 bytes beginning the concatenation of 48 bytes and 16 bytes of random pages. Thus, it is possible to minimize the increase in processing load due to encryption.
Next, the data reception unit 221 of the read control unit 220 receives the encrypted data and the ECC (step S212). Then, the data receiving unit 221 sends the received ECC in the error correction unit 223 (step S213). Error correction unit 223 holds the received ECC. Further, the data receiving unit 221 sends the received encrypted data D 'to the decrypting unit 222 (step S214). Decoding unit 222, by using the media key KM received from the encryption key sharing unit 210 of the controller 200 decrypts the encrypted data D '(step S215).
The result of this decoding, is obtained and the read data D and the random number of plaintext. Decoding unit 222, in accordance with a predetermined format, from the decoded data, it is possible to distinguish between the read data D and the random number. For example, in the above example the encryption unit 133 to encrypt only the 64 bytes, out of the decoded data, the first 48 bytes are read data D, is 16 bytes following the random number.
Decoding unit 222 transfers only the read data D to the error correction section 223 (step S216). Error correction unit 223 checks the error of the read data D by using the ECC held (step S217). Then, the error correction unit 223 determines whether there is an error (step S218). If there is no error (Step S218: No), the controller 200, the external device which has requested the reading of the read data D, and outputs the read data D (step S219).
If there is an error (step S218: Yes), the error correction section 223, further error is determined whether repairable (Step S220). If the error is repairable (Step S220: Yes), the error correction section 223, to repair errors in the read data D by using the ECC held (step S221). Then, the controller 200 outputs the read data D after repair (step S219).
If the error is unrecoverable (step S220: No), the error correction section 223 notifies an error to the controller 200 (step S222). In this case, the controller 200 transmits, for example, in an external device that requested the read that an error has occurred.
The processing described in FIG. 4, it is possible to only authorized controller 200 with valid device keys KD212 is obtained a semiconductor memory chip 100 common media key KM is an encryption key. Moreover, the processing described in FIG. 6, only the regular controller 200, it is possible to obtain a successfully decoded data by a common media key KM. That is, the authentication controller 200 can be realized by the semiconductor memory chip 100.
In this way, it is the combination of the encryption key sharing unit 120 and the sending control unit 130 of the semiconductor memory chip 100 is regarded as the authentication means for authenticating the controller 200. Area in the memory 110 of the semiconductor memory chip 100 for storing the data read by the authentication means, corresponds to the read special area.
The configuration of the encryption key sharing unit 120 and the encryption key sharing unit 210 is not limited to that shown in FIG. As long as it can share the encryption key with the semiconductor memory chip 100 and the controller 200 can be applied to any configuration.
Figure 7 is a block diagram showing a modification of the encryption key sharing unit 120 variant of (encryption key sharing unit 120-2) and the encryption key sharing unit 210 (the encryption key sharing unit 210-2). As shown in FIG. 7, the encryption key sharing unit 120-2, in addition to holding the media key KM and MKB 122, a random number generation unit 123, and a random number transmission unit 124, a temporary key generation unit 125. The encryption key sharing unit 210-2, a device key KD212, MKB reading unit 211, and in addition to the MKB processing unit 213, and a random number reception unit 214, a temporary key generation unit 215.
Random number generating unit 123 generates a random number in response to a request from the random number transmission unit 124. Random number transmission unit 124 transmits the generated random number, the random number reception unit 214 of the controller 200, and the temporary key generation unit 125 of the semiconductor memory chip 100. Temporary key generation unit 125 generates a temporary key K by using the media key KM and received random number. For example, the temporary key generation unit 125, by using a one-way function such as AES-G, to generate the temporary key K from the media key KM and the random number.
Random number reception unit 214 receives a random number from the random number transmission unit 124. Temporary key generation unit 215, in the same manner as the temporary key generation unit 125 of the semiconductor memory chip 100, and the media key KM received from the MKB processing unit 213, a temporary key K from the received random number by the random number reception unit 214 generated.
Also in the example of FIG. 7, the encryption key sharing unit 120-2 of the semiconductor memory chip 100 has authenticated the encryption key sharing unit 210-2 of the controller 200.
Next, will be described with reference to FIG encryption key sharing process for sharing an encryption key with the encryption key sharing unit 120-2 and the encryption key sharing unit 210-2 configured as in FIG. Figure 8 is a flow chart showing the overall flow of an encryption key sharing process of a modification of the first embodiment.
Step S301 ~ step S305 will be omitted because it is the same as steps S101 ~ step S105 of FIG.
In step S304, if the correct media key KM is determined to obtain (step S304: Yes), MKB processing unit 213 sends the obtained media key KM in the temporary key generation unit 215 (step S306). Next, the random number reception unit 214 of the encryption key sharing unit 210 of the controller 200 sends a random number transmission request to the random number transmission unit 124 of the semiconductor memory chip 100 (step S307). Random number transmission unit 124 sends a random number generation request to the random number generating unit 123 (step S308). Random number generating unit 123 generates a random number R (step S309). Random number transmission unit 124 receives the generated random number R, and transmits the random number R to the random number reception unit 214 of the controller 200 (step S310). Random number reception unit 214 of the controller 200 transfers the random number R received to the temporary key generation unit 215 of the controller 200 (step S311). Temporary key generation unit 215 generates a temporary key K from the media key KM and the random number R received from the MKB processing unit 213 (step S312). Further, the temporary key generation unit 215 sends the generated temporary key K to the reading control unit 220 of the controller 200 (step S313).
On the other hand, the random number transmission unit 124 sends the random number R to the temporary key generation unit 125 of the semiconductor memory chip 100 (step S314). Temporary key generation unit 125 which has received the random number R reads the media key KM the encryption key sharing unit 120 of the semiconductor memory chip 100 is stored in advance (step S315). The temporary key generation unit 125 generates a temporary key K in combination with the media key KM and the random number R (step S316). Further, the temporary key generation unit 125 sends the generated temporary key K to the sending control unit 130 of the semiconductor memory chip 100 (step S317).
MKB processing controller 200 is performed correctly, if the correct media key KM is generated, and the semiconductor memory chip 100 and the controller 200, the temporary key K to generate each independently the same.
Next, a modified example (sending control unit 130-2) of the transmission control unit 130 corresponding to the encryption key sharing unit 120-2 and the encryption key sharing unit 210-2 configured as in Figure 7 and the reading control unit 220 modification (read control section 220-2) will be described with reference to FIG. As shown in FIG. 9, sending control unit 130-2 includes a reading unit 132, and a cryptographic unit 133-2, and a sending unit 134. In this modification, the random number generating unit 131 is deleted, and the function of the encryption unit 133-2 is different from the transmission control unit 130 of FIG. Encrypting unit 133-2 are that encrypts the data using the temporary key K instead primarily media key KM is different from the encryption unit 133 of FIG.
Further, as shown in FIG. 9, the read control section 220-2, a data receiving unit 221, a decoding unit 222-2, and a error correction section 223. In this modification, the function of the decoding unit 222-2 is different from the read control unit 220 of FIG. Decoding unit 222-2 mainly points to decode the data using the temporary key K in place of the media key KM, it is different from the decoding unit 222 of FIG.
Will now be described with reference to FIG. 10 for the data read processing for transmitting and receiving the read data to and from the sending control unit 130-2 and the reading control unit 220-2 configured as in FIG. Figure 10 is a flow chart showing the overall flow of data reading process in the modification of the first embodiment.
When the decoding unit 222-2 of the read control section 220-2 receives the temporary key K from the encryption key sharing unit 210-2 (step S401), the decoding unit 222-2 holds the temporary key K received. Further, the data reception unit 221, with respect to delivery control unit 130-2 of the semiconductor memory chip 100, and sends the data transmission request with designation of the reading target page (step S402). Sending control unit 130 sends the specified data read instruction to be read out page reading unit 132 (step S403). Reading unit 132 reads the data D from the reading target page in the memory 110 (step S404).
On the other hand, the encryption unit 133-2 receives the temporary key K from the encryption key sharing unit 120-2 (step S405). Next, the encryption unit 133-2 encrypts data D using the temporary key K, to generate the encrypted data D '= Enc (K, D) (step S406). Incidentally, Enc (K, D) and means to encrypt the data D by using the temporary key K. Encrypting unit 133-2 sends the generated encrypted data D 'to the sending unit 134 (step S407).
Reading unit 132 reads the ECC data D from the code storage unit 111 of the memory 110 (step S408). Sending unit 134 holds the ECC read. Sending unit 134, and ECC that holds the encrypted data D ', and sends the data reception unit 221 of the reading control unit 220-2 (step S409).
Data receiving section 221, the sending unit 134 encrypts data D 'and receives the ECC, the encrypted data D' sent to the decoding unit 222-2 (step S410), and sends the ECC to the error correction section 223 (step S411). Error correction unit 223 holds the received ECC. Decoding unit 222-2, 'Upon receipt of the encrypted data D with the temporary key K held' encrypted data D decoded to obtain the data D (step S412). Next, the decoding unit 222-2 sends the decrypted data D to the error correction section 223 (step S413).
Step S414 ~ step S419 will be omitted because it is the same as steps S217 ~ step S222 of FIG. 6.
Next, another variation of the transmission control unit 130 and the read control unit 220 corresponds to the encryption key sharing unit 120-2 and the encryption key sharing unit 210-2 configured as in FIG. 7 (sending control unit 130-3 and reading control section 220-3) will be described with reference to FIG. 11. As shown in FIG. 11, sending control unit 130-3, a reading unit 132-3 includes an encryption unit 133-3, and a sending unit 134-3.
Reading unit 132-3, instead of the sending unit 134-3 the ECC read, and transmits the encryption unit 133-3. Encrypting unit 133-3 encrypts the data in which the data D and the ECC. Sending unit 134-3 sends the encrypted data in this manner to the reading control unit 220-3.
On the other hand, as shown in FIG. 11, the reading control unit 220-3, a data receiving unit 221-3, a decoder 222-3, and a error correction unit 223-3.
Data receiving unit 221-3 receives the encrypted data obtained by encrypting the data D and the ECC, and transmits the received encrypted data to the decoding unit 222-3. Decoding unit 222-3 obtains the data D and the ECC to restore the encrypted data, and transmits the error correction unit 223-3. Error correction unit 223-3, in this way using the ECC and the data D received from the decoding unit 222-3 are to perform error checking and error correction.
Will now be described with reference to FIG. 12 for the data read processing for transmitting and receiving the read data to and from the sending control unit 130-3 and the reading control unit 220-3 configured as in Figure 11. Figure 12 is a flow chart showing the overall flow of data reading process in another modification of the first embodiment.
When the decoding unit 222-3 of the read control unit 220 receives the temporary key K from the encryption key sharing unit 210-2 (step S501), the decoding unit 222-3 stores the temporary key K received. Further, the data reception unit 221-3, the delivery control unit 130-3 of the semiconductor memory chip 100, and sends the data transmission request with designation of the reading target page (step S502). Sending control unit 130-3 sends a data read instruction and the read page specified reading unit 132-3 (step S503). Reading unit 132-3 reads the data D for the specified reading target page of the memory (step S504). Further, the reading unit 132-3 reads the ECC of the read data D from the code storage unit 111 of the memory 110 (step S505). Next, the encryption unit 133-3 receives a temporary key K from the encryption key sharing unit 120-2 (step S506). Encrypting unit 133-3, connects the data D and the ECC using the temporary key K received (concatenate) data D || encrypted data D obtained by encrypting the ECC '= Enc (K, D || ECC ) (step S507). Then, the encryption unit 133-3 sends the encrypted data D 'to the sending unit 134 (step S508). Sending unit 134 sends the encrypted data D 'to the data receiving unit 221 of the read control unit 220 (step S509).
Data receiving section 221 'receives a corresponding encrypted data D' encrypted data D from the sending unit 134 sends to the decoding unit 222-3 (step S510). Decoding unit 222-3 are 'receives the encrypted data D with the temporary key K held' encrypted data D decoded to obtain the data D and the ECC (step S511). Decoding unit 222-3 sends the data D and the ECC in the error correction unit 223-3 (step S512).
Step S513 ~ step S518 will be omitted because it is the same as steps S217 ~ step S222 of FIG. 6 (steps S414 ~ step S419 of FIG. 10).
An encryption key sharing unit 120-2 of FIG. 7, a combination of one of the sending control unit 130-3 of the sending control unit 130-2 or 11 of FIG. 9, be regarded as the authentication means for authenticating the controller 200 can. Area in the memory 110 on the semiconductor memory chip 100 for storing the data read by these authentication means corresponds to the read special area.
In this way, by providing the authentication means for authenticating the controller 200 using the read special area, it is possible to prevent illegal use of data by forgery of the memory card.
Next, a configuration for implementing the authentication of the semiconductor memory chip 100 will be described below by writing device 300 using a write special area 113. With this configuration, it is possible to prevent illegal use of data by forgery of the memory card. The read function from the readout special area 112 (common area), and, if configured with both the write function to write the special area 113 (common region), trust the semiconductor memory chip 100 as described above it is possible to incorporate in the chain, it is possible to further improve the security function.
13, the write unit 300 to the controller 200 is connected, is a diagram showing a state where writing to the write special area 113 of the semiconductor memory chip 100. However, in FIG. 13, only the part related to the writing process is illustrated.
First, the writing unit 300 transmits the data requested to be written (write data) encrypted encrypted data, specifies the write destination page, and the ECC for the write data to the controller 200. Writing control unit 230 of the controller 200 sends the encrypted data and the ECC to the data converting unit 140 in the semiconductor memory chip 100. Data conversion unit 140 converts the encrypted data (decryption), writes the special area 113 writes transformed data obtained (write data), and writes the ECC in the code storage unit 111.
Then, the writing device 300 of FIG. 13, the write control unit 230 of the controller 200, and, an example of the configuration of the data converting unit 140 in the semiconductor memory chip 100 will be described with reference to FIG. 14. As shown in FIG. 14, the writing device 300, an ECC generating unit 310, a key storage unit 320, an encryption unit 330, and a data transmission unit 340.
ECC generator 310 generates an ECC write data input as data to be written. Key storage unit 320 stores the data conversion key (first key) used for converting the write data. In this embodiment, the key storage unit 320 stores the public key Kp of the public key system as the data conversion key. The public key Kp is a public key corresponding to the secret key Ks is key storage unit 141 of the semiconductor memory chip 100 (described later) data conversion key stored by the (second key).
In addition, the applicable encryption method is not limited to the public key system. In the following, it encrypts the write data writing device 300 using the data conversion key (public key Kp), the semiconductor memory chip 100 decodes the write data in the corresponding data conversion key (secret key Ks) describing a case of storing in the memory 110 as an example. It converts the data writing device 300 using the data conversion key (first key), the semiconductor memory chip 100 converts the converted data using a data conversion key corresponding to the first key (second key) as long as may be applied to other conversion methods. For example, the writing device 300 performs the conversion process corresponding to the decrypted using the first key, the semiconductor memory chip 100 performs the conversion process corresponding to the encrypted using the second key corresponding to the first key it may be configured to.
Encryption unit 330 encrypts the write data using the public key Kp. Also, the encryption unit 330 generates an encrypted code (transform coding) the ECC using the public key Kp. In the following, the write data encrypted called encrypted data, may be referred to encrypt ECC conversion code obtained by encrypting the ECC. Data transmission unit 340 transmits the encrypted data, and encryption ECC, and a designation of the write destination page to the writing control section 230 of the controller 200.
Next, a configuration example of the writing control unit 230 of the controller 200. As shown in FIG. 14, the write control unit 230 includes a data transfer unit 231. Data transfer unit 231 receives the encrypted data, and encryption ECC, and a write destination page specification, and transmits the information to the data converting unit 140 in the semiconductor memory chip 100.
Next, configuration examples of the data conversion unit 140. As shown in FIG. 14, the data converter 140, a key storage unit 141, a decoder 142, and a writing unit 143.
The key storage unit 141 stores the secret key Ks of the public key system. Decoding unit 142 decodes the encrypted data and the encrypted ECC by using the secret key Ks of the key storage unit 141. Incidentally, the write data decoded from the encrypted data corresponds to the conversion data. Writing section 143 records the decoded write data to the specified page of the writing special area 113 in the memory 110. The writing unit 143 stores the decoded ECC in the code storage unit 111 of the memory 110.
Next, configured writing device 300 as shown in FIG. 14, the write control unit 230, and the writing process of the write data by the data converting unit 140 will be described with reference to FIG. 15. Figure 15 is a flow chart showing the overall flow of the writing process in the first embodiment.
The write device 300 inputs a designation of the write destination page and write data (data D) (step S601). Next, ECC generator 310 generates a ECC data D, the generated and the ECC and the data D is transferred to the encryption unit 330 (step S602). Encryption unit 330 obtains the public key Kp from the key storage unit 320 (step S603). Next, the encryption unit 330, a public key Kp, encrypts the data D and the ECC, to obtain an encrypted ECC encrypted data D '(step S604). Encryption unit 330 sends the encrypted ECC to the data transmitting unit 340 and the encrypted data D '(step S605). Data transmission unit 340, the encrypted data D ', designated write destination page, and transmits the encrypted ECC to the writing control section 230 of the controller 200 (step S606).
Data transfer unit 231 of the write control unit 230, the encrypted data D ', the write destination page designation, and receives the encrypted ECC, and transmits them to the data conversion unit 140 of the semiconductor memory chip 100 (step S607 ).
Encrypted data D 'and the encrypted ECC data conversion unit 140 has received is input to the decoding unit 142. Decoding unit 142 obtains the secret key Ks from the key storage unit 141 (step S608). The decryption unit 142 decrypts the encrypted data D 'and the encrypted ECC by using the secret key Ks, obtaining data D and ECC (step S609). Next, the writing unit 143 records the decoded data D, and the pages in the memory 110 specified by the write destination page specified. The writing unit 143, the decoded ECC, as ECC corresponding to the designated page is stored in the code storage unit 111 of the memory 110 (step S610).
Note that the encryption and decryption according to the public key requires a large amount of calculation. Page size is on the order of, for example, about 2KB, but the data actually written is a small data such as encryption key (for example, about 16B). Thus, in particular, to avoid the load of decoding in the semiconductor memory chip 100, for example, may be performed as follows devised. That may be configured to only encrypting and decrypting minimal data. Figure 16 is a diagram showing a state of a change of data in the case of such a configuration.
First, as an example, the page size 2048 B, size 16B of the write data, and 3B the size of ECC. The ECC generating unit 310, and inputs a page of data consisting of 0 key data + remainder 2032B of the head 16B (1601). Encryption unit 330, after recording the 3B ECC from 17B th data of one page, the head 20B only encryption performed (1602). Decoding unit 142, after decoding only the head 20B (1603), stores 3B from 17B th data of one page in the code storage section 111 as ECC (1604). Then, after overwriting the 17B eyes and 3B at 0, the data of one page to write the special area 113 in the memory 110 is recorded (1605).
Data writing to the writing special area 113 is always performed via the data conversion unit 140 of the semiconductor memory chip 100. In this embodiment, when the data D is input to the writing unit 300, ECC (D) is ECC for data D and the data D, the writing device 300 is encrypted with the public key Kp to hold. Then, the data conversion unit 140 of the semiconductor memory chip 100, the encrypted data D '= Enc (Kp, D) and the encrypted ECC = Enc (Kp, ECC (D)) and are input.
Data D is recorded correctly writing special area 113, and, for the code storage unit 111 ECC (D) is recorded correctly, the semiconductor memory chip 100 needs to hold a secret key Ks. That is, the writing unit 300 is authenticating the semiconductor memory chip 100. Memory area to be written via the data conversion unit 140 described above corresponds to the writing special area 113.
Then, the data conversion unit 140 of FIG. 14, the write control unit 230, and, a modified example of the writing device 300 will be described with reference to FIG. 17. Figure 17 is a writing device 300-2 according to this modification, the writing control unit 230-2, and is a block diagram showing an example of the configuration of the data conversion unit 140-2.
As shown in FIG. 17, the writing device 300-2, the ECC generation unit 310-2, and the key storage unit 320-2, an encryption unit 330-2, a data transmission unit 340, a key selecting unit 350, It is equipped with a. Function of the data transmission unit 340 is the same as FIG. 14, the description given the same reference numerals will be omitted.
ECC generation unit 310-2, instead of the encrypting unit 330-2 the generated ECC, the point to be transmitted to the data transmission unit 340 is different from the ECC generation unit 310 of FIG. 14.
Key storage unit 320-2 stores the encryption key K is data conversion key of a symmetric key system. In this modification, the key storage unit 320-2 stores a plurality of encryption keys K for each version of the semiconductor memory chip 100. Figure 18 is a diagram illustrating an example of a data structure of data stored in the key storage unit 320-2. As shown in FIG. 18, the key storage unit 320-2 stores the version of the semiconductor memory chip 100, data that associates an encryption key.
Returning to Figure 17, the key selecting unit 350 selects the encryption key K matches the version of the semiconductor memory chip 100 from the key storage unit 320-2. Encrypting unit 330-2 encrypts the write data and the ECC using the selected encryption key K.
Next, a configuration example of the writing control unit 230-2. As shown in FIG. 17, the write control section 230-2 includes a data transfer unit 231-2. Data transfer unit 231-2, that the function of transferring the version information read from the semiconductor memory chip 100 in response to a request from the key selection unit 350 is added, different from the data transfer unit 231 of FIG. 14 there.
Next, configuration examples of the data conversion unit 140-2. As shown in FIG. 17, the data converter 140, a key storage unit 141-2, a decoder 142, and a writing unit 143, and a version information storage unit 144. Data conversion section 140, decoding section 142 and the function of the writing unit 143 is the same as FIG. 14, the description given the same reference numerals will be omitted.
Version information storage section 144 stores the version information of the semiconductor memory chip 100. Key storage unit 141-2 stores the encryption key K of the symmetric key system. The encryption key K is an encryption key version information storing unit 144 of the semiconductor memory chip 100 corresponds to the version information stored.
Next, it configured writing device as shown in FIG. 17 300-2, the write control unit 230-2, and the writing process of the write data by the data conversion unit 140-2 will be described with reference to FIG. 19. Figure 19 is a flow chart showing the overall flow of the writing process in this modification.
Writing device 300-2 inputs a designation of the write destination page and write data (data D) (step S701). ECC generation unit 310-2 generates ECC data D, and transfers the generated ECC to the data transmission unit 340 (step S702). Further, ECC generation unit 310-2 transfers the data D to the encryption unit 330 (step S703). Next, the encryption unit 330-2 sends a cryptographic key acquisition request to the key selecting unit 350 (step S704).
In this embodiment, the encryption key corresponds to the version of the semiconductor memory chip 100. Version is also different encryption keys for different. Key storage unit 320-2 of the writing device 300 is stored an encryption key for each version of the semiconductor memory chip 100, no encryption key is obtained and a corresponding version of the semiconductor memory chip 100 is not known.
Therefore, the key selecting unit 350, when receiving the encryption key acquisition request from the encryption unit 330-2 sends a version acquisition request to the controller 200 (step S705). Controller 200, the version information storage unit 144 of the data conversion unit 140 of the semiconductor memory chip 100, reads the version information of the semiconductor memory chip 100 is input to the data transfer unit 231 (step S706). Data transfer unit 231 transmits the version information to the key selecting unit 350 of the writing device 300 (step S707). The key selection unit 350 selects the encryption key K corresponding to the received version information from the key storage unit 320-2 (Step S 708). Then, the key selecting unit 350 transmits the encryption key K selected in the encryption unit 330-2 (step S709).
Encrypting unit 330-2 uses the transmitted encryption key K, encrypts the data (data D) to be written to obtain the encrypted data D '(step S710). Encrypting unit 330-2 sends the encrypted data D 'to the data transmission unit 340 (step S711). Data transmission unit 340, the encrypted data D ', designated write destination page, and the ECC, and transmits to the write control section 230-2 of the controller 200 (step S712). Data transfer unit 231-2 of the writing control unit 230-2, the encrypted data D ', receives the write destination page specification, and the ECC (step S713), the data conversion unit thereof a semiconductor memory chip 100 140- and it transmits to 2 (step S714).
Data conversion section 140-2, and inputs the received encrypted data D 'to the decrypting unit 142 (step S715). Decoding unit 142 obtains the encryption key K from the key storage unit 141-2 (step S716). Decoding unit 142 uses the encryption key K, to decrypt the encrypted data D 'to data D (step S717). Writing section 143 records the decoded data D, and the pages in the memory 110 specified by the write destination page designated (step S718). The writing unit 143 stores the received ECC, the code storage section 111 as ECC corresponding to the designated page (step S719).
Data recording to the memory area to be recorded via the data conversion unit 140-2 of FIG. 17 is always subjected to conversion by the data conversion unit 140-2. Area in which data is recorded via the data conversion unit 140-2 corresponds to the writing special area 113.
If data D is input to the writing unit 300, the data D is encrypted with the encryption key K selected for the version of the semiconductor memory chip 100. Then, the data conversion unit 140-2 of the semiconductor memory chip 100, the encrypted data D '= Enc (K, D) is input. For data D is recorded correctly writing special area 113 is a semiconductor memory chip 100 needs to hold the encryption key K. That is, also in this case, the writing unit 300 is authenticating the semiconductor memory chip 100.
Read the special region, the semiconductor memory chip 100 is used to authenticate the controller 200. On the other hand, the writing special area is used for writing apparatus 300 authenticates the semiconductor memory chip 100. Here Recall the trust chain of Figure 1. From the writing device 300, the semiconductor memory chip 100, to configure the trust chain that controller 200 reads the special area and the writing special area you need to have a communion. That is, by the data recorded in the area of ​​the intersection (common region) is read by the (intended to streets of the writing device 300) the controller 200 correctly, so that the trust chain is completed. Hereinafter also referred to as intersection area (common area) simply special area of ​​reading special area and the writing special area.
In the example of FIG. 18, but the version information it had been a simple numerical, but not the version information is not limited thereto. Further, according to one or more information than the version information and the version information may be configured to select an encryption key corresponding plurality of encryption keys. For example, timing of the semiconductor memory chip 100 is manufactured, or, based on the lot number at the time of production may be determined version information.
Also, version information is not limited to the numerical values. For example, a character string, or may be a sequence consisting of permutations, such as numbers and strings. Figure 20 is a diagram showing a modification of the configuration version information in this way. In Figure 20, manufacturing factory name of the semiconductor memory chip 100, the lot number which is managed in the manufacturing plant, and examples of the permutations of customer number and the version information is shown. Here, the customer number, for example, the manufacturer of the semiconductor memory chip 100 is a number assigned to the large of consumers. The product is not a large consumer-friendly, and this number fixed value (for example, 0). Correspondence table as shown in FIG. 20 is stored in the key storage unit 320-2 of the writing device 300.
Thus, a semiconductor memory chip according to the first embodiment is constructed in memory and the same die, and includes an encryption key sharing unit and sending control unit which functions as an authentication means for authenticating the controller. Then, only authenticated controller, data stored in the memory can be read out correctly. Also configured in the memory and the same die, and a data conversion section for storing in a memory by decoding the data by the key storage unit and the encryption key storing predetermined encryption key. Then, unable to properly record the data must not hold the correct encryption key. Thus, it is possible to prevent illegal use of data by forgery of the memory card.
In the first embodiment, it has been decoded write data before writing to the writing special area. In contrast, the semiconductor memory chip according to the second embodiment decodes the data read from the writing special area (write data encrypted). In this case, in order to read data from the writing special area is decoded correctly, the writing device needs to hold the encryption key corresponding to the encryption key used to encrypt the semiconductor memory chip. That is, also in this case, the writing device is authenticating semiconductor memory chips.
Figure 21 is a block diagram showing an example of the configuration of a semiconductor memory chip 2100 to the second embodiment. Note that the controller 200 has the same configuration as the first embodiment. As shown in FIG. 21, the semiconductor memory chip 2100 includes a memory 2110, an encryption key sharing unit 120, a sending control unit 2130, a data conversion section 2140, a reception control unit 2150, and a reading unit 2160 .
One difference from the first embodiment is the position of the data conversion unit 140. As shown in FIG. 2, in the first embodiment, the data conversion (decoding) is carried out during the writing, in the second embodiment is performed during a read. In addition, in the second embodiment, the configuration of the memory 2110 and sending control unit 2130, it was added the reception control unit 2150 and the reading unit 2160 is different from the first embodiment. Other configurations and functions are the same as in FIG. 2 is a block diagram illustrating a configuration of a semiconductor memory chip 100 according to the first embodiment are denoted by the same reference numerals, and description thereof is omitted here.
Sending control unit 2130, the reading unit 132 is deleted is different from the transmission control unit 130 of FIG. Incidentally, sending control unit 2130, instead of the reading unit 132 inputs the read data read by the reading unit 2160, and inputs the converted data by the data conversion unit 140.
Memory 2110 includes a code storage unit 111, a common region 2114, and a general area 115. In the second embodiment, the writing special area, of the memory area when the data read, a memory area predefined data undergoing decryption by the data conversion section 2140 is written. In the second embodiment, when the data read, decoded data by the data conversion unit 2140 is inputted to the sending control unit 2130, authentication controller 200 is performed. Therefore, a write special area where data to undergo decoding by the data converting unit 2140 is written, and read the special areas only authorized controller 200 can read the data correctly matches. Therefore, in FIG. 21 shows only the common area 2114 in the memory 2110.
Reception control unit 2150, the write data controls the processing of writing in the common area 2114 without receiving and decoding encrypted data that is encrypted.
Reading unit 2160 reads the data of the page read is designated read from the special area (common area 2114), and transmits to the data conversion section 2140. Further, the reading unit 2160 reads the ECC corresponding to the data of the designated page from the code storage unit 111, and transmits to the sending control unit 2130.
It will now be described with reference to FIG. 22 example of the configuration of the writing device 2300 configuration example and the second embodiment of the reception control unit 2150 of FIG. 21. In FIG. 22, only the part related to the writing process is illustrated.
First, the configuration of the writing device 2300. As shown in FIG. 22, the writing device 2300, an ECC generating unit 2310, a key storage unit 320, an encryption unit 2330, and a data transmission unit 2340. Key storage unit 320 are denoted by the same reference numerals for the same configuration as the key storage unit 320 of FIG. 14, the description thereof is omitted.
ECC generation unit 2310 generates the ECC of the write data is input as data to be written. Encryption unit 2330 encrypts the write data using the public key Kp. Data transmission unit 2340 transmits the encrypted data, and ECC, and a designation of the write destination page to the writing control section 230 of the controller 200.
Next, a configuration of the reception control unit 2150. As shown in FIG. 22, the reception control unit 2150 is provided with a writing unit 2143. Writing unit 2143 records the encrypted data in the designated page of the common region 2114. The writing unit 2143 stores the ECC in the code storage unit 111.
Next, it configured writing device 2300 as shown in FIG. 22, the write control unit 230, and will be described with reference to FIG. 23 for the writing of a write data by the reception control unit 2150. Figure 23 is a flow chart showing the overall flow of the writing process in the second embodiment.
Writing device 2300 inputs a designation of the write destination page and write data (data D) (step S801). Writing device 2300 inputs the input data D to the ECC generation unit 2310 (step S802). Next, ECC generation unit 2310 generates ECC data D, and transfers the generated ECC to the data transmission unit 2340 (step S803). Further, ECC generation unit 2310 transfers the data D to the encryption unit 2330 (step S804).
Encryption unit 2330 obtains the public key Kp from the key storage unit 320 (step S805). Also, the encryption unit 2330 encrypts the data D by the acquired public key Kp, to obtain the encrypted data D '(step S806). Next, the encryption unit 2330 sends the encrypted data D 'to the data transmission unit 2340 (step S807). Data transmission unit 340, the encrypted data D ', designated write destination page, and the ECC, and transmits to the write control unit 230 of the controller 200 (step S808).
Data transfer unit 231 of the write control unit 230, the encrypted data D ', the write destination page designation, and receives the ECC (step S809), and transmits them to the reception control unit 2150 of the semiconductor memory chip 100 ( step S810).
Reception control unit 2150 inputs the encrypted data D 'and a write destination page designation to the writing unit 2143 (step S811). Writing unit 2143, the encrypted data D 'input is recorded in the page in the memory 110 specified by the write destination page designated (step S812). The reception control unit 2150, the ECC, as ECC corresponding to the designated page is stored in the code storage section 111 (step S813).
Thus, in this embodiment, when the data D is input to the writing unit 2300, the data D, the writing device 2300 is encrypted with the public key Kp to hold. Then, the reception control unit 2150 of the semiconductor memory chip 100, the encrypted data D '= Enc (Kp, D) and a ECC (D) on the data D is input. As a result, data Enc (Kp, D) to write special area (common area 2114) is recorded, ECC (D) is recorded in the code storage unit 111.
It will now be described with reference to FIG. 24 for configuration of the data conversion unit 2140 in FIG. 21. As shown in FIG. 24, the data conversion section 2140 includes a key storage unit 141, a decoding unit 2142. Structure and function of the key storage unit 141 are denoted by the same reference numerals are the same as in FIG. 14, the description thereof is omitted. Decoding unit 2142, the data read by the reading unit 2160, decrypts using the private key Ks stored in the key storage unit 141.
Will now be described with reference to FIG. 25 for the data reading process performed by the data conversion unit 2140 is configured as shown in FIG 24. Figure 25 is a flow chart showing the overall flow of data reading process in the second embodiment.
First, the controller 200 inputs the specified page to be read from an external device such as a reproducing apparatus (step S901). Read control unit 220 of the controller 200, the semiconductor memory chip 100, and sends a read instruction for reading data specified page in the memory 110 (step S902). Reading unit 2160 of the semiconductor memory chip 100 reads out the data of the read designated page is input to data converter 2140 (step S903). Further, the reading unit 2160 sends the sending control unit 2130 reads the ECC corresponding to the read specified page from the code storage unit 111 (step S904).
In this embodiment as described above, to write to the common area 2114 without decrypting the encrypted data, read data is encrypted. Hereinafter, representative of the read data to the data D '.
Data converting unit 2140 is input to the decoding unit 2142 the input data D '(step S905). Decoding unit 2142 obtains the secret key Ks from the key storage unit 141 (step S906). Decoding unit 2142 decodes the data D 'which is input by using the secret key Ks acquired, obtaining data D (step S907). Then, decoding section 2142 sends the decoded data D to the sending control unit 2130 (step S908).
Sending control unit 2130 sends the ECC read from the data conversion unit 2140 and the decoded data D received from the code storage unit 111 in the reading control unit 220 of the controller 200 (step S909). The subsequent processing is similar to step S212 onward in FIG 6, are omitted in FIG. 25.
In the present embodiment, the data read from the write special area (common area 2114) is always performed via the data conversion unit 2140 of the semiconductor memory chip 100. By writing the above, a write special area data reading target page in the (common region 2114) is Enc (Kp, D), as ECC of the page, the ECC (D) is recorded in the code storage unit 111 to. In this case, data sent from the data conversion section 2140 of the semiconductor memory chip 100 to the sending control unit 2130 Dec (Ks, Enc (Kp, D)) = a D. Then, the controller 200 will receive the data D and the ECC (D). Here, the Dec (A, B), indicating that the decoded data B by the key A to be used for decoding.
Thus, the writing device 300 is Enc (Kp, D) when the writing and the ECC (D), in order to correctly receive and ECC (D) the controller 200 corresponding to the desired data D, the semiconductor memory chip 100 and there is a need to be stored in the secret key Ks. That is, also in this case, the writing unit 300 is authenticating the semiconductor memory chip 100. Memory area to be read via the data conversion unit 2140 of the above corresponds to the writing special area in this embodiment.
Thus, in the memory chip according to the second embodiment is constructed in memory and the same die, the data conversion for decoding the data read from the key storage unit and a memory for storing a predetermined encryption key by the encryption key and a part. And, you can not restore the data that has been written if not hold the correct encryption key correctly. Thus, it is possible to prevent illegal use of data by forgery of the memory card.
As described in the first and second embodiments, the write data into the special area (= common region) by the writing apparatus, the controller from the special area by reading the data, the trust chain is constructed. Whether data written in the special area has been correctly read by the controller by writing device, in fact, the data available, such as reproduction of the content is judged by whether it can successfully.
In a third embodiment, an embodiment of the specific data usage data, including devices that utilize (player, etc.) in the semiconductor memory chip of the embodiment.
Figure 26 is a third player 400 and the player 400 is a device that utilizes data in the embodiment of a block diagram showing an example of the configuration of a memory card 2501 to read data.
As shown in FIG. 26, the memory card 2501 includes a semiconductor memory chip 100 and the controller 200. The semiconductor memory chip 100 and the controller 200 includes a structure described in the first embodiment or the second embodiment. For example, the controller 200 of FIG. 26, for example, includes a read control unit 220 of the encryption key sharing unit 210 and FIG. 5 in FIG. Memory card 2501, for example, can be configured by such as an SD memory card.
In the third embodiment, the encrypted video data 2541, the encryption decryption key decryption key Kc is encrypted to be used to decrypt the encrypted video data 2541 2531, and, MKB2521 (hereinafter, simply referred to as MKB) but it recorded in the general area 115 in the memory 110 of the semiconductor memory chip 100. The media key conversion key 2511 (hereinafter referred to as the media key conversion key KT) is stored in the special area of ​​the memory 110 (common region 114).
Decryption key Kc is recorded as an encrypted decryption key 2531 which is encrypted. Key used for this encryption is one in which the media key KM derived when MKB is processed correctly, was transformed using the media key conversion key KT. For example, the encryption decryption key 2531 = AES-E (AES-G (KT, KM), Kc). In this example, using AES-G, a is a one-way function to transform, are used AES-E encryption.
Player 400, KD410 (hereinafter, referred to as the device key KD) representing a device key holds the, the MKB processing unit 420, a media key conversion unit 430, a key decryption unit 440, a video decoding unit 450, the playback unit 460 It is equipped with a door.
MKB processing unit 420 performs the MKB process of deriving a media key KM by treatment with an MKB read from the general area 115 of the device key KD. Media key conversion unit 430, the derived media key KM, generates a key Kw obtained by conversion using the media key conversion key KT read from the special area. The key decryption unit 440, a decryption key 2531 that has been read from the general area 115 to generate a decryption key Kc by decrypting the key Kw. Video decoding unit 450 decodes the encrypted video data by using the decryption key Kc. Reproducing unit 460 reproduces the decoded video data.
It will now be described with reference to FIG. 27 for reproduction of the data in the memory card 2501 by the configured player 400 as shown in FIG. 26. Figure 27 is a flowchart showing the entire flow of the reproducing process according to the third embodiment.
Player 400 instructs the controller 200 in the memory card 2501, a reading of the MKB contained in the general area 115 (Step S1001). For example, the player 400 specifies the start address and size of the MKB respect controller 200.
Controller 200 reads a page containing a specified area from the semiconductor memory chip 100, and sends data of the designated area (i.e. the value of MKB) to the player 400. Player 400 inputs an MKB received the MKB processing unit 420 (step S1002). MKB processing unit 420 reads the device key KD players 400 is holding, and MKB processing using the device key KD the input MKB, and outputs derive the media key KM (step S1003).
Then, the MKB processing unit 420 determines whether the media key KM has been obtained by the MKB processing (step S1004). If the device key KD has been disabled by the MKB, MKB processing unit 420 is not able to derive the correct media key KM. In this case, MKB processing unit 420 determines that the media key KM has not been obtained (step S1004: No), outputs an error. Incidentally, when an error is output from the MKB processing unit 420, the player 400 stops operating and displays a warning message.
If the media key KM has been obtained (step S1004: Yes), the player 400 sends the media key KM to the media key conversion unit 430 (step S1005). Then, the player 400 instructs the reading of the media key conversion key KT contained in the special area (common area 114) (step S1006). For example, the player 400, to specify the start address and size of the media key conversion key KT to the controller 200.
Controller 200 reads a page containing a specified area from the semiconductor memory chip 100, and sends data of the designated area (i.e. the value of the media key conversion key KT) to the player 400. Player 400 inputs the values ​​of the media key conversion key KT received from the controller 200 to the media key conversion unit 430.
Media key transformation unit 430 obtains a converted media key KM with the entered media key conversion key KT key Kw = AES-G (KT, KM) (step S1007). Player 400 sends the value of the key Kw to the key decrypting unit 440.
Then, the player 400, via the controller 200, reads the encrypted decryption key 2531 from the general area 115 of the semiconductor memory chip 100 (step S1008). For example, the player 400 specifies the start address and size of the encrypted decryption key 2531 to the controller 200.
Controller 200 reads a page containing the general region 115 is specified from the area, and sends the data of the designated area (i.e. the value of the decryption key 2531) to the player 400. Player 400 inputs the value of the decryption key 2531 received from the controller 200 to the key decryption unit 440.
The key decryption unit 440, a decryption key 2531 that is input is decrypted with key Kw (step S1009). Thus, the value of the decryption key Kc is obtained. Formula to obtain a decryption key Kc is expressed by the following equation (1).
Dec (Kw, encryption and decryption key)
= Dec (Kw, Enc (AES-G (KT, KM), Kc))
= Dec (Kw, Enc (Kw, Kc))
= Kc ··· (1)
The key decryption unit 440 sends the value of the decryption key Kc to the video decoding unit 450 (Step S1010). Video decoding unit 450 holds the value of the decryption key Kc received.
Then, the player 400, via the controller 200, reads the sequentially encrypted video data from the general area 115, sequentially inputted to the video decoding unit 450 (Step S1011). Video decoding unit 450 sequentially decrypts the encrypted video data by using the decryption key Kc (step S1012), and sends to the reproduction section 460 (step S1013). Reproducing unit 460 sequentially reproduces (displays) the received video data (step S1014).
Media key conversion key KT is data necessary to obtain the correct content decryption key (decryption key Kc). This value, for example, may be different in the semiconductor memory chip every 100. Or, it may be different for each memory card 2501. Furthermore, it may be statistically different for each memory card 2501. Differs from the statistical, there are cases that do not strictly different values, which means that regarded as statistically different. For example number of digits to generate a very large random number, it corresponds the case of using the value of the random number.
If the media key conversion key KT to be recorded in the special area is different for each memory card 2501 (at least statistically), the media key conversion key KT can be regarded as a kind of ID of the memory card 2501. Incidentally, as the data necessary for the decoding the encrypted content data (such as video data) may be configured to store the MKB in place of the media key conversion key KT.
The media key conversion key KT properly recorded in writing special area of ​​the semiconductor memory chip 100, the semiconductor memory chip 100 has to be authenticated by the writing device 300. Player 400, a media key conversion key KT recorded in the reading special area, in order to be able to correctly read via the controller 200, the controller 200 must be authenticated by the semiconductor memory chip 100. After all, writing device 300 if it is not trust chain is established to authenticate the controller 200 via the semiconductor memory chip 100, the player 400 can not read the media key conversion key KT correctly. In other words, with the playback of the video by the player 400, good as a trust chain establishment of proof.
Incidentally, MKB in the third embodiment, the supplier of the video may be supplied for each video. Generally, MKB is is configured by using the symmetric key cryptography, in which case, it is preferable to be constituted by using a public key encryption. The reason for this will be described below.
For MKB constructed using the symmetric key cryptography, to generally generate an MKB needs to know the values ​​of all the device keys KD. In order to perform the generation of the MKB to the video supplier, it is necessary to provide the values ​​of all the device keys KD in the video supplier. If the value of this device key KD has been leaked to malicious player manufacturer, disable your player MKB is virtually meaningless. Be disabled by using the MKB malicious or bad players, bad faith of the player manufacturer, can be using the device key KD that is not disabled, continue to manufacture a malicious or bad players in how much This is because it is.
There, there is a merit that constitute the MKB using the public key encryption. When using a public key encryption, the device key KD is configured with a secret key. Players manufacturer, only know the value of the player manufacturer assigned device key KD. On the other hand, the video supplier, to distribute a public key for MKB generation. Video supplier, it is possible to freely produce the MKB by using the public key. On the other hand, even if the public key for the MKB generation is leaked to malicious player manufacturer, from the basic nature of public-key cryptography, it is not possible to know the value of the device key KD that are configured with a secret key. Thus, it may be a MKB MKB is constructed on the basis of public key cryptography in FIG.
Thus, in the third embodiment, stores the encrypted data in the general area, and stores data necessary for decrypting the encrypted data in the special area, the encrypted data by using the data of the special area It can be used to decrypt the. Thereby, revoke playback devices by the content provider can be realized.
In the fourth embodiment, and disabling controller by MKB associated with content, an embodiment in which combination of the individualization of each memory card of encrypted video data will be described.
Figure 28 is a block diagram showing an example of a configuration of a fourth embodiment of the player 400-2 and the memory card 2601.
As shown in FIG. 28, the memory card 2601 includes a semiconductor memory chip 100 and the controller 200-2. The semiconductor memory chip 100 has a structure described in the first embodiment or the second embodiment.
In the fourth embodiment, the encrypted video data 2541, MKB2521-2 encrypted (hereinafter, MKB 'hereinafter) and MKB2522 (hereinafter, MKB2 hereinafter) is recorded in the general area 115. The storage from MKB 'MKB decryption key 2513 for decrypting the MKB (hereinafter, MKB referred decryption key KT) and the media key conversion key 2512 (hereinafter referred to as the media key conversion key KT2) is in the special area (common area 114) It is. Thus, in this embodiment, in place of the media key conversion key 2511 (media key conversion key KT), and a MKB decryption key KT to be used in decoding the MKB.
Next, a configuration example of a controller 200-2. Controller 200-2 of the present embodiment, in addition to the configuration of the controller 200 of the first or second embodiment, the device key KD2610 (hereinafter, referred to as the device key KD2) and, the MKB processing unit 2620, the media key a converting unit 2630, and a video decoding unit 2640. In FIG. 28, components described in the first or second embodiment is omitted, but the controller 200-2, for example, the encryption key sharing unit 210-2 of FIG. 7 and FIG. 11 and it includes a read control unit 220-3 of the. Then, the read is stored in the special area, MKB decryption key KT and reading of media key conversion key KT2 is performed using an encryption key sharing unit 210-2 and the reading control unit 220-3.
MKB processing unit 2620 performs the MKB process of deriving the media key KM2 by treating the general area 115 read from MKB2 using the device key KD2. Media key conversion unit 2630, the media key KM2 derived, to generate a decryption key Kc2 converted using the media key conversion key KT2 read from the special area. Video decoding unit 2640 decodes the encrypted video data by using the decryption key Kc2.
Next, a configuration example of a player 400-2. Players 400-2, a device key 410 (hereinafter, referred to as the device key KD) holds the, the MKB processing unit 420-2, a video decoding unit 450, a reproducing unit 460, includes a MKB decoding unit 470, the there.
In the fourth embodiment, the MKB decoding unit 470 is added, the function of the MKB processing unit 420-2, and that key decryption unit 440 and the media key conversion unit 430 is deleted, the third embodiment of the It is different from the form of the player 400.
MKB decoding unit 470 generates the MKB the general area 115 from the read MKB 'by decoding an MKB decryption key KT. MKB processing unit 420-2 performs MKB processing to derive the media key KM by treatment with the generated MKB the device key KD.
As described above, in this embodiment, the general area 115 two MKB (MKB 'and MKB2 encrypted the MKB) is recorded. MKB decoding the MKB 'is used for authentication and disabling Similarly players 400-2 in the third embodiment. Meanwhile, MKB2 is used for authentication and disabling controller 200.
Further, in the present embodiment, the special area (common area 114) stores the MKB decryption key KT and the media key conversion key KT2. MKB decryption key KT is a MKB decryption key for the player 400-2. Media key conversion key KT2 is a media key conversion key for the controller 200. These keys may be different for each memory card 2601. The relationship between the key and the data is as follows.
(1) When MKB is treated with the device key KD not invalidated the media key KM is obtained. Also, the media key KM2 is obtained upon treatment with the device key KD2 not invalidated the MKB2.
(2) 'When the video data C is doubly encrypted with the decryption key Kc2 the media key KM: C' (the plaintext) video data C, the encrypted video data C = AES-E ( Kc2, AES-E (KM, C)).
(3) MKB is MKB 'obtained by decoding the at MKB decryption key KT: MKB = AES-D (KT, MKB').
(4) decoding key Kc2 is obtained by converting the media key KM2 in the media key conversion key KT2: Kc2 = AES-G (KT2, KM2).
(5) the decoding process of the encrypted video data C 'is as follows:
AES-D (KM, AES-D (Kc2, C '))
= AES-D (KM, AES-D (Kc2, AES-E (Kc2, AES-E (KM, C))))
= AES-D (KM, AES-E (KM, C))
It will now be described with reference to FIG. 29 for reproduction of the data in the memory card 2601 by the configured player 400-2 as shown in Figure 28. Figure 29 is a flowchart showing the entire flow of the reproducing process according to the fourth embodiment.
Players 400-2 instructs the controller 200-2 in the memory card 2601, a reading of contained in the general area 115 MKB2 (step S1101). For example, the player 400-2 specifies a start address and size of the MKB2 respect controller 200-2.
Controller 200-2 reads a page containing a specified area from the semiconductor memory chip 100, and inputs data of the designated area (i.e. the value of MKB2) the MKB processing unit 2620 (step S1102). MKB processing unit 2620 reads the device key KD2 the controller 200-2 holds the MKB2 entered using the device key KD2 to MKB processing, and outputs to derive the media key KM2 (step S1103).
Then, the MKB processing unit 2620 determines whether the media key KM2 is obtained by the MKB processing (step S1104). If the device key KD has been disabled by the MKB2, MKB processing unit 2620 is not able to derive the correct media key KM2. In this case, MKB processing unit 2620 determines that the media key KM2 is not obtained (step S1104: No), outputs an error.
If the media key KM2 is obtained (step S1104: Yes), MKB processing unit 2620 sends the media key KM2 to the media key conversion unit 2630 (Step S1105). Media key conversion unit 2630 reads the media key conversion key KT2 contained in the special area (common area 114) (step S1106). Then, the media key conversion unit 2630 generates a decryption key Kc2 obtained by converting the media key KM2 in the media key conversion key KT2 read (step S1107). Media key conversion unit 2630 transmits the generated decryption key Kc2 the video decoding unit 2640 (Step S1108). Video decoding unit 2640 holds the value of the decryption key Kc received.
Next, the player 400-2 reads the MKB 'from the general area 115 of the semiconductor memory chip 100 via the controller 200-2, and inputs the MKB decrypting unit 470 (step S1109). MKB decrypting unit 470 reads the MKB decryption key KT from the special area of ​​the semiconductor memory chip 100 (common region 114) via a controller 200-2 (step S1110). Next, MKB decoding unit 470 uses the read MKB decryption key KT, decrypts the input MKB ', obtaining the MKB plaintext (step S1111). MKB decoding unit 470 sends the MKB plaintext to the MKB processing unit 420-2 (step S1112).
MKB processing unit 420-2 reads out the device key KD players 400-2 is holding, and MKB processing using the device key KD the input MKB, derives the media key KM (step S1113).
Then, the MKB processing unit 420-2 determines whether the media key KM has been obtained by the MKB processing (step S1114). If the device key KD has been disabled by the MKB, MKB processing unit 420-2 is not able to derive the correct media key KM. In this case, MKB processing unit 420-2 determines that the media key KM has not been obtained (step S1114: No), outputs an error. If the media key KM has been obtained (step S1114: Yes), MKB processing unit 420-2 sends the media key KM to the video decoding unit 450 (Step S1115).
Next, a video decoding unit 2640 of the controller 200-2 reads sequentially the encrypted video data 2541 from the general area 115 (Step S1116). Video decoding unit 2640, using the decryption key Kc2 held, decrypts the read encrypted video data (step S1117). Video decoding unit 2640 sends the decoded video data to the video decoding unit 450 of the player 400-2 (step S1118).
Video decoding unit 450 sequentially decodes the video data by using the decryption key Kc (step S1119), and sends to the reproduction section 460 (step S1120). Reproducing unit 460 sequentially reproduces (displays) the received video data (step S1121).
If the media key conversion key KT2 is they are different for each memory card 2601, a decryption key Kc2 also different for each memory card 2601. Thus, the media key KM or media key conversion key KT2 is if they differ for each memory card 2601, encrypted video data itself is different for each memory card 2601. That is, the encrypted video data is individualized for each memory card 2601.
Thus, in the memory chip according to the fourth embodiment, disabling controller by MKB accompanying the content and (revoked playback devices by the content provider), individualized for each memory card of encrypted video data ( the combination of a controller revoked in) by the content supplier (double encrypted) is possible.
Previously has been described an embodiment in which the present invention is applied to content protection, it can also be applied to other industries. In the fifth embodiment, illustrating the embodiment applied to a smart grid. And smart grid, in addition to conventional power generation, such as nuclear and thermal power, the next-generation power grid that is built in order to stabilize the power quality when used in combination renewable energy such as solar and wind power.
Figure 30 is a diagram showing a configuration example of a next generation power grid of the fifth embodiment. In the next-generation power grid, and smart meter 3010a to aggregate the electric power consumption, which is the home server HEMS (Home Energy Management System) 3020 to manage the home appliance is installed in each home. Further, as a target commercial buildings, BEMS is a server that manages the electrical equipment in the building (Building Energy Management System) 3030 is installed in each building. The commercial building, similar smart meters 3010b and smart meters 3010a is installed. In the following, the smart meter 3010a and 3010b referred to simply as smart meter 3010.
Smart meters 3010, organized by several units by the relay (concentrator 3040) called concentrator communicates a meter data management system via a communication network MDMS and (Meter Data Management System) 3050. MDMS3050 receives and stores power usage at regular intervals from the smart meters 3010 households. EMS (Energy Management System) 3060 is an energy management system, a plurality of household power usage gathered in MDMS3050, or based on information from sensors installed in the electric power system, and the smart meters 3010 households HEMS3020 perform power control such as requests to suppress power used for. Further, EMS3060 is distributed power 3080 such connected solar and wind power RTU (Remote Terminal Unit) 3071 is a remote terminal unit, also connected to power storage device to RTU3072 3090, and was connected to RTU3073 controls transmission power distribution control device 3100 for controlling between the generator side performs control for stabilizing the voltage and frequency of the entire grid.
Figure 31 is a block diagram showing a configuration example of a smart meter 3010. Smart meter 3010, perform the MDMS3050 and encrypted communication. Concentrator 3040 is present on the communication path, but the concentrator 3040 is only relays the encrypted communication. MDMS3050 The smart meters 3010 holds the shared key K, performs encrypted communication by using the shared key K.
For example, the communication unit 3012 to be connected to the measuring unit 3011 sends the MDMS3050 encrypts the measurement value using the shared key K. MDMS3050 decrypts the encrypted measured value using the shared key K held. Accordingly, even if the communication in the communication path is intercepted, the interceptor can not know the measured value. Alternatively, there is a case where the control command is sent to the measuring unit 3011 from MDMS3050. For example, stop and start of the measurement, which is a control command such as sending an instruction of the measurement data. MDMS3050 uses the shared key K, encrypts the control command, transmits a control command to encrypt the communication unit 3012 of the smart meter 3010. The communication unit 3012 decrypts the encrypted control commands using the shared key K, and sends the control command to the measurement unit 3011. Alternatively, the general area of ​​the memory 110 of the semiconductor memory chip 100 is stored power consumption data, the communication unit 3012 encrypts the power usage data using the shared key K, the encrypted power usage data to send to the MDMS3050. MDMS3050 decrypts the encrypted power usage data by using the shared key K.
In smart meters 3010, the shared key K is stored in the special area of ​​the memory in the semiconductor memory chip. Shared key K, it is desirable that is regularly or updated at any time. A shared key for the update to K '. MDMS3050 writes the shared key K for update 'in the writing special area of ​​the memory 110 of the semiconductor memory chip 100. As it has already been described for the semiconductor memory chip 100 needs to be authenticated by MDMS3050. The communication unit 3012 of the smart meter 3010 To read via the controller 200 (updated) shared key K ', it is necessary that the controller 200 is authenticated by the semiconductor memory chip 100. And updating the shared key through the use of a shared key that is updated, as a result, the entire smart meter 3010 that uses the semiconductor memory chip 100 comes to be authenticated by MDMS3050.
MDMS3050, for example, as a writing device 300 of FIG. 14, and writes the shared key K 'for updating the write special area of ​​the semiconductor memory chip 100. Further, the controller 200 of the smart meters 3010, for example, and a read control section 220-2 of the encryption key sharing unit 210-2 and 9 in FIG.
Thus, in the fifth embodiment, with respect to data used in next-generation power grid is an area different from the content protection, it is possible to prevent the unauthorized use of data.
The present invention is not exactly limited to the above embodiment, in an implementation stage can be embodied by modifying the components without departing from the scope of the invention. Also, by properly combining the structural elements disclosed in the above-described embodiment, it is possible to form various inventions. For example, it is possible to remove some of the components shown in the embodiments. Furthermore, it may be appropriately combined components in the different embodiments.
100 semiconductor memory chip 110 memory 111 code storage unit 112 reads the special area 113 writing special area 114 common area 115 general area 120 encryption key sharing unit 130 sends the control unit 140 the data conversion unit 200 controller 220 read control unit 230 write control unit 240 generally area reading unit 250 general area writing part 300 writes device 310 ECC generator 320 key storage unit 330 The encryption unit 340 data transmission unit
A memory chip that is connected to a controller for controlling reading and writing of data in response to a request of the external device,
A memory including a special area is a storage area of ​​a predetermined data,
A key storage unit for said external device stores a second key corresponding to the first key for use in converting the data,
A conversion unit said write data to be written in the special area is received from the controller, it generates the conversion data obtained by converting said write data using the second key,
A writing unit for writing the converted data into the special area,
Memory chip comprising: a.
Using the encryption key shared with the controller, an encryption unit for generating encrypted data obtained by encrypting the converted data written to said special area,
Further comprising a, a portion for sending the encrypted data to the controller,
Memory chip according to claim 1, wherein the.
Further comprising a code storage unit that stores the error correction code of said write data,
The converting unit comprises: a transform coding error correction code of said write data is converted by the first key, and said write data converted by said first key received from the controller, the converted code the second with the key into a said error correction code, to generate the converted data decoded in the write data using the second key converted the write data,
The write unit further storing said error correction code is decoded in the code storage section,
The conversion unit includes an error correction code of said write data, and the write data received from the controller, converts the write data using the second key to the conversion data,
The write unit further storing the received the error correction code to the code storage section,
A write unit for the write data to be written in the special area is received from the controller writes the write data received in the special area,
The write data written in the special area, and a conversion unit that generates converted data converted by using the second key,
Using the encryption key shared with the controller, an encryption unit for generating encrypted encrypted data the conversion data,
Memory chip according to claim 5, characterized in.
The write section includes: a transform coding error correction code of said write data is converted by the first key, and the write data received from the controller, the converted code received in the code storage unit writes, writing the write data received in the special area,
The converting unit, the said conversion codes written in the special area by using the second key to decrypt the error correction code, using said second key to said write data written in the special area It is decoded to said write data,
The write unit includes an error correction code of said write data, receive said write data from said controller writes the error correction code received in the code storage unit, it said write data received be written in the special area,
Using the encryption key shared with the controller, an encryption unit for generating encrypted encrypted data write data written in the special area,
A sending unit for sending said encrypted data to said controller,
PCT/JP2009/070056 2009-11-27 2009-11-27 Memory chip WO2011064883A1 (en)
PCT/JP2009/070056 WO2011064883A1 (en) 2009-11-27 2009-11-27 Memory chip
JP2010527680A JP5178839B2 (en) 2009-11-27 2009-11-27 Memory chip
US12/882,979 US8473810B2 (en) 2009-11-27 2010-09-15 Memory chip having a security function and for which reading and writing of data is controlled by an authenticated controller
US13/924,675 US8788907B2 (en) 2009-11-27 2013-06-24 Memory chip for converting data received from controller controlling reading and writing of data
US14/303,704 US9053062B2 (en) 2009-11-27 2014-06-13 Memory chip for converting data received from controller controlling reading and writing of data
US14/700,385 US9355045B2 (en) 2009-11-27 2015-04-30 Memory device for converting data received from controller controlling reading and writing of data
US12/882,979 Continuation US8473810B2 (en) 2009-11-27 2010-09-15 Memory chip having a security function and for which reading and writing of data is controlled by an authenticated controller
WO2011064883A1 true WO2011064883A1 (en) 2011-06-03
ID=44066002
US (4) US8473810B2 (en)
JP (1) JP5178839B2 (en)
WO (1) WO2011064883A1 (en)
JP2013026747A (en) * 2011-07-19 2013-02-04 Toshiba Corp Information processor, server device, and program
JP2014522171A (en) * 2011-07-22 2014-08-28 ネットフリックス・インコーポレイテッドＮｅｔｆｌｉｘ， Ｉｎｃ． The system and method for obfuscated initial value of the encryption protocol
US20140006738A1 (en) * 2012-06-29 2014-01-02 Kabushiki Kaisha Toshiba Method of authenticating a memory device by a host device
JP5395937B2 (en) * 2012-09-24 2014-01-22 株式会社東芝 Memory chip
US20150288518A1 (en) * 2014-04-08 2015-10-08 Karl P.W. Wiegand Algorithm-agnostic approach for systematically hardening encryption
JPH01162957A (en) * 1987-12-18 1989-06-27 Hitachi Ltd Semiconductor storage device
JP2006350782A (en) * 2005-06-17 2006-12-28 Fujitsu Ltd Processor and system
JP2007220211A (en) * 2006-02-16 2007-08-30 Fujitsu Ltd Semiconductor memory
DE19757651B4 (en) * 1997-12-15 2005-06-23 Francotyp-Postalia Ag & Co. Kg A franking machine with a chip card read / write unit
2009-11-27 WO PCT/JP2009/070056 patent/WO2011064883A1/en active Application Filing
2009-11-27 JP JP2010527680A patent/JP5178839B2/en active Active
2010-09-15 US US12/882,979 patent/US8473810B2/en active Active
2013-06-24 US US13/924,675 patent/US8788907B2/en active Active
2014-06-13 US US14/303,704 patent/US9053062B2/en not_active Expired - Fee Related
2015-04-30 US US14/700,385 patent/US9355045B2/en active Active
JP2016129403A (en) * 2011-07-22 2016-07-14 ネットフリックス・インコーポレイテッドＮｅｔｆｌｉｘ， Ｉｎｃ． System and method for obfuscated initial value of encrypted protocol
KR101536086B1 (en) * 2011-08-31 2015-07-24 가부시끼가이샤 도시바 Authenticator, authenticatee and authentication method
US20150234752A1 (en) 2015-08-20
JP5178839B2 (en) 2013-04-10
JPWO2011064883A1 (en) 2013-04-11
US9053062B2 (en) 2015-06-09
US8473810B2 (en) 2013-06-25
US20110131470A1 (en) 2011-06-02
US20130290738A1 (en) 2013-10-31
US8788907B2 (en) 2014-07-22
US20140298043A1 (en) 2014-10-02
US9355045B2 (en) 2016-05-31
JP4581246B2 (en) 2010-11-17 The information processing system, information processing method, and a program recording medium
EP1235381A1 (en) 2002-08-28 Information processing device, information processing method and program storage medium
JP2006512792A (en) 2006-04-13 The method of a secured information exchange between two devices
CA2361356A1 (en) 2001-08-02 Storage device authentication system
CN100393027C (en) 2008-06-04 Digital data recording apparatus, storage apparatus and using device
CN100517417C (en) 2009-07-22 Deciphering equipment, deciphering equipment making method and providing system
JP2002108811A (en) 2002-04-12 Data processor, data processing method and program providing medium
Ref document number: 2010527680
Ref document number: 09851674