US 8,266,450 B2Granted

Information processing device, encryption method of instruction code, and decryption method of encrypted instruction code

AssigneeRenesas Electronics Corporation

InventorsTakashi Endo, Toshio Okochi, Shunsuke Ota, Tatsuya Kameyama

Life of this patent

Estimating the term…

Loading patent…

Abstract

It is possible to achieve the protection of software with reduced overhead. For example, a memory for storing an encrypted code prepared in advance and a decryptor module for decrypting the code are provided. The decryptor module includes, for example, a three-stage pipeline and a selector for selecting one output from the outputs of each stage of the pipeline. When a branch instruction is issued and subsequent inputs of the pipeline are in the order of CD′1, CD′2, . . . , the decryptor module outputs a first decrypted code by performing a one-stage pipeline process to CD′1. Next, the decryptor module outputs a second decrypted code by performing a two-stage pipeline process to CD′2, and the decryptor module outputs a third decrypted code by performing a three-stage pipeline process to CD′3 (and subsequent codes). Therefore, in particular, the overhead to CD′1 can be reduced.

Claims5

Dependent claims

An information processing device, comprising:

a memory in which an encrypted code is stored;
a decryptor which performs, to the encrypted code, a multiple-stage decryption process including a first stage and a second stage performed after decryption through the first stage, and which sets a k-th stage which is any one stage of the multiple stages, thereby outputting a decrypted code having passed through a k-stage decryption process;
and
an instruction execution unit for executing the decrypted code,
wherein, when the instruction execution unit issues a branch instruction in a course of an execution cycle of the decrypted code, the decryptor sets a small value to “k” of the k-th stage with respect to the encrypted code of a branch destination, and thereafter, the decryptor outputs the decrypted code while changing the value of “k” to a larger value each time when the execution cycle of the instruction execution unit advances,
the decryptor includes:
a decryption processing circuit which has a multiple-stage pipeline and performs a decryption process using a key for each stage of the multiple-stage pipeline upon reception of the encrypted code;
a selection circuit which selects any one output from outputs of each stage of the multiple-stage pipeline in accordance with a select signal and outputs the selected output to the instruction execution unit;
and
a control circuit for generating the select signal while detecting issuance of the branch instruction by the instruction execution unit,
the decryption processing circuit includes:
a first node to which the encrypted code is transmitted;
a first-stage pipeline provided between the first node and a second node;
and
a second-stage pipeline provided between the second node and a third node,
the first-stage pipeline includes:
a first EXOR circuit which executes an exclusive OR operation using the first node and a first key as inputs;
a first transform circuit which performs a nonlinear transform of an output of the first EXOR circuit;
a first register which delays a signal of the first node by a predetermined number of cycles;
and
a second EXOR circuit which executes an exclusive OR operation using an output of the first transform circuit and an output of the first register as inputs, and outputs an operation result of the second EXOR circuit to the second node, and
the second-stage pipeline includes:
a third EXOR circuit which executes an exclusive OR operation using the second node and a second key as inputs;
a second transform circuit which performs a nonlinear transform of an output of the third EXOR circuit;
a second register which delays a signal of the second node by a predetermined number of cycles;
and
a fourth EXOR circuit which executes an exclusive OR operation using an output of the second transform circuit and an output of the second register as inputs, and outputs an operation result of the fourth EXOR circuit to the third node.

24 more elements

A decryption method of an encrypted instruction code, in which decrypted instruction codes are sequentially generated while sequentially transforming encrypted instruction codes inputted at each cycle by using a decryptor circuit,

wherein the decryptor circuit performs:
a first process of determining whether or not the encrypted instruction code inputted at each cycle is a branch instruction;
a second process of, when the encrypted instruction code is the branch instruction in the first process, performing a first decryption process to a first encrypted instruction code inputted at a first cycle subsequent to a cycle at which the encrypted instruction code is inputted, thereby generating a first decrypted instruction code;
and
a third process of performing a second decryption process having a cipher strength higher than a cipher strength of the first decryption process to a second encrypted instruction code inputted at a second cycle subsequent to the first cycle, thereby generating a second decrypted instruction code,
the first decryption process includes:
a first EXOR process in which an exclusive OR operation of the first encrypted instruction code and a first key is executed;
a first transform process in which a nonlinear transform of an operation result of the first EXOR process is performed with a first transformation rule;
and
a second EXOR process in which an exclusive OR operation of a transform result of the first transform process and a predetermined initial value is executed and this operation result is output as the first decrypted instruction code, and
the second decryption process includes:
a third EXOR process in which an exclusive OR operation of the second encrypted instruction code and the first key is executed;
a second transform process in which a nonlinear transform of an operation result of the third EXOR process is performed with the first transformation rule;
a fourth EXOR process in which an exclusive OR operation of a transform result of the second transform process and the first encrypted instruction code is executed;
a fifth EXOR process in which an exclusive OR operation of an operation result of the fourth EXOR process and a second key is executed;
a third transform process in which a nonlinear transform of an operation result of the fifth EXOR process is performed with a second transformation rule;
and
a sixth EXOR process in which an exclusive OR operation of a transform result of the third transform process and the first decrypted instruction code is executed and an operation result of the sixth EXOR process is output as the second decrypted instruction code.

15 more elements

An encryption method of an instruction code in which a source instruction code prepared in advance is transformed by using a program process by a computer system, thereby generating an encrypted instruction code,

wherein the computer system performs:
a first step of determining whether or not each of a plurality of source instruction codes assigned to a plurality of addresses is a branch instruction, and when it is determined that one of the plurality of source instruction codes is a branch instruction, recognizing a first address to be a branch destination and a first source instruction code assigned to the first address;
a second step of transforming the first source instruction code by using a first encryption algorithm, thereby generating a first encrypted instruction code;
and
a third step of transforming a second source instruction code assigned to a second address executed next to the first address by using a second encryption algorithm having a cipher strength higher than that of the first encryption algorithm, thereby generating a second encrypted instruction code,
the first encryption algorithm includes:
a first transform process in which a nonlinear transform of the first source instruction code is performed with a first transformation rule;
a first EXOR process in which an exclusive OR operation of a transform result of the first transform process and a first key is executed;
and
a second EXOR process in which an exclusive OR operation of an operation result of the first EXOR process and a predetermined initial value is executed and this operation result is output as the first encrypted instruction code, and
the second encryption algorithm includes:
a second transform process in which a nonlinear transform of the second source instruction code is performed with the first transformation rule;
a third EXOR process in which an exclusive OR operation of a transform result of the second transform process and the first key is executed;
a fourth EXOR process in which an exclusive OR operation of an operation result of the third EXOR process and the first source instruction code is executed;
a third transform process in which a nonlinear transform of an operation result of the fourth EXOR process is performed with a second transformation rule;
a fifth EXOR process in which an exclusive OR operation of a transform result of the third transform process and a second key is executed;
and
a sixth EXOR process in which an exclusive OR operation of an operation result of the fifth EXOR process and the first encrypted instruction code is executed and this an operation result of the sixth EXOR process is output as the second encrypted instruction code.

15 more elements

Dependencies are inferred from the claim text.

Facts

Application: 12/417,856Filed 3 Apr 2009
Priority: JP 2008-0971393 Apr 2008
Published: US 2009/0254740 A18 Oct 2009
Granted: 11 Sep 2012
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

G06F 21/72
To assure secure computing or processing of information: in cryptographic circuits
G06F 9/3017
Arrangements for executing machine instructions, e.g. instruction decode: runtime instruction translation, e.g. macros
G06F 9/30174
Runtime instruction translation, e.g. macros: for non-native instruction set, e.g. Javabyte, legacy code
G06F 9/30178
Runtime instruction translation, e.g. macros: of compressed or encrypted instructions