JP2018092174A - Random number generator, storage device, and information processing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a random number generator capable of performing processing with a simple configuration, that is, at low cost.SOLUTION: A random number generator 1 includes: an uncertainty circuit 10 that outputs uncertain data 100; and an encryption processing device 11. The encryption processing device 11 encrypts input data 300 by using its own encryption function; obtains data after encryption as encrypted data 310; and generates and outputs a random number 200 having more uniformity than the data 100 by using its own encryption function and the data 100 which is output from the uncertainty circuit 10.SELECTED DRAWING: Figure 1

Description

  The present invention relates to cryptographic processing.

  As described in Patent Document 1, various techniques have been proposed for cryptographic processing. Patent Document 2 discloses a random number generation technique.

JP 2004-234153 A JP 2003-173254 A

  As described in Patent Document 1, random number generation and cryptographic processing may be performed by the same device. In such devices and other devices, it is desired that processing can be performed with a simple configuration, that is, at low cost.

  Therefore, the present invention has been made in view of the above points, and an object thereof is to provide a technique capable of performing processing with a simple configuration, that is, at low cost.

  One aspect of the random number generation device includes an uncertain circuit that outputs uncertain data and an encryption processing device, and the encryption processing device uses its own encryption algorithm having nonlinearity, and the encryption processing device And encrypting the input data different from the uncertain data, and using the encryption algorithm and the uncertain data output from the uncertain circuit, the uncertain data Generate a more uniform random number.

  One aspect of the storage device includes the random number generation device described above and a storage unit, and the encryption processing device encrypts data read from the storage unit.

  One embodiment of the information processing system includes the above-described storage device and a host device that controls the storage device.

  Processing can be performed with a simple configuration, that is, at low cost.

It is a figure which shows the structure of a random number generator. It is a figure which shows the structure of a memory system. It is a flowchart which shows operation | movement of a semiconductor memory.

  FIG. 1 is a diagram illustrating a configuration of a random number generation device 1 according to an embodiment. The random number generation device 1 according to the present embodiment generates and outputs a highly uniform random number and has an encryption function for encrypting input data. As shown in FIG. 2, the random number generation device 1 includes an uncertain circuit 10 and a cryptographic processing device 11.

  The uncertain circuit 10 generates and outputs uncertain data 100. Data 100 is digital data. The uncertain circuit 10 can generate the uncertain data 100 using, for example, resistance or thermal noise of a diode. Further, the uncertain circuit 10 can generate the uncertain data 100 using, for example, fluctuation of a crystal oscillator. Further, as described in Patent Document 2, the uncertain circuit 10 can generate the uncertain data 100 using a logic circuit such as an RS flip-flop, for example. The uncertain circuit 10 that generates uncertain data using a logic circuit is also called an “indeterminate logic circuit”. The data 100 output from the uncertain circuit 10 can be regarded as random numbers with non-reproducibility and low uniformity. For random numbers with low uniformity, the entropy (randomness) is low, and since random numbers with low entropy have low authenticity, the data 100 can be said to be random numbers with low authenticity.

  The cryptographic processing device 11 has a cryptographic function, encrypts the input data 300 using the cryptographic function, and outputs the encrypted input data 300 as the encrypted data 310. Further, the cryptographic processing device 11 generates and outputs a random number 200 having higher uniformity than the data 100 using its own cryptographic function and the data 100 output from the uncertain circuit 10. In other words, the cryptographic processing device 11 uses its own cryptographic function and the data 100, and the random number 200 (the data 100) having a smaller difference in appearance frequency (appearance probability) between “1” and “0” than the data 100. And generates and outputs a random number 200) having a smaller value bias. It can be said that the cryptographic processing apparatus 11 has a function of a uniformizing circuit that improves the uniformity of data. The random number 200 generated by the cryptographic processing device 11 is highly uniform digital data having non-reproducibility. A random number with high uniformity has high entropy, and a random number with high entropy has high authenticity. Therefore, the random number 200 can be said to be a highly random number. Note that the cryptographic processing device 11 may decrypt the encrypted data using its own cryptographic function.

  The random number 200 with high authenticity generated by the random number generation device 1 can be used as highly confidential information, for example. Examples of highly confidential information include a key used for encryption and an authentication code used for authentication. The random number 200 can be used as a key used in an encryption algorithm such as DES (Data Encryption Standard) or AES (Advanced Encryption Standard). Further, the random number 200 can be used as an authentication code used between a plurality of devices in the mutual authentication between the plurality of devices, for example.

  As described above, in the random number generation device 1 according to the present embodiment, the cryptographic function of the cryptographic processing device 11 and the data 100 output from the uncertain circuit 10 are used to generate the random number 200 with high uniformity. Therefore, it is not necessary to provide a uniformizing circuit for uniformizing the data 100 separately from the cryptographic processor 11 in order to increase the entropy of the data 100 output from the uncertain circuit 10. Therefore, cryptographic processing and generation of a highly authentic random number can be realized with a simple configuration. As a result, it is possible to reduce the cost of an apparatus that performs cryptographic processing and random number generation. Note that the uniformizing circuit is also referred to as a “smoothing circuit” as described in Patent Document 1. Further, as in the present embodiment, by ensuring the uniformity of the random number 200 by using a part of the cryptographic processing device 11, the overhead of the circuit scale can be minimized.

<Usage example of random number generator>
Next, a usage example of the random number generation device 1 and a configuration example of the cryptographic processing device 11 will be described. FIG. 2 is a block diagram showing a memory system 50 including the semiconductor memory 20 on which the random number generation device 1 is mounted.

  As shown in FIG. 2, a memory system 50 that is a type of information processing system includes a semiconductor memory 20 having a random number generation device 1 and a host device 30 that controls the semiconductor memory 20. The semiconductor memory 20 which is a kind of storage device and the host device 30 perform encrypted communication with each other.

  The memory system 50 is, for example, a computer system mounted on a game device. The game device includes a game device body and a game cartridge that can be attached to and detached from the game device body. The semiconductor memory 20 is built in the game cartridge, and the host device 30 is built in the game apparatus main body. The host device 30 is a kind of computer. The user can enjoy various types of games by exchanging the game card ridge attached to the game apparatus main body. In the memory system 50, a key used for encryption is exchanged between the host device 30 and the semiconductor memory 20.

  The semiconductor memory 20 is, for example, a mask ROM (Read Only Memory). The semiconductor memory 20 includes an uncertain circuit 10 and a cryptographic processing device 11 that constitute the random number generation device 1, a command decoder 12, and a memory array 13 that is a storage unit. In this example, the encryption processing device 11 is used to realize the security of the semiconductor memory 20. In addition, the random number 200 generated by the random number generation device 1 is input to the cryptographic processing device 11 as a key.

  The encryption processing device 11 shown in FIG. 2 encrypts and decrypts data using, for example, a stream encryption method which is a kind of common key encryption method. Note that the cryptographic processing apparatus 11 may encrypt and decrypt data using a block encryption method which is a kind of common key encryption method. The cryptographic processing device 11 may encrypt and decrypt data using a public key cryptosystem.

  The cryptographic processing apparatus 11 includes a plurality of cryptographic processing units 110 and 111, an arithmetic circuit 112, a first selection circuit 113, a second selection circuit 114, and a third selection circuit 115. Each of the cryptographic processing units 110 and 111 has a cryptographic function. In the cryptographic processing units 110 and 111, the cryptographic algorithms used may be the same or different from each other. As an encryption algorithm used by the encryption processing units 110 and 111, for example, DES or AES is conceivable. In the cryptographic processing apparatus 11 according to the present example, the cryptographic processing unit 110 uses the cryptographic function (own cryptographic algorithm) of itself and the data 100 output from the indeterminate circuit 10 to generate a highly uniform random number 200. Is generated.

  The first selection circuit 113 selects any one of the three input data based on the input first control signal, and outputs the selected data to the encryption processing unit 110 as data 550a. . Further, the second selection circuit 114 selects any one of the three input data based on the input second control signal, and outputs the selected data as data 550b to the encryption processing unit 110. To do.

  In the present embodiment, the data 550 a output from the first selection circuit 113 and the data 550 b output from the second selection circuit 114 constitute a common key 550 used in the encryption processing unit 110. Based on the common key 550, the cryptographic processing unit 110 initializes itself (initializes its own cryptographic algorithm). Hereinafter, the data 550a and 550b constituting the common key 550 are referred to as “first common key 550a” and “second common key 550b”, respectively. The first common key 550a is, for example, upper data of the common key 550, and the second common key 550b is, for example, lower data of the common key 550. The first common key 550a may be a part of the common key 550, and may not be higher-order data of the common key 550. The second common key 550b may be a portion other than the first common key 550a in the common key 550, and may not be lower data of the common key 550.

  The first selection circuit 113 includes a first fixed key 500 a that is part of the fixed key 500 stored in advance in the cryptographic processing device 11 and first data that is part of the data 100 output from the indeterminate circuit 10. Three pieces of data, that is, 100a and a random number 200 generated by the cryptographic processing apparatus 11 are input. For example, when the first selection circuit 113 selects the first fixed key 500a, the first fixed key 500a is input to the encryption processing unit 110 as the first common key 550a.

  The second selection circuit 114 includes a second fixed key 500b that is a part other than the first fixed key 500a in the fixed key 500 and a part other than the first data 100a in the data 100 output from the indeterminate circuit 10. Three pieces of data, that is, a certain second data 100 b and a random number 600 sent from the host device 30 are input. For example, when the second selection circuit 114 selects the random number 600, the random number 600 is input to the cryptographic processing unit 110 as the second common key 550b. The random number 600 is output from the command decoder 12 as will be described later. Hereinafter, the random number 200 may be referred to as “memory random number 200” and the random number 600 may be referred to as “host random number 600”.

  The third selection circuit 115 selects one of the two input data based on the input third control signal, and outputs the selected data to the arithmetic circuit 112 as output data 560. . Two data of the memory random number 200 and data 400 output from the memory array 13 (hereinafter referred to as “memory data 400”) are input to the third selection circuit 115. For example, when the third selection circuit 115 selects the memory data 400, the memory data 400 becomes the output data 560. The first to third control signals for controlling the first selection circuit 113 to the third selection circuit 115 are generated in the semiconductor memory 20, for example.

  The cryptographic processing unit 111 initializes itself (initializes its own cryptographic algorithm) based on a session key SK described later output from the cryptographic processing unit 110. The initialized cryptographic processing unit 111 generates and outputs a key stream KS using its own cryptographic function (its own cryptographic algorithm). In other words, the encrypted cryptographic processing unit 111 performs cryptographic processing to generate and output a key stream KS.

  The arithmetic circuit 112 is exclusive of the key stream KS output from the encryption processing unit 111 and the encrypted command 350 (hereinafter also referred to as “encryption command 350”) output from the host device 30. Calculate and output the logical sum. As a result, the encryption command 350 from the host device 30 is decrypted. The decrypted encrypted command 350 is input to the command decoder 12 as a plaintext command 360.

  The arithmetic circuit 112 calculates and outputs an exclusive OR of the key stream KS output from the encryption processing unit 111 and the output data 560 from the third selection circuit 115. As a result, the output data 560 is encrypted. The encrypted output data 560 is output to the host device 30 as encrypted data 570.

  As described above, the arithmetic circuit 112 uses the data output from the encryption processing unit 111 as the key stream KS, and encrypts or decrypts the input data.

  The command decoder 12 decodes the input plaintext command 360 and analyzes the plaintext command 360. When the command decoder 12 analyzes the input plaintext command 360, and the plaintext command 360 is a read command for instructing to read data from the memory array 13, the command decoder 12 outputs control signals such as an address signal and a read signal. Output to the memory array 13. As a result, the memory data 400 is output from the memory array 13. The memory array 13 stores, for example, a plurality of game programs and various data used in each game program. When the memory data 400 is output from the third selection circuit 115, the memory data 400 is encrypted in the arithmetic circuit 112, and the encrypted memory data 400 is input to the host device 30. When the input memory data 400 includes a game program, the host device 30 executes the game program.

  In addition, the command decoder 12 decodes the input plaintext command 360 and extracts the host random number 600 generated by the host device 30 included in the plaintext command 360. The command decoder 12 outputs the extracted host random number 600 to the second selection circuit 114.

  The host device 30 is provided with a random number generation device similar to the random number generation device 1 of the semiconductor memory 20 (hereinafter referred to as “host-side random number generation device”). The host-side random number generator includes an uncertain circuit similar to the uncertain circuit 10 (hereinafter referred to as “host-side uncertain circuit”) and an encryption processor similar to the cryptographic processor 11 (hereinafter referred to as “host-side encryption process” Device). The host device 30 encrypts the command using the host-side cryptographic processing device, and outputs the encrypted command (encrypted command 350) to the semiconductor memory 20. In addition, the host device 30 decrypts the encrypted data 570 from the semiconductor memory 20 using the host-side cryptographic processing device.

  Further, in the host-side random number generation device, in the same manner as the random-number generation device 1, the host-side cryptographic processing device uses a host with high uniformity using its own cryptographic function and data output from the host-side uncertain circuit. A random number 600 is generated. The host device 30 outputs a predetermined command including the generated host random number 600 to the semiconductor memory 20. Note that the host-side random number generation device may generate the host random number 600 by a method different from that of the random number generation device 1 of the semiconductor memory 20.

  In the memory system 50 according to the present embodiment, the host random number 600 and the memory random number 200 are used as keys. Key exchange is performed by exchanging the host random number 600 and the memory random number 200 between the host device 30 and the semiconductor memory 20.

<About key exchange in the memory system>
Next, an operation of the memory system 50 when a key exchange is performed between the host device 30 and the semiconductor memory 20 will be described. FIG. 3 is a flowchart showing the operation of the semiconductor memory 20 when key exchange is performed between the host device 30 and the semiconductor memory 20.

  As shown in FIG. 3, in step s <b> 1, the semiconductor memory 20 uses the fixed key 500 to perform initialization processing for the cryptographic processing device 11. This initialization process is a process necessary for exchanging keys between the host device 30 and the semiconductor memory 20.

  In step s1, the first selection circuit 113 selects and outputs the first fixed key 500a, and the second selection circuit 114 selects and outputs the second fixed key 500b. As a result, the fixed key 500 is input to the cryptographic processing unit 110 as the common key 550. The cryptographic processor 110 initializes itself (initializes its cryptographic algorithm) based on the input fixed key 500 (common key 550). Then, the encrypted cryptographic processing unit 110 generates a session key SK using its own cryptographic function and outputs it to the cryptographic processing unit 111. In other words, the cryptographic processing unit 110 after initialization performs cryptographic processing to generate and output a session key SK. In step s1, the output of the encryption algorithm initialized based on the fixed key 500 in the encryption processing unit 110 becomes the session key SK.

  In step s1, the encryption processing unit 111 initializes itself (initializes its encryption algorithm) based on the input session key SK. Then, the initialized cryptographic processing unit 111 generates a key stream KS using its own cryptographic function and outputs the key stream KS to the arithmetic circuit 112. In step s1, the output of the encryption algorithm initialized with the session key SK in the encryption processing unit 111 becomes the key stream KS. Hereinafter, this key stream KS is particularly referred to as “key exchange key stream KS”.

  Similarly, the host device 30 uses the same fixed key as the fixed key 500 to perform initialization processing for the host-side cryptographic processing device. As a result, the same key stream as the key exchange key stream KS (hereinafter referred to as “host side key exchange key stream”) is also generated in the host side cryptographic processing apparatus.

  When the host device 30 generates the host side key exchange key stream, the host device 30 encrypts the random number generation command using the host side key exchange key stream. The random number generation command is a command for instructing the semiconductor memory 20 to generate the memory random number 200. The host device 30 outputs the encrypted random number generation command to the semiconductor memory 20.

  In step s2, when the semiconductor memory 20 receives the encrypted random number generation command, in step s3, the arithmetic circuit 112 uses the key exchange key stream KS to decrypt the random number generation command. The decrypted random number generation command is input to the command decoder 12.

  When the command decoder 12 analyzes the random number generation command, in step s4, the first selection circuit 113 selects and outputs the first data 100a, and the second selection circuit 114 selects and outputs the second data 100b. . As a result, the data 100 output from the indeterminate circuit 10 is input to the cryptographic processing unit 110 as the common key 550 for generating random numbers (provisional common key 550).

  Next, in step s5, the cryptographic processing unit 110 functioning as a key generating unit for generating a key uses its own cryptographic function (own cryptographic algorithm) and the input data 100 (common key 550 for random number generation). The memory random number 200 having higher uniformity than the data 100 is generated and output. Specifically, the cryptographic processing unit 110 initializes itself based on the data 100. Then, the encrypted cryptographic processing unit 110 generates and outputs the memory random number 200 using its own cryptographic function. In step s5, the output of the cryptographic algorithm initialized based on the data 100 (random number with low uniformity) in the cryptographic processing unit 110 becomes the memory random number 200 with high uniformity. Since the output of the cryptographic algorithm has unpredictability due to the essence of the cryptographic algorithm, the difference between the appearance probabilities of “0” and “1” is small in the output of the cryptographic algorithm. Therefore, the memory random number 200 with high uniformity can be generated in the cryptographic processing unit 110.

  When the memory random number 200 is generated by the cryptographic processing unit 110, the first selection circuit 113 selects and outputs the memory random number 200 in step s6. As a result, the memory random number 200 is input to the cryptographic processing unit 110 as the formal first common key 550a used after the key exchange.

  Next, in step s 7, the semiconductor memory 20 outputs the memory random number 200 generated as the key in step s 5 to the host device 30. In step s7, the third selection circuit 115 selects and outputs the memory random number 200. As a result, the memory random number 200 is input to the arithmetic circuit 112 as the output data 560. The arithmetic circuit 112 calculates and outputs an exclusive OR of the input memory random number 200 and the key exchange key stream KS. As a result, the memory random number 200 encrypted with the key exchange key stream KS is input to the host device 30 as the encrypted data 570.

  When the encrypted memory random number 200 is input to the host device 30, the host-side cryptographic processing device decrypts the memory random number 200 using the host-side key exchange key stream. In the host device 30, a host random number 600 that is treated as a key is generated in the same manner as the semiconductor memory 20. Then, the host device 30 generates a host random number command including the generated host random number 600. The host random number command is encrypted based on the host side key exchange key stream in the host side cryptographic processing device. The encrypted host random number command is input to the semiconductor memory 20.

  In step s8, when the semiconductor memory 20 receives the encrypted host random number command, in step s9, the cryptographic processing device 11 decrypts the host random number command using the key exchange key stream KS. The decrypted host random number command is input to the command decoder 12.

  Next, in step s10, the command decoder 12 decodes the host random number command and extracts the host random number 600 from the host random number command. When the host random number 600 is acquired, in step s11, the second selection circuit 114 selects and outputs the host random number 600. As a result, the host random number 600 is input to the cryptographic processing unit 110 as the formal second common key 550b used after the key exchange. A formal common key 550 including a memory random number 200 and a host random number 600 is input to the cryptographic processing unit 110.

  Also in the host device 30, as in the semiconductor memory 20, the formal processing composed of the memory random number 200 from the semiconductor memory 20 and the host random number 600 is made to the encryption processing unit corresponding to the encryption processing unit 110 in the host side encryption processing device. A common key is entered.

  The host device 30 generates an initialization command that instructs the semiconductor memory 20 to perform initialization processing for the cryptographic processing device 11 using the formal common key 550. In the host device 30, the host-side cryptographic processing device encrypts the initialization command using the host-side key exchange key stream. The encrypted initialization command is input to the semiconductor memory 20.

  In step s12, when the semiconductor memory 20 receives the encrypted initialization command, in step s13, the arithmetic circuit 112 uses the key exchange key stream KS to decrypt the initialization command. The decoded initialization command is input to the command decoder 12.

  When the command decoder 12 analyzes the initialization command, in step s14, the formal common key 550 (memory random number 200 and host random number 600) is used to perform initialization processing on the cryptographic processing device 11. Specifically, the cryptographic processing unit 110 initializes itself based on the inputted formal common key 550, that is, based on the host random number 600 and the memory random number 200. Then, the initialized cryptographic processing unit 110 generates and outputs a session key SK using its own cryptographic function. The encryption processing unit 111 initializes itself based on the session key SK generated by the encryption processing unit 110. Then, the encrypted cryptographic processing unit 111 generates and outputs the key stream KS using its own cryptographic function. Thereafter, in the cryptographic processing device 11, the command from the host device 30 is decrypted with the key stream KS output from the cryptographic processing unit 111. Further, the memory data 400 from the memory array 13 is encrypted with the key stream KS output from the encryption processing unit 111.

  In the host device 30, in the same manner as in the semiconductor memory 20, initialization processing for the host-side cryptographic processing device is performed using a formal common key composed of the host random number 600 and the memory random number 200. In the host side cryptographic processing apparatus after the initialization process, the command transmitted to the semiconductor memory 20 is encrypted with the key stream, and the encrypted data 570 (encrypted memory data 400) from the semiconductor memory 20 is the key stream. Decrypted with

  In this manner, mutual authentication between the host device 30 and the semiconductor memory 20 can be realized by performing key exchange (exchange of random numbers in this example) between the host device 30 and the semiconductor memory 20. .

  Further, as in this example, by using a highly uniform random number 200 generated using a part of the cryptographic processing device 11 (the cryptographic processing unit 110) as highly confidential information in security, security can be improved. Highly confidential information can be generated at low cost.

  Further, as in this example, by using a highly uniform random number 200 generated by using a part of the cryptographic processing device 11 as a key, security of a generated key or a key to be exchanged can be ensured. As a result, it is possible to ensure the security of encryption communication at a low cost.

  In step s5, the cryptographic processing unit 110 that functions as a key generation unit generates the memory random number 200, which is the first key, using the data 100 and its own cryptographic function. In step s14, the cryptographic processing unit 110 uses the first key and its own cryptographic function to generate a session key SK that is a second key. As described above, the cryptographic processing unit 110 generates the second key using the first key generated by itself, thereby generating a high-security key with a simple configuration. That is, a high-security key can be generated at low cost. In addition, since the first key is generated in the cryptographic processing unit 110 using the data 100 output from the uncertain circuit 10, the security of the first key can be enhanced. In the above example, the first key (memory random number 200) is not used in the cryptographic processing unit 111. However, in the case where key exchange is not performed in the memory system 50, the cryptographic processing unit 111 itself The first key may be used as the key.

  In the above example, the memory random number 200 generated by the cryptographic processing unit device 11 is used by the cryptographic processing device 11, but may be used by another device. In the above example, the cryptographic processing apparatus 11 is provided with a plurality of cryptographic processing units. However, only one cryptographic processing unit may be provided. In the above example, the key exchange is performed between the host device 30 and the semiconductor memory 20, but the key exchange may not be performed. In this case, in the semiconductor memory 20, the formal common key 550 is configured only by the memory random number 200 generated by the cryptographic processing device 11. Also in the host device 30, only the memory random number 200 sent from the semiconductor memory 20 constitutes a formal common key in the host side cryptographic processing device. Further, instead of providing the indeterminate circuit 10 and the cryptographic processing device 11 in the semiconductor memory 20 in which the semiconductor element is used in the storage area (storage element) as in this example, the storage device in which the semiconductor element is not used in the storage area An indeterminacy circuit 10 and a cryptographic processing device 11 may be provided.

  As described above, the random number generation device 1, the semiconductor memory 20, and the memory system 50 have been described in detail. However, the above description is an example in all aspects, and the present invention is not limited thereto. The various modifications described above can be applied in combination as long as they do not contradict each other. And it is understood that the countless modification which is not illustrated can be assumed without deviating from the scope of the present invention.

DESCRIPTION OF SYMBOLS 1 Random number generator 10 Uncertain circuit 11 Cryptographic processing device 20 Semiconductor memory 30 Host device 50 Memory system

Claims (6)

An uncertain circuit that outputs uncertain data;
A cryptographic processing device,
The cryptographic processing device encrypts input data different from the uncertain data from the outside of the cryptographic processing device using its own cryptographic algorithm having non-linearity, and the cryptographic algorithm and the A random number generation device that generates random numbers with higher uniformity than the uncertain data using the uncertain data output from the uncertain circuit. The random number generation device according to claim 1,
The random number generation device, wherein the cryptographic processing device initializes the cryptographic algorithm used in the generation of the random number based on the uncertain data, and generates the random number based on the cryptographic algorithm after initialization. The random number generation device according to any one of claims 1 and 2,
The random number generator is used as a key used for encryption or an authentication code used for authentication. The random number generation device according to claim 3,
The random number generation device, wherein the random number is input as a key to the cryptographic processing device. The random number generation device according to any one of claims 1 to 4,
A storage unit,
The encryption processing device is a storage device that encrypts data read from the storage unit. A storage device according to claim 5;
An information processing system comprising: a host device that controls the storage device.

Images