Information processing device, encryption method of instruction code, and decryption method of encrypted instruction code

The present application claims priority from Japanese Patent Application No. JP 2008-097139 filed on Apr. 3, 2008, the content of which is hereby incorporated by reference into this application.

The present invention relates to an information processing device, an encryption method of an instruction code and a decryption method of an encrypted instruction code, and more particularly to a technique effectively applied to an information processing device which performs a desired process while decrypting an encrypted instruction code previously stored in a memory in real time.

For example, Japanese Patent Application Laid-Open Publication No. 7-129473 (Patent Document 1) describes a data protection device which encrypts and stores an execution program of a computer in an external storage device, and executes the program while decrypting the same. In this data protection device, for example, an address space of the external storage device is divided for each four addresses for the encryption. The encrypted data whose low two bits of the address are “11” is created by using the previous encrypted data whose low two bits are “10”. Similarly, the encrypted data of “10” and “01” are created by using the encrypted data of “01” and “00”, respectively, and the encrypted data of “00” is created by using an initial value. Then, when the data column whose low two bits of the address are “10” is executed in response to a branch instruction, the decryption is sequentially performed from its two-previous encrypted data of “00”, and wait is performed until reaching the encrypted data of “10”.

Also, Japanese Patent Application Laid-Open Publication No. 2005-18434 (Patent Document 2) describes a microprocessor in which the pipeline process for executing a received encrypted instruction while decrypting the same can be performed with suppressing the generation of stall. Specifically, the two-stage pipeline is provided in the instruction fetch unit, and the instruction fetch is performed on the former stage and the decryption of the encrypted instruction is performed on the latter stage.

In recent years, the importance of the protection of digital contents typified by game software, video contents and others has been increasing. The protection of these digital contents is ensured by using encryption, signature and various other technologies, but there is a fear that the protection function is disabled when the software (firmware) controlling them is altered. For example, the copyright protection function can be disabled by cryptanalyzing and altering the firmware of a DVD drive, and the checking function of illegal software can be disabled by cryptanalyzing and altering the firmware of a gaming machine, so that the illegal copy of the video contents and the game software becomes possible.

As the protection technology for the firmware described above, for example, a method of storing an obfuscated program in a ROM (Read Only Memory) and a method described in the Patent Document 1, in which an encrypted program is stored in a ROM and the program is decrypted when it is executed, have been known. In the method in which a program is obfuscated, for example, a simple instruction in one row is transformed into an obfuscated instruction in plural rows, thereby making the cryptanalysis from outside difficult, but the overhead at the time of instruction execution is correspondingly increased. Further, it cannot be said that the protection against the falsification and copying is sufficient in this method. Meanwhile, in the method of performing the encryption, it is possible to provide sufficient protection against the cryptanalysis, falsification and copying, but in this case, appropriate cipher strength has to be provided. However, when the cipher strength is increased, the overhead is increased in proportion to the strength in general, and therefore, it is important to ensure compatibility therebetween.

In such a circumstance, in the technology of the Patent Document 1, a relatively high cipher strength is achieved by employing the encryption method in which a next encrypted code is generated by using a previous encrypted code. In this technology, however, when the branch instruction is issued, overheads different in size depending on the values of branch destination addresses thereof are generated, and therefore, there is a possibility that the real-time processing becomes difficult as the number of branch instructions directed to the branch destination addresses with large overhead is increased.

Therefore, an object of the present invention is to provide an information processing device, an encryption method of an instruction code and a decryption method of an encrypted instruction code capable of achieving the protection of software with reduced overhead. Note that the above and other objects and novel characteristics of the present invention will be apparent from the description of this specification and the accompanying drawings.

The typical embodiments of the inventions disclosed in this application will be briefly described as follows.

An information processing device according to one embodiment of the present invention comprises: a memory in which an encrypted code is stored; a decryptor for generating a decrypted code by decrypting the encrypted code; and an instruction execution unit for executing the decrypted code. When the instruction execution unit issues a branch instruction, the decryptor generates a decrypted code by performing a decryption in accordance with a low cipher strength to an encrypted code of the branch destination thereof, and thereafter, it generates a decrypted code by performing a decryption in accordance with a high cipher strength gradually as the instruction execution unit advances the process from the branch destination.

Therefore, although a certain degree of overhead is required until an initial instruction code after the branch instruction is issued is executed when the cipher strength is assumed to be always constant, the overhead can be reduced by using the configuration described above. By this means, the real-time processing can be realized in, for example, the embedded device. Furthermore, since the cipher strength is gradually increased after this initial instruction code, the sufficient cipher strength can be maintained when viewed as the whole instruction code.

Also, the above-described decryptor includes: a multiple-stage pipeline in which a decryption process is performed for each stage by using a key; a selection circuit which selects any one of outputs of each stage of the multiple-stage pipeline and outputs it to an instruction execution unit; and a control circuit which controls the selection circuit while detecting the issuance of the branch instruction by the instruction execution unit. By using the configuration described above, the decrypted code can be generated with the reduced overhead because the cipher strength is reduced by selecting the output passed through a small number of pipeline stages immediately after the issuance of the branch instruction. Thereafter, by gradually increasing the number of stages of the pipeline, the output of which is selected, the high cipher strength can be achieved, and at the same time, the decrypted code can be generated by the pipeline process in a time-efficient manner.

Also, in an encryption method of an instruction code according to one embodiment of the present invention, a previously prepared source code is transformed by using a program process by a computer system, thereby generating an encrypted code. At this time, the computer system first determines whether or not each source code assigned to each address is a branch instruction, and recognizes the branch destination address thereof. Subsequently, the computer system transforms the source code of the branch destination address by using a first encryption algorithm, thereby generating a first encrypted code, and further transforms the source code of the next address of the branch destination address by using a second encryption algorithm, thereby generating a second encrypted code. The second encryption algorithm mentioned here has a higher cipher strength than the first encryption algorithm. The encrypted code is generated by using such an encryption method and is stored in a memory of the above-described information processing device, so that the above-described effects can be achieved.

The effects obtained by typical embodiments of the inventions disclosed in this application will be briefly described below. That is, it becomes possible to protect the software with reduced overhead.

FIG. 1 is a block diagram showing one example of the general configuration of an information processing device according to one embodiment of the present invention;

FIG. 2 is a conceptual diagram showing a schematic configuration example and an operation example of a decryptor module in the information processing device of FIG. 1 ;

FIG. 3 is a block diagram showing a detailed configuration example of the decryptor module in the information processing device of FIG. 1 ;

FIG. 4 is a circuit diagram showing a detailed configuration example of a decryptor block in the decryptor module of FIG. 3 ;

FIG. 5 is an explanatory diagram showing an operation example of the decryptor block of FIG. 4 ;

FIG. 6 is a block diagram showing a configuration example of a main part of a cipher strength control block in the decryptor module of FIG. 3 ;

FIG. 7 is a sequence diagram showing an operation example in the case where the configuration examples of FIG. 4 and FIG. 6 are used in the decryptor module of FIG. 3 ;

FIG. 8 is a flow diagram showing an operation example of an encryption compiler used when generating the encrypted code in the information processing device of FIG. 1 ;

FIG. 9 is a supplementary diagram of FIG. 8 ; and

FIG. 10 is a flow diagram showing one example of the process in a decryption processing method of an encrypted instruction according to one embodiment of the present invention.

In the embodiments described below, when referring to the number of elements (including number of pieces, values, amount, range, and the like), the number of the elements is not limited to a specific number unless otherwise stated or except the case where the number is apparently limited to a specific number in principle, and the number larger or smaller than the specified number is also applicable. Further, in the embodiments described below, it goes without saying that the components (including element steps) are not always indispensable unless otherwise stated or except the case where the components are apparently indispensable in principle. Similarly, in the embodiments described below, when the shape of the components, positional relation thereof, and the like are mentioned, the substantially approximate and similar shapes and the like are included therein unless otherwise stated or except the case where it can be conceived that they are apparently excluded in principle. The same goes for the numerical value and the range described above.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. Note that components having the same function are denoted by the same reference numbers throughout the drawings for describing the embodiments, and the repetitive description thereof will be omitted.

FIG. 1 is a block diagram showing one example of the general configuration of an information processing device according to one embodiment of the present invention. An information processing device SYS of FIG. 1 is, for example, an information processing unit provided in a so-called embedded device typified by DVD equipment, a gaming machine, a mobile phone and others. This information processing device SYS includes a bus BS, a volatile memory (RAM: Random Access Memory), a non-volatile memory (ROM) and a processor (CPU: Central Processing Unit) mutually connected by the bus BS. The ROM is typically a flash memory, EEPROM (Electrically Erasable and Programmable Read Only Memory) or the like.

A program for controlling the embedded device (that is, firmware) is stored in the ROM. This firmware is encrypted in advance by using an external device PC typified by a personal computer and then stored. More specifically, the external device PC performs the encryption to a source code SC by using an encryption compiler CP_EN to be software and stores the encrypted source code SC_EN thus generated in the ROM.

The CPU includes a decryptor module DE_MD, a secret key KEY and a processor module CPU_MD. Although described later in detail, the decryptor module DE_MD receives a memory output code ICDm which is an encrypted code stored in the ROM, decrypts the same by using the secret key KEY and outputs the resulting decrypted code to the CPU_MD as a CPU instruction code ICDc. The CPU_MD performs the predetermined processes by fetching, decoding and executing the decrypted CPU instruction code ICDc (that is, equivalent to the source code SC) similarly to the general processor. The secret key KEY is set in advance in the CPU by using, for example, a hardware circuit, a non-volatile memory and others.

FIG. 2 is a conceptual diagram showing a schematic configuration example and an operation example of the decryptor module DE_MD in the information processing device of FIG. 1 . As shown in FIG. 2 , the decryptor module DE_MD is constituted of buffers BF 1 to BF 3 , decryptor circuits DE 1 to DE 3 , secret keys KEY 1 to KEY 3 , a selector SEL 1 and others. The DE 1 decrypts an output of the BF 1 by using the KEY 1 and then transmits it to the BF 2 , and the DE 2 decrypts an output of the BF 2 by using the KEY 2 and transmits it to the BF 3 . The DE 3 decrypts an output of the BF 3 by using the KEY 3 . The selector SEL 1 selects and outputs any one of the outputs of the DE 1 , DE 2 and DE 3 .

As described above, the DE_MD is mainly characterized by including a multiple-stage (here, three-stage) pipeline and the selector SEL 1 for selecting the outputs of each stage of the pipeline. In such a case, the cipher strength is increased as passing through the stages of the pipeline (in other words, as going from DE 1 to DE 3 ), but the overhead until taking the initial output immediately after the issuance of the branch instruction is correspondingly increased. Therefore, the selector SEL 1 capable of taking out the outputs with different cipher strengths is provided, thereby reducing the overhead.

More specifically, a case is assumed in which an encrypted code CD′ 1 is inputted at a cycle t=0 as the memory output code ICDm from the memory MEM (for example, corresponding to ROM of FIG. 1 ) immediately after the issuance of the branch instruction, and then, encrypted codes CD′ 2 , CD′ 3 and CD′ 4 are sequentially inputted at cycles t=1, t=2 and t=3. These encrypted codes CD′ 1 to CD′ 4 are sequentially inputted in the buffer BF 1 and processed in the pipeline.

Here, for the CD′ 1 to be the first input code, the DE_MD outputs the decrypted code CD 1 [ 1 ] by the selector SEL 1 after the decryption through the first-stage pipeline (decryptor circuit DE 1 ). Next, for the CD′ 2 to be the second input code, the DE_MD outputs the decrypted code CD 2 [ 2 ] by the SEL 1 after the decryption through the second-stage pipeline (decryptor circuits DE 1 and DE 2 ). Thereafter, for the CD′ 3 and CD′ 4 to be the third and subsequent input codes, the DE_MD outputs the decrypted codes CD 3 [ 3 ] and CD 4 [ 4 ] by the SEL 1 after the decryption through the third-stage pipeline (decryptor circuits DE 1 to DE 3 ). Note that [k] of CDn[k] indicates the number of stages (cipher strength) of the pipeline.

By using the operation as described above, the CD 1 [ 1 ] is outputted at t=1, the CD 2 [ 2 ] is outputted at t=3, and the CD 3 [ 3 ] and CD 4 [ 3 ] are outputted at t=5 and t=6, respectively. Meanwhile, if the cipher strength is not changed, the CD 1 [ 3 ] is outputted at t=3, and CD 2 [ 3 ] to CD 4 [ 3 ] are sequentially outputted at t=4 to t=6. Therefore, for the first and second input codes (CD′ 1 and CD′ 2 ), the overhead can be reduced by reducing the cipher strength, and for the third and subsequent input codes (CD′ 3 and CD′ 4 ), the cipher strength can be increased without particular overhead along with the pipeline process. Accordingly, when viewed as a whole, the high cipher strength can be achieved with reduced overhead.

Of course, the number of stages of the pipeline is not limited to three stages, and any number of stages can be used as long as the number is two or more. For example, when the number of stages is four, the CD 1 [ 1 ] is outputted at t=1, the CD 2 [ 2 ] is outputted at t=3, the CD 3 [ 3 ] is outputted at t=5, the CD 4 [ 4 ] is outputted at t=7, and subsequent CD 5 [ 4 ], CD 6 [ 4 ], . . . are outputted at t=8, t=9, . . . . In this case, the overhead caused by the decryption of the CD′ 1 to CD′ 3 can be reduced. As described above, the number of codes, the overhead of which can be reduced is increased as the number of stages of the pipeline is increased. Therefore, the effect of the present embodiment becomes more conspicuous. Furthermore, also in the case of the program that returns after executing a small number of instruction codes immediately after the issuance of the branch instruction, the above-described effect becomes more conspicuous.

FIG. 3 is a block diagram showing a detailed configuration example of the decryptor module DE_MD in the information processing device of FIG. 1 . The decryptor module DE_MD of FIG. 3 includes a cipher strength control block CTL_BK, a decryptor block DE_BK and a selector SEL 2 . The cipher strength control block CTL_BK receives a conditional branch generating signal BRc, an unconditional branch generating signal JPc, a bus command signal BCMDc, an address signal ADRc, a data signal DATc, an instruction fetch signal IFc and others as input signals from the processor module CPU_MD. The BRc and JPc are outputted by the CPU_MD when the branch is executed during the program execution of the CPU_MD. The BCMDc, ADRc and DATc correspond to access signals directed to the memory. The IFc is not outputted at the time of the data access to the memory but outputted at the time of the instruction code access. Note that, in the case of the instruction code access, the memory corresponds to the ROM of FIG. 1 or corresponds to the RAM of FIG. 1 when the instruction code is expanded in the RAM for use.

The CTL_BK receives these input signals from the CPU_MD and issues a bus command signal BCMDm and the address signal ADRm corresponding to the BCMDc and ADRc to the memory in the case of the instruction code access, thereby performing the instruction code access. The memory receives the BCMDm and ADRm and outputs a memory output code (that is, encrypted code) ICDm and a bus ready signal BRDYm. This memory output code (encrypted code) ICDm is inputted to the decryptor block DE_BK, and the bus ready signal BRDYm is inputted to the CTL_BK. Note that the bus ready signal BRDYm is a signal generated at its corresponding cycle each time when the memory output code ICDm is read from the memory.

The decryptor block DE_BK decrypts the ICDm and then outputs it to one input of the selector SEL 2 . At the time of this decryption, the CTL_BK outputs a select signal S for controlling the cipher strength (the number of stages of pipeline) as described in FIG. 2 and the address signal ADRm used as a part of the decryption key to the DE_BK. Further, the ICDm is transmitted to the other input of the selector SEL 2 directly without passing through the DE_BK. The CTL_BK uses the conditional branch generating signal BRc, the unconditional branch generating signal JPc and the bus ready signal BRDYm when controlling the cipher strength by using the select signal S. More specifically, upon reception of the BRc and JPc, the CTL_BK reduces the cipher strength of the instruction code read immediately thereafter from the memory, and then increases the cipher strength each time when receiving the BRDYm.

Also, the CTL_BK controls the selector SEL 2 with the select signal Sdt, and outputs the bus ready signal BRDYc at each cycle when the CPU instruction code (that is, decrypted code) ICDc is inputted from the decryptor block DE_BK through the SEL 2 . The processor module CPU_MD receives the CPU instruction code ICDc and the bus ready signal BRDYc to perform the predetermined process. Note that the SEL 2 is provided so as to handle the cycle where the decryption is not involved (for example, data access to a memory).

FIG. 4 is a circuit diagram showing a detailed configuration example of the decryptor block DE_BK in the decryptor module DE_MD of FIG. 3 . The decryptor block DE_BK of FIG. 4 is constituted of registers REG 40 , REG 41 a to REG 43 a and REG 41 b to REG 43 b , exclusive OR (EXOR) circuits EOR 40 , EOR 41 a to EOR 43 a and EOR 41 b to EOR 43 b , nonlinear transform circuits NL 1 to NL 3 , selectors SEL 1 and SEL 41 to SEL 44 and others.

The EOR 40 executes the EXOR operation of the memory output code ICDm and the address signal ADRm at which the code is stored. This operation is a part of the decryption algorithm (encryption algorithm). Note that, although the input to the EOR 40 is made from the ADRm through a compression circuit CPR in this case, since this compression circuit CPR is provided so as to equalize the bit widths of the ADRm and the ICDm, it is not particularly necessary when the bit widths are equal from the beginning. The REG 40 is a circuit for the encrypted code fetch and latches the operation result of the EOR 40 .

The first-stage decryption is performed when the output of the REG 40 passes through the process of the EOR 41 a , the NL 1 and the EOR 41 b . The EOR 41 a executes the EXOR operation of the output of the REG 40 and the secret key KEY 1 , the NL 1 performs the nonlinear transform of the EXOR operation result, and the EOR 41 b executes the EXOR operation of the nonlinear transform result and the code of the previous cycle stored in the REG 41 a . Although not particularly limited, for example, the method of transforming a certain bit column into another bit column by using a table or the like is known as the NL 1 . The output of the REG 40 is transmitted to the REG 41 a through one input of the SEL 41 . Also, the output of the REG 41 a is transmitted to the EOR 41 b through one input of the SEL 44 .

The second-stage decryption is performed when the output of the EOR 41 b which is the result of the first-stage decryption process passes through the process of the EOR 42 a , the NL 2 and the EOR 42 b . The EOR 42 a executes the EXOR operation of the output of the EOR 41 b and the secret key KEY 2 , the NL 2 performs the nonlinear transform of the EXOR operation result, and the EOR 42 b executes the EXOR operation of the nonlinear transform result and the code of the previous cycle stored in the REG 42 a . The output of the EOR 41 b is transmitted to the REG 42 a through one input of the SEL 42 . Also, the output of the REG 42 a is transmitted to the EOR 42 b.

The third-stage decryption is performed when the output of the EOR 42 b which is the result of the second-stage decryption process passes through the process of the EOR 43 a , the NL 3 and the EOR 43 b . The EOR 43 a executes the EXOR operation of the output of the EOR 42 b and the secret key KEY 3 , the NL 3 performs the nonlinear transform of the EXOR operation result, and the EOR 43 b executes the EXOR operation of the nonlinear transform result and the code of the previous cycle stored in the REG 43 a . The output of the EOR 42 b is transmitted to the REG 43 a through one input of the SEL 43 . Also, the output of the REG 43 a is transmitted to the EOR 43 b.

The SEL 1 selects any one of the first-stage decryption process result (output of the EOR 41 b ), the second-stage decryption process result (output of the EOR 42 b ) and the third-stage decryption process result (output of the EOR 43 b ), and outputs it as the CPU instruction code ICDc. The output of the EOR 41 b is selected when the select signal S 1 is inputted, the output of the EOR 42 b is selected when the select signal S 2 is inputted, and the output of the EOR 43 b is selected when the select signal S 3 is inputted. Note that the other input of the SEL 44 is an initial value IV, and the initial value IV is used in place of the code of the previous cycle when performing the first-stage decryption process for the initial instruction code immediately after the issuance of the branch instruction.

Also, the REG 41 b to the REG 43 b are used as save registers when an interrupt instruction is generated in the course of the decryption process. More specifically, when an interrupt instruction is issued, the REG 41 b latches the output of the REG 41 a (output of the SEL 44 ), the REG 42 b latches the output of the REG 42 a , and the REG 43 b latches the output of the REG 43 a . On the other hand, when returning from the interrupt instruction, the output of the REG 41 b is returned to the REG 41 a through the other input of the SEL 41 , the output of the REG 42 b is returned to the REG 42 a through the other input of the SEL 42 , and the output of the REG 43 b is returned to the REG 43 a through the other input of the SEL 43 .

FIG. 5 is an explanatory diagram showing an operation example of the decryptor block DE_BK of FIG. 4 . In FIG. 5 , f 1 denotes the EXOR operation by the KEY 1 of FIG. 4 and the following nonlinear operation by the NL 1 . Similarly, f 2 denotes the EXOR operation by the KEY 2 and the nonlinear operation by the NL 2 , and f 3 denotes the EXOR operation by the KEY 3 and the nonlinear operation by the NL 3 . A case is assumed in which the encrypted code CD′ 1 is inputted at the cycle t=0, CD′ 2 is inputted at the cycle t=1, . . . , and CD′ 7 is inputted at the cycle t=6 as the output of the REG 40 of FIG. 4 .

In this case, as the first-stage decryption process result, the decrypted code “CD 1 [ 1 ]=f 1 (CD′ 1 )+CD′ 0 ” (here, CD′ 0 =IV) is outputted at t=1, the decrypted code “CD 2 [ 1 ]=f 1 (CD′ 2 )+CD′ 1 ” is outputted at t=2, and subsequently the decrypted codes given by the formula (1) are outputted in the same manner.

CDn[ 1 ]=f 1( CD′n )+ CD′n− 1  (1)

Also, in parallel to these processes, the second-stage decryption process is performed in the pipeline. As the result of the second-stage decryption process, the decrypted code “CD 1 [ 2 ]=f 2 (CD 1 [ 1 ])+xx” (here, xx=indefinite) is outputted at t=2, the decrypted code “CD 2 [ 2 ]=f 2 (CD 2 [ 1 ])+CD 1 [ 1 ]” is outputted at t=3, and subsequently the decrypted codes given by the formula (2) are outputted in the same manner.

CDn[ 2 ]=f 2( CDn[ 1])+ CDn− 1[1]  (2)

Further, in parallel to these processes, the third-stage decryption process is performed in the pipeline. As the result of the third-stage decryption process, the decrypted code “CD 1 [ 3 ]=f 3 (CD 1 [ 2 ])+xx” (here, xx=indefinite) is outputted at t=3, the decrypted code “CD 2 [ 3 ]=f 3 (CD 2 [ 2 ])+CD 1 [ 2 ]” is outputted at t=4, and subsequently the decrypted codes given by the formula (3) are outputted in the same manner.

CDn[ 3 ]=f 3( CDn[ 2])+ CDn− 1[2]  (3)

Therefore, for obtaining the decrypted code CD 4 [ 3 ] at t=6, for example, the CD 4 [ 2 ] and the CD 3 [ 2 ] at the previous cycle (t=5) and the two-previous cycle (t=4) are necessary in addition to f 3 . Further, for obtaining the decrypted code CD 3 [ 2 ] at t=4, for example, the CD 3 [ 1 ] and the CD 2 [ 1 ] at the previous cycle (t=3) and the two-previous cycle (t=2) are necessary in addition to f 2 . Still further, for obtaining the decrypted code CD 2 [ 1 ] at t=2, for example, the CD′ 2 and the CD′ 1 are necessary in addition to f 1 . As described above, since the f 1 to f 3 and CD′ 1 to CD′ 4 are accordingly necessary for obtaining the CD 4 [ 3 ], the high cipher strength can be realized. Also, when the decrypted code CD′ 1 is the initial instruction code immediately after the branch instruction in FIG. 5 , as the CPU instruction code ICDc, the CD 1 [ 1 ] is obtained at t=1, the CD 2 [ 2 ] is obtained at t=3, the CD 3 [ 3 ] is obtained at t=5, the CD 4 [ 3 ] is obtained at t=6 and the CD 5 [ 3 ] is obtained at t=7 by the selector SEL 1 of FIG. 4 .

FIG. 6 is a block diagram showing a configuration example of a main part of the cipher strength control block CTL_BK in the decryptor module DE_MD of FIG. 3 . The cipher strength control block CTL_BK of FIG. 6 is provided with a counter unit CUNT, a select signal control unit SEL_CTL, a processor instruction fetch control unit IF_CTL and others. These can be realized by, for example, state machines and others. Upon reception of the logical OR (OR 6 ) output of the conditional branch generating signal BRc and the unconditional branch generating signal JPc from the processor module CPU_MD, the counter unit CUNT resets (RST) the value of a register REG 60 . Then, upon reception of the logical AND (AD 6 ) output of the clock signal CLK and the bus ready signal BRDYm, the counter unit CUNT adds “1” to the value of the REG 60 through an adder circuit ADD at each cycle where the BRDYm is inputted (that is, at each cycle where the encrypted code reaches from the memory).

The select signal control unit SEL_CTL outputs the select signals S 1 , S 2 and S 3 when the counter value of the REG 60 is “0”, “2” and “4”, respectively, and outputs the select signal S 3 when the counter value of the REG 60 is “5”, “6”, and subsequent values. The processor instruction fetch control unit IF_CTL outputs “1” as the bus ready signal BRDYc when the counter value of the REG 60 is “0”, “2” and “4”, and outputs “1” also when the counter value of the REG 60 is “5”, “6”, and subsequent values. Further, the IF_CTL outputs “0” as the BRDYc when the counter value is “1” or “3”.

FIG. 7 is a sequence diagram showing an operation example in the case where the configuration examples of FIG. 4 and FIG. 6 are used in the decryptor module DE_MD of FIG. 3 . In FIG. 7 , a case is assumed in which the fetch encrypted code (output of the FF 40 of FIG. 4 ) is CD′ 1 , CD′ 2 , CD′ 3 , . . . at the cycles t=1, t=2, t=3, . . . , respectively. At the cycle t=1, the select signal S 1 and the bus ready signal BRDYc=‘1’ are outputted from the cipher strength control block CTL_BK, and the decryptor block DE_BK outputs the decrypted code CD 1 [ 1 ] corresponding to the CD′ 1 in response to the select signal S 1 . At the cycle t=3, the select signal S 2 and the BRDYc=‘1’ are outputted by the CTL_BK, and the DE_BK outputs the decrypted code CD 2 [ 2 ] corresponding to the CD′ 2 in response to the S 2 .

At the cycle t=5, the select signal S 3 and the BRDYc=‘1’ are outputted by the CTL_BK, and the DE_BK outputs the decrypted code CD 3 [ 3 ] corresponding to the CD′ 3 in response to the S 3 . At the cycle t=6 and subsequent cycles, the select signal S 3 and the BRDYc=‘1’ are outputted by the CTL_BK at each of successive cycles, and the DE_BK sequentially outputs the decrypted codes CD 4 [ 3 ], CD 5 [ 3 ], . . . corresponding to the CD′ 4 , CD′ 5 , . . . at each cycle. The processor module CPU_MD performs the predetermined processes by fetching the decrypted code of the cycle of the BRDYc=‘1’ (that is, equivalent to the source code).

FIG. 8 is a flow diagram showing an operation example of the encryption compiler CP_EN used when generating the encrypted code in the information processing device of FIG. 1 . FIG. 9 is a supplementary diagram of FIG. 8 . First, it is assumed that the values of the address signal ADRm “0 to 57, . . . ” and the source codes “CD 1 to CD 58 , . . . ” sequentially assigned to the values of the ADRm are prepared in advance as the source codes SC before the encryption on the processing table TBL of the external device PC as shown in FIG. 9 . The encryption compiler CP_EN performs the encryption process with using the processing table TBL as an input, thereby creating the encrypted codes “CD′ 1 to CD′ 58 , . . . ” for each of the values of the address signals ADRm “0 to 57, . . . ”.

As shown in FIG. 8 , the encryption complier CP_EN first sets “j=1 and ADRm=0” (S 801 ). Next, it is determined whether or not the source code of the ADRm is the code to be the start of the branch boundary. More specifically, it is assumed that the source code CD 5 of ADRm=4 is the instruction of the unconditional branch to the subroutine of ADRm=52 and the source code CD 56 of ADRm=55 is the instruction of the return from the subroutine in FIG. 9 . In such a case, in addition to the CD 1 to be an initial code, the CD 6 of ADRm=5 which is the initial code after returning from the subroutine, the CD 53 of ADRm=52 which is the initial code after the subroutine branch and the CD 57 of ADRm=56 which is the initial code after the branch made in some way become the start codes (STAO to STA 3 ) of the branch boundary.

In FIG. 8 , the CP_EN sets j=1 (S 807 ) when the code is the start of the branch boundary, and executes the encryption operation “CDn=ADRm+CDn” corresponding to the decryption process to the EOR 40 of FIG. 4 (S 803 ) when it is not the start of the branch boundary. Subsequently, the CP_EN determines the value of j and generates the encrypted code CD′n in accordance with the value (S 804 ). At this time, (a) when j=1 (that is, the code of the start address of the branch boundary), the first-stage encrypted code CD′n=CD′n[ 1 ] is generated by using the formula (1)′. The f 1 ′ of the formula (1)′ is an inverse operation of the f 1 described in FIG. 5 and it means that the EXOR operation by the KEY 1 is executed after performing the nonlinear inverse transform. Furthermore, in the case of j=1, CDn−1 in the formula (1)′ is the initial value IV described in FIG. 5 .

CD′n[ 1 ]=f 1′( CDn )+ CDn− 1  (1)′

Also, in S 804 , (b) when j=2 (that is, the code of “the start address of the branch boundary+1”), the second-stage encrypted code CD′n=CD′n[ 2 ] is generated by using the formula (2)′. The f 2 ′ of the formula (2)′ is an inverse operation of the f 2 described in FIG. 5 and it means that the EXOR operation by the KEY 2 is executed after performing the nonlinear inverse transform. Furthermore, in the operation at this time, the CD′n[ 1 ] which is the first-stage encrypted code with respect to a target source code and the CD′n−1[ 1 ] which is the first-stage encrypted code with respect to the source code at the previous cycle thereof are used. These are given by the formula (1)′.

CD′n[ 2 ]=f 2′( CD′n[ 1])+ CD′n− 1[1]  (2)′

Further, in S 804 , (c) when j≧3 (that is, the code of “the start of the branch boundary+2” or more), the third-stage encrypted code CD′n=CD′n[ 3 ] is generated by using the formula (3)′. The f 3 ′ of the formula (3)′ is an inverse operation of the f 3 described in FIG. 5 and it means that the EXOR operation by the KEY 3 is executed after performing the nonlinear inverse transform. Furthermore, in the operation at this time, the CD′n[ 2 ] which is the second-stage encrypted code with respect to the target source code and the CD′n−1[ 2 ] which is the second-stage encrypted code with respect to the source code at the previous cycle thereof are used. These are given by the formula (2)′. Also, the formula (1)′ is used in order to execute the operation of the formula (2)′.

CD′n[ 3 ]=f 3′( CD′n[ 2])+ CD′n− 1[2]  (3)′

Next, the CP_EN sets “j=j+1 and ADRm=ADRm+1” in S 805 , and determines whether or not the ADRm is the last address in S 806 . When it is the last address, the decryption process ends, and when it is not so, the process returns to S 802 to perform the same process for the source code of the next ADRm. Then, the encrypted source code SC_EN thus generated is stored in the ROM in the information processing device SYS of FIG. 1 .

FIG. 10 is a flow diagram showing one example of the process in the decryption method of an encrypted instruction code according to one embodiment of the present invention. In the decryption method of FIG. 10 , the inverse operation of the above-described encryption method of FIG. 8 is executed, and in the process flow thereof, the decryption operation described in FIG. 2 to FIG. 7 is performed by, for example, the program process using a processor. The process steps S 1001 to S 1007 shown in FIG. 10 are almost the same as the process steps S 801 to S 807 described in FIG. 8 , and S 1003 corresponding to S 803 of FIG. 8 and S 1004 corresponding to S 804 of FIG. 8 only are varied.

More specifically, in S 1003 , upon reception of the encrypted code CD′n and its address signal ADRm, the decryption operation “CD′n=ADRm+CD′n” corresponding to the EOR 40 is executed. Furthermore, in S 1004 , (a) when j=1, the first-stage decrypted code CDn=CDn[ 1 ] is generated by using the formula (1) described in FIG. 5 . Similarly, (b) when j=2, the second-stage decrypted code CDn=CDn[ 2 ] is generated by using the formula (2), and (c) when j≧3, the third-stage decrypted code CDn=CDn[ 3 ] is generated by using the formula (3).

Note that, in FIG. 10 , the process of determining the value of j (cipher strength) in accordance with the distance from the branch instruction (that is, corresponding to S 1001 , S 1002 , S 1005 and S 1007 ) is performed by the cipher strength control block CTL_BK of FIG. 6 when the information processing device of FIG. 1 is used. Further, when the process of FIG. 10 is performed by, for example, the program process, the increment of the address signal ADRm (that is, corresponding to S 1005 ) is the process of the program counter and the like.

When the decryption process is performed by the program process as described above, although both the protection function and the execution speed are decreased as compared with the case of using the dedicated hardware like in FIG. 4 , the protection function can be ensured unless the secret key KEY is deciphered. Further, also in the case of using the program process, since the decryption algorithm is such that the cipher strength is gradually increased (that is, the amount of operation is increased) from immediately after the issuance of the branch instruction like that of the case of the hardware process, the overhead immediately after the issuance of the branch instruction can be reduced, and the speed-up can be achieved.

In the foregoing, the invention made by the inventors of the present invention has been concretely described based on the embodiments. However, it is needless to say that the present invention is not limited to the foregoing embodiments and various modifications and alterations can be made within the scope of the present invention.

For example, although the example where the decrypted codes are generated in the order of CD 1 [ 1 ], CD 2 [ 2 ], CD 3 [ 3 ], CD 4 [ 3 ], . . . by using the three-stage pipeline after the issuance of the branch instruction has been shown in the embodiment described above, various modifications can be made as long as the configuration is such that the number of process stages immediately after the issuance of the branch instruction is small and the number of process stages is gradually increased each time when passing through the instruction execution cycle. For example, it is also possible to output the decrypted codes in the order of CD 1 [ 2 ], CD 2 [ 3 ], CD 3 [ 4 ], CD 4 [ 4 ], . . . by using a four-stage pipeline and outputting the codes from the second-stage pipeline after the issuance of the branch instruction. Furthermore, it is also possible to output the decrypted codes in the order of CD 1 [ 1 ], CD 2 [ 3 ], CD 3 [ 5 ], CD 4 [ 5 ], . . . by using a five-stage pipeline and increasing the number of process stages by two stages at a time after the issuance of the branch instruction.

The information processing device according to one embodiment of the present invention is the technology particularly effective when applied to an embedded device for performing the desired hardware control by using the firmware stored in a ROM, and other than that, it can be widely applied to all the information processing devices in which the security is required.