JP2013097539A - Control device and control program illegal reading prevention method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a control device and a control program illegal reading prevention method for reducing manufacturing costs, and for easily changing a decryption program.SOLUTION: A control device 1 includes: a processor 5 for controlling a control object on the basis of a control program 31; and an external storage area 3 for storing the control program 31. The processor 5 includes an internal storage area 7 which can be set to a writable state and reading inhibition state from the outside. The control program 31 is stored in the external storage area 3 in an encrypted state, and a decryption routine 72 for decrypting the control program 31 is stored in the internal storage area 7.

Description

  The present invention relates to a control device and a control program unauthorized read prevention method.

2. Description of the Related Art Conventionally, a programmable control device is used for industrial / commercial or consumer equipment in order to control its operation. Such a control apparatus is configured based on a small computer system that executes a control program describing a control operation necessary for the device.
In a system used for a control device, an embedded microcontroller (MCU) or a general-purpose microprocessor (MPU) is used as a processor including a central processing unit (CPU) that executes a control program. Along with the processors (MCU, MPU) described above, a read / write random access memory (RAM) serving as a main storage area of the processor and a read-only memory (non-volatile external storage area for storing a control program) ROM). In some processors (MCU, MPU), a ROM and a RAM are integrated into one package.

In recent years, unauthorized use of a control program in a built-in control device has become a problem, and it is required to ensure resistance to such unauthorized use (tamper resistance).
Examples of unauthorized use of the control program in the control device include: I) illegally reading out the control program and illegally using the copy in other control devices (illegal copy); II) analyzing the read control program (reverse) Engineering), stealing a program that is not the copy itself, III) rewriting the read control program, returning it to the original control device and modifying its operation for the user's convenience (illegal modification of the gaming machine), etc. It is remarkable.

Among these, a technique for stopping the operation of the control device based on the modified control program by detecting a modification to the original control program has been proposed for unauthorized modification of the gaming machine (Patent Documents 1 to 3). 4).
However, with such a technology, even if the execution of a tampered control program can be prevented, the control program cannot be copied or stolen. There is a demand for prevention of the original illegal reading act itself.

Here, a so-called data encryption technique is well known for preventing unauthorized reading of a control program.
Such an encryption technique is also used in a built-in control device. For example, a control program stored in a ROM is encrypted in advance, and the encrypted control program is decrypted prior to operation. In this case, a processor performs a control operation based on a decoded control program on the RAM (Patent Documents 5 to 7).
In patent documents 5-7, even if only the encryption control program stored in ROM is read by memorize | storing in a processor the decryption program for performing decryption of a control program, subsequent analysis etc. The use is prohibited.

By the way, even if the techniques of Patent Documents 5 to 7 are used, if the decryption program is illegally read from the processor, the decryption program is used to decrypt the encryption control program stored in the ROM. It will be done.
Thus, a technique has been proposed in which dedicated hardware for security maintenance is provided in an MCU or the like used as a control device to prevent unauthorized reading of a decryption program stored in the processor (Patent Document 8).

Japanese Patent No. 2620020 Japanese Patent No. 2975522 Japanese Patent No. 3495409 Japanese Patent No. 4027738 Japanese Patent Laid-Open No. 10-228374 JP-A-8-305558 JP 2003-162341 A JP 2000-29790 A

  However, adding the security function as in Patent Document 8 to the processor as dedicated hardware leads to an increase in the manufacturing cost of the processor or a control device incorporating the processor. Further, every time the decryption program is changed, it is necessary to change the processor circuit and the manufacturing process, which may affect not only the cost but also the product delivery date.

  An object of the present invention is to provide a control device and a control program unauthorized read prevention method that can reduce the manufacturing cost and can easily change the decoding program.

The control device of the present invention is a control device having a processor that controls a control target based on a control program, and an external storage area that stores the control program,
The processor has an internal storage area that is writable from the outside and can be set to a read-inhibited state,
The control program is stored in the external storage area in an encrypted state,
A decoding routine for decoding the control program is stored in the internal storage area.

In the present invention, an encrypted control program is written in the external storage area in advance, and a decryption routine is written in the internal storage area.
In operation, the processor refers to the decryption routine in the internal storage area, reads the decrypted control program in the external storage area using this decryption routine, decrypts it, and decrypts it on the main storage area or the like. Expand the control program. Then, the processor performs an operation based on the decoded control program, and starts a control operation as a control device.
In order to perform the above-described operation, the encrypted control program in the external storage area is decrypted and decrypted in the processor startup program (IPL, boot loader) using the decryption routine in the internal storage area. It may be described that control is performed based on a control program. In this case, when the control device is activated, the above operation is realized by the processor performing an operation based on the IPL.

As described above, in the present invention, since the control program for the external storage area is encrypted, it cannot be decrypted even if it is read, and is protected against unauthorized reading.
Decryption of the encrypted control program requires a decryption routine stored in the internal storage area. The internal storage area is set in an external reading prohibited state after a decryption routine is written at the time of manufacture or the like. In this state, external reading is not possible except for processing in which the processor decrypts the control program. Therefore, unauthorized reading of the decryption routine is prevented, and unauthorized decryption of the control program by the decryption routine can be prevented.
In particular, in the present invention, since the decryption routine is stored in the internal storage area with the security function, high protection performance can be obtained with respect to the encrypted control program.

Further, in the present invention, since the control program is stored in the external storage area, it is possible to cope with a large control program by expanding the external storage area. That is, there is no limitation on the program size that causes a problem when the control program is stored in the internal storage area.
As described above, according to the present invention, strong protection against unauthorized reading can be obtained, and the configuration of the present invention can be easily realized by using a commercially available product such as a processor with a built-in nonvolatile memory with a security function. it can.
Therefore, an increase in cost as in the case of using dedicated hardware can be avoided, and even when the decoding routine is changed, the internal storage area can be rewritten, such as a change in the processor circuit and manufacturing process. Since complicated measures are not required, problems of cost and production delivery can be avoided.

The control device of the present invention includes, as the processor, a main processor that controls a control target based on a control program, and an auxiliary processor that has an internal storage area that is writable from the outside and can be set to a read-inhibited state. desirable.
Such a configuration of the present invention can be rephrased as follows.
The control device according to the present invention includes a main processor that controls a control target based on a control program, an external storage area that stores the control program, and an auxiliary storage area that is writable from outside and can be set in a read-inhibited state. A processor, and
The control program is stored in the external storage area in an encrypted state,
A decoding routine for decoding the control program is stored in the internal storage area.

In the present invention, as described for the auxiliary processor and its internal storage area as a processor that can be used in the present invention, commercially available products such as a processor with a built-in nonvolatile memory with a security function can be used. On the other hand, the main processor only needs to constitute a control device such as an existing microcontroller together with an external storage area, that is, a ROM storing a control program and a RAM serving as a main storage area.
That is, the configuration of the present invention can be said to be a configuration in which an auxiliary processor for decoding is added to an existing control device having a main processor and an external storage area.

In the present invention, an encrypted control program is written in the external storage area in advance, and a decryption routine is written in the internal storage area of the auxiliary processor.
The auxiliary processor refers to the decryption routine in the internal storage area, uses this decryption routine to read and decrypt the encrypted control program in the external storage area, and decrypts the control on the main storage area etc. Deploy the program. The main processor performs an operation based on the decoded control program, and starts a control operation as a control device.

  Note that the main processor startup program (IPL, boot loader) transfers control to the auxiliary processor after startup, and when the control is returned from the auxiliary processor, the main processor operates based on the decoded control program. It is good to describe in. Further, the auxiliary processor startup program (IPL, boot loader), after being started, decrypts the encrypted control program in the external storage area by using the decryption routine in the internal storage area, and then sends it to the main processor. It should be described so that control is returned. In this case, when the control device is activated, the main processor activates the auxiliary processor based on the IPL, and the auxiliary processor decodes the control program. After decoding, the auxiliary processor returns control to the main processor, and the main processor operates based on the decoded control program.

According to the present invention as described above, the main processor and the auxiliary processor cooperate with each other, that is, the start and control operations are performed by the main processor, and the decoding is performed by the auxiliary processor. It is possible to achieve the same effects as (with a single processor).
Furthermore, in the present invention, the decoding function can be separated into the auxiliary processor for the activation and control operations by the main processor. For this reason, the control apparatus of the present invention can be configured by adding an auxiliary processor having an internal storage area with a security function based on the present invention to an existing control apparatus having a main processor and an external storage area.
Therefore, by adding the auxiliary processor of the present invention to the existing control device, the control device of the present invention can be easily realized, and the auxiliary processor of the present invention is also added to the control device already in operation. By doing so, it can be set as the control apparatus of this invention, and the application range of this invention can be expanded.

The control program unauthorized read prevention method of the present invention is a control program unauthorized read prevention method for a control device having a processor that controls a control target based on a control program and an external storage area that stores the control program,
In order to use the processor having an internal storage area writable from the outside and set to a read-inhibited state, store the control program in an encrypted state in the external storage area, and decrypt the control program A preparation step for storing the decryption routine in the internal storage area;
A decoding step in which the processor refers to the decoding routine in the internal storage area and decodes the control program in the external storage area using the decoding routine when the control device is activated. When,
And an operation step in which the processor performs a control operation as the control device based on the decrypted control program.
According to the method of the present invention as described above, it is possible to obtain the operation and effects as described in the above-described control device of the present invention (with a single processor).

In the control program unauthorized read prevention method of the present invention, as the processor, a main processor that controls the control object based on a control program, and an auxiliary processor having an internal storage area that can be written from outside and set to a read-inhibited state, It is desirable to use.
Such a method of the present invention can be rephrased as follows.
The control program unauthorized read prevention method of the present invention is a control program unauthorized read prevention method for a control device having a processor that controls a control target based on a control program and an external storage area that stores the control program,
The control program is encrypted by using, as the processor, a main processor that controls the control target based on the control program, and an auxiliary processor that has an internal storage area that is writable externally and can be set in a read-inhibited state. Stored in the external storage area in a state of being prepared, and storing a decoding routine for decoding the control program in the internal storage area;
A decoding step in which the processor refers to the decoding routine in the internal storage area and decodes the control program in the external storage area using the decoding routine when the control device is activated. When,
An operation step in which the processor performs a control operation as the control device based on the decoded control program.
According to such a method of the present invention, it is possible to obtain the operation and effects as described in the above-described control device of the present invention (using a main processor and an auxiliary processor).

The block diagram which shows the control apparatus of 1st Embodiment of this invention. The flowchart which shows the process of the said 1st Embodiment. The block diagram which shows the control apparatus of 2nd Embodiment of this invention. The flowchart which shows the process of the said 2nd Embodiment. The block diagram which shows the control apparatus of 3rd Embodiment of this invention. The flowchart which shows the process of the said 3rd Embodiment. The block diagram which shows the control apparatus of 4th Embodiment of this invention. The flowchart which shows the process of the said 4th Embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[First Embodiment]
1 and 2 show a first embodiment of the present invention.
In FIG. 1, a control device 1 according to the present embodiment is an embedded control system that is incorporated in equipment and performs operation control of an operation portion (not shown) of the equipment.
The control device 1 includes a ROM 3, a RAM 4 and an MCU 5 connected to the system bus 2.

The ROM 3 is an external storage area configured by a read-only memory element, and stored contents can be read from the MCU 5 as needed via the system bus 2.
The RAM 4 is constituted by a memory element that can be read and written, and is arranged as a main storage area of the MCU 5, and can read or write stored contents from the MCU 5 at any time via the system bus 2.
The MCU 5 is a processor composed of an embedded microcontroller, and has a CPU 6 and a FROM 7 inside the package.

Specifically, the MCU 5 is a processor having an internal storage area that is writable from the outside and can be set in a read-inhibited state. For example, the central processing unit (CPU) and the internal storage area are rewritten in one integrated circuit package. A non-volatile memory (for example, EPROM, PROM, flash ROM, etc.) that can be used, and a non-volatile memory that has a security function for prohibiting external reading from the outside can be used.
Such a security function for the non-volatile memory can be performed under the control of the CPU, and there are a method of referring to information of a specific address designated in the internal memory or the external memory, and a method of performing authentication using a predetermined protect code. Can be adopted. Furthermore, it is also possible to use write inhibit mode switching by hardware using an interface called JTAG for circuit testing.

In such a processor, it is assumed that data in the nonvolatile memory can be read from a CPU in the same package regardless of the setting of the read prohibition state. That is, even when the security function of the nonvolatile memory is effective and reading of the nonvolatile memory from the outside is prohibited, the CPU can read the data in the nonvolatile memory without releasing the reading prohibited state. Shall.
A processor having such a nonvolatile memory with a security function can be selected from a commercially available embedded microcontroller (MCU) or microprocessor (MPU) product.
Specifically, as a microcontroller incorporating a flash ROM with a security function, there are TMP91 series manufactured by Toshiba Corporation, MSP430 series manufactured by Texas Instruments, USA, and the like.

As described above, the MCU 5 includes the CPU 6 and the FROM 7.
The CPU 6 is a central processing unit installed in an existing microprocessor or the like. The CPU 6 can read the contents of the ROM 3 as an external storage area via the system bus 2 and can store information on the RAM 4 as a main storage area. Reading or writing is possible.
An IPL 61 is disposed in the CPU 6.
The IPL 61 is a so-called boot loader that determines an operation at the time of activation. When the CPU 6 is activated, the IPL 61 is first read and the operation is performed according to the contents.
In the present embodiment, the IPL 61 is set with a program that specifies that the CPU 6 performs necessary initialization when it is started and then follows the IPL 71 of the FROM 7 described later.

The FROM 7 is a flash ROM with a security function that is arranged as an internal storage area of the MCU 5. The CPU 6 in the same MCU 5 can read the stored contents at any time, and can write the stored contents as necessary. It is.
The FROM 7 has a security function, and can set and cancel the read prohibition state by a control signal from the CPU 6.
When the reading prohibition state is set, reading from or writing to the FROM 7 from the outside is completely blocked.
When the reading prohibition state is cancelled, external reading from the FROM 7 is permitted, but writing is blocked.
Therefore, by setting the reading prohibition state, the contents stored in the FROM 7 are protected, and unauthorized reading from the outside is prevented.

In the control device 1 of the present embodiment, programs and the like necessary for the operation as the control device 1 are stored in the above-described FROM 7 and ROM 3.
The ROM 3 stores an encrypted control program 31. The encrypted control program 31 is obtained by encrypting a control program for the MCU 5 to perform a control operation as the control device 1 using a predetermined encryption rule.
In the FROM 7, an IPL 71 and a decryption routine 72 are arranged.

The IPL 71 is a so-called boot loader that determines the operation at startup, and is the same as the IPL 61 described above.
In this embodiment, the IPL 71 is designated to start the decryption routine 72 to execute the decryption of the encrypted control program 31 in the ROM 3 and to execute the decrypted control program after the decryption is completed. The program is set.
The decryption routine 72 is executed by the CPU 6, reads the encrypted control program 31 stored in the ROM 3, decrypts it based on a predetermined encryption rule, and decrypts it. The contents are set to be written in the RAM 4 as the control program 41.

  In the present embodiment, the control device 1 described above is prepared, the necessary programs and the like are stored in the above-described FROM 7 and ROM 3 (preparation process), and the MCU 5 is activated to decrypt the control program ( A series of processes up to the decoding process) and the control operation (operation process) based on this can be executed, and unauthorized reading of the control program can be prevented.

In FIG. 2, when the control device 1 is prepared as a preparation step, the encrypted control program 31 is stored in the ROM 3 and the decryption routine 72 is stored in the FROM 7 (step S11).
When ready, the MCU 5 of the control device 1 is activated. When the MCU 5 is activated, the CPU 6 reads the IPL 61 and executes the initialization operation of the MCU 5 and the control device 1 based on the contents (processing S12).

When the initialization operation is completed, the CPU 6 reads the IPL 71 in the FROM 7 in accordance with the IPL 71, and starts the decrypting process based on the content (processing S13).
The CPU 6 reads the decoding routine 72 into the FROM 7 according to the IPL 71, and executes the decoding process according to the decoding routine 72. In the decryption process, the encrypted control program 31 is read from the ROM 3, decrypted according to the decryption routine 72 (process S14), and the decrypted control program 41 is written in the RAM 4 (process S15).
The decoding process is performed by these.

After the decryption step, the CPU 6 reads the control program 41 in the RAM 4 according to the IPL 71, and starts the control operation as the control device 1 according to the control program 41 (processing S16).
Thereby, an operation process is performed.

According to the present embodiment as described above, the encrypted control program 31 in the ROM 3 that is the external storage area is encrypted and cannot be decrypted even if it is read out, and is protected against unauthorized reading. Is done.
Decryption of the encrypted control program 31 requires a decryption routine 72 stored in the FROM 7 which is an internal storage area. The FROM 7 serving as an internal storage area is set in an external reading prohibited state after the decryption routine 72 is written at the time of manufacture or the like. In this state, external reading is not possible except for the process in which the CPU 6 of the MCU 5, which is the processor, decrypts the encrypted control program 31. Therefore, unauthorized reading of the decryption routine 72 is prevented, and unauthorized decryption of the encrypted control program 31 by the decryption routine 72 can be prevented.

In particular, in the present embodiment, since the FROM 7 is used as an internal storage area with a security function and the decryption routine 72 is stored therein, a high protection performance can be obtained with respect to the encrypted control program 31.
As another technique, an encrypted control program and a decryption routine for decrypting the encrypted control program are stored in an external storage area, and a password is stored in an internal storage area with a security function. It can be considered that the control program is decrypted by the decryption routine when the authentication is obtained.
However, such password protection is practically a short code or character string and can be released relatively easily. Therefore, as long as authentication can pass, the decryption routine itself is not protected, and the control program may be easily decrypted.
On the other hand, in this embodiment, since the decryption routine 72 itself is stored in the FROM 7 which is an internal storage area with a security function, it is difficult to read out the entire routine, which is high with respect to the encrypted control program 31. Protective performance is obtained.

Furthermore, in this embodiment, since the encrypted control program 31 is stored in the ROM 3 that is an external storage area, it is possible to cope with a large encrypted control program 31 by expanding the ROM 3. That is, there is no limitation on the program size that causes a problem when the encrypted control program 31 is stored in the FROM 7 as the internal storage area.
As described above, in the present embodiment, strong protection against unauthorized reading is obtained, and the configuration of the control device 1 is easily realized by using a commercially available flash ROM with a security function as the MCU 5 as a processor. be able to.
Therefore, an increase in cost as in the case where dedicated hardware for the security function is configured in the MCU 5 can be avoided, and even when the decoding routine 72 is changed, the FROM 7 can be rewritten, and the processor circuit and manufacturing can be performed. Since complicated measures such as process changes are not necessary, problems of cost and production delivery can be avoided.

  Furthermore, in the present embodiment, the IPL 71 is installed in the FROM 7 and the processes from starting the decryption routine 72 to decrypting the encrypted control program 31 and writing the decrypted control program 41 to the RAM 4 are described in the IPL 71. Can do. By using such IPL7, it is only necessary to instruct the IPL 61 of the CPU 6 to jump to the IPL 71, and it is possible to avoid being restricted by the program size of the IPL 6 even if the processing related to decoding increases.

[Second Embodiment]
3 and 4 show a second embodiment of the present invention.
In FIG. 3, the control device 1 </ b> A of the present embodiment has substantially the same configuration as the control device 1 (see FIG. 1) of the first embodiment described above. For this reason, the description which overlaps using the same code | symbol regarding a common element is abbreviate | omitted.
The difference between the control device 1A of the present embodiment and the control device 1 of the first embodiment described above is the installation location of the IPL that instructs the decoding operation.

In the control device 1 according to the first embodiment, the IPL 71 is installed in the FROM 7 of the MCU 5, from starting the decryption routine 72 to decrypting the encrypted control program 31 and writing the decrypted control program 41 to the RAM 4. Was described in IPL71.
On the other hand, in the control apparatus 1A of the present embodiment, the FROM 7 has no IPL and stores only the decryption routine 72. On the other hand, the ROM 3 is provided with the IPL 32 together with the encrypted control program 31, and the decryption of the encrypted control program 31 from the activation of the decryption routine 72 and the writing of the decrypted control program 41 to the RAM 4 are performed here. Instructions are described.

In the present embodiment, the control device 1A described above is prepared, the necessary programs and the like are stored in the above-described FROM 7 and ROM 3 (preparation process), and the MCU 5 is activated to decrypt the control program ( A series of processes up to the decoding process) and the control operation (operation process) based on this can be executed, and unauthorized reading of the control program can be prevented.
These steps are the same as those in the first embodiment described above. Specifically, the processes S21 to S26 in the present embodiment shown in FIG. 4 are the processes S11 to S16 in the first embodiment described above (see FIG. 2). ).
However, in accordance with the change in the installation location of the IPL 32 described above, in the processing S23 in the present embodiment, the process shifts to decoding based on the IPL 32 in the ROM 3, and the IPL 71 in the FROM 7 in the processing S13 in the first embodiment is referred to. And different.

According to the present embodiment, the same effects as those of the first embodiment described above can be obtained with respect to prevention of unauthorized reading of the control program, reduction in manufacturing cost, and ease of changing the decryption program.
Furthermore, in this embodiment, since the IPL 32 describing the processing related to decryption is installed in the ROM 3, the storage area of the FROM 7 having the security function can be freed, and the size of the decryption routine 72 can be expanded. .
On the other hand, the decryption process described in the IPL 32 does not require confidentiality in itself, and there is no problem even if it is stored in the ROM 3.

[Third Embodiment]
5 and 6 show a third embodiment of the present invention.
In FIG. 5, the control device 1B of the present embodiment has a configuration (ROM 3, RAM 4, FROM 7) substantially similar to the control device 1 (see FIG. 1) of the first embodiment described above. For this reason, the description which overlaps using the same code | symbol regarding a common element is abbreviate | omitted.
The difference between the control device 1B of the present embodiment and the control device 1 of the first embodiment described above is the configuration of the processor.

That is, in the first embodiment (see FIG. 1), there is one MCU 5 as a processor, and the CPU 6 and FROM 7 are included therein. When the MCU 5 is activated, the CPU 6 refers to the IPL 61, jumps to the IPL 71 in the FROM 7, and executes the decoding by the decoding routine 72 according to the IPL 71.
On the other hand, in the present embodiment (see FIG. 5), a main MCU 5A that is a main processor and an auxiliary MCU 5B that is an auxiliary processor are installed as processors.

The main MCU 5A has a CPU 6A inside, and an IPL 61A is installed in the CPU 6A.
The auxiliary MCU 5B has a CPU 6B and a FROM 7 therein, and an IPL 71 and a decoding routine 72 are stored in the FROM 7.
In this embodiment, when the main MCU 5A is activated, the CPU 6A refers to the IPL 61A, jumps to the IPL 71 in the FROM 7 of the auxiliary MCU 5B, and executes the decoding by the decoding routine 72 according to the IPL 71.

Specifically, the CPU 6A of the main MCU 5A passes control to the CPU 6B of the auxiliary MCU 5B based on the program of the IPL 61A. The process up to writing the decrypted control program 41 into the RAM 4 is executed.
The CPU 6A of the main MCU 5A is in a standby state during the above-described decoding process, and when the decoding process is completed and control is returned from the CPU 6B, a control operation is performed based on the control program 41 in the decoded RAM 4 Execute.

In the present embodiment, the control device 1B described above is prepared, the necessary programs and the like are stored in the above-described FROM 7 and ROM 3 (preparation step), and the main MCU 5A is activated to decode the control program. A series of processes up to (decoding process) and control operation (operation process) based on this can be executed, and unauthorized reading of the control program can be prevented.
These steps are the same as those in the first embodiment described above. Specifically, the processes S31 to S36 in the present embodiment shown in FIG. 6 are the processes S11 to S16 in the first embodiment described above (see FIG. 2). ).
However, as described above, the processor is composed of the main MCU 5A and the auxiliary MCU 5B, and each processing is executed by being shared by the two processors.

In FIG. 6, when the control device 1B is prepared as a preparation step, the encrypted control program 31 is stored in the ROM 3, and the decryption routine 72 is stored in the FROM 7 of the auxiliary MCU 5B (processing S31).
When ready, the main MCU 5A of the control device 1B is activated. In the main MCU 5A, the CPU 6A reads the IPL 61A, and executes initialization operations of the main MCU 5A, the auxiliary MCU 5B, and the control device 1B based on the contents (processing S32).

When the initialization operation is completed, the CPU 6A transfers control to the CPU 6B of the auxiliary MCU 5B according to the IPL 61A, and the CPU 5B reads the IPL 71 in the FROM 7 and starts the decoding process based on the content (process S33).
In the auxiliary MCU 5 </ b> B, the CPU 6 </ b> B reads the decoding routine 72 into the FROM 7 according to the IPL 71, and executes the decoding process according to the decoding routine 72. In the decryption process, the encrypted control program 31 is read from the ROM 3, decrypted according to the decryption routine 72 (process S34), and the decrypted control program 41 is written in the RAM 4 (process S35).
The decoding process is performed by these.

After the decryption step, the control is returned from the CPU 6B to the CPU 6A of the main MCU 5A, and the CPU 6A reads the control program 41 in the RAM 4 according to the IPL 61A, and starts the control operation as the control device 1B according to the control program 41 (process S36). .
Thereby, an operation process is performed.

According to the present embodiment, the same effects as those of the first embodiment described above can be obtained with respect to prevention of unauthorized reading of the control program, reduction in manufacturing cost, and ease of changing the decryption program.
Furthermore, in this embodiment, the following effects can be obtained by using the main MCU 5A as the main processor and the auxiliary MCU 5B as the auxiliary processor as the processors.

The main MCU 5A, which is the main processor, executes control operations after the initialization process and the decoding process of the control device 1B before the decoding process are completed.
The auxiliary MCU 5B, which is an auxiliary processor, executes the decoding process exclusively. In particular, the FROM 7 of the auxiliary MCU 5B is provided with the IPL 71 describing the decoding process together with the decoding routine 72, and all the decoding processes are collected in the auxiliary MCU 5B.
That is, as the main MCU 5A, an MCU of an existing control device that does not have an illegal read prevention function can be used as it is, and can be used as the main MCU 5A of the present embodiment only by changing the IPL at the time of activation. it can.
Since the auxiliary MCU 5B collects all the decoding processes, it can be added to an existing control device to configure the control device 1B of the present embodiment.

  As described above, by adopting the configuration using the main processor and the auxiliary processor as in the present embodiment, the present invention can be easily implemented using the existing control device, and the existing control device is used as the security function of the present invention. In the case of a control device with a deadline, it is possible to eliminate the need for complicated modification work such as replacing an existing MCU.

[Fourth Embodiment]
7 and 8 show a fourth embodiment of the present invention.
In FIG. 7, the control device 1 </ b> C of this embodiment has substantially the same configuration as the control device 1 </ b> B (see FIG. 5) of the third embodiment described above, and many elements are in the first embodiment (see FIG. 1). And in common. For this reason, the description which overlaps using the same code | symbol regarding a common element is abbreviate | omitted.
The difference between the control device 1C of the present embodiment and the control device 1B of the third embodiment described above is the installation location of the IPL that instructs the decoding operation. This difference is the same as the difference of the second embodiment with respect to the first embodiment described above.

In the control device 1B according to the third embodiment, the IPL 71 is installed in the FROM 7 of the auxiliary MCU 5B, where the decryption routine 72 is started, the encrypted control program 31 is decrypted, and the decrypted control program 41 is written to the RAM 4. Up to this point was described in the IPL 71.
On the other hand, in the control device 1C of the present embodiment, the FROM 7 has no IPL, and stores only the decoding routine 72. On the other hand, the ROM 3 is provided with the IPL 32 together with the encrypted control program 31, and the decryption of the encrypted control program 31 from the activation of the decryption routine 72 and the writing of the decrypted control program 41 to the RAM 4 are performed here. Instructions are described.

In the present embodiment, the control device 1C described above is prepared, the necessary programs and the like are stored in the above-described FROM 7 and ROM 3 (preparation step), and the main MCU 5A is activated to decode the control program. A series of processes up to (decoding process) and control operation (operation process) based on this can be executed, and unauthorized reading of the control program can be prevented.
These steps are the same as those in the third embodiment described above. Specifically, the processes S41 to S46 in the present embodiment shown in FIG. 8 are the processes S31 to S36 in the third embodiment described above (see FIG. 6). ).
However, with the change in the installation location of the IPL 32 described above, in the process S43 in the present embodiment, the process shifts to decoding based on the IPL 32 in the ROM 3, and the IPL 71 in the FROM 7 in the process S33 in the third embodiment is referred to. And different.

According to the present embodiment, the same effects as those of the first embodiment described above can be obtained with respect to prevention of unauthorized reading of the control program, reduction in manufacturing cost, and ease of changing the decryption program.
Furthermore, in this embodiment, since the IPL 32 describing the processing related to decryption is installed in the ROM 3, the storage area of the FROM 7 having the security function can be freed, and the size of the decryption routine 72 can be expanded. .
On the other hand, the decryption process described in the IPL 32 does not require confidentiality in itself, and there is no problem even if it is stored in the ROM 3.

[Other Embodiments]
The present invention is not limited to the above-described embodiments, and modifications and the like within a scope that can achieve the object of the present invention are included in the present invention.
In the above embodiments, the ROM 3 and the RAM 4 are installed separately from the MCU 5, the main MCU 5A, and the auxiliary MCU 5B, which are processors, but may be incorporated into these processors.
For example, in the first embodiment and the second embodiment, a one-chip MCU including a ROM and a RAM may be used as the MCU 5. Alternatively, in the third and fourth embodiments, a one-chip MCU including a ROM and a RAM may be used as the main MCU 5A.

  In each of the embodiments, the FROM 7 which is a flash memory is used as an internal storage area having a security function. However, the invention is not limited to the flash memory, and an EPROM having another configuration may be used. In addition, as a method for realizing the security function (read prohibition and cancellation thereof), an existing technique may be used as appropriate. A method of performing authentication by using a protection code can be adopted.

1, 1A, 1B, 1C ... control device 2 ... system bus 31 ... encrypted control program 41 ... control program 5 ... MCU
5A ... Main MCU
5B ... Auxiliary MCU
6,6A, 6B ... CPU
61, 61A ... IPL
7 ... FROM
71 ... IPL
72: Decoding routine

Claims (4)

A control device having a processor for controlling a control object based on a control program, and an external storage area for storing the control program,
The processor has an internal storage area that is writable from the outside and can be set to a read-inhibited state,
The control program is stored in the external storage area in an encrypted state,
A control apparatus, wherein a decoding routine for decoding the control program is stored in the internal storage area. The control device according to claim 1,
A control apparatus comprising: a main processor that controls a control target based on a control program; and an auxiliary processor that has an internal storage area that is writable externally and can be set in a read-inhibited state. A control program unauthorized read prevention method for a control device having a processor for controlling a control object based on a control program and an external storage area for storing the control program,
In order to use the processor having an internal storage area writable from the outside and set to a read-inhibited state, store the control program in an encrypted state in the external storage area, and decrypt the control program A preparation step for storing the decryption routine in the internal storage area;
A decoding step in which the processor refers to the decoding routine in the internal storage area and decodes the control program in the external storage area using the decoding routine when the control device is activated. When,
A control program unauthorized reading prevention method comprising: an operation step in which the processor performs a control operation as the control device based on the decrypted control program. In the control program unauthorized read prevention method according to claim 3,
A control program fraud that uses a main processor that controls the control target based on a control program and an auxiliary processor having an internal storage area that can be written from outside and set to a read-inhibited state as the processor Read prevention method.

Images