Microprocessor

• US 20060005260A1
• Filed: 06/23/2005
• Published: 01/05/2006
• Est. Priority Date: 06/24/2004
• Status: Active Grant

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Haruki, Hiroyoshi, Hashimoto, Mikio, Kawabata, Takeshi
• Granted Patent: US 7,707,645 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A microprocessor includes a decryption unit that decrypts information to be utilized by a processor core to obtain plaintext information when the acquired information is encrypted; and a plaintext information storing unit that stores the plaintext information. The microprocessor also includes a protected attribute adding unit that adds a protected attribute indicating one of protection and non-protection to the plaintext information based on whether the decryption has been performed; an access request acquiring unit that acquires an access request to the plaintext information; a request type identifying unit that identifies a type of request of the access request; and an access controlling unit that controls an access to the plaintext information based on the type of request and the protected attribute.

Claims

1. A microprocessor comprising:

an information acquiring unit that acquires information to be utilized by a processor core from outside;

a decryption unit that decrypts the acquired information to obtain plaintext information, when the acquired information is encrypted;

a plaintext information storing unit that stores the plaintext information obtained by decryption;

a protected attribute adding unit that adds a protected attribute indicating one of protection and non-protection to the plaintext information based on whether the decryption has been performed;

an access request acquiring unit that acquires an access request to the plaintext information;

a request type identifying unit that identifies a type of request of the access request; and

an access controlling unit that controls an access to the plaintext information based on the type of request and the protected attribute.

2. The microprocessor according to claim 1, wherein

the protected attribute adding unit adds the protected attribute indicating protection to the plaintext information obtained by the decryption;

and

the access controlling unit restricts an access to the plaintext information to which the protected attribute indicating protection is added.

3. The microprocessor according to claim 1, wherein

the plaintext information storing unit stores the plaintext information when the information is plaintext information which is not encrypted,

the protected attribute adding unit adds the protected attribute indicating non-protection to the plaintext information, and

the access controlling unit permits an access to the plaintext information to which the protected attribute indicating non-protection is added.

4. The microprocessor according to claim 1, wherein

the access controlling unit restricts an access to the plaintext information when the type of request is other than a registered type of request.

5. The microprocessor according to claim 1, wherein

the access controlling unit permits an access to the plaintext information when the type of request is a registered type of request.

6. The microprocessor according to claim 5, wherein

the access controlling unit restricts the access to the plaintext information when the type of request is other than the registered type of request and when the plaintext information is added with the protected attribute indicating protection.

7. The microprocessor according to claim 1, wherein

the access controlling unit prohibits an access to the plaintext information based on the type of request and the protected attribute.

8. The microprocessor according to claim 1, wherein

the access controlling unit determines whether to output the plaintext information or encrypted information generated through encryption of the plaintext information based on the type of request and the protected attribute.

9. The microprocessor according to claim 1, wherein

the access controlling unit restricts an overwrite to the plaintext information based on the type of request and the protected attribute.

10. The microprocessor according to claim 9, further comprising,

an overwrite instruction acquiring unit that acquires an overwrite instruction which indicates whether an overwrite to the plaintext information is permitted, wherein

the access controlling unit permits the overwrite to the plaintext information on receiving the overwrite instruction indicating that the overwrite is permitted.

11. The microprocessor according to claim 1, wherein

the access controlling unit determines whether to delete the plaintext information already stored in the plaintext information storing unit, prior to the overwrite of the plaintext information, based on the type of request and the protected attribute.

12. The microprocessor according to claim 1, further comprising:

a cipher key storing unit that stores a plurality of cipher keys to be utilized for decryption; and

a protected attribute table that stores identification information of the cipher key and the protected attribute in association with each other, wherein

the protected attribute adding unit adds the protected attribute, which is associated with the cipher key in the protected attribute table, as the protected attribute of the plaintext information.

13. The microprocessor according to claim 12, further comprising:

a cipher key specifying unit that accepts specification of the cipher key to be utilized for decryption from a user, and

the decryption unit decrypts the encrypted information utilizing the cipher key specified by the user.

14. The microprocessor according to claim 1, wherein

the plaintext information storing unit stores a plural pieces of the plaintext information and the protected attributes of the plaintext information in association with each other, and

the access controlling unit controls an access for each piece of the plaintext information based on the type of request and the protected attribute which is associated with the plaintext information.

15. The microprocessor according to claim 4, wherein

the plaintext information storing unit is provided in an internal memory,

an instruction fetch by the processor core is registered as the registered type of request, and

the access controlling unit restricts an access when the type of request is not the instruction fetch by the processor core.

16. The microprocessor according to claim 1, wherein

the access controlling unit restricts an access to the plaintext information to be utilized for an execution of a program by the processor core based on the type of request and the protected attribute.

17. The microprocessor according to claim 16, wherein

the processor core executes the plaintext information by a pipeline processing, and

the access controlling unit restricts an access to the plaintext information executed by the processor core based on the type of request and each of the protected attributes added to respective plaintext information executed by units of the processor core.

18. The microprocessor according to claim 17, further comprising:

a plurality of protected attribute storing units that stores the protected attribute of the plaintext information executed in each stage of the pipeline processing, one protected attribute storing unit for each stage; and

the access controlling unit restricts the access to the plaintext information utilized for the execution of the program by the processor core based on each of the protected attributes stored by the plurality of protected attribute storing units.

19. The microprocessor according to claim 17, wherein

the access controlling unit restricts the access to the plaintext information utilized for the execution of the program by the processor core when the plaintext information executed by at least one of the stages among plural stages in the processor core is added with the protected attribute indicating the protection.

20. A microprocessor comprising:

an information acquiring unit that acquires information to be utilized by a processor core from outside;

a decryption unit that decrypts the acquired information to obtain plaintext information, when the acquired information is encrypted;

a plaintext information storing unit that stores the plaintext information obtained by decryption;

a cipher key storing unit that stores a cipher key to be utilized for decryption;

a key identification information adding unit that adds key identification information to identify the cipher key to the plaintext information;

a key identification information storing unit that stores the key identification information;

an access request acquiring unit that acquires an access request to the plaintext information;

a request type identifying unit that identifies a type of request of the access request; and

an access controlling unit that controls an access to the plaintext information based on the type of request and the key identification information.

21. The microprocessor according to claim 20, wherein

the key identification information is information which further indicates whether a protected attribute of corresponding plaintext information is protection or non-protection, and

the access controlling unit restricts the access to the plaintext information when the protected attribute indicated by the key identification information is protection.

22. The microprocessor according to claim 20, wherein

the key identification information is information which further indicates whether a protected attribute of corresponding plaintext information is protection or non-protection, and

the access controlling unit permits the access to the plaintext information when the protected attribute indicated by the key identification information is non-protection.

23. The microprocessor according to claim 20, wherein

the access controlling unit restricts the access to the plaintext information when the type of request is other than a registered type of request.

24. The microprocessor according to claim 20, wherein

the access controlling unit permits the access to the plaintext information when the type of request is the registered type of request.

25. The microprocessor according to claim 24, wherein

the access controlling unit restricts the access to the plaintext information when the type of request is other than the registered type of request and when the protected attribute indicated by the key identification information is protection.

26. The microprocessor according to claim 20, wherein

the access controlling unit prohibits the access to the plaintext information based on the type of request and the protected attribute.

27. The microprocessor according to claim 22, further comprising:

an initialization instruction acquiring unit that acquires an initialization instruction which instructs initialization of the plaintext information storing unit; and

an initializing unit that stores the key identification information that indicates that the protected attribute is non-protection in the key identification information storing unit when the initialization instruction is acquired.

28. The microprocessor according to claim 27, further comprising a state storing unit that stores state information which indicates whether the key identification information storing unit is in an initialized state, wherein

the access controlling unit permits the access to the plaintext information when the state information indicating the initialized state is stored.

29. The microprocessor according to claim 20, wherein

the access request includes the key identification information, and

the access controlling unit controls the access to the plaintext information based on the key identification information further included in the access request and the key identification information stored by the key identification information storing unit.

30. The microprocessor according to claim 29, wherein

the access controlling unit permits the access to the plaintext information when the key identification information included in the access request matches with the key identification information stored by the key identification information storing unit.

31. The microprocessor according to claim 20, wherein

the access controlling unit determines whether to output the plaintext information or encrypted information generated by encryption of the plaintext information based on the type of request and the key identification information.

32. The microprocessor according to claim 20, wherein

the access controlling unit restricts the access to the plaintext information utilized for an execution of a program by the processor core based on the type of request and the key identification information.

33. The microprocessor according to claim 32, wherein

the processor core executes the plaintext information by a pipeline processing, and

the access controlling unit restricts the access to the plaintext information utilized for the execution of the program by the processor core based on the type of request and each of the key identification information added to respective plaintext information executed by units in the processor core.

34. The microprocessor according to claim 33, wherein

the key identification information storing unit includes a plurality of key identification information storing units that stores the key identification information of the plaintext information executed in each stage of the pipeline processing, one key identification information storing unit for each stage, and

the access controlling unit restricts the access to the plaintext information utilized for the execution of the program by the processor core based on each of the key identification information stored by the plurality of key identification information storing units.

35. The microprocessor according to claim 33 wherein

the key identification information is information which further indicates whether the protected attribute of corresponding plaintext information is protection or non-protection, and

the access controlling unit restricts the access to the plaintext information executed by the processor core when the protected attribute of the key identification information for the plaintext information executed by at least one stage among a plurality of stages of the processor core indicates protection.

36. A microprocessor comprising:

a protected attribute storing unit that stores a protected attribute for a program executed by each stage of a pipeline in association with each stage;

a debug request acquiring unit that acquires a debug request from a debugger; and

a debug interruption controlling unit that permits an access from the debugger when the all protected attributes at a time the debug request is acquired indicate non-protection.

37. The microprocessor according to claim 36, wherein

the debug interruption controlling unit restricts the access from the debugger when at least one of the protected attributes at the time the debug request is acquired indicates protection.

38. A microprocessor comprising:

a protected attribute storing unit that stores a protected attribute for a program executed by a processor core; and

a trace information output controlling unit that permits an output of trace information acquired from the microprocessor when the protected attribute indicates non-protection.

39. The microprocessor according to claim 38, wherein

the trace information output controlling unit restricts the output of the trace information when the protected attribute indicates protection.