CRYPTOGRAPHIC PROCESSING APPARATUS, CRYPTOGRAPHIC PROCESSING SYSTEM, AND CRYPTOGRAPHIC PROCESSING METHOD

• US 20150310230A1
• Filed: 10/07/2014
• Published: 10/29/2015
• Est. Priority Date: 04/28/2014
• Status: Active Grant

• Current Assignee: Nintendo Company Limited
• Original Assignee: Nintendo Company Limited
• Inventors: Shirai, Tatsuhiro
• Granted Patent: US 9,411,984 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A process mode of either of an encryption process and a decryption process is set for at least one of a plurality of pieces of key data, in association with the key data. Then, a mode specifying command for specifying a process mode in association with key data is received from another apparatus, and if the received process mode and the process mode associated with the key data coincide with each other, the process in the process mode using the key data is permitted.

Claims

1. A cryptographic processing apparatus for encrypting and decrypting data, the cryptographic processing apparatus comprising:

a key data storage area in which a plurality of pieces of key data used for encryption and/or decryption are stored;

a mode setting circuit configured to set, for at least one of the plurality of pieces of key data stored in the key data storage area, a process mode of either of an encryption process and a decryption process in association with the key data; and

a process limitation circuit configured to receive a mode specifying command for specifying a process mode in association with key data from another apparatus, and if the received process mode and the process mode associated with the key data set in the mode setting circuit coincide with each other, permit the process in the process mode using the key data.

2. The cryptographic processing apparatus according to claim 1, wherein

the key data associated with the process mode of either of the encryption process and the decryption process is key data of a common key that can be used in the encryption process and the decryption process.

3. The cryptographic processing apparatus according to claim 1, wherein

the key data is written to the key data storage area when the cryptographic processing apparatus is started, and

the mode setting circuit sets a process mode corresponding to the written key data when the cryptographic processing apparatus is started.

4. The cryptographic processing apparatus according to claim 1, wherein

the key data is written to the key data storage area by execution of secure system firmware, and

a process mode corresponding to the written key data is set in the mode setting circuit by execution of the system firmware.

5. The cryptographic processing apparatus according to claim 4, wherein

the system firmware is a boot program stored in a boot ROM.

6. The cryptographic processing apparatus according to claim 1, wherein

if the process mode specified by the received mode specifying command and the process mode set in the mode setting circuit do not coincide with each other, the process limitation circuit erases the key data to be used in the process mode from the key data storage area.

7. The cryptographic processing apparatus according to claim 1, wherein

if the process mode specified by the received mode specifying command and the process mode set in the mode setting circuit do not coincide with each other, the process limitation circuit discards the mode specifying command.

8. The cryptographic processing apparatus according to claim 1, further comprising a dummy key data storage area configured to store dummy key data different from the plurality of pieces of key data, wherein

if the process mode specified by the received mode specifying command and the process mode set in the mode setting circuit do not coincide with each other, the process limitation circuit performs control for processing data in the process mode using the dummy key data in a processing circuit.

9. The cryptographic processing apparatus according to claim 1, wherein

if the process mode specified by the received mode specifying command and the process mode set in the mode setting circuit do not coincide with each other, the process limitation circuit refuses to receive data input to be processed in the process mode.

10. The cryptographic processing apparatus according to claim 1, wherein

if the process mode specified by the received mode specifying command and the process mode set in the mode setting circuit do not coincide with each other, the process limitation circuit outputs, as data processed in the process mode, data generated by a process different from the process of the processing mode.

11. A cryptographic processing apparatus for encrypting and decrypting data, the cryptographic processing apparatus comprising:

a key data storage area in which key data used for encryption and/or decryption is stored;

a mode setting circuit configured to set, for the key data stored in the key data storage area, a process mode of either of an encryption process and a decryption process in association with the key data; and

a process limitation circuit configured to receive a mode specifying command for specifying a process mode from another apparatus, and if the received process mode and the process mode set in the mode setting circuit coincide with each other, permit the process in the process mode using the key data associated with the process mode.

12. A cryptographic processing system including a cryptographic processing apparatus for encrypting and decrypting data and system firmware for controlling the cryptographic processing apparatus, the cryptographic processing apparatus comprising:

a key data storage area to which a plurality of pieces of key data used for encryption and/or decryption are written by the system firmware;

a mode setting circuit in which a process mode of either of an encryption process and a decryption process is set for at least one of the plurality of pieces of key data stored in the key data storage area, in association with the key data by the system firmware; and

a process limitation circuit configured to receive a mode specifying command for specifying a process mode in association with key data from another apparatus, and if the received process mode and the process mode associated with the key data set in the mode setting circuit coincide with each other, permit the process in the process mode using the key data.

13. A cryptographic processing method for encrypting and decrypting data, the cryptographic processing method comprising:

storing in a storage area a plurality of pieces of key data used for encryption and/or decryption;

setting a process mode of either of an encryption process and a decryption process for at least one of the plurality of pieces of key data stored in the storage area, in association with the key data; and

receiving a mode specifying command for specifying a process mode in association with key data from another apparatus, and if the received process mode and the process mode associated with the key data set in the setting in association with the key data coincide with each other, permitting the process in the process mode using the key data.