Information processing apparatus and information processing method

• US 9,158,924 B2
• Filed: 05/02/2012
• Issued: 10/13/2015
• Est. Priority Date: 05/25/2011
• Status: Active Grant

• Current Assignee: Sovereign Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Panasonic Intellectual Property Management Co., Ltd. (Panasonic Holdings Corporation)
• Inventors: Maeda, Manabu, Hirota, Teruto, Matsushima, Hideki
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): TRUVAN, LEYNNA THANH
• Application Number:
  US13/808,178
• Publication Number:
  US 20130111605A1
• Time in Patent Office: 1,259 Days
• Field of Search: 711/3, 711/5, 711/100, 711/113, 711118-126, 711/145, 711/152
• US Class Current: 1/1
• CPC Class Codes: G06F 12/126 with special data handling, e.g. priority of data or instructions, handling errors or pinning
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen

Abstract

An information processing apparatus that processes data to be protected is provided. The information processing apparatus includes a first storage unit, a second storage unit, and a cache control unit configured to cache data stored in the first storage unit into the second storage unit. The cache control unit is configured to lock a cache region in the second storage unit to thereby prevent cache data of the stored data from being written back into the first storage unit, the cache data being obtainable from the cache region in the second storage unit in which the stored data is cached, and write the data to be protected different from the stored data into the cache region in the second storage unit, after the cache region in the second storage unit is locked.

Claims

1. An information processing apparatus that performs predetermined processing on data to be protected, the information processing apparatus comprising:

a first storage unit;

a second storage unit;

a cache control unit configured to cache data stored in the first storage unit into the second storage unit;

a cache locking unit configured to instruct the cache control unit to lock a cache region in the second storage unit; and

a secret data loading unit configured to load the data to be protected in one of the first storage unit and the second storage unit,

wherein the cache control unit is configured to lock the cache region in the second storage unit to thereby prevent cache data of the stored data from being written back into the first storage unit, the cache data being obtainable from the cache region in the second storage unit in which the stored data is cached,

the cache locking unit is configured to;

read data which is different from the data to be protected and is already stored in a region into which the data to be protected is scheduled to be stored; and

instruct the cache control unit to lock the cache region in the second storage unit, and

the secret data loading unit is configured to write the data to be protected into the cache region in the second storage unit, after the cache region in the second storage unit is locked.

2. The information processing apparatus according to claim 1,

wherein the cache control unit is configured to write the data to be protected outputted from a processor in the cache region of the second storage unit, through a circuit physically protected to restrict an external apparatus from acquiring the data to be protected outputted from the processor, and

the second storage unit is physically protected to restrict an external apparatus from acquiring the data to be protected written in the cache region.

3. The information processing apparatus according to claim 1,

wherein the cache control unit is configured to, when the predetermined processing is performed on the data to be protected:

allocate a data region in the first storage unit to the data to be protected;

cache the stored data in the allocated data region in the second storage unit;

lock the cache region in the second storage unit, to thereby prevent the cache data of the stored data from being written back into the first storage unit, the cache data being obtainable from the cache region in the second storage unit in which the stored data is cached; and

write the data to be protected into the cache region in the second storage unit, after the cache region in the second storage unit is locked.

4. The information processing apparatus according to claim 1,

wherein the cache control unit is configured to unlock the cache region in the second storage unit so as to allow the cache data obtainable from the cache region in the second storage unit to be written back in the first storage unit, and

the cache locking unit is configured to:

clear the cache region in the second storage unit after the predetermined processing is performed on the data to be protected; and

instruct the cache control unit to unlock the cache region in the second storage unit.

5. The information processing apparatus according to claim 1, further comprising

a processor that executes a program for performing the predetermined processing on the data to be protected,

wherein the cache locking unit is configured to, upon receiving an instruction from the program, read the data which is different from the data to be protected and is already stored in the region into which the data to be protected is scheduled to be stored, and instruct the cache control unit to lock the cache region in the second storage unit, and

the secret data loading unit is configured to, upon receiving an instruction from the program, write the data to be protected in the cache region in the second storage unit, after the cache region in the second storage unit is locked.

6. The information processing apparatus according to claim 5, further comprising

an integrated circuit,

wherein the second storage unit, the cache control unit, and the processor are included in the integrated circuit.

7. The information processing apparatus according to claim 5,

wherein the program further generates the data to be protected by decrypting encrypted data, and performs the predetermined processing on the generated data to be protected.

8. The information processing apparatus according to claim 7,

wherein, prior to decrypting the encrypted data, the program, using the cache locking unit, reads the data which is different from the data to be protected and is already stored in the region into which the data to be protected is scheduled to be stored, and instructs the cache control unit to lock the cache region in the second storage unit.

9. The information processing apparatus according to claim 5,

wherein the processor executes a secure program in a secure mode and a normal program in a normal mode, and

the first storage unit includes:

a first storage region in which the normal program is to be stored; and

a second storage region in which the secure program is to be stored and an access to which by the normal program is restricted.

10. The information processing apparatus according to claim 9,

wherein the cache control unit is configured to write, in the cache region in the second storage unit, the data to be protected scheduled by the secure program to be written in the second storage region.

11. The information processing apparatus according to claim 9, further comprising

an access control unit configured to restrict the normal program from accessing the second storage region.

12. The information processing apparatus according to claim 1,

wherein the cache control unit is configured to write, in the cache region in the second storage unit, the data to be protected scheduled by a program to be written in the first storage unit.

13. The information processing apparatus according to claim 1,

wherein the cache control unit is configured to write an executable program in the cache region in the second storage unit, as the data to be protected.

14. The information processing apparatus according to claim 1, further comprising

a processor that executes a program for performing the predetermined processing on the data to be protected,

wherein the cache locking unit is configured to:

clear the cache region in the second storage unit, upon receiving an instruction from the program after the predetermined processing ends; and

instruct the cache control unit to unlock the cache region in the second storage unit.

15. The information processing apparatus according to claim 1, further comprising

a processor that executes a program for performing the predetermined processing on the data to be protected,

wherein the cache locking unit is configured to:

clear the cache region in the second storage unit, when the program for performing the predetermined processing ends; and

instruct the cache control unit to unlock the cache region in the second storage unit.

16. An information processing method for performing predetermined processing on data to be protected, the method comprising:

caching data stored in a first storage unit into a second storage unit;

instructing locking of a cache region in the second storage unit; and

loading the data to be protected in one of the first storage unit and the second storage unit,

wherein in the caching, the cache region in the second storage unit is locked to thereby prevent cache data of the stored data from being written back into the first storage unit, the cache data being obtainable from the cache region in the second storage unit in which the stored data is cached,

in the instructing, data which is different from the data to be protected and is already stored in a region into which the data to be protected is scheduled to be stored is read, and locking of the cache region in the second storage unit is instructed to be performed, and

in the loading, the data to be protected is written into the cache region in the second storage unit, after the cache region in the second storage unit is locked.

17. A non-transitory computer-readable recording medium for use in a computer, the recording medium having a computer program recorded thereon for causing the computer to execute the information processing method according to claim 16.

18. An integrated circuit that performs predetermined processing on data to be protected, the integrated circuit comprising:

a storage unit;

a cache control unit configured to cache data stored in a storage device into the storage unit;

a cache locking unit configured to instruct the cache control unit to lock a cache region in the storage unit; and

a secret data loading unit configured to load the data to be protected in one of the storage device and the storage unit,

wherein the cache control unit is configured to lock the cache region in the storage unit to thereby prevent cache data of the stored data from being written back into the storage device, the cache data being obtainable from the cache region in the storage unit in which the stored data is cached,

the cache locking unit is configured to;

read data which is different from the data to be protected and is already stored in a region into which the data to be protected is scheduled to be stored; and

instruct the cache control unit to lock the cache region in the storage unit, and

the secret data loading unit is configured to write the data to be protected into the cache region in the storage unit, after the cache region in the storage unit is locked.