Mitsubishi DS907x SIP User Manual page 77

Dummy Bus Access
The Secure Microcontroller makes its memory contents
obscure through encryption. Additional steps are also to
prevent analysis of the bus activity by 8051–familiar
hackers. Both the DS5000FP and DS5002FP insert
dummy memory operations when possible. In the 8051
architecture, there are typically two identical memory
accesses per instruction cycle, but most operations so
nothing with the second program fetch. In the Secure
Microcontroller, a pseudo–random address is gener-
ated for the dummy cycle and this random memory
address is actually fetched, but the dummy data is dis-
carded. The order of the real and dummy accesses are
DUMMY BUS ACCESS TIMING Figure 9–3
SINGLE CYCLE INSTRUCTION
ALE
CE1
BA14–0
BD7–0 CODE IN
SINGLE CYCLE INSTRUCTION
ALE
CE1
BA14–0
BD7–0 BYTE1 IN
Either XXXX or YYYY is real but encrpted, the other is pseudo–random.
Either QQQQ or RRRR is real but encrypted, the other is pseudo–random.
Either Byte1 or Byte2 is used, the other is a dummy fetch and is not used. Both are encrypted.
Either Byte3 or Byte4 is used, the other is a dummy fetch and is not used. Both are encrypted.
NON–ENCRYPTED MEMORY ACCESS
PC PC
CODE IN
ENCRYPTED MEMORY ACCESS WITH DUMMY FETCHES
XXXXh YYYYh
BYTE2 IN
switched according to a pseudo–random process. This
is repeatable so that the execution always appears the
same. During these pseudo–random cycles, the RAM is
to all appearance read. Thus by repeatedly switching
between real and dummy access, it is impossible to dis-
tinguish a dummy cycle from a real one. In analyzing
bus activity, a large percentage of the memory fetches
will be garbage that has no meaning. The dummy
accesses are always performed on a DS5002FP, but
are only used on a DS5000FP when encryption is
enabled. Naturally, dummy accesses are always read
operations since the dummy address might contain
valid data.
SINGLE CYCLE INSTRUCTION
PC+1
CODE IN
SINGLE CYCLE INSTRUCTION
QQQQh
BYTE3 IN
77
USER'S GUIDE
PC+1
CODE IN
RRRRh
BYTE4 IN
050396 76/173