Mitsubishi Motors DS5000TK - Manual (Page 75)

USER’S GUIDE
050396 74/173
75
In a DS5000, the encryption feature is optional. A
DS5000 can be locked irrespective of its encryption and
encrypted irrespective of the lock. Neither makes much
sense by itself. The encryption process is enabled by
loading an Encryption Key for the first time. Prior to load-
ing a Key, the DS5000 remains in a non–encrypted
state. Once encrypted, the memory interface will remain
so until a part is locked, then unlocked. The process of
clearing the Security Lock deactivates the encryption
circuits. Note that an Encryption Key of zero is still a
valid Key. A DS5002 has encryption enabled at all
times. No extra steps are required to invoke it. As dis-
cussed below, the DS5002 generates its own security
Keys.
Encryption logic consists of an address encryptor and a
data encryptor using separate but related algorithms.
These encryptors are high speed circuits that are trans-
parent to the application software. They are bidirec-
tional and repeatable. That is, addresses and data that
are scrambled prior to writing to RAM will be correctly
unscrambled when reading in reverse. Each encryptor
operates with its own algorithm but both are dependent
on the Encryption Key. Encryptors operate while pro-
grams are being loaded so that the memory contents
are stored in its scrambled form. When program
memory is fetched, the process is reversed. Thus the
actual program or data is only present in its “true” form
while inside the microcontroller.
The address encryptor translates each “logical”
address, i.e., the normal sequence of addresses that
are generated in the logical flow of a program, into an
encrypted address (or physical address) at which the
byte is actually stored in RAM. Each time a logical
address is generated either during program loading or
during execution, the address encryptor circuits use the
Encryption Key value and the address itself to form the
physical address that will be presented to the RAM on
the Byte–wide bus. The encryption algorithm is such
that there is one and only one physical address for
every possible logical address. The address encryptor
operates over the entire memory range.
The Data Encryptor operates in a similar manner to the
address encryptor. As each byte including opcode,
operand, or data is received during Bootstrap Loading,
its value is scrambled prior to storing it in RAM. The
value that is actually written in RAM is an encrypted rep-
resentation. All values that are subsequently stored in
RAM during execution also are encrypted. As each byte
is read back to the CPU during execution, the internal
Data Encryptor restores it to its original value. This
encryptor uses the Encryption Key and the data value
itself, but also the logical address. Thus the same data
with the same Key will have different physical values at
different address locations. The data encryption algo-
rithm is repeatable and reversible so that with the same
key, data and address, the same encrypted value will be
obtained. Note however that there are many possible
encrypted data values for each possible true value due
to the algorithms dependency on Key and address.
Using the combination of address and data encryption,
the normal flow of program code is unintelligible in the
NV RAM. What had been a sequential flow of addresses
is now apparently random. The values stored in each
memory location appear to have no relation to the origi-
nal data. Another factor that makes analysis more diffi-
cult is that all 256 possible values in each memory are
valid possibilities. Thus an encrypted value is not only
scrambled, but it becomes another potentially valid
byte.
Different memory areas are encrypted in the DS5000
and DS5002. For a DS5000, all memory accessed
under CE1 can be encrypted. CE2 is not encrypted. This
allows access to peripherals such as a Real–time Clock
to be performed using CE2.
For the DS5002, encryption is performed on all bytes
stored under CE1 through CE4. The memory or periph-
erals accessed by PE1 through PE4 on a DS5002 are
not encrypted.