Electronic device with firmware and operating method thereof

Abstract

Embodiments of the present disclosure relate to electronic devices with firmware and methods of operating the same. Embodiment An electronic device includes a memory containing multiple copies of firmware for the device.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of French Patent Application No. 1908696, filed on July 30, 2019, which is incorporated herein by reference. Technical Field

[0003] The present disclosure relates generally to electronic devices and methods, and more particularly to electronic devices including firmware and methods of operating the same. Background Art

[0004] Some electronic devices include a data processing unit capable of executing programs, for example, a processing unit including one or more microprocessors.

[0005] Such devices usually comprise firmware. Firmware means a program which has to be executed by a processing unit in order for the device to operate, which program is stored in the device, ie contained in a memory of the device. Summary of the invention

[0006] Embodiments overcome all or part of the disadvantages of known electronic devices comprising a processing unit, in particular comprising firmware.

[0007] Embodiments overcome all or part of the disadvantages of known firmware.

[0008] Embodiments overcome all or part of the disadvantages of known firmware update methods.

[0009] An embodiment provides an electronic device in which the memory contains multiple copies of firmware for the device.

[0010] According to an embodiment, each of the copies, when executed by a device, enables the device to operate in accordance with a Trusted Platform Module (TPM) standard.

[0011] According to an embodiment, the memory further comprises a signature for each of the copies for checking the validity of said copy.

[0012] According to an embodiment, the memory further comprises a program for starting the device, which program, when executed by the device, is capable of causing a validity check and execution of at least one of the copies.

[0013] According to an embodiment, the memory comprises a value indicative of a replica selected from among said replicas.

[0014] According to an embodiment, the selected copy corresponds to the latest version among the firmware versions.

[0015] According to an embodiment, the memory further comprises a common file system accessible to each of said replicas.

[0016] Embodiments provide methods of operating the apparatus described above.

[0017] According to an embodiment, the method comprises executing one of the replicas, the executed replica being valid and corresponding to a latest replica version among the valid replica versions.

[0018] According to an embodiment, a method comprises replacing an invalid copy among the copies with another valid copy among the copies.

[0019] According to an embodiment, the method comprises replacing one of said copies by another of said copies corresponding to a newer version than the version of the replaced copy.

[0020] According to an embodiment, the method comprises receiving, by the device: an additional copy of the firmware, wherein, depending on the value of a future location of the additional copy on a memory, is replaced with the same predefined value, the predefined value preferably having all its bits equal to a memory erase value; and the associated value, the associated value being for each location of the location of the copy in the memory.

[0021] According to an embodiment, the method further comprises replacing at least one of the replicas with an additional replica and restoring the relevant value corresponding to the position of the replaced replica.

[0022] According to an embodiment, the additional copy and / or the associated value are received in compressed form and then decompressed.

[0023] An embodiment provides an electronic component, preferably comprising a package, comprising a device such as defined above or a device capable of carrying out a method as described above.

[0024] The foregoing and other features and advantages will be discussed in detail in the following non-limiting description of specific embodiments in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] For a more complete understanding of the present invention and its advantages, reference is now made to the following description taken in conjunction with the accompanying drawings, in which:

[0026] Figure 1 shows an example of a device to which the embodiments described below are applicable;

[0027] Figure 2 schematically illustrates an embodiment of a memory of a device including firmware;

[0028] Figure 3 An embodiment of a method implemented by a device including firmware is schematically illustrated in block form;

[0029] Figure 4 Schematically illustrating the steps of an embodiment of a firmware update method;

[0030] Figure 5 schematically illustrates another step of the method; and

[0031] Figure 6 A further step of the method is shown schematically. DETAILED DESCRIPTION

[0032] In different drawings, the same elements are designated by the same reference numerals. In particular, structural and / or functional elements common to different embodiments may be designated by the same reference numerals and may have the same structure, size and material properties.

[0033] For the sake of clarity, only the steps and elements useful for understanding the described embodiments are shown and described in detail. In particular, the firmware is not described in detail, and the described embodiments are compatible with common firmware.

[0034] In the following description, when reference is made to terms defining absolute positions (such as terms “front”, “back”, “top”, “bottom”, “left”, “right”, etc.), or relative positions (such as terms “above”, “below”, “upper”, “lower”, etc.), or terms defining directions (such as terms “horizontal”, “vertical”, etc.), unless otherwise specified, the orientation of the drawings is referred to.

[0035] The terms “nearly,” “approximately,” “substantially,” and “about” are used herein to indicate a tolerance of plus or minus 10%, preferably plus or minus 5%, of the stated value.

[0036] Figure 1 An example is shown in which the described embodiments are applicable to a device. More particularly, the device is a device including firmware.

[0037] In this example, the device comprises an electronic component 100. The electronic component comprises one or more electronic integrated circuit chips 110. The electronic chip or each electronic chip 110 is defined by a semiconductor wafer portion and electronic circuits located within and on the wafer. As an example, the electronic component 100 also comprises a package 120 comprising the (multiple) electronic chips, typically a compact package having conductive pins 122 protruding from it. The pins 122 are intended to be electrically coupled to other components, preferably soldered to a printed circuit board PCB.

[0038] The firmware is stored in a memory 130 (MEM). Preferably, the memory 130 is non-volatile, more preferably rewritable. For example, the memory 130 is an electrically erasable programmable read-only memory EEPROM type memory, such as a memory known as "flash memory". Such a flash memory is defined by a memory comprising transistors, each transistor having a floating gate capable of storing an electric charge. Preferably, the memory 130 is located inside the package 120, more preferably included in the chip(s) 110.

[0039] The electronic component 100 further comprises a data processing unit 140. Preferably, the processing unit is located in the package 120. For example, the data processing unit is located on the same electronic chip 110 as the memory 130.

[0040] Preferably, during the execution of the firmware by the device (more precisely, by the processing unit 140), the firmware causes the device to operate according to the Trusted Platform Module (TPM) standard of the standard ISO / IEC 11889-1 (e.g., ISO / IEC 11889-1:2015 or a newer version). The device may then form a TPM cryptographic component. TPM cryptographic components are typically used in electronic and / or computer equipment (such as computers, tablet computers, cellular phones, etc.), or also in various objects or systems referred to as connected (i.e., connectable to the Internet), (e.g., motor vehicles or cameras). Such components are typically used to store cryptographic keys.

[0041] The application of the described embodiments is not limited to Figure 1 The described embodiments are applicable to any device including firmware. In particular, the memory and the processing unit may be located in different packages, or the device may also be included in a component, for example, a system on a chip including other electronic devices.

[0042] Figure 2 Schematically illustrates an embodiment of a memory of a device including firmware. More particularly, the contents of the memory 200 are stored in Figure 2 In the embodiment, the memory 200 replaces Figure 1 A memory 130 of a device of the type.

[0043] The memory 200 is for example Figure 1The memory 130 of the device is of the same type (i.e. preferably a non-volatile rewritable memory (e.g. a flash type memory). The memory 200 may correspond to one or more memory banks, which are located in the same chip or multiple chips of the same component or multiple different components. According to an embodiment, the elements contained in the memory are in the order of the positions shown, i.e. in the order of increasing addresses in the memory, which addresses are physical addresses or preferably logical addresses. However, the described embodiments are compatible with all positions of the different elements contained in the memory.

[0044] The memory 130 includes a plurality of copies FWi or instances of the firmware (where i is an integer number of copies from 1 to N). In the preferred embodiment shown, the memory 130 includes two copies FW1, FW2 of the firmware (N=2). In other embodiments, the memory 130 may include more than two copies of the firmware. The copies of the firmware are stored in a manner that can be directly executed by the device at the location where the copies are located in the memory, i.e., the copies do not need to be moved, modified or decrypted before being executed by the device.

[0045] One of the copies of the firmware may become defective or invalid, for example, due to an error in a memory location or after a failed attempt to update the firmware copy. The device may then execute the other copy (or a copy of the other copy). For this purpose, the device may implement the following description regarding Figure 3 method.

[0046] In contrast, in the presence of a single copy of the firmware, the device cannot operate correctly in the event of an error in the memory location or an update failure (e.g. only a portion of the copy is placed in the memory). Therefore, despite an error in the memory or a failed update attempt, the presence of multiple copies FWi of the firmware enables the device to operate. This enables the availability and / or reliability of the device to be increased. In the case where preferably only two copies FWi are provided, the trade-off between the space occupied by the copies FWi in the memory and the reliability / availability can be optimized.

[0047] Each copy FWi occupies at least a portion of a region 210-i (210-1, 210-2) of the memory 200 from a position, or from the starting address 220-i (220-1, 220-2) of the copy. Preferably, each copy FWi leaves free, i.e. not occupied, a portion 222 of the relevant region 210-i, preferably located on the side of the highest logical address in the region. The portion 222 enables the copy FWi under consideration to be updated by a longer copy without changing the position 220-i. The region 210-i is preferably contiguous, however, as a variant, the region 210-i can have any position. Each region 210-i is defined by a contiguous set of memory locations, however, as a variant, each region 210-i can be replaced by a plurality of separated regions located at different memory locations.

[0048] Preferably, the copies FWi correspond to the same version of the firmware, that is, when they are valid (without defects) and executed by the processing unit 140, the copies FWi cause the same operation of the device. Figure 3 As described, the copies may correspond, at least temporarily, to different versions of the firmware.

[0049] Preferably, copies FWi of the same version of firmware are provided to cause the same sequence of operations, each operation corresponding to an instruction of the executed copy FWi. In an example, the copy FWi may include instructions that depend on the location 220-i of the copy FWi in the memory 200, and then the copy FWi preferably only differs from its instructions that depend on the location 220-i. More precisely, the valid copies FWi only differ in the number of operands indicated by their location. Therefore, the operators of the instructions are the same in the valid copies. In another example, the copies FWi are completely independent from the location 220-i, and then preferably are the same.

[0050] As a variant, the copies FWi of the same version of firmware may correspond to different instructions, for example instructions resulting from the same source code and from compilations implemented differently.

[0051] Preferably, for each of the copies FWi, the memory also contains a signature MACi (MAC1, MAC2) for checking the validity of the copy under consideration, that is, an integrity measurement. The signature MACi can be any type of signature that enables detection of errors in the corresponding copy FWi. Such an error corresponds to a difference of at least one bit between the copy provided corresponding to the firmware and stored at the location under consideration and the copy FWi obtained by reading the content of this location. Preferably, the signature MACi is a signature of the message authentication code MAC type. As an example, the signature MACi is a signature of the cyclic redundancy check or CRC type, or of the checksum type. As a variant, the signature can be replaced by any method for checking the validity of the copy under consideration, such as a memory and / or copy operation test, or an update failure indication. However, compared to these variants, the signature MACi enables the check of the validity of the copy FWi to be simplified. The signature MACi is, for example, located at the end of the memory 200 (their logical address is the highest among the memory locations).

[0052] Preferably, the memory also includes a device boot program 230 (BOOT). When the device is started, the processing unit ( Figure 1 140 in). The execution of the device boot program 230 ends with the start of one of the copies of the firmware FWi. Preferably, the memory location 240 contains the value SEL. The value SEL indicates that, among the copies FWi, the selected copy FW-SEL or the active copy is to be started as a priority relative to the other copies FWi. Preferably, the device boot program 230 checks the validity of the selected copy FW-SEL and starts it if it is valid. Preferably, the selected copy is a copy whose validity was checked in a previous step, for example during its installation. Figure 3 An example of a method implemented during execution of the device boot procedure 230 is described.

[0053] Preferably, the selected copy FW-SEL is the copy corresponding to the latest version of the firmware among the copies FWi. This advantageously results in the copy corresponding to the latest version of the firmware being started.

[0054] As a variant, the value SEL indicating the selected copy is omitted. In this variant, in order to start the latest version of the firmware, the device tests the validity of all copies FWi, compares the versions of all copies FWi, and then selects and starts the valid copy corresponding to the latest version. Compared to this variant, in the case where the selected copy is valid, the value indicating the selected copy enables a single validity test to be performed, which enables the device boot program 230 to simplify and accelerate its execution.

[0055] Preferably, the memory also includes a common file system 250 (FS) accessible to each of the replicas. The common file system 250 typically includes data used by the firmware to operate the device. The advantage of the common file system 250 is that the data used is the same as the replica FWi started. For example, the file system is extended between the replica FWi and the signature MACi in the memory.

[0056] Figure 3 The block diagram schematically shows the Figure 2 More particularly, blocks corresponding to steps implemented by a device during execution of: a device boot program 230, a selected copy FW-SEL, and a copy FWi different from the selected copy are represented in blocks 230', 210-SEL, and 210-BU, respectively.

[0057] At step 302 (START), execution of the device boot program 230 is initiated and the method proceeds to step 304 .

[0058] In step 304 (SEL OK?), the device tests the validity of the selected copy FW-SEL. If the copy is valid (Y), the method proceeds to step 306 (START SEL) to start executing the selected copy FW-SEL. If the copy is invalid (N), the method proceeds to step 308.

[0059] In step 308 (SEEK BU OK), if this step has not been performed from the beginning, the device searches for a backup copy FW-BU among the valid copies FWi other than the selected copy FW-SEL. The method then continues to step 310.

[0060] In step 310 (LAST VERSION?), the device tests whether the version of the backup copy FW-BU is the latest version. To achieve this, it is sufficient to compare the versions of the selected copy FW-SEL and the backup copy FW-BU, in the preferred case where the latest version is the selected copy FW-SEL. If the versions are identical (Y), the method proceeds to step 312. Otherwise, the method returns to step 308 or, in the case where the memory contains only two copies, the method continues to step 314 (dashed line 313).

[0061] In a new execution of step 308, the device searches for a new backup copy FW-BU among the valid copies FWi other than the selected copy FW-SEL and the previous copy or copies FW-BU. If a new copy FW-BU is found (Y), the method proceeds to step 310. Otherwise, the method proceeds to step 314.

[0062] In step 312 (NEW SEL), the method modifies the value SEL at position 240. The replica FW-BU that is valid and corresponds to the latest value becomes the new selected replica FW-SEL to be executed first. The method then proceeds to step 306 described above.

[0063] In step 314 (START BU), the method starts the backup copy FW-BU.

[0064] After step 306, the method preferably passes to step 316 (REPLACE?). Step 316 and steps after step 316 are implemented during execution of the selected copy FW-SEL.

[0065] When the request is received by the device, step 316 is performed. To achieve this, the device communicates with a system such as a server via the platform. The communication is performed, for example, over a remote communication network such as the Internet, and may also be performed by any communication mode suitable for communication between the device and the server via the platform. In step 316, the device sends information indicating whether the replica selected before step 304 is valid. If, after this, the device receives a request to replace one or more invalid replicas (Y), the method proceeds to step 318. If the device does not receive a replacement request (N), the method proceeds to step 320.

[0066] In step 318 (REPLACE BU), the device replaces a copy that is invalid and / or corresponds to a version different from the latest version. More precisely, preferably, the device receives a new copy from the server that is intended to replace the invalid copy. As a variant, in the case where the selected copy FW-SEL does not depend on its position in the memory, an identical copy of the selected copy FW-SEL is provided at the location of the copy to be replaced. Preferably, the device then replaces the check signature of the replaced copy with the check signature of the selected copy FW-SEL. In this variant, and in the case where the selected copy FW-SEL includes position-related indications, the copy is implemented by modifying these indications. The device calculates the new check signature MACi of the replaced copy FWi and stores the signature at the location in its memory. Embodiments of the method are compatible with the usual steps of writing a copy, instance or program to the memory according to the location of another copy from the program. Step 318 enables the copy to be valid and correspond to the latest version.

[0067] Step 320 (UPDATE?) is preferably implemented when a request to perform this step is received by the device. In this step, the device tests whether a firmware update should be performed. For this purpose, the device communicates with the server via the platform. If an update is to be performed (Y), the method proceeds to step 322 (UPDATE BU). Otherwise (N), the method proceeds to step 324.

[0068] In step 322, the device updates the replicas other than the selected replica FW-SEL. In other words, the device replaces the replicas other than the selected replica FW-SEL with replicas corresponding to a version newer than the version of the selected replica FW-SEL. Figures 4 to 6 An example of an implementation mode of this step is described. After step 322, for example, the device proceeds to step 326, where the device checks whether the updated replica is valid. If the replica is valid (Y), the method proceeds to step 328 (NEW-SEL). Otherwise, as an example, the method can return to step 322 to try to perform the update again. As a variant, the method can proceed to step 318 to recover the replica that failed to update.

[0069] At step 328, the method modifies the value SEL( Figure 2 ) to indicate that the copy updated in step 322 must be started first when the device is started next time. Therefore, the updated copy will become the new selected copy FW-SEL at the next startup, and the new copy corresponds to the latest version of the firmware. Then, after the next startup, step 316 will enable all copies of the firmware to be updated. The method proceeds to step 324 after step 328.

[0070] Step 324 (TPM) corresponds to the operation after the device is started, the external update and the replacement of the copy FWi. As mentioned, this operation preferably complies with the TPM standard.

[0071] Although the steps performed during execution of the selected copy (block 210-SEL) have been shown in a particular order, other sequences of steps are possible. In particular, steps 316, 318, 320, 322, 326, and 328 may be performed in parallel with, and / or after, a portion of step 324 (dashed line 325) (not shown). In addition, steps 316 and 318 may be omitted, particularly in the absence of a request, with the method passing directly from step 306 to step 320. Similarly, steps 320, 322, 326, and 328 may be omitted, particularly in the absence of a request, with the method passing directly from step 306 or 316 to step 324.

[0072] After step 314 (START BU), the method preferably passes to step 330 (RELOAD SEL). In this step, the device updates the selected copy FW-SEL. In other words, the device replaces the selected copy, which is invalid in this case, with the new version of the firmware. This step is preferably performed identically or similarly to the step of updating step 322, i.e., it is performed by preferably using communication with a server. After step 330, the device restarts (the method returns to step 302). Step 330 can be performed in parallel with step 332 (TPM), in which the device ensures at least part (preferably only part) of the functionality of step 324 (TPM).

[0073] Figure 4 , Figure 5 and Figure 6 The steps of an embodiment of a firmware update method are schematically shown. More precisely, the method may be as described above with respect to Figure 3 The described steps 322 and / or 330 are implemented to update the memory 200 ( Figure 2 ) in the .

[0074] Figure 4 The steps are preferably implemented by a system external to the device including the firmware to be updated. Such a system is preferably a computer information system, for example including a computer, intended to communicate with the device to perform the update.

[0075] exist Figure 4 In the step of , a copy FWi of the firmware is formed, preferably two copies FW1 and WF2. The two copies preferably correspond to the same latest version of the firmware. The copy FWi can be stored in the memory 200 ( Figure 2 ). The copies may differ by position-related indications. The copies FW1 and FW2 then differ by M number of values ​​FWiVj, such as words (a word is defined by a given number of bits, preferably 32 bits). These values ​​are located at a position offset POSj from position 220-i, j being an integer in a range of 1 to M. In the example shown, the values ​​of the copies FW1 and FW2 differ by the offsets POS1, POS2 and POS3 corresponding to FW1V1 and FW2V1, FW1V2 and FW2V2, FW1V3 and FW2V3. Each offset position is common to the copies FWi. The position POSj can be obtained by comparing the copies FW1 and FW2. As a variant, a single copy is formed by locating position-related values ​​and the offset POSj is obtained.

[0076] exist Figure 5In the step of , an additional copy FW is formed at a position corresponding to the offset position POSj, and the value is replaced by the same predefined value. Preferably, when the memory 200 is a flash memory, all bits of the predefined value are equal to the erased value of the memory 200, that is, the value contained at the position of the memory 200 after the memory 200 is erased, for example the value 1. The predefined value is therefore equal to the value OxFFFFFFFF (wherein "Ox" indicates that the symbol is hexadecimal) in the case of a 32-bit word, for example.

[0077] Preferably, a set 510 of values ​​organized in the form of a table is additionally formed. The set 510 comprises at least one value FWiVj of the replica FWi to be updated, preferably corresponding to another column in the table. Preferably, the set 510 comprises all values ​​FWiVj, wherein each value of the integer i corresponds to a column (each value of the integer j corresponds to a row). The set 510 preferably comprises offsets POSj, more preferably corresponding to columns in the table. Columns and rows in the table can be interchanged.

[0078] exist Figure 6 The additional replica FW is compressed in a step. This step is compatible with a common data compression step. Preferably, the compression enables a set 610 of data of a smaller size relative to the additional replica to be obtained from the additional replica FW (without losing information). As an example, the size of the set 610 is 85% smaller than the size of the additional replica FW. As an example, the additional replica FW has a size greater than or equal to 310 kilobytes, and the compressed set 610 has a size less than 260 kilobytes.

[0079] Preferably, collection 510 is not compressed, however, compressing collection 510 is possible.

[0080] In a next step, not shown, the sets 510 and 610 are sent to the device having the firmware to be updated. Preferably, the device decompresses the set 610 upon receipt and stores the result of the decompression (ie the additional copy FW) directly at the location of the copy FWi to be replaced. As a variant, Figure 6 The step of is omitted and the additional copy FW is received by the device in uncompressed form.

[0081] In a variant, the device places the set 610 in the memory 200 or another memory before decompressing the set 610. However, the fact that the set 610 is decompressed when it is received allows the memory space used to be reduced compared to this variant. In another variant, the device stores the decompressed copy in another memory or in a different location in the memory 200 from the copy to be replaced. However, the fact that the compression result is stored directly at the location of the copy to be replaced also allows the memory space used to be reduced compared to this other variant.

[0082] The device then replaces the predefined value of the location-related value FWiVj with the corresponding value of the set 510 received by the device. Figure 4 The value FWiVj obtained in step has been restored to the relevant replica FWi and the replica has been updated accordingly.

[0083] In the case of a flash type memory, the portions of the decompressed copy are stored consecutively. For each of these portions, the memory locations are erased simultaneously, after which the portion in question is rewritten simultaneously in all locations.

[0084] In another variant, the decompressed copy can be stored in another memory, such as a RAM, and while the copy is in the RAM, the predefined values ​​can be replaced by the values ​​FWiVj and then the copy can be rewritten to the flash memory. Compared to this variant, the predefined values ​​are written to the memory using bits equal to the erase values ​​of the flash memory and then they are replaced by the values ​​FWiVj, making it possible to avoid using space in the RAM without adding write / erase cycles to the flash memory. This makes it possible to reduce the size of the RAM and limit the risk of aging of the flash memory and / or the update time.

[0085] Figures 4 to 6 The method enables a device to receive all the data needed to update any replica FWi having a position-related value FWiVj contained in the set 510. In particular, in the preferred case where the set 510 includes all values ​​FWiVj, the device receives all the values ​​needed to update any replica FWi. More precisely, the sets 510 and 610 can be advantageously obtained in advance without knowing which replica is to be updated or without the need for the device to have to communicate an indication of the replica to be updated.

[0086] In order to transmit data required to update any copy to a device without knowing which copy is to be updated, it can be designed that the data transmitted in Figure 4 However, by comparison, Figures 4 to 6 The method has the advantage of reducing the amount of data transmitted for the update. Thus, the update can be performed faster and / or by a communication device with a narrower bandwidth.

[0087] Various embodiments and variations have been described. Those skilled in the art will appreciate that certain features of these various embodiments and variations may be combined, and those skilled in the art will recognize other variations.

[0088] Finally, based on the functional indications given above, the actual implementation of the described embodiments and variants is within the capabilities of a person skilled in the art.

[0089] Such changes, modifications and improvements are intended to be part of this disclosure and are within the spirit and scope of the present invention. Therefore, the foregoing description is intended to be exemplary only and not limiting. The present invention is limited only by the limitations in the following claims and their equivalents.

Claims

1. An electronic device, comprising: Memory, Storage: multiple copies of at least one version of the same firmware of the electronic device; as well as a signature for each of the copies, the signature being used to check the validity of the copy; a central processing unit communicatively coupled to the memory, wherein each copy of the same firmware is configured to cause the central processing unit to perform operations of the electronic device in accordance with a Trusted Platform Module (TPM) standard, wherein the central processing unit is configured to: receiving an additional copy of the same firmware, wherein a value dependent on a future location of the additional copy in the memory is replaced with the same predefined value; receiving, in the memory, an associated value for each position of the replica; replacing at least one of the copies with the additional copy; as well as The associated value corresponding to the position of the additional replica is restored. 2 . The electronic device according to claim 1 , wherein the memory further comprises a program for starting the electronic device, and when executed by the electronic device, the program is capable of causing validity verification and execution of at least one of the copies. 3 . The electronic device of claim 1 , wherein the memory includes a value indicating a copy selected from among the copies. The electronic device according to claim 3 , wherein the selected copy corresponds to a latest version among versions of the firmware.

5. The electronic device of claim 1, wherein the memory further comprises a common file system accessible to each of the replicas.

6. A method of operating an electronic device having a memory, the electronic device comprising a package having external conductive pins, a central processing unit disposed on a first integrated circuit chip in the package, and a non-volatile memory disposed on a second integrated circuit chip in the package that is different from the first integrated circuit chip, the non-volatile memory containing multiple copies of at least one version of the same firmware of the electronic device, the method comprising: storing, by the central processing unit in the package, in the non-volatile memory in the package, an integrity signature for each copy of at least one version of the same firmware, the integrity signature being used to check the validity of the copy; receiving, by the electronic device, an additional copy of the same firmware, wherein a value dependent on a future location of the additional copy in the memory is replaced with the same predefined value; Receiving, by the electronic device, a value associated with each position of the replica in the memory; replacing at least one of the copies with the additional copy; restoring the associated value corresponding to the position of the additional copy; determining, by the central processing unit in the package, that a first one of the copies of the same firmware is a valid copy and corresponds to a latest version of a valid copy; as well as The first of the copies is executed to cause operation of the electronic device in accordance with a Trusted Platform Module (TPM) standard. 7 . The method of claim 6 , wherein each of the valid copies, when executed by the electronic device, is capable of causing operation of the electronic device in accordance with the TPM standard.

8. The method according to claim 6, comprising: An invalid copy among the copies is replaced with another valid copy among the copies.

9. The method according to claim 6, comprising: One of the copies is replaced with another of the copies, the other copy corresponding to a newer version than the replaced one.

10. The method according to claim 6, further comprising: receiving the additional replica and / or the associated value in compressed form; as well as The additional copies and / or the associated values ​​are decompressed.

11. The method of claim 6, wherein the predefined value has all bits equal to a memory erase value.

12. An electronic component comprising: Encapsulation; a central processing unit disposed in the package; a memory disposed in the package and communicatively coupled to the central processing unit; as well as a plurality of copies of at least one version of the same firmware of the electronic component, stored in the memory, wherein each of the copies, when executed by the central processing unit, is capable of causing operation of the electronic component in accordance with the Trusted Platform Module (TPM) standard; a signature for each of the copies, the signature being used to check the validity of the copy; and The central processing unit is configured as follows: receiving an additional copy of the same firmware, wherein a value dependent on a future location of the additional copy in the memory is replaced with the same predefined value; receiving, in the memory, an associated value for each position of the replica; replacing at least one of the copies with the additional copy; as well as The associated value corresponding to the position of the additional replica is restored.

13. The electronic component according to claim 12, wherein the memory further comprises a program for starting the electronic component, which, when executed by the central processing unit, is capable of causing validity verification and execution of at least one of the copies. The electronic component according to claim 12 , wherein the memory includes a value indicating a replica selected from among the replicas.

15. The electronic component according to claim 12, wherein the selected copy corresponds to a latest version among versions of the firmware.

16. The electronic component of claim 12, wherein the memory further comprises a common file system accessible to each of the replicas.

Images