Memory Protection Unit

Abstract

The present invention is titled Memory Protection Unit. A specific implementation is directed to a device. The device includes: a controller having a memory protection unit; a legally relevant memory portion capable of interacting with the controller; a legally non-relevant memory portion capable of interacting with the controller; an interface in the memory protection unit that allows a privileged application to access the legally relevant memory portion and does not allow a non-privileged application to access the legally relevant portion; and an interrupt system, wherein when the non-privileged application attempts to interact with the legally relevant memory portion, the memory protection unit takes an action associated with the non-privileged application.

Description

Background Art

[0001] Over time, embedded systems have become increasingly connected and have become one of the many devices in the "Internet of Things". Some of these devices, such as measuring instruments or smart meters, derive great value from having a high level of connectivity. These devices must also be highly secure and trustworthy to produce accurate and substantially indestructible results. In fact, the parties affected by the measuring instrument cannot check the results, so they must be able to rely on the measuring instrument's accuracy at a very high level.

[0002] One solution is to separate legally relevant data and legally irrelevant data and operate a device with two microcontrollers. One microcontroller is dedicated to legally relevant functions, while the other microcontroller is dedicated to legally irrelevant functions. This allows at least the part of the device that runs the legally relevant system to be secure and not tampered with. Typically, the legally relevant part of the system cannot be upgraded, while the legally irrelevant part allows for remote firmware upgrades. This is a less than ideal solution. Multiple microcontrollers require more PCB space, consume more power, and offer less flexibility.

[0003] There is a need for a system that: 1) has a single microcontroller that can handle both legally relevant applications and legally irrelevant applications; and 2) has inherent security and trustworthiness while also being scalable to adapt to the changing needs of the "Internet of Things". Summary of the Invention

[0004] One embodiment is directed to a device. The device includes: a controller having a memory protection unit; a legally relevant memory portion capable of interacting with the controller; a legally irrelevant memory portion capable of interacting with the controller; an interface in the memory protection unit that allows privileged applications to access the legally relevant memory portion and does not allow non-privileged applications to access the legally relevant portion; and an interrupt system, wherein when the non-privileged application attempts to interact with the legally relevant memory portion, the memory protection unit takes an action associated with the non-privileged application.

[0005] Another specific implementation includes one or more hardware-based non-transitory memory devices that store computer-readable instructions which, when executed by one or more processors disposed in a computing device, cause the computing device to: enable interaction between a memory protection unit enabling controller and a legal relevant portion; enable interaction between the memory protection unit enabling controller and a legal non-relevant portion; allow a privileged application to access the legal relevant portion; receive an attempt to access the legal relevant portion from a non-privileged application; and perform at least one action with respect to the non-privileged application.

[0006] Another specific implementation is a method for protecting a device. The method includes: enabling interaction between a memory protection unit enabling controller and a legal relevant portion; enabling interaction between the memory protection unit enabling controller and a legal non-relevant portion; allowing a privileged application to access the legal relevant portion; receiving an interruption from a non-privileged application configured to interact with the legal relevant portion; and performing an operating system-level response to the interruption. Description of the Drawings

[0007] Figure 1 is a simplified block diagram of a computer system that can be used to implement a memory protection unit.

[0008] Figure 2 is a simplified block diagram of a device including a memory protection unit.

[0009] Figure 3 is a simplified block diagram of an interrupt handler used by a memory protection unit.

[0010] Figure 4 is a flowchart showing the current use of a memory protection unit.

[0011] Figure 5 is a flowchart showing the current use of a memory protection unit.

[0012] Figure 6 is a flowchart showing the current use of a memory protection unit.

[0013] Figure 7 is a flowchart showing the current use of a memory protection unit. Detailed Description

[0014] Figure 1is a simplified block diagram of a computer system that can be used to implement a memory protection unit. In one example, computer system 1300 includes a processor 1305, a system memory 1311 (which may also include a memory protection unit), and a system bus 1314 that couples various system components including the system memory 1311 to the processor 1305. The system bus 1314 can be any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a local bus, using any of a variety of bus architectures. The system memory 1311 includes read only memory (ROM) 1317 and random access memory (RAM) 1321. A basic input / output system (BIOS) 1325 is stored in the ROM 1317, and the BIOS contains basic routines that help transfer information between elements within the computer system 1300 during startup, for example. The computer system 1300 may also include: a hard disk drive 1328 that reads from and writes to an internally disposed hard disk (not shown); a disk drive 1330 that reads from or writes to a removable disk 1333 (e.g., a floppy disk); and an optical disk drive 1338 that reads from or writes to a removable optical disk 1343 (such as a CD (compact disc), DVD (digital versatile disc), or other optical medium). The hard disk drive 1328, the disk drive 1330, and the optical disk drive 1338 are connected to the system bus 1314 via a hard disk drive interface 1346, a disk drive interface 1349, and an optical drive interface 1352, respectively. The drives and their associated computer-readable storage media provide non-volatile storage of computer-readable instructions, data structures, program modules, and other data for the computer system 1300.

[0015] Although this illustrative example includes a hard disk, a removable disk 1333, and a removable optical disk 1343, other types of computer-readable storage media that can store computer-accessible data may also be used in some currently used applications of the memory protection unit, such as magnetic tape cartridges, flash memory cards, digital video discs, data cartridges, random access memory (RAM), read only memory (ROM), and the like.

[0016] In addition, as used herein, the term computer-readable storage medium includes one or more instances of a medium type (e.g., one or more disks, one or more CDs, etc.). For the purposes of this specification and the claims, the phrase "computer-readable storage medium" and its variants are intended to cover non-transitory implementations and do not include waves, signals, and / or other transient and / or intangible communication media.

[0017] Multiple program modules may be stored on a hard disk, disk 1333, optical disk 1343, ROM 1317, or RAM 1321, including an operating system 1355, one or more application programs 1357, other program modules 1360, and program data 1363. A user may input commands and information into the computer system 1300 through input devices such as a keyboard 1366 and a pointing device 1368 such as a mouse. Other input devices (not shown) may include a microphone, joystick, gamepad, satellite dish, scanner, trackball, touchpad, touch screen, touch-sensitive device, voice command module or device, user motion or user gesture capture device, etc. The additional input devices (not shown) may include both privileged and non-privileged devices, including but not limited to: P0 communication interface, P1 communication interface, P3 communication interface, integrated circuit breaker, relay, external Symbol chip including sensors, Symbol LED, LCD, button, external flash memory, tamper sensor, power supply, client circuit breaker, and downstream voltage.

[0018] These and other input devices are typically connected to the processor 1305 through a serial port interface 1371 coupled to the system bus 1314, but may be connected through other interfaces such as a parallel port, game port, or Universal Serial Bus (USB). A monitor 1373 or other type of display device is also connected to the system bus 1314 via an interface such as a video adapter 1375. In addition to the monitor 1373, a personal computer typically includes other peripheral output devices (not shown), such as speakers and printers. Figure 1 The illustrated exemplary example also includes a host adapter 1378, a Small Computer System Interface (SCSI) bus 1383, and an external storage device 1376 connected to the SCSI bus 1383.

[0019] The computer system 1300 may operate in a networked environment using a logical connection to one or more remote computers, such as the remote computer 1388. The remote computer 1388 may be selected as another personal computer, server, router, network PC, peer device, or other common network node, and typically includes many or all of the elements described above with respect to the computer system 1300, but Figure 1 only a single representative remote memory / storage device 1390 is shown. Figure 1 The logical connections depicted therein include a Local Area Network (LAN) 1393 and a Wide Area Network (WAN) 1395. Such networked environments are typically deployed in, for example, offices, enterprise-wide computer networks, intranets, and the Internet.

[0020] When used in a LAN networking environment, computer system 1300 is connected to a local area network 1393 through a network interface or adapter 1396. When used in a WAN networking environment, computer system 1300 typically includes a broadband modem 1398, a network gateway, or other devices for establishing communications through a wide area network 1395 (such as the Internet). The broadband modem 1398 (which can be internal or external) is connected to the system bus 1314 via a serial port interface 1371. In a networking environment, program modules related to the computer system 1300 or parts thereof can be stored in a remote memory / storage device 1390. It should be noted that Figure 1 the network connections shown are illustrative, and other devices for establishing communication links between computers can be used according to the specific requirements of the currently used application of the enhanced temperature range power supply.

[0021] Figure 2 is a simplified block diagram of a device including a memory protection unit. In a specific implementation, the memory protection unit 205 is used by the device 100 as the basis for software separation in a single controller 200. In one example, the controller 200 can be based on M23 and / or M33 cores and M0+, M3, and / or M4 cores. In these designs, they allow the controller 205 to enforce separation based on the addresses in the memory 206.

[0022] The execution contexts managed by the controller 200 can be privileged or unprivileged. In one example, an unprivileged execution context can be initiated by an unprivileged device A 210 or an unprivileged device B 215. Similarly, a privileged execution context can be initiated by a privileged device A 250 or a privileged device B 255. The unprivileged device A 210 or the unprivileged device B 215 can also initiate a privileged execution context. This may or may not be allowed by the memory protection unit 205, as will be described in more detail below).

[0023] Exemplary privileged and unprivileged devices (such as devices 210, 215, 250, and 255) include, but are not limited to: P0 communication interface, P1 communication interface, P3 communication interface, integrated circuit breaker, relay, external Symbol chip including sensors, Symbol LED, LCD, button, external flash memory, tamper sensor, power supply, client circuit breaker, and downstream voltage. In operation, when one of the devices 210, 215, 250, and 255 communicates with device 100, they communicate via controller 200. Controller 200 includes a privileged mode interface 230 and an unprivileged mode interface 240. When an unprivileged device, such as unprivileged device A 210 or unprivileged device B 215, or multiple unprivileged devices communicate with device 100, they communicate via the unprivileged mode interface 240. Similarly, when one or more of privileged device A 250 or unprivileged device B 255 communicate with device 100, they communicate via the privileged mode interface 230.

[0024] Memory protection unit 205 uses interfaces 230 and 240 to enforce the physical separation of memory 206 into a legally relevant memory section 220 and a legally irrelevant memory section 230. An unprivileged execution context cannot be directly granted access to the legally relevant memory section 220, as it may compromise the security of device 100. For example, unprivileged device A 210 may attempt to change the settings of memory protection unit 205 in a privileged execution context, thereby disabling memory protection unit 205. For example, Table 1 describes some actions that are allowed and / or not allowed in various execution contexts.

[0025] Table 1

[0026] Action Privilege Non - privilege Change privilege level Allow Prohibit Access system register Allow Prohibit Access interrupt vector table Allow Prohibit

[0027] Interrupt module 270 can be configured such that when an unprivileged device, such as unprivileged device 210 or 215, uses an execution context that affects the legally relevant memory section 220, the interrupt module can take one or more actions to process or deny the request. In one example, memory protection unit 205 can create a buffer in the legally relevant memory section 220 such that the buffer is used to process the request, and unprivileged device 210 or 215 only receives the result and is not permitted to directly process the request.

[0028] Figure 3 Is a simplified block diagram of an interrupt handler used by the memory protection unit. Figure 3Includes unprivileged device A210, which may attempt to interact with both legal relevant part 260 and legal non-relevant part 270. The legal relevant part has interface 270. The legal non-relevant part has interface 250. Interface 220 of legal relevant part 260 has buffer creation module 230 and device disabling module 240.

[0029] When an interruption is issued from unprivileged device 210, interface 220 receives the interruption via communication path 280. In the case where the device is privileged (not shown), interface 220 may directly process the interruption in legal relevant part 260. If the interruption from unprivileged device 210 is a task that only requires the use of legal non-relevant part 270, it may be sent via interface 250 for processing. When the interruption from unprivileged device 210 is a task that requires the use of any legal relevant part in legal relevant part 260, interface 220 may be used, and this interface may process the interruption in various ways in different examples.

[0030] In one example, interface 220 only acknowledges receiving the request via path 290 or rejects the request. In another example, interface 220 uses buffer creation module 230 and device disabling module 240. For example, it may create a new buffer in legal relevant part 260 and process the code required to execute the request there. Similarly, interface 220 may use device disabling module 240 to temporarily disable unprivileged device 210 when executing the code. Thereafter, the result may be sent back from interface 220 to unprivileged device 210 via path 290.

[0031] Figure 4 Is a flowchart showing the current use of the memory protection unit. At step 400, the memory protection unit allows privileged applications to access the legal relevant part of the memory. Thereafter, at step 420, an unprivileged application requests access to the memory. Examples of unprivileged applications include, for example, P0 communication interface, P1 communication interface, P3 communication interface, integrated circuit breaker, relay, external Codejit chip including sensors, Codejit LED, LCD, button, external flash memory, tamper sensor, power supply, client circuit breaker, and downstream voltage detection circuit.

[0032] At step 430, the memory protection unit determines whether the request affects any aspect of the legal relevant part of the memory. If not, the memory protection unit grants the request at step 440. Otherwise, the memory protection unit takes at least one action with respect to the request at step 450. In one example, this is designed to ensure that unprivileged applications cannot take actions that may compromise the security provided by the memory protection unit. See, for example, Table 1, as previously discussed.

[0033] Figure 5 is a flowchart showing the current use of the memory protection unit. At step 500, the memory protection unit allows a privileged application to access the legally relevant parts of the memory. Thereafter, at step 510, a non-privileged application requests access to the memory. Examples of non-privileged applications include, for example, P0 communication interface, P1 communication interface, P3 communication interface, integrated circuit breaker, relay, external Symbol chip including sensors, Symbol LED, LCD, button, external flash memory, tamper sensor, power supply, client circuit breaker, and downstream voltage.

[0034] At step 520, the memory protection unit determines whether the request affects any of the legally relevant parts in the legally relevant parts of the memory. If not, the memory protection unit grants the request at step 530. Otherwise, the memory protection unit creates a buffer in the legally relevant memory part 540. The attempt to access the legally relevant part is processed at step 550. For example, the device can execute the code in the legally relevant part only via the interface or interrupt handler configured for the legally relevant part. At step 560, the result is returned to the non-privileged application.

[0035] Figure 6 is a flowchart showing the current use of the memory protection unit. At step 600, the device or system receives a request from a remote device or process to allow the device or system to update the firmware on the device or system. Thereafter, at step 610, the device provides the request to the memory protection unit. At step 620, the memory protection unit determines whether the request is from a non-privileged application. Examples of non-privileged applications include, for example, P0 communication interface, P1 communication interface, P3 communication interface, integrated circuit breaker, relay, external Symbol chip including sensors, Symbol LED, LCD, button, external flash memory, tamper sensor, power supply, client circuit breaker, and downstream voltage. If the request is not from a non-privileged application, the request is usually granted at step 630 because the application is privileged and has access to the legally relevant memory that may be affected by the remote firmware update. On the other hand, if at step 620, the request is from a non-privileged application, the memory protection unit determines at step 640 whether the request only affects the legally non-relevant memory area. If so, the request is usually granted at step 630. Otherwise, at step 640, the request is usually denied.

[0036] Figure 7Is a flowchart showing the current use of the memory protection unit. At step 700, the operating system, computing device, or other application that interrupts the system and separates the memory of the interrupt system into at least a legally relevant memory area and a legally irrelevant memory area waits until an interruption occurs at step 700. At step 710, the system determines whether the interruption is initiated by a privileged application. If so, the system can generally grant the request at step 730 because privileged applications generally have access to both the legally relevant memory area and the legally irrelevant memory area in the system.

[0037] On the other hand, if the interruption is initiated by a non-privileged application at step 710, then at step 720, the system determines whether the interruption request only affects the legally irrelevant memory area. Examples of non-privileged applications include, for example, P0 communication interfaces, P1 communication interfaces, P3 communication interfaces, integrated circuit breakers, relays, external Symbol chips including sensors, Symbol LEDs, LCDs, buttons, external flash memories, tamper sensors, power supplies, client circuit breakers, and downstream voltages.

[0038] If one of the foregoing applications is making an attempt that does not affect the legally relevant memory area, the process proceeds to step 730, where the request can be granted because non-privileged applications generally have access to the legally irrelevant memory area and the associated processing. If the interruption request even partially affects the legally relevant memory at step 720, the system determines whether it needs to create a buffer in the legally relevant memory area.

[0039] If no buffer is needed, the option is for the system to confirm or deny the request at step 750 and optionally send the result to the non-privileged application at step 780. When a buffer is needed, the system creates a buffer in the legally relevant memory area at step 760, and at step 770, the system uses a controller to process the interruption in the legally relevant memory portion. Optionally, at step 780, the system sends the result to the non-privileged application.

[0040] Although the subject matter has been described in language specific to structural features and / or methodological acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A device, the device comprising: A controller having a memory protection unit; A legally relevant portion of a memory, the legally relevant portion of the memory being capable of interacting with the controller; A legally non-relevant portion of a memory, the legally non-relevant portion of the memory being capable of interacting with the controller; An interface in the memory protection unit, the interface allowing a privileged device to access the legally relevant portion of the memory and not allowing a non-privileged device to access the legally relevant portion of the memory; And An interrupt system, wherein when the non-privileged device attempts to interact with the legally relevant portion of the memory, the memory protection unit is configured to: Determine whether the attempt affects any portion of the legally relevant portion of the memory; When it is determined that the attempt affects the legally relevant portion of the memory, perform at least one action on the non-privileged device; Characterized in that the device further comprises: A buffer created by the memory protection unit in the legally relevant portion of the memory, wherein the action includes the controller using the buffer to process the attempt and returning a result to the non-privileged device, and not allowing the non-privileged device to attempt to directly access the legally relevant portion of the memory.

2. The device according to claim 1, wherein the non-privileged device comprises a communication interface, an integrated circuit breaker or a relay.

3. One or more hardware-based non-transitory memory devices storing computer-readable instructions which, when executed by one or more processors provided in a computing device, cause the computing device to: Enable interaction between a controller and the legally relevant portion of the memory using a memory protection unit; Enable interaction between the controller and the legally non-relevant portion of the memory using the memory protection unit; Allow a privileged device to access the legally relevant portion of the memory; Receive an attempt from a non-privileged device to access the legally relevant portion of the memory; Determine whether the attempt affects any portion of the legally relevant portion of the memory; And When it is determined that the attempt affects the legally relevant portion of the memory, perform at least one action on the non-privileged device, wherein the at least one action includes: Creating a buffer in the legally relevant portion of the memory; Processing the attempt using the buffer; and Returning a result to the non-privileged device and not allowing the non-privileged device to attempt to directly process the legally relevant portion of the memory.

4. A method for protecting a device, the method comprising: Enabling interaction between a controller and a legally relevant portion of a memory using a memory protection unit; Enabling interaction between the controller and a legally non-relevant portion of the memory using the memory protection unit; Allowing a privileged device to access the legally relevant portion of the memory; Receiving an interrupt from the non-privileged device when the non-privileged device attempts to interact with the legally relevant portion of the memory; Determining whether the attempt affects any portion of the legally relevant portion of the memory; and when determining that the attempt affects a legally relevant part of the memory, performing an operating system-level response to the interruption; wherein the performing step further comprises: creating a buffer in the legally relevant part of the memory; processing the attempt using the buffer; and returning the result to the non-privileged device and not allowing the non-privileged device to attempt to directly process the legally relevant part of the memory.

Images