Secure debug

Abstract

Embodiments of the present disclosure relate to secure debugging. In one embodiment, a method for debugging a processing device includes generating, by a monotonic counter of the processing device, a first count value; communicating, by the monotonic counter, the first count value to a debug access control circuit; comparing, by a debug access control circuit of the processing device, the first count value to one or more reference values; and authorizing or preventing, by the debug access control circuit, debug access based on the comparison.

Description

[0001] Cross-reference to related applications

[0002] This application claims the benefit of French patent application No. 2103315, filed on March 31, 2021, which is incorporated herein by reference. Technical Field

[0003] This disclosure relates to methods and apparatus for protecting electronic circuits, and specifically to apparatus and methods for performing safe debugging of such circuits. Background Technology

[0004] The debugging process for a device can be problematic in applications where the device's memory contains confidential, sensitive data. This could include encryption keys, passwords, codes, or keys, boot codes, or proprietary protocols used throughout the circuit's lifespan, stored in the device's memory by the device manufacturer or an intermediary entity between the manufacturer and the end user. Ideally, the security of sensitive data should not be compromised during the debugging process. Summary of the Invention

[0005] The implementation provides improvements to the security of accessing sensitive data.

[0006] Various embodiments address all or some of the drawbacks of known processing devices.

[0007] Another embodiment provides a method for debugging a processing apparatus, the method comprising: generating a first count value by a monotonic counter; transmitting the first count value to a debug access control circuit by the monotonic counter; comparing the first count with one or more reference values ​​by the debug access control circuit; and authorizing or preventing debug access by the debug access control circuit based on the comparison.

[0008] According to one embodiment, a first count value is generated in the first step of the guiding sequence of the processing device, the first step including incrementing a monotonic counter to a second count value after transmitting the first count value.

[0009] According to one embodiment, the authorization or prevention includes preventing debug access based on the first count value, the method further includes transmitting the second count value to the debug access control circuit by the monotonic counter, comparing the second count value with the one or more reference values ​​by the debug access control circuit, and authorizing debug access based on the second count value.

[0010] According to one embodiment, the first count value corresponds to the initial value of the monotonic counter during the first boot of the processing device, while the second count value corresponds to the initial value of the monotonic counter during the second boot of the processing device.

[0011] According to one embodiment, during a first boot, the processing device is initially placed in a first state in which debug access via the debug access circuit is authorized based on a first count value, and during a second boot, the processing device is locked in a second state in which debug access via the debug access circuit is prevented based on the first count value.

[0012] According to one embodiment, the method further includes: an access control circuit that transmits the first count value to a memory of the processing device by the monotonic counter; reading the first data stored in the memory based on the first count value; an access control circuit that transmits the second count value to a memory of the processing device by the monotonic counter; and reading the second data stored in the memory based on the second count value, wherein the memory access control circuit is configured such that reading the first data is not authorized based on the second count value.

[0013] According to one embodiment, the first state and the second state of the processing device are defined by one or more values ​​stored in a memory.

[0014] According to one embodiment, the debug access control circuit authorizes debug access based on a count value greater than or equal to the one or more reference values, and prevents debug access based on a count value strictly less than the one or more reference values.

[0015] According to one embodiment, the method further includes: receiving a debug access request from an external device by a debug access circuit before authorizing or preventing debug access, and verifying the authentication of the external device by the debug access control circuit, wherein authorizing or preventing debug access by the debug access control circuit is also performed based on authentication verification.

[0016] One embodiment provides a data processing apparatus including: a monotonic counter configured to generate a first count value and a debug access control circuit configured to compare the first count value with one or more reference values ​​and to authorize or prevent debug access based on the comparison. Attached Figure Description

[0017] The foregoing features and advantages, as well as other features and advantages, will be set forth in the following detailed description of embodiments by way of illustration rather than limitation, with reference to the accompanying drawings, in which:

[0018] Figure 1 It is a schematic representation in block form of an electronic device according to an embodiment;

[0019] Figure 2 This is a flowchart illustrating the operation of a method for operating a device in debug mode according to an embodiment;

[0020] Figure 3 This describes an example of the life cycle of a processing device that includes a debugging process according to an embodiment;

[0021] Figure 4 This refers to the data and code that can be accessed during secure boot, according to one embodiment;

[0022] Figure 5 This is a flowchart of a secure boot method for a processing apparatus according to an embodiment; and

[0023] Figure 6 This is a flowchart of a secure boot method for a processing apparatus according to another embodiment. Detailed Implementation

[0024] In the various figures, the same features are indicated by the same reference numerals. In particular, common structural and / or functional features in the various embodiments may have the same reference numerals and may have the same structure, dimensions, and material properties.

[0025] For clarity, only the operations and elements that can be used to understand the embodiments described herein have been detailed and described. In particular, the design of the processing apparatus is well known to those skilled in the art, and certain elements are not described in detail in the following description.

[0026] Unless otherwise stated, when referring to two elements connected together, it means that there is no direct connection between them except for the conductor, and when referring to two elements coupled together, it means that the two elements can be connected or they can be coupled through one or more other elements.

[0027] In the following disclosure, unless otherwise stated, when referring to absolute position qualifiers, such as the terms “front,” “back,” “top,” “bottom,” “left,” “right,” etc., or when referring to relative position qualifiers, such as the terms “up,” “down,” “higher,” “lower,” etc., or when referring to orientation qualifiers, such as “horizontal,” “vertical,” etc., the orientation shown in the accompanying drawings is mentioned, or the orientation during normal use is mentioned.

[0028] Unless otherwise stated, the expressions “about,” “approximately,” “basically,” and “in the order of” indicate within 10%, preferably within 5%.

[0029] Figure 1 An electronic device 100 including a processing apparatus 102 according to an embodiment is shown schematically in block diagram form.

[0030] Electronic device 100 is, for example, an electronic board such as a microcircuit board, hardware used in a computer, a microprocessor circuit, etc.

[0031] The processing device 102 includes, for example, non-volatile memory 104 (NV MEM), such as flash memory, and a monotonic counter 106 (monotonic counter).

[0032] Monotonic counters are known in the art. Examples of such counters are described, particularly in Part 3, of “Virtual monotonic counters and count-limited objects using a TPM without a Trusted OS” by LFGSarmenta, M. Van Dijk, CWO'Donnell, J. Rhodes, and S. Devadas. This paper is incorporated herein by reference in its entirety and describes embodiments of counters implemented in hardware and / or software. Monotonic counter 106 is implemented in hardware, for example, by digital circuitry such as an application-specific integrated circuit (ASIC). The monotonic counter is configured to maintain a count value accessible at the counter's output. Following an increment instruction, the monotonic counter increases its count value by one or more units, but the operation is irreversible after each increment. In effect, the monotonic counter is configured such that its count value never decreases. Furthermore, between two increments, the count value is protected from any modification, such that it cannot be erased or altered. Only increment instructions allow the current value to be replaced with a new value higher than the current value.

[0033] The monotonic counter 204 is configured such that once an increment instruction is executed, no instruction is allowed to return to the previous value except when the processing device is reset to zero. When the count value is stored volatilely, the count value is lost each time the processing device is shut down, and the monotonic counter generates the initial count value again each time the device is rebooted. When the count value is stored in non-volatile memory, the initial count value is, for example, rewritten to the non-volatile memory of the monotonic counter at each reboot.

[0034] Processing device 102 also includes a general-purpose processor 110 (CPU). For example, the general-purpose processor 110 is coupled via bus 120 to a monotonic counter 106 and RAM (Random Access Memory) 112 and non-volatile memory 104. Memory 112 and / or memory 104 store, for example, instructions for controlling the processor 110. The general-purpose processor 110 is also coupled via bus 120 to a cryptographic processor 114 (CRYPTO) and a random number generator 118 (RNGENERATOR). The cryptographic processor 114 receives encrypted data and returns decrypted data via bus 120 and / or receives unencrypted data and returns encrypted data via bus 120. In one example, the random number generator 118 is a pseudo-random number generator, such as a linear congruential generator, which uses a recursive arithmetic sequence with disordered behavior and a sufficiently long period to behave as random. The quality of such a generator depends entirely on the arithmetic parameters used. In another example, generator 118 is a true random number generator that uses a physical random source, which is based, for example, on the inherent properties of the material on which the generator is implanted.

[0035] Processing device 102 also includes debug access circuitry 116 (debug interface) connected to bus 120. For example, circuitry 116 is part of or connected to a Joint Test Action Group (JTAG) debug port or Serial Line Debug Port (SW-DP) or other type of debug access circuitry for device 102. Circuitry 116 allows a user to connect a compatible interface (not shown) to device 102 to request system debugging procedures, for example, in the event of a failure. According to the embodiments described herein, circuitry 116 is further configured to limit access to the debugging process based on a count value generated by monotonic counter 106. For example, during operation of device 102, such as during the boot phase of device 102, monotonic counter 106 is controlled to increment its count value. Therefore, it is possible to limit the time period during which debug operations can be accessed.

[0036] The non-volatile memory 104 includes, for example, access control circuitry 108 (access control) connected to the output of the monotonic counter 106. The memory 104 stores, for example, multiple datasets associated with multiple isolation levels (TILs), such as boot codes and / or encryption keys. Figure 1 In the example, non-volatile memory 104 includes a first region 122 in which a first data set (region 0) is stored. Memory 104 also includes a second region 124 storing a second data set (region 1), and a third region 126 storing a third data set (region 2). The first, second, and third data sets are associated, for example, with three corresponding TIL isolation levels. Although in Figure 1 The example shown depicts a scenario with three datasets, but in other embodiments, the non-volatile memory 104 may store only two or more datasets in the respective areas.

[0037] The TIL level of isolation depends on the count value generated by the monotonic counter 106. Figure 1 In the example, the TIL value is equal to the count value of the monotonic counter 106, although the count value can be modified to generate the TIL value.

[0038] The access control mechanism implemented by circuit 108 can be implemented in several ways. In a first example, when circuit 108 receives a read request associated with one or more addresses in memory 104 via device 102 itself or via debug access circuit 116, it is configured to compare said / those addresses with address ranges associated with regions 122, 124, and 126 of memory 104. If it is an address in a region associated with a TIL value lower than the current value, access control circuit 108 is configured, for example, to prevent the read operation. In a second example, circuit 108 is configured to disable read circuitry for any region 122, 124, and 126 of memory 104 associated with a TIL value lower than the current value. For example, one or more logic gates (such as OR gates or AND gates) are coupled to the output path of each region 122, 124, and 126 of memory 104, and also receive an activation signal generated based on the TIL value to selectively disable each output path.

[0039] During the operation of device 100, the fact that the TIL value cannot be decremented allows for the protection of data sets, wherein access control circuit 108 prevents them from being read based on TIL values ​​greater than those associated with them.

[0040] In some embodiments, one or more datasets and associated isolation levels are maintained for individual entities in the chain from manufacturer to end user. For example, it may be necessary to have an intermediate entity between the manufacturer of the processing device and the end user of the electronic device 100 to store data specific to the use of device 100, such as boot code. In this case, one or more “minimum” datasets (e.g., datasets associated with isolation level 0) are maintained for the manufacturer of the processing device 102, and other datasets are maintained for the intermediate entities.

[0041] However, when device 102 exhibits one or more faults, the manufacturer, an intermediate entity, or another entity outside the manufacturer, as well as the intermediate entity, can perform a debugging process. Therefore, it is desirable that the dataset associated with the TIL values ​​held by the manufacturer and / or intermediate entity be unaccessible during this process.

[0042] Figure 2This is a flowchart illustrating the operation of a method for opening the packaging processing apparatus 102 in debug mode according to an embodiment. This method is implemented, for example, by a debug access circuit 116 and an access control circuit 108 of the apparatus 102.

[0043] In step 201 (closed state), the processing device is just booted up and automatically enters a so-called closed (or secure) state. In the closed state, access to the debugging process is not permitted. The contents of the memory of device 102, particularly the contents of regions 122, 124, and 126 of the non-volatile memory 104, are therefore rendered inaccessible from the outside by the debugging access circuitry 116. In other words, when processing device 102 is in the closed state, testing of processing device 102 and execution of the debugging protocol are impossible, regardless of the current TIL value.

[0044] In step 203 (Debug Request), following step 201, an external debugging device connects to the debug access circuit 116 to activate the debug mode of device 102. For example, the external device sends a debug mode access request to the debug access circuit 116. Step 203 also includes, for example, an authentication process initiated by the processing device 102. This authentication process, for instance, verifies, based on the debug access circuit 116, a digital signature generated by the external device and provided with or separately from the debug mode access request.

[0045] In step 205 (Success?) following step 203, the authentication process ends. The authentication process is either successful (Y branch) or failed (N branch). In the case of failure, the method ends at step 207 (Error Signal), where the processing device warns the initiator of the authentication process that the authentication process has failed. For example, this alarm may be an error message or a beep.

[0046] If the verification process is successful, the method proceeds to step 209 (qualifying or retrieving debugging for the reference TIL) in some cases, where, for example, one or more reference TIL values ​​are qualified or retrieved. The reference value indicates a TIL value compatible with debug mode access. For example, one or more reference values ​​may define one or more TIL values ​​that prevent debug mode access, or one or more TIL values ​​that allow debug mode access. In some cases, the reference TIL value is a threshold that allows debug mode access or is higher than that threshold. In the following, the case where a single reference TIL value indicates a threshold of TIL values ​​above which debug mode access is permitted is considered.

[0047] In some cases, one or more reference TIL values ​​are constant and stored in the memory of device 102. In another example, one or more reference TIL values ​​can be set via a request from an external device.

[0048] In step 211 (current TIL ≥ reference TIL?) following step 209, the current TIL value, corresponding to, for example, the count value of a monotonic counter, is compared with one or more reference TIL values, for example, defined or retrieved in step 209. If the current TIL value is not greater than or equal to the reference TIL value (N-branch), in other words, if the current TIL value is strictly less than the reference TIL value, the method is suspended to wait for the monotonic counter 106 to increment and for the current TIL value to equal the reference TIL value in step 213 (waiting until current TIL = reference TIL). For example, in the bootstrap of the processing device 102, where regions 122, 124, and 126 contain boot code and where the monotonic counter is incremented after the code in each region is executed, step 213 includes, for example, waiting for at least some steps in the bootstrap method to complete.

[0049] After step 213, or if the current TIL value is at least equal to the reference TIL value (Y branch) in step 211, the method terminates in step 215 (opening state and debugging), in which the circuit is switched from a closed state to an open state, thereby allowing the execution of the test and debugging protocol of the processing device 102 and the execution of the debugging process.

[0050] As for Figure 1 For example, the processing device boots up, and the initial TIL value is, for example, 0. A request to enter debug mode is transmitted to debug access circuitry 116, and authentication in step 205 is successful. For example, after step 209, the reference TIL value is identified as 3. For example, regions 122, 124, and 126 are associated with TIL values ​​0, 1, and 2, respectively, and contain boot code. Then, in step 213, the debug process is pending, and the code contained in region 122 is executed, causing the monotonic counter 106 to increment, so the TIL value equals 1. The debug process is still pending. The code contained in region 124 is executed, causing the monotonic counter 106 to increment, so the TIL value equals 2. The debug process is still pending. The code contained in region 126 is executed, causing the monotonic counter 106 to increment, so the TIL value equals 3. With the current TIL value equal to the reference TIL value, the debug process can begin.

[0051] Figure 3 Examples of the lifetime of a processing device that allows for the implementation of a debugging process are described. Blocks marked with odd numbers correspond to steps in the lifetime of the processing device 102 according to the embodiment, and blocks marked with even numbers correspond to hardware elements used for initialization and execution of the debugging process.

[0052] The lifespan of the processing device 102 begins at manufacturing step 301 (manufacturing). During step 301, manufacturer-specific data, such as boot codes and encryption keys, is stored in the non-volatile memory 104 of the device 102. This data is confidential, and the manufacturer of the device 102 does not wish for it to be accessible to third parties. Figure 3 In the example, confidential data stored by the manufacturer is associated with the level value TIL0. As for... Figure 1 For example, the data is stored in region 122 of non-volatile memory 104.

[0053] The grade value TIL 0 corresponds, for example, to the initial count value generated by the monotonic counter 106 when the device 102 is first started.

[0054] After storing the confidential data and in step 303 (Declare Debugging), debug access is closed. This means that the authentication process for debugging precedes debug access.

[0055] For example, device 102 is customized in step 305 (personalization). For example, at this stage of the lifespan of device 102, device 102 is disposed of by an intermediate entity. The intermediate entity is, for example, a reseller that customizes device 102 to suit the operation of electronic device 100. The intermediate entity will, for example, store other data, such as additional boot codes and other encryption keys, in another part of memory 104. In relation to... Figure 1 In the example, this additional data is stored in regions 124 and 126. For instance, a portion of the data stored by the intermediate entity is associated with the level value TIL1 and is stored in region 124, while another portion of the data is associated with the level value TIL2 and is stored in region 126.

[0056] In one example, after step 305, the intermediate entity initializes the debugging process (debugging authentication) in step 307. For example, this process is initialized to verify the correct operation of device 102 after customization.

[0057] For example, since level value TIL 0 is closed in step 305, the reference value for this process is equal to 1. When the reference value is equal to 1, the flow of the debugging process is represented by a sequence of thin arrows. Once the authentication for debugging is successful and device 102 is opened for debugging, device 102 is debugged in step 309 (Debug 1). In this step, unlike the data stored, for example, by an intermediate entity and associated with level values ​​TIL1 and TIL2, the data associated with level value TIL0 is inaccessible. Once debugged, customization of device 102 can continue in step 305.

[0058] Following customization of device 102 and in step 311 (constraint debugging), the reference TIL value is programmed to allow access to debug mode only for TIL values ​​greater than the reference value (e.g., value 2 or 3). Therefore, the memory associated with TIL values ​​below the reference value is locked, particularly regarding the debugging process. Specifically, after step 311, debugging of "root of trust" types, such as those associated with levels TIL0 and / or 1, is no longer permitted.

[0059] After step 311, device 102 is acquired and used by its end user, for example, in step 313 (USE).

[0060] During end-user use, device 102 may be required to undergo a commissioning process again, for example, initiated by the manufacturer or another entity. In this case, the commissioning process (commissioning verification) in step 307 is initiated. The flow of this commissioning process is represented by a sequence of dashed arrows.

[0061] Once authentication for debugging is successful and device 102 is unpacked for debugging, device 102 is debugged in step 315 (debugging on TIL3). For example, because debugging is performed after step 311, where debug access with a TIL value of 1 or less is locked, the reference TIL value identified by the device is greater than 1. Figure 3 In the example, it equals 3.

[0062] In the debugging verification step 307, computing device 300 (computer) is connected to device 102, for example, via debugging access circuit 116. The debugging authentication process is implemented, for example, by a digital signature protocol based on asymmetric cryptography. For example, the initiator of the debugging process has a card 302 (module) containing a private key and connected to computing device 300. Figure 1 The random number generator 118 of device 102 further transmits the random value to computing device 300 via debug access circuitry 116. A private key is used to sign the random value, and the signed random value is transmitted to the cryptographic processor 114 of device 102. Device 102 contains, for example, a public key. For example, the public key is stored in non-volatile memory 104 outside of regions 122, 124, and 126, or in other non-volatile memory not shown. The authenticity of the random value signature is then verified based on the public key. In one example, the private key used in step 309 to enable debug mode access for the TIL value is different from the private key used in step 315 to enable debug mode access for the TIL value.

[0063] This authentication protocol is a non-restrictive example. Other authentication protocols can be implemented.

[0064] Figures 4 to 6An embodiment of this specification is illustrated, wherein the encrypted data is boot code and / or an encryption key associated with such code, and the TIL value is incremented at the end of each step of the boot sequence. Each TIL value further corresponds to one or more boot codes associated with each boot step; these codes become inaccessible when the current TIL value is greater than their associated TIL value.

[0065] exist Figure 4 In one example, memory regions 400, 402, and 404 store sensitive data associated with boot codes 122, 124, and 126 stored in non-volatile memory 104, respectively. For example, regions 400, 402, and 404 are separate from regions 122, 124, and 126, but maintain an isolation level corresponding to the boot code associated with the data. This sensitive data includes, for example, one or more encryption keys stored in each region 400, 402, and 404, and each of these regions is contained within non-volatile memory 104. According to another embodiment, each region 400, 402, and 404 is a sub-region of the corresponding regions 122, 124, and 126.

[0066] exist Figure 4 During the first guiding step 410 of the processing device shown at the top, the current count value is, for example, equal to 0. Figure 4 In the example, isolation level 0 is associated with a first code (CODE0) and first sensitive data (KEY0). For example, the memory access control circuit 108 is configured such that the first code and the first data are exclusively accessible when the current count value is equal to 0. However, during step 410, the access control circuit 108 authorizes, for example, access to all memory regions 122, 124, and 126, and all regions 400, 402, and 404. In practice, in some cases, one or more other boot codes (CODE1, CODE2) may be accessed for reading during step 410, for example, in anticipation of subsequent steps in the boot process.

[0067] For example, once the first code CODE0 is executed, the general-purpose processor 110 controls the first increment of the current count value via the monotonic counter 106. For example, the first code includes an instruction to request the counter to increment. This instruction is, for example, transferred to the control register (not shown) of the monotonic counter 106.

[0068] Following this first increment, corresponding to the second bootstrapping step 411, the current count value of the monotonic counter 106 is, for example, equal to 1. The access control circuit 108 receives the new current count value and is configured to prevent any access to the first code and first data associated with isolation level 0 based on this count value, which is greater than 0. In other words, memory areas 122 and 400 are locked based on any count value that is strictly greater than 0.

[0069] Isolation level 1 is associated with a second code (CODE1) contained in region 124 and second data (KEY1) contained in region 402. According to one embodiment, a third code (CODE2), for example associated with isolation level 2 and contained in region 126, is accessible for reading based on a current count value equal to 1.

[0070] For example, once the second code CODE1 is executed, the general-purpose processor 110 controls a second increment of the current count value via a monotonic counter 106. For example, after this second increment, corresponding to the third bootstrap step 412, the current count value of the monotonic counter 106 is equal to 2. Isolation level 2 is associated with the third code CODE2 and the third data (KEY2). The access control circuit 108 receives the new count value and is configured to prevent any access to the first and second codes and the first and second data associated with isolation levels less than or equal to 1 based on the count value being greater than 1.

[0071] According to one embodiment, when the final boot code, such as the third boot code, is executed, the general-purpose processor 110 controls a third increment of the current count value via a monotonic counter. Then, the access control circuitry 108 locks all access to the first, second, and third boot codes, as well as the first, second, and third data.

[0072] According to another embodiment, when the final boot code (e.g., the third boot code) is executed, the current count value is not incremented by the monotonic counter 106, and the access control circuit 108 still allows access to the third boot code and the third data.

[0073] Figure 5 This is a flowchart illustrating the operation of a secure boot method for a processing apparatus according to an embodiment. The method, for example, is... Figure 1 The general-purpose processor 110, monotonic counter 106, and access control circuit 108 of the processing device are used to implement this.

[0074] In step 501 (startup boot sequence), the boot processing device 102 is booted. In one example, this is the first boot of device 102 after its manufacture. In another example, it is a boot performed by an intermediary entity between the manufacturer of device 102 and its end user. In yet another example, it is a so-called operational boot of electronic device 100 performed by the end user.

[0075] In step 503 (initializing the counter) following step 501, the monotonic counter is initialized to an initial value, i.e., a natural number. In the example where the counter value is stored volatilely, each boot of the processing device initializes the counter value to, for example, 0 or 1. In another example where the counter value is stored in a non-volatile storage element, each boot of the processing device replaces the current counter value with the initial counter value, for example, equal to 0 or 1.

[0076] In some embodiments, the initial count values ​​generated after booting can vary depending on the state or context of the processing device 102. For example, this could correspond to one or more count values ​​for one or more isolation levels reserved for the initial setup phase of the device 102, including, for example, firmware installation. Data and / or code associated with these isolation levels are used, for example, for this initial setup.

[0077] For example, after manufacturing, processing device 102 has a context "blank" and an initial count value equal to a value reserved for setup, such as 0. Once setup is complete, the device's context becomes, for example, "setup complete". Utilizing this new context, device 102 is then booted, for example by an intermediary entity between the manufacturer and the end user and / or by the end user, a count value greater than the reserved count value will be triggered, for example, equal to 1. Therefore, the boot code associated with the isolation level corresponding to the reserved count value, as well as sensitive data, will be inaccessible.

[0078] For example, the context of a device can be detected by the presence of a voltage on its boot pin, for instance, by applying that voltage by adding a jumper between the boot pin and another pin at the power supply voltage. Alternatively or additionally, the context of a device can be detected by the value of one or more bits stored in memory 104 or another memory in a non-volatile, protected manner.

[0079] In one example, a general-purpose processor 110 is configured to detect the context of device 102 upon booting device 102 and configure the initial count value of monotonic counter 106 accordingly. In another example, monotonic counter 106 is configured to detect the context of device 102 itself and configure its own initial count value upon booting device 102.

[0080] In step 505 (reading and executing code at level i) following step 503, the general-purpose processor 110 reads the data and boot code associated with isolation level i and executes the boot code associated with isolation level i. Once the code at level i has been executed, the general-purpose processor 110 compares (i = N?) the count value i to the value N in step 507, where N is the count value associated with the last step in the boot sequence; in other words, according to the embodiment, the boot code at isolation level N is the last to be executed. For example, in Figure 4 In the example, N equals 2. If i is not equal to N (N branch), the method continues in step 509 (i = i + 1), where the general-purpose processor triggers the increment of the count value. For example, the count value increases from i to i + 1. The increment can also increase the value i by several units. The method then restarts in step 505.

[0081] If the count value resulting from comparison step 507 is equal to N (Y branch), the method ends at step 511 (booting end), whereby the booting of the processing device ends. According to one embodiment, after step 511, the current count value remains equal to N. According to another embodiment, the count value is incremented in step 511, and the current count value becomes equal to N+1. In this second embodiment, the access control circuit 108 is configured to prevent access to all boot codes based on this count value.

[0082] Figure 6 This is a flowchart illustrating the operation of a secure boot method for a processing apparatus according to another embodiment. The method, for example, is... Figure 1 The general-purpose processor 110, monotonic counter 106, and access control circuit 108 of the processing device are used to implement this.

[0083] Steps 601 and 603 are similar Figure 5 Steps 501 and 503 will not be described in detail hereafter.

[0084] In step 605 (code at access level i and code at i+1 execution level i) following step 603, the general-purpose processor 110 accesses the data and boot code associated with isolation level i+1 and executes the boot code associated with isolation level i.

[0085] In one example, the data or code associated with isolation level i contains one or more encrypted or unencrypted encryption keys that will be used when executing one or more pieces of code associated with isolation level i+1. Therefore, write access is granted, for example, on the memory region associated with isolation level i+1 to provide the keys to the code associated with isolation level i+1.

[0086] In another instance, the code associated with isolation level i contains instructions for verifying the integrity of data and / or code associated with isolation level i+1. Therefore, read access to the memory region associated with isolation level i+1 is permitted to perform this verification.

[0087] In step 607 (i = i + 1) following step 605, the count value is incremented. For example, the count value increases from i to i + 1. In other examples, the increment increases i by several units.

[0088] In step 609 (i = N?), the general-purpose processor 110 compares the count value i with the value N, where N is relative to... Figure 5 The definition described in step 507. If the value i is not equal to N (N branch), the method returns to step 605.

[0089] If the count value equals N (Y branch) in comparison step 609, the method continues to step 613 (execute code at level N), where boot code associated with isolation level N is executed.

[0090] The guidance of the processing device ends at step 615 (end guidance), which is similar to... Figure 5 Step 511 will not be described in detail hereafter.

[0091] Its implementation method is in Figure 6 The method shown allows for interleaved reading of the bootstrap code. In practice, when the count value is below the level value, the bootstrap code associated with the isolation level is read. Figure 5 This saves time compared to the implementation of the method shown.

[0092] One advantage of the described embodiments is that sensitive data regarding confidentiality is protected in a significant way by using a monotonic counter, especially during lock access in the debugging process.

[0093] Another advantage of the described embodiments is that they are easily adaptable to several boot architectures.

[0094] Various embodiments and variations have been described. Those skilled in the art will understand that certain features of these embodiments can be combined, and other variations will be readily apparent to them. In particular, different types of processors can be used. Furthermore, the number of isolation levels can vary.

[0095] Finally, based on the functional descriptions provided above, the actual implementation of the embodiments and variations described herein is within the capabilities of those skilled in the art. In particular, authentication protocols for debugging, other than symmetric cryptography protocols, can be implemented.

Claims

1. A method for debugging a processing device, the method comprising: During the first guidance of the processing device, a first count value is generated by the monotonic counter of the processing device; During the first boot period, the first count value is transmitted to the debug access control circuit and the memory access control circuit of the memory via the monotonic counter. During the first boot process, the first count value is compared with one or more reference values ​​via the debug access control circuit and the memory access control circuit. Based on the comparison made by the debug access control circuit, during the first boot period, debug access is authorized or prevented by the debug access control circuit. During the first boot process, the memory access control circuit authorizes the reading of first data stored in the memory based on the first count value; After transmitting the first count value, the monotonic counter is incremented to the second count value; During the second boot process, the second count value is transmitted to the debug access control circuit and the memory access control circuit via the monotonic counter. as well as During the second boot process, the memory access control circuit prevents the reading of the first data stored in the memory based on the second count value.

2. The method according to claim 1, wherein: The authorization or prevention includes: preventing the debugging access based on the first count value; The method also includes: The second count value is compared with one or more reference values ​​via the debug access control circuit; and The debugging access is authorized based on the second count value.

3. The method according to claim 1, wherein: The first count value corresponds to the first initialization value of the monotonic counter used for the first boot of the processing device; and The second count value corresponds to the second initialization value of the monotonic counter used for the second guidance of the processing device.

4. The method according to claim 3, wherein: During the first boot, the processing device is initially placed in a first state, and the debug access is authorized by the debug access control circuit based on the first count value; as well as During the second guidance, the processing device is locked in the second state; and the debug access is prevented by the debug access control circuit based on the second count value.

5. The method according to claim 1, further comprising: The memory access control circuit authorizes the reading of the second data stored in the memory based on the second count value.

6. The method according to claim 5, wherein: During the first boot process, the processing device is initially placed in a first state; the debug access is authorized by the debug access control circuit based on the first count value; During the second guidance, the processing device is locked in the second state; and the debug access is prevented by the debug access control circuit based on the first count value; as well as The first state and the second state of the processing device are defined by one or more values ​​stored in the memory.

7. The method of claim 1, wherein the debug access control circuit authorizes debug access when the count value of the monotonic counter is greater than or equal to the one or more reference values, and prevents debug access when the current count value of the monotonic counter is strictly less than the count value of the one or more reference values.

8. The method of claim 1, further comprising: Before authorizing or preventing the debugging access: The debugging access control circuit receives debugging access requests from external devices. as well as The external device's authentication is verified through the debugging access control circuit. The authorization or prevention of debug access is also performed based on the authentication of the external device through the debug access control circuit.

9. A data processing apparatus, comprising: A monotonic counter is configured to: generate a first count value during a first boot of the data processing device, transmit the first count value to a debug access control circuit and to a memory access control circuit, and generate a second count value greater than the first count value. The debugging access control circuit is configured as follows: Compare the first count value with one or more reference values; as well as Debugging access is authorized or prevented based on comparisons made through the aforementioned debug access control circuit. as well as The memory access control circuit is configured as follows: Compare the first count value with the one or more reference values; Based on the first count value, the reading of the first data stored in the memory is authorized during the first boot process; as well as The second count value is used to prevent the reading of the first data stored in the memory during the second boot process.

10. The data processing apparatus according to claim 9, wherein the monotonic counter is configured to: The second count value is generated by incrementing the first count value.

11. The data processing apparatus according to claim 10, wherein: During the second boot process, the debug access control circuit is further configured to: Compare the second count value with the one or more reference values; as well as The debugging access is authorized based on the second count value.

12. The data processing apparatus according to claim 10, wherein: The first count value corresponds to the first initialization value of the monotonic counter used for the first boot of the processing device; and The second count value corresponds to the second initialization value of the monotonic counter used for the second guidance of the processing device.

13. The data processing apparatus of claim 10, wherein the memory access control circuit is configured to read second data stored in the memory based on the second count value.

14. The data processing apparatus of claim 13, wherein the memory is a non-volatile memory.

15. The data processing apparatus according to claim 9, wherein the debug access control circuit is configured as follows: The debug access is authorized when the count value of the monotonic counter is greater than or equal to one or more reference values; and preventing the debug access when the count value of the monotonic counter is strictly less than the one or more reference values.

16. The data processing apparatus according to claim 9, wherein the debug access control circuitry is configured to: receive a debug access request from an external device prior to authorizing or preventing the debug access; verify an authentication of the external device; and authorize or prevent the debug access further based on the verification of the authentication.

Images