Secure startup of the processing unit

Abstract

This disclosure relates to a secure startup of a processing unit. A method for starting the processing device includes: generating a first count value by a monotonic counter during a first startup phase; transferring the first count value by the monotonic counter to access control circuitry of a memory; reading first data stored in the memory based on the first count value; and generating a second count value greater than the first count value by the monotonic counter during a second startup phase. The memory access control circuitry is configured such that reading the first data is not authorized based on the second count value.

Description

[0001] Cross-reference to related applications

[0002] This application claims priority to French application number 2103313, filed on March 31, 2021, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This disclosure relates to the field of methods and apparatus for protecting electronic circuits, and more particularly to an apparatus and method for performing a safe start-up of such circuits. Background Technology

[0004] The boot process of a device is based on the execution of code such as software and / or firmware code. The device boot sequence is a security-sensitive step because it typically involves the setting of parameters related to device security and / or the processing of sensitive data such as encryption keys for confidentiality, integrity, and authenticity.

[0005] Although solutions exist to make the startup code immutable, further protection of access to this code and sensitive data during startup of the processing device would be desirable. Summary of the Invention

[0006] There is a need to improve the security of the startup process used to process devices.

[0007] The embodiments described herein address all or some of the drawbacks of known processing devices.

[0008] One embodiment provides a method for starting a processing device, the method comprising: generating a first count value by a monotonic counter during a first startup phase; transferring the first count value by the monotonic counter to an access control circuit of a memory; reading first data stored in the memory based on the first count value; and generating a second count value greater than the first count value by the counter during a second startup phase, the memory access control circuit being configured such that reading the first data is unauthorized based on the second count value.

[0009] According to one embodiment, the first data includes first startup code.

[0010] According to one embodiment, the first startup code is executed before the monotonic counter generates a second count value, and the first startup code includes instructions for incrementing the monotonic counter to generate the second count value.

[0011] According to one embodiment, the memory is volatile memory.

[0012] According to one embodiment, the memory is a non-volatile memory.

[0013] According to one embodiment, the memory access control circuit is configured such that reading of the first data is not authorized based on a count value greater than a first count value.

[0014] According to one embodiment, the method further includes: reading second data stored in memory and associated with a second startup phase based on a first count value.

[0015] According to one embodiment, the method further includes: transferring a second count value to a memory by a monotonic counter; and reading second and / or third data stored in the memory based on the second count value.

[0016] According to one embodiment, the first count value corresponds to the initialization value of the monotonic counter at the first startup of the processing device, and the method further includes a second startup of the processing device during which the monotonic counter is initialized to the second count value.

[0017] According to one embodiment, the method further includes processing another startup of the device after the first startup and the second startup, wherein, at the second startup, if a condition regarding the state of the device is satisfied, the monotonic counter is reinitialized to the first count value.

[0018] According to one embodiment, the conditions relating to the state of the processing device correspond to the programming state of one or more bits stored in a region of memory or another memory in a non-volatile manner.

[0019] According to one embodiment, the method further includes: before generating a second count value, reading one or more first encryption keys stored in a memory based on a first count value, wherein the memory access control circuitry is configured such that reading of the first encryption keys is unauthorized based on a count value greater than the first count value.

[0020] According to one embodiment, the method further includes: after generating a second count value, reading one or more second encryption keys stored in a memory based on the second count value.

[0021] One embodiment provides a data processing apparatus, including: a monotonic counter configured to generate a first count value; a memory including access control circuitry and containing first startup code, the access control circuitry being configured to: read first data based on the first count value; and deny read access to the first data based on a second count value generated by the monotonic counter that is greater than the first count value. Attached Figure Description

[0022] The foregoing features and advantages, as well as other features and advantages, will be described in detail in the following description of specific embodiments given by way of illustration rather than limitation with reference to the accompanying drawings, in which:

[0023] Figure 1 An embodiment of a processing apparatus according to one embodiment of this specification is schematically illustrated in the form of a block diagram;

[0024] Figure 2 This illustration schematically depicts data and code accessible during secure boot according to one embodiment of this specification;

[0025] Figure 3 The illustration shows a flowchart illustrating the operation of a secure boot method for a processing device according to an embodiment of this specification; and

[0026] Figure 4 The illustration shows a flowchart illustrating the operation of a secure startup method for a processing device according to another example of an embodiment of this specification. Detailed Implementation

[0027] Similar features are indicated by similar reference numerals in the figures. In particular, common structural and / or functional features in the various embodiments may have the same reference numerals and may have the same structural, dimensional, and material properties.

[0028] For clarity, only operations and elements useful for understanding the embodiments described herein are described in detail. In particular, the design of the processing device is well known to those skilled in the art, and certain elements are not detailed in the following description.

[0029] Unless otherwise specified, when referring to two elements connected together, this means a direct connection without any intermediate elements other than the conductor, and when referring to two elements coupled together, this means that the two elements can be connected or they can be coupled via one or more other elements.

[0030] In the following disclosure, unless otherwise indicated, reference is made to absolute position modifiers such as “front,” “back,” “up,” “down,” “left,” “right,” etc., or relative position modifiers such as “above,” “below,” “higher,” “lower,” etc., or direction modifiers such as “horizontal,” “vertical,” etc., referring to the orientation shown in the figure.

[0031] Unless otherwise specified, the expressions “approximately,” “around,” “substantially,” and “around” indicate within 10%, preferably within 5%.

[0032] Figure 1 An electronic device 100 including a processing device 102 according to one embodiment of this specification is shown schematically in block diagram form.

[0033] Electronic device 100 includes, for example, electronic cards such as microcircuit cards, hardware used in computers, microprocessor circuits, etc.

[0034] Processing device 102 includes, for example, non-volatile memory 104 (NV MEM), such as flash memory. Memory 104 includes access control circuitry 108 (access control) connected to a monotonic counter 106 (monotonic counter).

[0035] Monotonic counters are known in the background art, and examples of such counters are described, for example, in the publication “Virtual Monotonic Counters and Count-Limited Objects using a TPM without a Trusted OS” by LFGSarmenta, M. VanDijk, CWO'Donnell, J. Rhodes, and S. Devadas (e.g., in Part 3), which is incorporated herein by reference in its entirety. This document describes embodiments of counters implemented in hardware and / or software. For example, a monotonic counter 106 is implemented in hardware by digital circuitry such as an application-specific integrated circuit (ASIC). The monotonic counter is configured to maintain a count value accessible at the counter's output. After an increment command, the monotonic counter increases its count value by one or more units, but the operation is irreversible after each increment. In effect, the monotonic counter is configured so that its count value never decreases. Furthermore, between two increments, the count value is protected from any modification and therefore cannot be erased or altered. Only increment commands allow the current value to be replaced with a new value higher than the current value.

[0036] The monotonic counter 106 is configured such that once an increment instruction is executed, no instruction is allowed to return to the previous value except when the processing device is reset to zero. When the count value is stored volatilely, the count value is lost each time the processing device is shut down, and the monotonic counter regenerates the initial count value each time the device is restarted. When the count value is stored in non-volatile memory, the initial count value is written back to the non-volatile memory of the monotonic counter after each restart.

[0037] Processing device 102 may also include a general-purpose processor 110 (CPU). For example, the general-purpose processor 110 may be coupled via bus 116 to a monotonic counter 106 and RAM (random access memory) 112 and non-volatile memory 104. Memory 112 and / or memory 104 stores, for example, instructions for controlling processor 110. The general-purpose processor 110 may be further coupled via bus 116 to a cryptographic processor 114 (CRYPTO). Cryptographic processor 114 receives encrypted data and returns decrypted data via bus 116 and / or receives unencrypted data and returns encrypted data via bus 116.

[0038] Non-volatile memory, for example, stores multiple boot codes and / or other data associated with multiple time isolation levels (TILs). Boot codes are, for example, software and / or firmware code. Figure 1 In the example, the non-volatile memory 104 includes a first region 118 in which a first boot code and / or first data (CODE0) is stored. The memory 104 also includes a second region 120 in which a second boot code and / or second data (CODE1) is stored, and a third region 122 in which a third boot code and / or third data (CODE2) is stored. The first, second, and third boot codes and / or data are associated, for example, with three corresponding isolation level (TIL) values. Although in Figure 1 The illustration shows a scenario with three datasets, but in other embodiments, the non-volatile memory 104 may store only two or more datasets in corresponding areas. As an example, the first, second, and third datasets include first, second, and third startup code.

[0039] The TIL isolation level depends on the count value generated by the monotonic counter 106. In one example, the TIL value is equal to the count value of the monotonic counter 106, but the count value can be changed to generate a different TIL value.

[0040] During startup, the reading of first, second, and third code and / or data, and / or the execution of first, second, and third startup code, are performed in steps, each associated with a corresponding isolation level. Access control circuitry 108 in memory 104 is configured to control the reading of these codes / data based on the isolation level of each step. First data and / or code, for example, is associated with an isolation level or TIL value of 0, and access control circuitry 108 is configured to make this data and / or code accessible for reading only when the current TIL count value is equal to 0. As the count value increments, for example as a result of the execution of the first code, access control circuitry 108 locks region 118, and the first data and / or code is no longer accessible for reading. After the increment, the current count value increases to, for example, 1, and the data and / or startup code associated with isolation level 1 (e.g., the second startup code) is executed.

[0041] In certain specific situations, access control circuitry 108 is configured to allow reading of one or more data associated with an isolation level higher than the current TIL value. The lower the isolation level, the higher the protection level. Therefore, isolation level 0 provides the most protection because the corresponding data can only be read when the count value is equal to 0. Thus, each isolation level corresponds to the protection level of the contents of the memory region associated with it.

[0042] The access control mechanism implemented by circuit 108 can be implemented in several ways.

[0043] In the first example, when circuit 108 receives a read request associated with one or more addresses in memory 104, it is configured to compare this / these addresses with the address ranges associated with regions 118, 120, 122 of memory 104. If it is an address in a region associated with a TIL value less than the current value, circuit 108 is configured to, for example, block the read operation.

[0044] In the second example, circuit 108 is configured to disable read circuitry for any region 118, 120, 122 of memory 104 associated with a TIL value less than the current value. For example, one or more logic gates, such as OR gates or AND gates, are coupled to the output paths of each region 118, 120, 122 of memory 104, and also receive an enable signal generated based on the TIL value to selectively disable each output path.

[0045] Because the access control circuit 108 prevents the reading of data and / or the execution of code associated with a TIL value lower than the current level, the fact that the count value cannot be decremented during the operation of the device 100 allows the startup code to be protected once it is executed.

[0046] In some embodiments, data and / or startup codes and one or more of the associated isolation levels are retained for the setup phase of device 102 or for individual entities in the chain from manufacturer to end user. For example, an intermediate entity between the manufacturer of the processing device and the end user of the electronic device 100 may be required to install startup data and / or codes specific to the use of device 100. In this case, one or more of the “minimum” data and / or startup codes associated with isolation level 0 are retained, for example, for the manufacturer of processing device 102, and other data and / or startup codes are retained for the intermediate entity.

[0047] In some embodiments, the contents of memory regions 118, 120, and 122 include other data besides the boot code for processing the device. For example, other confidential, sensitive data is stored in association with at least one of the first, second, and third codes and / or data. Such other data, for example, includes encryption keys used in the execution of the associated boot code. Figure 2 In the example, memory regions 200, 202, and 204 store sensitive data associated with boot codes 118, 120, and 122, respectively, stored in non-volatile memory 104. Regions 200, 202, and 204 are, for example, separate from regions 118, 120, and 122, but remain associated with an isolation level corresponding to the isolation level of the boot code to which the data is associated. This sensitive data includes, for example, one or more encryption keys stored in each region 200, 202, and 204, and each of these regions is contained within non-volatile memory 104. According to another embodiment, each region 200, 202, and 204 is a sub-region of the corresponding region 118, 120, and 122.

[0048] Figure 2 This refers to the data and code that are accessible during secure boot according to one embodiment of this specification.

[0049] Start Figure 2 During the first step 210 of the processing device illustrated at the top, the current count value is, for example, equal to 0. Figure 2In the example, isolation level 0 is associated with a first code (CODE0) and first sensitive data (KEY0). For example, access control circuitry 108 is configured such that the first code and the first data are exclusively accessible when the current count value is equal to 0. However, during step 210, the access control circuitry, for example, allows access to all memory regions 200, 202, and 204, and all regions 118, 120, and 122. In practice, in some cases, such as for anticipated subsequent steps in the boot process, one or more of the other boot codes CODE1, CODE2 are accessible for reading during step 210.

[0050] For example, once the first code (CODE0) is executed, the general-purpose processor 110 indicates a first increment of the current count value via the monotonic counter 106. For example, the first code includes an instruction requesting the counter to increment. This instruction is, for example, transferred to the control register of the monotonic counter (not shown).

[0051] Following this first increment, the current count value of the monotonic counter 106 is, for example, equal to 1, corresponding to the second startup step 211. The access control circuit 108 receives the new current count value and is configured to prevent any access to the first data and first code associated with isolation level 0 based on this count value, which is greater than 0. In other words, memory regions 118 and 200 are locked based on any count value that is strictly greater than 0.

[0052] Isolation level 1 is associated with a second code (CODE1) in contained region 120 and second data (KEY1) in contained region 202. According to one embodiment, a third code (CODE2) associated with isolation level 2 and contained in region 122 is accessible for reading based on a current count value equal to 1.

[0053] For example, once the second code (CODE1) is executed, the general-purpose processor 110 indicates a second increment of the current count value via a monotonic counter 106. For example, after this second increment, the current count value of the monotonic counter 106 is equal to 2, corresponding to the third startup step 212. Isolation level 2 is associated with the third code (CODE2) and the third data (KEY2). The access control circuitry 108 receives the new count value and is configured to prevent any access to the first and second codes and the first and second data associated with isolation levels less than or equal to 1 based on the count value greater than 1.

[0054] According to one embodiment, when the final startup code (e.g., the third startup code) is executed, the general-purpose processor 110 controls the third increment of the current count value via a monotonic counter. The access control circuitry 108 then locks out all access to the first, second, and third startup codes, as well as the first, second, and third data.

[0055] According to another embodiment, when the final startup code (e.g., the third startup code) is executed, the current count value is not incremented by the monotonic counter 106, and access to the third startup code and the third data is kept authorized by the access control circuit.

[0056] Figure 3 This is a flowchart illustrating the operation of a secure boot method for a processing device according to an example embodiment of this specification. The method is, for example, performed by... Figure 1 This is achieved using a general-purpose processor 110, a monotonic counter 106, and an access control circuit 108 in the processing device.

[0057] In step 301 (start-up sequence), processing device 102 is turned on. In one example, this is the first startup of device 102 after manufacturing. In another example, it is a startup performed by an intermediary entity between the manufacturer of device 102 and its end user. In yet another example, it is a so-called operational startup of electronic device 100 performed by the end user.

[0058] In step 303 (initializing the counter) following step 301, the monotonic counter is initialized to an initial value, which is a natural number. In the example where the count value is stored in a volatile manner, each startup of the processing device causes the count value to be initialized, for example, to 0 or 1. In another example where the count value is stored in a non-volatile storage element, each startup of the processing device causes the current count value to be replaced by the initial count value, for example, equal to 0 or equal to 1.

[0059] In some embodiments, the initial count values ​​generated after startup can vary depending on the state or context of the processing device 102. For example, one or more count values ​​corresponding to one or more isolation levels are retained for the initial setup phase of the device 102, including, for example, firmware installation. For example, data and / or code associated with these isolation levels are used for this initial setup.

[0060] For example, after manufacturing, processing device 102 has a context "blank" and an initial count value equal to a value reserved for setup, such as 0. Once setup is complete, the device's context changes to, for example, "setup complete". Utilizing this new context, device 102 is then initiated, for example by an intermediary entity between the manufacturer and the end user and / or by the end user, a count value larger than the reserved count value and, for example, equal to 1, will be triggered. Therefore, the startup code(s) associated with the isolation level corresponding to the reserved count value, as well as sensitive data, will be inaccessible.

[0061] For example, the context of a device can be detected by the presence of a voltage on the device's power-on pin, such as by applying the voltage by adding a jumper between the power-on pin and another pin that is at a power supply voltage. Alternatively or additionally, the context of a device can be detected by the value of one or more bits stored in memory 104 or another memory in a non-volatile, protected manner.

[0062] In one example, the general-purpose processor 110 is configured to detect the context of device 102 once device 102 is started, and configure the initial count value of monotonic counter 106 accordingly. In another example, monotonic counter 106 is configured to detect the context of device 102 itself and configure its initial count value itself once device 102 is started.

[0063] In step 305 (reading and executing code at isolation level i) following step 303, the data and startup code associated with isolation level i are read by the general-purpose processor 110, and the startup code associated with isolation level i is executed. Once the code at level i is executed, the general-purpose processor 110 compares the count value i with the value N in step 307 (i = N?), where N is the count value associated with the last step in the startup sequence; in other words, according to embodiments of this specification, the startup code at isolation level N is the last startup code to be executed. For example, in Figure 2 In the example, N equals 2. If i is not equal to N (N branch), the method continues in step 309 (i = i + 1), where the general-purpose processor triggers the increment of the count value. For example, the count value increases from i to i + 1. The increment can also increase the count value by several units. The method then continues at step 305.

[0064] If, as a result of comparison step 307, the count value equals N (Y branch), the method terminates at step 311 (startup end), where the startup of the processing device ends. According to one embodiment, the current count value remains equal to N after step 311. According to another embodiment, the count value is incremented in step 311, and the current count value becomes equal to N+1. In this second embodiment, the access control circuitry is then configured to block access to all startup code based on this count value.

[0065] Figure 4 This is a flowchart illustrating the operation of a secure boot method for a processing device according to another example of an embodiment of this specification. The method is, for example, performed by... Figure 1 This is achieved using a general-purpose processor 110, a monotonic counter 106, and an access control circuit 108 in the processing device.

[0066] Steps 401 and 403 and Figure 3 Steps 301 and 303 are similar and will not be described in detail again.

[0067] In step 405 (accessing code at isolation level i and i+1, executing code at isolation level i) following step 403, the general-purpose processor 110 accesses the data and startup code associated with isolation level i+1 and executes the startup code(s) associated with isolation level i.

[0068] In one example, the data or code associated with isolation level i contains one or more encryption keys (encrypted or unencrypted) that will be used when executing one or more pieces of code associated with isolation level i+1. Thus, for example, write access is granted to memory regions(s) associated with isolation level i+1 in order to supply keys to the code associated with isolation level i+1.

[0069] In another example, the code associated with isolation level i contains instructions for verifying the integrity of data and / or code associated with isolation level i+1. Therefore, to perform this verification, read access to (or similar memory regions) associated with isolation level i+1 is permitted.

[0070] In step 407 (i = i + 1) following step 405, the count value is incremented. For example, the count value increases from i to i + 1. In other examples, the increment increases i by a certain number of units.

[0071] In step 409 (i = N?), the general-purpose processor 110 compares the count value i with the value N, where N is relative to... Figure 3 Define it as described in step 307. If the value i is not equal to N (N branches), the method returns to step 405.

[0072] If the count value equals N (Y branch) in comparison step 409, the method continues to step 413 (code at execution level N), where startup code(s) associated with isolation level N is executed.

[0073] The startup of the processing device ends at step 415 (startup complete), and... Figure 3 Step 311 is similar and will not be described in detail here.

[0074] exist Figure 4 The implementation method described in the document allows for interleaved readings of the boot code. In practice, boot code associated with the isolation level is read when the count value is below the isolation level value. Figure 3 This saves time compared to the implementation of the method presented in [the document / document].

[0075] One advantage of the described embodiments is that the startup code and confidential sensitive data are substantially protected by using a monotonic counter to lock access to the code and / or data.

[0076] Another advantage of the described embodiment is that it is easily adaptable to multiple boot architectures.

[0077] Various embodiments and variations have been described. Those skilled in the art will understand that certain features of these embodiments can be combined, and other variations will readily conceive of them. In particular, different types of processors can be used. Furthermore, the number of isolation levels can vary.

[0078] Finally, actual implementations of the embodiments and variations described herein are within the capabilities of those skilled in the art based on the functional descriptions provided above.

Claims

1. A method for starting a processing device, the method comprising: The first count value is generated by a monotonic counter during the first startup phase; The monotonic counter transmits the first count value to the memory access control circuit. Based on the first count value, read the first data stored in the memory and associated with the first startup phase; During the second startup phase, the monotonic counter generates a second count value that is greater than the first count value. The monotonic counter transmits the second count value to the access control circuit of the memory; The access control circuit prevents the reading of the first data based on the second count value; as well as Based on the second count value, read the second data stored in the memory and associated with the second startup phase.

2. The method according to claim 1, wherein the first data includes first startup code.

3. The method of claim 2, wherein the first startup code is executed before the monotonic counter generates the second count value, the first startup code comprising instructions for incrementing the monotonic counter to generate the second count value.

4. The method according to claim 1, wherein the memory is a volatile memory.

5. The method according to claim 1, wherein the memory is a non-volatile memory.

6. The method of claim 1, wherein the access control circuitry of the memory is configured to: in response to a count value greater than the first count value, not authorize reading of the first data.

7. The method according to claim 1, further comprising: Based on the first count value, the second data stored in the memory and associated with the second startup phase is pre-read during the first startup phase.

8. The method of claim 1, wherein the first count value corresponds to the initialization value of the monotonic counter at a first startup of the processing device, and wherein the method further comprises a second startup of the processing device, during which the monotonic counter is initialized to the second count value.

9. The method of claim 8, further comprising a third startup of the processing device after the first startup and the second startup, wherein, during the third startup, if a condition relating to the state of the processing device is satisfied, the monotonic counter is re-initialized to the first count value.

10. The method of claim 9, wherein the condition relating to the state of the processing device corresponds to the programming state of one or more bits stored in a region of the memory or another memory in a non-volatile manner.

11. The method according to claim 1, further comprising: Before generating the second count value and based on the first count value, one or more first encryption keys stored in the memory are read, and the access control circuitry of the memory is configured to: in response to a count value greater than the first count value, not authorize reading of the first encryption key.

12. The method of claim 11, further comprising: After generating the second count value and based on the second count value, one or more second encryption keys stored in the memory are read.

13. A method for starting a processing device, the method comprising: (a) Perform the first startup phase, including: The first count value is generated by a monotonic counter. The monotonic counter transmits the first count value to the memory access control circuit, and Based on the first count value, read the first data stored in the memory; and (b) Perform the second startup phase, including: The monotonic counter is irreversibly incremented to a second count value that is greater than the first count value. The monotonic counter transmits the second count value to the access control circuit of the memory. The access control circuit prevents the reading of the first data based on the second count value; and Based on the second count value, read the second data stored in the memory and associated with the second startup phase.

14. The method of claim 13, further comprising: Restart the processing device to reset the monotonic counter; as well as Repeat steps (a) and (b).

15. The method of claim 13, wherein: The second data is associated with an isolation level equal to the second count value; as well as The second startup phase also includes: The third data is read based on the second count value, and the third data is associated with an isolation level greater than the second count value.

16. A data processing apparatus, comprising: The monotonic counter is configured as follows: The first count value is generated during the first startup phase; as well as In the second startup phase, a second count value is generated after the first count value is generated, wherein the second count value is greater than the first count value; as well as The memory includes access control circuitry and contains first boot code and second boot code, wherein the access control circuitry is configured to: The first startup code is read based on the first count value during the first startup phase. Reading of the first startup code is prevented during the second startup phase based on the second count value; as well as The second startup code is read based on the second count value during the second startup phase.

17. The data processing apparatus of claim 16, wherein the memory is a volatile memory.

18. The data processing apparatus of claim 16, wherein the memory is a non-volatile memory.

19. The data processing apparatus of claim 16, wherein the monotonic counter is further configured to increment only the generated count value and to be reinitialized based on the condition of the state of the data processing apparatus being met.

Images