Processing systems, related integrated circuits, devices, and methods

Abstract

Embodiments of the present disclosure relate to processing systems, related integrated circuits, devices, and methods. In one embodiment, a processing system includes a plurality of storage elements each comprising a latch or a flip-flop and configured to receive a write request comprising a data bit and store the received data bit to the latch or the flip-flop, a non-volatile memory configured to store the data bits of the plurality of storage elements, a hardware configuration circuit configured to read the data bits from the non-volatile memory and generate a write request to store the data bits to the storage elements, and a hardware circuit configured to change operation in dependence on a logic level stored to a latch or a flip-flop of a first storage element of the plurality of storage elements. The first storage element comprises another latch or another flip-flop and is configured to store an inverted version of the received data bit to the other latch or the other flip-flop in response to the write request.

Description

[0001] Cross-reference to related applications

[0002] This application claims the benefit of Italian patent application No. 102021000030332, filed on November 30, 2021, which is incorporated herein by reference. Technical Field

[0003] Embodiments of the present invention relate to protecting the processing system from register modifications. Background Technology

[0004] Figure 1 A typical electronic system, such as the electronic system of a vehicle, is shown, including multiple processing systems 10, such as embedded systems or integrated circuits, such as field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or microcontrollers (e.g., dedicated to the automotive market).

[0005] For example, in Figure 1 The diagram illustrates three processing systems 101, 102, and 103 connected via a suitable communication system 20. For example, the communication system may include a vehicle control bus, such as a Controller Area Network (CAN) bus, connected via a gateway to a vehicle control bus, and possibly a multimedia bus, such as a Media-Oriented System Transport (MOST) bus. Typically, the processing systems 10 are located in different parts of the vehicle and may include, for example, an engine control unit, a transmission control unit (TCU), an anti-lock braking system (ABS), a body control module (BCM), and / or a navigation and / or multimedia audio system. Therefore, one or more processing systems 10 may also implement real-time control and adjustment functions. These processing systems are generally identified as electronic control units.

[0006] Figure 2 It shows what can be used as Figure 1 A block diagram of any exemplary digital processing system 10 (e.g., a microcontroller).

[0007] In the considered example, the processing system 10 includes a microprocessor 102 programmed via software instructions, typically a central processing unit (CPU). The software executed by the microprocessor 102 is typically stored in a non-volatile program memory 104, such as flash memory or EEPROM. Therefore, the memory 104 is configured to store the firmware of the microprocessor 102, which includes software instructions to be executed by the microprocessor 102. Generally, the non-volatile memory 104 can also be used to store other data, such as configuration data or calibration data.

[0008] The microprocessor 102 is also typically associated with volatile memory 104b, such as random access memory (RAM). For example, memory 104b can be used to store temporary data.

[0009] like Figure 2 As shown, communication with the memories 104 and / or 104b is typically performed via one or more memory controllers 100. The memory controllers 100 may be integrated into the microprocessor 102 or connected to the microprocessor 102 via a communication channel (e.g., the system bus of the processing system 10). Similarly, the memories 104 and / or 104b may be integrated with the microprocessor 102 in a single integrated circuit, or the memories 104 and / or 104b may be in the form of separate integrated circuits and connected to the microprocessor 102, for example, via traces on a printed circuit board.

[0010] In the example under consideration, microprocessor 102 may have one or more associated (hardware) resources / peripherals 106 selected from the group consisting of:

[0011] - One or more communication interfaces IF, such as those used for exchanging data via communication system 20, such as Universal Asynchronous Receiver / Transmitter (UART), Serial Peripheral Interface (SPI), Inter-Integrated Circuit (I2C), Controller Area Network (CAN) bus, and / or Ethernet interface, and / or debug interface; and / or

[0012] - One or more analog-to-digital converters (AD) and / or digital-to-analog converters (DA); and / or

[0013] - One or more dedicated digital components (DCs), such as hardware timers and / or counters, or cryptographic coprocessors; and / or

[0014] - One or more analog components AC, such as comparators, sensors, such as temperature sensors, etc.; and / or

[0015] - One or more mixed signal component MSCs, such as PWM (Pulse Width Modulation) drivers.

[0016] Typically, a dedicated digital component (DC) may also correspond to an FPGA integrated within the processing system 10. For example, in this case, the memory 104 may also include program data for such an FPGA.

[0017] Therefore, the digital processing system 10 can support different functions. For example, the behavior of the microprocessor 102 is determined by firmware stored in the memory 104, such as software instructions executed by the microprocessor 102 of the microcontroller 10. Thus, by installing different firmware, the same hardware (microcontroller) can be used for different applications.

[0018] Future generations of processing systems, especially microcontrollers designed for automotive applications, will exhibit a significant increase in complexity, primarily due to the increased number of functions (such as new protocols, new features, etc.) and the stringent constraints on system operating conditions (such as lower power consumption, increased computing power and speed, etc.).

[0019] In parallel, the security framework for each processing system 10 also becomes increasingly complex. Typically, the security framework is based on the concept of resource protection; that is, given a set of resources, the framework is designed so that access to one or more resources can be selectively blocked or permitted based on specific conditions. For example, access to a given resource (e.g., a memory region of non-volatile memory 104 and / or a debug interface) can typically be blocked by storing one or more bits in a reserved memory location of non-volatile memory 104. Additionally or alternatively, access to a resource can typically be blocked until a given password is provided, for example, via microprocessor 102 or communication interface IF.

[0020] In this regard, the state of whether access to a given resource is blocked or authorized is typically stored in a register, for example, using one or more triggers. However, this means that a hacker could attempt to modify the contents of such a register to grant access to a blocked resource. Summary of the Invention

[0021] The embodiments provide solutions for protecting registers, particularly configuration registers for storing security information, such as configuration registers configured to store data identifying whether access to a resource is permitted or blocked, and / or configuration registers configured to store one or more reference passwords.

[0022] According to one or more embodiments, one or more of the above-described objects are achieved by a processing system having the features specifically set forth in the appended claims. The embodiments also relate to related integrated circuits and methods.

[0023] As described above, various embodiments of this disclosure relate to processing systems. Specifically, the processing system includes a plurality of storage elements, wherein each storage element includes a latch or flip-flop and is configured to receive a write request including data bits and store the received data bits into the latch or flip-flop. Therefore, hardware circuitry can be configured to change its operation based on the logic level of the latch or flip-flop stored in at least one of the plurality of storage elements.

[0024] Specifically, in various embodiments, the first storage element may be used to store security-related configuration data. For example, as will be described in more detail below, the hardware circuitry may include at least one sub-circuit, such as a resource / peripheral device, memory controller, or microprocessor, and protection circuitry configured to receive control commands for the sub-circuit and selectively execute (or suppress) the control commands, i.e., selectively forward (or not forward) the control commands to the sub-circuit. For instance, in various embodiments, the processing system includes a microprocessor and / or a debug interface configured to provide this control command to control the operation of the hardware circuitry. For example, the control command may be a read or write request.

[0025] Therefore, the protection circuit can selectively (at least) execute control commands based on the logic level of the latch or flip-flop stored in the first storage element. For example, the data bits stored in the first storage element may correspond to configuration data and / or lifetime data.

[0026] Therefore, in various embodiments, the processing system further includes: a non-volatile memory configured to store data bits of the plurality of storage elements; and hardware configuration circuitry configured to read data bits from the non-volatile memory and generate write requests to store the data bits into the storage elements.

[0027] In various embodiments, the processing system is configured to protect data stored in latches or flip-flops of a first storage element from tampering attacks. For this purpose, the first storage element includes another latch or flip-flop and is configured to store an inverted version of received data bits in response to a write request. Furthermore, the first storage element includes combinational logic configured to compare the logic level of the latch or flip-flop stored in the first storage element with the logic level of the other latch or flip-flop stored in the first storage element. Specifically, in various embodiments, the first storage element is configured to de-assert a first tampering signal associated with the first storage element when the logic levels are different, and to assert the first tampering signal when the logic levels are the same.

[0028] Therefore, in various embodiments, the hardware circuitry is configured to further modify the operation based on the first tamper signal. For example, the protection circuitry of the hardware circuitry may be configured to selectively execute control commands based on the logic level of the latch or flip-flop stored in the first storage element and the first tamper signal. For example, the protection circuitry may be configured to execute (i.e., forward) the control command when the latch or flip-flop of the first storage element has stored the first logic level and the first tamper signal is deasserted, and to suppress (i.e., not forward) the execution of the control command when the latch or flip-flop of the first storage element has stored the second logic level or the first tamper signal is asserted.

[0029] Optionally, the protection circuit can be configured to selectively execute control commands based on a control signal, and the hardware circuitry or the first storage element may include combinational logic circuitry configured to determine whether the first tamper signal has been asserted. In this case, in response to determining that the first tamper signal has been deasserted, the combinational logic circuitry may set the first control signal to a logic value stored in a latch or flip-flop of the first storage element. Conversely, in response to determining that the first tamper signal has been asserted, the combinational logic circuitry may set the first control signal to a predetermined tamper value.

[0030] Typically, the protection circuit can also be configured to manage access to multiple sub-circuits and / or memory regions, each of which is associated with at least one corresponding first storage element. In this case, the protection circuit can be configured to disable the execution of control commands (to a subset or all of the sub-circuit and / or memory regions) when at least one of the first tamper signals provided by the multiple first storage elements is asserted.

[0031] In various embodiments, the hardware circuitry may further include a password verification circuit configured to receive a password verification command from the microprocessor and / or the debug interface, wherein the password verification command includes a password. The password verification circuitry then compares the password with a reference key, wherein the reference key is determined as a function of the logic levels of latches or flip-flops stored in a plurality of second storage elements, and asserts a rewrite signal when the password corresponds to the reference key. Therefore, in this case, the protection circuitry may be configured to execute (i.e., forward) a control command when the rewrite signal is asserted.

[0032] For example, in various embodiments, each second storage element further includes another latch or flip-flop and combinational logic circuitry configured to selectively assert a second tamper signal by comparing the logic level of the latch or flip-flop stored in the respective second storage element with the logic level of another latch or flip-flop stored in the respective second storage element.

[0033] In various embodiments, the cryptographic verification circuit may also incorporate a corresponding tampering signal. For example, the verification circuit may be configured to assert a rewrite signal when the cryptography corresponds to the reference key and the second tampering signal provided by the second storage element is deasserted, and to deassert the rewrite signal when the cryptography does not correspond to the reference key or at least one of the second tampering signal provided by the second storage element is asserted.

[0034] Additionally or alternatively, the protection circuit may be configured to disable the execution of control commands when at least one of the second tampering signals provided by the second storage element is asserted. Attached Figure Description

[0035] Embodiments of this disclosure will now be described with reference to the accompanying drawings, which are provided by way of non-limiting example only, in which:

[0036] Figure 1 A typical electronic system including multiple processing systems is shown;

[0037] Figure 2 An example of a processing system is shown;

[0038] Figure 3 An embodiment of the processing system is shown;

[0039] Figure 4 An embodiment of the security architecture for the processing system is shown;

[0040] Figure 5 An embodiment of a security architecture for a processing system including cryptographic verification circuitry is shown;

[0041] Figure 6 An embodiment of a security architecture for a processing system including a cryptographic verification circuit and a temporary cryptographic library is shown;

[0042] Figure 7 and 8 An embodiment of a processing system including configuration circuitry and a configuration data client is shown; and

[0043] Figures 9 to 12 It shows the use of Figure 7 and 8 An embodiment of the storage element for the configuration data client. Detailed Implementation

[0044] In the following description, numerous specific details are set forth to provide a thorough understanding of the embodiments. The embodiments may be practiced without one or more of these specific details, or using other methods, components, materials, etc. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the embodiments.

[0045] Throughout this specification, references to "an embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic described in connection with that embodiment is included in at least one embodiment. Therefore, the phrases "in one embodiment" or "in an embodiment" appearing throughout this specification do not necessarily refer to the same embodiment. Furthermore, particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0046] The titles provided in this document are for convenience only and do not explain the scope or meaning of the embodiments.

[0047] In the following Figures 3 to 12 In China, it has already been referred to Figure 1 and 2 The parts, elements, or components described are indicated by the same reference numerals used previously in these figures; in order not to overburden the detailed description of the invention, the description of these previously described elements will not be repeated below.

[0048] Figure 3 An embodiment of the processing system 10a according to this specification is shown.

[0049] Specifically, in the considered embodiment, the processing system 10a includes at least one processing core 102 integrated in the integrated circuit 30, for example, n processing cores 1021…102. n One or more of the processing cores 102 are connected to the (on-chip) communication system 114. For example, in a real-time control system environment, processing cores 1021…102 n It can be an ARM Cortex®-R52 core. Typically, the communication system 114 may include one or more bus systems, such as those based on an Advanced Scalable Interface (AXI) bus architecture and / or a Network on Chip (NoC).

[0050] For example, as illustrated by the example of processing core 1021, each processing core 102 may include a microprocessor 1020 and a communication interface 1022 configured to manage communication between the microprocessor 1020 and the communication system 114. In the considered embodiment, interface 1022 is a master interface configured to forward (read or write) requests from the microprocessor 1020 to the communication system 114 and to forward optional responses from the communication system 114 to the microprocessor 1020. In various embodiments, processing core 102a may also include a slave interface 1024. For example, in this way, a first microprocessor 1020 may send a request to a second microprocessor 1020 (via the communication interface 1022 of the first microprocessor, the communication system 114, and the communication interface 1024 of the second microprocessor). For example, for this purpose, in addition to a system bus or NoC, the communication system 114 may also include an additional coprocessor bus, such as connecting the same processing core 102a or all processing cores 102a of the microprocessors 1020.

[0051] In various embodiments, each processing core 1021…102 n It may also include additional local resources, one or more local memories 1026, typically identified as tightly coupled memory (TCM).

[0052] As mentioned earlier, typically, processing cores 1021…102 n It is configured to exchange data with non-volatile memory 104 and / or volatile memory 104b. In various embodiments, these memories are system memories, i.e., for processing cores 1021…102. n Sharing. For example, in various embodiments, processing system 10a includes one or more memory controllers 100 configured to connect at least one non-volatile memory 104 and at least one volatile memory 104b to communication system 114. As previously described, one or more of the memories 104 and / or 104b may be integrated into integrated circuit 30 including processing core 102, or may be externally connected to integrated circuit 30.

[0053] As previously described, processing system 10a may include one or more resources 106, such as one or more communication interfaces or coprocessors (e.g., cryptographic coprocessors). Resources 106 are typically connected to communication system 114. For example, for this purpose, communication system 114 may actually include an Advanced Microcontroller Bus Architecture (AMBA) High Performance Bus (AHB) and an Advanced Peripheral Bus (APB) for connecting resources / peripheral devices 106 to the AMBA AHB bus. For example, each resource 106 may be connected to communication system 114 via a slave interface 1062 of resource 106 and / or via a DMA controller 107, which includes a master interface configured to directly exchange data by sending read or write requests to communication system 114.

[0054] like Figure 3 As shown, the integrated circuit 30 of the processing system 10a may also include a debug interface 50. For example, a typical debug interface 50 includes two sub-circuits: a communication interface 502 (e.g., JTAG (Joint Test Action Group), CAN, SPI, or I2C communication interface) manages data exchange with an external debugger 52, and an internal debug circuit 500 is configured to manage debug operations, for example, by sending read or write requests via the communication system 114 or a dedicated debug bus. Generally, the debug circuit 500 may also be implemented via software instructions executed via the processing core 102 (e.g., by receiving debug commands via one of the communication interfaces IF of the processing system 10a).

[0055] As previously described, in various embodiments, the processing system 10a includes a security architecture configured to restrict access to one or more resources of the processing system 10a.

[0056] Figure 4 An embodiment of the security architecture of the processing system 10a is shown.

[0057] As described above, the security architecture of the processing system 10a, such as a microcontroller, is designed to restrict access to one or more circuits of the processing system 10a, which are referred to below as hardware circuits 110, such as memory 104 and / or 104b, one or more processing cores 102 and / or one or more resources 106.

[0058] For example, such as Figure 4 As shown, one or more of the hardware circuits 110 of the processing system may have associated (e.g., including) protection circuits 150 configured to control access to the respective hardware circuit 110. For example, a corresponding access request CMD may be received from another resource of the processing system 10a (e.g., processing core 102 and / or debug interface 50).

[0059] For example, in various embodiments, protection circuitry 150 can control access to target hardware circuitry 110 by selectively forwarding reads or writes from source resources (e.g., processing core 102 and / or debug interface 50) to target hardware circuitry 110. Generally, these reads or writes can be forwarded via communication system 114 (e.g., in the case of processing core 102) or via a dedicated debug communication system / bus (e.g., in the case of hardware debug interface 50). For example, protection circuitry 150 can be configured to:

[0060] - Selectively forward reads or writes from the source resource to the communication system; and / or

[0061] - Selectively forward reads or writes from the communication system to the target hardware circuit 110.

[0062] However, protection circuitry 150 can also typically be implemented within the target and / or source resources. For example, as previously described, a typical debug interface 50 includes a communication interface 502 that manages data exchange with an external debugger 52, and internal debug circuitry 500 configured to manage debug operations. Therefore, in this case, protection circuitry 150 can be configured to disable debug interface 50 by interrupting the connection between communication interface 502 and internal debug circuitry 500 and / or the connection of pins to which communication interface 502 can be connected to the external debugger 52.

[0063] Typically, while some hardware circuits 110 may not have any access restrictions at all, access to other hardware circuits 110 can be blocked by default or selectively based on configuration data (i.e., protection can be activated). For example, in various embodiments and as described in detail in U.S. Patent Application Publications US2018 / 0357015A1 and US2018 / 0357012A1 (which are incorporated herein by reference for this purpose), protection for a given resource can be selectively activated based on the lifecycle stage of the processing system 10a, as indicated by the lifecycle data LCD and / or configuration data CD. For example, each protection circuit 150 of the processing system 10a can be in one of the following states:

[0064] a) The lifecycle data LCD, independent of the configuration data CD, indicates that the protection is disabled;

[0065] b) The lifecycle data LCD indicates that the protection can be selectively enabled, and the configuration data CD indicates that the protection is disabled;

[0066] c) The lifecycle data LCD indicator can selectively enable protection, and the configuration data indicator can be used to enable protection; or

[0067] d) The lifecycle data LCD indicates that the protection is enabled independently of the configuration data CD.

[0068] For example, in the context of memory 104 and / or 104b, the memory range of the memory can be divided into sectors, and each sector can be associated with one or more bits of the corresponding configuration data CD, thereby indicating whether read and / or write access to the corresponding memory sector is permitted.

[0069] Figure 5 An embodiment of the modified security architecture of the processing system 10a is shown.

[0070] Specifically, in the considered embodiment, to allow access to protected resources, processing system 10a includes circuitry for rewriting one or more protections when a specific password is provided. Typically, some protection circuitry 150, once activated, may not be deactivated again, or a given password may deactivate only a given subset of protections. For example, even when a password is provided, read-protected memory areas containing security-related data such as password keys are never accessed.

[0071] In the considered example, at least one reference key / keyword RK is stored in the processing system 10a in some way. For example, the reference key RK may be hardwired or stored in non-volatile memory 104 of the processing system 10a, such as non-volatile program memory 104a. In the latter case, the processing system 10a is preferably configured to restrict read access to the memory region containing the reference key RK in order to ensure that the reference key RK is kept confidential. For example, a possible solution for storing the reference key in non-volatile memory is described in the patent application cited above.

[0072] In the example under consideration, the processing system 10a also includes a cryptographic verification circuit 152.

[0073] Therefore, in order to deactivate at least one protection, the user should be able to provide the password verification circuit 152 with a password verification command VPW including the password / keyword K. For example, in the considered embodiment, the user can provide the password K to the password verification circuit 152 via software instructions executed by the processing core 102 of the processing system 10a and / or via the communication interface of the processing system 10a, such as via a CAN interface or (e.g., a JTAG) debug interface 50 connected to an external debugger 52.

[0074] For example, in various embodiments, hardware circuit 110, password verification circuit 152, and interface IF and / or processing core 102 can be connected via a suitable communication system such as communication system 114. In this case, command CMD and password verification command VPW can be sent via the same bus, specifying the address of hardware circuit 110 (for command CMD) or the address of password verification circuit 152 (for password verification command VPW) as the target address.

[0075] Therefore, once the password verification circuit 152 has received the password verification command VPW including the password K, the password verification circuit 152 can obtain the reference password RK and compare the password K with the reference password RK. If the two passwords match, the password verification circuit 152 can generate a rewrite signal OW, which is sent to one or more protection circuits 150. Therefore, in response to the rewrite signal OW, the protection circuit 150 can disable at least a portion of the corresponding protection.

[0076] Figure 6 An embodiment of the security architecture of a processing system 10a consistent with U.S. Patent Application Publication US2019 / 026498A1, which is incorporated herein by reference, is shown.

[0077] Specifically, with Figure 5 In contrast, the processing system 10a also includes a cryptographic upload circuit 154 and a temporary cryptographic library 156.

[0078] Therefore, in the considered example, the password verification circuit 152 does not dynamically access one or more original reference passwords RK, which are hardwired or preferably stored in non-volatile memory 104. Instead, the password upload circuit 154 reads one or more reference passwords RK once and stores them in a temporary password library 156, which is implemented, for example, as a register, and can only be read by the password verification circuit 152. Thus, the password verification circuit 152 can compare the received password K with the reference passwords RK stored in the temporary password library 156, wherein the read path between the password verification circuit 152 and the temporary password library 156 is not shared with other resources of the processing system 10a and is therefore not subject to eavesdropping.

[0079] Therefore, as described above, protection can be activated in various embodiments, and similarly, hardware circuitry 110 can also be configured based on lifecycle data LCD and / or configuration data CD.

[0080] For example, Figure 7An example of a processing system 10a is shown, wherein when the processing system 10a is powered on, configuration data CD can be written to a specific area of ​​non-volatile memory and retrieved.

[0081] For example, the configuration data CD can be stored in non-volatile memory 104 and / or additional non-volatile memory, such as one-time programmable (OTP) memory implemented with fuses. For example, memory 104 can be used when the memory is integrated with the processing core 102 in the same integrated circuit 30. Conversely, additional non-volatile memory can be used when memory 104 is external memory. Therefore, in various embodiments, the configuration data CD is stored in the non-volatile memory of integrated circuit 30.

[0082] For example, such a configuration data CD may include calibration data to ensure consistent hardware behavior, thereby compensating for possible manufacturing process tolerances. This is often used, for example, for the calibration of analog components in a processing system, such as temperature sensors, analog-to-digital converters, voltage references, etc. Furthermore, as previously mentioned, the configuration data CD can also be used to customize the behavior of hardware (e.g., hardware circuit 110 and / or protection circuit 150) according to different application needs. For example, as previously mentioned, once the firmware of the processing system 10a is stored in the processing system 10a, some configuration data CD can be written to deactivate the debug interface 50, which, for example, can be used to download the firmware of the processing system 10a. Therefore, typically the first part of the configuration data CD can be written by the manufacturer of the processing system hardware (e.g., the manufacturer of the integrated circuit), and / or the second part of the configuration data CD can be written by the developer of the firmware of the processing system 10a.

[0083] In various embodiments, programmed configuration data CD is read during a configuration phase, which typically begins as soon as the processing system 10a is powered on.

[0084] Specifically, such as Figure 7 As shown, for this purpose, processing system 10a may include configuration circuitry 108 configured to read configuration data CDs from non-volatile memory 104 and distribute these configuration data CDs within processing system 10a. For example, in the considered embodiment, the configuration data CDs are stored, for instance, in a reserved memory region as a plurality of contiguous memory locations. Thus, in the considered embodiment, configuration circuitry 108 accesses the reserved memory region containing the configuration data CDs, reads the configuration data CDs, and sends the configuration data CDs to the corresponding hardware circuitry 110 and / or protection circuitry 150 within processing system 10a. As described above, hardware circuitry 110 may correspond to any block of processing system 10a that requires configuration data, and may correspond to processing core 102, hardware resource 106, or even memory (e.g., memory 104a).

[0085] For example, to distribute configuration data CDs, each hardware circuit 110 and each protection circuit 150 may have an associated corresponding configuration data client 112. For example, in Figure 7 The diagram illustrates two configuration data clients 112a and 112b that provide configuration data to hardware circuit 110 and protection circuit 150, respectively. Typically, each configuration data client 112 may be unilaterally associated with a single hardware circuit 110 or a single protection circuit 150, and will only provide configuration data to the associated hardware circuit 110 or protection circuit 150 (e.g., a specific hardware resource 106). However, configuration data clients 112 may also be associated with multiple hardware circuits 110 and / or protection circuits 150. For example, in various embodiments, the same configuration data client 112 is used to provide configuration data CD to hardware circuit 110 and the protection circuit 150 associated with that hardware circuit 110. Typically, configuration data clients may also be integrated within the respective hardware circuit 110 or protection circuit 150.

[0086] Therefore, in the considered embodiment, configuration circuit 108 can determine corresponding configuration data (selected from configuration data CD) for each target hardware circuit 110 / protection circuit 150 to be configured, and send the configuration data associated with the target hardware circuit 110 / protection circuit 150 to the configuration data client 112 associated with the target hardware circuit 110 / protection circuit 150. Similarly, when reading configuration data CD from memory 104, configuration circuit 108 can determine the target block of the current configuration information and send the current configuration data to the configuration data client associated with the corresponding target block. Typically, any communication can be used to send configuration data CD to configuration data client 112, including serial and parallel communication. For example, configuration circuit 108 and configuration data client 112 can be connected via bus 109, possibly corresponding to communication system 114, and each configuration data client 112 can have an associated corresponding target address.

[0087] Therefore, each configuration data client 112 is configured to receive configuration data from configuration circuitry 108, store it in internal registers, such as in one or more internal flip-flops or latches. The data stored in the registers can then be used to generate one or more signals that affect the behavior of one or more hardware circuits 110 and / or protection circuitry 150.

[0088] In various embodiments, the above mechanism is also used to send the reference password RK to the temporary cryptographic library 156. Specifically, in various embodiments, the reference password RK is stored in memory 104 along with configuration data CD, and one or more configuration data clients 112c are associated with the temporary cryptographic library 156 (preferably unambiguously). Therefore, in various embodiments, the configuration circuit 108 also reads the reference password RK and other configuration data CD from memory 104 and sends the reference password RK to the configuration data client 112c associated with the temporary cryptographic library 156, thereby loading the reference password RK into the temporary cryptographic library 156.

[0089] Figure 8 In this regard, a possible embodiment of communication between configuration circuitry 108 and configuration data client 112 consistent with the disclosure of US2019 / 026498A1 is shown.

[0090] Specifically, in the same scenario, processing system 10a includes configuration circuitry 108 and multiple configuration data clients 112. Configuration circuitry 108 is configured to read configuration data CDs from one or more non-volatile memories 104. Configuration data clients 112 are configured to receive corresponding configuration data CDs from configuration circuitry 108 and distribute them across hardware circuitry 110 / protection circuitry 150 / temporary cryptographic library 156 that requires configuration data. For example, as previously described, each configuration data client 112 may be unilaterally associated with its respective hardware circuitry 110 / protection circuitry 150 / temporary cryptographic library 156. For example, in the considered embodiment, processing system 10a further includes three sets of configuration data clients 112a, 112b, and 112c.

[0091] In the considered embodiment, the configuration circuit 108 includes a data reading module 1080 configured to read configuration data CD from memory 104 and a scheduling module 1082 configured to send configuration data to configuration data client 112.

[0092] As described above, any communication can be used for communication between the scheduling module 1082 and the configuration data client 112. For example, in various embodiments, communication between the scheduling module 1082 and the configuration data client 112 is based on data frames according to a given format, referred to in the following Device Configuration Format (DCF). For example, in various embodiments, each data frame includes two fields: a payload (i.e., the actual data) referred to as the DCF format payload and possible additional data attributes referred to as DCF format attributes for identifying the recipient of the data, wherein the recipient is one of the configuration data clients 112 representing a DCF client. For example, the data attributes may include 16 or 32 bits, wherein a given number of bits specifies the address of one of the configuration data clients 112, and the payload may include 16 or 32 bits. For example, in various embodiments, the data reading module 1080 is configured to read a 64-bit block from the memory 104, wherein the first 32 bits contain data attributes (including the address of the configuration data client) and the second 32 bits contain configuration data to be transmitted to the address specified in the data attributes.

[0093] As described above, each configuration data client / DCF client 112 may be hardware circuitry, typically including combinational circuitry configured to store received data in internal registers, for example, implemented using flip-flops / latches, thereby allowing the received configuration data to be distributed to various portions of the associated hardware circuitry 110 / protection circuitry 150 / temporary cryptographic library 156 via one or more internal signals generated as a function of the data stored in the internal registers. For example, as previously stated, each configuration data client 112 may have an associated, meaningful address (i.e., meaningful within each processing system 10a), and the data sent by the scheduling module 1082 is analyzed to determine whether additional data attributes (DCF format attributes) include the address associated with the configuration data client 112.

[0094] In various embodiments, configuration circuitry 108 may further include a state control module 1084 configured to manage various configuration phases of processing system 10a. For example, in various embodiments, once processing system 10a is powered on, reset circuitry 116 of processing system 10a may generate a reset signal RESET, which is used to perform a reset of various components of processing system 10a. For example, the reset signal RESET may correspond to a reset pulse of a given number of clock cycles provided to hardware circuitry 110 of processing system 10a. For example, in the considered embodiment, configuration data client 112 may use the reset signal RESET to set an internal register to a given reset value.

[0095] Similarly, in response to a reset, the status control module 1084 can activate the configuration phase. Specifically, during the configuration phase, the data reading module 1080 can read the configuration data CD from the memory 104, and the scheduling module 1082 can send the configuration data CD to various configuration data clients 112, thereby rewriting the reset value.

[0096] For example, in various embodiments, the scheduling module 1082 may generate a data signal DATA having a given number of bits (corresponding to payload bits), which includes configuration data to be sent to a given configuration data client 112 and other control signals for selecting a target configuration data client 112. For example, in the considered embodiment, the scheduling module 1082 may also generate an address signal ADR including the address of the target configuration data client 112, and optionally generate a chip select signal CS for signaling that the address signal ADR and the data signal DATA are valid.

[0097] For example, in various embodiments, an address signal ADR (and a chip select signal CS) may be provided to a decoder 124 configured to activate one of the configuration data clients 112 based on the address signal ADR. For example, in the considered embodiment, when the address signal ADR corresponds to an address assigned to configuration data client 112a (and the chip select signal CS is set), the decoder 124 may set the chip select signal CSa to indicate that configuration data client 112a should read the data signal DATA. Similarly, when the address signal ADR corresponds to an address assigned to configuration data client 112b (and the chip select signal CS is set), the decoder 124 may set the chip select signal CSb to indicate that configuration data client 112b should read the data signal DATA.

[0098] Therefore, as previously stated, the configuration data CD may also include security configuration data for configuring the protection circuit 150, such as external access to the debug interface or (read and / or write) access to a given memory location, and a reference password RK to be stored in the temporary password library 156.

[0099] Specifically, in various embodiments, each segment of configuration data is inserted into a frame along with an identifier / address of the configuration data client 112. The hardware configuration circuitry 108 reads all these DCF data frames programmed in the non-volatile memory 104 and sends them to the corresponding configuration data client 112.

[0100] Therefore, by including the reference cipher RK in the DCF data frame having the address of the configuration data client 112c associated with the temporary cipher library 156, the reference cipher RK can be stored in the temporary cipher library 156.

[0101] For example, such as Figure 8 As shown, the temporary cryptographic library 156 may include one or more slots PW0, PW1, ..., each slot adapted to store a corresponding reference cipher RK. Furthermore, in the considered embodiment, a single configuration data client 112c is associated with the temporary cryptographic library 156. In this case, multiple DCF frames (each DCF frame including a corresponding reference cipher RK) can be sequentially sent to the address of the configured data client 112c, and once a reference cipher RK is received, the temporary cryptographic library 156 can store the reference cipher into the corresponding slot PW0, PW1, ... in the internal memory. Typically, the DCF frame may also include a field indicating a timeslot number, where the corresponding reference cipher RK should be stored.

[0102] Typically, since the configuration data client 112 also includes internal registers, these registers can also be directly used as memory for the temporary cryptographic library 156. For example, in this case, multiple configuration data clients 112c can be associated with the temporary cryptographic library 156, with each configuration data client 112c having its own (unambiguous) address. In this case, multiple DCF frames (each DCF frame including a corresponding reference cipher RK) can be sequentially sent to the addresses of the configured data clients 112c.

[0103] Once the password loading phase is complete, the reference password RK is stored in the memory of the temporary password library 156. Therefore, there is no need to further access the reference password RK stored in the non-volatile memory 104 during a password challenge request. Thus, in the considered embodiment, other blocks of the processing system 10a may not snoop on the communication because they are inoperable during the configuration phase of the processing system 10a.

[0104] Typically, due to the organization of configuration data CDs within data groups, configuration data CDs can include at least two subsets of configuration data, for example:

[0105] - The first set of configuration data (e.g., calibration data) written by the manufacturer of the processing system 10a (e.g., chip manufacturing); and

[0106] - A second set of configuration data written at a later stage, such as configuration data written by firmware developers and / or system integrators (e.g., manufacturers of engine control units (ECUs)).

[0107] For example, in this case, the security configuration data included in the first set of configuration data can also allow setting access permissions to the memory location where the first set of configuration data is stored. For instance, in this way, the first set of configuration data may not be overwritten, and / or the memory interface may suppress read access to the first set of configuration data (e.g., by processing core 102). Conversely, the security configuration data included in the second set of configuration data can be used to configure the behavior of hardware circuitry 110 from a functional point of view, for example, to enable or disable a debug interface, etc. Therefore, also in this case, once the debug interface is disabled, the second set of configuration data may not be overwritten or read. Similarly, a reference password for deprotection can be configured together with the first and / or second set of configuration data. For example, the first set may include a reference password for performing access operations to read and / or write to the protected memory location, while the second set may include a reference password for re-enabling the debug interface.

[0108] Conversely, the lifecycle data LCD indicates the product's lifecycle. The lifecycle is a permanent signature written to non-volatile memory that identifies the stage of the processing system 10a within its lifecycle. For example, the lifecycle can be encoded using a bit sequence. For instance, in various embodiments, the bit sequence LCD may indicate one of the following stages:

[0109] - "Production" (LC1), when the processing system 10a (e.g., a microcontroller) is in the chip factory;

[0110] - "Customer Delivery" (LC2) occurs when processing system 10a has been delivered to the first-tier customer (e.g., the manufacturer of the engine control unit);

[0111] - "OEM product" (LC3), when the equipment has already been shipped to the next level of customer (e.g., an automobile manufacturer);

[0112] - "Field" (LC4), when the device is installed in the final product (e.g., in a car sold on the market).

[0113] - "Fault Analysis" (LC5) is performed when the device is sent back to the producer or software developer of processing system 10a for diagnostic purposes.

[0114] In various embodiments, the bit sequence is stored at a reserved memory location in non-volatile memory 104, or in a separate non-volatile memory 126 such as one-time programmable memory. In various embodiments, lifecycle data LCD is written such that once a stage is reached, it is impossible to revert to the previous stage; that is, the lifecycle can only advance. This can be achieved, for example, using one-hot coding, in which a fuse is burned each time a given stage is reached. For example, advancing the lifecycle to the next stage can be accomplished by the entity that owns the device in the current lifecycle stage (e.g., a chip manufacturer advances the lifecycle when shipping it to a customer delivery stage; a first-tier customer advances the lifecycle when shipping to an OEM production stage, etc.).

[0115] like Figure 8 As shown, in various embodiments, the hardware configuration circuit 108 can also be configured to read lifetime data / bit sequences from memory 126 (or 104), store the lifetime data in register 128, and the signal LCD can correspond to the lifetime data stored in that register. For example, the configuration circuit 108 (e.g., the hardware configuration circuit) can store lifetime data in the register in the following manner:

[0116] - Store lifecycle data in a register of configuration circuit 108, i.e., register 128 can be integrated into configuration circuit 108; and / or

[0117] - Transfer lifecycle data to one or more dedicated configuration data clients 112, i.e., register 128 can be integrated into one or more configuration data clients 112.

[0118] This solution can be used, for example, when lifecycle data is stored in non-volatile memory 104 and / or when lifecycle data can be rewritten for testing / debugging purposes.

[0119] Typically, configuration circuitry 108 can also be configured to decode a lifetime bit sequence read from memory 126 (or 104). For example, the lifetime bit sequence read from memory may correspond to (e.g., a hot) encoded bit sequence, and the signal LCD may correspond to a binary encoded sequence indicating a value associated with a corresponding lifetime stage. Typically, in this case, the encoded bit order or the decoded bit order can be stored in register 128; that is, decoding can be performed before or after the data is stored in register 128.

[0120] Therefore, in various embodiments, the processing system 10a includes registers for storing security-related information, particularly one or more of the following:

[0121] - Registers configured to store configuration data for enabling or disabling protection circuitry 150, such as registers of configuration data client 112b; and / or

[0122] - Registers configured to store reference passwords for rewriting protection implemented by one or more protection circuits 150, such as registers of configuration data client 112c; and / or

[0123] - Register 128 is configured to store lifecycle data for the LCD.

[0124] The inventors have observed that such registers should therefore be protected to prevent them from being intentionally or unintentionally overwritten. For example, for this purpose, U.S. Patent Application Publication US2019 / 0227747A1 discloses an embodiment of a configuration data client 112, wherein the configuration data client can be configured to selectively allow or prohibit the overwriting of already stored configuration data based on at least one type identification signal. Therefore, this document is incorporated herein by reference for possible embodiments of the configuration data client 112.

[0125] Therefore, the mechanism described above allows determining whether a given configuration data packet can overwrite previously stored configuration data on the same client 112, for example, to prevent already activated protection from being deactivated via subsequent DCF packet addresses to the same configuration data client 112. However, this protection does not cover possible tampering attacks. Specifically, such tampering attacks refer to techniques aimed at changing the bit states of triggers / latches (e.g., using electromagnetic attacks), typically designed to remove programmed protection or simply restore the default bit-protected state, which usually corresponds to an unprotected state.

[0126] Figure 9 An embodiment of the improved processing system 10a is shown in this regard.

[0127] Specifically, in the same case, the processing system 10a includes:

[0128] - Protection circuit 150 is configured to control access to the corresponding hardware circuit 110 according to configuration data, which is referred to below as configuration data CDb;

[0129] - Multiple configuration data clients 112, wherein at least one configuration data client 112b is configured to store configuration data CDb for protecting circuit 150;

[0130] - Non-volatile memory 104, configured to store configuration data CDs of one or more of a plurality of configuration data clients 112, for example, in the form of data packets, wherein each data packet also includes the address of the corresponding configuration data client 112; and configuration circuitry 108 (e.g., hardware configuration circuitry), configured to read configuration data CDs from non-volatile memory 104 and store configuration data to configuration data clients 112.

[0131] For example, in the considered embodiment, each configuration data client 112 includes a register configured to store a given number of N bits, such as 32 or 64 bits. Specifically, Figure 9 In this respect, a single storage element 113 of the configuration data client 112 is shown, wherein the storage element 113 includes a latch or trigger 1122 configured to store a single bit. Therefore, in various embodiments, each configuration data client 112 includes N storage elements 113.

[0132] As described above, in various embodiments, a given configuration data client 112 may provide configuration data to a plurality of hardware circuits 110 and / or protection circuits 150, i.e., the configuration data CDb may correspond to data provided by a subset of the storage elements 113 of the given configuration data client 112. Additionally or alternatively, in various embodiments, the hardware circuits 110 and / or protection circuits 150 may receive configuration data from a plurality of configuration data clients 112, i.e., a given protection circuit 150 may receive configuration data CDb from the storage elements 113 of at least two configuration data clients 112. Typically, the configuration data CDb may therefore correspond to one or more bits indicating whether the protection circuit 150 should implement one or more security rules.

[0133] Therefore, in various embodiments, each configuration data client 112 is configured to receive a write request including data to be written to the storage element 113 of the configuration data client 112, and to store the received data to a latch or trigger 1122 in response to the write request. For example, the write request may correspond to the previously described data signal DATA and chip select signal CS, or similar write enable signals. In this respect, although not explicitly stated... Figure 9 As shown, however, storage element 113 can also be configured to selectively execute write requests based on the previously mentioned type identification information, for example, to execute only the first write request and then prohibit further write operations to latch or trigger 1122, thereby ensuring that the stored configuration data is not overwritten by further write requests.

[0134] In this regard, in various embodiments, each configuration data client 112 is configured to reset the contents of storage element 113 (specifically, latch or trigger 1122) to a default / reset value RV in response to a reset signal RESET. For example, as mentioned, this reset signal RESET may be generated by a reset circuit 116, which is configured, for example, to generate a pulse / trigger in the reset signal RESET when processing system 10a is turned on and / or in response to other events. Alternatively, the reset signal RESET may also be provided by configuration circuit 108 (e.g., status control module 1084).

[0135] For example, in the considered embodiment, a reset signal RESET is provided to multiplexer 1120, which is configured to store data provided by configuration circuitry 108 (e.g., the assignment of the previously mentioned signal DATA) or a reset value RV to latch or flip-flop 1122. Therefore, in order to store data to latch or flip-flop 1122, the storage element may be configured to store a signal provided by multiplexer 1120 in response to a write request (such as indicated by chip select signal CS) or in response to a reset signal.

[0136] Generally, the corresponding bit of the configuration data CDb should be set to high or low by default, and the reset value RV can correspond to logic level 1 or logic level 0.

[0137] In various embodiments, storage element 113, particularly storage element 113 arranged at least to store security-related information, is thus protected from possible tampering attacks.

[0138] Specifically, in various embodiments, in addition to latches or flip-flops 1122, one or more storage elements 113 of a given configuration data client 112 (e.g., configuration data client 112b) that provides configuration data CDb to the protection circuit 150 with one or more bits of configuration data CDb also include another latch or flip-flop 1124.

[0139] Specifically, in various embodiments, latches or flip-flops 1122 and 1124 are arranged close together within the integrated circuit 30 of the processing system 10a. In fact, the inventors have observed that, in this configuration, a tampering attack would likely set the physical latches or flip-flops 1122 and 1124 to 0 or 1, but it would be virtually impossible to apply different logic levels.

[0140] Therefore, to detect potential tampering attacks, storage element 113 also includes a NOT gate / inverter 1126, configured to, for example, store an inverted version of the logic value stored in latch or flip-flop 1124 by storing an inverted version of the bit provided by multiplexer 1120 into latch or flip-flop 1124. Furthermore, the storage element includes an XOR gate 1128, which receives the bit values ​​stored in latches or flip-flops 1122 and 1124 at its inputs and provides a tamper signal TAMP at its output.

[0141] Therefore, in various embodiments, the storage element is configured to store a given bit value (DATA or RV) into latch or flip-flop 1122 and a corresponding inverted bit value (DATA or RV) into latch or flip-flop 1124. Furthermore, the storage element 113 is configured to assert a tamper signal TAMP when latches or flip-flops 1122 and 1124 are set to the same value.

[0142] Therefore, in various embodiments, one or more storage elements 113 of a given configuration data client 112 that provides configuration data CDb with one or more corresponding bits to protection circuit 150 also provide a corresponding tamper signal TAMP to protection circuit 150. Thus, in this case, protection circuit 150 can be configured to control access to the corresponding hardware circuit 110 not only based on the bits of configuration data CDb, but also based on the corresponding tamper signal TAMP.

[0143] For example, when the protection circuit 150 is configured to enable or disable access to the associated hardware circuit 110 based on the configuration data CDb, for example, when the setting of the configuration data CDb is set to the corresponding reset value RV (e.g., low), access is enabled, and when the setting of the configuration data CDb is set to the inverted value of the reset value RV (e.g., high), access can be disabled in any case when the corresponding tamper signal TAMP is asserted.

[0144] However, generally, the protection circuit 150 can also manage access to multiple hardware circuits 110 or memory regions, such as the debug interface 50's access to multiple hardware circuits 110 and / or memory regions. For example, in this case, the configuration data CDb may include one or more bits for enabling / disabling access to each sub-circuit or memory region. Thus, in various embodiments, when a given tamper signal TAMP is asserted, the protection circuit 150 may activate a given configuration (e.g., indicating that access should be disabled) only for the corresponding hardware circuit 110 or memory region, a subset of the circuit and / or memory regions, or even all hardware circuits 110 and / or memory regions managed by the protection circuit 150.

[0145] For example, Figure 10 An embodiment is shown in which the processing system 10a is configured to activate a given configuration only for the corresponding bit of the configuration data CBb.

[0146] Specifically, in the considered embodiment, bits of configuration data CDb provided by the corresponding latch or flip-flop 1122 are provided to multiplexer 1130. Multiplexer 1130 also receives a corresponding tamper signal TAMP and a value TV indicating the configuration to be used in the event of a tampering attack. Therefore, in the considered embodiment, multiplexer 1130 is configured to provide bits of configuration data CDb' to protection circuitry 150, wherein bit CDb' corresponds to:

[0147] - When the tamper signal TAMP is de-asserted, the bits of the configuration data CDb provided by the corresponding latch or flip-flop 1122; or

[0148] - When the assertion tampers with the signal TAMP, bit TV is affected.

[0149] Typically, multiplexer 1130 (and similar multiplexer 1120) can be replaced by any other suitable combinational logic circuit. For example, when signal TV is set high, multiplexer 1130 can be replaced by a logic OR gate that receives the bits of configuration data CDb and the tamper signal TAMP at its input.

[0150] For example, combinational logic circuits can be:

[0151] - Integrated into storage element 113, whereby the storage element has managed tamper protection for the corresponding bits and provides a given predetermined configuration TV in the event of a tampering attack;

[0152] - Integrated into the protection circuit 150; - External to the storage element 113 and the protection circuit 150.

[0153] Furthermore, consistent with the preceding description, such combinational logic circuitry can be configured to receive tamper signal TAMP from multiple storage elements 113.

[0154] For example, this is also in Figure 11 shown in . Specifically, Figure 11 An embodiment is shown in which configuration data client 112 provides configuration data of multiple bits to a given associated circuit.

[0155] For example, this applies to a configuration data client 112c that provides one or more reference keys RK to a cryptographic verification circuit 152.

[0156] Therefore, in the same case, the previously described storage element 113 (with an additional latch 1124 and an XOR gate 1128) can be used to provide a corresponding tamper signal TAMP for each bit of the configuration data (as provided by the corresponding latch or flip-flop 1122).

[0157] For example, in this case, the cryptographic verification circuit 152 can receive a given reference key RK and a corresponding tamper signal TAMP from one or more configuration data clients 112c.

[0158] Specifically, in various embodiments, the cryptographic verification circuit 152 is configured to disable the cryptographic verification operation when at least one of the received tamper signals TAMP is asserted. In effect, when one of the tamper signals TAMP is asserted, the corresponding reference key RK is no longer valid.

[0159] Therefore, in various embodiments, even if the password verification command VPW provides a password corresponding to the reference key RK, the password verification circuit 152 is configured to maintain the deassertion of the rewrite signal OW.

[0160] Therefore, in this case, the combinational logic circuit configured to combine multiple tamper signal TAMPs will be implemented within the cryptographic verification circuit 152.

[0161] However, Figure 11 Also schematically shown is a combinational logic circuit 1502 such as an OR gate, which is configured to generate a combined tamper signal TAMP' by combining multiple tamper signals TAMP provided by a given configuration data client 112 and / or by a plurality of configuration data clients 112.

[0162] For example, in this way, protection circuit 150 can receive a combination of tampered signals TAMP', which is asserted when at least one of the associated tampered signals TAMP (as received by the corresponding combinational logic circuit 1502) is asserted.

[0163] For example, in this way, the combined tampered signal TAMP' can be asserted when the following conditions are met:

[0164] -like Figure 9 As shown, when asserting a tamper signal TAMP associated with the location of the configuration data CDb managed by protection circuit 150; and / or as

[0165] - Figure 11 As shown, when asserting the tamper signal TAMP associated with one or more protected reference ciphers RK managed by protection circuit 150.

[0166] As previously described, one or more of the protection circuit 150 and / or password verification circuit 152 can be configured to also function as a function of the lifecycle data LCD.

[0167] Therefore, previous solutions applied to configuration data CDb and / or reference key RK can also be used for lifecycle data.

[0168] For example, this is in Figure 12 The diagram schematically shows that the previously described register 128, configured to store lifecycle data LCD, is replaced by a set of storage elements 113.

[0169] Therefore, in this case, storage element 113 includes a latch or flip-flop 1122 and another latch or flip-flop 1124, wherein the lifetime data LCD corresponds to the bits stored in the latch or flip-flop 1122, and wherein storage element 113 is configured to receive a write request including data bits, and in response to the write request, store the received data bits in the corresponding latch or flip-flop 1122, and store an inverted version of the data bits of the received data in the corresponding latch or flip-flop 1124. Also in this case, storage element 113 can manage a reset signal RESET to reset the contents of the latch or flip-flop 1122.

[0170] Furthermore, storage element 113 is configured to declare a tamper signal TAMP for the corresponding latch or flip-flop 1122 when the corresponding latch or flip-flop 1122 and 1124 store the same logic level.

[0171] For example, in the considered embodiment, the tamper signal TAMP associated with the active cycle data LCD is provided to the protection circuit 150 (also referred to as Figure 9 (as stated above). However, similar to the information about... Figure 10 In the embodiment described in 11, the protection circuit 150 may receive:

[0172] - When at least one of the tampering signals TAMP associated with the lifecycle data LCD is asserted, given predetermined lifecycle data, such as lifecycle data indicating the lifecycle stage in which the highest security level is applied, such as the field stage; and / or

[0173] - A combined tamper signal TAMP' generated by combining tamper signals TAMP associated with bits of the lifecycle data LCD.

[0174] In various embodiments, the tamper signal TAMP and / or the combined tamper signal TAMP' may also be provided to one or more other circuits within the processing system 10a, such as the microprocessor 1020 and / or error management circuitry. For example, in various embodiments, the combined tamper signal TAMP' is provided to the microprocessor 1020 as an interrupt signal and / or a register status bit, and the microprocessor 1020 is also capable of reading the contents of the associated tamper signal.

[0175] Therefore, in the previously described embodiments, the processing system 10a includes hardware circuitry 110 (e.g., memory controller 100 or resource / peripheral device 106) and a processing core 102 (digital processing circuitry) and / or a debug interface 50, the processing core 102 and / or debug interface 50 being configured to provide control commands (CMD) to control the operation of the hardware circuitry 110.

[0176] In various embodiments, the processing system also includes protection circuitry 150, configured to receive control commands CMD and selectively forward the control commands CMD to hardware circuitry 110 based on one or more control signals. For example, one or more control signals may correspond to configuration data CDb, lifetime data LCD, and / or rewrite signal OW.

[0177] Specifically, in various embodiments, the processing system 10a further includes one or more storage elements 113, each storage element 113 including a corresponding latch or trigger 1122, and wherein the one or more control signals are generated based on the contents of the one or more latches or triggers 1122. Thus, for example, in the case of configuration data CDb and / or lifecycle data LCD, each control signal may correspond to a signal provided by the corresponding latch or trigger 1122, or, for example, in the case of the password verification circuit 152 generating a rewrite signal OW, each control signal may be generated via more complex logic operations.

[0178] Specifically, in various embodiments, each storage element 113 includes another latch or flip-flop 1124 and is configured to receive a write request including data bits, and in response to the write request, store the received data bits into a corresponding latch or flip-flop 1122, and store an inverted version of the data bits of the received data into the corresponding latch or flip-flop 1124. In various embodiments, the storage element 113 may also receive a reset signal RESET, and in response to the reset signal RESET, reset the contents of the latch or flip-flop 1122 to a given reset value RV and reset the contents of the latch or flip-flop 1124 to an inverted version of the reset value RV.

[0179] Therefore, in various embodiments, the processing system includes a non-volatile memory configured to store data bits (i.e., configuration data and / or a sequence of lifetime data bits) and a hardware configuration circuit 108 configured to read data bits from the non-volatile memory and generate write requests to store the data bits into the storage element 113.

[0180] Specifically, in various embodiments, storage element 113 is configured to assert a tamper signal TAMP for the respective latch or flip-flop 1122 when the respective latches or flip-flops 1122 and 1124 store the same logic level, and to deassert the tamper signal TAMP for the respective latches or flip-flops 1122 when the respective latches or flip-flops 1122 and 1124 store different logic levels.

[0181] Therefore, in various embodiments, the processing system 10a is configured such that the protection circuit 150 also forwards the control command CMD to the hardware circuit 110 based on the tamper signal TAMP. For example, for this purpose, the protection circuit 150 may:

[0182] - Directly receive the tampered signal TAMP; and / or

[0183] One or more control signals can be generated not only based on the contents of one or more latches or flip-flops 1122, but also as a function of the tamper signal TAMP.

[0184] Typically, while previous embodiments primarily concern security-related configuration data, storage element 113 can also be used to protect other data, such as to enforce default configuration data (e.g., in the event of a tampering attack). Figure 10 (As shown).

[0185] Of course, without departing from the principles of the invention, the details of the construction and embodiments may vary extensively with respect to what is described and shown herein by way of example only, without departing from the scope of the invention as defined by the appended claims.

[0186] Although the invention has been described with reference to illustrative embodiments, this description is not intended to be limiting. Various modifications and combinations of the illustrative embodiments, as well as other embodiments of the invention, will be apparent to those skilled in the art based on the description. Therefore, the appended claims are intended to cover any such modifications or embodiments.

Claims

1. A processing system, comprising: Multiple storage elements, each storage element including a latch or a trigger, and each storage element is configured to receive a write request including data bits and store the received data bits into the latch or the trigger; A non-volatile memory configured to store data bits for the plurality of storage elements; Hardware configuration circuitry is configured to read data bits from the non-volatile memory and generate a write request to store the data bits into the memory element. as well as Hardware circuitry configured to change its operation based on the logic level of a latch or flip-flop in a first storage element stored among the plurality of storage elements. The first storage element includes another latch or another trigger, and the other latch or the other trigger is configured to store an inverted version of the received data bits in response to the write request. The first storage element includes combinational logic circuitry configured as follows: The logic level of the latch or flip-flop stored in the first storage element is compared with the logic level of the other latch or flip-flop stored in the first storage element. When the logic levels are different, the assertion of the first tampering signal associated with the first storage element is released, and Assert the first tampered signal when the logic levels are the same, and The hardware circuitry is further configured to change its operation in response to the first tampering signal.

2. The processing system according to claim 1, further comprising: The microprocessor is configured to provide control commands to control the operation of the hardware circuitry. The hardware circuit includes a protection circuit, which is configured to: Receive the control command, and The control command is selectively executed based on the logic level stored in the latch or flip-flop in the first storage element and the first tamper signal.

3. The processing system according to claim 2, wherein the protection circuit is configured as follows: The control command is executed when the latch or flip-flop of the first storage element stores the first logic level and the first tamper signal is de-asserted, and The execution of the control command is suppressed when the latch or the trigger of the first storage element stores the second logic level, or when the first tamper signal is asserted.

4. The processing system according to claim 2, The protection circuit is configured to selectively execute the control command based on the control signal, and The hardware circuitry includes combinational logic circuitry, which is configured as follows: Determine whether the first tampered signal has been asserted. In response to the assertion that the first tamper signal has been deactivated, the first control signal is set to the logic value stored in the latch or flip-flop of the first storage element, and In response to determining that the first tampering signal has been asserted, the first control signal is set to a predetermined tampering value.

5. The processing system according to claim 2, The protection circuit is configured to selectively execute the control command based on the control signal, and The first storage element includes combinational logic circuitry, which is configured to: Determine whether the first tampered signal has been asserted. In response to the assertion that the first tamper signal has been deactivated, the first control signal is set to the logic value stored in the latch or flip-flop of the first storage element, and In response to determining that the first tampering signal has been asserted, the first control signal is set to a predetermined tampering value.

6. The processing system according to claim 2, The protection circuitry is configured to manage access to multiple sub-circuits and / or memory regions. At least one corresponding first storage element is associated with each sub-circuit and / or memory region, and The protection circuit is configured to suppress the execution of the control command when at least one of the first tampering signals provided by a plurality of first storage elements is asserted.

7. The processing system according to claim 2, The protection circuit is configured to execute the control command when the rewrite signal is asserted, and The hardware circuit includes a password verification circuit, which is configured to: The microprocessor receives a password verification command, the password verification command including a password. The password is compared with a reference key, which is determined based on the logic levels of latches or flip-flops stored in a plurality of second storage elements of the plurality of storage elements. The rewrite signal is asserted when the cipher corresponds to the reference key.

8. The processing system of claim 7, wherein each of the second storage elements comprises another latch or another flip-flop and combinational logic circuitry configured to selectively assert a second tamper signal by comparing a logic level of the latch or flip-flop stored in the respective second storage element with a logic level of the other latch or flip-flop stored in the respective second storage element.

9. The processing system according to claim 8, wherein the cryptographic verification circuit is configured as follows: When the password corresponds to the reference key and the second tampering signal provided by the second storage element is de-asserted, the rewrite signal is asserted, and When the password does not correspond to the reference key or at least one of the second tampering signals provided by the second storage element is asserted, the assertion of the rewrite signal is de-asserted.

10. The processing system of claim 8, wherein the protection circuit is configured to suppress the execution of the control command when at least one of the second tampering signals provided by the second storage element is asserted.

11. The processing system according to claim 1, further comprising: A debug interface, configured to provide control commands to control the operation of the hardware circuitry. The hardware circuit includes a protection circuit, which is configured to: Receive the control command, and The control command is selectively executed based on the logic level stored in the latch or flip-flop of the first storage element and the first tamper signal.

12. The processing system of claim 11, wherein the protection circuit is configured to: The control command is executed when the latch or flip-flop of the first storage element stores the first logic level and the first tamper signal is de-asserted, and The execution of the control command is suppressed when the latch or the trigger of the first storage element stores the second logic level or the first tamper signal is asserted.

13. The processing system according to claim 11, The protection circuit is configured to selectively execute the control command based on the control signal, and The hardware circuitry includes combinational logic circuitry, which is configured as follows: Determine whether the first tampered signal has been asserted. In response to the assertion that the first tamper signal has been deactivated, the first control signal is set to the logic value stored in the latch or flip-flop of the first storage element, and In response to determining that the first tampering signal has been asserted, the first control signal is set to a predetermined tampering value.

14. The processing system according to claim 11, The protection circuit is configured to selectively execute the control command based on the control signal, and The first storage element includes combinational logic circuitry, which is configured to: Determine whether the first tampered signal has been asserted. In response to the assertion that the first tamper signal has been deactivated, the first control signal is set to the logic value stored in the latch or flip-flop of the first storage element, and In response to determining that the first tampering signal has been asserted, the first control signal is set to a predetermined tampering value.

15. The processing system according to claim 11, The protection circuit is configured to execute the control command when the rewrite signal is asserted, and The hardware circuit includes a password verification circuit, which is configured to: Receive a password verification command from the debug interface, the password verification command including a password. The password is compared with a reference key, which is determined based on the logic levels of latches or flip-flops stored in a plurality of second storage elements of the plurality of storage elements. The rewrite signal is asserted when the cipher corresponds to the reference key.

16. An integrated circuit, comprising: The processing system according to claim 1.

17. A vehicle comprising: Multiple processing systems, each of which is the processing system according to claim 1. The processing system is connected via a communication system.

18. A method for operating a processing system, the method comprising: Data bits for multiple storage elements of the processing system are stored in the non-volatile memory of the processing system; as well as Connect the processing system, wherein The hardware configuration circuitry of the processing system reads data bits from the non-volatile memory and generates a write request to store the data bits into the storage element of the processing system. The first storage element of the plurality of storage elements of the processing system: The data bits are stored in a latch or trigger of the first storage element; Store the inverted version of the data bits into another latch or another trigger; The logic level of the latch or flip-flop stored in the first storage element is compared with the logic level of the other latch or flip-flop stored in the first storage element. When the logic levels are different, the assertion of the first tampering signal associated with the first storage element is released, and Assert the first tampered signal when the logic levels are the same.

Images