Method for starting a computing unit

Abstract

The invention relates to a method for starting a computing unit comprising a microcontroller and a trusted component, wherein, during the startup of the computing unit, the trusted component verifies the hardware configuration of the microcontroller. The invention further relates to a device and a computer program.

Description

State of the art

[0001] During hardware startup, i.e., the boot process after a microcontroller reset, hardware configurations are transferred to the respective hardware registers of the microcontroller. The specific mechanism or origin (e.g., non-volatile memory) of the configuration varies depending on the hardware architecture. Regardless of the mechanism and origin, however, during microcontroller startup, the user-defined configuration is translated into an actual configuration stored in the hardware registers. This actual configuration is crucial for determining the microcontroller's security behavior (e.g., whether the debug interfaces are open). Attacks (e.g., fault attacks) during startup could disrupt this mechanism and, in particular, lead to a missing or incomplete hardware configuration with regard to security features.

[0002] In the current state of the art, only an integrity check of the memory area is performed using the application software; an integrity check of the hardware configuration described above does not take place. Disclosure of the invention

[0003] The inventive method for starting a computing unit comprising a microcontroller and a trusted component has the advantage that the trusted component verifies the microcontroller's hardware configuration during the startup process. In particular, the hardware configuration can be compared with a target configuration known only to the trusted component. The hardware configuration can be, in particular, a partial configuration encompassing all security-relevant parts of the hardware configuration. It is especially advantageous to omit the verification of non-security-relevant parts of the hardware configuration. The hardware configuration can, for example, include a configuration of a debug interface of the microcontroller.

[0004] The advantage is that the hardware configuration check takes place during the microcontroller's startup process.

[0005] It is advantageous if, after a reset of the processing unit, the hardware configuration check is performed after a hardware startup and before the application software is started. In other words, under this advantageous configuration, the check is performed only after a reset of the processing unit. First, the hardware startup takes place, then the hardware configuration check, and finally the application software is started. The application software is advantageously executed by the microcontroller.

[0006] It is particularly advantageous if the hardware configuration check includes the following steps: - Reading the hardware configuration from non-volatile memory by the microcontroller, - Writing the hardware configuration to a hardware register of the microcontroller, - Validation of the hardware register by the trusted component.

[0007] Particularly advantageous is the process of first reading the hardware configuration, then writing the hardware configuration, and finally validating the hardware register. Validating the hardware register advantageously completes the hardware configuration check. Hardware register validation can include a comparison of the hardware register with an expected state by the trusted component.

[0008] A key advantage is that an error response is initiated if the hardware configuration check detects a deviation from the target configuration. This error response could, for example, involve aborting the startup process of the processing unit. Alternatively, it could involve continuing the startup process in a safe mode, a mode that, for safety reasons, prevents certain critical functionalities of the processing unit from starting. Alternatively or additionally, the response could involve sending an error message, for example, to another control unit that is connected to the processing unit and is intended to take over its function.

[0009] Advantageously, the trusted component is a Hardware Security Module (HSM). Hardware Security Modules are installed in many safety-critical computing units, such as vehicle control units, and can be used to verify the hardware configuration.

[0010] Advantageously, the method according to the invention is used to start a vehicle control unit. It is therefore advantageous if the processing unit is a control unit, particularly of a vehicle. Vehicles are safety-critical systems, so the use of the method according to the invention is particularly worthwhile in this context.

[0011] Advantageous are also a device that is set up to carry out the method according to the invention and a computer program that causes a computing unit to execute the method according to the invention when the computer program runs on the computing unit.

[0012] An embodiment of the present invention will now be explained in more detail with reference to the accompanying drawings. The drawings show: Brief description of the drawings Fig. 1 a schematic representation of a first aspect of an embodiment of the method according to the invention; Fig. 2 a schematic representation of a second aspect of an embodiment of the method according to the invention. embodiment of the invention

[0013] Fig. Figure 1 shows a schematic representation of a first aspect of an embodiment of the method according to the invention. Fig. Figure 1 shows in particular a processing unit (30), which could, for example, be a vehicle control unit. The processing unit (30) comprises a non-volatile memory (12), a microcontroller (10), a hardware register (14), and a hardware security module (20).

[0014] In a first step, the microcontroller (10) or the firmware of the microcontroller reads a desired hardware configuration for the hardware register (14) from the non-volatile memory (12).

[0015] In a second step, the microcontroller (10) or the firmware of the microcontroller (10) writes the hardware configuration to the hardware register (14).

[0016] In a third step, the hardware security module (20) checks the hardware configuration in the hardware register (14). If the hardware configuration does not correspond to a target configuration or an expected configuration, the hardware security module (20) sends a message to initiate an error response.

[0017] Fig.Figure 2 shows a schematic representation of a second aspect of an embodiment of the method according to the invention, in particular a sequence of an exemplary startup process of a computing unit. Such a startup process is also referred to as Secure Boot.

[0018] First, in step 110, a self-test of the microcontroller's firmware (10) is performed. This is followed by step 111.

[0019] In step 111, the microcontroller's firmware (10) reads a hardware configuration from the non-volatile memory (12). Optionally, the microcontroller's firmware (10) writes the hardware configuration to the hardware register (14). Steps 120 and 130 then follow.

[0020] Step 130 initiates a startup process for a host computer, which may be the microcontroller (10) in normal operation. Prior to this, the host computer is in a reset state. Step 131 then follows.

[0021] In step 131, the host computer waits for a release signal to end its reset state. Upon receiving the release signal, the host computer exits its reset state and starts application software, which may be software for controlling a vehicle function.

[0022] In step 120, the Hardware Security Module (20) starts. Prior to this, the Hardware Security Module (20) is also in a reset state. Step 121 then follows.

[0023] In step 121, the software of the Hardware Security Module (20) is initialized. This is followed by step 122.

[0024] In step 122, the hardware security module (20) reads the hardware configuration, for example, from the hardware register (14), and validates it. Alternatively, the hardware configuration can also be read from the non-volatile memory (12). Hardware configuration validation is preferably performed by comparing the hardware configuration with a target configuration. If the hardware configuration validation is successful, step 123 follows. If the hardware configuration validation is unsuccessful, step 124 follows. Validation is considered successful if no discrepancy is detected between the hardware configuration and the target configuration.

[0025] In step 123, the Hardware Security Module (20) sends the release signal to the host computer, so that the host computer is released from its reset state.

[0026] In step 124, the Hardware Security Module (20) initiates an error response, for example by aborting the start of the computing unit and / or sending an error message.

[0027] Steps 110 and 111 relate to the microcontroller's firmware (10). Together, steps 110 and 111 constitute a hardware startup. Steps 120 to 124 relate to the hardware security module (20). Steps 130, 131, and 132 relate to the host computer.

[0028] Advantageously, the presented embodiment of the method according to the invention is carried out after a reset of the computing unit (10).

[0029] The presented embodiment of the method according to the invention is particularly suitable for starting a control unit of a vehicle.

Claims

[1] Method for starting a computing unit comprising a microcontroller and a trusted component, characterized by , that during the startup of the computing unit, a hardware configuration of the microcontroller is checked by the trusted component. [2] Method according to claim 1, characterized by that the hardware configuration check takes place as part of the microcontroller's startup process. [3] Method according to claim 1 or 2, characterized by , that after a reset of the computing unit, the hardware configuration is checked after a hardware startup and before starting any application software. [4] Method according to any of the preceding claims, characterized by , that the hardware configuration check includes: - Reading the hardware configuration from non-volatile memory by the microcontroller, - Writing the hardware configuration to a hardware register of the microcontroller, - Validation of the hardware register by the trusted component. [5] Method according to any of the preceding claims, characterized by , that an error response is initiated if the hardware configuration check detects a deviation from a target configuration. [6] Method according to any of the preceding claims, characterized by that the trusted component is a hardware security module. [7] Device configured to carry out the method according to any one of claims 1 to 6. [8] Computer program that causes a computing unit to perform the steps of the method according to any one of claims 1 to 6 when the computer program is running on the computing unit.

Images