COMPUTING UNIT AND OPERATING PROCEDURES FOR THIS

Description

State of the art

[0001] The disclosure relates to a computing device with at least one computing core for executing a first computer program, wherein the computing device is configured to access a memory device, in particular to load the first computer program. Such computing devices are used, for example, in control units for motor vehicles, for example in the form of so-called embedded systems.

[0002] The disclosure further relates to a method for operating such a computing device.

[0003] US 2013 / 117578 A1 describes a method for verifying a memory block of a non-volatile memory. US 2018 / 150637 A1 describes a method for securely booting a computer system. US 2009 / 0327678 A1 describes a system and method for performing pre-boot security verification. US 2005 / 193217 A1 describes an autonomous memory checker for ensuring runtime security. US 2006 / 036853 A1 describes systems and methods that support the authentication of storage device contents. Disclosure of the invention

[0004] It is an object of the present invention to provide a computing device with increased security and increased utility.

[0005] This object is achieved in the computing device of the type mentioned at the outset by the combination of features according to patent claim 1. This advantageously makes it possible to initiate a check of the first computer program by the cryptography module. This advantageously provides the option of checking the first computer program or a content of the memory area in which the first computer program is stored, for example for deviations from a predeterminable content. This can advantageously prevent, for example, the execution of insecure computer programs or computer programs compromised by an attacker by the computing device. Further advantageously, the memory area or areas to be checked can be signaled to the cryptography module by means of the first control command (e.g. address information as to which memory blocks are to be checked), so that this information does not have to be preconfigured, for example.Rather, the memory area or memory areas or computer programs to be checked can be signaled dynamically (e.g. during the runtime of the cryptography module or the computing device) by means of the first control command, which further increases flexibility.

[0006] In preferred embodiments, the memory device can be arranged or provided externally to the computing device (and in particular also externally to the cryptography module). In further preferred embodiments, however, the memory device can also be integrated into the computing device. In still further preferred embodiments, a system, in particular a system-on-a-chip (SoC), can also advantageously be provided, which comprises the computing device according to the embodiments, the memory device, and the cryptography module according to the embodiments.

[0007] In further preferred embodiments, the computing device is designed to receive a response from the cryptography module to the first control command or to read it from the cryptography module (e.g. from a memory area of ​​the cryptography module to which the computing device can access for reading (preferably only for reading, not for writing)), wherein in particular the response comprises information about the result of a check of the computer program characterized by the control command or of the memory area of ​​the memory device assigned to the first computer program.

[0008] In further preferred embodiments, the cryptography module is configured to perform the verification of the first computer program or the at least one memory area using a key-based message authentication code, CMAC (Cipher-based Message Authentication Code). This enables particularly efficient verification. An internet publication relating to an exemplary embodiment of the CMAC method can be accessed, for example, at https: / / doi.org / 10.6028%2Fnist.sp.800-38b. A result of the verification can be written to a memory area of ​​the cryptography module, which the computing device can access for reading (preferably only for reading, not for writing). Thus, in further preferred embodiments, the computing device can read the result of the verification from this memory area of ​​the cryptography module.

[0009] In further preferred embodiments, it is provided that the cryptography module has a memory unit, preferably integrated into the cryptography module, for storing at least one reference value and / or a reference layout for the at least one memory area. In further preferred embodiments, the reference value can, for example, represent a CMAC value for a predeterminable memory content, which is, for example, comparable to a CMAC value determined when the cryptography module checked the at least one first computer program or memory area. If the determined CMAC value deviates from the reference value, it can be concluded that an impermissible change to the memory content of the checked memory area and in particular to the computer program stored therein has occurred.

[0010] In further preferred embodiments, it is provided that the cryptography module is designed to carry out the check depending on the reference value. In these embodiments, the check comprises, for example, the formation of a CMAC value depending on the first computer program or the memory content of the at least one memory area and a comparison of the CMAC value thus formed with the reference value, as stored, for example, in the memory unit of the cryptography module. Alternatively or additionally, in further preferred embodiments, the reference value can also be sent by the computing device to the cryptography module using the first control command. Further alternatively or additionally, in further embodiments, multiple reference values ​​for multiple computer programs or memory areas to be checked can also be sent to the cryptography module using the first control command.

[0011] In further preferred embodiments, the reference layout can contain one or more of the following information: a) the number of computer programs or memory areas in the memory device that the computing device can access, b) the address range (start address and / or end address) of the relevant computer programs or memory areas, c) the length of the relevant computer programs or memory areas, d) at least one reference value (for example, a CMAC value) of the relevant computer program or memory area, e) data relating to a cryptographic signature, for example, a signature address and / or a signature type and / or a reference to a higher-level certificate ("root certificate"). The information can preferably be stored in a data structure having a plurality of corresponding data fields.

[0012] In further preferred embodiments, the cryptography module can use the aforementioned reference values ​​or the reference layout to determine the type and scope of a check of at least one computer program or memory area. For example, the amount of input data for the check (e.g., CMAC value generation) can be determined based on a start address and end address.

[0013] Advantageously, the computing device is designed to execute the first computer program directly after the first control command has been sent to the cryptography module, in particular without waiting for a response from the cryptography module to the first control command and / or without reading the response from the cryptography module. Thus, the first computer program is already executed by the computing device before a check of the first computer program by the cryptography module has been completed or the result of the check of the first computer program by the cryptography module has been read out by the computing device (e.g., in the form of the response to the first control command). This ensures particularly fast execution of the first computer program by the computing device, and at the same time, the check of the first computer program by the cryptography module has at least been initiated by means of the first control command.

[0014] In further preferred embodiments, the computing device is configured to wait for a response from the cryptography module to the first control command and / or to read the response from the cryptography module, and to execute the first computer program only after receiving or reading the response. This enables particularly secure execution of the first computer program, which only occurs after verification by the cryptography module.

[0015] In further preferred embodiments, it is provided that the computing device is designed to control operation of the computing device depending on the response. As a result, for example, if the result of the check of the first computer program by the cryptography module is negative (the first computer program has been changed or manipulated, for example, due to an error in the memory device), an error reaction can be initiated by the computing device and / or by the cryptography module. The error reaction can, for example, provide for at least one of the following measures: aborting the execution of the first computer program by the computing device (if possible), preventing repeated orre-execution of the first computer program by the computing device, signaling an error condition to an external unit, resetting the computing device, temporarily or permanently deactivating the computing device, deleting the first computer program from the storage device.

[0016] In further preferred embodiments it is provided that a) the memory device is integrated into the computing device, and / or that b) the memory device is provided externally to the computing device.

[0017] Further preferred embodiments relate to a method for operating a computing device according to claim 6.

[0018] In further preferred embodiments, it is provided that the computing device receives a response from the cryptography module to the first control command or reads it from the cryptography module, wherein in particular the response comprises information about the result of a check of the computer program characterized by the control command or of the memory area of ​​the memory device assigned to the first computer program.

[0019] Advantageously, it is provided that the computing device executes the first computer program directly after sending the first control command to the cryptography module, in particular without waiting for a response from the cryptography module to the first control command and / or without reading the response from the cryptography module (in particular before starting the first computer program).

[0020] Further preferred embodiments relate to a system according to claim 8.

[0021] Further advantageous embodiments are the subject of the subclaims.

[0022] Further features, possible applications, and advantages of the invention will become apparent from the following description of exemplary embodiments of the invention, which are illustrated in the figures of the drawing. All described or illustrated features, individually or in any combination, constitute the subject matter of the invention, regardless of their summary in the claims or their references, as well as regardless of their wording or representation in the description or in the drawing.

[0023] The drawing shows: Figure 1 schematically shows a simplified block diagram of a computing device according to one embodiment, Figure 2 schematically shows a simplified block diagram of a computing device according to a further embodiment, Figure 3 schematically shows a simplified block diagram of a further embodiment, Figure 4 schematically shows a simplified block diagram of a cryptography module according to an embodiment, Figure 5 schematically shows a simplified flow diagram of a method according to an embodiment, Figure 6 schematically shows a simplified flow diagram of a method according to a further embodiment, Figure 7 schematically shows a simplified flow diagram according to a further embodiment, and Figure 8 schematically shows a data structure according to an embodiment.

[0024] Figure 1schematically shows a simplified block diagram of a computing device 100 according to one embodiment. The computing device 100 has at least one computing core 110 for executing a first computer program PRG1, which is stored, for example, at least temporarily in a memory device 200 that can be accessed by the computing device 100. The memory device 200 comprises, for example, a random access memory (RAM) and / or a non-volatile memory (e.g., flash EEPROM).

[0025] In the present case, the computing device 100 accesses the memory device 200 via a first data connection DV1, which may, for example, have at least one address and / or data bus. A bootloader BL for the computing device 100 and, if applicable, other computer programs (not shown) may also be stored in the memory device 200 in further embodiments.

[0026] The computing device 100 is designed to load and execute the first computer program PRG1. The computing device 100 is further designed to send a first control command A1, which characterizes the first computer program PRG1 and / or a memory area assigned to the first computer program PRG1 (e.g. address area in an address space of the memory device 200), to at least one cryptography module 300. The cryptography module 300 is designed to check the computer program PRG1 characterized by the first control command A1 or the memory area of ​​the memory device 200 assigned to the first computer program PRG1. This advantageously makes it possible to initiate and carry out a check of the first computer program PRG1 by the cryptography module 300. This advantageously provides the possibility ofto check the contents of the memory area in which the first computer program PRG1 is stored, for example for deviations from a predeterminable content. This can advantageously prevent, for example, the execution of insecure computer programs PRG1 or computer programs compromised by an attacker by the computing device 100. Further advantageously, the memory area or areas to be checked can be signaled to the cryptography module 300 by means of the first control command A1 (e.g. address information as to which memory blocks are to be checked), so that this information does not have to be preconfigured, for example. Rather, the memory area or areas or computer programs PRG1 to be checked can be dynamically (e.g. during runtime of the cryptography module 300 orthe computing device 100) by means of the first control command A1, thereby further increasing flexibility.

[0027] In further preferred embodiments, the memory device 200 can be arranged or provided externally to the computing device 100 (and in particular also externally to the cryptography module 300). The cryptography module 300 can access the memory device 200, for example, via a second data connection DV2, which in further embodiments can also be identical or similar to the first data connection DV1.

[0028] In further preferred embodiments, see the configuration 100a according to Figure 2However, the memory device 200a can also be integrated into the computing device 100a. The computing core 110 can access the memory device 200a via the data connection DV1`, and the cryptography module 300 can access the memory device 200a via the data connection DV2`. A control command for initiating a check of the first computer program PRG1 is in Fig. 2 designated by the reference symbol A1`.

[0029] In still further preferred embodiments, see Fig. 3 , a system 1000, in particular a single-chip system (SoC) 1000, can advantageously also be provided, which comprises the computing device 100, the memory device 200, and the cryptography module 300. Preferably, all components 100, 200, 300 are arranged on the same semiconductor substrate 1000a.

[0030] Figure 4schematically shows a simplified block diagram of a cryptography module 300 according to an embodiment. The cryptography module 300 has a memory unit 302 for storing at least one reference value R and / or a reference layout for computer programs PRG1 to be checked ( Fig. 1 ), as well as a computing unit 304, which is designed to carry out the aforementioned verification of the computer program PRG1 and is preferably designed entirely as a hardware circuit. Alternatively, the computing unit 304 can also have a computing core 304a and a memory device 304b for operating software that controls the operation of the cryptography module 300. Furthermore, the cryptography module 300 has a result storage unit 306, to which the computing device 100 ( Fig. 1, 3 ), 100a ( Fig. 2 ) can be accessed for reading but not writing.

[0031] Figure 5schematically shows a simplified flowchart of a method according to one embodiment. In step 400, the computing device 100 ( Fig. 1 ) sends the control command A1, which in this case characterizes the first computer program PRG1 or its memory area in the memory device 200, to the cryptography module 300. This informs the cryptography module 300 which computer program or memory area of ​​the memory device 200 it should check. In step 410 ( Fig. 5 ), the computing device 100 executes the first computer program PRG1, in particular without waiting for the aforementioned check. In the optional step 420, the computing device 100 reads a response or a result A2 ( Fig. 3 ), which the cryptography module 300 has formed in dependence on the control command A1, e.g. directly from the result storage unit 306 according to Fig. 4In the optional step 430, the computing device 100 controls its operation depending on the result A2. The response or the result A2 can, for example, contain information about the result of the check of the computer program PRG1 characterized by the control command A1 or the memory area of ​​the memory device 200 assigned to the first computer program PRG1.

[0032] In further preferred embodiments, the cryptography module 300 is configured to perform the verification of the first computer program PRG1 or the at least one memory area using a key-based message authentication code, CMAC (Cipher-based Message Authentication Code). This enables a particularly efficient verification. An internet publication relating to an exemplary embodiment of the CMAC method can be accessed, for example, at https: / / doi.org / 10.6028%2Fnist.sp.800-38b. A result of the verification can be stored, for example, in the result memory area 306 ( Fig. 4) of the cryptography module 300, which the computing device 100, 100a has read access to (preferably only read, not write). Thus, in further preferred embodiments, the computing device 100, 100a can read the result of the check from this memory area 306 of the cryptography module 300. Alternatively or additionally, in further embodiments, the cryptography module 300 can also send the response or result A2 to the computing device 100, 100a.

[0033] Figure 6 shows schematically a simplified flow diagram of a method for operating the cryptography module 300 ( Fig. 4 ) according to one embodiment. In step 500 ( Fig. 6) the cryptography module 300 receives the first control command A1 from the computing device 100, 100a. In step 510, the cryptography module 300 checks the first computer program PRG1 characterized by the first control command A1, for example, using a CMAC calculation. In the optional step 520, the cryptography module 300 determines a response A2 to the first control command A1, wherein in particular the response A2 contains information about the result of the check 510 of the computer program PRG1 characterized by the control command A1 or of the memory area of ​​the memory device 200, 200a assigned to the first computer program PRG1.

[0034] Figure 7shows a schematic, simplified block diagram of another embodiment. Area 100' comprises steps executed essentially on the part of the computing device 100, and area 300` comprises steps executed essentially on the part of the cryptography module 300. In step S1, the cryptography module 100 is activated or initialized. In step S2, the computing device 100 is activated or initialized. In some embodiments, steps S1, S2 can preferably be performed at least essentially simultaneously with one another, or at different times from one another.

[0035] After initialization S2, the computing device 100 executes a start program PRG0 (for example a bootloader BL ( Fig. 1) or a program started by a bootloader BL). In step S3, a first control command A1 is sent to the cryptography module 300, which characterizes a first computer program PRG1 to be checked by the cryptography module 100, e.g., describes the address range assigned to it in the memory device 200, 200a. The computing device 100 then directly executes the first computer program PRG1, cf. step S3a, in particular without waiting for a result of the check of the first computer program PRG1 by the cryptography module 300. As a result, the first computer program PRG1 becomes active in the computing device, cf. block PRG1 from Fig. 7 .

[0036] After the cryptography module 300 has received the first control command A1` (cf. step S4), the cryptography module 300 checks the first computer program PRG1 in step S5. The checking in step S5 comprises, for example, the formation of a CMAC value as a function of the first computer program PRG1 or a corresponding memory content of the memory device 200, 200a storing the first computer program PRG1, and a comparison with a reference CMAC value R. The cryptography module 300 can obtain the information as to which memory area is to be checked and which (e.g. CMAC) reference value R is to be used for this purpose, for example, from the reference data stored in the memory unit 302 (and / or the first control command A1'). In step S6, the cryptography module 300 stores the result of the check from step S5, preferably internally (in particular in a memory 302 orMemory area to which no other unit has read or write access), and in step S7, a corresponding response A2` is sent to the computing device 100. Alternatively, the result of the check from step S5 can also be stored (if necessary additionally) in the result storage unit 306 in step S6, where it can be read by the computing device 100. In further embodiments, it is also conceivable for the cryptography module to send an interrupt request ("interrupt") A2` to the computing device as soon as the check S5 is completed.

[0037] As mentioned above with reference to Fig. 3As already indicated, in further preferred embodiments, the cryptography module 300 has a memory unit 302, preferably integrated into the cryptography module 300, for storing at least one reference value R and / or a reference layout for the at least one memory area or the at least one computer program PRG1 to be checked. In further preferred embodiments, the reference value R can, for example, represent a CMAC value for the computer program PRG1 or a predefinable memory content that is, for example, comparable to a CMAC value that was determined when the cryptography module checked the at least one first computer program or memory area. If the determined CMAC value deviates from the reference value R, it can be concluded that the memory content of the checked memory area has been altered in an inadmissible manner.

[0038] In further preferred embodiments, it is provided that the cryptography module 300 is designed to carry out the check as a function of the reference value R. In these embodiments, the check comprises, for example, the formation of a CMAC value as a function of the first computer program PRG1 or the memory content of the at least one memory area and a comparison of the thus formed CMAC value with the reference value R ( Fig. 4), as stored, for example, in the memory unit 302 of the cryptography module 300. Alternatively or additionally, in further preferred embodiments, the reference value R can also be sent by the computing device 100, 100a to the cryptography module 300 by means of the first control command A1. Further alternatively or additionally, in further embodiments, multiple reference values ​​R for multiple memory areas or computer programs PRG1, BL, .. to be checked can also be sent to the cryptography module 300 by means of the first control command A1.

[0039] In further preferred embodiments, a reference layout can contain one or more of the following information: a) number of computer programs or memory areas in the memory device that the computing device can access, b) address range (start address and / or end address) of the relevant computer programs or memory areas, c) length of the relevant computer programs or memory areas, d) at least one reference value (for example a CMAC value) of the relevant computer program or memory area, e) data relating to a cryptographic signature, for example a signature address and / or a signature type and / or a reference to a higher-level certificate ("root certificate"). The information can preferably be stored in a data structure DS having several corresponding data fields, cf. Figure 8 , e.g., in the storage unit 302 ( Fig. 3 ).

[0040] In further preferred embodiments, the cryptography module 300 can use the aforementioned reference values ​​or the reference layout to determine the type and extent of a check of at least one computer program PRG1 or memory area. For example, the amount of input data for the check (e.g., CMAC value generation) can be determined based on a start address and end address.

[0041] In further particularly preferred embodiments, it is provided that the computing device 100, 100a is designed to execute the first computer program PRG1 directly after the transmission 400 ( Fig. 5) of the first control command A1 to the cryptography module 300, in particular without waiting for a response from the cryptography module 300 to the first control command A1 and / or without reading the response from the cryptography module 300 420. In these embodiments, the first computer program PRG1 is therefore already executed by the computing device 100, 100a (cf. block PRG1 from Figure 7), even before a check of the first computer program PRG1 by the cryptography module 300 is completed or the result of the check of the first computer program PRG1 by the cryptography module 300 is read out by the computing device 100, 100a (e.g., in the form of the response A2, A2` to the first control command). This ensures particularly fast execution of the first computer program PRG1 by the computing device 100, 100a, and at the same time, the check of the first computer program PRG1 by the cryptography module 300 has already been initiated by means of the first control command.

[0042] In further preferred embodiments, the computing device 100, 100a is configured to wait for a response A2 from the cryptography module 300 to the first control command A1 and / or to read the response A2 from the cryptography module 300, and to execute the first computer program PRG1 only after receiving or reading the response. This enables a particularly secure execution of the first computer program PRG1, which only occurs after verification by the cryptography module 300.

[0043] In further preferred embodiments, as already mentioned above, it is provided that the computing device 100, 100a is designed to control an operation of the computing device 100, 100a depending on the response A2. As a result, for example, in the event of a negative result of the check of the first computer program PRG1 by the cryptography module 300 (the first computer program has been changed or manipulated (e.g. by an attacker) due to an error in the memory device 200, 200a, for example), an error reaction can be initiated by the computing device 100, 100a and / or the cryptography module 300. The error reaction can, for example, provide for at least one of the following measures: aborting the execution of the first computer program PRG1 by the computing device 100, 100a (if possible), preventing a repeated orrenewed execution of the first computer program PRG1 by the computing device 100, 100a, signaling of an error condition to an external unit, resetting the computing device 100, 100a (in particular by the cryptography module 300), temporary or permanent deactivation of the computing device 100, 100a, deletion of the first computer program PRG1 from the memory device 200, 200a.

[0044] The principle according to the embodiments has, among other things, the following advantages: a) manipulations (as well as error-related changes) to the content of the memory device 200, 200a, for example manipulations of computer programs PRG1, BL stored therein, can be efficiently detected during the runtime of the computing device 100, 100a and the cryptography module 300 ("runtime manipulation detection", RTMD), b) the secure booting (i.e. starting) of a software PRG1 on the computing device 200, for example an application software, is ensured ("trusted boot"), c) computer programs PRG1 or BL stored subsequently in the memory device 200, 200a can also beother data can advantageously be checked according to the principle according to the embodiments ("secure flashing"), d) access to cryptographic keys and other sensitive information that may be provided by the cryptography module can be controlled depending on the check according to the embodiments ("security access"), e) a boot sequence (sequence of processing computer programs when starting the computing unit 100) can be selected as desired without compromising security, f) by using the cryptography module 300, optionally with a dedicated hardware circuit, powerful and secure cryptographic functions can be provided, for example CMAC formation, e.g. based on 128 bit AES (Advanced Encryption Standard), g) by providing reference layouts, e.g. in the form of the data structure DS according to. Fig. 8the operation of the cryptography module 300 can be flexibly adapted to different memory layouts and other configurations of the computing device 100, 100a, h) by transmitting the first control command A1, the programs PRG1 or memory areas to be checked can be signaled dynamically to the cryptography module 300 (e.g. during the runtime of the cryptography module), i) by the immediate execution 410 ( Fig. 5 ) of the first computer program PRG1 before (complete) execution of the check by the cryptography module 300 results in a particularly short start time for the computer program PRG1.

Claims

1. Computing device (100; 100a) with at least one computing core (110) for carrying out a first computer program (PRG1), wherein the computing device (100; 100a) is designed to access a memory device (200; 200a) to load the first computer program (PRG1), wherein the computing device (100; 100a) is designed to send a first control command (A1; A1'), which characterizes the first computer program (PRG1) and / or a memory area of the memory device (200; 200a) assigned to the first computer program (PRG1), to at least one cryptographic module (300) (400), wherein the cryptographic module (300) is designed to verify the computer program (PRG1) characterized by the first control command (A1) or the memory area of the memory device (200; 200a) assigned to the first computer program (PRG1) (510), wherein the computing device (100; 100a) is designed to execute the first computer program (PRG1) (410), wherein the computing device (100; 100a) is designed to execute the first computer program (PRG1) directly after the sending (400) of the first control command (A1; A1') to the cryptographic module (300) without waiting for a or the response (A2) of the cryptographic module (300) to the first control command (A1; A1') and / or without reading out the response (A2) from the cryptographic module (300) (420), wherein the computing device (100; 100a) is designed to receive a response (A2; A2') of the cryptographic module (300) to the first control command (A1) or to read it out from the cryptographic module (300) (420), wherein the response (A2; A2') has information about the result of a test of the first computer program (PRG1) characterized by the control command (A1; A1') or the memory area of the memory device (200; 200a) assigned to the first computer program (PRG1), wherein the computing device (100; 100a) is designed to control operation of the computing device (100; 100a) in dependence on the response (A2; A2') (430).

2. Computing device (100; 100a) according to Claim 1, wherein a) the memory device (200; 200a) is integrated in the computing device (100; 100a), or wherein b) the memory device (200; 200a) is provided externally from the computing device (100; 100a).

3. Method for operating a computing device (100; 100a) with at least one computing core (110) for carrying out a first computer program (PRG1), wherein the computing device (100; 100a) is designed to access a memory device (200; 200a) to load the first computer program (PRG1), wherein the computing device (100; 100a) sends a first control command (A1), which characterizes the first computer program (PRG1) and / or a memory area of the memory device (200; 200a) assigned to the first computer program (PRG1), to at least one cryptographic module (300) (400), wherein the cryptographic module (300) is designed to verify the computer program (PRG1) characterized by the control command (A1) or the memory area of the memory device (200; 200a) assigned to the first computer program (PRG1) (510), wherein the computing device (100; 100a) executes the first computer program (PRG1) (410), wherein the computing device (100; 100a) executes the first computer program (PRG1) directly after the sending of the first control command (A1; A1') to the cryptographic module (300) without waiting for a or the response (A2; A2') of the cryptographic module (300) to the first control command (A1; A1') and / or without reading out the response (A2; A2') from the cryptographic module (300), wherein the computing device (100; 100a) receives a response (A2; A2') of the cryptographic module (300) to the first control command (A1; A1') or reads it out from the cryptographic module (300) (420), wherein the response (A2; A2') has information about the result of a test of the computer program (PRG1) characterized by the control command (A1; A1') or the memory area of the memory device (200; 200a) assigned to the first computer program (PRG1), wherein the computing device (100; 100a) controls operation of the computing device (100; 100a) in dependence on the response (A2; A2') (430).

4. System (1000) comprising at least one computing device (100; 100a) according to at least one of Claims 1 to 2, at least one memory device (200; 200a), and at least one cryptographic module (300), wherein the cryptographic module (300) is designed to receive a first control command (A1; A1'), which characterizes a first computer program (PRG1) and / or a memory area of the memory device (200; 200a) assigned to the first computer program (PRG1), from the computing device (200; 200a) (500), wherein the cryptographic module (300) is designed to verify the computer program (PRG1) characterized by the first control command (A1; A1') or the memory area of the memory device (200; 200a) assigned to the first computer program (PRG1) (510), wherein in particular the at least one computing device (100; 100a) and the at least one memory device (200; 200a) and the at least one cryptographic module (300) are arranged on the same semiconductor substrate (1000a).

5. System (1000) according to Claim 4, wherein the cryptographic module (300) is designed to determine a response (A2; A2') to the first control command (A1; A1') (520), wherein in particular the response (A2; A2') has information about the result of a test of the computer program (PRG1) characterized by the control command (A1; A1') or the memory area of the memory device (200; 200a) assigned to the first computer program (PRG1).

6. System (1000) according to Claim 4 or 5, wherein the cryptographic module (300) is designed to carry out the verification (510) of at least one computer program (PRG1) or memory area using a key-based message authentication code, CMAC.