AUTHENTICATION METHOD OF A PROCESSOR

Description

Technical field

[0001] This description relates generally to electronic devices and more particularly to processors. This description relates more particularly to a mode of operation of a processor. Prior art

[0002] A processor, included in most current electronic devices, is a processing unit that executes operating codes.

[0003] Processors are frequently subject to attempts to clone and emulate the operating codes they are designed to execute.

[0004] It would be desirable to improve at least in part certain aspects of the known implementation methods of processors, and, more particularly, to improve at least in part the authentication methods executed by a processor.

[0005] Document US 9,177,111 relates to a processor whose arithmetic and logic unit is adapted to implement encrypted instructions.

[0006] Document US 6,308,256 relates to a processor whose arithmetic and logic unit is adapted to implement encrypted instructions. Summary of the invention

[0007] An embodiment overcomes all or part of the drawbacks of known processor implementation methods.

[0008] One embodiment overcomes all or part of the drawbacks of known authentication methods implemented by a processor.

[0009] The invention is defined by the appended independent claims. Embodiments are defined by the appended dependent claims. Brief description of the drawings

[0010] These and other features and advantages will be set forth in detail in the following description of particular embodiments given without limitation in relation to the attached figures, among which: there figure 1 represents a flowchart illustrating a method of implementing a processor; the figure 2 represents a flowchart (a) illustrating a mode of implementation of an authentication method executed by a processor, and a block diagram (b) illustrating the architecture of a processor; the figure 3 represents a flowchart (a) illustrating another mode of implementation of an authentication method executed by a processor, and a block diagram (b) illustrating the architecture of another processor; and the figure 4represents a flowchart (a) illustrating another mode of implementation of an authentication method executed by a processor, and a block diagram (b) illustrating the architecture of another processor. Description of the embodiments

[0011] The same elements have been designated by the same references in the different figures. In particular, the structural and / or functional elements common to the different embodiments may have the same references and may have identical structural, dimensional and material properties.

[0012] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been represented and are detailed. In particular, not all the elements making up the architecture of a processor will be described, only the elements relating to the described embodiments will be detailed, these elements adapting to standard processor architectures.

[0013] Unless otherwise specified, when two elements are referred to connected together, this means directly connected without intermediate elements other than conductors, and when two elements are referred to connected or coupled together, this means that these two elements can be connected or be connected or coupled through one or more other elements.

[0014] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "upper", "lower", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made unless otherwise specified to the orientation of the figures.

[0015] Unless otherwise specified, the expressions "about", "approximately", "substantially", and "of the order of" mean to within 10%, preferably to within 5%.

[0016] We call: operation code: an operation to be executed by a processor and comprising an instruction and one or more operands; operand of an operation code: a numeric, logical, alphanumeric, etc. value contained in the operation code; instruction of an operation code: an actual mathematical or logical operation applied to one or more operands of the operation code; and command: a set or a succession of operation codes.

[0017] There figure 1is a flowchart illustrating a method of processing, by a processor, an operating code to be executed. This processing method is a conventional processing method used by a standard processor. For example, the processor is a RISC (Reduced Instruction Set Computing) type processor.

[0018] In step 10 (IF, "Instruction Fetch"), an operation code is supplied, for example by a bus, to the processor. For example, the operation code is loaded from a memory.

[0019] In step 12 (ID, "Instruction Decode"), the operation code is decoded by a decoding unit of the processor. More specifically, the operation code is converted into an instruction and one or more operands.

[0020] In step 14 (EX, "Execution"), the decoded operation code, i.e., the instruction and the operand(s), is supplied to an arithmetic logic unit included in the processor. The arithmetic logic unit is responsible for implementing the operation code, by performing calculations on the operands of the operation code in accordance with the instruction of the operation code to be executed.

[0021] At step 16 (MEM, "Memory Access"), the arithmetic and logic unit requests access to a register in a register bank or stack, to store there the result of the calculations of the executed operating code. At this step, the processor can, in addition, access an external memory to, for example, read and / or write one or more data.

[0022] At step 18 (WB, "Write Back"), the arithmetic logic unit provides the result of its calculations to the register bank to store it in a register.

[0023] There figure 2illustrates a mode of implementation of a method 100 for authenticating a processor 1000. The figure 2 comprises a flowchart (a) illustrating the steps of the authentication method 100, and a diagram (b), in block form, illustrating a simplified architecture of the processor 1000.

[0024] The authentication method 100 includes: a step 110 of loading, by the processor 1000, an operating code to be executed; a step 120 of decoding the operating code to be executed; and a step 130 of processing the operating code to be executed.

[0025] Step 110 is identical to step 10 described in relation to the figure 1 . An operation code OPCODE is received and loaded by the processor 1000.

[0026] Step 120 is identical to step 12 described in relation to the figure 1The operation code OPCODE is decoded, by a decoding unit 1010 (DEC), into one or more operands OP1, ..., OPN, and into an instruction INSTR.

[0027] Step 130 includes steps similar to steps 14, 16 and 18 described in connection with the figure 1 but further includes the use of one or more operating codes previously executed by the processor 1000. The detail of step 130 will be described below in relation to the description of the architecture of the processor 1000.

[0028] The 1000 processor includes: the decoding unit 1010; a multiplexer 1020 (MUX); a register bank 1030 (REGLIST); a context register bank 1040 (CONTEXT); a combination circuit 1050 (COMB); and an arithmetic and logic unit 1060 (ALU).

[0029] As indicated previously, the decoding unit 1010 makes it possible to decode the operation code OPCODE into several operands OP1, ..., OPN, and into an instruction INSTR. Thus, the decoding unit 1010 receives, as input, the operation code OPCODE loaded in step 110, and provides, as output, the operands OP1, ..., OPN, and the instruction INSTR (step 120). More particularly, the decoding unit 1010 provides the operands OP1, ..., OPN to inputs of the multiplexer 1020, and the instruction INSTR to an input of the combination circuit 1050.

[0030] The multiplexer 1020 makes it possible to choose and direct the operands OP1, ..., OPN, necessary for processing the operating code OPCODE to the arithmetic and logic unit 1060. Alternatively, the multiplexer 1020 directs all or part of the operands to the combination circuit 1050. Thus, the multiplexer 1020 receives, as input, the operands OP1, ..., OPN and for example an output from the register bank 1030. The multiplexer 1020 transmits, as output, the operands OP1, ..., OPN to the arithmetic and logic unit 1060 and to an input of the combination circuit 1050.

[0031] The register bank 1030 makes it possible to temporarily store, in registers, data, for example operands OP1, ..., OPN of the operating code OPCODE, results of the arithmetic and logic unit 1060, etc. The register bank 1030 can also make it possible to provide other operands, for example directly or via the multiplexer 1020, to the arithmetic and logic unit 1060. The register bank 1030 receives, as input, an output of the arithmetic and logic unit 1060 and for example the output of the multiplexer 1020. The register bank 1030 provides, as output, data to the arithmetic and logic unit 1060 and, for example, to the multiplexer 1020.

[0032] The context register bank 1040 is a register bank storing, in registers, the operation codes previously executed by the processor 1000. For example, the context register bank 1040 may store all or part of the previously executed operation codes in a stack, or in a circular buffer, and / or it may apply to them, in order to store them, a mathematical function, for example a permutation. For example, the context register bank 1040 may take into account the operation code to be executed or currently being executed. The context register bank 1040 receives, as input, the operation code OPCODE in order to store it. The context register bank 1040 provides, as output, data to the combination circuit 1050.

[0033] The combination circuit 1050 makes it possible to combine the decoded INSTR instruction of the OPCODE operation code with the data from the output of the context register bank 1040. In other words, the combination circuit 1050 makes it possible to provide, to the arithmetic and logic unit 1060, a new instruction comprising a data signature depending on the operation codes previously executed by the processor 1000. The combination circuit 1050 can be, for example, controlled by one of the decoded operands of the OPCODE operation code. This new instruction will be called in the remainder of the description a signed instruction INSTR-SIG. Thus, the combination circuit 1050 receives, as input, the INSTR instruction and the output of the context register bank 1040. The combination circuit 1050 provides, as output, the signed instruction INSTR-SIG to the arithmetic and logic unit 1060.According to an alternative embodiment, the combination circuit 1050 may combine only certain decoded INSTR instructions with the data from the output of the context register bank 1040, and transmit the other decoded INSTR instructions, without signing them, directly to the arithmetic and logic unit 1060.

[0034] The arithmetic and logic unit 1060 makes it possible to implement the processing and calculations of the operating code OPCODE. In other words, the arithmetic and logic unit 1060 applies the signed instruction INSTR-SIG to the operands supplied by the multiplexer 1020. For example, the arithmetic and logic unit 1060 can also take into account data supplied by the register bank 1030. The arithmetic and logic unit 1060 receives, as input, the instruction INSTR-SIG from the combination circuit 1050, the output from the multiplexer 1040 and the output from the register bank 1030. The arithmetic and logic unit 1060 provides, as output, a result signal R to the input of the register bank 1030.

[0035] The sequence of step 130 is as follows. The combination circuit 1050 combines the INSTR instruction with data from the context register bank 1040 to provide the arithmetic logic unit 1060 with the signed instruction INSTR-SIG. The arithmetic logic unit 1060 performs the calculations relating to the signed instruction ISNTR-SIG and the operands provided by the multiplexer 1020. The arithmetic logic unit then requests access to the register bank 1030 to store the result signal R therein.

[0036] An advantage of this embodiment is that, for an identical operation code OPCODE, an arithmetic and logic unit of a conventional processor will produce result signals R different from those produced by the arithmetic and logic unit 1060 of the processor 1000 of the embodiment. The result signal R could, for example, serve as a control signal used as a means of authenticating a device during its use.

[0037] An example of application of this embodiment is the following. A processor generally receives one or more commands each comprising several operating codes. To use the method of this embodiment, it is sufficient that a single instruction relating to one of these operating codes is signed by the combination circuit 1050. For example, a command may comprise only a single signed instruction allowing authentication of the device. According to another example, all of the instructions linked to the same command may be signed by the combination circuit 1050.

[0038] A more specific application example may be the following. Consider a printer comprising a processor of the processor type 1000 and an ink cartridge adapted to communicate data to the printer. This data is, for example, filling levels or authentication data of the ink cartridge. The installation of the cartridge in the printer may be followed by a series of commands sent by the cartridge to the printer. If the cartridge is intended to be installed in the printer in question, the designer of the cartridge will have planned to prepare the operating codes of the series of commands so that they are adapted to the architecture of the printer processor. In other words, in this case, the operating codes will be adapted to take into account the data of the context register bank 1040.However, if the operating codes of the series of commands are not adapted to the architecture of the processor 1000, the results R provided by the arithmetic and logic unit 1060 will not be those expected by the other circuits of the printer which could, for example, go into fault mode. It will be noted that it is sufficient for a single instruction of the series of commands to be signed to activate, for example, a fault mode of the other circuits of the printer. It may also be decided to sign all the instructions of the series of commands.

[0039] There figure 3 illustrates a mode of implementation of a method 200 for authenticating a processor 2000. The figure 3 comprises a flowchart (a) illustrating the steps of the authentication method and a diagram (b), in block form, illustrating a simplified architecture of the processor 2000. The method 200 and the processor 2000 are similar to the method 100 and the processor 1000 described in relation to the figure 2 , the differences between them will be described below.

[0040] The authentication method 200 comprises: a step 210 of loading an operating code to be executed; a step 220 of decoding the operating code to be executed; and a step 230 of processing the operating code to be executed.

[0041] Step 210 is identical to step 10 described in relation to the figure 1 . An operation code OPCODE is received and loaded by the processor 2000.

[0042] Step 220 is identical to step 12 described in relation to the figure 1 The operation code OPCODE is decoded, by the decoding unit 1010 (DEC) of the processor 2000, into one or more operands OP1, ..., OPN, and into an instruction INSTR.

[0043] Step 230 differs from step 130 described in connection with the figure 2in that the use of previously executed operation codes is replaced by the use of one or more previous results of the arithmetic and logic unit 2060 of the processor 2000. The detail of step 230 will be described below in relation to the description of the architecture of the processor 2000.

[0044] The processor 2000 includes elements in common with the processor 1000, these elements will not be described again. Thus, the processor 2000 includes: the decoding unit 1010; the multiplexer 1020 (MUX); the register bank 1030 (REGLIST); a result register bank 2040 (RESULT); a combination circuit 2050 (COMB); and the arithmetic and logic unit 2060 (ALU).

[0045] The result register bank 2040 is a register bank storing the previous results of the arithmetic logic unit 2060. For example, the result register bank 2040 may store the previous results in a stack, and / or it may apply a mathematical function, for example a permutation, to store them. The result register bank 2040 receives, as input, the result R of the arithmetic logic unit 2060 in order to store it. The result register bank 2040 provides, as output, data to the combination circuit 2050, this data therefore depending on the previous results of the arithmetic logic unit 2060. The result register bank 2040 is, for example, a register adapted to operate as a shift register in which the last information stored is the first information to be deleted, or as a linear feedback shift register.

[0046] The combination circuit 2050 is similar to the combination circuit 1050 described in connection with the figure 2. The combination circuit 2050 combines the decoded INSTR instruction of the operation code OPCODE with the data from the output of the result register bank 2040. In other words, the combination circuit 2050 provides a signed instruction INSTR-SIG by the previous results of the arithmetic and logic unit 2060. Thus, the combination circuit receives, as input, the INSTR instruction and the output of the result register bank 2040. The combination circuit 2050 provides, as output, the new INSTR-SIG instruction to the arithmetic and logic unit 2060. According to an alternative embodiment, the combination circuit 2050 may combine only certain decoded INSTR instructions with the data from the output of the result register bank 2040, and transmit the other INSTR instructions, without signing them, directly to the arithmetic and logic unit 2060.

[0047] The arithmetic logic unit 2060 differs from the arithmetic logic unit 1060 described in connection with the figure 2 in that it additionally provides, as output, the output signal R to the register bank 1030 and to the results register bank 2040.

[0048] The progress of step 230 therefore differs from the progress of step 130 described in relation to the figure 1 , by the fact that the instructions which are signed are signed with data taking into account the previous results of the arithmetic and logic unit 2060.

[0049] This embodiment has the same advantage as the embodiment described in relation to the figure 2 .

[0050] There figure 4 illustrates a mode of implementation of a method 300 for authenticating a processor 3000. The figure 4includes a flowchart (a) illustrating the steps of the authentication method and a diagram (b), in block form, illustrating a simplified architecture of the processor 3000.

[0051] The embodiments described below are a combination of the embodiments described in connection with the figures 2 And 3 .

[0052] The authentication method 300 includes: a step 310 of loading an operating code to be executed; a step 320 of decoding the operating code to be executed; and a step 330 of processing the operating code to be executed.

[0053] Step 310 is identical to step 10 described in relation to the figure 1 . An operation code OPCODE is received and loaded by the processor 3000.

[0054] Step 320 is identical to step 12 described in relation to the figure 1The operation code OPCODE is decoded, by the decoding unit 1010, into one or more operands OP1, ..., OPN, and into an instruction INSTR.

[0055] Step 330 is a combination of steps 130 and 230 described in connection with the figures 2 And 3 . More particularly, step 330 comprises the use of one or more previous results of the arithmetic and logic unit 3060 of the processor 3000, and the use of one or more operation codes previously executed by the processor 3000. The detail of step 330 will be described below in relation to the description of the architecture of the processor 3000.

[0056] The processor 3000 includes elements in common with the processors 1000 and 2000, these elements will not be described again. Thus, the processor 3000 includes: the decoding unit 1010 (DEC); the multiplexer 1020 (MUX); the register bank 1030 (REGLIST); a bank of context and result registers 3040 (CONTEXT RESULT); a combination circuit 3050 (COMB); and an arithmetic and logic unit 3060 (ALU).

[0057] The context and results register bank 3040 is a combination of the context register bank 1040 described in connection with the figure 2 and the 2040 results register bank described in relation to the figure 3. More particularly, the context and result register bank 3040 is adapted to store operation codes previously executed by the processor 3000 and previous results of the arithmetic and logic unit 3060. For example, the context and result register bank 3040 can store the data in a stack, and / or it can apply a mathematical function, for example a permutation, to store them. The context and result register bank 3040 receives, as input, the result R of the arithmetic and logic unit 3060 and the operation code OPCODE in order to store them. The context and result register bank 3040 provides, as output, data to the combination circuit 3050.

[0058] Combination circuit 3050 is similar to combination circuits 1050 and 2050 described in connection with figures 1 And 2. The combination circuit 3050 combines the decoded INSTR instruction of the OPCODE operation code with the data from the output of the context and result register bank 3040. In other words, the combination circuit 3050 provides a signed instruction INSTR-SIG by the operation codes previously executed by the processor 3000 and by the previous results of the arithmetic and logic unit 3060. Thus, the combination circuit receives, as input, the INSTR instruction and the output of the context and result register bank 3040. The combination circuit 3050 provides, as output, the new INSTR-SIG instruction to the arithmetic and logic unit 3060.According to an alternative embodiment, the combination circuit 3050 may combine only certain decoded INSTR instructions with the data from the output of the context register bank 3040, and transmit the other decoded INSTR instructions, without signing them, directly to the arithmetic and logic unit 3060.

[0059] The arithmetic logic unit 3060 is identical to the arithmetic logic unit 2060 described in connection with the figure 3 . Thus, the arithmetic and logic unit 3060 provides the output signal R to the register bank 1030 and to the context and result register bank 3040.

[0060] The sequence of step 330 differs from the sequence of steps 130 and 230 described in relation to the figures 2 And 3, by the fact that the instructions which are signed are signed with data taking into account the operating codes previously executed by the processor 3000 and taking into account the previous results of the arithmetic and logic unit 3060.

[0061] This embodiment has the same advantage as the embodiments described in relation to the figures 2 And 3 .

[0062] Various embodiments and variations have been described. Those skilled in the art will understand that certain features of these various embodiments and variations could be combined, and other variations will occur to those skilled in the art.

[0063] Finally, the practical implementation of the embodiments and variants described is within the reach of those skilled in the art from the functional indications given above.

Claims

1. A method (100, 300) of authenticating a device by a processor (1000, 3000), comprising an arithmetic and logic unit (1060, 3060), comprising the steps of: receiving, on a first terminal of the arithmetic and logic unit (1060, 3060), at least one decoded operand (OP1, ..., OPN) of at least a portion of an opcode to be executed (OPCODE) sent by said device to the processor; receiving, on a second terminal of the arithmetic and logic unit (1060, 3060), a first instruction (INSTR-SIG) combining a second decoded instruction (INSTR) of the opcode to be executed (OPCODE) and at least one previously-executed opcode; the processing, by the arithmetic and logic unit (1060, 3060), of said first instruction (INSTR-SIG) and of said at least one operand (OP1, ..., OPN) to obtain a sign of result (R); and the authentication of said device as a function of said result sign (R) provided by the arithmetic and logic unit (1060, 3060) after said processing.

2. The method of claim 1, wherein said at least one portion of the opcode to be executed (OPCODE) represents the entire opcode to be executed (OPCODE).

3. The method of claim 1 or 2, wherein said first instruction (INSTR-SIG) is delivered by an output of a combination circuit (1050, 3050).

4. The method of claim 3, wherein the combination circuit (1050, 3050) receives as an input said second instruction (INSTR) of the opcode to be executed (OPCODE) and data taking into account said at least one previously-executed opcode.

5. The method of any of claims 1 to 4, wherein said at least one previously-executed opcode is stored in a context register bank (1040).

6. The method of any of claims 1 to 5, wherein said first instruction (INSTR-SIG) combines said second decoded instruction (INSTR) of the opcode to be executed (OPCODE), said at least one previously-executed opcode, and at least one previous result of said arithmetic and logic unit (3060).

7. A processor (1000, 3000) wherein an arithmetic and logic unit (1060, 3060) comprises: a first terminal capable of receiving at least one decoded operand (OP1, ..., OPN) of at least a portion of an opcode to be executed (OPCODE) sent by a device to said processor; and a second terminal capable of receiving a first instruction (INSTR-SIG) combining a second decoded instruction (INSTR) of an opcode to be executed (OPCODE) and at least one previously-executed opcode wherein the arithmetic and logic unit (1060, 3060) is adapted to process said first instruction (INSTR-SIG) received on its first terminal and said at least one operand received on its second terminal to provide a sign of result (R); and wherein said processor is adapted to authenticate said device as a function of said result sign (R) provided by said arithmetic and logic unit (1060, 3060) after said processing.

8. The processor of claim 7, further comprising a combination circuit (1050, 3050) capable of delivering said first instruction (INSTR-SIG) to the second terminal of the arithmetic and logic unit (1060, 3060).

9. The processor of claim 7, wherein the combination circuit (1050, 3050) is capable of receiving, as an input, said second instruction (INSTR) of the opcode to be executed (OPCODE) and data taking into account said at least one previously-executed opcode.

10. The processor of any of claims 7 to 9, further comprising a context register bank (1040) capable of storing said at least one previously-executed opcode.

11. The processor of any of claims 7 to 10, wherein said first instruction (INSTR-SIG) combines said second decoded instruction (INSTR) of the opcode to be executed (OPCODE), said at least one previously-executed opcode, and at least one previous result of said arithmetic and logic unit (3060).

12. The processor of any of claims 7 to 11, further comprising a decoding circuit (1010) capable of decoding the opcode (OPCODE) into at least one operand and into said second instruction.

13. The processor of any of claims 7 to 12, further comprising a multiplexer (1020) capable of receiving said at least one operand (OP1, ..., OPN) and of delivering it to the first terminal of the arithmetic and logic unit (1060, 3060).