Method for emulating startup programs

Abstract

Method for emulating startup programs. This description relates to a method for emulating N startup programs in a memory, N being greater than 2, in which the size of a forbidden access region of memory containing the startup programs after execution increases with each program executed. Figure for the abstract: Fig. 2

Description

Title of the invention: Method for emulating startup programs. Technical field.

[0001] This description relates in general to the methods of emulating startup programs in a memory as well as the circuits implementing these methods. Previous technique

[0002] Many electronic circuits, such as microcontrollers, use a boot program (BOOT) which is loaded into non-volatile memory of the circuit at startup to then execute a boot application. For security reasons, once executed, the boot program must be made inaccessible from outside the circuit. This poses a particular problem when several successive boot programs need to be executed. Summary of the invention

[0003] There is a need to provide a method which allows the implementation of at least three startup programs while ensuring their safety after execution.

[0004] An embodiment overcomes all or part of the disadvantages of known processes.

[0005] One embodiment provides a method for emulating N programs of boot in a memory, N being greater than 2, in which the size of a forbidden access region of memory containing the boot programs once executed increases once each program is executed.

[0006] In one embodiment, the startup programs are loaded one after the other into successive memory areas, access to each area being blocked once the program concerned has been executed, by enlarging the prohibited access region.

[0007] In one embodiment, a startup program from the second is loaded into memory following the previous program once access to the latter has been prohibited by enlarging the region.

[0008] In one embodiment, the size of the forbidden access region of memory is defined by the content of a first volatile memory register, the value of which is incremented by the region enlargement value at each end of program execution.

[0009] In one embodiment, the increment of the value contained in the first register is in number of memory sectors.

[0010] In one embodiment, the first register is increasing monotonically.

[0011] In one embodiment, the content of a second memory register volatile includes the value defining a status, allowed or prohibited, of access to the region.

[0012] In one embodiment, the second register can only be reset by a memory reset.

[0013] In one embodiment, the second register is 1 bit.

[0014] In one embodiment, the second register is on several bits.

[0015] In one embodiment, the two values ​​defining the status of access to said regions are separated by more than one bit.

[0016] In one embodiment, when the content of the second register is different from one of said two values, access to the region is prohibited until the memory is reset.

[0017] In one embodiment, when the content of the second register is different from one of said two values, the content of the first volatile memory register can no longer be modified.

[0018] In one embodiment, a maximum region size is predefined, and application programs can only be loaded outside of said region.

[0019] One embodiment provides an electronic circuit configured to implement one of the above processes. Brief description of the drawings

[0020] These features and advantages, as well as others, will be described in detail in the following description of particular embodiments, given by way of non-limiting example, in relation to the accompanying figures, among which:

[0021] [Fig.1] represents, in a very schematic way and in block form, an example of an integrated circuit of the type to which the described embodiments apply;

[0022] Figure 2 illustrates an implementation method for emulating several startup programs in a memory; and

[0023] Fig. 3 illustrates another method of implementing a method for emulating several startup programs in a memory. Description of the implementation methods

[0024] The same elements have been designated by the same reference numerals in the different figures. In particular, structural and / or functional elements common to the different embodiments may have the same reference numerals and may have identical structural, dimensional and material properties.

[0025] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been represented and are detailed.

[0026] Unless otherwise specified, when referring to two elements connected together, this means directly connected without intermediate elements other than conductors, and when referring to two elements coupled together, this means that these two elements can be connected or linked through one or more other elements.

[0027] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "superior", "inferior", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made, unless otherwise specified, to the orientation of the figures.

[0028] Unless otherwise specified, the expressions "approximately", "roughly", and "in the order of" mean within 10%, preferably within 5%.

[0029] Fig. 1 represents, in a very schematic way and in block form, an example of an integrated circuit 100 of the type to which the described embodiments apply.

[0030] The circuit 100 includes a non-volatile memory 104 (FLASH MEMORY), for example of the FLASH memory type, capable of communicating, via a communication bus 114, with a non-volatile memory interface 106 (FLASH INTERFACE) configured to write or read data into and from the non-volatile memory 104.

[0031] The circuit 100 further includes, for example, a processing unit 110 (CPU) comprising one or more processors under the control of instructions stored in an instruction memory 112 (INSTR MEM). The instruction memory 112 is, for example, a volatile random access memory (RAM). The processing unit 110 and the memory 112 communicate, for example, via a system bus 140 (data, address, and control bus). The FLASH memory 104 is connected to the system bus 140 via the non-volatile memory interface 106 and via the bus 114. The device 100 further includes an input / output interface 108 (FO interface) connected to the system bus 140 for external communication.

[0032] The device 100 can integrate other circuits implementing other functions (for example, one or more volatile and / or non-volatile memories, other processing units), symbolized by a block 116 (FCT) in [Fig.1]. Among these other circuits, the circuit 100 includes, for example, a read-only or static memory 118 (ROM).

[0033] The described embodiments relate to the emulation of boot programs in flash memory 104. To this end, the boot programs are, for example, transferred directly to memory 104 during factory programming processes. However, the contents of flash memory are, in principle, modifiable. Therefore, care must be taken, for example, when loading multiple operating systems, to ensure that they cannot be modified once transferred to 104 flash memory, except system reset or circuit 100.

[0034] An example concerns OEM-type operating systems, which must be loaded during the manufacturing processes of the circuit 100 at system initialization into flash memory 104 so that they can then be executed at each system startup. However, once in flash memory, access to the boot program must be protected against other boot programs, any application, or access from outside the circuit to prevent it from being modified. To achieve this, access to the area of ​​flash memory containing the boot program is locked so that it cannot be accessed except by restarting the circuit.

[0035] One difficulty lies in providing for this functionality when several startup programs, of different levels, are likely to be transferred to the flash memory 104.

[0036] The described embodiments provide for an increase in the size of a forbidden access region of memory 104 containing the startup programs once each program has been executed.

[0037] Lower level startup programs are therefore protected from access by new startup programs loaded and executed subsequently.

[0038] Fig. 2 illustrates an implementation method for emulating several startup programs in memory 104.

[0039] Fig. 3 represents, in block form, steps of another mode of implementation of a method for emulating several startup programs in memory 104.

[0040] In the example shown in Figures 2 and 3, memory 104 is partitioned into a region 214 and a region 212 whose dimensions are defined by User Option Bytes SECWMx_PEND and SECWMx_PSTRT, which are loaded from non-volatile memory at startup, for example, memory 118. Data written to region 212 is, for example, encrypted. Data written to region 214 is, for example, not encrypted or encrypted with a lower level of security than that in region 212. Although this is not apparent in the figures, the size of region 214 is, in practice, significantly larger than the size of region 212 (by a factor of at least 10).

[0041] The memory 104 is coupled to a first volatile storage register 230 (HDPxEXT), whose value can only be incremented; that is, the first register is monotonically increasing. The value contained in the first register is representative, for example, of the size of the forbidden access region 212 of the memory 104. The size of the forbidden access region is, for example, measured in memory sectors.

[0042] Memory 104 is also coupled to a second volatile storage register 232 (HDPxEXT_ACCDIS). The second volatile storage register 232 contains an HDPxEXT_ACCDIS value defining a status, allowed (value 0) or forbidden (value 1), of access to region 212, the size of which is defined by the HDPxEXT content of register 230.

[0043] Memory 104 is further coupled to another volatile storage register HDPx_ACCDIS which defines the possibility or prohibition of access to the region between the values ​​HDP_PEND and SECWMx_PSTRT.

[0044] By way of example, the contents SECWMx_PSTRT, HDPxEXT and SECWMx_PEND represent memory addresses 104, either directly or in number of sectors.

[0045] For simplicity, in the following description, the same reference is used to designate a register and the value it contains.

[0046] The process in [Fig. 2] comprises successive steps 202, 204, 206, 208, and 210.

[0047] In step 202, which corresponds to circuit initialization, the value of HDPx_ACCDIS is 0, allowing a first boot program (BootL1) to be loaded into one or more sectors 218 of region 212, between address SECWMx_PSTRT and an address HDPx_PEND defined by user option bytes before booting. Once loaded, the first boot program is executed, and then access to it is blocked by changing the value of HDPx_ACCDIS from 0 to 1. Once set to 1, the HDPx_ACCDIS register can only be reset to 0 by resetting the memory. Step 202 also corresponds to a start-up or a reset of the circuit, i.e. phases which do not take place in the factory during the manufacture or programming of the circuit but during the standard use of the circuit.In this case, the boot program (BootLl), which has already been loaded into one or more sectors 218 of region 212 during the factory production phase, is not reloaded but only executed.

[0048] In step 204, which corresponds to circuit initialization, it is assumed that a second boot program (BootL2) is then written in region 212, for example, following the first boot program. The program is then executed. Step 204 also corresponds to a circuit startup or reset. In this case, the second boot program (BootL2), which was already loaded during the factory production phase, is not reloaded but only executed.

[0049] In a step 206, which corresponds to a circuit initialization, the first volatile storage register HDPxEXT is incremented so that its value is representative of the size of the memory region 212 comprising the first and second startup programs. The second volatile storage register HDPxEXT_ACCDIS is set to 1, which blocks access to the region whose size is defined by the HDPxEXT register. The second boot program is thus prevented from accessing another boot program, for example, BootL3. Once set to 1, the HDPxEXT_ACCDIS register can only be reset to zero by resetting the memory.

[0050] It is assumed that, when step 206 corresponds to an initialization phase, a third boot program 222 (BootL3) is then written to region 212 following the second boot program. Then the program is executed. Step 206 also corresponds to a circuit startup or reset. In this case, the third boot program 222, which was already loaded during the factory production phase, is not reloaded but only executed.

[0051] In step 208, which corresponds to circuit initialization, the first volatile storage register HDPxEXT is incremented so that its value represents the size of the memory region 212 containing the first, second, and third startup programs. The second volatile storage register HDPxEXT_ACCDIS remains at the value 1, which prevents access to the region, augmented by the third startup program, the size of which is defined by the HDPxEXT register.

[0052] If, as illustrated in [Fig.3], an additional startup program This fourth boot program 224 (BootL4) is then written to region 212, for example, following the third boot program. Because the value of HDPxEXT_ACCDIS is set to 1, and the value of HDPxEXT corresponds to a region size encompassing the first, second, and third boot programs, the first, second, and third boot programs are inaccessible to the fourth boot program. The fourth boot program is then executed. Step 208 also corresponds to a circuit startup or reset. In this case, the fourth boot program 224, which was already loaded during the factory production phase, is not reloaded but simply executed.

[0053] In a step 210, the first volatile storage register HDPxEXT is incremented so that its value represents the size of the memory region 212 comprising the first, second, third, and fourth startup programs. The second volatile storage register HDPxEXT_ACCDIS remains at the value 1, which prevents access to the region, augmented by the fourth startup program, the size of which is defined by the HDPxEXT register.

[0054] In the example of [Fig.2], when HDPxEXT reaches the predefined value corresponding to a region encompassing the first four startup programs, Application programs 216 (Sec-Appli, NS-Appli) can be loaded outside the restricted access region between SECWMx_PEND and HDPxEXT or into region 214. These applications cannot access the restricted access region defined with HDPxEXT because of the value HDPxEXT_ACCDIS which is 1, which, in the example of [Fig.2], prohibits access to the region whose size is defined by the HDPxEXT register.

[0055] A memory reset at any time from steps 202 to 210 restarts the emulation process at step 202 for example.

[0056] Figure 3 illustrates another method of implementing a method for emulating several startup programs in non-volatile memory.

[0057] The process illustrated in [Fig.3] is similar to that of [Fig.2] except that the registers HDPx_ACCDIS and HDPxEXT_ACCDIS are this time on several bits and more particularly on 8 bits in the example shown.

[0058] In the example associated with [Fig. 3], when the contents of the HDPx_ACCDIS register are equal to 0xA3, access to the region defined by the HDP_PEND register, i.e., between HDP_PEND and SECWMx_PSTRT, is permitted. For other values ​​of the HDPx_ACCDIS register, access to the relative region defined by the HDP_PEND register is prohibited. Furthermore, access to the HDPx_ACCDIS value depends on its current value. When the value of the HDPx_ACCDIS register is not equal to 0xA3, write access to that same HDPx_ACCDIS register is prohibited.

[0059] In the example associated with [Fig.3], when the HDPxEXT_ACCDIS register has the value 0xA3, access to the region whose size is defined by HDPxEXT is allowed.

[0060] When the HDPxEXT_ACCDIS register has the value 0x5C, access to the region whose size is defined by the HDPxEXT register, as well as the region defined by the HDP counter, is prohibited. However, the HDPxEXT register can be incremented.

[0061] For other values ​​of the HDPxEXT_ACCDIS register other than 0xA3 and 0x5C, access to the region whose size is defined by the HDPxEXT register is prohibited and any writing in the HDPxEXT register is prohibited until a memory reset 104. The value of the HDPxEXT_ACCDIS register cannot be modified before a memory reset.

[0062] Table [Table 1] below summarizes the write access possibilities of the HDPxEXT and HDPxEXT_ACCDIS registers as a function of the current value of the HDPxEXTACCDIS register.

[0063] [Tables 1] HDPxEXT_ACCDIS Registry Value Write access to: HDPxEXT_ACCDIS HDPxEXT 0xA3 (value at reset) Allowed Allowed 0x5C Allowed if the value to be written is different from 0xA3. Otherwise, write access is prohibited. Allowed if the new value is greater than the current value. Otherwise, write access is prohibited. Other Write access prohibited. Write access prohibited.

[0064] When the HDPxEXT_ACCDIS register has a current value of 0xA3, then write access to the HDPxEXT and HDPxEXT_ACCDIS registers is permitted. Access to the region whose size is defined by the HDPxEXT register is permitted.

[0065] When the HDPxEXT_ACCDIS register has a current value of 0x5C, then write access to the HDPxEXT_ACCDIS register is permitted if the value to be written is not 0xA3. Otherwise, write access to HDPxEXT_ACCDIS is prohibited.

[0066] When the HDPxEXT_ACCDIS register has a current value of 0x5C, then write access to the HDPxEXT register is permitted if the new value to be written is greater than the current value, in other words, if the HDPxEXT register is incremented. Otherwise, write access is prohibited.

[0067] Finally, when the contents of the HDPxEXT_ACCDIS register are different from one of the two values ​​0xA3 and 0x5C, write access to the HDPxEXT and HDPxEXT_ACCDIS registers is prohibited and access to the region whose size is defined by the HDPxEXT register is prohibited until memory is reset.

[0068] In step 202 of [Fig.3], after reset, the HDPx_ACCDIS and HDPxEXT_ACCDIS registers have the value 0xA3, allowing writing and reading in the region whose size is defined by the HDP_PEND register.

[0069] In step 204 of [Fig. 3], the HDPxEXT_ACCDIS register retains the value 0xA3 while the HDPx_ACCDIS register is set to a value other than 0xA3, which prevents access to the region whose size is defined by the HDP_PEND register. Once the HDPx_ACCDIS register is set to a value other than 0xA3, it cannot be changed until the memory is reset. Access to the region defined by the HDP_PEND registry is therefore prohibited until reset.

[0070] In step 206 of [Fig. 3], the HDPxEXT_ACCDIS register takes the value 0x5C, which prevents access to the region whose size is defined by the HDPxEXT register. The latter can nevertheless be incremented after the execution of the BootL2 boot program.

[0071] In steps 208 and 210 of [Fig. 3], the HDPxEXT_ACCDIS register remains at the value 0x5C, which prevents access to the region whose size is defined by the HDPxEXT register. However, the latter is incremented after the execution of the BootL3 and BOOTL4 boot programs, thereby preventing access to the region whose size, incremented at each step, is defined by the register; that is, the region between the values ​​contained in the HDPx_PEND and HDPxEXT registers. Access to the region between the values ​​contained in the HDPx_PEND and SECWMx_PSTRT registers is already blocked by the value held by the HDPx_ACCDIS register.

[0072] The values ​​0xA3 and 0x5C are chosen to be sufficiently far apart so that a change in these values, caused by an attack or disruption, does not allow access to an access region defined as forbidden or result in a denial of service. These values ​​are, however, examples, and other values ​​are possible provided that the probability of an attack or disruption causing the register contents to switch from one value to the other is low. Typically, the two chosen values ​​must be at least two bits apart.

[0073] Compared to the method in [Fig. 2], the fact that the HDPxEXT_ACCDIS register can affect access to the HDPxEXT region with three values ​​(0xA3, 0x5C, and any other value) provides optimal protection against external attacks or disruptions. In particular, it prevents a deliberate (attack) or accidental disruption from changing the value of the HDPxEXT_ACCDIS register to 0, which would allow access to startup programs in the HDPxEXT region. As another example, it prevents the HDPxEXT register from being incremented beyond the Sec-Appli or NS-Appli application level, thus preventing access to these applications and a denial of service.

[0074] Furthermore, the embodiment presented in connection with [Fig.3] allows emulation of a number of startup programs greater than 2.

[0075] Various embodiments and variants have been described. Those skilled in the art will understand that certain features of these various embodiments and variants could be combined, and other variants will become apparent to those skilled in the art. In particular, even though values ​​of the HDPx_ACCDIS, HDPxEXT_ACCDIS, and HDPxEXT registers have been presented, in connection with the different embodiments, with values ​​0 and 1, or 0xA3 and 0x5C, the person skilled in the art may implement other values ​​provided that the described functionalities are respected.

[0076] Finally, the practical implementation of the described embodiments and variants is within the reach of a person skilled in the art, based on the functional indications given above, in particular with regard to the number of startup programs that can be emulated.

Claims

Demands

1. A method for emulating N boot programs (BootL1, BootL2, BootL3, BootL4) in a memory (104), N being greater than 2, wherein: the size of a memory forbidden access region (HDP) containing the boot programs after execution increases after each program is executed, the size of the memory forbidden access region being defined by the contents of a first volatile storage register (HDPxEXT), the value of which is incremented by the region's expansion value at each program's completion; and the first register (HDPxEXT) is monotonically increasing.

2. A method according to claim 1, wherein the startup programs are loaded one after the other into successive memory areas (218, 220, 222, 224), access to each area being blocked once the program concerned has been executed, by enlarging the prohibited access region.

3. A method according to claim 1 or 2, wherein a startup program from the second is loaded into memory following the previous program once access to the latter has been prohibited by enlarging the region.

4. Method according to claim 3, wherein the increment of the value contained in the first register (HDPxEXT) is in number of memory sectors.

5. A method according to any one of claims 1 to 4, wherein the contents of a second volatile storage register (HDPxEXT_ACCDIS) include the value defining a status, allowed or prohibited, of access to the region.

6. A method according to claim 5, wherein the second register (HDPxEXT_ACCDIS) can only be reset by a memory reset.

7. Method according to claim 5 or 6, wherein the second register is on several bits.

8. A method according to claim 7, wherein the two values ​​defining the access status to said region are separated by more than one bit.

9. A method according to any one of claims 5 to 8, wherein when the content of the second register (HDPxEXT_ACCDIS) is different from one of the two said values, access to the region is prohibited until the memory is reset.

10. A method according to any one of claims 5 to 9, wherein when the content of the second register (HDPxEXT_ACCDIS) is different from one of said two values, the content of the first volatile storage register (HDPxEXT) can no longer be modified.

11. A method according to any one of claims 1 to 10, wherein a maximum region size (HDP) is predefined, application programs being able to be loaded only outside of said region.

12. Electronic circuit configured to implement the method according to any one of claims 1 to 11.

Images