Instruction monitoring module

Abstract

Instruction Monitoring Module This description relates to an instruction monitoring module (201) of a microcontroller (202), adapted to verify instructions received on an input terminal of said microcontroller (202) or instructions being processed by a code pointer of said microcontroller (202). Figure for the abbreviation: Fig. 2

Description

Title of the invention: Instruction monitoring module Technical field

[0001] The present description relates generally to electronic circuits and devices, and to the protection of electronic circuits and devices against malicious attacks. The present description relates more specifically to the protection of a complex electronic circuit such as a processor or a microcontroller. Prior art

[0002] Complex electronic circuits are circuits adapted to implement one or more complex functions, such as performing complex calculations from received data and instructions. Processors and microcontrollers are complex electronic circuits, and are particularly adapted to receive instructions, decode them, and implement them.

[0003] It would be desirable to be able to improve, at least in part, certain aspects of the protection of complex electronic circuits such as processors or microcontrollers. Summary of the invention

[0004] There is a need for more secure protection of complex electronic circuits, such as processors and microcontrollers.

[0005] There is a need for a module for monitoring instructions received by a complex electronic circuit.

[0006] There is a need for a module for monitoring instructions being processed by a complex electronic circuit.

[0007] One embodiment overcomes all or part of the drawbacks of the instruction monitoring modules.

[0008] One embodiment overcomes all or part of the drawbacks of the methods for monitoring instructions of a complex electronic circuit.

[0009] One embodiment overcomes all or part of the drawbacks of electronic devices comprising known complex electronic circuits.

[0010] One embodiment provides an instruction monitoring module of a microcontroller, adapted to verify instructions received on an input terminal of said microcontroller or instructions being processed by a code pointer of said microcontroller.

[0011] Another embodiment provides a method for verifying instructions of a microcontroller, implemented by a monitoring module, comprising a step of verifying the instructions received at an input terminal of said microcontroller. controller or instructions being processed by a code pointer of said microcontroller.

[0012] According to one embodiment, if the verification indicates that the instructions are valid then their reception or processing can continue.

[0013] According to one embodiment, if the verification indicates that the instructions are not valid then the microcontroller has entered an error mode, or a secure mode or a semi-secure mode.

[0014] According to one embodiment, the verification is implemented by a comparison of at least one piece of data corresponding to said instructions with a piece of reference data.

[0015] According to one embodiment, when the verification is a verification of the instructions received on said input terminal of said microcontroller, the reference data is equal to the data "OxFFFFFFFF".

[0016] According to one embodiment, when the verification is a verification of the instructions currently being processed by a code pointer of said microcontroller, the reference data is equal to the data "0xF0000002".

[0017] According to one embodiment, said input terminal of said microcontroller is a terminal for connection to a data bus.

[0018] According to one embodiment, the data bus is a communication bus of the Advanced High-performance Bus type.

[0019] According to one embodiment, the data bus is an Advanced Extensible Interface type communication bus.

[0020] According to one embodiment, said instructions come from a memory.

[0021] According to one embodiment, said memory is a non-volatile memory.

[0022] According to one embodiment, said memory is a flash type RAM.

[0023] Another embodiment provides an electronic device comprising a module described previously.

[0024] According to one embodiment, the device further comprises said microcontroller. Brief description of the drawings

[0025] These characteristics and advantages, as well as others, will be explained in detail in the following description of particular embodiments given without limitation in relation to the attached figures among which:

[0026] [Fig.l] represents, very schematically and in the form of blocks, an example of a device suitable for understanding the embodiments described below;

[0027] [Fig. 2] represents, very schematically and in the form of blocks, an embodiment of a first monitoring module; and

[0028] [Fig.3] represents, very schematically and in the form of blocks, an embodiment of a second monitoring module. Description of the embodiments

[0029] The same elements have been designated by the same references in the different figures. In particular, the structural and / or functional elements common to the different embodiments may have the same references and may have identical structural, dimensional and material properties.

[0030] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been shown and are detailed.

[0031] Unless otherwise specified, when referring to two elements connected to each other, this means directly connected without intermediate elements other than conductors, and when referring to two elements connected (in English "coupled") to each other, this means that these two elements can be connected or be connected by means of one or more other elements.

[0032] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "upper", "lower", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made unless otherwise specified to the orientation of the figures.

[0033] Unless otherwise specified, the expressions "about", "approximately", "substantially", and "of the order of" mean to within 10%, preferably to within 5%.

[0034] The embodiments described below relate to the security of complex electronic circuits such as processors and microcontrollers receiving instructions. The embodiments described below relate more particularly to a module for monitoring instructions received or being processed by a complex electronic circuit, and the corresponding instruction monitoring method.

[0035] The monitoring module is particularly suitable for verifying that an instruction received or being processed by the complex electronic circuit is valid. If such an instruction is not valid then said monitoring module interrupts the reception and / or processing of said instruction. The use of such a monitoring module makes it possible to avoid malicious attacks consisting of the substitution of valid instructions by invalid instructions making it possible, for example, to modify the operation of the complex electronic circuit.

[0036] [Fig. 1] is a block diagram representing, very schematically, an architecture of an example of an electronic device 100 adapted to understand the embodiments described in relation to FIGS. 2 and 3.

[0037] According to one embodiment, the device 100 comprises a complex electronic circuit 101 (MCU) adapted to implement different processing of data stored in memories and / or supplied by other circuits of the device 100. According to In one embodiment, the complex electronic circuit 101 is a processor or a microcontroller. In a preferred embodiment, the circuit 101 is a microcontroller.

[0038] According to one example, the device 100 may further comprise one or more memories 102 (MEM), for example memories of different types, including, for example, random access memory, non-volatile memory, volatile memory, and / or read-only memory. According to a preferred example, the device 100 comprises at least one non-volatile memory and / or flash-type random access memory.

[0039] According to one example, the device 100 may further comprise a secure element 103 (SE) adapted to process sensitive and / or secret data. The secure element 103 may comprise its own processor(s), its own memory(s), etc.

[0040] According to one example, the device 100 may further comprise input / output circuits 104 (IN / OUT) adapted to allow the device 100 to communicate with one or more external electronic devices.

[0041] According to one embodiment, the device 100 comprises a module 105 for monitoring instructions (MONITORING MODULE) received and / or being processed by the complex circuit 101. Two embodiments of the module 105 and their operations are described in detail in relation to figures 2 and 3.

[0042] According to one example, the device 100 may further comprise different circuits 106 (FCT2) adapted to perform different functions. For example, the circuits 106 may comprise measurement circuits, data conversion circuits, electronic or electromechanical equipment control circuits, etc.

[0043] According to one embodiment, the device 100 further comprises one or more data communication means 107 adapted to transfer data between the different electronic devices.

[0044] According to one embodiment, a means 107 used to transmit data and instructions to the complex circuit 101 is a communication bus of the Advanced High-performance Bus (AHB) type, i.e. an advanced high-performance bus intended for communication, via a single channel, of circuits within an electronic system on a chip.

[0045] According to another embodiment, a means 107 used to transmit data and instructions to the complex circuit 101 is a communication bus of the Advanced extensible Interface (AXI) type, that is to say an advanced extensible interface intended for communication, via several channels, of circuits within an electronic system on a chip.

[0046] [Fig.2] is a block diagram representing, very schematically, a monitoring module 201 (Monitoring MODULE), of the type of monitoring module 105 described in relation to figure 105, and a complex electronic circuit 202 (MCU), called hereinafter microcontroller 202, of the type of the complex electronic circuit 101 described in relation to [Fig.l].

[0047] The monitoring module 201 is adapted to monitor the instructions received by the microcontroller 202. More particularly, the monitoring module 201 is adapted to receive the instructions received that the microcontroller 202 receives via a data bus 203. According to one embodiment, the instructions come from a memory, such as, for example, a non-volatile memory or a flash-type RAM.

[0048] The monitoring module 201 is, furthermore, adapted to carry out a verification of these instructions to determine whether the instructions are valid or not. It is said here that a valid instruction is a correct instruction intended for the microcontroller, and that an invalid instruction is an instruction which is generated by a malicious person, and which is intended to obtain information on the operation of the microcontroller and / or to modify the behavior of the microcontroller.

[0049] According to one embodiment, the verification performed by the module 201 is a comparison of the received instructions with known invalid instructions. For this, the module 201 compares data forming the received instructions with reference data. According to one embodiment, the module 201 compares the data of the instructions with the hexadecimal data "OxFFFFFFFF".

[0050] If the result of the verification indicates that the instructions are valid, the module 201 does not interrupt the reception of the instructions by the microcontroller 202. Conversely, if the result of the verification indicates that the instructions are not valid, the module 201 can cause the microcontroller to enter an error mode or a secure or semi-secure mode, in which sensitive data, such as encryption and / or decryption keys, are made inaccessible. In addition, the module 201 can inform another module adapted to handle errors.

[0051] Thus, a monitoring method implementing the module 201 is as follows. Each time instructions are received by the microcontroller 202, a step of verifying these instructions is implemented by the module 201 to verify the validity of the instructions. The module 201 interrupts, or not, the reception of the instructions depending on the result of the verification.

[0052] [Fig. 3] is a block diagram representing, very schematically, a monitoring module 301 (Monitoring MODULE), of the type of monitoring module 105 described in relation to figure 105, and the complex electronic circuit 202 (MCU) described in relation to [Fig. 2].

[0053] The monitoring module 301 is adapted to monitor the instructions currently being processed by the microcontroller 202. More particularly, the monitoring module 301 is adapted to receive the instructions currently being processed by the microcontroller 202 begins decoding using its code pointer 2021 (PC). In fact, any instruction received by the microcontroller 202 is, firstly, decoded by the code pointer 2021, to then be effectively processed by one or more internal circuits of the microcontroller.

[0054] Like the module 201 of [Fig.2], the monitoring module 301 is, furthermore, adapted to carry out a verification of these instructions to determine whether the instructions are valid or not.

[0055] According to one embodiment, the verification performed by the module 301 is a comparison of the received instructions with known invalid instructions. For this, the module 301 compares data forming the received instructions with reference data. According to one embodiment, the module 301 compares the data of the instructions with the hexadecimal data "0xF0000002".

[0056] If the result of the verification indicates that the instructions are valid, the module 301 does not interrupt the decoding of the instructions by the code pointer 2021 of the microcontroller 202. Conversely, if the result of the verification indicates that the instructions are not valid, the module 301 prevents the decoding of the instructions by the code pointer 2021 of the microcontroller 202.

[0057] Thus, a monitoring method implementing the module 301 is as follows. Each time instructions are processed by the microcontroller 202, i.e. each time instructions are decoded by the code pointer 2021 of the microcontroller 202, a step of verifying these instructions is implemented by the module 301 to verify the validity of the instructions. The module 301 interrupts, or not, the reception of the instructions depending on the result of the verification.

[0058] Various embodiments and variations have been described. Those skilled in the art will understand that certain features of these various embodiments and variations could be combined, and other variations will occur to those skilled in the art. In particular, a monitoring module is also contemplated combining the properties of modules 201 of [Fig. 2] and 301 of [Fig. 3].

[0059] Finally, the practical implementation of the embodiments and variants described is within the reach of those skilled in the art from the functional indications given above.

Claims

Claims

1. Instruction monitoring module (105; 201; 301) of a microcontroller (101; 202), adapted to check instructions received on an input terminal of said microcontroller (101; 202) or instructions being processed by a code pointer (2021) of said microcontroller (101; 202).

2. Module according to claim 1, in which if the verification indicates that the instructions are valid then their reception or processing can continue.

3. A module according to claim 1 or 2, wherein if the check indicates that the instructions are invalid then the microcontroller has entered an error mode, or a secure mode or a semi-secure mode.

4. Module according to any one of claims 1 to 3, in which the verification is implemented by a comparison of at least one data item corresponding to said instructions with a reference data item.

5. Module according to claim 4, wherein, when the verification is a verification of the instructions received on said input terminal of said microcontroller (101; 202), the reference data is equal to the data "OxFFFFFFFF".

6. Module according to claim 4 or 5, wherein, when the verification is a verification of the instructions being processed by a code pointer (2021) of said microcontroller (101; 202), the reference data is equal to the data "0xF0000002".

7. Module according to any one of claims 1 to 6, wherein said input terminal of said microcontroller (101; 202) is a terminal for connection to a data bus (107; 203).

8. Module according to any one of claims 1 to 7, in which the data bus is a communication bus (107; 203) of the Advanced High-performance Bus (AHB) type.

9. Module according to any one of claims 1 to 7, in which the data bus is a communication bus (107; 203) of the Advanced Extensible Interface (AXI) type.

10. Module according to any one of claims 1 to 9, wherein said instructions come from a memory (102).

11. The module of claim 10, wherein said memory (102) is a non-volatile memory.

12. Module according to claim 10, wherein said memory (102) is a flash type RAM.

13. Method for verifying instructions of a microcontroller (101; 202), implemented by a monitoring module (105; 201; 301), comprising a step of verifying the instructions received at an input terminal of said microcontroller (101; 202) or the instructions being processed by a code pointer (2021) of said microcontroller (101; 202).

14. An electronic device comprising a module according to any one of claims 1 to 12.

15. Device according to claim 14, further comprising said microcontroller (101; 202).

Images