Microcontroller configuration method
A method for configuring microcontrollers allows post-manufacturing modification of configuration option bytes using a secured startup program and authorization, addressing the inflexibility of current systems by enabling secure, post-manufacturing updates.
Patent Information
- Authority / Receiving Office
- FR · FR
- Patent Type
- Applications
- Current Assignee / Owner
- STMICROELECTRONICS INT NV
- Filing Date
- 2024-11-29
- Publication Date
- 2026-06-05
AI Technical Summary
Current microcontroller configurations, including security parameters and memory sizes, can only be modified during manufacturing and cannot be changed after production, limiting post-manufacturing flexibility and control.
A method for configuring a microcontroller that allows modification of configuration option bytes through a secured first stage of the startup program, using a monotonically increasing counter for authorization, enabling post-manufacturing changes under manufacturer control.
Enables post-manufacturing modification of microcontroller configurations, including security parameters, allowing activation of new features and maintaining manufacturer control through secure updates.
Smart Images
Figure 00000000_0000_ABST
Abstract
Description
Title of the invention: Method for configuring a microcontroller technical field
[0001] This description relates generally to microcontroller configuration methods as well as microcontrollers implementing these methods. Previous technique
[0002] Changing the security parameters of current microcontrollers can only be done during manufacturing steps, whether at the manufacturer's or a subcontractor's. Summary of the invention
[0003] There is a need to be able to modify the configuration of microcontrollers after their manufacture and in particular their security parameters or available memory sizes.
[0004] An embodiment overcomes all or part of the drawbacks of known configuration methods.
[0005] One embodiment provides a method for configuring a microcontroller, including permission to modify a register containing microcontroller configuration option bytes if: - a first stage of the microcontroller startup program, secured by the microcontroller manufacturer, is executed; and - a microcontroller program access authorization level corresponds to a microcontroller manufacturing state or a state where only a first stage of the microcontroller startup program is allowed.
[0006] According to one embodiment, a first program, secured by the microcontroller manufacturer, is read by said first stage of startup program and, if the authorization has been validated, the value of one or more option bytes of the register is modified according to instructions included in the first program.
[0007] According to one embodiment, said first stage of startup program is stored in a FLASH type system memory of the microcontroller.
[0008] According to one embodiment, when the first startup program stage is executed, then a first signal is set to a given value.
[0009] According to one embodiment, the first signal is set to a value of 0xA3 when the first startup program stage is executed.
[0010] According to one embodiment, the program access authorization level of the microcontroller is given by a monotonically increasing counter.
[0011] According to one embodiment, the zero value of the monotonic counter corresponds to the state where the microcontroller is being manufactured.
[0012] According to one embodiment, the value 1 of the monotonic counter corresponds to the state where only the first stage of the startup program is allowed.
[0013] According to one embodiment, the modification of the option bytes is allowed if the first signal has said given value and if the monotonic counter has the value zero or the value 1.
[0014] According to one embodiment, the first stage of the microcontroller startup program and the first program are secured with one or more security keys.
[0015] According to one embodiment, the register includes several categories of different option bytes to control the activation or deactivation of the same microcontroller configuration feature; a first category of option bytes being writable only during a production phase by the microcontroller manufacturer; and a second category of option bytes being writable, after production, if the authorization is validated.
[0016] According to one embodiment, prior to the authorization step, the first program is loaded into a download memory of the microcontroller.
[0017] According to one embodiment, after the first program is loaded, the microcontroller is reset.
[0018] According to one embodiment, said option byte values which have been modified are reset, after a given time, to their value before modification.
[0019] One embodiment provides a microcontroller, including a configuration option byte register, and configured to implement the configuration method described above. Brief description of the drawings
[0020] These features and advantages, as well as others, will be described in detail in the following description of particular embodiments, given by way of non-limiting example, in relation to the accompanying figures, among which:
[0021] [Fig.1] illustrates in a very schematic way and in block form, an example of a microcontroller of the type to which the described embodiments apply;
[0022] [Fig. 2] illustrates a method for configuring the microcontroller of [Fig. 1]; and
[0023] [Fig.3] illustrates a step in the process of [Fig.2]. Description of the implementation methods
[0024] The same elements have been designated by the same reference numerals in the different figures. In particular, the structural and / or functional elements common to the Different embodiments may have the same references and may have identical structural, dimensional and material properties.
[0025] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been represented and are detailed.
[0026] Unless otherwise specified, when referring to two elements connected together, this means directly connected without intermediate elements other than conductors, and when referring to two elements coupled together, this means that these two elements can be connected or linked through one or more other elements.
[0027] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "superior", "inferior", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made, unless otherwise specified, to the orientation of the figures.
[0028] Unless otherwise specified, the expressions "approximately", "roughly", and "on the order of" mean to within 10% or 10°, preferably to within 5% or 5°.
[0029] Fig. 1 illustrates in a very schematic way and in block form, an example of a microcontroller 100 of the type to which the described embodiments apply.
[0030] In the example shown, the microcontroller 100 includes a memory 104 (MEM1), for example non-volatile (NVM), for example of type FLASH memory or Phase change memory (PCM), capable of communicating, via a communication bus, with a non-volatile memory interface not shown configured to write or read data into and from the memory 104.
[0031] The microcontroller 100 further includes, for example, a processing unit 110 (CPU) comprising one or more processors under the control of instructions stored in an instruction memory not shown, which is, for example, a volatile random access memory (RAM).
[0032] The processing unit 110 and the instruction memory communicate, for example, via a system bus 140 (data, address, and control bus). The memory 104 is connected to the system bus 140, for example, via a memory interface (not shown) and an intermediate bus (not shown). The microcontroller 100 further includes, for example, an input / output (I / O) interface 108 connected to the system bus 140 for external communication.
[0033] In the example shown, memory 104 includes a register 105 for configuration options of the microcontroller IPENR1. Register 105 is, for example, 32 bits. The contents of register 105 control possible configurations IPI, IP2, IP3, IP4 etc. of the microcontroller 100. These configurations include, for example, security settings such as those related to cryptography, for example, hardware accelerators like SAES, CRYP, MCE, CCB, or RNG. These configurations also include settings related to the available memory size. Thus, depending on the bit value of the register, the accessible non-volatile memory can vary, for example, between 4 MB and 512 KB. The IPI, IP2, IP3, IP4... configurations can also relate to parameters such as CAN, LCD, JPEG, or HCD.
[0034] Each configuration is enabled or disabled based on the values of option bytes in a register 110 (User_OB1) that can be modified, for example, by a subcontractor. Each configuration can also be enabled or disabled based on the contents of another option byte register 111 (Engi_OB), which can be modified, for example, only during the production of the microcontroller 100.
[0035] The microcontroller 100 includes, for example, a memory 150 (MEM3), for example, non-volatile, of the FLASH or phase-change type. The memory 150 is, for example, the same as the memory 104. The memory 150 communicates with the other elements of the microcontroller 100, for example, via the system bus 140. The memory 150 is, for example, a system memory, that is to say, it contains, for example, memory sectors accessible only by the manufacturer of the microcontroller 100. Thus, the memory 150 includes, for example, a boot program 152 (ROT), root of trust, of the microcontroller, which cannot be updated after manufacturing. This is, for example, an immutable root of trust program which is executed first after a reset of microcontroller 100. Program 152 has an HDPL access permission level, which is associated, for example, with a monotonically increasing counter.The access authorization level takes, for example, a value of HDPL=HDPL0=0 when the microcontroller 100 is being manufactured. When the microcontroller 100 is in a state where only the first stage of the microcontroller's startup program is authorized, then HDPL=HDPL1=1, for example. When HDPL=HDPL1=1, then, in an example, only the ROT program 152 is executed. The state HDPL=HDPL1=1 is reached as soon as the microcontroller is at a customer's or subcontractor's site.
[0036] The microcontroller 100 includes, for example, a memory 111 (MEM2), for example, non-volatile, of the FLASH or phase-change type. The memory 111 is, for example, the same as the memory 104 or the memory 150. The memory 210 communicates with the other elements of the microcontroller 100, for example, via the system bus 140. The memory 210 includes, for example, memory locations 119 configured to receive elements (User_OB_update) received during updates. These elements received during updates are, for example, program images (files in .bin format, for example).
[0037] The microcontroller 100 can integrate other circuits implementing other functions (for example, one or more volatile and / or non-volatile memories, or other processing units), not shown in [Fig. 1]. Among these other circuits, the microcontroller 100 includes, for example, a read-only or static memory 118 (ROM).
[0038] The example in [Fig. 1] is limited with regard to modifying the IPI, IP2, IP3, IP4... configurations. Indeed, currently, only the manufacturer or a subcontractor can modify these configurations, which may concern security parameters. Once the microcontroller 100 has been put on the market and is no longer with the manufacturer or subcontractor, the USER_OB 1 and Engi_OB registers are no longer modifiable, thus preventing any subsequent modification of the IPI, IP2, IP3, IP4... configurations.
[0039] The described embodiments overcome these disadvantages by proposing a method for configuring the microcontroller 100, including modifying a register containing option bytes (User_OBl) for configuring the microcontroller if: - a first stage of the microcontroller's (100) startup program (ROT), secured by the microcontroller manufacturer, is executed; and - a microcontroller program access authorization level corresponds to a state among the microcontroller's manufacturing (HDPL0) or to a state where only a first stage of the microcontroller's startup program (HDPL1) is allowed.
[0040] This solution allows, under certain defined conditions and under the control of the manufacturer, the modification of the User_OBl option bytes, even after manufacturing, and even when the microcontroller 100 is at the end user's.
[0041] Such a solution allows the IPI, IP2, IP3, and IP4 configurations, linked for example to security parameters, to be modified under the manufacturer's control once the microcontroller 100 has been sold or is no longer with the manufacturer or subcontractor. This makes it possible to activate, throughout the microcontroller's life, configurations of the microcontroller 100 that are not activated at the factory, for example, when paying for an upgrade. Furthermore, this allows the microcontroller manufacturer to control configuration modifications, including, for example, security parameters of the microcontroller 100.
[0042] Figure [Fig.2] illustrates a method for configuring the microcontroller of Figure [Fig.1].
[0043] In a step 202 (DOWNLOAD User_OB_update AND LOAD User_OB_update IN MEM2), a User_OB_update program is downloaded and stored in memory space 119. The User_OB_update program includes, for example, instructions to update the User_OB_update option bytes of register 110 and reset the microcontroller 100. The User_OB_update program is, for example, in the form of one or more images.
[0044] In a step 204 (RESET), subsequent to step 302, the microcontroller 100 is reset.
[0045] In a step 206 (BOOT IN ROT AND READ User_OB_update), subsequent to step 204, the microcontroller 100 starts by executing the ROT program which is the first stage of the boot program which reads the instructions present in the User_OB_update program.
[0046] In a step 207 (User_OBl UPDATE AUTHORIZED), subsequent to step 206, authorization is obtained for register 110 to be accessible and writable so that the option bytes (User_OBl) can be updated. This authorization originates, for example, from the payment to the manufacturer for an upgrade by the end user, who is, for example, a professional or a subcontractor of the microcontroller.
[0047] In a step 218 (ROT UPDATES User_OBl INTO User_OB2), subsequent to step 207, the User_OBl option bytes are modified and a new version of the option bytes, called User_OB2, is obtained in register 110. The IPI, IP2, IP3, IP4... configurations are thus modified according to the content of the respective User_OB2 option bytes.
[0048] In a step 220 (RESET), subsequent to step 218, the microcontroller 100 is reset.
[0049] In a step 222 (MICROCONTROLLER BOOTS WITH User_OB2 CONFIGURATION), subsequent to step 220, the microcontroller 100 is again reset to restart the microcontroller 100 with the new configurations permitted by the User_OB2 option bytes.
[0050] In order for the manufacturer to be able to maintain control over updates to the configurations of the microcontroller 100 after manufacturing, step 207 contains specific features developed in [Fig.3].
[0051] Figure 3 illustrates a step in the process of Figure 2. More specifically, Figure 3 details an example of the implementation of step 207.
[0052] In the example of [Fig.3], step 207 includes, for example, several intermediate steps 208, 210, 212, and 214.
[0053] In step 208 (User_OB_update secured by manufacturer?), it is checked, for example with the ROT program, whether the User_OB_update program is secured by the microcontroller manufacturer. In one example, the User_OB_update program is considered manufacturer-secured if one or more security keys provided by the microcontroller manufacturer are used to, for example, sign the program. If the User_OB_update program is recognized as secure (branch Y), then one of the Steps 210 or 212 are then implemented. Otherwise (branch N), then step 213 (User_OBl UPDATE DENIED) is implemented.
[0054] In step 213, access to modify the byte values of User_OBl options is denied.
[0055] In step 210 (FIRST STAGE OF BOOT (ROT), SECURED BY MICROCONTROLLER MANUFACTURER, IS RUN?), it is checked whether the program that constitutes the first boot stage, for example the ROT program, is secured by the microcontroller manufacturer 100 and whether it is running. To do this, in one example, when the first boot stage ROT is secured and running, a first RSSACCDIS signal is set to a given value. In one example, the first RSSACCDIS signal is set to the value 0xA3 when the first boot stage ROT is secured and running. Thus, by checking the value of the first signal, it is possible to determine directly whether the running program is the manufacturer-secured boot program or whether the running program is another program, for example, one not secured by the manufacturer.When the program that constitutes the first boot stage, for example the ROT program, is secured by the microcontroller manufacturer 100 and is executed, then (branch Y) one of steps 208 or 212 is implemented. Otherwise (branch N) then step 213 (User_OBl UPDATE DENIED) is implemented.
[0056] In step 212 (HDPL=HDPL0 OR HDPL1?), if the monotonic counter HDPL has a value of zero or a value of 1, i.e., HDPL0, HDPL1, then (branch Y) step 214 (User_OBl_UPDATE AUTHORIZED) is implemented. If HDPL has a value other than zero or a value of 1, i.e., other than HDPL0 or HDPL1, then step 213 is implemented.
[0057] In step 214, modification of the User_OBl option bytes is permitted. In the illustrated example, steps 208, 210, and 212 are performed sequentially, but in other, unillustrated examples, they can also be implemented in parallel or in a different order, for example, 208 then 212 and 210, or 210 then 212 and 208, or even 212 then 208 and 210. To maximize manufacturer control, for step 214 to be implemented, it is preferable that all steps 208, 210, and 212 be validated (branch Y).
[0058] In an unillustrated example of the implementation of Figures 2 and 3, all or part of the User_OB2 option bytes resulting from the update of the User_OB1 option bytes are reset, after a given time, to their initial User_OB1 value prior to the update. This allows, for example, the manufacturer to authorize an upgrade of the microcontroller configuration for a given period, similar to temporary licenses.
[0059] Various embodiments and variants have been described. Those skilled in the art will understand that certain features of these various embodiments and variants could be combined, and other variants will become apparent to them. In particular, the value chosen for the first RSSACCDIS signal may be different from 0xA3, provided that it is not attainable by a simple perturbation, for example by using a high-entropy value.
[0060] Finally, the practical implementation of the described embodiments and variants is within the reach of a person skilled in the art, based on the functional specifications given above. In particular, with regard to steps 210 and 212, authorization to modify the User_OBl option byte register may be granted even if the program executed at ROT startup is not from the manufacturer, provided that it is secured by the manufacturer.
Claims
Demands
1. A method for configuring a microcontroller (100), comprising permission to modify a register containing microcontroller configuration option bytes (User_OBl) if: - a first stage of the microcontroller (100) boot program (ROT), secured by the microcontroller manufacturer, is executed; and - a microcontroller program access authorization level corresponds to a microcontroller manufacturing state (HDPLO) or a state where only a first stage of the microcontroller boot program (HDPL1) is allowed.
2. A method according to claim 1, wherein a first program (User_OB_update), secured by the microcontroller manufacturer, is read by said first boot program stage (ROT) and, if authorization has been validated, the value of one or more option bytes (User_OB1) of the register is modified according to instructions included in the first program (User_OB_update).
3. Method according to claim 1 or 2, wherein said first boot program stage (ROT) is stored in a FLASH type system memory of the microcontroller.
4. Method according to the preceding claim, wherein, when the first startup program stage (ROT) is executed, then a first signal (RSSACCDIS) is set to a given value.
5. Method according to the preceding claim, wherein the first signal is set to a value of 0xA3 when the first startup program stage (ROT) is executed.
6. A method according to any one of claims 1 to 5, wherein the program access authorization level (HDPLO, HDPL1) of the microcontroller is given by a monotonically increasing counter (HDPL).
7. Method according to the preceding claim, wherein the zero value of the monotonic counter corresponds to the state where the microcontroller is in manufacturing (HDPLO).
8. Method according to claim 6 or 7, wherein the value 1 of the monotonic counter corresponds to the state where only the first startup program stage (HDPL1) is allowed.
9. A method according to any one of claims 7 or 8 in their dependence on claim 4, wherein the modification of the option bytes (User_OBl) is permitted if the first signal (RSSACCDIS) has said given value and if the monotonic counter has the value zero or the value 1 (HDPLO, HDPL1).
10. A method according to any one of claims 2 to 9, wherein the first boot program stage (ROT) of the microcontroller and the first program are secured with one or more security keys.
11. A method according to any one of claims 1 to 10, wherein the register comprises several different categories of option bytes to control the activation or deactivation of the same configuration feature of the microcontroller (100); a first category (Engi OB) of option bytes being writable only during a production phase by the microcontroller manufacturer; and a second category of option bytes being writable, after production, if authorization is validated.
12. A method according to any one of claims 2 to 11, wherein, prior to the authorization step, the first program is loaded into a download memory (119) of the microcontroller.
13. A method according to the preceding claim, wherein, after the first program (User_OB_update) is loaded, the microcontroller is reset.
14. A method according to any one of claims 2 to 13, wherein said option byte values (User_OB2) which have been modified are reset, after a given time, to their value before modification (User_OB1).
15. Microcontroller, comprising a configuration options byte register (User_OBl), and configured to implement the configuration method according to any one of claims 1 to 14.