Hardware Execution Flow Protection Module for Microcontrollers

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for protecting microcontroller execution flow against attacks, such as fault injection and software bugs, are inefficient and vulnerable to the same attacks they aim to prevent, as they rely on additional software computations that impact performance and are not resilient against hardware attacks.

Innovation Solution

A hardware-based execution flow protection module that monitors memory access, predicts the next program counter value, and compares it with the actual value, using an interrupt module to respond to mismatches, thereby providing real-time protection without duplicating the entire program or instructions executed by the main microprocessor.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If additional software computations are used to protect execution flow, then execution flow protection is provided, but system performance deteriorates and code size increases

Engineering Contradiction:

Improveexecution flow protectionVSAvoidsystem performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent replaces software-based execution flow protection with a hardware-based protection module that operates in parallel to the microcontroller. The hardware module includes an instruction decoder unit, program counter predictor unit, and interrupt module that collectively monitor and verify execution flow without requiring additional software computations, thus maintaining system performance while providing robust protection

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent introduces a dedicated execution flow protection module as an intermediary between the microcontroller and the external environment. This module independently verifies execution flow integrity by comparing predicted program counter values with actual values, acting as a mediator that protects the system without interfering with the main execution path or requiring modifications to the protected code

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If additional software computations are used to protect execution flow, then execution flow protection is provided, but development time increases

Engineering Contradiction:

Improveexecution flow protectionVSAvoiddevelopment time

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The patent replaces complex software-based protection mechanisms with a dedicated hardware module that provides execution flow protection automatically. The hardware module is designed to work with standard microcontroller instruction sets without requiring developers to insert additional protective code, thereby reducing development time while maintaining protection effectiveness

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If software-based protection methods are used, then execution flow monitoring is achieved, but the protection is vulnerable to the same attacks

Engineering Contradiction:

Improveexecution flow monitoringVSAvoidvulnerability to attacks

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the execution flow protection function into a separate, independent hardware module that operates in parallel to the main microcontroller. This segmentation isolates the protection logic from the protected code, making it difficult for attackers to compromise both simultaneously. The module includes separate units for instruction decoding, program counter prediction, and interrupt generation that work independently to verify execution flow integrity

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The hardware protection module acts as an intermediary that independently verifies execution flow without being part of the protected code path. By using separate hardware components including an instruction decoder unit, program counter predictor unit, and interrupt module, the system creates a trusted monitoring path that is resistant to the same attacks that target the main execution flow

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS10223117B2Execution flow protection in microcontrollers

Publication Date: 2019.03.05 NXP BV

AI summary

An execution flow protection module (30) for a microcontroller (10) with a memory (24) and a microprocessor (20) is described. The module (30) is configured to monitor the memory (24) access of the microcontroller (10) to identify instructions fetched by the microcontroller (10) from the memory (24) for execution by the microprocessor (20). The module (30) comprises an instruction decoder unit (32) for determining a program counter value associated with the execution flow of the instructions fetched by the microcontroller (10); a program counter predictor unit (34) for predicting the program counter value of the next fetched instruction; and an interrupt module (40) for responding if the next instruction fetched by the microcontroller does not match the predicted program counter value.