Secure microprocessor including a system for allocating rights to libraries

The present invention relates to a microprocessor, and more particularly to a protected microprocessor.

Protected microprocessors are most commonly used in applications where access to certain sensitive data or programs needs to be banned. Thus, for example, smart cards are commonly provided in protected microprocessors to protect memory zones with sensitive codes and ciphertext algorithms.

[0003] Conventionally, a microprocessor confirms that a program being executed is entitled to address a memory zone for read, write, jump, or call operations. Protected by an address control system. This type of system is generally a rights assignment table that receives the identification code of the program being executed on the first input and the identification code of the addressed memory zone on the second input. .. The memory zone corresponds to the current address present on the microprocessor's address bus. If a running program is expected to have access to an addressed memory zone in a table, the table outputs an authorization signal. Otherwise, the table does not output a permit signal and an address violation signal is transmitted.

[0004] This type of address control system is used to obtain the protected coexistence of various programs within a microprocessor's memory array by assigning different rights to each of those programs. These various programs generally address different microprocessor applications planned by the manufacturer.

However, microprocessor protection divides the memory array into various mutually "sealed" parts, each part reserved for one application. In that respect, it has a negative effect on the configuration of the memory array. Nowadays, programs designed for different applications often have similar computational steps that can be centralized in a common area as a "library". A library, in one of ordinary skill in the art, refers to one or more subprograms shared by several programs.

[0006] The standard method of centralizing library-style program parts common to some programs is generally prohibited for protected microprocessors due to the safety issues it causes. ing. For example, the program PGA enjoys the right to access zone X in the memory array, and the program PGB Suppose you enjoy the right to access a zone "Y" that is different from the "X". Designing a subprogram shared by the program PGA and the program PGB raises the question of finding out which is the right to be granted to the subprogram. The subprogram must be able to read and write data in zone "X" when called into the program PGA and read and write data in zone "Y" when called into the program PGB. If there is, the subprogram must be given the combined rights of the program PGA and PGB, namely to zone X and zone Y. However, a program PGB, or a malicious program loaded in the location of the program PGB, may be able to use subprograms to access the zone X reserved for the program PGA and vice versa. Is also the same. Therefore, designing a subprogram shared by two programs with different access rights to the memory array is a violation of memory array partitioning.

[0007] The present invention attempts to overcome this drawback.

[0008] In particular, the present invention seeks to obtain means for providing subprograms shared by several programs without jeopardizing the integrity of the rights conferred on each of those programs. is there.

[0009] [Means for Solving Problems] An object of the present invention is to provide a rights allocation system for allocating a permanent access right to a zone of a memory array of a microprocessor to a program that can be executed by a microprocessor. Achieved by designing a protected microprocessor, the rights allocation system is such that for a subprogram shared by at least two programs, the subprogram may be called by one of those programs. It is provided with means for granting temporary access to the memory zone, and the scope of the temporary right is characterized by being a function of the program calling the subprogram.

[0010] According to one embodiment, the rights allocation system provides means for temporarily granting rights to a calling program to a subprogram.

[0011] According to one embodiment, the rights allocation system provides a means of further granting the subprogram a permanent right independent of the calling program.

[0012] According to one embodiment, the rights allocation system is designated by a program or subprogram identification code on the first input and by the current address flowing through the microprocessor's address bus on the second input. A rights assignment table laid out to receive the memory zone identification code and a means to enter the identification code of the program that called the subprogram in the first input of the rights assignment table while the subprogram is running. Be prepared.

[0013] According to an embodiment, the rights allocation system calls the executing subprogram's identification code and the subprogram into the first input of the rights allocation table during execution of the subprogram. A means for inputting the identification code of the program at the same time is provided.

[0014] According to an embodiment, the bit of the identification code of the subprogram being executed and the bit of the identification code of the program that called the subprogram are input to the first input of the rights assignment table. Previously combined by a logical function.

[0015] According to one embodiment, the rights allocation system has a first latch for storing the identification code of the program or subprogram being executed during execution of the instruction, and its input is first. A second latch that is connected to the output of the latch and is laid out to store the identification code of the program that is running when the microprocessor switches to the subprogram, forming the identification code of the program that called this subprogram. The second latch is reset when the microprocessor exits the subprogram.

[0016] According to an embodiment, the loading and reset of the second latch receives the current address flowing through the address bus at the input, and when the address of the first instruction of the subprogram is detected, the loading is performed. The signal is laid out to be input to the second latch, and when the address of the last instruction of the subprogram is detected, it is controlled by the address decoder which transmits the reset signal to the second latch.

[0017] According to an embodiment, the memory zone identification code specified by the current address and the identification code of the program and subprogram being executed receive the current address flowing through the address bus at the input. It is transmitted by the address decoder.

[0018] According to one embodiment, the rights sharing system signals a violation if the address present on the address bus does not correspond to a right that is permanently or temporarily assigned to a running program or subprogram. To send.

[0019] According to one embodiment, the violation signal is processed by an interrupt decoder to send the microprocessor to an address violation processing subprogram.

[Embodiments of the Invention] These and other objects, features and advantages of the present invention are given as non-limiting explanations for exemplary embodiments of the microprocessor according to the invention, provided in the accompanying figures. It will be described in more detail in the following description made with reference.

[0021] FIG. 1 is a block diagram of a microprocessor MP equipped with a read-only memory MEM1 (ROM), an electrically erasable programmable memory MEM2 (EEPROM), and a random access memory MEM3 (RAM). These various memories are connected to the microprocessor by address bus 1 and data bus 2, and together form a memory array of the microprocessor.

[0022] According to the present invention, the microprocessor MP includes a right allocation system 10 that grants variable access rights to subprograms as a function of the calling program.

The system 10 includes two address decoders DEC1 and DEC2 that are connected to the address bus at the input and receive the current address ADR circulating in the address bus. The decoder DEC1 outputs a code CIM of the following type for memory zone identification: CIM = b0 b1 ... bn bn + 1 ... bm where each bit identifies a given memory zone It is assigned and only one bit can be 1 at a time, the others will be 0.

[0024] Hereinafter, it is assumed that the bits b0 to bn are assigned to the designation of the memory zone composed of memory, and the bits bn + 1 to bm are assigned to the designation of the memory zone composed of data. The memory zone is located in memory MEM1, for example, and the data zone is located in memory MEM2 and MEM3.

Bits b0 to bn of the code CIM are input to the input of the latch LT1 driven by the loading signal LOAD1 output from the microprocessor MP. When the signal LOAD1 is input to the latch LT1, the output of the latch copies the input of the latch and outputs the code CIP1 for program zone identification.

[0026] The code CIP1 is input to the input of the second latch LT2 driven by the loading signal LOAD2 and the reset signal RST output from the decoder DEC2. When the signal LOAD2 is input to latch LT2, the output of latch LT2 outputs code CIP2, which is a copy of code CIP1 at that input.

[0027] The codes CIP1 and CIP2 are combined to form the resulting code CIP3, which is input to the input E1 of the rights assignment table TDA which receives the code CIM output from the decoder DEC1 at the input E2. In this embodiment, the coupling of codes CIP1 and CIP2 is provided by OR gate 11, and the output is code CIP3 equal to the bitwise OR of codes CIP1 and CIP2.

[0028] The right allocation table TDA has a basic output S.₀~ S_n Equipped with an output OUT consisting of each output S₀~ S_n Is the basic input E1 of the input E1 that receives one of the bits of the code CIP3₁, ..., E1n corresponds to the same rank. Output S₀~ S_nAllows bit a₀~ a_n The access right is output in the form of. Allow bit a_iIs the corresponding input E1_iBits equal to 1 bit b_iIs equal to 1 bit when is received, bit b_i Along with the allowed combination {b which is 1 bit_i, b_j} Is formed. Allowed combinations {b_i, b_j} Is finally recorded in the table and defines a permanent right.

[0029] The loading signal LOAD1 of the latch LT1 is transmitted from the microprocessor MP when the microprocessor MP reads or is about to read an instruction in memory MEM1 (microprocessor read cycle or fetch cycle). .. At that time, the address ADR existing on the address bus is the address IADR of the instruction transmitted from the order counter PC of the microprocessor. Therefore, the code CIM transmitted from the decoder DEC1 is the bit b that specifies the memory zone that has this instruction._i Or have one. This bit b_iIs found in code CIP1 recorded in latch LT1 and in input E1 of table TDA.

Further, the signal LOAD2 is transmitted from the decoder DEC2 when the decoder DEC2 detects the address ADRin of the first instruction of the shared subprogram on the bus 1, and the signal RST is the signal RST at the end of the shared subprogram by the decoder DEC2. When the instruction address ADRout is detected on the address bus, it is transmitted from the decoder DEC2. The addresses ADRin and ADRout are preset and represent the input and output addresses of the subprogram being considered. If several subprograms are shared by multiple programs, the decoder DEC2 will detect the input and output addresses of each subprogram and will send signal LOAD2 or signal RST if one of these addresses is detected. It is laid out to do.

The system 10 according to the present invention operates as usual during the execution of the program because the output of the latch LT2 is 0 and the code CIP3 input to the table TDA is therefore equal to the code CIP1. During program execution, after loading each new instruction, for example, when the instruction being executed is a read or write instruction in a memory array, the current address ADR of the address bus changes and moves into other zones of memory. Often specified. In this case, the value of the code CIM sent by the decoder DEC1 changes and specifies the corresponding memory zone, a different bit b of 1._jHave. Combinations entered in table TDA {b_i, b_j} If allowed, table output S_iRemains 1. Otherwise, output S_i Becomes 0 and the violation signal VLT becomes 1. After execution of this instruction, the address IADR of the new instruction is sent to the address bus for further changes in the code CIM and other combinations of code bits {b_i, b_j} Causes automatic validation in table TDA. If this address corresponds to a jump in the subprogram, the corresponding permission must be scheduled in the table TDA.

The operation of the system 10 according to the present invention differs from a standard address control system when the program has instructions for jumping or calling a shared subprogram. When the address ADRin of the first instruction of the subprogram is located on the address bus, the decoder DEC2 sends the signal LOAD2 and the latch LT2 records the code CIP1 before the microprocessor switches to the subprogram. When the microprocessor switches to a subprogram, the code CIP1 at the output of latch LT1 specifies the memory zone containing the subprogram, and the code CIP2 at the output of latch LT2 specifies the memory zone in which the program that called this subprogram specify. Thus, code CIP1 identifies the subprogram being executed, and code CIP2 identifies the program that called this subprogram.

Since the codes CIP1 and CIP2 are joined here in OR gate 11, the table TDA receives the code CIP3 at its input E1. This code CIP3 is bit b which is 1 instead of only 1 bit_iThe first bit corresponds to the subprogram being executed, and the second bit corresponds to the program that called this subprogram. Bit b corresponding to the calling program_iThe TDA application in the table TDA has code CIM bits and bits {b that are specific to its caller._i, b_j} Allows combinations. In this way, the called subprogram "inherits" the rights granted to the calling program during its execution. These rights transferred to the subprogram are in addition to the perpetual rights assigned to it. However, these rights may be chosen to be zero.

The system 10 according to the invention thus performs dynamic entitlement to the called subprogram, which is when the decoder DEC2 detects the output address ADRout of the subprogram and resets the code CIP2. , Exits when the microprocessor returns to the calling program.

[0035] In practice, the signal VLT transmitted in the event of a permanent or temporary breach of rights may be used in different ways to prevent access to prohibited memory zones. As shown in FIG. 1, the signal VLT is input to, for example, the input of the interrupt decoder ITDEC, the output of which sends the address ITADR of the subprogram that handles the case of address violations. The address ITADR is input to the input of the multiplexing device MUX that receives the address IADR of the next instruction transmitted from the rank counter PC at another input. The multiplexing device is driven by the signal IT transmitted from the decoder ITDEC, and when the signal IT is transmitted, it transmits the address ITADR to the address bus instead of the address IADR. In one alternative embodiment, the signal VLT is used to set the microprocessor reset signal (RESET) to 0 so as to deactivate the microprocessor. In another alternative embodiment, the signal VLT is used to generate an unmaskable interrupt.

[0036] The operation of the system 10 according to the present invention may be more clearly understood in view of the simple typical implementation shown in FIG.

FIG. 2 shows a microprocessor memory array, some memory zones reserved for applications and others strictly forbidden and shaded. This figure shows Zone A, where the program PGA is recorded, Zone B, where the program PGB is recorded, and the subprogram LIB shared by the program PGA and PGB. Zone C where (library) is recorded, data zone D reserved in read and write mode for the program PGA, data zone E reserved in read and write mode for the program PGB, subprogram LIB It shows the data zone F reserved for read and write modes, and the zone G available in read and write modes for the three programs PGA, PGB, and LIB. Zones A, B, and C are laid out in memory MEM1 (ROM), for example, zones D, E, and F are laid out in memory MEM2 (EEPROM), and zone G is laid out in memory MEM3 (RAM). As shown, the memory zone identification code CIM consists of seven code bits b0 to b6 assigned to identify zones A to G, respectively, and the code CIP1 and CIP2 for program zone identification are bits b0, respectively. It consists of b1 and b2.

[0038] In this example, the program PGA may require the subprogram to record the results of the calculation steps in zone D, and the program PGB may record such results in the subprogram in zone E. The subprogram LIB should benefit from the rights of the program PGA or PGB that calls this subprogram so that it can store temporary results, thanks to its permanent rights. Zones F and G can be used for.

[0039] In the prior art, the solution used to achieve this goal would have been to have the subprograms assign permanent rights to zones D and E, which is a memory array. It was to break the division wall of.

[0040] According to the present invention, when the microprocessor inputs a subprogram, the right to one of zones D and E is temporarily assigned to the subprogram as a function of the calling program.

[0041] To give a clearer image, FIG. 3 shows a typical embodiment of table TDA1 used to trigger such temporary allocation of rights. The table TDA1 has three horizontal lines LH0 to LH2, seven vertical lines LV0 to LV6, and three output lines LS0 to LS2. In order to make the following easy to understand, the bit of the identification code CIP1 of the program being executed is b0'to b2', and the bit of the identification code CIP2 of the program calling the subprogram is b0'to b2'.

[0042] The vertical lines LV0 to LV6 receive bits b0 to b6 of the code CIM, respectively. Line LH0 receives the result of the OR of bits b0'and b0'. Line LH1 receives the result of the OR of bits b1'and b1'. Line LH2 receives only b2'because bit b2'is still 0. Lines LS0 to LS2 output allow bits a0 to a2 coupled at gate 12 to form the signal VLT, respectively.

Permanent access to the memory array assigned to the program PGA, PGB, and subprogram LIB takes the form of MOS transistors Ti, j located at the intersection of the horizontal line LHi and the vertical line LVj. Transistors Ti, j located at the intersection of lines LHi and LVj are connected to line LHi by its gate, to line LVj by its drain, and to output line LSi by its source. Note that the intersection of line LH0 of the program PGA with its own memory zone A, zone C including subprogram LIB, and lines LV0, LV2, LV3, and LV6 that determine permanent rights to zones D and G. Transistors can be distinguished in (Fig. 2). This figure also shows the transistor at the intersection of line LH1 and lines LV1, LV2, LV4, and LV6, which determines the perpetual rights of the program PGB, and the subprogram LIB for line LH2 and program zones C and zones F and G. Shown is a transistor at the intersection of lines LV2, LV5, and LV6, which determine permanent rights.

The behavior of table TDA1 is regarding the assignment of permanent rights to the programs PGA, PGB, and LIB.<u style="single">As such</u>, Standard. Each output line LS0 to LS1 is held at 0 by a register, r1 to r3, respectively, and a bit whose transistor Ti, j connected to the output line by its source is 1 at its gate is placed at its drain. It becomes 1 when the logic "1" corresponding to the power supply voltage of the system is received.

Temporary and permanent rights assignments for subprograms occur when the microprocessor switches to subprograms. At that point, bit b2'in code CIP1 is 1. This activates the rights of the subprogram. In addition, bit b0 "or b1" in code CIP2 is also 1 depending on whether the subprogram was called by the program PGA or PGB. This keeps the rights of the program PGA or PGB in the benefit of the subprogram.

[0046] Naturally, the table TDA1 is open to various alternative embodiments within the skill of ordinary skill in the art, in particular the reverse logical configuration.

[0047] Further, although it has been proposed above to transfer the rights of the calling program to the subprogram, various alternative embodiments of the present invention have been devised with respect to the scope of the temporary rights assigned to the subprogram. Can be done.

[0048] As an example, FIG. 4 has vertical lines LV0 to LV6 similar to table TDA1, but receives bits b0', b1', b0 ", and b1", respectively, without logical coupling of these bits 4 The table TDA2 with the horizontal lines LH0 to LH3 of the book is shown. The transistors T and j at the intersection of the lines are schematically represented by the points connected to the output line, in this case the four lines LS0 to LS3, by arrows. Here, there is no horizontal line for assigning permanent rights to the subprogram LIB. Thus, in this example, these perpetual rights are none, but it is possible that they are not.

In table TDA2, lines LH0 and LH1 define permanent rights for programs PGA and PGB, and lines LH2 and LH3 invoked only by bits b0 and b1 give temporary rights for subprogram LIB. It differs from table TDA1 in that it is defined. Lines LH2 and LH3 are lines LH0 And unlike LH1, it is independent, so it is possible to assign a temporary right that is different from the permanent right of the calling program to the subprogram as a function of the calling program. Therefore, in the illustrated example, the transistors Ti, j are laid out so that the following assignments are made. To Program PGA: Rights to Program Zone A of Its Own, Rights to Program Zone C of Subprogram LIB, and Rights to Zone G To Program PGB: Rights to Program Zone B of Its Own, Programs of Subprogram LIB Rights to Zone C, and Rights to Zone G For the subprogram LIB when called by the program PGA: its own program Rights to Zone C, and rights to Zones E and G When called by the program PGB. For subprogram LIB: its own right to program zone C, and right to zones F and G [0050] Finally, in switching to the subprogram, the bits b0 "and b1" recorded by latch LT2 It is possible to assign special rights to subprograms by providing two special lines LH2 and LH3 to receive. These special rights are determined by the calling program and at the same time are independent of the rights of this program.

[0051] Further, in this example, the rights assignment depends only on the bits b0 "and b1" of the code CIP2, so that the rights assigned to the subprogram LIB can be called by any other program PGA and PGB. It can be seen that it can also be assigned to subprograms.

FIG. 5 shows table TDA3 similar to table TDA2, where line LH2 receives bit b0 combined with bit b2'by an AND gate and LH3 is bit by another AND gate. Receives bit b1'combined with b2'. In this case, line LH2 or LH3 can only be activated under the dual condition that bit b2'is equal to 1 and bit b0 "or b1" is also 1. Thus, the temporary transfer of rights is secured against the subprogram LIB, excluding any other subprogram.

[0053] The present invention is, of course, open to variants and alternative embodiments based on the principles of the present invention of the temporary transfer of rights to subprograms by storing the essence of the calling program. In particular, a cascading transfer of rights can be devised for the secondary level subprograms called by the primary level subprograms themselves called by the main program.

Finally, the embodiment of the rights assignment table further described above is shown in the form of a matrix circuit using transistors for the purpose of facilitating the understanding of the present invention, but the rights according to the present invention. It should be noted that the allocation table can actually assume some other form. In particular, this kind of table can be created in the form of Boolean logic circuits that are automatically created by the VHDL language compiler. The automatic creation of logic circuits from functions written in this high-level language has made great strides in recent years.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a block diagram showing a microprocessor provided with a rights management system according to the present invention.

FIG. 2 shows a memory array of microprocessors and illustrates an embodiment of a rights management system according to the present invention.

FIG. 3 shows a typical embodiment of the rights assignment table for the embodiment shown in FIG.

FIG. 4 is a schematic diagram of another typical embodiment of the rights assignment table according to the present invention.

FIG. 5 is a schematic diagram of another typical embodiment of the rights assignment table according to the present invention.

[Code description] 1 Address bus 2 Data bus 10 Rights allocation system 11 OR Gate 12 Gate LT1 Latch LT2 Second latch