DE102019127856A1 - Procedure for safely booting a control unit and control unit - Google Patents

Abstract

Method for safely booting a control device, comprising a hardware security module (HSM) and a host, comprising the method steps:
a. Applying a voltage to the control device and at least partially booting the HSM;
b. Checking whether a flag associated with the HSM is set to a first value or a second value;
c. If the flag is set to the second value, performing an integrity and authentication check on software assigned to the control device; and if the flag is set to the first value, completing the boot of the HSM by transmitting a request from the HSM to the host to boot the host;
d. if the integrity and authentication check are positive, set the flag to the first value and reboot the HSM;
e. Check again whether the flag is set to the first value or the second value, if it is now recognized that the flag is set to the first value, completing the booting of the HSM by transmitting a request from the HSM to the host to boot of the host.

Description

The invention relates to a method for safely and quickly booting a control device and a control device, the control device comprising a hardware security module and a host.

Various ways are known from the prior art for providing a method by means of which the security and / or the speed during the boot process of the control device is to be increased.

In particular, sequential boot processes or parallel boot processes are known, but these can have weak points with regard to security.

It is therefore the object of the present invention to provide a method for safely and quickly booting a control device which, in particular, allows almost no manipulation during the booting process and yet allows the control device to be booted very quickly.

This object is achieved by a method according to claim 1 and a control device according to claim 10.

1. a. Anlegen einer Spannung an das Steuergerät und zumindest partielles Booten des HSM;
2. b. Überprüfen, ob ein dem HSM zugeordnetes Flag auf einen ersten Wert oder einen zweiten Wert gesetzt ist;
3. c. Falls das Flag auf den zweiten Wert gesetzt ist, Durchführen einer Integritäts- und Authentifizierungsüberprüfung einer dem Steuergerät zugeordneten Software; und falls das Flag auf den ersten Wert gesetzt ist, Vervollständigen des Bootens des HSM durch Übermitteln einer Aufforderung von dem HSM an den Host zum Booten des Host;
4. d. falls die Integritäts- und Authentifizierungsüberprüfung positiv ist, setzen des Flag auf den ersten Wert und Rebooten des HSM;
5. e. Erneutes überprüfen, ob das Flag auf den ersten Wert oder den zweiten Wert gesetzt ist, wobei falls nun erkannt wird, dass das Flag auf den ersten Wert gesetzt ist, Vervollständigen des Bootens des HSM durch Übermitteln einer Aufforderung von dem HSM an den Host zum Booten des Host.

The core concept of the invention is to provide a method for safely booting a control device, comprising a hardware security module (HSM) and a host, comprising the method steps:

1. a. Applying a voltage to the control device and at least partially booting the HSM;
2. b. Checking whether a flag associated with the HSM is set to a first value or a second value;
3. c. If the flag is set to the second value, performing an integrity and authentication check on software assigned to the control device; and if the flag is set to the first value, completing the boot of the HSM by transmitting a request from the HSM to the host to boot the host;
4. d. if the integrity and authentication check are positive, set the flag to the first value and reboot the HSM;
5. e. Check again whether the flag is set to the first value or the second value, if it is now recognized that the flag is set to the first value, completing the booting of the HSM by transmitting a request from the HSM to the host to boot of the host.

Partial booting of the HSM is to be understood to mean that at least the transmission of a request from the HSM to the host to boot the host is not carried out. This transmission of the request is only carried out when it has been recognized, for example by the HSM, more preferably by a processing unit of the HSM, that the flag is set to a first value.

The flag is to be understood as a bit structure, the bit structure comprising at least one bit. A first value and a second value of the flag can be understood to mean, for example, the values “true” and “false” or “1” and “0”. The first value refers to the value that the flag needs to boot the host. It is also conceivable to design the flag as an n-bit, where n equal to 8 is preferred. A bit shift is carried out each time the flag is set again, and the bit to be set is stored on the right in the n-bit. In this way, the bits last set in the flag can be checked. It is furthermore preferably also conceivable that a timestamp or timestamp is stored which indicates when a check of the flag was positive or negative. This can be used, in particular, to make a decision as to whether or not the control device may be released. A time stamp is particularly preferably stored for each bit that is set, or at least assigned uniquely or unambiguously.

If the flag is set to the second value, this is an indicator that the software can be manipulated. If the integrity and authentication check fails, the flag is set to the second value and the host is prevented from booting.

In particular, the integrity and authentication check checks whether the software is integer and whether the source is authenticated. It can also be checked whether new software is available.

In particular, the flag provides information as to whether the previous integrity and authentication check was positive or negative. If the integrity and authentication check have failed, it is likely that the checked software does not match the software that should be available; that is, the software could be tampered with.

Rebooting the HSM here means that the HSM is first partially booted, as in method step a. and a decision is made depending on the flag set.

According to a particularly preferred embodiment, it is provided that after checking and determining that the flag is set to the first value and before or during the transmission of the request from the HSM to the host to boot the host, the flag is set to the second value is set.

This means in particular that during or after the request to the host to boot the host is transmitted, the previously set flag, which according to the invention must be set to the first value for the transmission of the request, is now set to the second value again.

Furthermore, this means in particular that no manipulation from outside is possible during the host's boot process, since the flag is now set to the second value. Assuming that a change in the software were attempted during the boot process, an integrity and authentication check would be necessary according to the invention due to the flag, which now has the second value. Because the software has been manipulated, the integrity and authentication check turns out negative and the system is not released for the attacker.

According to a further preferred embodiment, it is provided that if in method step d. the integrity and authentication check is negative, the control unit is brought into a predefined state and the HSM is rebooted.

A predefined state is understood to mean a variety of things and can of course also be dependent on the type of control device, since control devices can be provided in different security classes and accordingly require different treatment in the event of attacks and changes to the software. For example, the drive train of a vehicle is to be assessed differently in terms of safety than the media unit of the vehicle. Of course, other examples are also conceivable here, from different areas in which control devices or generally embedded systems are provided.

The reboot of the HSM is accompanied by process step a. without applying a voltage, since a voltage has already been applied, so that the HSM is now partially booted again and the flag assigned to the HSM is checked again to determine whether the flag is set to the first value or the second value.

It is also conceivable that a counter is provided in the HSM, which is incremented after each failed integrity and authentication check and the process is interrupted at a specified number of counters in order to prevent further booting or rebooting of the HSM in order to further increase the risk minimize. It is also conceivable that the counter is reset when booting of the host is detected. This recognition can be recognized, for example, by the HSM when the request to boot the host is or has been transmitted to the host.

According to a further preferred embodiment, it is provided that after booting the host, the control device is in a normal operating state, with a cyclical integrity and authentication check of the software in the HSM being carried out during the normal operating state, with a negative integrity and authentication check being carried out the software, the flag is set to the second value and, in the event of a positive integrity and authentication check, the flag is set to the first value.

A “normal operating state” is to be understood as meaning that the control unit is in normal operating mode and works according to its stored software and dependent on higher-level and subordinate control units.

A “cyclical” integrity and authentication check is to be understood as a recurring integrity and authentication check which is carried out, for example, after a specified period of time and / or after certain parameters have been recognized.

According to a further embodiment, after the negative cyclical integrity and authentication check of the software, a renewed integrity and authentication check of the software is carried out, with a counter being incremented after each negative integrity and authentication check of the software and the control device in a defined state at a predetermined number of counters is brought.

The counter can be reset by recognizing a positive integrity and authentication check, for example by the HSM.

Since there are negative integrity and authentication checks several times in a row, it can be assumed that the software has been tampered with.

It is of course also advisable not to set the specified number of meters too high, because the longer the defective software is present, the greater the damage could be. It is preferred that the counter number 2 or 3 amounts to.

According to a further preferred embodiment, a renewed integrity and authentication check of the software is carried out after the positive integrity and authentication check.

A renewed integrity and authentication check is preferably carried out after a predetermined period of time.

A cyclical integrity and authentication check during the normal operating state or during runtime, depending on the outcome of the integrity and authentication check, sets the flag either to the first value or the second value, which means that when the normal operating state is terminated, whether there is an error in the software or not.

Assuming the flag is set to the first value and the normal operating state is ended, for example by switching off, the next time the HSM boots, it is recognized that the software is stored correctly, which means that the host's boot process continues immediately can be.

Assuming that the flag is set to the second value and the normal operating state is ended, the next time the HSM boots, it is recognized that the integrity and authentication check has failed and the software check has failed. Booting of the host is initially prevented according to the invention and the method is run through accordingly.

According to a further preferred embodiment, an extraordinary operating state can occur or be recognized during the normal operating state, which is caused by a software update, a further integrity and authentication check of the software update being carried out, the software update being installed after a positive integrity and authentication check, and an integrity and authentication check of the updated software is preferably carried out and, if the integrity and authentication check is positive, the flag is set to the first value and the HSM is rebooted; and after a negative integrity and authentication check of the software update, the software update is not installed and the control device is brought into a predefined state and the HSM is rebooted.

The extraordinary operating state, which is caused by a software update, is understood to mean that the control device or the HSM receives a request to update the software, so that this cannot correspond to the normal operating state or the operating time.

A request to update the existing software could of course also mean an attempt to manipulate the software. It is therefore intended to carry out an integrity and authentication check of the software update in order to be able to rule out manipulation.

If it is determined that the software update complies with the specifications, i.e. that there is a positive integrity and authentication check, it can be assumed that no attempt at manipulation has been attempted. The software update can therefore be installed, checked again and, if the check is positive, the flag can be set to the first value and the HSM rebooted.

If the integrity and authentication check are negative, a manipulation attempt is assumed and the software update is accordingly not installed. The control unit is brought into a predefined state and the HSM is rebooted.

It is preferably provided that no software update is installed during the normal operating state or the operating time. An update of the software is accompanied by changes that affect the runtime, so that an update during the runtime is not necessary.

According to a particularly preferred embodiment, the integrity and authentication check of the software is carried out by forming a hash value of the software by means of the HSM and a comparison with an original hash value of the software, which is provided in encrypted form and is decrypted by means of the HSM, the integrity and authentication check is positive if the hash value matches the original hash value.

The original hash value of the software is stored in an area of the software and is transmitted encrypted with the software by the OEM provider or the like. Decryption can be carried out, for example, by asymmetrical cryptosystems, that is to say for example using private keys and public keys, which are stored in the software and the HSM. Therefore, initially only the HSM can access and use the original hash value.

The HSM can also create a hash value for the software and compare this hash value with the original hash value. If the hash value formed and the original hash value match, there is a positive integrity and authentication check.

According to a further preferred embodiment, the hash value and the original hash value are stored in a hardware trust anchor. The hardware trust anchor can in particular be a memory area of the HSM or also a TPM (Trusted Platform Module) so that these values cannot be manipulated.

Likewise, it can preferably be provided that in a software update that is actually installed, the new hash values of the original hash value and the newly formed hash value replace the previous hash values.

A control device is also provided according to the invention, which is provided and suitable for performing the method according to the invention, comprising a voltage connection, an HSM and a host, the HSM comprising a memory with a flag stored therein and a computing unit, and the host at least one microcontroller comprises, wherein the HSM and the host are connected to one another for signaling purposes.

The memory of the HSM is also preferably designed as a hardware trust anchor for storing the original hash value and the hash value formed. A comparison of the original hash value and the hash value formed can preferably be carried out by the arithmetic unit of the HSM, with other arithmetic units, for example higher-level or subordinate ones outside the control unit, also being able to carry out this comparison. However, the calculation is particularly preferably carried out in the HSM. The hash value or the hash values are also preferably stored in the HSM.

Further advantageous embodiments emerge from the subclaims.

• 1 Verfahren gemäß einer besonders bevorzugten Ausführungsform;
• 2 zeigt einen Ausschnitt des Verfahrens gemäß einer bevorzugten Ausführungsform;
• 3 Steuergerät gemäß einer bevorzugten Ausführungsform.

Further objects, advantages and expediencies of the present invention can be taken from the description below in conjunction with the drawing. Here show:

• 1 Method according to a particularly preferred embodiment;
• 2 shows a section of the method according to a preferred embodiment;
• 3 Control device according to a preferred embodiment.

In the figures, the same components are to be understood with the corresponding reference symbols. For the sake of clarity, components in some figures may not be provided with a reference number, although they have been designated elsewhere.

In the 1 a method according to the invention can be seen in a particularly preferred embodiment.

The control device is particularly important for better visualization 1 , especially the microcontroller 1 of the control unit and the HSM on it 2 as well as a host 3 shows which parts of the control unit or the microcontroller are.

The respective procedural steps are in 1 either the HSM 2 or the host 3 assigned.

The method shown here according to an embodiment starts with a step S0, wherein a voltage 4th to the control unit 1 or the microcontroller 1 of the control unit and in particular to the HSM 2 is applied, whereby the HSM 2 automatically partially boots. Certain functions of the HSM are preferred here 2 released, for example access to a memory 5 (not shown here) and on a computing unit 6th (not shown here). It is particularly preferred in the memory 5 a flag is stored, which can have a first value or a second value.

In a subsequent step S1, it is checked whether the flag is set to the first value or the second value, preferably by means of the HSM 2 , and more preferably by means of the computing unit 6th of the HSM 2 .

If the flag is set to the second value, the procedure is continued with method step S2, in which an integrity and authentication check of the software is carried out, for example by comparing the original hash value of the software, which is stored in the software, with an established one Hash value of the software, which is preferably done by means of the computing unit 6th is calculated. It is also conceivable that the software's signatures are checked.

If it is established in a step S3 that the integrity and authentication check is negative, then in a step S5 the control device 1 with the HSM 2 transferred to a predefined state and the HSM 2 rebooted, shown in step S6. Rebooting means in particular that the HSM 2 is partially rebooted, as shown in step S0.

If, on the other hand, it is determined in step S3 that the integrity and authentication check is positive, the flag is set to the first value in a subsequent step S4 and the process continues with the further step S6, that is, rebooting the HSM 2 .

It should be noted here that the integrity and authentication check can also be carried out outside the HSM 2 can be carried out, for example on a superordinate or ancillary control unit. It should be noted that an integrity and authentication check can only be carried out before the software is flashed using another control device. As soon as the software has already been installed, no further checks can be carried out by an external control device.

If, however, it is recognized in step S2 that the flag is set to the first value, then the booting of the HSM is completed 2 by submitting a request from the HSM 2 to the host 3 to boot the host 3 continued in a step S2 '. In the subsequent step S10, the host becomes 3 is now booted and brought into a normal operating state in a step S11, which the control unit 1 can work normally, shown in step S12.

During the normal operating state, a cyclical integrity and authentication check of the software is carried out, shown in step S14. The cyclical integrity and authentication check is described in the following 2 shown in more detail.

It is also conceivable that a trigger occurs during the runtime or in the normal operating state 7th to the control unit 1 is transmitted with the request for a software update. One such trigger 7th could be an attempt at manipulation, so that this must be considered separately. The host 3 is based on the request by means of the trigger 7th brought from the normal operating state to an extraordinary operating state, represented by method step S15. The procedure subsequently continues with step S2, with the implementation of an integrity and authentication check of the software update.

If the integrity and authentication check is positive, the software update is installed and the original hash value stored in the software and the hash value formed by the new software are preferably stored in a hardware trust anchor and the previously stored hash values are particularly preferably overwritten.

Further back to the normal operating state, it is conceivable that the normal operating state is ended and therefore the control device 1 from the power supply 4th is separated (step S16).

In the 2 is the step S14 as section A of the 1 shown in more detail.

In a step S20, the computing unit 6th the hash value of the software is formed and it is checked in a step S21 whether the hash value formed matches the original hash value.

If the hash value that is formed does not match the original hash value, the flag is set to the second value and method step S22 is continued so that a new check takes place. A counter is preferably used in the event of a negative integrity and authentication check, shown here as a comparison between hash values 8th increments up to a certain count. If this count value is reached, the normal operating state is ended (step S13). Depending on the control device present, a change is preferably made to a predefined safe state. It is also conceivable that the normal operating state is terminated after the first negative integrity and authentication check. A counter 8th would therefore not be necessary here.

However, if the hash value formed agrees with the original hash value, the flag is set to the first value (step S22 ') and the process is then continued with method step S20. It is also conceivable that the (cyclical) test step is exited at this point and carried out again after a predetermined time has elapsed and / or after an event or trigger has occurred.

In the further 3 is a microcontroller 1 shown according to a preferred embodiment. The microcontroller 1 comprises: a hardware security module 2 , comprising a memory 5 and an arithmetic unit 6th , and a host 3 , comprising at least one microcontroller with further processing units 9 , and a power supply 4th .

In the memory, preferably designed as a hardware trust anchor (HTA) 5 In particular, the flag is stored in which the original hash values and the hash values formed can preferably be stored.

All features disclosed in the application documents are claimed as essential to the invention, provided that they are new to the state of the art, individually or in combination.

List of reference symbols

1

Control unit / microcontroller

2

Hardware security module (HSM)

3

Host

4th

Power supply, voltage

5

Storage

6th

Arithmetic unit

7th

Trigger

8th

counter

9

Arithmetic unit

Claims (10)

Method for safely booting a control device with a microcontroller (1), comprising a hardware security module (HSM) (2) and a host (3), comprising the method steps: a. Applying a voltage to the control device (1) and at least partially booting the HSM (2); b. Checking whether a flag assigned to the HSM (2) is set to a first value or a second value; c. If the flag is set to the second value, performing an integrity and authentication check on software assigned to the control device (1); and if the flag is set to the first value, completing the booting of the HSM (2) by transmitting a request from the HSM (2) to the host (3) to boot the host (3); d. if the integrity and authentication check are positive, set the flag to the first value and reboot the HSM (2); e. Check again whether the flag is set to the first value or the second value, and if it is now recognized that the flag is set to the first value, complete the booting of the HSM (2) by transmitting a request from the HSM (2 ) to the host (3) to boot the host (3). Procedure according to Claim 1 , characterized in that after checking and determining that the flag is set to the first value and before or during the transmission of the request from the HSM (2) to the host (3) to boot the host (3) the flag is set to the second value. Procedure according to Claim 1 or 2 , characterized in that if in process step d. the integrity and authentication check is negative, the control unit (1) is brought into a predefined state and the HSM (2) is rebooted. Method according to one of the Claims 1 - 3 , characterized in that after booting the host (3) the control device (1) is in a normal operating state, a cyclical integrity and authentication check of the software in the HSM (2) being carried out during the normal operating state, with a negative one Integrity and authentication check of the software the flag is set to the second value and in the case of a positive integrity and authentication check the flag is set to the first value. Procedure according to Claim 4 , characterized in that after the negative integrity and authentication check of the software, a renewed integrity and authentication check of the software is carried out, with a counter (8) being incremented after each negative integrity and authentication check of the software and the control unit ( 1) is brought into a defined state. Procedure according to Claim 4 or 5 , characterized in that a renewed integrity and authentication check of the software is carried out after the positive integrity and authentication check. Method according to one of the Claims 4 to 6th , characterized in that an extraordinary operating state can occur during the normal operating state, which is caused by a software update, a further integrity and authentication check of the software update being carried out, the software update being installed after a positive integrity and authentication check, the flag on the first value is set and the HSM (2) is rebooted; and after a negative integrity and authentication check of the software update, the software update is not installed and the control device (1) is brought into a predefined state and the HSM (2) is rebooted. Method according to one of the Claims 1 to 7th , characterized in that the integrity and authentication check of the software is carried out by forming a hash value of the software by means of the HSM (2) and a comparison with an original hash value of the software, which is provided in encrypted or unencrypted form and can be decrypted by means of the HSM (2) where the integrity and authentication check is positive if the hash value matches the original hash value. Procedure according to Claim 8 , characterized in that the hash value and the original Hash value can be stored in a hardware trust anchor. Control device (1) which is provided and suitable for performing a method according to one of the Claims 1 to 9 , characterized in that the control device (1) has a voltage connection, an HSM (2) and a host (3), the HSM (2) comprising a memory (5) with a flag stored therein and a computing unit (6), and wherein the host (3) comprises at least one processing unit, the HSM (2) and the host (3) being connected to one another for signaling purposes.

Images