TW201821998A - Memory protection logic - Google Patents

Abstract

A resettable microcontroller (1) comprising a processor (7), a memory (11, 13), a memory bus, and memory protection logic (9). The microcontroller (1) is arranged to clear a set of memory-protection configuration registers (26) whenever the microcontroller (1) is reset. The memory protection logic (9) is arranged to access the set of memory-protection configuration registers (26) and is configured to monitor memory access requests on the bus; detect when a memory access request attempts to access a memory address in a protectable region of the memory (11, 13); determine whether the memory access request satisfies an access criterion for the protectable region, the access criterion depending on data stored in the set of memory-protection configuration registers (26); block the memory access request when the access criterion is not satisfied; and prevent writing to any memory-protection configuration register (26) unless the memory-protection configuration register (26) is in a cleared state.

Description

 Memory protection logic  

The invention relates to controlling memory access on a microcontroller.

It is known to limit the reading, writing or execution of memory accesses on the microcontroller to prevent unauthorized access to data or programs.

Typically, in the prior art, certain trusted codes always have full access to restricted or unrestricted memory regions - for example, by having the processor on the microcontroller enter privileged mode and then access restrictions. Memory area.

Applicants recognize that this poses a security risk. For example, if an attacker is able to execute the attacker's own malicious code with the same elevated security permissions, the attacker can read sensitive data, such as an encryption key, from the restricted memory.

The present invention attempts to address this shortcoming.

The first aspect of the present invention provides a resettable microcontroller including a processor, a memory, a memory bus, and a memory protection logic, wherein the microcontroller is configured to be Clearing a set of memory protection configuration registers when the microcontroller is reset; the memory protection logic is configured to access the set of memory protection configuration registers and configured to: monitor memory on the bus An access request; detecting when a memory access request attempts to access a memory address in a protected area of the memory; determining whether the memory access request satisfies an access standard for the protected area The access standard depends on the data stored in the set of memory protection configuration registers; blocks the memory access request when the access criteria are not met; and prevents writing to any memory protection configuration The memory, unless the memory protection configuration register is in a cleared state.

Thus, it will be apparent to those skilled in the art that, in accordance with the present invention, access to a protected area of a memory can be safely restricted by storing an appropriate value in the set of memory protection configuration registers to limit or block the pair. Protects access to areas. Even when the processor is executing an instruction in secure or privileged mode, this limit cannot be overridden until the next reset by the microcontroller. This versatile mechanism thus allows programmers to be assured of increased security in many different situations.

For example, some embodiments allow a programmer to prevent all write access to a protected area of memory by storing a boot program that allows storage criteria to be stored in the set of memory protection groups whenever the microcontroller is reset. The state register is used to prevent write access to the area.

As another example, some embodiments allow the bootloader to read sensitive encrypted data from the protected area and use it to verify the integrity of the microcontroller, and thus, once the encrypted material has been used, the bootloader can set access. Standards to prevent any further read or write access to sensitive encrypted data until the next reset by the microcontroller.

It can be appreciated that the microcontroller reset can clear the set of memory by a hard weight setting mechanism (for example, by temporarily removing power to the RAM) or by writing a default value to the set of memory protection configuration registers. Body protection configuration register. Therefore, only when the memory protection configuration registers are cleared, they can be set to store access criteria for controlling access to the protected area.

In some embodiments, the microcontroller can also prevent modification of the configuration register by the peripheral device or even the bus master, and it can prevent or limit modification of the external debugger.

The write protection of the memory protection configuration register can be implemented by a rewrite controller within the memory protection logic. When there is a request to write to the memory protection configuration register, the rewrite controller can be configured to determine if the data contained in the configuration register is different from the cleared or default value. When the rewrite controller determines that there is a difference, the rewrite controller can be configured to block the write request. The rewrite controller can be configured to allow write requests when the rewrite controller determines that there is no difference.

Thus, the rewrite controller can provide access to the bootstrap program to set access criteria in the set of memory protection configuration registers after the microcontroller is reset.

The protectable area may be defined by one or more values stored in the set of memory protection configuration registers. For example, the base address of the protected area can be stored in one of the memory protection configuration registers. Another memory protection configuration register can store the end address or length of the protected area. The protectable area may be defined by a single memory address range or may comprise a plurality of memory address ranges or blocks of memory.

The values stored in the memory protection configuration register may define complex protected areas in the memory, each of which may have one or more associated access criteria. Logic can be set to resolve conflicts at regional overlaps. Preferably, conflicts are resolved by preventing access to the area if at least one configuration register is set to prevent zone access (even if another register allows access).

The access criteria may indicate or determine the type of memory access request that is allowed for a protected area. In some embodiments, it may indicate one or more of read access, write access, erase access, and execute access allowed for the protected area (or conversely, it may indicate such a save Take is prohibited). In some embodiments, the access criteria may additionally or alternatively require the processor or microcontroller to be in one of a set of specific states, such as in a secure mode or a privileged mode, or an access request from an external debugger, To allow access to protected areas. In some embodiments, an area may be associated with a configuration register associated with a secure mode access grant and an additional configuration register associated with a non-secure mode access grant. The access criteria may additionally or alternatively require that the memory access request be generated by instructions stored in a particular area of one or more memories on the microcontroller. The access criteria may additionally or alternatively require that the memory access request be generated by one of a particular set of components, such as by a processor, or by a particular peripheral device (eg, a serial interface, a digital to analog converter) Or a service unit such as an external debugger or a peripheral device group. In some embodiments, the access criteria may additionally or alternatively require the access request to have a secure or privileged state, or it may be associated with a particular program (eg, a firmware or third party software program).

Preferably, for at least one or more of the memory protection configuration registers, the value of the configuration register in the clear state represents a looser access than represented by a substitute value or any other value. For example, a clear value (eg, a zero bit) may define unrestricted access to a particular memory access type (eg, read access when processing gas is in an unsecured state), and a substitute value (eg, one bit) Meta) represents a blocked access of a particular memory access type.

The memory protection logic can be configured to block memory access requests by triggering bus fault exceptions.

The memory protection logic is preferably configurable to detect memory access instructions regardless of their source, ie from any bus master. This allows it to be used to detect direct memory access (DMA) instructions from peripheral devices (such as from an external debugger), as well as instructions from the processor.

The memory protection configuration register is preferably addressable by a processor, for example, via a memory bus. Preferably, it can be written to and/or read by the processor. In this way, the boot program can set the configuration register after resetting. Each register can occupy a contiguous area of memory or can be split at multiple locations. A scratchpad as used herein may be a unit long (possibly within a larger bit field) or may contain a plurality of bits (e.g., a 32-bit word).

The memory on the microcontroller can store one or more software components, such as bootloaders and/or firmware modules and/or user applications. The processor is preferably configured to execute instructions from a predetermined memory address after resetting - preferably before executing any other instructions. In some embodiments, the bootstrap program is stored at the predetermined memory address, which may be in a protectable area of the memory. The boot program can include instructions for writing an access standard to one or more memory protection configuration registers to prevent writing to the predetermined memory address and/or to a protected area containing the boot program . In this way, the boot program can be read-only, which enhances the security of the microcontroller. In particular, this prevents an attacker from modifying the bootstrap to prevent it from writing the correct access criteria to the memory protection configuration register after the next reset.

In some embodiments, the memory protection logic can also be configured to access a set of memory protection configuration registers for non-secure mode write protection. These non-secure mode write-protected memory protection configuration registers can function like other memory protection configuration registers, ie they define and control access to one or more protected areas of memory. . However, the rewrite controller is preferably configured to allow the processor to change the non-secure mode write protected memory protection configuration register any number of times while the processor is in the secure mode, without resetting the micro control Device. Preferably, when the processor is not in the secure mode, the rewrite controller blocks writing to the memory protection configuration register of the non-secure mode write protection unless it is in the cleared state. Like other memory protection configuration registers, the memory protection logic can be configured to determine whether the memory access request is based on data stored in the memory protection configuration register of the set of non-safe mode write protections. Meet the access criteria. The memory protection logic can block memory access requests when the access criteria are not met. It may be desirable to have this non-secure mode write protected memory protection configuration register as it can be used by the software rather than just the bootloader and can be changed during normal operation of the device (as long as the processor is in safe mode) in).

In one set of embodiments, the non-secure mode write protected memory protection configuration register is used to store access criteria that are executed when the processor is in non-secure mode but are not executed when the processor is in secure mode. . In some of these embodiments, a standard memory protection configuration register (for which the processor is rewritten in either safe mode or non-secure mode) is used to store access standards regardless of the processor Both safe mode and non-secure mode are executed.

The memory (including one or more protectable regions) may comprise an electrical and/or non-electrical memory such as RAM and/or flash memory. The memory can store the code. The memory is preferably addressable by the processor through the memory bus. The memory protection configuration register may include non-electrical memory (eg, flash), but preferably includes an electrical memory because it is exempt from the memory protection configuration temporary memory after resetting. Special circuit for the device.

The processor can be any suitable processor. In some embodiments, it may be a processor from the ARM ^TM, such as a processor from Cortex ^TM family of ARM ^TM. In the secure mode as used herein may in some embodiments according to the specifications of the ARM ^TM TrustZone ^TM secure mode or state. The microcontroller can include one or more other processors connected to the memory bus.

The memory bus can be an address or an instruction bus that can carry both instructions and data. The microcontroller can include a plurality of busses, such as a processor bus or a peripheral bus. The memory protection logic can be configured to monitor memory access instructions on the plurality of busses.

The memory protection logic preferably operates independently of the processor. It preferably includes a different logic gate separate from the processor. Accordingly, a malicious or unintentional programmer cannot execute a code that bypasses the memory protection logic on the processor. For the same reason, the memory protection logic is preferably entirely hardware-based, that is, it does not include a general purpose processor for executing software instructions. Preferably, the rewriting controller within the memory protection logic is also partially or wholly hardware based, that is, includes a different logic gate than the processor. It should be understood that the memory protection logic is not limited to any particular physical shape or location on the microcontroller, and may include any number of separate logical components.

The microcontroller is preferably an integrated device, for example integrated on a crucible. In some embodiments, it may include a radio transmitter or receiver, such as a so-called on-wafer radio. Viewed from another aspect, the present invention provides an integrated radio device including the microcontroller as disclosed.

1‧‧‧Microcontroller

3‧‧‧ clock logic

5‧‧‧Power Management Circuit

7‧‧‧ Processor

9‧‧‧ Memory Protection Logic

11‧‧‧RAM

13‧‧‧Flash memory

15‧‧‧ Peripherals

17‧‧‧ Radio Communication Logic

18‧‧‧Debugging interface

19‧‧‧Input/Output Circuit

20‧‧‧Flash Memory Controller

22‧‧‧Reset event

24‧‧‧ Bootstrap

26‧‧‧Memory Protection Configuration Register

BRIEF DESCRIPTION OF THE DRAWINGS Some preferred embodiments of the present invention are illustrated by way of example with reference to the accompanying drawings in which: FIG. 1 is a schematic diagram of a microcontroller of the present invention; and FIG. 2 is a rewrite control in a memory protection logic of a microcontroller A schematic diagram of the operations taken by the device; and FIG. 3 is a flow chart showing some examples of the startup sequence of the microcontroller of FIG. 1 along with the access request procedure.

Figure 1 shows an integrated circuit microcontroller 1 or a radio-on-a-chip that includes a crystal oscillator that can include a resistor-capacitor oscillator and/or can be external to the wafer (not shown) Clock logic 3 for receiving input, power management circuit 5, processor 7 (such as ARM ^TM Cortex-M0), memory protection logic 9, RAM 11, flash memory controller 20, flash memory 13, Radio communication logic 17, one or more peripheral devices 15, and input/output circuits 19.

These components are interconnected using appropriate wires and/or bus bars (not shown). The microcontroller 1 can use the Harvard architecture or Feng. Von Neumann architecture. The memory protection logic 9 is configured to block all memory accesses to the RAM 11 and to the flash memory controller 20. Therefore, the memory access instructions from the processor 7 and the peripheral device 15 are intercepted by the memory protection logic 9.

The microcontroller 1 also has a debug interface 18 which can be used to load data into the flash memory 13 and to debug the processor 7. It is expected that the debug interface 18 will be completely disabled before the microcontroller 1 is shipped to the end user. The microcontroller 1 can include a configurable mechanism for limiting or blocking access to the flash memory 13 and RAM 11 from the debug interface 18.

In use, the microcontroller 1 can be connected to a number of external components such as a power supply, a radio antenna, a crystal oscillator, a sensor, an output device, and the like.

The memory protection logic 9 can be configured such that the flash memory 13 has at least one memory protected area and at least one memory unprotected area. (These) protected areas store firmware data and code, as well as a bootloader. (These) unprotected areas store third-party software. In other embodiments, the third party software may also be stored in the protected area. The memory protection logic 9 can also be configured such that the RAM 11 has at least one protected area and at least one unprotected area.

Access to a given area (e.g., protected area) of flash memory 13 or RAM 11 is controlled by memory protection logic 9 and is granted only if the access criteria for that area are met. The access criteria may define the protected area of flash memory 13 or RAM 11 (eg, by memory start address and length values) and may specify system programs (eg, firmware for each read, write, and execute operation). Whether the program or software program) and peripheral device 15 are granted access to that memory area. In some embodiments, access to the erase function can also be directly controlled by the access criteria. When the override register is set, the debug interface 18 can override the memory protection logic 9 (unless the debug of the microcontroller 1 is disabled), but with the exception of this configuration The protection applies to all components of the memory bus.

The access criteria are stored in at least one memory protection configuration register 26. The memory protection configuration register 26 can be part of the RAM 11 memory or flash memory 13. In this embodiment, they are part of the RAM 11. This is advantageous because it ensures that the memory protection configuration register 26 is immediately cleared when the microcontroller 1 is reset. If the memory protection configuration register 26 is part of the flash memory 13, the microcontroller 1 (e.g., the flash memory controller 20) would need to be configured to automatically erase when the reset event 22 occurs. One or more flash memory blocks are associated with the memory protection configuration register 26.

There may be a complex array of memory protection configuration registers 26, each group having an additional protected area. For example, a set of memory protection configuration registers 26 may have a start address register and a size register for defining a protected area, for enabling or disabling the area in a secure mode. enabled or disabled in the secure mode can be written into Dual performing an access flag, it applied to binary enabling or disabling the security mode can be accessed in the reading area of the flag, for the region of enter into dual access flag for enabling or disabling the non-secure execution mode, you can access the area of a binary flag for enabling or disabling energy in a non-secure mode to the region A binary flag for read access, and a binary flag for enabling or disabling write access to the region in non-secure mode. In one set of embodiments, there are eight such sets of memory protection configuration registers 26. Each binary flag can be treated as a separate register, or a group of flags (such as all security mode flags, or all non-secure mode flags, or all secure and non-secure mode flags) can be treated together as a single Register.

In some embodiments, a clear value (eg, "0") in the binary flag indicates that the individual region allows the associated access type. Therefore, a substitute value (e.g., "1") is written after the reset to the binary flag to restrict access to the area.

The memory protection logic 9 has read access to the memory protection configuration register 26. A rewrite controller forms part of the memory protection logic 9. When the memory protection logic 9 intercepts a request to write to the memory protection configuration register 26, the rewrite controller is configured to determine whether the memory protection configuration register 26 is in a cleared state or contains Clearing or different data with the default value - that is, it determines whether the register 26 has been written since the last reset. When the rewrite controller determines that there is a difference, the rewrite controller is configured to block the request to modify the configuration register 26. When the rewrite controller judges that there is no difference, the rewrite controller allows the configuration register 26 to be written. In this manner, the rewrite controller ensures that the memory protection configuration register 26 is only written once after each reset. If the clear value represents a looser setting, the overwrite controller prevents the software from relaxing the memory access restrictions by reverting the scratchpad to a clear value.

Therefore, it can be understood that when the microcontroller 1 is started after resetting the event 22 (for example, after manually restarting the device, after installing a new battery into the device, or when the watchdog timer triggers resetting, etc.), the memory The body protection configuration register 26 is cleared and the bootstrap software has write access to the configuration register 26. More generally, each time the microcontroller 1 begins executing from address zero, the memory protection configuration register 26 will be reset. Normally, the bootloader will then write the appropriate value to the memory protection configuration register 26, which will have the effect of preventing any other software on the device from making any changes to those registers 26. If the boot program does not need to be configured, such as the configuration register 26 can support a large number of different protection areas (for example, it only needs to define five areas, and the register 26 can support eight areas), the boot program is preferably One or more of the zone settings are copied from the configuration register 26 of the spare group to prevent them from being written by any other software until the next reset. Therefore, the attacker can be prevented from using the malicious code to change the memory protection configuration register 26 to change the access standard, and thereby access the protected area of the memory. Similarly, errors in the non-malicious code are prevented from being unintentionally written into the protected area of the RAM 11 or the flash memory 13.

The bootloader itself (including its data) can be stored in an area of the flash memory 13, and the bootloader can immediately write to protect the area after resetting. This prevents any other software from inadvertently or maliciously manipulating the bootstrap to prevent it from setting the correct access criteria after each reset.

The processor 7 can have a safe operating mode and a non-secure operating mode. In general, the rewrite controller in the memory protection logic 9 prevents rewriting to the configuration register 26 even if the processor 7 is in the secure mode. However, in some embodiments, when the processor 7 is in the secure mode, the rewrite controller allows rewriting of a particular scratchpad (which may be a binary flag) with respect to the non-secure mode license (but its total) It is to prevent the rewriting of the binary flag regarding the security mode license).

Figure 2 illustrates in more detail the various main operations of the rewrite controller in the memory protection logic 9.

When the memory protection logic 9 receives a "reset" signal from the processor 7, all of its configuration registers are set to a default value - for example, for a word length register, set to 0x0000 0000 (with Zero 32-bit words), or a scratch for a single bit is set to zero.

When the memory protection logic 9 detects a memory access attempt, it determines if the attempt is to write to the secure configuration register (i.e., the scratchpad with respect to the processor in the secure mode). If yes, it checks if the value of the safety configuration register is a default value. If it is a default value, it allows writing; otherwise, it rejects writing (for example by triggering a "bus fault" exception).

If the memory access attempt is not to configure the scratchpad for security, the memory protection logic 9 determines whether the attempt is written to the non-secure configuration register (ie, there is permission for the processor in the non-secure mode) Register). If so, it checks a line from processor 7 indicating whether processor 7 is in a safe or non-secure state and determines that processor 7 is currently in the state. If the processor 7 is in a safe state, the rewrite controller allows writing. If the processor 7 is not in a safe state, the rewrite controller checks if the value of the non-secure configuration register is a default value. If it is a default value, write is allowed; otherwise, it refuses to write (for example, by triggering a "bus fault" exception).

Figure 3 illustrates the operation of the microcontroller 1 after resetting, along with how the memory protection logic 9 responds to the software program running from the unprotected areas of the memory 11 and 13 from the memory 11 and 13 Some examples of data access requests for the area running firmware program and peripheral devices 15.

When the microcontroller 1 is reset, the memory protects the configuration register 26 and the boot program 24 is initiated in step 200 to begin the boot sequence. The boot program 24 is stored at a special address, which is the first address that is executed after the processor 7 is reset. The boot program 24 can thus be executed before any software program or firmware program makes a data access request. In step 202, the bootstrap program 24 reads its own data, representing the desired access criteria, as well as the encrypted data directly from the upcoming protected area of the flash memory 13, and performs an integrity check with the encrypted data. Make sure that the microcontroller 1 is not destroyed. At step 204, the boot program 24 then issues a write request to write the access criteria to the memory protection configuration register 26. The write request is intercepted by the memory protection logic 9 and processed by the rewrite controller within the memory protection logic 9. The rewrite controller determines if the requested configuration register 26 is in the cleared state. This step is accomplished by reading the register 26 as described above. However, in other embodiments, the rewrite controller may check one or more different flags representing the state of the configuration register 26 (e.g., indicating whether they have been written).

In the example of Figure 3, the requested configuration register 26 is found to be in its cleared state from step 206 because the microcontroller is booted from the reset event. Thus, at step 206, the boot program 24 is allowed to write access criteria to the requested configuration register. Preferably, the access criteria define the area in which the encrypted data is taken from and indicates that the data cannot be read or written again. Read protection is especially valuable if the encrypted data includes private key data. They can also be written to protect areas that contain the bootloader itself. At this stage, the bootloader can also define other protected areas - for example, to protect the firmware code from being overwritten. Therefore, the protection of these memory areas is effective until the next reset.

It should be understood that once these configuration registers 26 have been written, they will no longer be in a cleared state, so the memory protection logic 9's rewrite controller will not allow any writes to those configuration registers. 26 further requests. Accordingly, the data in the configuration register 26 is protected from being changed until the next reset. In addition, by using the hardware rewrite controller to determine if the configuration register 26 is in its clear state, all write requests or peripherals from any type of program (eg, security or protection) are rejected and cannot be This mechanism is bypassed by software.

Once the boot program 24 completes the write access criteria to the configuration register 26, the memory protection logic 9 manages (i.e., grants or denies) all memory access requests in accordance with the access criteria.

In step 210, a third-party software program running from a code stored in the unprotected area of the flash memory 13 sends a write request to write to the protected area of the flash memory 13, followed by reading from the same Request for information on protected areas. These requests are intercepted and processed by the memory protection logic 9. At step 212, the memory protection logic 9 retrieves access criteria for the requested region of the memory from the memory protection configuration register. The access criteria indicate which operations (eg, write, read, or execute) of the protected area of the memory are allowed. In this example, the access criteria indicate that the software program is not allowed to write data to the protected area of the memory, but allows it to read data from the protected area. Accordingly, based on the access criteria, the memory protection logic 9 rejects the write request at step 214 and allows the read request at step 216. This prevents the software program from being unintentionally or maliciously written to the protected area of the memory (eg, the location of the protected memory assigned to the firmware data and code), thereby increasing robustness and security. The memory protection logic 9 can trigger a "bus fault" exception when access is denied.

At step 220, a request to write the access standard to the memory protection configuration register 26 is sent from the secure mode firmware program running on the code stored in the protected area of the flash memory 13. The memory protection logic 9 intercepts the request. The rewrite controller in the memory protection logic 9 determines that the data in the requested configuration register 26 is different from the clear state - this is because the boot program has been written to the configuration temporarily during the reset sequence after the reset. Memory 26. Accordingly, at step 222, the memory protection logic 9 rejects the write request.

In step 230, the peripheral device 15 attempts to read data from the protected area of the flash memory 13 through a direct memory access (DMA) request. This request is intercepted by the memory protection logic 9. At step 232, the memory protection logic 9 retrieves access criteria from the memory protection configuration register 26 regarding the requested memory region. The access criteria indicate whether the peripheral device 15 is allowed to read the data in the requested memory region. In this example, the access criteria indicate that the peripheral device 15 is not allowed to read the data and thus the memory protection logic 9 rejects the read request by triggering a bus fault exception.

At step 240, peripheral device 15 sends a request to write access criteria to memory protection configuration register 26. The memory protection logic 9 intercepts the request. The rewrite controller determines that the data in the requested configuration register 26 is different from the clear state - this is because the boot program has been written to the configuration register 26 during the reset sequence after the reset. Accordingly, in step 242, the memory protection logic 9 rejects the write request.

Thus, the described device has a versatile memory protection mechanism that can be used for a variety of purposes, and it employs hardware logic to allow the device to use a trusted boot program to prepare access permissions during a controlled boot sequence. The boot order or licensing scheme cannot be changed after the malicious code.

Claims (15)

 A resettable microcontroller comprising a processor, a memory, a memory bus, and a memory protection logic, wherein: the microcontroller is configured to clear a set of memory each time the microcontroller is reset Protecting the configuration register; the memory protection logic is configured to access the set of memory protection configuration registers and configured to: monitor memory access requests on the bus; detect when a memory is stored Retrieving a request to access a memory address in a protected area of the memory; determining whether the memory access request satisfies an access criterion for the one of the protectable areas, the access criterion being dependent on the group being stored in the group Memory protection configuration data in the scratchpad; block the memory access request when the access standard is not met; and prevent writing to any memory protection configuration register unless the memory protection configuration is temporarily The memory is in a cleared state.    The resettable microcontroller of claim 1, wherein the memory protection logic includes a rewrite controller configured to determine when there is a request to write to a memory protection configuration register Whether the material contained in the memory protection configuration register is different from the clear value, and blocks the write request when there is a difference.    The resettable microcontroller of claim 2, wherein the memory protection logic is further configured to access a set of memory protection configuration registers of non-secure mode write protection, wherein the rewrite controller group The memory protection configuration register is prevented from being written to the non-secure mode write protection when the processor is not in a secure mode, unless the non-safe mode write protection memory protection configuration is temporarily suspended. The memory is in a cleared state.    The resettable microcontroller of claim 3, wherein the microcontroller is configured to clear the set of non-secure mode write protected memory protection configuration registers each time the microcontroller is reset.    A resettable microcontroller as claimed in any one of the preceding claims, wherein the memory protection logic is configured to block a memory access request by triggering a bus fault exception.    A resettable microcontroller as claimed in any of the preceding claims, wherein the memory protection logic is configured to detect a memory access request from any bus master.    A resettable microcontroller as claimed in any one of the preceding claims, wherein: a predetermined address of the memory stores a bootloader including one or more The memory protects the instructions of the configuration register; and the processor is configured to execute the boot program before executing any other instructions.    A resettable microcontroller as claimed in claim 7, wherein the boot program is configured to read the encrypted material from the protectable area and use it during a boot procedure to verify the integrity of the microcontroller, and thus, Once the encrypted material has been used, an access standard is set to prevent any further read or write access to the encrypted material until the next reset by the microcontroller.    The resettable microcontroller of any one of the preceding claims, wherein the memory protection configuration registers comprise electrical memory.    A resettable microcontroller as claimed in any of the preceding claims, wherein the memory protection logic comprises a logic gate different from a logic gate of the processor.    A resettable microcontroller as claimed in any of the preceding claims, wherein the access criteria indicates or determines the type of allowed memory access request for a protectable area.    A resettable microcontroller as claimed in any one of the preceding claims, wherein the access standard requires the processor or microcontroller to be in one of a set of specific states, or the access request is from a An external debugger to allow access to the protected area.    A resettable microcontroller as claimed in any of the preceding claims, wherein the protectable area is defined by one or more values stored in the set of memory protection configuration registers.    The resettable microcontroller of claim 13, wherein the set of memory protection configuration registers stores values defining a plurality of protectable regions in the memory, and one or more for each of the protectable regions Access standards.    An integrated radio device comprising a resettable microcontroller as claimed in any of the preceding claims.