WO2007090712A1

WO2007090712A1 - Method for protecting a control device against tampering and control device which has been protected against tampering

Info

Publication number: WO2007090712A1
Application number: PCT/EP2007/050384
Authority: WO
Inventors: Klaus Schneider; Axel Aue
Original assignee: Robert Bosch Gmbh
Priority date: 2006-02-10
Filing date: 2007-01-16
Publication date: 2007-08-16
Also published as: DE102006006109A1

Abstract

A method for protecting a control device, in particular an engine control device, against tampering, said control device having a microcontroller and a non-volatile memory which is provided separately from the microcontroller and is in the form of a flash memory in particular, involves: encrypting unencrypted characteristic information of the non-volatile memory using an asymmetrical encryption method and storing the encrypted characteristic information in the non-volatile memory; transmitting information, which has been stored in the non-volatile memory, to the microcontroller; decrypting the transmitted information using the microcontroller; and comparing the decrypted information with the unencrypted characteristic information. A control device which has been protected against tampering is also provided.

Description

description

title

Method for tamper protection of a control device and protected against tampering control device

STATE OF THE ART

The present invention relates to a protected against manipulation control unit with a microcontroller and an external flash memory, and a method for manipulation protection of such a control device.

Engine control units control the functions of a motor vehicle, such as fuel injection, ignition timing, immobilizer, etc. The engine control unit has a microcontroller, which executes a predetermined program, and a memory in which, for example, certain vehicle parameters used in this program or the like are stored. By manipulating the data stored in this memory, it is possible, for example, to increase the performance of the motor vehicle (so-called tuning), which at the same time leads to increased safety risks in road traffic and is therefore undesirable by the manufacturer, even with regard to clear liability conditions , There is therefore a need for protection against such manipulation.

Known protection against tampering can be achieved by providing the microcontroller with an internal flash memory, and other protection measures such as protection. the use of passwords for reading, deleting or programming. However, due to the necessary flash technology, this is associated with increased costs, so that a solution without internal flash is preferable.

In the case of an external (ie not integrated in the microcontroller) flash memory, however, various attacks are conceivable. For example, an attacker may exchange an external flash memory for a manipulated flash memory. In In practice this turns out to be relatively simple, since the number of pins of the external flash memory is relatively small and thus the housing is relatively small, so that a desoldering is relatively unproblematic.

Another potential attack is to change the data stored in the external flash memory by direct access. Modern flash modules can usually be programmed in the installed state (ie without desoldering), which simplifies the possibilities of attack. A possible protection against such an attack would be to completely ban access to the flash memory when installed. However, it is advantageous to allow an authorized group of users to access the flash memory in order, for example, to be able to re-program the control unit or update the data stored in the flash memory.

As a possible protection against such attack, the US patent publication

6,138,236 a PROM memory for initializing a computer system, wherein the PROM memory comprises a programmable data area and an authentication area with a hash generator. The hash generator generates a hash value of the code present in the programmable data area, and the authentication area authenticates the code by means of this hash value. However, there is also the possibility of the first-mentioned attack, namely replacement of the entire PROM memory, so that comprehensive protection without further protection measures can not be guaranteed.

ADVANTAGES OF THE INVENTION

Accordingly provided is a method for manipulation protection of a control device, in particular a motor control device, with a microcontroller and a non-volatile memory provided separately from the microcontroller, which is designed in particular as a flash memory, with the following steps:

Encrypting non-encrypted characteristic information relating to the nonvolatile memory by an asymmetric encryption method and storing the encrypted characteristic information in the nonvolatile memory; Transmitting the information stored in the non-volatile memory to the microcontroller; Decrypting the transmitted information by the microcontroller; and Comparing the decrypted information with the unencrypted characteristic information.

By "unencrypted information" is meant information that is not yet encrypted with the asymmetric encryption method, so the unencrypted information may be information that is otherwise encoded.

A control device protected against manipulation according to the invention comprises:

a non-volatile memory comprising a memory area in which characteristic information relating to the non-volatile memory is encrypted with a private key of a key pair for asymmetric encryption; and

a microcontroller which is connected to the nonvolatile memory via a data line, and a ROM memory in which the public key of the asymmetric encryption key pair and a program for decrypting data encrypted with the asymmetric encryption are stored.

The idea underlying the invention is to encrypt characteristic information relating to the nonvolatile memory (typically a flash memory) and store it in the nonvolatile memory. During operation, this information is then read out by the microcontroller, decrypted and compared with the unencrypted information. If there is a difference, this is a strong indication that one of the building blocks or the information stored in it has been manipulated.

The characteristic information may be, for example, the serial number of the nonvolatile memory. Thus, protection against replacement of the nonvolatile memory can be achieved. It is advantageous that the characteristic information further comprises the serial number of the microcontroller. As a result, the nonvolatile memory and the microcontroller can be paired with one another, so that protection against the replacement of one of these two components is achieved. However, the characteristic information may also be a hash of data stored in nonvolatile memory. Thus, protection against manipulation of the data stored in the non-volatile memory is achieved.

Upon detection of inequality of the decrypted information and the unencrypted characteristic information, an error response, in particular a reset, may be performed.

It is advantageous if the key for decrypting the information is stored by the microcontroller in a ROM memory of the microcontroller, as this protects the key from tampering.

In an advantageous embodiment of the invention, the following steps are further provided: Encrypting data by the microcontroller;

Storing the encrypted data in the non-volatile memory; Reading the data stored in the nonvolatile memory by the microcontroller; and

Decrypt the encrypted data read out by the microcontroller.

This provides protection against the copying or cloning of sensitive or sensitive data in the non-volatile memory. In this case, it is advantageous that the encrypting and decrypting of data by the microcontroller is carried out with a symmetrical encryption method, since a symmetric encryption method is not only faster but also easier to implement than an asymmetric encryption method.

In an advantageous development of the invention, the key for encrypting and decrypting data is stored by the microcontroller as a combination of programmable bits and hardwired bits in the microcontroller.

This makes it possible to inexpensively realize a high key length with high variability.

DRAWINGS

The invention will be explained in more detail with reference to the exemplary embodiments indicated in the schematic figures of the drawing. It shows: Fig. 1 is a schematic diagram of a control device according to an embodiment of the present invention.

2 is a flowchart of a first method according to an embodiment of the present invention.

3 is a flowchart of a second method according to an embodiment of the present invention.

DESCRIPTION OF THE EMBODIMENTS

In all figures of the drawing, identical or functionally identical elements - unless otherwise stated - have been provided with the same reference numerals.

Fig. 1 shows a schematic diagram of a control unit 1 according to an embodiment of the present invention. In the present embodiment, the control unit 1 is configured as an engine control unit, which controls the functions of a motor vehicle, such as fuel injection, ignition timing, immobilizer, and so on. In this case, the engine control unit 1 has a microcontroller 2 as well as a non-volatile memory provided separately from the microcontroller 2, which memory is designed in particular as a flash memory 3. The microcontroller 2 is connected to the flash memory 3 via a data line 4. The microcontroller 2 is further connected via a not-shown interface and a data bus (for example, a CAN bus) to various sensors and actuators of the vehicle (e.g.

Tachometer, fuel injection, etc.).

The microcontroller 2 has a non-changeable serial number 5 and the flash memory 3 has a non-changeable serial number 6. These can be realized for example by a fixed wiring in the respective blocks, so that a manipulation of these serial numbers is not possible. The serial numbers are typically 128 bits long and are not freely programmable or changeable. Furthermore, they are uniquely assigned to the blocks, that is, there are not several blocks with the same serial numbers. This is achieved, for example, by the serial numbers containing information about the production number, the production date, the wafer number and / or the position of the chip of the respective component on the wafer. The microcontroller 2 includes a ROM storage area 10, a RAM storage area 11, and a central processing unit (CPU) 12 which executes a program stored in the ROM 10. The ROM 10 also has a key 9 for decrypting it by means of an asymmetric method

Data saved. A program for decrypting data with the key 9 is also stored in the ROM 10. As an asymmetric encryption / decryption method, for example, an implementation of the RSA algorithm is suitable.

The flash memory 3 includes a memory area 20 in which various data is stored, such as a boot code 21, a program code 22, and a data set 23 (including, for example, vehicle or engine parameters). The boot code 21, the program code 22 and the data record 23 are secured by respective signatures SIG21, SIG22 and SIG23, as explained below. The im

Flash memory 3 stored data are transmitted during operation via the data line 4 to the microcontroller 2 and used by this for controlling the motor vehicle. The data stored in the flash memory 3 can be updated relatively easily by an authorized party (e.g., the manufacturer) without requiring replacement of the entire controller 1.

In the arrangement shown in FIG. 1, various types of attacks are conceivable that could allow an unauthorized party to attempt to change the data in the flash memory 3, for example, by replacing the flash memory 3 or by reprogramming the flash memory 3 in FIG built-in condition. An attacker could also try to read stored in the flash memory 3 security-sensitive or sensitive data. These attacks are prevented according to the invention by the methods described below.

FIG. 2 shows a flowchart of a first method according to an embodiment of the present invention. This first method prevents the data in the flash memory 3 from being manipulated by the fact that the flash memory 3 is completely replaced (ie, soldered out and replaced by another flash memory). This is achieved by a pairing of microcontroller 2 and flash memory 3 via their serial numbers 5, 6. In a step Sl, the respective serial numbers 5 and 6 are factory read out of the microcontroller 2 and the flash memory 3 and stored in a memory of a (not shown) data terminal or programming station.

In the following step S2, the serial numbers 5 and 6 are concatenated together (ie, hung on each other) and encrypted with an encryption key 8. In this case, the encryption key 8 is part of a key pair 8, 9 for an asymmetric encryption method. The encryption key 8 is a secret key, which is therefore known only at the factory, while the decryption key 9 stored in the ROM 10 of the microcontroller 2 is a public key which need not be kept secret.

The serial numbers 5 and 6 are unencrypted information regarding the flash memory 3: The serial number 6 is the serial number of the flash memory 3, while the serial number 5 is the serial number of the component with which the flash memory 3 is uniquely associated. The encrypted characteristic information obtained by the encryption with the key 8 will be referred to as certificate 7 hereinafter.

In step S3, the certificate 7 is factory-set in the memory area 20 of the flash memory.

Memory 3 stored, which completes the factory-executed part of the process.

In step S4, the certificate 7 is read from the flash memory 3 via the data line 4 into the RAM memory area 11 of the microcontroller 2. This step S4 may be performed, for example, every time the vehicle is started.

In step S5, the certificate 7 is decrypted with the decryption key 9 of the key pair 8, 9 and separated into two serial numbers.

Finally, in step S6 it is checked whether the serial numbers obtained by the decryption with the key 9 are identical to the serial numbers 5 and 6, which are in fact directly accessible to the microcontroller 2.

If the serial numbers obtained by the decryption with the key 9 are identical to the serial numbers 5 and 6, then this means that the flash Memory 3 has not been replaced and thus the data stored therein can be trusted. In this case, the procedure jumps to step S7, in which parameters and other data are loaded from the flash memory 3 for further processing in the RAM memory of the microcontroller.

If the serial numbers obtained by the decryption with the key 9 are not identical with the serial numbers 5 and 6, then this means that the flash memory 3 has been exchanged and thus the data stored therein may have been manipulated. In this case, the procedure jumps to step S8 in which an error reaction (reset) is performed and, for example, in

ROM memory of the microcontroller 2 stored instead of the parameters and data in the flash memory 3 are loaded into the RAM memory of the microcontroller 2. Alternatively, a warning signal may be output, indicating that the flash memory 3 has been manipulated. This warning signal can then, for example, be further processed in a step, not shown, in such a way that an immobilizer is activated, which means that the motor vehicle can no longer be started if the flash memory 3 has been manipulated.

By the method described above it is achieved that during the program runtime or when starting the control unit 1, the encrypted serial numbers (characteristic information) with the key 9 (public key) decrypted and verified with the serial numbers of the actually built in the control unit 1 components. The use of an asymmetric encryption / decryption method ensures that information stored with the control unit 1 can only be used to decrypt the characteristic information, but not encryption that could produce a pairing of components. Thus, the key 9 used for decryption does not need to be kept secret.

The method steps S4 to S7 are implemented by a program stored in the microcontroller 2. It is advantageous if this program is stored in the ROM of the microcontroller 2. Thus it can be ensured that the program itself is not manipulated. For the same reason, it is also advantageous, although the decryption key 9 in the ROM memory of

Microcontroller 2 is stored. Since no complex manufacturing steps are necessary for a ROM, this solution is also cost-effective. It should be noted that in the embodiment described above, both the serial number 6 of the flash memory 3 and the serial number 5 of the microcontroller 2 were used for mating flash memory and microcontroller. However, it is also possible that only the serial number of the flash

Memory is stored encrypted as a certificate 7. In this case, protection against replacement of the flash memory is realized. However, it is preferable that both the serial number of the flash memory and the serial number of the microcontroller are stored encrypted as a certificate 7, since then a clear match between flash memory and microcontroller is given, so that also protects against the replacement of the microcontroller is.

3 shows a flowchart of a second method according to an embodiment of the present invention. This second method prevents the data stored in the flash memory 3 from being manipulated. This is achieved by backing up the data in the flash memory 3 by means of signatures.

First, the data to be stored in the flash memory are factory-set with a

Signature provided. For this purpose, a hash value of the data to be stored in the flash memory, that is to say for example the boot code 21, the program code 22 and / or the data record 23, is calculated in step S1 using a hash function. Hash function here is an irreversible function (an algorithm) that uniquely reduces a large amount of data to a much smaller one

Target quantity maps. Examples of such hashing functions are the Message Digest MD4 or the Secure Hash Algorithms SHA family, details of which have been found in Bruce Schneier's Applied Cryptography, John Wiley & Sons, 1996.

In step S2, the hash value obtained in step S1 is encrypted with the encryption key 8, whereby a signature SIG21, SIG22 and / or SIG23 is obtained.

In step S3, the signature determined in step S2 is stored in the flash memory 3 at the factory. It is advantageous if these steps S 1 to S 3 are carried out for all sensitive data stored in the flash memory 3 and, as in FIG. 1 shown, both the boot code 21, the program code 22 and the record 23 are each provided with a signature SIG21, SIG22 and SIG23.

During runtime, in step S4, the signature SIG21, SIG22 and / or SIG23 to be checked is transferred from the flash memory 3 via the data line 4 into the RAM.

Memory area 11 of the microcontroller 2 read. For example, this step S4 may be performed each time the motor vehicle is started.

In step S5, the signature to be checked is decrypted with the decryption key 9 of the key pair 8, 9, and thus an unencrypted hash value is determined.

In step S6, the microcontroller 2 determines the hash value of the data to be verified in the flash memory 3, with the same hash function that was used in step S1. For this purpose, the microcontroller 2 reads the data to be verified from the flash memory 3 via the data line 4 into the RAM memory 11 and applies the hash function to this data, whereby hash values of these data are obtained.

Finally, in step S7, it is checked whether the hash values obtained by the decryption with the key 9 in step S5 are identical with the hash values obtained in step S6.

If the hash values obtained by the decryption with the key 9 in step S5 are identical to the hash values obtained in step S6, it means that the flash memory 3 has not been manipulated and thus the data stored therein can be trusted. In this case, the procedure jumps to step S8 in which parameters and other data are loaded from the flash memory 3 for further processing in the RAM memory of the microcontroller.

On the other hand, if the hash values obtained by the decryption with the key 9 in step S5 are not identical with the hash values obtained in step S6, it means that the flash memory 3 has been manipulated and can not trust the data stored therein. In this case, the procedure jumps to step S9, in which an error response (reset) is performed and, for example, in the ROM memory of the microcontroller 2 stored default instead of the parameters and data in the flash memory 3 in the RAM memory of Microcontroller 2 will be charged. Alternatively, a warning signal may be output, indicating that the flash memory 3 has been manipulated. This warning signal can then, for example, be further processed in a step not shown in more detail so that an immobilizer is activated, which means that the motor vehicle can no longer be started if the flash

Memory 3 was manipulated.

The method described above ensures that the data stored in the flash memory 3 are verified during the program runtime or when the control unit 1 is started. In this second method as well, the use of an asymmetric encryption / decryption method ensures that information stored with the control unit 1 can only be used to decrypt the characteristic information, but not an encryption which could produce a pairing of components. Thus, the key 9 used for decryption does not need to be kept secret.

Another possible attack on the control unit 1 may be that the attacker tries to read out the data stored in the flash memory 3, and to copy or clone. This is simplified by the fact that the data in the flash

Memory 3 are easy to read.

In an advantageous development of the embodiments explained above, therefore, measures are provided which prevent the detection of secrets. Specifically, this can be done by storing the ones stored in the flash memory 3

Data are stored in encrypted form and this encrypted data is decrypted by the microcontroller 2.

Thus, if the microcontroller 2 accesses the flash memory 3 in order to store data there, then the microcontroller 2 encrypts this data before storing it. The algorithm and the key for this data encryption are in turn stored in the ROM 10 so that they are protected against manipulation. In this way, if encrypted data is read from the flash memory 3 into the microcontroller, then in turn they are first decrypted before being processed further. For the encryption / decryption, a symmetric encryption / decryption method is preferably used, since such a method is faster than an asymmetric method. In symmetric methods, the key used for encryption is identical to the key used for decrypting, so that it is advantageous to store this key in a memory area of the microcontroller 2 which is not accessible from the outside, in other words this key is read-protected save.

It is desirable that the key for symmetric encryption have a high key length because a short key length is prone to so-called "brute-force" attacks in which the attacker advises the key by repeated trial and error, and it is desirable in that individual keys can be generated and project- or customer-specific variation possibilities are possible In general there is the possibility to use the key in the form of programmable bits, for example as so-called "semiconductor backups" (OTP bits - "one-time programmable bits"). ) or hard-wired bits.

The advantage of programmable bits is that they offer a great deal of variation. Variation options are particularly important when keys are corrupted, so have become known. However, programmable bits are relatively expensive and only partially suitable for long keys. The advantage of hardwired bits is that they are inexpensive and thus suitable for long key lengths. However, they offer no variation possibilities due to the fixed wiring.

According to the invention, it is now proposed to realize the key by a combination of programmable bits and hardwired bits. Thus, it is possible to produce cost-effective for the respective control unit individualized key with a high key length.

It is advantageous if, for example, with a key length of 16 bytes, approximately 10% of the bits are provided as OTP bits C, one time programmable bits ") and the remainder as hard-wired bits If, for example, 10 bits of the key are provided as OTP bits, this gives 2 ^× 10 = 1024 possible variations. It is advantageous if the various measures described above for protection against attacks are combined with one another. In this way, more complete protection against the various types of attacks (ie, for example, replacement of the flash memory 3 or the microcontroller 2, manipulation of the data in the flash memory 3 and copying or cloning of sensitive data in the flash memory 3) is achieved become.

Claims

claims

1. A method for manipulation protection of a control device (1), in particular an engine control unit, with a microcontroller (2) and a separate from the microcontroller (2) provided non-volatile memory (3), which is designed in particular as a flash memory (3), with the following steps:

Encrypting unencrypted characteristic information regarding the nonvolatile memory (2) by an asymmetric encryption method and storing the encrypted characteristic information (7, SIG21, SIG22, SIG23) in the nonvolatile memory (3); Transmitting the information stored in the non-volatile memory (7,

SIG21, SIG22, SIG23) to the microcontroller (2);

- decrypting the transmitted information (7, SIG21, SIG22, SIG23) by the microcontroller (2); and comparing the decrypted information with the unencrypted characteristic information by the microcontroller (2).

2. The method according to claim 1, characterized in that the characteristic information comprises a serial number (6) of the non-volatile memory (3).

3. The method according to claim 1 or 2, characterized in that the characteristic information comprises a serial number (5) of the microcontroller (2).

4. Method according to one of the preceding claims, characterized in that the characteristic information comprises a hash value of data stored in the nonvolatile memory (3).

5. The method according to any one of the preceding claims, characterized in that upon detection of inequality of the decrypted information and the unencrypted characteristic information, an error response, in particular a reset, is executed.

6. The method according to any one of the preceding claims, characterized in that a further step for storing the key (9) for decrypting the information by the microcontroller (2) in a ROM memory (10) of the microcontroller (2) is provided.

7. The method according to any one of the preceding claims, characterized in that the following further steps are provided: encrypting data by the microcontroller (2); - storing the encrypted data in the non-volatile memory (3);

- Reading the data stored in the non-volatile memory (3) by the microcontroller (2); and

Decrypt the encrypted data read out by the microcontroller (2).

8. The method according to claim 7, characterized in that the encryption and decryption of data by the microcontroller (2) is carried out with a symmetric encryption method.

9. The method according to claim 8, characterized in that the

Key for encrypting and decrypting data stored by the microcontroller (2) as a combination of programmable bits and hardwired bits in the microcontroller (2).

A tamper resistant control apparatus (1) comprising: a nonvolatile memory (3) comprising a memory area (20) in which characteristic information relating to the nonvolatile memory (3) is stored with a private key (8) of a key pair (8, 9) a- symmetric encryption is stored encrypted; and a microcontroller (2) connected to the nonvolatile via a data line (4)

Memory (3) is connected, and a ROM memory (10), in which the public key (9) of the key pair (8, 9) for asymmetric encryption, and a program for decrypting encrypted with asymmetric encryption data are stored ,

11. Control device according to claim 10, characterized in that the characteristic information comprises a serial number (6) of the non-volatile memory (3).

12. Control unit according to claim 10 or 11, dad urch in that the characteristic information further comprises a serial number (5) of the microcontroller (2).

13. Control device according to one of claims 10 to 12, characterized in that the characteristic information comprises a hash value of data stored in the non-volatile memory (3).

14. Control device according to one of claims 10 to 13, characterized in that in the ROM memory (11) of the microcontroller (2) is further stored a symmetric key for symmetrically encrypting data to be stored in the nonvolatile memory.

15. Control unit according to claim 14, characterized in that the symmetric key contains programmable bits and hardwired bits.