DE102020207866A1 - Method for performing a secure start sequence of a control unit - Google Patents

Abstract

The invention relates to a method for carrying out a secure start sequence of a control device that includes a host that is set up to run programs and a hardware security module, HSM, that is set up to authenticate application programs. The method includes starting the host and the HSM; the host executing a loader, the loader being stored in a non-rewritable first memory of the host; the HSM verifying the authenticity of at least one application program, the application program being stored in a rewritable second memory of the host; and if the authenticity of the at least one application program is verified, the host executing the at least one application program.

Description

The present invention relates to a method for carrying out a secured start sequence for a control device as well as a computing unit and a computer program for carrying it out.

State of the art

Programmable control devices are used in machines and vehicles to control them or their components. For example, a motor vehicle can contain control units for engine control, for the brake system, etc. The control units comprise a processor with one or, typically, with several processor cores (also referred to in simplified form as a host or host system), which executes programs stored in a memory in order to achieve the functions of the control unit.

For security reasons, it can be provided that the authenticity of the program is checked before a program is executed by the control device in order to prevent a manipulated program from being executed. The test can be carried out by what is known as a hardware security module, HSM, which provides functionalities to protect programs and communication executed by the control unit from manipulation. The HSM uses signatures that are calculated using cryptological functions and (secret) keys. After switching on the control device, the host's loading program, which in particular loads at least one application program, must first be checked for authenticity. This check of the authenticity of the charging program by the HSM extends the start phase of the control unit. The extension of the start phase can also be negatively influenced by the fact that the HSM itself must first be initialized and runs at a reduced clock frequency during an initial period in which the authenticity check of the loading program takes place.

Disclosure of the invention

According to the invention, a method for carrying out a secured start sequence of a control device as well as a computing unit and a computer program for carrying it out are proposed with the features of the independent claims. Advantageous refinements are the subject matter of the subclaims and the description below.

The method according to the invention avoids a delay in the start sequence in the case of time-critical control devices (e.g. engine control devices). This is achieved in that the central loading software or boot software is protected by hardware protection, since the first memory that contains the loading program cannot be rewritten and therefore cannot be changed. This ensures the integrity and authenticity of the loading program. The loading program can be executed immediately, without being checked by the HSM, so that a reliable start sequence is possible without any time delays. In other words, the method for carrying out a secured start sequence of a control device is a secured control device start sequence.

The term “start sequence” or run-up refers to the control unit initially following the start-up through steps until application programs that implement the actual control functionality of the control unit are running. 'Secured' means that it is not possible to manipulate the start sequence in such a way that programs are executed that change the functionality of the control unit without permission, i.e. in the form of the manufacturer and / or user of the device (e.g. machine or vehicle) in which the control device is used, change in an illegal manner or which allow an attacker to gain control of the control device and thus at least partially the device controlled by it.

Another advantage of the invention is that although the loading program is stored in the first, non-rewritable memory, the application programs that provide the actual functionality of the control device are, however, stored in the second, rewritable memory so that they can be updated or reprogrammed .

The host or the host system comprises a processor which is set up to execute software or computer programs (referred to simply as programs) in order to implement functions of the control device. The host can have further elements, such as a volatile main memory (e.g. a random access memory, RAM), a non-volatile memory (here first and second memory), communication interfaces, in particular for communication with the memory, the HSM and external devices, and / or the like. The software is contained or stored in the non-volatile memory of the control unit. The host comprises a non-rewritable first memory, for example a one-time writable memory (OTP, One Time Programmable), and a rewritable second memory, for example a flash memory, a hard disk, or an SSD (solid state disk). An OTP memory can be used as fuse technology or Anti-fuse technology can be implemented, whereby relevant connection points of an electronic circuit are either separated (fuse technology) or connected (anti-fuse technology) during programming; the program code of a program programmed in this way is then given by structural hardware features of the memory. A flash memory with hardware protection can also be used, which prevents rewriting after the original one-time programming.

The terms “first memory” and “second memory” are to be understood as meaning memory of the host; a memory of the HSM is referred to as "HSM memory".

The programs can be one or more application programs that are set up to implement control functions of the control unit when they are executed by the host, a loading program that is set up to carry out initializations and call at least one of the application programs when it is executed by the host and one or more update programs (programming software) which are set up, inter alia, to rewrite the second memory or parts thereof with software (program data) or data when they are executed by the host. Application programs are preferably stored in the second memory. The loading program and preferably also the update programs are stored in the first memory.

Update programs represent, so to speak, programming software for reprogramming the control device, so the control device can be updated or reprogrammed. The update can relate to programs, the sequence of which determines the function of the control device, and / or data that are required for the function of the control device, such as initialization parameters or program parameters. During the update or reprogramming, the second memory or areas thereof are completely or partially rewritten with update data (new programs, i.e. software, and / or other new data). If necessary, the update program can carry out further actions, e.g. determine which programs / data need to be updated, or initiate a restart of the control unit after the update.

The hardware security module, referred to as HSM for short, provides cryptographic functions that can be used by the host to secure security-critical functions, such as communication between several control units. For this purpose, the HSM manages in particular secret passwords, signatures and / or cryptographic keys and implements cryptographic methods preferably in hardware. These keys are stored by the HSM in a designated area of a memory of the HSM (HSM memory). The HSM comprises a processor (which is different from the host processor) and can be implemented separately from the host or integrated with the host or host processor in a chip (HSM and host are then, for example, on the chip through different processor cores educated). It is also possible that the various memories are at least partially integrated with one another (in particular the second memory with the HSM memory) and are formed on a chip with the host processor and / or the HSM processor. The HSM is set up in particular to check the integrity of memory areas of the second memory in order to check the authenticity of computer programs or software and / or data contained in the respective memory area.

During the integrity check, it is determined whether the content of the memory area to be checked is unchanged compared to a known correct content. This is preferably done by comparing signatures, with a signature managed by the HSM and stored in the HSM memory (ie a reference signature) which corresponds to an (earlier) state of the memory area that is known to be correct (not manipulated) ) is compared with a newly calculated value of the signature, which is calculated based on the current content of the memory area. If the newly calculated signature value is the same as the stored signature (reference signature), the content of the memory area (in the sense of signature comparison) is unchanged, and the authenticity of the program is then confirmed. If, on the other hand, the newly calculated signature value is not the same as the stored signature (reference signature), the content of the memory area (in the sense of signature comparison) is changed and the authenticity of the program is not confirmed.

For example, a check value or a hash value of the data stored in the memory area can be calculated and compared with a value calculated at an earlier point in time at which it was known that the memory area contained correct, non-manipulated software and / or data. A MAC, ie a message authentication code, is preferably compared for the integrity check. When calculating a MAC, in addition to the original message, here the data stored in the memory area or a hash value thereof, a secret key that the HSM manages. This allows so-called collision attacks (or here pre-image attacks) can be prevented. A so-called CMAC (Cipher-based Message Authentication Code) is preferably used. These methods mentioned (check value, hash value, MAC, CMAC) represent preferred examples of possible signature methods, but another method known to the person skilled in the art can also be used, for example known digital signatures.

The method can furthermore, if the authenticity of the at least one application program is not confirmed, executing an update program stored in the first memory; and rewriting, by the update program, an area of the second memory in which the at least one application program is stored with update data. This embodiment preferably further comprises sending and / or outputting a request to provide the update data; and receiving the update data.

If the authentication of an application program is unsuccessful, for example because it has been manipulated, a secured update can be carried out according to this embodiment, since the update program is stored in the non-rewritable first memory and is therefore safe from unauthorized changes. The necessary update data can be requested and obtained from outside the control unit. This is advantageously secured by the HSM using a corresponding key.

This refinement can furthermore include updating a signature used for checking the authenticity of the at least one application program by the HSM based on the newly written area of the second memory or the update data. This ensures that the reference signature managed by the HSM corresponds to the newly written application program; this is necessary, for example, with a new version of the application program.

The method preferably comprises a one-time writing of the first memory with the loading program and / or the update program. This is best done before or when the control unit is installed in the device (e.g. machine or motor vehicle) in which the control unit is used. This means that it takes place in a safe environment (e.g. at the manufacturer of the control unit or at the manufacturer of the device in which it is used) so that it can be ensured that the loading program or update program has not been manipulated.

A computing unit according to the invention, for example a control unit of a motor vehicle, is set up, in particular in terms of programming, to carry out a method according to the invention.

The implementation of a method according to the invention in the form of a computer program or computer program product with program code for performing all method steps is advantageous, since this causes particularly low costs, especially if an executing control device is used for other tasks and is therefore available anyway. Suitable data carriers for providing the computer program are, in particular, magnetic, optical and electrical memories, such as hard drives, flash memories, EEPROMs, DVDs, etc. A program can also be downloaded via computer networks (Internet, intranet, etc.).

Further advantages and embodiments of the invention emerge from the description and the accompanying drawing.

The invention is shown schematically in the drawing using exemplary embodiments and is described below with reference to the drawing.

Figure list

• 1 shows the basic structure of a control device on which the invention can be based.
• 2 shows an overview of the basic structure of a preferred embodiment of the method for the secure implementation of a start sequence of a control device.
• 3 shows a flow chart of a preferred embodiment of the method according to the invention.

Embodiments of the invention

1 shows the basic structure of a control device or a computing unit contained in a control device, as it or the invention can be based on. Essentially, only those components are shown that are necessary for an understanding of the present invention.

The control unit 1 includes a host 2 and a hardware security module (HSM) 4th . These are connected to one another by means of one or more connections or lines 3 connected for data exchange. It can be a serial or parallel connection. The connection can be a point-to-point connection or it can be implemented via a bus.

The host 2 has a host core 6th , ie a processor, a first memory 8th and a second memory 10 on. The first store 8th cannot be rewritten, ie its content cannot be changed after it has been written to once. This can be a so-called one-time programmable memory (OTP memory). The second store 10 is rewritable. Both memories are non-volatile memories in which programs, in particular a loading program, update programs and application programs, and data are stored. The loading program is in the first memory 8th saved. In the second store 10 one or more application programs are stored. The host core 2 is set up in the first memory 8th and in the second memory 10 run saved programs.

The HSM 4th has an HSM core 12th , ie a processor, and an HSM memory 14th , for programs to be executed by the HSM core and for data, in particular for signatures (or reference signatures) and keys.

For the sake of completeness there is also a communication interface 16 shown, which serves to control the control unit 1 to connect with other devices. This can in particular be a device to be controlled by the control device and / or other control devices. A programming device that is to be used to update the control device can also be used via the communication interface 16 communicate with the control unit. The communication interface 16 can include, for example, a CAN bus interface in addition to other interfaces. The communication interface 16 is right here with the host 2 connected, but can also be connected via a bus.

Several or all of the individual parts (host 2 , HSM 4th , Storage 8th , 10 , 14th , Communication interface 16 ) can be integrated in a chip. Other than shown, the memory can 8th , 10 , 14th can also be implemented separately from the respective core (separate chip). The three memories (first memory 8th , second memory 10 and HSM storage 14th ) to be partially integrated with each other. The control device can comprise further components, not shown.

In 2 an overview of the basic structure of a preferred embodiment of the method for carrying out a secured start sequence of a control device is shown. Processes that run on the host side 22 are shown on the left in the figure, and processes that run on the HSM side 24 are shown on the right in the figure. Arrows represent relationships or interactions between individual elements, ie generally not the chronological sequence of successive steps in the sense of a flow chart. The arrangement of the drawn elements in the vertical direction of the figure roughly corresponds to the time sequence, but this arrangement does not necessarily correspond exactly to the actual time sequence, ie it is possible that processes arranged at the same vertical height take place at different times or at different heights Operations run simultaneously or in reverse order, as long as this is consistent with the logic of the process.

First of all, starting or switching on the control unit in step 26th the host started and in step 28 the HSM started. The host or the host core and also the HSM or HSM core typically each run a firmware that carries out or provides basic initializations and functions.

A loader is then created by the host's firmware 30th of the host, which can carry out further initializations (e.g. those that relate to a specific use of the control unit) and loads one (or more) application program, ie software that implements the actual control function of the control unit. The loading program is according to the invention 30th stored in the first memory which is not rewritable, ie the loading program cannot be changed. The loading program is correspondingly read out from the first memory in a step not shown. Since the first memory cannot be rewritten, the loading program cannot be manipulated, so that the HSM does not need to authenticate the loading program, which would lead to a time delay when starting.

In particular, the host's loader causes the HSM to run in step 32 carries out further initializations of the HSM and that a main application of the HSM is started, which provides functions, in particular cryptographic functions that can be called by the host in order to ensure the security of the control device against manipulation. In particular, a change or manipulation of the programs executed by the host should be prevented. It can also be used to secure the exchange of data, for example with other control units in a motor vehicle. Cryptographic functions can at least partially be implemented as hardware in order to ensure high speed.

The loader continues to load at least one application program 34 , which is not executed immediately by the host, but only after a successful authenticity check by the HSM. First in step 36 based an associated signature value (eg a digital signature or a message authentication code) is calculated on the content (ie the program data) of a memory area in which the application program is stored, and this signature value is then calculated in step 38 with a previously calculated signature of the application program, which is associated with an earlier, known correct state of the content of the memory area. The previously calculated signature represents, so to speak, a reference signature of the application program. If the currently calculated signature value is the same as the previously calculated signature of the application program, the execution of the application program is released and this is activated in step 40 executed. The signatures of the application programs - there are generally several application programs that are either loaded by the loading program during the control unit start sequence or are called later by other application programs - are stored in the HSM memory.

3 represents a flowchart of a preferred embodiment of the method according to the invention. The secured control unit start sequence begins in principle with step 52 , starting the host and the HSM, with the host core and the HSM core being started in particular. Also shown is a previous step 50 , in which the non-rewritable first memory is written to once, in particular the loading program and optionally at least one update program being written into the first memory. This step 50 is only carried out once, e.g. when the control unit is manufactured or when the control unit is programmed for the first time.

The loading program is then called and in step 54 executed, wherein the loading program is read from the first memory in a step not shown. As already explained, the loading program carries out further initializations, for example, and prompts HSM to switch to its main application. Finally, the loading program calls at least one application program that is stored in the rewritable second memory. However, the application program is not executed immediately, but in step 56 first the authenticity of the at least one application program is checked by the HSM and the application program is only executed if the authentication is successful. This ensures that only programs that have not been manipulated are executed by the host. During the authenticity check, the integrity of the memory area is checked, ie it is checked whether the memory area has not changed. This is done by calculating the value of a cryptographic signature, for example a digital signature or a message authentication code, based on the memory area in which the at least one application program is contained. The calculated signature value is compared with a previously calculated reference signature for at least one application program. This calculation and the subsequent comparison are carried out by the HSM, which also stores and manages reference signatures and any secret keys that may be included during their calculation in the HSM memory.

If the authenticity of the at least one application program is confirmed, arrow 58 , ie if the calculated signature value is equal to the reference signature, in step 60 executed the at least one application program. If necessary, this can call up a further application program, which must also be subjected to an authenticity check before it is executed. So it will, arrow 62 , again with step 56 , ie the authenticity check, this time being applied to the further application program.

On the other hand, if the authenticity of the at least one application program is not confirmed, arrow 64 , ie if the calculated signature value is not the same as the reference signature, ie if the at least one application program has possibly been manipulated, step 66 the update program, which is stored in the non-rewritable first memory, is called and executed. The updater leads in step 72 an at least partial rewriting of the memory area in which the at least one application program is contained with update data. The update data contain a version of the at least one application program that is known not to have been manipulated. If the update program has access to a secure, non-manipulated version of the at least one application program and corresponding update data, step 72 of rewriting can be carried out immediately.

Optionally, for example if the update program does not have access to a secured version of the at least one application program and corresponding update data, in step 68 Update data that contain a non-manipulated version of the at least one application program are requested and in step 70 be received. The update data can be requested and received via the communication interface of the control unit.

Likewise, in step 74 nor the signature managed by the HSM (reference signature) of the at least one application program are updated so that it corresponds to the newly written version of the at least one application program. During this update, the updated signature is written to the HSM memory by the HSM. The updated signature can, for example, be contained in the update data or be recalculated by the HSM.

Overall, the result is that even if a possibly manipulated application program should be contained in the second memory, this is not executed and instead a secured update is carried out by an update program that is protected against manipulation since it is contained in the non-rewritable first memory.

Claims (8)

Method for carrying out a secure start sequence of a control device (1), which comprises a host (2), which is set up to execute programs, and a hardware security module, HSM, (4), which is set up to authenticate application programs , full Starting (26, 28; 52) the host and the HSM; Executing (30; 54) a loading program by the host, the loading program being stored in a non-rewritable first memory (8) of the host; Checking (36, 38; 56) the authenticity of at least one application program by the HSM, the application program being stored in a rewritable second memory (10) of the host; and, if the authenticity of the at least one application program is confirmed, the host executes (40; 60) the at least one application program. Procedure according to Claim 1 comprising, if the authenticity of the at least one application program is not confirmed: executing (66) an update program stored in the first memory; and rewriting (72), by the update program, an area of the second memory in which the at least one application program is stored with update data. Procedure according to Claim 2 comprising sending and / or issuing (68) a request to provide the update data; and receiving (70) the update data. Procedure according to Claim 2 or 3 comprising updating (74) a signature used for checking the authenticity of the at least one application program by the HSM based on the rewritten area of the second memory. Method according to one of the preceding claims, comprising writing (50) the first memory once with the loading program. Computing unit (1), comprising a host (2) which is set up to execute programs and which has a non-rewritable first memory (8) and a rewritable second memory (10), a loading program being stored in the first memory and at least one application program being stored in the second Memory is stored; and a hardware security module, HSM, (4) which is set up to check the authenticity of the at least one application program; wherein the processing unit is set up to carry out all method steps of a method according to one of the preceding claims. Computer program that causes a processing unit to carry out all process steps of a process according to one of the Claims 1 until 5 to be carried out when it is executed on the processing unit. Machine-readable storage medium with a computer program stored thereon Claim 7 .

Images