EP3186709A1

EP3186709A1 - Method for protecting user data of a storage device, and electronic computing system

Info

Publication number: EP3186709A1
Application number: EP15763226.6A
Authority: EP
Inventors: Andreas Heise; Kai Schade
Original assignee: Continental Teves AG and Co OHG
Current assignee: Continental Teves AG and Co OHG
Priority date: 2014-08-29
Filing date: 2015-08-27
Publication date: 2017-07-05
Also published as: US10635309B2; US20170168718A1; WO2016030466A1; DE112015003968A5

Abstract

The invention relates to a method for protecting user data (ND) of a read/write storage device (3) of an electronic computing system (4) in a motor vehicle. Using test data (PD) relating to the run time of the electronic computing system (4), at least one protection region (F1, F2) for protecting a storage region of the read/write storage device (3) is established or removed or is specified in such a manner that the extent and/or position of the protection region with respect to a total storage region comprised by the read/write storage device (3) is changed. The invention further relates to a corresponding electronic computing system.

Description

description

Method for securing user data of a memory and electronic computer system

The present invention relates to a method for securing user data of a memory according to the preamble of claim 1 and an electronic computing system according to the preamble of claim 5. For safety-related control devices in motor vehicles must

Microprocessors and their interface modules as well as externally connected functional modules, such as bus driver, memory, AD converter, etc. either be designed structurally safe, ie redundant (= spatial), or repeatedly checked at runtime (= temporal) to requirements sicherheitsre ^¬ levante electronic systems in motor vehicles to satisfy (eg ISO 26262). The problem here is in particular the protection of memory modules, such as DRAMs. Spatial redundancy is a major cost driver as the chip area doubles with complete redundancy, which is uneconomical, especially for large data sets. Temporal testing may require extended time resources for modern automotive systems, with the tolerable time between occurrence and detection of an error (FTTI) being too high for safety-related computing systems. DRAMs often compromise. Instead of redundantly storing memory elements, ECC / EDC units ("Error Correcting Code" and "Error Detecting Code") are used to store test data (ECC / CRC) in regular memory elements in addition to the user data be compared. These test data are generated for a defined memory area, so that not the entire memory area needs to be kept multiple times and only safety-critical areas are enriched with test data. These test data comprise about 25 to 100% of the hedged Memory, depending on the size of the user data to be written; or about 12.5 to 20% if, in addition to the user data, the corresponding address information is also taken into account. Such a system is described for example in DE 19529434 B4.

The weighting of the address information within this secure memory area is lower in favor of a higher error correction power of the user data. This is achieved in that the respective address bits with different weightings are included in the test data calculation, wherein the upper address bits are usually considered less strongly. The error detection and correction capability of the check codes against the payload data is thus inversely proportional to the size of the protected memory area. The error detection or error correction capacity thus decreases with increasing memory areas to be protected. This weighting is hardware implemented (hard-wired) and specifies the basics of the ma ^¬ thematic calculation of the check codes. For modern applications in motor vehicles, the defined memory area can be designed too small, for example, if with known systems only 8 MByte would be secured, but 256 MB are needed. Thus, the storage of program data or user data either does not meet the required security or the secure memory area for this is very limited.

The object of the invention is to provide a means for securing data of a memory, which enables an improved Ver ^¬ ratio of the error detection and / or error correction capability to be provided for a memory requirement for test data and can be realized as inexpensively.

This object is achieved by a method according to claim 1 and an electronic computing system according to claim 5. The invention relates to a method for securing user data of a read-write memory of an electronic computer system in a motor vehicle, wherein at least one hedging area for securing the user data of a memory area of the

Read-write memory using test data at the time of elekt ^¬ ronic computer system set or canceled or specified in such a way that its extension and / or position is changed with respect to an entire memory area covered by the read-write memory.

Thus, it is advantageously possible to select rich during the ongoing operation of an underlying electronic computing system or during the execution of a program Speicherbe ^¬ rich, whereby the configurability is significantly improved. Under an ongoing operation of the electronic computing system is in particular an active state to understand in which this performs arithmetic operations. The limitations of the prior art are overcome with the present invention in an advantageous manner and the above object is achieved. It is thus an improved ratio of the error detection ^¬ and / or error correction capability allows a sure to be provided memory requirements for test data and can be realized less expensive, for example, in comparison with the redundant memory solutions. The test data can also be secured.

A protection of the memory areas or using test data is preferably carried out by means of hardware and / or software ^¬ implemented error detection and / or error correction method, such as ECC or EDC, through which a test and / or correction in the read-write memory existing user data can be done. The generation of the test data is carried out in particular when writing to the read-write memory, while a check and possibly correction when reading the user data is done. When Read-write memories can be used for various embodiments of data memories for electronic systems, such as semiconductor memories or magnetic memories.

According to a preferred embodiment, an association is provided between a program module executed by the electronic computer system and / or memory area of a program code and the memory area to be protected by means of the security area. In particular, the memory area of the program code is specified by means of the underlying virtual or physical memory. Which program module is executed at the respective time is thereby preferably detected by means of the memory addresses of the underlying memory area of a program code.

According to a further preferred embodiment of the invention are in the presence of several hedge areas in

Memory area of the read-write memory, these hedging ^¬ areas independently configurable. In this way, an advantageous increase in the focus is achieved, in particular only for data that is critical to security, and the configurability of the data backup is improved.

As a result of a change of a hedging area from a first storage area to a second storage area of the

Read-write memory or removing a first hedging ^¬ area of a first memory area and generating a new hedging area for a second memory area, preferably no memory access to the first memory area follow. This is particularly advantageous in order to partition the safety and / or security-relevant data and to prevent each affected software modules can access to a storage area to ^¬ which this is not assigned to this or from other reasons, such as a lower security level, may not access the memory area.

The invention further describes an electronic computing system for a motor vehicle, comprising at least one central computing ^¬ unit, a read-write memory and a Speichabsiche ^¬ tion unit for securing user data at least one

Memory area of the read-write memory by means of test data, wherein the memory protection unit is configured to set at least one hedge area for securing a memory area of the read-write memory during the term of the electronic Re ^¬ chensystems, cancel or pretend in such a way that its extension and / or or position is changed with respect to an entire memory area covered by the random access memory.

For the inventive electronic computer system is essentially the same advantages as those described above for which he ^¬-making proper procedures.

A mapping means for mapping between a program executed by the electronic computing system program module and / or memory area of a program code and the specified means of Absiche ^¬ approximately range to be protected storage area is preferred see superiors.

The electronic computing system is preferably configured to carry out the method according to the invention.

The invention particularly preferably finds use in or in conjunction with one or more-in particular fast-clocked-digital signal processors, Field Programmable Gate Array (FPGA) or RISC / CISC CPUs. Further preferred embodiments will become apparent from the following description of an embodiment with reference to FIG. 1.

In a schematic representation shows:

Fig. 1 is an electronic computing system for explaining the

Securing data of a memory according to the invention.

Fig. 1 shows a schematic representation of an electronic computing system 4, e.g. a microprocessor system, to illustrate the invention. According to this exemplary embodiment, memory 3 is assigned to central processing unit (CPU) 1, user data ND in memory 3 being protected by memory protection unit 2 by means of test data PD. Memory 3 is, for example, a random access semiconductor memory, e.g. a RAM. In order to generate the test data PD, known error detection and / or error correction methods such as ECC can be used. When storing useful data ND in memory 3, these test data PD are generated by Speicherabsicherungs- unit 2 and compared when reading in a conventional manner with re-calculated from the read payload ND test data. For better illustration, an exemplary division of test data PD and useful data ND into RAM 3 is depicted in the lower part of FIG. 1, wherein a cell 3.1, in particular a single memory cell or, depending on the granularity of memory 3, a smallest to read or write Unit, eg a word, is.

Memory protection unit 2 sets according to the embodiment, the hedging areas Fl and F2 within the entire Spei ^¬ cherbereichs of memory 3, which are to be safeguarded by means of test data PD or hedged. According to this example, two fused memory areas Fl, F2 are given, but it can also be more than two or only a single to same time or no secured storage area be present. Memory areas which are to be protected by means of useful data ND can be set several times independently by memory backup unit 2 at runtime by computer system 4 or can again be classified as not to be protected. Furthermore, the size of each already existing secure storage area or security area F1, F2 can be specified and changed during operation of the computer system 4. The hard ^¬ interpretation of the hedged memory areas and the size of which is preferably carried out by means of a mapping of a program executed at the current time by the computer system 4 program module in such a way that the program module executed at the time dictates the hedged storage area or this module is associated with a secured memory area. Which program module is executed at the respective time can be detected, for example, by means of the memory addresses of the underlying memory area of a program code. The assignment or assignment of a program module or its program memory area to a memory area to be protected can be done, for example, by means of an allocation table by the memory protection unit 2. This mapping table can be created from the relevant part of the operation ^¬ system software, managed and stored statically to the memory protection unit 2 (hardware), regardless of ak ^¬ tual state of the actual program execution to be available at all times. The memory protection unit 2 would allow according to this realization, an automatic configuration of the hedging areas.

According to an alternative embodiment, memory protection unit 2 is always configured for only one area to be protected in such a way that the corresponding configuration is implemented by means of software when entering or activating a program area that is worthy of data protection and / or instruction protection. The Corresponding allocation table is managed in accordance with this realization by means of software and memory protection unit 2 is not necessarily made available, but tested as required by the software for the configuration of memory protection unit 2 before program execution. This alternative embodiment advantageously does not require any additional resources, such as an integrated logic circuit for accessing and reading the access ports, or an integrated logic circuit for dynamically configuring memory protection unit 2. By appropriate adaptation of the software, implementation into existing systems can be made.

The additional memory requirement for the test data PD required to implement the invention is calculated in the exemplary embodiment according to FIG. 1 as follows:

S PD = SNDFI * Size P _D / Size _ND + S _ND F2 * Size P _D / Size _ND with

Sp _D - additional storage volume for the test data total

SNDFI ^_ Storage volume within security window Fl

S _ND F2 - Storage volume within security window F2

Size _ND - storage volume of a storage cell 3.1 of the payload data Size - storage volume of the check data for securing a storage cell with payload data

The software architecture is preferably interpreted in such a way that after a change of a second coverage area of a first SpeI ^¬ cherbereich on a second storage area or removing a first coverage area of a first memory area and generating a new coverage area for a

Memory area, no memory access to the first memory area can be done. The content or extent of the stored data, which includes user data and test data, is canceled a protection of a memory area not changed, but released for writing. One advantage, for example, is that an application on microcontroller units (MCU) whose ECC logic (error correction of the memory) can specify or manage only one memory area, since this only about the required number of configuration registers for a security area, eg Offset, Length, Status, Config. With the invention, it is thus possible to operate a plurality of hedging regions with precisely one reconfigurable hedging region in a quasi-simultaneous manner. In case of data access

(not program code access) a correct address assignment to the user data, in particular by means of adaptation of the software reali ^¬ Siert, since an automatic incrementing the physical memory address to access a memory cell 3.1 could lead to test data, since after cancellation of the protection of a memory area, the addressing no longer User or test data selectively. Read operations in which payload data would be read from test data addresses would thus be unavoidable. In order to avoid this, the way of accessing and interpreting the data by addressing directly in the signal path,

Modified decoder and test blocks such that the test data PD is not read and instead essentially ignored. The same applies to instructions, although, especially apart from self-modifying program code, primarily for reading. In a case in which a program module, for example, only reading and not necessarily secured both data and program code must read from a memory, as is the case with a checksum calculation over the entire memory area, the test data PD are thus not included in the checksum. The skipping is done for this and similar cases be ^¬ preferably also for instructions. Alternatively, a repeated reconfiguration or reconfiguration of the hedging area when entering / leaving the hedging area is possible.

Claims

claims

1. Method for securing user data (ND) of a

Read-write memory (3) of an electronic computing system (4) in a motor vehicle, characterized in that we ^¬ nigstens a hedging field (F1, F2) for securing the user data (ND) of a memory area of the read-write SpeI ^¬ Chers ( 3) by means of test data (PD) at runtime of the electronic computing system (4) set or canceled or specified in such a way that its extension and / or position relative to an entire memory area covered by the read-write memory (3) is changed ,

2. Method according to claim 1, characterized in that an association is provided between a program module and / or memory area of a program code executed by the electronic computer system (4) and the memory area to be protected by means of the security area (F1, F2).

3. The method according to any one of the preceding claims, characterized in that in the presence of several ^{Verichernungsbe ¬} rich (F1, F2) in the memory area of the read-write memory (3), these hedging areas (F1, F2) are independently configurable.

4. The method according to any one of the preceding claims, characterized in that in response to changes in Absiche ^¬ approach portion (F1, F2) of a first memory area to a second memory area of the read-write memory (3) and removing a first coverage area of a first

Memory area and creating a new hedge area for a second memory area, no memory access to the first memory area can be done. Electronic computing system (4) for a motor vehicle, comprising at least one central processing unit (1), one

Read-write memory (3) and a memory protection unit (2) for securing user data (ND) of at least one

Memory area of the read-write memory (3) by means of

Test data (PD), characterized in that the Speicherab ^¬ backup unit (2) is designed, at least one from ^¬ backup area (F1, F2) for securing a memory area of the read-write memory (3) to the running time of the electronic computing system (4) set, set or in such a way pretend that its extent and / or position is changed with respect to an entire memory area covered by the random access memory (3).

Electronic computing system according to claim 5, characterized in that an allocation means is provided for the association between a program module executed by the electronic computing system (4) and / or memory area of a program code and the memory area to be protected by the security area (F1, F2).

Electronic computing system according to one of the preceding claims, characterized in that it is designed for carrying out the method according to one of claims 1 to 4.