FR2914448A1 - Secured execution computer environment protecting system for very high security digital apparatus i.e. payment terminal, has transcoder detecting whether descriptor returned by memory associates virtual address at physical address of ROM - Google Patents

Abstract

The system has a processor (10) e.g. Intel(RTM: Not defined), with a hardware page table walker (HTW) mechanism (102) to transmit read request of terminal translation descriptors stored in an external memory (2) when an operating system (OS) (21) Linux(RTM: multi-user operating system), and applications (22) emit a virtual address. A transcoder (15) receives one descriptor in response to the request, and detects whether the descriptor returned by the memory associates the virtual address at a physical address of a static RAM (11), a ROM (12) and internal peripherals (13). An independent claim is also included for a method for protecting a secured execution computer environment.

Description

SYSTEM AND METHOD FOR PROTECTING A COMPUTER ENVIRONMENT

  The present invention relates to the field of computer memory management and relates more particularly to a system and a method for securing translation tables stored in an external memory to a secure processor module. In some very high-security digital devices, for example payment terminals, part of the sensitive information used during their operation is, in order to guarantee security, stored in one or more memories internal to the circuit containing the processor in operation. Such circuits include a miniaturized silicon chip or a set of such chips glued together, or on the same support. It is important to note that the miniaturization of the interconnections inside such a circuit makes the observation and the alteration of the signals which are conveyed there difficult and thus expensive. It is therefore effective to keep, within the same circuit, hereinafter named circuit, processor circuit or secure circuit, the sensitive information. One embodiment of these secure circuits can be encapsulated in a protective housing, for example an embodiment in the form of an electronic chip ("chip"). Indeed, if the sensitive information was stored on a memory external to this circuit, for example on a dynamic random access memory DRAM (Dynamic Random Access Memory) of the electronic card of the device, they could be disclosed or fraudulently modified by the observation and / or alteration of the signals conveyed by the electrical tracks connecting the processor circuit to the circuits of the external memory, which electrical tracks are in this case easily accessible.

  It is therefore sought, as much as possible, to keep in the internal memories of the processor circuit, a maximum of sensitive data. Nevertheless, the size, surface and bytes, of the internal memory available inside the circuit hosting a processor is limited. Current systems therefore include both a secure internal memory in the circuit and an external memory of greater capacity connected to this secure circuit.

  In more detail, a secure processor circuit generally contains a number of logical macroblocks. The designer of such a circuit generally uses, and therefore buys, logic macroblocks preconceived to achieve part of the circuit, for example a processor model. It develops in parallel other specialized logic macroblocks, for the other part of the circuit. Because of its complexity, the logical processor macroblock, the "processor" in the rest of the document, is generally preconceived and provided by suppliers of solutions specialized in the field of processors, for example ARM Ltd or MIPS Technology (names commercial). In a system comprising a secure processor circuit and a connected external memory, for example a payment terminal as mentioned above, two software universes (or execution environments) executed on the same processor generally coexist: side, a secure universe based on, in addition to the processor, the memories and peripherals internal to the secure circuit. This environment is very sensitive and should never be compromised, especially when the external memory (which does not concern it) is corrupted; on the other hand, a less secure universe for which it is less damaging and therefore acceptable than its functionalities may be compromised, inter alia, by modifying the content of the external memory, for example through the interception of signals by a malicious person. The less secure universe includes, in addition to the external memory, external peripherals and possibly some memories or peripherals internal to the circuit, not shared with those of the secure universe. When executing the secure environment or the less secure environment, the processor relies on a memory management unit (MMU) to determine the data or data memory addresses. instructions, in particular by the translation of addresses. A translation provides, for a given execution context, the physical address corresponding to the virtual (or logical) address issued by an executed application. The MMU unit includes a cache memory, also called Translation Look-aside Buffer (TLB), containing the most recent translations between virtual address and physical address. On some processor architectures, MIPS (commercial name) for example, this translation cache is filled by the execution of a software routine. On other processor architectures, for example ARM or Intel (commercial names), this translation cache is filled automatically by a hardware mechanism. This mechanism, which is an integral part of the processor, is usually called a "Hardware Page Walker Table", also referred to in the following, by the acronym HTW.

  The HTW uses a database of translation tables present in memory. This database, whose internal architecture can be more or less complex, is intended to provide the HTW, when it consults, translational descriptors for directly or indirectly determine the physical address associated with an address Virtual. The database may combine terminal translation descriptors that associate a virtual page address with a physical page address, and translation table descriptors that associate a range of virtual page addresses with a new table (by an address physical) of the database including other translation descriptors. This can result in a table tree. These translation descriptors are used by the HTW to determine new translations not present in the translation cache TLB and update, if necessary, the latter. The update of this database is performed under the responsibility of the operating system or a virtualization software (hypervisor) when this technology is used. For the rest of the talk, it is assumed that the HTW mechanism traverses this database using physical addresses only and not virtual addresses, otherwise it may be faced with recursive searches (because virtual addresses would themselves to be translated and could potentially launch new routes of the database by the HTW). However, those skilled in the art will have no difficulty in extending the following description of the invention in the case where, if the HTW mechanism supports it, these accesses are made using virtual addresses. The external memory being much larger than the internal memory, the less secure universe is much larger than the secure universe. Also, the majority of the translations database concerns the less secure universe. For obvious reasons of memory space, it is therefore appropriate to place the part of the translation database concerning only the less secure universe, in a memory external to the secure circuit of the processor. The present invention relates to processors with a HTW mechanism and more particularly relates to a system for protecting a secure execution computing environment, comprising a secure processor circuit, at least one resource defining a first unsecured universe, said resource comprising an external memory connected to said secure circuit, said external memory comprising a plurality of translation descriptors (part of the translation database) arranged to associate virtual addresses with physical addresses belonging to the less secure universe, c ' that is, designating a resource of this universe, said secure processor circuit including at least one internal resource (usually an internal memory and possibly other internal resources) and a processor for executing at least one application, said at least one internal resource defining a second united to secure, the processor comprising a hardware mechanism HTW arranged to issue at least one request (or access) for reading one or more translation descriptors stored in external memory, when the execution of an application sends a virtual address. Such requests are usually issued when the requested translation is not present in the MMU's TLB cache.

  In practice the HTW issues read requests until it obtains a terminal translation descriptor. The first requests make it possible to browse the translation database via table descriptors and the last request provides a terminal descriptor including the desired translation physical address. This descriptor makes it possible to update the translation cache TLB of the memory management unit MMU, when it has to translate a virtual address, issued by the running application, into a physical address, and that the corresponding terminal translation descriptor, or its equivalent, is not present in its translation cache TLB.

  The translation database placed in external memory and used by a less secure operating system of the universe to specify the addressing and the use of the physical memory of the applications that it executes, can be, by its external location and in case of bad intention, modified so that these applications are to have access to ranges of physical addresses of the secure universe. Such access is detrimental in that it may alter the integrity of the secure environment. The solution of placing this database in secure internal memory does not seem appropriate for the reasons mentioned above (limited internal storage resources). A solution to this problem is proposed by US Pat. No. 7,124,274 which relates to a system as presented above in which the HTW of the processor has two registers, a first one assigned to the secure universe and pointing to a database of translations said secure, and a second assigned to the less secure universe and pointing to a second database of translations said unsecured. Each database includes the translations associated with the corresponding universe. The processor switches from one registry to another when it executes instructions for a secure application or an insecure application. Thus, the HTW mechanism solves translations in one universe or the other. However, a filter is applied to detect when a translation descriptor, returned by the unsecured database, describes a physical address of the secure universe. Appropriate countermeasures are then taken.

  Nevertheless, this solution requires a certain number of modifications of the existing processor architectures and, in particular, the modification of the HTW in such a way that it comprises two registers designating two translation databases, the register commonly used depending on the fact that the processor is in an operating mode belonging to the secure domain or not. The HTW mechanism is also modified to detect the environment to which the translation request is to be processed and to switch to the correct associated register. These changes are only available on a small number of processor models, which are more expensive than comparable unmodified processor models. An object of the invention is to provide a solution to the above problem without modifying the current processor models. Thus, an object of the invention is to enable the circuit designer mentioned above, by making a logic block of low additional complexity to the processor block, to solve the particular security problem described above, by using for the secure circuit a low-cost standard preconception processor model, instead of having to use a preconceived processor model that is more expensive because it has special security features. The invention achieves this goal by using a logic block integrated in the secure circuit, hereinafter "transcoding means", and set to receive the data (the translation descriptors) returned to the HTW by the external memory. , and possibly modify them before transmitting them to the HTW. This transcoding means then filters the translation descriptors received from the external memory, and when it determines that they describe a physical address of the secure universe, issues an error. For this purpose, the invention firstly relates to a system as presented above in which said secure processor circuit further comprises a transcoding means disposed between said processor and the external memory so as to receive (or intercept) at least one translational descriptor in response to said read request of the external memory transmitted by said HTW mechanism (when it consults the translation database), and said transcoding means being arranged to detect if said translation descriptor returned by the external memory associates a virtual address with a physical address of the secure universe. Thus, the current processors, having a usual HTW mechanism, having a single translation database designation register, are kept to provide the desired degree of security. The transcoding means can take place as a relay of read requests of the translation database, issued by the HTW mechanism and filters the translation descriptors that are made in response thereto. It is then expected that said transcoding means is also arranged to receive the read request (s) issued by the HTW for purposes of logical synchronization with the HTW. Depending on the embodiment of the transcoding means, it may also receive translation descriptors received from the internal memory, for logical synchronization with the HTW. The embodiment of the invention does not require the modification of the preconceived model of the processor, a modification that the circuit designer generally could not carry out, due, among other things, to technical and legal obstacles. In this way, secure environment protection is provided to all existing processor models. Since the external memory is likely to be corrupted, the transcoding means ensures that the translation descriptors that are returned specify physical addresses of the less secure universe. Behavioral responses can then be made in response to this detection to ensure security of the secure universe. As a result, the transcoding means makes it possible to limit the range of physical addresses that can be described by any translation table located in the external memory.

  The invention therefore prevents unauthorized access to the secure universe via a virtual address whose translation into a physical address depends, even partially, on a translation table located in external memory that can be altered. .

  In one embodiment, it is provided that said transcoding means is capable of generating, following said detection, a computer exception so that the processor or the operating system (possibly a hypervisor) takes the necessary steps to guarantee the hermeticity. of the secure environment.

  An exception is a signal issued when running an application to warn of an exceptional situation that does not correspond to a normal execution of the application, and for which the operating system, the processor or adapted routines takes restorative actions.

  The exception is issued when the invalid physical address, because it belongs to the secure universe, is returned via a terminal translation descriptor or via a translation table descriptor. This computer exception can be realized, for example, by applying the following rules: - if the faulty translation descriptor is a terminal translation descriptor, it is modified so that it specifies that the logical address to be translated is invalid, no physical address associated with it. Thus the invalid access exception is generated. The OS operating system routine (or the hypervisor) associated with this exception can then determine whether the invalidity of the access results from the action of the transcoding means or not, for example by reading a status register. of this transcoding mechanism, the designer of the system having taken care to make this register accessible to the processor as a peripheral register. if the faulty translation descriptor is a translation table descriptor, and if it can be modified into a terminal translation descriptor, then it is modified to an invalid terminal translation descriptor as described above, if the Offending translation descriptor is a translation table descriptor, but can not be modified into a terminal translation descriptor because the memory access of the HTW corresponds to a hierarchical level of the translation database tree where the HTW does not expect to receive a terminal translation descriptor, so the address specified by the offending descriptor is transformed in such a way that it specifies a valid physical address of the external memory. A state machine of the transcoding mechanism notes that it must signal an exception, by one of the two previously described rules, as soon as the access generated by the HTW corresponds to a hierarchical level where it is possible to return a descriptor terminal translation invalid.

  If the system designer does not wish to modify the management by the OS (or hypervisor) of the exceptions, and thus not generate an unusual exception, resulting from the action of the transcoding mechanism, it is expected that, to ensure following the execution of the current application, said transcoding means is able to modify following said detection (that is to say when the physical address specified by the translation descriptor designates the secure universe ), said translation descriptor received by specifying a physical address designating the less secure universe. This ensures that the continued execution of the application does not read or alter data of the secure universe. The execution of the application is now corrupted, which is irrelevant because anyway the external memory is also corrupted. But, this is without damage to the secure universe. In one embodiment, said plurality of translation descriptors is grouped into a plurality of translation tables in the translation database, said translation tables being grouped into table types. Depending on the type of the table considered, an entry of a table may, depending on the value of a binary field of this entry, contain a terminal translation descriptor associating a range of virtual addresses with a range of physical addresses, ie a table translation descriptor describing another table of the translation database. A table descriptor contains, in addition to other possible information, the physical address, or at least a sufficient part of it, of the table it describes. The translation database can thus be organized in a tree-like manner, in particular in the form of a hierarchical tree, said types corresponding to the different hierarchical levels. The HTW, when it consults the database, continues the search in it, possibly descending into the subtrees of the translation database, as long as the read data corresponds to a table descriptor. Only reading a terminal translation descriptor terminates the search. The organization of type tables makes it possible, in particular, to add additional security by verifying the compatibility of the addresses specified by the received translation table descriptors with the type of current translation table. The transcoding means is arranged to apply to the physical address of a translation descriptor received in response to a read request from the HTW, a processing rule before transmission of the translation descriptor received to the hardware mechanism HTW, said rule being function said type of translation table containing said received descriptor. For this purpose, said transcoding means comprises a logic unit storing, at each read request sent by the HTW, the type associated with the translation table referred to in the request. As a result, the transcoding means continually knows the type associated with the request and therefore the rule to be applied to the response received, if it comes from the external memory, so that it can modify the descriptor appropriately. received before transmitting it to the HTW. Several applicable rules are described in more detail later. When at least one translation descriptor associates a range of virtual addresses with another translation table by indicating a physical address of said other table, it is expected that the physical addresses of the translation tables of the same type of tables belong to the same address range associated with said type, and the transcoding means is then arranged to verify that said physical table address of said descriptor received in response to the read request belongs to the range of addresses associated with the type of said another table specified by the descriptor received, and transmit, in case of positive verification, said translated descriptor received to said hardware mechanism HTW. The HTW mechanism thus verifies at each step of the path of the tree in order to resolve an address translation, generally the translation table trees comprise two to three levels, that the physical addresses specified by the descriptors of translated translations are compatible with those expected. When this is the case, the translation descriptors are transmitted to the HTW for further action, in particular by issuing a new request to read the database with the address of a new table in order to proceed. the resolution of the virtual address.

  If this is not the case (negative verification), the transcoding means is then arranged to modify the translation descriptor before transmission to the HTW so as to: transform said physical address into a valid physical address belonging to the range of addresses associated with the type of translation table specified by the received translation descriptor, that is, the address that the returned descriptor specifies is in the address range associated with the expected type; or - modify the type of translation table specified by the translation descriptor to the type corresponding to the address range to which the physical address specified by the received descriptor belongs. Thus, in the case of a negative verification, either the type of the translation table described or the physical address of the translation table described, is modified so that the type and the address are compatible with each other. The first method is preferred in that the modification of the address is always feasible, the second method assumes that the HTW decodes the descriptor type from a bit field of the descriptor itself (which is not always the case) so that the transcoder can modify this bit field, and thus modify the type of the descriptor as decoded by the HTW. If the HTW calculates the descriptor type implicitly, the second method is not feasible. If the HTW partially decodes the descriptor type using an explicit encoding of one type among an implicit subset of possible types, the second method, depending on the precise characteristics of the HTW, may or may not be to be achievable. To simplify the processing that the transcoding means performs, it is expected that the types of tables are encoded in bits among the most significant addresses. As such, the memory addresses of each address range associated with a type have bits, among them the most significant, depending on the type. This embodiment corresponds to a mapping (correspondence) of the external memory, that is to say that the effective addresses are encoded on the remaining bits; bits, among the most significant, being used only to encode the current type of table and therefore know the current level in the path of the tree and the rules to be applied to the translation descriptors that are read. This organization of addresses makes it possible to perform the filtering (transcoding) function even though the processor or the HTW gives no information, by means of transcoding, on the type (normal access, or type of HTW access given) of its accesses. read. It should be noted that normal accesses use addresses whose most significant bits have a different combination of the combinations used to indicate the given types of HTW access, which combination is referred to as a normal access combination. The physical addresses specified by the terminal translation descriptors use the normal access combination because these addresses are intended to translate virtual addresses issued by the applications.

  In this embodiment, it can be provided more particularly, in the case where the descriptor received in response is a terminal descriptor specifying a physical memory page address, that the transcoding means is a filter of said received physical address, before transmission of the received terminal descriptor to said HTW hardware mechanism, the following function: the alteration of said most significant bits of the physical address provided, the bits encoding the actual physical addresses being, in turn, not altered.

  This possible cleaning aims to restore, within the address indicated in the descriptor returned, a correct type of address (the combination of normal access) so that this precise encoding is used when issuing memory requests by the applications (so normal accesses). In order to apply the appropriate filtering function of the current type, it is important for the transcoder to effectively know the path in the database. The use of the most significant bits for this purpose as described above is a solution. Depending on the characteristics of the HTW, the transcoding means may be required to record the requests issued by the HTW (it can recognize them because their address does not use the normal access combination as defined above). For this purpose of recording, it may be provided the use of a register as previously described in order to memorize the type of descriptor expected (and therefore the filtering operations to be applied to the return). To update this register, the transcoding means should list all requests issued by the HTW to access the descriptors in memory. To do this, it is provided that said transcoding means is arranged to receive said at least one read request from the external memory. In addition, access to descriptors in internal memory can change the course in the database. Thus, it is provided that said at least one internal resource comprises at least one internal memory storing translation descriptors, said hardware mechanism HTW is then also arranged to transmit at least one read request of a translation descriptor stored in internal memory when the transmission of a virtual address by the execution of an application, and said transcoding means is also arranged to receive said at least one read request from the internal memory.

  In a configuration as presented above, in which a processor allows the execution of several environments some of which are secured, it is appropriate to use a hypervisor (processor virtualization software) to partition various applications to be executed (including operating systems vis-à-vis very sensitive secure applications, for example those relating to payment by credit card terminals). In particular, said application is a hypervisor executed in a privileged mode of the processor. This hypervisor thus controls access to hardware resources of the secure circuit by the applications and operating systems running on the processor. According to two embodiments: said external memory comprises an operating system for executing a plurality of applications, said operating system being executed by said processor under the control and supervision of said hypervisor, said internal memory comprises at least one secure application, which may itself be an operating system, this application being executed under the control and supervision of said hypervisor. As mentioned above, said processor may comprise a MMU memory management unit containing a cache of recent address translations TLB, said hardware mechanism HTW being arranged to update said TLB cache in response to said request for consultation.

  In one embodiment of the invention, it is provided that said secure circuit comprises an external memory controller by which said secure circuit communicates with said external memory, said transcoding means being disposed between the processor and said external memory controller. The transcoding means therefore relates to a specific module integrated in the secure circuit at a communication matrix for communication between the HTW and the external memory controller.

  According to one variant, said transcoding means comprises external memory controller functions by virtue of which said secure circuit communicates with said external memory. Advantageously, said transcoding means is a hardware unit integrated in the secure module. Such an embodiment, from the functional specificities described above, has no technical complexity. The processor and possibly other units of the circuit can also access the external memory. In this case, it is provided that said transcoding means is arranged to also receive a read request not generated by the hardware mechanism HTW and to transmit, to the transmitter of said request and without modification, the data received in response to this request. Thus delimits the invention to secure the management of memory by the processor (through the MMU and HTW). The invention also relates to a method for protecting a secure computing environment executed in a secure processor circuit 20, the method comprising: executing an application by a processor in said secure circuit; application transmits a virtual address, a step by which a hardware mechanism HTW of said processor issues at least a read request of at least one translation descriptor stored in an external memory, said external memory being connected to said secure module and comprising a plurality translation descriptors arranged to associate virtual addresses with physical addresses belonging to a less secure universe.

  The method relies on a transcoding means receiving the response to said at least one read request, this transcoding means being disposed in said secure processor circuit between said processor and the external memory. The method further comprises the steps of: - receiving, by said transcoding means, at least one translation descriptor in response to said at least one read request, and - checking, by said transcoding means whether said received descriptor associates a virtual address with a physical address of a secure universe, said secure universe comprising at least one resource internal to said secure circuit. In one embodiment, the method comprises, when said verification is positive (association of a virtual address to an address of the secure universe), a step of generating, by said transcoding means, a computer exception. In another embodiment, the method comprises, when said verification is positive, a step of modifying said received translation descriptor by specifying a physical address designating said insecure universe, before transmission of this modified address to said hardware mechanism HTW. In particular, said plurality of translation descriptors is grouped into a plurality of translation tables, said translation tables being grouped into table types, at least one translation descriptor associates a range of virtual addresses with another translation table indicating a physical address of said other table, the physical addresses of the translation tables of the same type of tables belonging to the same address range associated with said type, the method further comprising a second verification step, by said means of transcoding, that said physical address of the descriptor received in response to the read request belongs to the address range associated with the type of said other translation table specified in the received descriptor, and a subsequent transmission step, in the case of second positive verification of said translated translation descriptor to said HTW hardware mechanism. In this embodiment, it is also envisaged that at least one translation descriptor is a terminal translation descriptor associating a range of virtual addresses with a range of physical addresses of the less secure universe, said descriptor addresses encoding in a part of their bits, the type of table to which they refer. The method then further comprises, when a terminal translation descriptor is received by the transcoding mechanism, a step of altering said received end descriptor bits into a specific format (hereafter referred to as "normal access combination"). . More particularly, the method may further comprise, at the time of transmission of said at least one request, a step of updating a register of said transcoding means, said register comprising the type associated with the translation table referred to in FIG. said request, and at least one step of processing said translation descriptor received by said transcoding means, said processing being a function of said type of table registered in the register.

  In one embodiment, the applications are executed under the control of a hypervisor, and the method comprises, following the detection of the exception by said hypervisor, a step of altering confidential data stored in internal memory, in order to prevent access to them.

  The invention will be better understood by means of the description, given below purely for explanatory purposes, of one embodiment of the invention, with reference to the appended figures: FIG. 1 illustrates the general architecture of the present invention; - Fig. 2 represents an example of software architecture in which the invention is inscribed; - Fig. 3 is an example of translation table structure for the implementation of the invention; and - Fig. 4 illustrates an example of formatting addresses and the principle of correspondence (mapping) associated memory. With reference to FIG. 1, a module or secure circuit 1 comprises a processor 10, internal memories 11 and 12, one or more internal peripheral (s) 13, an external memory controller 14, a hardware transcoder unit 15 and a bus or matrix 16 between these various entities. The transcoder 15 is located between the processor 10 and the external memory controller 14, so that all read accesses to an external memory 2 connected by the controller and generated by the HTW pass through the transcoder 15. These entities are located either on the same silicon chip, this silicon chip being encapsulated in a housing, or distributed on separate silicon chips, these silicon chips and their interconnections being encapsulated in the same housing.

  The encapsulation in the same housing is carried out so that it is not possible to observe or alter the communication signals between these entities without very important technical means. The processor 10 includes a MMU memory management unit 100, a recent translation table TLB 101 and a Walker Table HTW 102 hardware page mechanism to update the TLB 101.

  A single register 1020 is associated with the hardware mechanism HTW 102 and indicates the location of the initial translation table 111 from which the resolution of a logical address for the processor can be conducted.

  Also with reference to FIG. 2, the processor 10 allows the execution of a hypervisor 17 in a privileged mode of the processor and at least one secure application 18 using sensitive data stored in the SRAM 11 memory (Static Random Access Memory) module 1. The code the hypervisor and the secure application, and the non-modifiable data they use, are stored in the ROM 12 (Read Only Memory) of the secure module 1. The secure module 1 is connected to the external memory 2 (limited to 512 MB) and any external peripherals 2 'by a connection matrix 3 of the printed circuit track type and connectors. The external memory comprises an operating system OS 21, for example Linux, adapted to be executed on the processor 10 under the control of the hypervisor 17 and the applications 22 executed by this operating system. These applications and OS use instruction codes and data 23 stored in this external memory 2.

  The HTW mechanism 102 of the processor 10 relies on a translation table database 24 stored in external memory 2 to resolve the logical address translations used by the operating system 21 and the applications 22 when they are executed. by the processor 10.

  The secure application 18 and the entities of the secure module 1 constitute a sensitive execution environment and for this secure SEC-S. The external memory 2, the applications 22, the operating system 21 and the peripherals 2 'constitute a less secure universe ENVIR-NS, in particular because the exchanges with the module 1 can be intercepted at the level of the connection matrix 3.

  The less secure universe ENVIR-NS may also include some of the internal memory and peripherals of the enclosure 1. The less secure universe ENVIR-NS is nonetheless resistant to software-only attacks, thanks to the use of the processor MMU and the software isolation that it provides. These two universes ENVIR-S and ENVIR-NS coexist on the same processor 10 thanks to the specialized processor virtualization software, (hypervisor 17). The resources (memory (s), device (s)) used by the hypervisor operate in the secure universe. The general-purpose operating system protects its applications with each other by the use of a virtual MMU which is performed by software services provided by the hypervisor 17, these services using the actual MMU of the processor. Such a solution is described in particular in the patent application WO-2006/027488. Now with reference to FIG. 3, since the processor 10 is dedicated both to the secure universe ENVIR-S and to the less secure environment ENVIR-NS, the initial translation table 111 is stored in the internal memory 11 secured. Its size is reduced, for example 16 KB, and refers, as regards the data of the insecure universe to the translation tables of the base 24. On the other hand, with regard to the data secured in the internal memory 11 or 12, this table 111 contains either directly the logical address-physical address translations of the memory pages of the internal memory, or the address of another translation table stored in the internal memory. Traditional mechanisms apply then. The invention aimed primarily at protecting the system when accessing translation tables in external memory, the resolution of logical addresses for secure data is not discussed further.

  The database 24 consists of an assembly of translation tables 240 in a tree-like manner. For this purpose, three types of translation tables are used. Terminal translation tables are tables where each E entry describes the address translation of a logical (or virtual) address page corresponding to the E entry into a physical address page of the memory (translation descriptor). final). The physical pages of the memory are generally of a size of the order of 4 kilobytes.

  The non-terminal X translation tables are tables of which each entry E (called table translation descriptor) describes another translation table Y (for example, fill in the @Y address of this other table Y). This table Y, which can be terminal, non-terminal or mixed, describes, with a finer granularity, the range of logical addresses which corresponds to the entry E considered of the table X. The type of the table Y can be either implicit, either encoded in the entry E possibly from an implicit subset of the translation table types. Mixed X translation tables are tables of which each entry E can describe: either the translation of the address of the range of logical addresses corresponding to the entry E into a range of physical addresses; -is another Y, terminal, non-terminal or mixed translation table, which will describe with a finer granularity, the range of logical addresses which corresponds to the entry E considered of the table X. In each entry of a mixed translation table X, an encoding indicates which of these two functions is performed. When another translation table Y is described, the type of the table Y can be either implicit or encoded in the entry E, possibly from an implicit subset of the translation table types.

  Each translation descriptor corresponds to at least one access of the processor, for example, 32 bits. Also referring to FIG. 4, the physical addresses stored in the entries (descriptors) of translation tables are encoded on 32 bits. For example, a physical page is at least 4 KB, so only the 20 most significant bits (MSB) of the 32-bit physical address are needed to encode the physical page address, the remaining 12 bits being used: possibly indicate the type of the translation descriptor, for example from an implicit subset of translation descriptor types (for HTW purposes), - for terminal translation descriptors only, to encode various information about the properties of the translation descriptor the physical page, such as its accessibility read, write, possibly depending on the operating mode of the processor in which access is made. The tree of translation tables 240 in the base 24 defines these three (N) types of tables, each type corresponding to a level of the tree as illustrated in FIG. 3.

  The HTW mechanism recognizes three different types of HTW-1, HTW-2 and HTW-3 (HTW-N) tables. A memory access generated by the HTW 102 for resolving an address translation is said to be of type P when it corresponds to the reading of a translation table of type P. The processor 10 does not indicate, when accessing reading the memory, if the access was generated by the HTW 102, or results from the usual execution of a memory read instruction. If the transcoder 15 is set so that it also intercepts read accesses that are not generated by the HTW 102, then the type 0 access is defined as an access that is not generated by the HTW. .

  If type 0 exists, the external memory is mapped four (N + 1) times: it can be accessed via four (N + 1) different physical address ranges designated PAP [0] to PAP [3] ( PAP [N]).

  If type 0 does not exist, the external memory is mapped three (N) times: it can be accessed via three (N) ranges of different Physical Addresses numbered PAP [1] to PAP [3] (PAP) [NOT]). In both cases, the PAPs are all the same size and allow access to all the external memory 2. The two most significant bits [31; 29] of the physical addresses are decoded as follows: - 00 -> indicates that the access is internal to the secure circuit. Internal access remains inside the secure circuit 1, so that from outside the circuit 1, it can not be altered or even known that it has occurred, - 01 -> indicates that the access is external and relates to the external resources 2 ', - lx -> indicates that the access is external, and relates to the external memory 2 (x being 0 or 1, as described below). External access, meanwhile, is conveyed on the electrical tracks of the external communication matrix 3 in order to access one of the external resources 2 or 2 '(thus necessarily the less secure universe). When the physical address corresponds to an address of the external memory 2 (that is, the bit [31] is 1), the bits [30:29] indicate the type number: 00 -> access was not generated by the HTW (the filter is inactive), 30 01 -> access must be filtered, and corresponds to type HTW 1 25 10 -> access must be filtered, and corresponds to type HTW 2 11 -> the access must be filtered, and corresponds to the type HTW 3, When the address corresponds to the external memory 2, the bits [28: 0] correspond to the effective address in the external memory 2.

  This means that the physical addresses whose bits [31, 30, 29]: -valent 100, form the PAP [0]; - are 101, form the PAP [l]; worth 110, form the PAP [2]; - are 1 1 1, form the PAP [3].

  When executing the applications and operating systems by the processor, the hypervisor 17 stores the data addresses in the form indicated above, that is to say using the three most significant bits to encode the externality and the type of table concerned.

  The hypervisor thus organizes logical and physical addressing management so that type i accesses use the PAP [i]. The transcoder 15 has a logical unit or register 150, which allows it to recognize which PAP a physical address belongs to. It updates this logical unit when the tree is traversed, for example by incrementing by 1 the unit if the course of the tree is done level by level, otherwise by updating the logic unit 150 according to the type corresponding to the translation table referred to in the read request issued by the HTW 102.

  During the HTW 15 reloading process of a TLB 101 input, one or more translation tables (111 then 240) are accessed. Access to a translation table (1 1 1, 240) consists of reading one of its inputs.

  The reading of a translation table input 240 of a given type in external memory 2 is performed either: - by a single read access of the memory, - by a consecutive series of read accesses of the memory.

  The number of read accesses to read an entry of a translation table of a given type is specific to this type. In the remainder of this document, and to simplify the explanations without affecting the generality, the reading of a table entry is considered to be performed by a single read access. When the reading of an entry requires several accesses, those skilled in the art will simply extrapolate the explanations by considering for example that a series of consecutive accesses, on a bus of width I bit, can be seen as a single access. , of width (ix I) bits.

  Thus, during a read access to the external memory 2 to resolve a translation, the transcoder 15 recognizes the PAP concerned by the address sought by the three most significant bits [31,30,29] of the requested address. . The transcoder 15 then updates the register 150 with the value of the bits [30,29]. Generally the type is 01 when a new virtual address must be translated. This type is incremented as the tree of the tables progresses and thus addresses indicating new types in the corresponding bits. At this stage, the transcoder 15 is waiting for the response to the request to apply appropriate processing according to the type stored in the register 150. The mechanisms of the external memory 2 resolve the read request issued and returns the descriptor of the base 24 which is associated with the address sent. This translation descriptor indicates either a physical memory page address (final descriptor) or the address of another translation table which must be accessed, by an additional request for reading, to continue the translation of the virtual address.

  Upon receipt of the response, the transcoder 15 applies different rules. For access to the PAP [O] (do not concern requests issued by the HTW mechanism 102), the transcoder transmits the data read unchanged to the processor or to the sender of the request. For non-zero index PAP accesses (relating to requests issued by the HTW 102), the transcoder modifies the read data, before supplying it to the processor HTW, from a rule that depends on the index of the PAP stored in the register 150. This modification ensures the following rules in two separate cases. In a first case, if the returned translation descriptor directly describes the translation of a range of logical addresses into a range of physical addresses, then the transcoder 15 alters certain bits of its contents, so that: 1. either the translation can only specify physical addresses of the less secure universe; 2. If the translation specifies a physical address of the secure universe, then the specified accessibility is null (invalid). Depending on its security requirement, the system designer can modulate and reduce accessibility: run-only and / or read-only, instead of forcing this accessibility to be nil; 3. If the translation specifies a physical address of the secure universe, the transcoder tells the CPU that the instruction that caused the search in the translation database must be canceled or aborted. In this case, the transcoder no longer realizes a transcoding function, but rather a detection function.

  For these three actions, the transcoder generates an interrupt or exception to report the problem to the hypervisor. In addition, it can provide an independent register "status" by which it indicates (value = 1) that it is he who issued an interruption / exception. The hypervisor, considering the attacked system, may, for example, decide to prevent the erasure of encryption keys stored in internal memory or any other adapted countermeasure. However, if the register is 0 and an interrupt / exception is received by the hypervisor, the hypervisor may decide to consider it differently, such as terminating the running application which is at the origin of the translation request interrupted. Indeed, this exception is perhaps only a bug in the application that does not deserve extreme countermeasure, but only the restart of the application. In a second case, if the returned translation descriptor describes a translation table of a given type T, the transcoder 15 verifies that the address of the table T is in the PAP [T]. The type of table T is given by the bits [30,29] of the address returned in the descriptor. If this is the case, the read data is provided to the HTW unchanged (except indefinite case described below). Otherwise the transcoder ensures that: a) preferentially the address is transformed into a valid address belonging to PAP [T], b) is, if the address belongs to the PAP [S] and if the HTW decodes from part of the descriptor , the type of the latter (possibly from an implicit subset of the types of descriptors, this subset containing at least the type S), then the transcoder can modify the descriptor so that it is recognized the address can in this process be modified also to respect, for example corresponding type Method a) is preferred in that it is simpler and works in all cases, unlike method b) which requires the additional condition set out in its description.

  In general, the designer of HTW seeks to allow the realization of databases of compact translations in memory. Also usually all possible combinations for a given page format are significant, that is, there is no binary combination for a translation descriptor, which can not be decoded by the HTW, and lead to a predictable and legal behavior of it. But in the case where the HTW 102 does not support all the possible combinations, and in the event of a table entry comprising unsupported combinations, an unsupported arrangement (creation of loop in the structure for example), or some other improper realization of the translation database, the HTW 102 could then behave indefinitely, posing a threat to the security of the secure universe. Consequently, the transcoder 15 also has the role of protecting the HTW against all the defects or deficiencies of the translation database, these defects or defects that could be achieved, for attack purposes, by modifying the contents of the memory. external, by means of alteration of the signals. To this end, the transcoder 15 detects these defects and defects. This detection is carried out, for example, as follows: - when a request is sent by the HTW, the transcoder locates what is the expected type. When the descriptor is returned by the external memory, the transcoder checks its conformity with the expected type, according to rules specific to each type (for example to check that a translation table address alignment constraint is respected); - When a defect is detected then the Transcoder: • either transforms the incorrect data (s) into correct data (s), then applies a transcoding complying with one of the rules 1, 2 or 3 above; • tell the CPU that the instruction that caused the search in the translations database must be canceled or abandoned. In both cases, the transcoder 15 then generates an interrupt or an exception to report the problem to the hypervisor.

  Instead of using an external memory 2 mapped several times by PAPs 20, it can be mapped once. The corresponding physical address range is divided into ZONEs, of equal size or not, playing the same role as the PAPs. In this case, the hypervisor must place translation tables only in the corresponding zones, which can represent a significant constraint (more important treatments). But this variant has the advantage of reducing the physical address space consumed by the external memory. A mixture of the concept of PAP and ZONE can be used to achieve a compromise between flexibility and size of the physical address space consumed by the external memory. The bus 16 may have signals whose combinations can indicate whether the HTW 102 is accessing or not, and what type this access is. The transcoder 15 therefore no longer needs the concept of PAP because it obtains, by these signals, the TYPE information needed to apply the appropriate transcoding rule.

Claims (22)

  A system for protecting a secure execution computing environment, comprising a secure processor circuit (1), at least one resource (2, 2 ') defining an insecure universe, said resource comprising an external memory (2) ) connected to said secure circuit (1), said external memory (2) comprising a plurality of translation descriptors arranged to associate virtual addresses with physical addresses belonging to the less secure universe (2, 2 '), said secure circuit ( 1) comprising at least one internal resource (1 1, 12, 13) and a processor (10) for executing at least one application (21, 22), said at least one internal resource defining a secure universe, the processor comprising a hardware mechanism HTW (102) arranged to transmit at least one read request of one or more translation descriptors stored in external memory (2), when the execution of the application (21, 22) issues a virtual address, characterized in that said secure processor circuit (1) further comprises transcoding means (15) disposed between said processor (10) and the external memory (2) so as to receive at least one descriptor of translation in response to said at least one read request of the external memory transmitted by said hardware mechanism HTW, said transcoding means (15) being arranged to detect whether the translation descriptor returned by the external memory associates a virtual address with an address physics of the secure universe (11, 12, 13).   2. System according to claim 1, wherein said transcoding means (15) is capable of generating, following said detection, a computer exception.   3. System according to claim 1 or 2, wherein said transcoding means (15) is able to modify, following said detection, said translated translation descriptor by specifying a physical address designating the less secure universe (2, 2 '). ).   4. System according to one of claims 1 to 3, wherein said plurality of translation descriptors is grouped into a plurality of translation tables (240), said translation tables being grouped into table types, at least one descriptor of translation associates a range of virtual addresses with a range of physical addresses of the less secure universe (2 2) the transcoding means (15) being arranged to apply, to said physical address of said translation descriptor received in response, a processing rule before transmitting the received translation descriptor to the HTW hardware mechanism (102), said rule being a function of said type of table containing said received descriptor.   5. System according to the preceding claim, wherein said transcoding means (15) comprises a logic unit (150) storing, at each read request, the type associated with the translation table referred to in the request.   6. System according to one of claims 1 to 3, wherein said plurality of translation descriptors is grouped into a plurality of translation tables (240), said translation tables being grouped into table types, at least one descriptor of translation associates a range of virtual addresses with another translation table (240) by indicating a physical address of said other table, the physical addresses of the translation tables of the same type of tables belonging to the same range of addresses ( 20) associated with said type, the transcoding means (15) being arranged to verify that said physical table address of said translation descriptor received in response to the read request belongs to the address range (20) associated with the type of said another translation table (240) specified by descriptor received, and transmit, in case of positive verification, said translated translation descriptor to said hardware mechanism HTW.   The system according to claim 6, wherein the transcoding means (15) is arranged, in the case of a negative check, to transform said received descriptor physical address into a valid physical address belonging to the associated address range (20). the type of translation table (240) specified by the received descriptor.   8. System according to claim 6, wherein the transcoding means (15) is arranged, in the case of negative verification, to modify the type of translation table (240) specified by the received descriptor in the type corresponding to the range. address (20) to which said received descriptor physical address belongs.   The system of claim 5 or 8, wherein the addresses of each address range (20) associated with a type have the most significant bits depending on said type.   10. System according to claim 4 to 9, wherein said plurality of tables (240) is organized in the form of a hierarchical tree, said types corresponding to different hierarchical levels.   11. System according to one of the preceding claims, wherein said transcoding means is also arranged to receive said at least one read request from the external memory (2).   12. System according to the preceding claim, wherein said at least one internal resource (11, 12,   13) comprises at least one internal memory (1 1, 12) storing translation descriptors, said HTW hardware mechanism (102) is also arranged to transmit at least one read request of a translation descriptor stored in internal memory (11). , 12) during the transmission of a virtual address by the execution of an application (17, 18, 21, 22), and said transcoding means (15) is also arranged to receive said at least one request for reading the internal memory (11, 12). The system of one of the preceding claims, wherein said processor (10) comprises a memory management unit (100) containing a recent TLB address translation cache (101), said HTW hardware mechanism (102) being arranged to update said TLB cache (101) in response to said request for consultation.   The system according to one of the preceding claims, wherein said secure module (1) comprises an external memory controller (14) by which said secure module (1) communicates with said external memory (2), said transcoding means ( 15) being disposed between the processor (10) and said external memory controller (14).   15. System according to one of the preceding claims, wherein said transcoding means (15) comprises external memory controller functions (14) with which said secure module (1) communicates with said external memory (2).   The system according to one of the preceding claims, wherein said transcoding means (15) is arranged to also receive a read request not generated by the HTW hardware mechanism (102) and to transmit, without modification, the received data item. response to this request, to the issuer of said request.   A method for protecting a secure computing environment executed in a secure processor circuit (1), the method comprising: executing an application (21, 22) by a processor (10) in said secure circuit ( 1), when the application (21, 22) issues a virtual address, a step by which a hardware mechanism HTW (102) of said processor (10) issues at least one read request of at least one stored translation descriptor in an external memory (2), said external memory (2) being connected to said secure module (1) and comprising a plurality of translation descriptors arranged to associate virtual addresses with physical addresses belonging to a less secure universe (2, 2 '), characterized in that the method further comprises the steps of: receiving, by transcoding means (15) disposed in said secure processor circuit (1), between said processor (10) and theExternal memory (2), at least one translation descriptor in response to said at least one read request, and verification, by said transcoding means (15), whether said received descriptor associates a virtual address with a physical address of a secure universe, said secure universe comprising at least one internal resource (11, 12, 13 ') to said secure circuit (1).   18. The method of claim 17, comprising, when said verification is positive, a step of generating, by said transcoding means (15), a computer exception.   19. The method of claim 17 or 18, comprising, when said verification is positive, a step of modifying said received translation descriptor by specifying a physical address designating said insecure universe (2, 2 '), before transmission of this modified address. to the hardware mechanism HTW (102).   The method according to one of claims 17 to 19, wherein said plurality of translation descriptors is grouped into a plurality of translation tables (240), said translation tables (240) being grouped into table types, at least a translation descriptor associates a range of virtual addresses with another translation table by indicating a physical address of said other table, the physical addresses of the translation tables of the same type of tables belonging to the same associated address range said type, the method further comprising a second step of verifying, by said transcoding means (15), that said physical address of the descriptor received in response to the read request belongs to the associated address range (20) to the type of said other translation table (240) specified in the received descriptor, and a subsequent transmission step, in case of a second positive check, of said translated translation descriptor received at said HTW hardware mechanism (102).   21. Method according to the preceding claim, wherein at least one translation descriptor is a translationterminal descriptor associating a range of virtual addresses to a range of physical addresses of the less secure universe (2, 2 '), said addresses. descriptor encoding, in a portion of their bits, the type of table to which they refer, the method further comprising, when a terminal translation descriptor is received by the transcoding mechanism, a step of altering said descriptor bits; terminal received in a specific format.   22. Method according to one of claims 17 to 21, further comprising, at the transmission of said at least one request, a step of updating a register (110) of said transcoding means, said register ( 110) comprising the type associated with the translation table (240) referred to in said request, and at least one step of processing said translation descriptor received by said transcoding means (15), said processing being a function of said type of table stored in said the register (110).