JP2004503860A - Data processing method and apparatus for execution of protected instructions - Google Patents

Abstract

The device for determining whether an application program has been manipulated improperly is provided with a signature register connected to the output of the instruction register and / or to an address of the program memory. The signature register is also connected to mode bits of a processor having two operating modes. In the first mode, the signature register stores the output of the instruction register and / or the address of the program memory, but the output of the signature register cannot be identified externally. In the second mode, the signature register is set to store no more inputs. In the second mode, the contents of the signature register are checked by comparison with a specific value. This comparison value can be effectively included in the instruction at the relevant location in the program. In one embodiment, the signature values are not compared immediately, but are compared after encrypting the values so that the comparison values cannot be easily changed during unauthorized operation of the program.

Description

[0001]
The present invention generally relates to a method and a data processing device for executing a sequence of instructions. More specifically, the present invention relates to a method and a data processing apparatus for executing a program portion without changing it in an appropriate order.
[0002]
In the execution of a program, a program portion composed of an instruction sequence has an intended sequence flow. Even in the case of an interrupt request, this program portion typically has a predefined interrupt exit point, interrupt entry point, and interrupt handling sequence. However, problems can arise with program ordering. For example, electrical interference signals or defective elements can cause errors when executing a sequence of instruction sequences. These errors no longer allow the instructions to be executed in a particular intended order, and the continuation of the program sequence is also permanently interrupted.
[0003]
However, the instructions of the program may not be executed in a particular order during proper operation. These cases relate, for example, to so-called smart cards. A smart card is a flat card that contains a data processor and memory in the form of a microprocessor. Smart cards operate with a host device (eg, a reader) that utilizes contacts or wireless contact media.
[0004]
This type of smart card can be used for banking applications where the data in the smart card memory can be read and / or changed only under tightly defined conditions. Further, other data provided (eg, security-related data) is typically only exchanged between the smart card and the reader and cannot be distributed or identified externally. Such security-related data is also included in other applications of the smart card, such as, for example, use as a health care card or an access card in a set-top box.
[0005]
Typically, the programs on these smart cards are typically modified or added to add data to the smart card, adapt the smart card to various applications, and / or create further use possibilities. Supplemented. Preferably, only the smart card originator will recognize these changes and supplements. However, in practice, it is almost impossible to prevent unauthorized persons from attempting to modify the sequence of instructions in the microprocessor or its program memory to read or tamper with the data without authorization.
[0006]
In the prior art system described in DE 19804784.3, which is incorporated herein by reference, smart cards have been proposed which provide a high degree of protection against such operations. For this purpose, the interaction between the program part controlling the smart card and the reader is subdivided substantially into two instruction sequences, one of which is stored irrevocably. Substantial, in particular all access to security-related data, is only possible with one sequence of instructions called a system program. The other instruction sequence is called an application program. Both instruction sequences and programs consist of a number of individual instruction sequences. When trying to access security-related data provided by an application program, in particular security, a jump is made to a system program. Thereafter, a jump to the application program is performed, and the application program is continuously executed. However, this system has the problem that unauthorized changes can be made in unprotected application programs. When making unauthorized changes, the intended entry and exit sections can be bypassed to break into system programs and gain external access to security-related data or to execute system programs in an unauthorized manner .
[0007]
In another prior art system shown in U.S. Ser. No. 09 / 365,212, assigned to the same assignee as the present invention and incorporated herein by reference, a signature is used to store a sequence of addresses or instructions. Registers are used. The address or instruction stored from the signature register is compared with the value contained in the instruction portion to determine whether the intended instruction flow has been properly modified. If an improper instruction flow occurs, the operation of the device ends because the value stored in the signature register does not correspond to the value in the instruction portion. In order to prevent unauthorized alteration of the value of the signature register, the value of the signature register is sometimes changed secretly using an encryption device. However, if the encryption method of the encryption device is discovered by unauthorized tampering, the security of the device may be compromised.
[0008]
It is therefore an object of the present invention to overcome the disadvantages of the prior art.
[0009]
It is a further object of the present invention to provide a method and a data processing device capable of recognizing unauthorized modification or supplementation of instructions.
[0010]
The device for determining whether an application program has been manipulated improperly is provided with a signature register connected to the output of the instruction register and / or to an address of the program memory. The signature register is also connected to mode bits of a processor having two operating modes. In the first mode, the signature register stores the output of the instruction register and / or the address of the program memory, but the output of the signature register cannot be identified externally. In the second mode, the signature register is set to store no more inputs. In the second mode, the contents of the signature register are checked by comparison with a specific value. This comparison value can be effectively included in the instruction at the relevant location in the program. In one embodiment, the signature values are not compared immediately, but are compared after encrypting the values so that the comparison values cannot be easily changed during unauthorized operation of the program.
[0011]
In one embodiment, the signature register is connected to an address in program memory via a memory management unit. Thus, the signature register stores the virtual address of the program memory instead of the real address of the program memory, so that the program flow can be easily characterized. The virtual address can correspond to a self-relative address.
[0012]
In an embodiment, a first mode of the processor is saved for an untrusted application program sequence and a second mode of the program is saved for a trusted program sequence. An untrusted program sequence is a program sequence that can be changed and identified by external intervention. A trusted program sequence is a program sequence that cannot be changed and cannot be identified by external intervention. In certain embodiments, the device can correspond to a smart card.
[0013]
The following is a description of embodiments of the invention illustrating the above features and advantages, as well as other features and advantages, in connection with the drawings. It should be understood that the drawings are included for illustrative purposes and do not represent the scope of the present invention. The invention can be best understood in connection with the accompanying drawings.
[0014]
In the following description, certain terms are set forth by way of example with respect to particular embodiments or systems to simplify the description. However, as one of ordinary skill in the art will readily appreciate, these terms should be understood to include other similar applications and embodiments to which the present invention is readily applicable.
[0015]
FIG. 1 shows a block diagram of a data processing device 100 of the present invention. The memory 10 includes an instruction sequence that is addressed and read continuously by the address generator 12 via a read 13A. The read instructions are output to an instruction register 14 that stores at least one instruction at a time. The instructions, or at least a portion thereof, are output via leads 15 to various elements.
[0016]
One of these elements is the instruction decoder 16. This instruction decoder 16 in particular decodes the operation part of the instruction and sends a signal via a corresponding control lead to another element, here generally indicated as an execution unit 18. Execution unit 18 particularly includes processors and registers (not shown), such as a central processing unit ("CPU").
[0017]
A read 19 from the execution unit 18 to the address generator 12 sends a control signal to the address generator 12 when the execution of the instruction is completed and the next instruction is to be called. In addition, the read 19 sends a control signal to the address generator 12, for example, in response to a simultaneous instruction (eg, an interrupt instruction) or when a different instruction portion is requested from the address generator 12 at the execution unit 18. The new address of the different instruction part is preferably indicated via lead 15 by the part of the instruction present in instruction register 14. In this case, the new address and the control signal on read 19 trigger a jump in the instruction sequence.
[0018]
In one embodiment, lead 15 is also connected to the input of signature register 20. Signature register 20 is also connected to the output of address generator 12 via lead 13B. In other embodiments, only one of these two leads 13B and 15 may be connected to the signature register 20. Signature register 20 accumulates and stores newly received values from either or both address generator 12 and instruction register 14. Signature register 20 stores the accumulated value in response to a related signal received from instruction decoder 16 via lead 17A. It should be clarified that the signature 20 can store all or part of the received value to prevent malicious intentional intervention.
[0019]
The signature register 20 can store values in many known ways, such as maintaining a checksum of the stored data, exclusive-OR (XOR) the stored data, and other known storage methods. Further, each bit of the input value can be combined / stored and then stored in the stored storage result. Importantly, the storage methods are known in the art, but the particular method chosen is not known, which can discourage attempts to hide unauthorized changes or supplements to the order. In one embodiment, all bits of the input value are stored, in other embodiments, only selected bits are stored, or a combination thereof to further provide unpredictability (clearly random states) of the stored data. Can be.
[0020]
An output 21 of the signature register 20 is connected to an input of a comparator 22. A second input of comparator 22 is connected to lead 15 in the illustrated embodiment. In this way, the comparator 22 compares the value output by the signature register 20 via the lead 21 with the value included in the instruction portion when the instruction decoder 16 outputs the corresponding signal via the lead 17B. In another embodiment, the comparator 22 may compare the value output by the signature register 20 with the value contained in the unchangeable portion of the memory 10 via the instruction register 14 and the lead 15.
[0021]
When the value output by the signature register 20 via the lead 21 does not correspond to the value included in the instruction portion, the comparator 22 outputs the value and the control signal to the address generator 12 via the lead 23. Since the address generator 12 is set to a given address in response to the control signal, a predetermined instruction sequence is executed. For example, the predetermined instruction sequence can be an interrupt instruction sequence that inhibits further functionality of the device.
[0022]
In one embodiment, the signature register 20 may include an encryption device 24 that generates a new value from the combined value stored in the signature register 20 using a secret algorithm. This new value is stored in signature register 20 when the associated control signal is on lead 17A. Next, the signature register 20 starts creating another signature based on a value that cannot be predicted by a person who does not know the encryption algorithm of the encryption device 24. Therefore, it is difficult to change the value output to comparator 22 by the associated instruction so that comparator 23 does not generate a signal or execute a jump to the interrupt instruction sequence when modifying the previous instruction sequence. . In this way, it is possible to check whether the instruction sequence and the instructions contained therein are executed in the correct order, and whether the instructions have been modified.
[0023]
If the checksum communicates externally, such as with a card reader 28, other encryption and protection provided by the encryption device 24 can be further utilized. Encrypting the checksum output by the signature register 20 allows a hacker to easily intercept the leads (eg, telephone lines) of a corresponding device such as an automatic teller machine (ATM) and patch it to the correct checksum. It becomes difficult.
[0024]
Further in accordance with the present invention, the mode signal output on lead 17C from execution device 18 acts as a hardware protection that excludes the application mode from accessing and / or changing signature register 20. In this way, the device 100, such as a smart card, has a distinct operating mode determined by hardware constraints in the form of mode signals.
[0025]
In one embodiment, "application mode" or "user mode" is determined by the logic state of the mode signal being zero ("zero mode signal"). The zero mode signal is saved for running untrusted applications. If the logic state of the mode signal is 1 ("1 mode signal"), it is saved for the system program including execution of the interrupt code portion. Thus, the mode signal is part of the processor state (eg, the CPU of execution device 18). Thus, application programs are excluded from extending the operating mode to "system mode" due to hardware constraints (e.g., mode signals) other than sending full control to the operating system code from a given entry point.
[0026]
In one embodiment, the application program invokes a "call system" instruction. A system call instruction from the instruction register 14 triggers an interrupt instruction portion. In this embodiment, the operating system code acts as an interrupt handler for these "system call" interrupts.
[0027]
In operation, the signature register 20 stores a checksum or other logical operation of the executed instruction and / or instruction address. At that time, the CPU is operating in the application mode. Since the zero mode signal acts as a hardware lock set in the application mode, the signature register 20 cannot be accessed by the application program in any way. Accordingly, the zero mode signal can prevent the application program from accessing the output 21 of the signature register 20.
[0028]
In the system mode, the hardware is determined by the one mode signal, so that the checksum state of the signature register 20 can access the read operation without being affected by other address generation. Since all interrupt codes are executed in the system mode, the interrupt codes are excluded from being added by the signature register 20. Further, since the mode of the interrupt program is saved / restored at the interrupt entry / exit, the signature register 20 restarts the checksum processing only when control returns to the application mode at the interrupt exit. Signature register 20 does not restart the checksum if control returns to the previous interrupt system program. Thus, the mode of the CPU controls the accumulation / stop state and accesses the result (for example, checksum) of the signature register 20.
[0029]
Excluding the interrupt code from the result of the signature register 20 is desirable to facilitate characterizing the application program or its flow with a unique signature. Including the interrupt code portion in the result will result in the result being dependent on the exact time or instruction portion where the interrupt code was executed in the application program. This makes it more difficult to properly characterize the instruction flow with the results contained in the signature register 20, since the occurrence of the interrupt cannot be limited to a given particular part of the application program.
[0030]
In the system mode, the system program has complete control over the result of the signature register 20. Since the system program is a "TRUSTED" code that cannot be changed from a "NONTRUSTED" application program, as controlled by the hardware protection mechanism described in German Patent No. 19804784.3, the signature register 20 is protected from changes by the system program. No need to protect. As shown in this patent, the system program is under full control of the memory protection hardware, so that the system program can be protected from access by application programs.
[0031]
In one embodiment, address generator 12 acts as a memory management unit that performs address relocation to access memory 10 and control the address output to signature register 20 via lead 13B. In one embodiment, it is desirable for the address generator to act as a memory management unit because the signature register 20 can perform a checksum of the address, but the application program has a defined (eg, fixed) memory location. Instead, it may be loaded on the fly.
[0032]
If not relocating the addresses performed by the memory management unit, the addresses as referenced in the program (eg, JUMP to address XX) should be changed for the final placement of the program in memory. is there. The relocation loader can perform this address change. However, the checksum of the signature register no longer characterizes the program, but the program at that new address. A relocation loader is a utility program that typically changes the address portion of a program while sending it to memory, for example, before execution. The relocation loader examines the program prior to executing the program and stores all references from symbolic addresses (e.g., addresses that relate to program flow and are not related to the actual location in memory where the program is stored). Change to the actual address that is. The problem with this is that the signature register is not available to characterize program flow because the symbol address is usually lost.
[0033]
This problem can be solved by using the address generator 12 as a memory management unit. In the memory management unit, the program flow may be referred to as a virtual address that does not change before execution. The virtual address is output by the address generator 12 to the signature register 20 via the lead 13B. Therefore, the checksum of the signature register is not affected by the real address where the program is located in the memory 10. The memory management unit executes the change of the virtual address to the real address, and outputs these real addresses to the memory 10 via the lead 13A.
[0034]
In this embodiment, a memory management unit or other means for address independence is desirable to facilitate characterization of the program by the address sequence of the program. The memory management unit is under full control of the system program. The system mode program "knows" the correspondence between the virtual address and the real address of the application program. Therefore, the application program refers only to a virtual address that does not change regardless of the position of the application program in the memory. Thus, the signature register can characterize the program flow (by virtual address) without being affected by the real address.
[0035]
In other embodiments, the program portion may utilize self-relative addressing. Self-relative addressing makes the program portion "position independent". This method utilizes the CPU's addressing mode, such as a relative jump, so that the checksum of the signature register 20 can characterize the program flow. In self-relative addressing, the address of the application program represents, for example, some reference addresses that refer only to the distance from the current instruction at the branch destination. As long as the application program moves alone, the relative positions of the start and end of the branch move together, so that all branches in the application program are not changed.
[0036]
In one embodiment, the device 100 shown in FIG. 1 constitutes a control device for a smart card as described in the referenced German Patent 1,980,478,4.3. In this embodiment, the control signal on lead 17B activates comparator 22, which signal is preferably generated for each jump instruction that causes a jump to the described system program. At the same time, the signature register 20 is set so as not to accumulate due to a change in the mode signal from the CPU. The system program is preferably stored in an unchangeable portion of the memory 10 as described above. Only at the time of a return jump to the application program, the signature register 20 is released and stored again by the mode signal. In one embodiment, the value generated by the encryption unit 24 is stored as a checksum in the signature register 20 in response to a signal on lead 29 from the smart card or a signal on lead 17A from the instruction decoder 16.
[0037]
Smart cards typically work with card readers. Block 28 of FIG. 1 symbolically represents such a card reader. When the smart card program performs the jump, the card reader 28 can receive the value of the output 21 of the signature register 20, for example. The output 21 may represent the checksum directly or may represent the value encrypted by the encryption unit 24. This value is then compared with a predetermined value of the card reader 28. In one embodiment, the comparator 22 may be omitted if the card reader 28 can control the smart card.
[0038]
In other embodiments, the card reader 28 can create another signature from the received value, or return the other signature to the signature register 20 via the lead 29. It can thus be checked whether the smart card is working with a suitable, in particular unoperated, card reader.
[0039]
FIG. 2 shows an exemplary flowchart of execution of an instruction sequence according to an embodiment of the present invention. As shown, execution begins at start 30 where a smart card is inserted into a card reader to establish these conductive or contactless connections. Subsequently, the start program 31 is executed. At this time, the card and the card reader exchange various data in order to determine, for example, the characteristics of the card and whether an authentication test needs to be performed. Next, processing proceeds to a program sequence 32 that forms part of the application program. Before executing the program sequence 32 (for example, as the last part of the program sequence 31 or before), the mode register of the CPU of the execution device 18 is cleared to zero to set the signature register 20 and start accumulation. Let it.
[0040]
The program sequence 32 includes a jump instruction to a system program at a predetermined position. The CPU sets the mode bit, which stops the accumulation of the signature register 20. Thereafter, processing continues to system instruction sequence 33. The sequence 33 confirms a signature created in advance during the processing of the program sequence 32. Subsequently, a further predetermined instruction 34 is executed, after which a return jump to the application program is performed, and the CPU clears the mode bit and starts accumulation of the signature register 20. The application program continues to sequence 35, where a new signature is created by signature register 20. At a given location of the application program in sequence 35 or when a given condition is met, a jump to the system program is made again and the CPU sets the mode bit, which stops the accumulation of the signature register 20. . Processing then proceeds to system instructions in sequence 36, where the created signature is tested again. Further system instructions continue to sequence 37.
[0041]
In one embodiment, the sequence 37 may incorporate the generation of a new initial value, and may be an erasure or other modification of the checksum stored in the signature register, such as encryption of a previously created checksum. The changed checksum can be written to the signature register 20 by the system program when the sequence 37 of the system program is executed. In this case, the changed checksum can be used as a reference for generating another checksum when returning to the application program sequence.
[0042]
The above is repeated several times until the desired operation of the card is finally performed by the instruction sequence 38 of the application program. Upon completion, the program returns to the system program again by the jump instruction, and stops accumulation of the signature register 20 by the CPU setting the mode bit. Thus, the signature of the output of the signature register 20 is checked by the system instruction 39. Thereafter, an end command 40 of the system program is executed, and the program is finally stopped as indicated by the end sequence 42 and the card is removed.
[0043]
If the value from the signature register is tested with the instructions in sequence 33, 36 or 39, and it is found that the expected value does not exist, a jump is made to the interrupt program in sequence 41. The interrupt program inhibits any further external operation of the card and leads directly to termination 42.
[0044]
Finally, the above description is intended only to illustrate the invention. For example, a system program may dispatch control to some application programs in a controlled manner (eg, in a cyclic mode for time sharing). At the same time, the system program can save and re-save the corresponding intermediate results from / to signature register 20, so that only each execution of a separate application program updates the results of the corresponding application program.
[0045]
For example, the system program can load the checksum A into the signature register 20, execute the instructions of the application program A, accumulate the checksum A, and save the accumulated checksum A. The system program can then load checksum B into signature register 20, execute a portion of application program B, accumulate in checksum B, and save checksum B. Next, the system program re-stores the checksum A in the signature register 20 and starts execution of the application program A and the like. After running both (or more) application programs to some extent, the cumulative checksum of each of the application programs may be evaluated. This not only allows the processor to "time-share" several application programs at about the same time, but also allows for "time-division" of the checksum mechanism, so that the signature register 20 can be used for almost all simultaneously involved application programs. And can operate independently.
[0046]
As another example, FIG. 1 shows separate functional blocks for the identified functions, but one or more of these functions may be combined into a single block, or separated into separate functional blocks. You may. One or more of these functional blocks may be performed by a sequence of instructions of a processor, may be performed by a hardwired integrated circuit, may be a reprogrammable integrated circuit, or any other known means, Obviously, a combination of the above may be performed.
[0047]
One skilled in the art can devise a number of alternative embodiments without departing from the spirit and scope of the claims. In interpreting the appended claims, the following should be understood.
a) The word "comprising" does not exclude the presence of other elements or acts listed in a given claim.
b) the word "a" or "an" preceding an element does not exclude the presence of such elements.
c) Reference signs in the claims do not limit their scope.
d) Some "means" may be represented by the same item or structure or function implemented by hardware or software.
[Brief description of the drawings]
FIG. 1 is a block diagram of a data processing device according to an embodiment of the present invention.
FIG. 2 shows a flowchart of execution of an instruction sequence according to the embodiment of the present invention.
[Explanation of symbols]
10 memory
12 Address generator
14 Instruction Register
16 Instruction decoder
18 Execution device
20 Signature Register
22 Comparator
24 Encryption device
28 Card Reader

Claims (16)

A method of executing a sequence of program instructions on a processor, comprising:
Storing data from a first portion of a program instruction sequence without providing an indication of a current value of the stored data in response to a first mode signal from the processor;
Determining, in response to a second mode signal from the processor, data accumulated from the first portion of a program instruction sequence during execution of a second portion of the program instruction sequence.
How to execute a program instruction sequence. The method of claim 1, comprising comparing a value stored and determined from the first portion of the program instruction sequence to a value, and further executing the program in response to the comparison. Data accumulated from the first portion of the program instruction sequence is at least one of a program instruction corresponding to an actual memory address location of the program instruction and a program instruction corresponding to a virtual memory address location of the program instruction. The method of claim 1, wherein: 2. The method of claim 1, wherein the first part of the program instruction sequence is part of an unprotected application program and the second part of the program instruction sequence is part of a protected system program. Method. Changing a corresponding address location from a real address in memory of the first portion of the program instruction sequence to a virtual address, wherein the data accumulated from the first portion of the program instruction sequence is a virtual address of the program instruction. The method of claim 1, comprising the step of being an address. The method according to claim 5, wherein the virtual address is a self-relative address. 3. The method of claim 2, comprising modifying the stored data from the first portion of the program instruction sequence before comparing the determined stored data to a value. The method of claim 7, wherein the stored data is modified by encryption. A processor configured to execute a first sequence of instructions, output a corresponding first mode signal, execute a second sequence of instructions, and output a corresponding second mode signal;
When the first mode signal is received, data corresponding to the first command sequence is accumulated, the accumulated data is not displayed, and when the second mode signal is received, data accumulation is stopped. And a signature register configured to display the stored data.
Processing equipment. A comparator connected to the output of the signature register and configured to receive stored data and compare the stored data with a value, such that the processor executes a further instruction sequence in response to a result of the comparison. The processing device according to claim 9, wherein the processing device is configured. A memory manager coupled to the signature register and configured to change a corresponding address location of a first instruction sequence to a virtual address, wherein the signature register is configured to store the virtual address. Item 10. A processing device according to item 9. The processing device according to claim 11, wherein the virtual address corresponds to a self-relative address. The processing device according to claim 9, wherein the processing device is part of a smart card. A program stored in a processor readable memory device having a protected memory portion and an unprotected memory portion,
A first program sequence stored in an unprotected memory portion for executing or storing a corresponding program portion in a first processor mode state;
Executing and comparing the program portions stored in the protected memory portion and stored in the second processor mode state; and a second program sequence.
program. 15. The program of claim 14, wherein the second program sequence includes a value to be compared with a stored portion, and wherein the program is further configured to execute in response to a result of the comparison. 16. The program according to claim 15, wherein the program is configured to compare a value with an encrypted part of the stored part.

Images