WO2010034831A1

WO2010034831A1 - Device for securing an electronic component

Info

Publication number: WO2010034831A1
Application number: PCT/EP2009/062505
Authority: WO
Inventors: Christophe Izard; Franck Jeulin
Original assignee: Thales
Priority date: 2008-09-26
Filing date: 2009-09-28
Publication date: 2010-04-01
Also published as: FR2936624A1; FR2936624B1

Abstract

The invention relates to a device for securing an electronic component, said device including a processor (11), a spy module (12) capable of interrogating the processor (11) registers, a connection means (13) for connecting the spy module (12) to an activation means (14) of the spy module (12), the activation means (14) being outside the component (10), and the spy module (12) executing, upon the activation thereof, a specific program stored at an address in the memory (15) of the component (10). According to the invention, the component (10) includes a securing memory (16) that may contain instructions enabling a shift to said specific program. The shift is present during test operations of the component and is cancelled during the functional operation of the component (10). Accordingly, even if the spy module (12) is accidentally activated, the specific program is not executed.

Description

Device for securing an electronic component

The invention relates to a device for securing an electronic component. The invention finds particular utility in microprocessors incorporating a spy module. This type of module is known in the Anglo-Saxon literature as the "debug module". When this module is integrated inside a component, it is called "on chip debug".

It is common to have custom components forming a network of programmable gates and known in the English literature under the name of FPGA for "field programmable programmable array,". These custom components typically include a processor and a spy module for accessing the processor registers to read their contents during the execution of a program. This access makes it possible to make sure of the good functioning of the program and to debug it. It is understood that the invention is not limited to FPGA type components. Other types of electronic components are equipped with spy modules and can implement the invention.

The components incorporating a spy module are equipped with connection means for connecting the module to the outside of the component, for example to connect a computer from which the debugging of the program will be performed. In operational operation, the spy module is inactive and the computer connected to the module allows it to be activated if necessary. This activation takes place essentially in the program development phase implemented by the processor. The connection means make it possible both to activate the spy module and to interact with it either to read the information contained in the registers of the processor or to send instructions to the spy module. The connection means follow, for example, the JTAG standard for: "Join Test Action Group". This standard was developed by major computer and electronic manufacturers in 1985 and incorporated in the IEEE 1149.1 standard. When activating the spy module, the current program in the processor is interrupted by a specific program stored at an address of a component memory. Generally the memory in which the specific program is stored is internal to the spy module. The addressing of this memory can be done in the continuity of the addressing the main memory of the processor in which is stored the main program forming the normal tasks that the processor performs.

A failure of the connection means may inadvertently activate the spy module and therefore interrupt the current main program in the processor. The nominal operation of the processor is then disturbed.

The invention aims to overcome this problem by avoiding inadvertent access to the specific program used by the spy module.

For this purpose, the subject of the invention is a device for securing an electronic component comprising a processor, a spy module making it possible to interrogate processor registers, connection means making it possible to connect the spy module to means of communication. activation of the spy module, the activation means being external to the component, the spy module executing, during its activation, a specific program stored at an address of a memory of the component, characterized in that it comprises a security memory may contain instructions to jump to the specific program. The invention does not prevent the activation of the spy module but only the execution of the specific program.

The invention will be better understood and other advantages will appear on reading the detailed description of an embodiment given by way of example, a description illustrated by the attached drawing in which: FIG. 1 represents a first variant of FIG. a device according to the invention, wherein the component contains a security memory; FIG. 2 represents a second variant of a device according to the invention, in which the security memory is external to the component.

For the sake of clarity, the same elements will bear the same references in the different figures. FIG. 1 represents an electronic component 10 comprising a processor 11, a spy module 12 and connection means 13 making it possible to connect the spy module 12 towards the outside of the component

10. The connection means 13 are for example JTAG type. The electronic component 10 of course includes other means of connection to the outside which have not been shown not to overload Figure 1. The electronic component 10 is for example a microprocessor type FPGA. The connection means 13 make it possible to connect the component 10, for example to an individual computer 14, by means of which it is possible to debug a program executed by the processor

11. This program, hereinafter called the main program, is stored in a memory of the component 10 not shown in FIG. 1. The main program is executed when the component 10 is in operational operation. When the main program is operating normally, the spy module 12 is inactive. The personal computer 14 activates the spy module 12 through the connection means 13.

The spy module 12 comprises a memory 15 containing a specific program executable by the processor 11 when the spy module 12 is activated. The specific program can be loaded into the memory 15 from the personal computer 14. Upon activation of the spy module 12, an interruption of the processor 11 is generated by the spy module 12. This interruption stops the main program by course in the processor 1 1 to launch the specific program allowing for example to read the registers of the processor 11.

According to the invention, to avoid an untimely launch of the specific program, even if an interruption is generated by the spy module 12 after activation thereof, the component 10 comprises a security memory 16 that may contain instructions for a jump to the specific program. Advantageously, the security memory 16 is separate from the memory 15 and the memory containing the main program. The security memory 16 is complementary to the means implemented by the interruption generated by the spy module

12. In the absence of the security memory 16, the interrupt causes a direct jump to the specific program. According to the invention, the interruption generated by the spy module 12 causes a jump 17 to the security memory 16. In other words, during the activation of the spy module 12, the current main program in the processor 1 1 is diverted to the instructions contained in the memory of security 16. During a development phase of the main program or more generally during a test operation of the component 10, it is necessary to use the spy module 12 and the security memory 16 contains a jump 18 to the program specific.

By cons, during a current implementation phase of the main program, or more generally during the operational operation of the component, the use of the spy module 12 is unnecessary and can be removed from the security memory jump 18. Thus, even in the event of failure of the connection means 13, failure leading to the activation of the spy module 12, the interruption remains generated but the specific program is no longer launched. This keeps a standard spy module 12 without special security. Securing is done by means of the security memory 16 in which one can store different instructions depending on whether one is in the development phase of the main program or phase of operational use of this main program.

The presence of the security memory 16 also makes it possible not to modify the main program between its development phase and its operational use phase. Indeed, in some areas, such as for example the aeronautical domain, certification bodies may require, after the development phase, to verify the design of the main program, for example by checking the structural coverage of this program. This verification is done using the spy module 12. The certification bodies may not accept a subsequent modification of the main program, modification removing any jump to the memory 15 containing the specific program.

Thanks to the invention, it is no longer necessary to modify the main program to suppress the jump to the specific program, one can simply change the contents of the security memory 16 to remove the jump to the specific program. Two variants can be implemented for the security memory 16. In the first variant, represented in FIG. 1, the component 10 comprises the security memory 16. In the second variant, represented in FIG. 2, the security memory 16 is external to the component 10 and is connected to the component 10 through removable connection means 20. These connection means 20 allow, for example, not to modify the contents of the security memory 16 after the certification of the main program. It suffices to disconnect the security memory 16 to avoid any jump to the specific program during the operational use of the component 10.

Advantageously, during the operational operation of the component 10, the security memory 16 contains instructions indicating that an error has occurred. Thus it is possible to alert a user that the spy module 12 has been activated, for example by a fault in the connection means 13 and then resume the normal course of the main program. This avoids disrupting the operational functioning of the component 10 while informing of the presence of an anomaly.

Claims

1. Device for securing an electronic component (10) comprising a processor (1 1), a spy module (12) for interrogating processor registers (1 1), connection means (13) for connecting the spy module (12) has activation means (14) for the spy module (12), the activation means (14) being external to the component (10) during the activation of the spy module (12), a processor interrupt (1 1) being generated by the spy module (12), the interrupt stopping a current main program in the processor (1 1) to launch a specific program stored at an address of a memory (15) component (10), characterized in that it comprises a security memory (16) may contain instructions for a jump to the specific program.

2. Device according to claim 1, characterized in that the security memory (16) is distinct from the memory (15) containing the specific program and a memory intended to contain a main program executed by the processor (1 1). when the component (10) is in operational operation.

3. Device according to one of the preceding claims, characterized in that the component (10) comprises the security memory (1 6).

4. Device according to any one of claims 1 or 2, characterized in that the security memory (1 6) is external to the component (10) and is connected to the component (10) through second connection means (20). ) removable.

5. Method implementing a device according to one of the preceding claims, characterized in that during the activation of the spy module (12), a main program running in the processor (1 1) is diverted to instructions contained in the security memory (1 6).

6. Method according to claim 5, characterized in that during a test operation of the component the security memory (16) contains the instructions for the jump, and in that during its operational operation, the security memory ( 16) does not contain instructions for jumping.

7. Method according to any one of claims 5 or 6, characterized in that during operational operation of the component (10), the security memory (16) contains instructions indicating that an error has occurred.