WO2017093029A1

WO2017093029A1 - Method for operating a microcontroller

Info

Publication number: WO2017093029A1
Application number: PCT/EP2016/077964
Authority: WO
Inventors: Simon Hufnagel; Jens Gladigau
Original assignee: Robert Bosch Gmbh
Priority date: 2015-11-30
Filing date: 2016-11-17
Publication date: 2017-06-08
Also published as: DE102015223757A1

Abstract

The invention relates to a method for operating a microcontroller (101), wherein access rights of processes (111, 112, 113, 114) carried out in the micro-controller (101) are stored in a memory protection unit (120) on different storage areas (131, 132, 133), wherein, when a first process (113) wants to access a specific storage area (132) in a specific manner, the memory protection unit (120) checks in the event that an access condition is met, whether the first process (113) is allowed to access the specific storage area (132), and not, whether the first process (113) is allowed to access in said specific manner. The access to the memory region (132) is allowed only when the first process (113) is allowed to access the specific storage area (132).

Description

Description title

Method for operating a microcontroller

The present invention relates to a method for operating a

Microcontroller and a computing unit and a computer program for its implementation.

State of the art

Microcontrollers, for example for embedded systems, have i.a. a processor unit and a memory unit, such as ROM, RAM, flash and / or EEPROM, with different memory areas. The processor unit may comprise one or more processor cores, in each of which different processes (tasks, programs, arithmetic instructions, etc.) can be executed. The processes executed can access the different memory areas.

For the operation of microcontrollers, access protection or memory protection is of great importance. By means of such access or storage protection is to be prevented that unauthorized access to the

Memory areas takes place. Such a memory protection can be realized for example by a special hardware component, the so-called Memory Protection Unit (MPU).

Disclosure of the invention

According to the invention, a method for operating a microcontroller as well as a computer unit and a computer program for its implementation proposed with the features of the independent claims.

Advantageous embodiments are the subject of the dependent claims and the following description.

In particular, the microcontroller has a processor unit with one or more processor cores and a memory unit (e.g., ROM, RAM, Flash, EEPROM) having different memory areas. Different processes (tasks, programs, arithmetic instructions, etc.) are executed by the microcontroller or by the processor unit. The processes are executed in particular with different privilege levels or hierarchy levels. An operating system or operating software (BSW) has in particular a highest privilege level or a highest hierarchical level. Furthermore, different application software (ASW) can be executed, each with a lower privilege level than the operating system.

For security reasons, not all processes are allowed to fully access all storage areas. Different processes are therefore assigned in particular different access rights, i. Different processes may (or may not) access individual storage areas ("where") to varying degrees ("how"). Access rights of processes to storage areas can be for example read, write and / or executing.

In a memory protection unit, access rights (e.g., read, write, execute) of processes executed in the microcontroller are present

different memory areas (in particular characterized by a start and an end address) deposited, i. in the memory protection unit is deposited, to which extent processes may access different memory areas. Different processes or different parts of the application software may e.g. through a thread or context ID

be differentiated.

The memory protection unit may in particular be designed as a hardware unit, in particular as a memory protection unit (MPU). It is It is also conceivable that the memory protection unit is executed as a process or as a software application, in particular with a highest privilege level. By the invention, individual processes are treated privileged and this

Processes are granted a higher degree of access rights in a simple, uncomplicated way. If a first process wants to access a particular storage area in a particular way, the storage protection unit checks, in the event that an access condition is met, only if the first process is allowed access to that particular storage area ("where") and not the first

Process in the specific way ("how") is allowed to access. Although the first process is not allowed to access in the specific way, the memory protection unit will not prevent that access if the first process is allowed to access that particular memory area. The access condition is satisfied, for example, if a correspondingly privileged second process wants to access the first process or if the storage protection unit is operated in a corresponding operating mode without access rights checking.

The access condition may alternatively include operating the memory protection unit in a corresponding operating mode with predetermined access rights to predetermined memory areas for predetermined privilege levels. In this case, the access condition is satisfied if the first process wants to access in a particular way ("like"), according to his

Privilege level for this particular space ("where") is allowed.

Preferably, a second process for the first process accesses the particular memory area in the particular way. In particular, the second process is a higher privileged process than the first process. The memory protection unit checks whether the first process is allowed to access the specific memory area ("where") and whether the second process is allowed to access the particular memory area ("where") in the specific way ("how"). Access is allowed only if the first process is allowed access to the designated memory area and if the second process is allowed to access the particular memory area in the specific way. According to a further aspect of the invention, the memory protection unit can be operated in a first operating mode. If the first process wants to access the particular memory area in the particular way, the memory protection unit only checks to see if the first process is on the

certain memory area may access. Based on this verification, access is allowed or denied. The memory protection unit thus ignores the access rights of the first process in the first operating mode and allows access.

In a conventional microcontroller, if a (first) process attempts to access a memory space in a manner that is not permitted to it (e.g., if the process wants to access writing or executing, but is only allowed to read), that access is provided by the

Memory protection unit prevented after checking the access rights. The

Memory protection unit notifies in this case, for example by means of a trap a higher instance, for example, a second process with high or highest privilege level, in particular the operating system. This higher privileged process decides in this case whether the desired access of the process is allowed and can be performed or whether the

Access should be omitted, for example, because of an error of the process or even an attack is present. If the higher privileged process decides that the access may be made, then this higher priviledged process performs this access to the memory area itself, since the other process still does not have sufficient access rights. To this

The purpose of the higher privileged process is usually to verify that the other process is allowed to access the memory area, for example, by having the higher privileged process first obtain and verify access privileges from the memory protection unit, or use tables stored in memory for checking.

If there is no error or attack and the access is finally made, this may be associated with increased runtime overhead by the previous check by the higher privileged process. In particular It comparatively expensive when a higher privileged process

is consulted and performs the desired access itself. Such an expense and runtime overhead can be reduced by the invention, since the question of Where continues to be answered by the memory protection unit.

Conveniently, the memory protection unit is also in a second

(conventional) operating mode operable in which in the case of

If desired, the memory protection unit checks whether the first process is allowed to access in the specific way, and based on this checking, the access of the first process to the memory area is permitted or denied. In the second operating mode, the memory protection unit can be operated in particular as in a conventional microcontroller as described above. Thus, the second operating mode can ensure a more secure, reliable protection of all memory areas, in particular against process errors or even against enemy attacks.

In particular, a sufficiently privileged second process may toggle between the first and second modes of operation, and thus authorize the access of the first process.

If the first process in this first mode of operation on the

Memory area wants to access writing or executing, for example, although he has only read access rights, the first process in the first mode of operation can be privileged treated and the corresponding write or execute access can be easily admitted. In particular, the memory protection unit is put back into the second operating mode after this access in order to ensure more secure and reliable protection of all memory areas.

The microcontroller is in particular implemented in a control unit of a motor vehicle, for example in an engine control unit. Thus, an improved security of the corresponding control device can be ensured and safety requirements, which are made in the automotive sector, can be met. In particular, safety requirements as laid down in ISO standard 26262 can be complied with. Advantageously, a second process switches to a higher one

Privilege level as the first process the memory protection unit in the first operating mode (especially from the second) to. This prevents a low privileged process from changing or extending its access rights or the privileges of a more privileged process. In particular, it can thus be prevented that an attacker with a low privilege level can unauthorizedly change or override access rights.

The second process preferably transmits the storage protection unit its privilege level. The memory protection unit checks in particular whether this privilege level is sufficiently high to allow a change between the

Effect operating modes. The storage protection unit may also check to see if this privilege level is higher than the privilege level of the first process that will next request access. If this is the case, the change between the operating modes is performed.

The second process preferably switches the memory protection unit into the first operating mode before the first process wants to access the memory area. Thus, a trap is prevented from being triggered by the memory protection unit and a higher privileged process (e.g., the second process itself or the operating system) is informed.

Preferably, the storage protection unit informs a fourth process with a higher privilege level than the first process, for example by means of a trap, if a third process with a lower privilege level than the first process wants to switch the storage protection unit into the first operating mode. Thus, unauthorized switching between the modes of operation is prevented by a less privileged process. In particular, this fourth process may be the same process as the second process described above. Preferably, the second and fourth processes are Operating system. The fourth process may also be a stand-alone process, which, for example, is explicitly responsible for such unauthorized switching through low-priority processes.

Preferably, the memory protection unit is designed as a memory protection unit (MPU). The memory protection unit is preferably designed as a unit or a module of the microcontroller and is in particular in the

Integrated microcontroller. Preferably, the memory protection unit may alternatively or additionally be formed an external unit or an external module, which is connected to the microcontroller, for example via a Busbzw. Fieldbus system.

An arithmetic unit according to the invention, e.g. a control unit of a

Motor vehicle is, in particular programmatically, adapted to perform a method according to the invention.

Also, the implementation of the method in the form of a computer program is advantageous because this causes very low costs, especially if an executive controller is still used for other tasks and therefore already exists. Suitable media for providing the

Computer programs are in particular magnetic, optical and electrical memories, such as e.g. Hard drives, flash memory, EEPROMs, DVDs, etc. It is also possible to download a program via computer networks (Internet, intranet, etc.).

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

The invention is based on embodiments in the drawing

schematically and will be described below with reference to the drawings.

Brief description of the drawings Figure 1 shows schematically preferred embodiments of a

Control unit of a motor vehicle, each of which is adapted to a preferred embodiment of a

to carry out the inventive method.

FIGS. 2 to 6 each schematically show a preferred embodiment of a method according to the invention as a block diagram.

Embodiment (s) of the invention

In Figure 1 a, a control device 100 of a motor vehicle, such as an engine control unit, shown schematically. The control unit 100 comprises a microcontroller 101 having a processor unit 1 10, a memory protection unit (MPU) designed as a memory protection unit 120 and an example designed as a RAM memory unit 130th

In the processor unit 110, a plurality of processes are executed. In FIG. 1 a, for example, four executed processes 1 1 1, 1 12, 1 13 and 1 14 are shown.

Process 1 1 1 in this example is an operating system having a highest privilege level, e.g. Four, owns. The processes 1 12, 1 13 and 1 14 are about tasks that are executed in the course of a motor control. For example, process 1 12 has a privilege level of three, process 1 13

Privilege level of two and process 1 14 has, for example

Privilege level of one.

The RAM memory 130 includes a variety of different ones

Storage areas. For example, three memory areas 131, 132 and 133 are shown in FIG. 1a.

In the MPU 120 access rights of the individual processes 1 1 1 to 1 14 are deposited. As access rights are for each of the processes 1 1 1 to 1 14th Defines whether the respective process may read, write and / or execute access to a specific memory area.

FIG. 1 b shows a further embodiment of a control device 100. Identical or identical elements are each provided with identical reference numerals in FIGS. 1a and 1b. The microcontroller 101 according to FIG. 1 b comprises a second processor core 140 in addition to the processor core 110. In the example of FIG. 1 b, the processes 1 1 1 and 1 12 are executed by the processor core 1 10 and the processes 1 13 and 1 14 are executed by the processor core 140. In each case, a separate MPU 120 is provided for each of the processor cores 1 10 and 140. The RAM 130 is provided in common to both processor cores 1 10 and 140.

The control device according to FIGS. 1 a and 1 b is in each case adapted to a preferred embodiment of a method according to the invention

to perform, which in the figures 2 to 5 each schematically as

Block diagram is shown.

In the case of FIG. 2, process 1 13 wants to access an address within memory area 132 in step 201. In this case, the MPU 120 is operated in a second operating mode, which does not fulfill an access condition, and the MPU checks in step 202, on the one hand, whether the process 1 13 is allowed to access the memory area 132 and, on the other hand, whether the process 1 13 is allowed to read. For example, the process 1 13 has a read access right to the memory area 132. The MPU 120 therefore leaves access to and

Process 1 13 accesses the address in memory area 132 in step 203.

In the case of FIG. 3, process 1 13 wants to write to an address in memory area 132 in step 301. The MPU 120 is also operated in the second operating mode and checks again in step 302, on the one hand, whether the process is allowed to access the memory area 132, and on the other hand, whether the process 1 13 may write access. Since process 1 13 has read-only access to storage area 132, MPU 120 leaves the access not and informs in step 303 by means of a trap the process with the highest privilege level, in this case the operating system 1 1 1. Das

Operating system 1 1 1 then checks in step 304 whether the access attempt of the process 1 13 is permitted or, for example, indicates an attack or an error. If the access attempt is detected as legitimate, the operating system executes

1 1 1 in step 305 the appropriate write access itself.

In the example of FIG. 4, the operating system 1100 switches the MPU 120 from the second operating mode into a first operating mode in step 401 and transmits its privilege level for this purpose. The MPU 120 recognizes the highest privilege level of four and enters the first mode of operation. Thus, an access condition according to a preferred embodiment of the invention is satisfied. Process 1 13 would like to write to an address in memory area 132 in step 402. The MPU 120 now checks because the

Access condition is satisfied, in the first mode of operation in step 403, only whether the process 1 13 is allowed to access the memory area 132, and not the access rights of the process 1 13. After it has been determined that the process 1 13 may access the memory area 132, allows the MPU 120 in step 404 the write access of the process 1 13 to the memory area 132, although this process 1 13 has read-only access rights. Process 1 13 then performs the access. In step 405, the operating system 1100 switches the MPU 120 back to the second operating mode.

According to FIG. 5, process 1 13 wishes to re-write to memory area 132. Process 1 14 wants the MPU 120 in step 501 from the second

Switch operating mode to the first mode of operation and transmit the MPU 120 its privilege level of one. The MPU 120 recognizes in step 502 that this privilege level is less than the privilege level of two of the process 1 13. The MPU 120 then does not switch to the first one

Operating mode and informed by means of a trap in step 503 the

Operating system 1 1 1 from the switchover attempt. The operating system 1 1 1 then checks in step 504 whether the switch attempt was performed due to an error of the process 1 14 or in the course of an attack. In the example of FIG. 6, process 1 13 wants to re-write the memory area 132 in step 601. The operating system 1 1 1 accesses the memory area 132 in this case for the process 1 13 writing. Operating system 1 1 1 transmits for this purpose the MPU 120 in step 602

Privilege level and the identity of process 1 13. The MPU 120 checks in step

603, whether the operating system 1 1 1 write access to the memory area 132 may access. Since this is the case, an access condition according to a preferred embodiment of the invention is met. The MPU 120 now checks, as the access condition is satisfied, in step 604, whether process 1 13 is on

Memory area 132 may access. Since this is the case, the MPU 120 in

Step 605 the write access of the process 1 13 to the memory area

Claims

claims

1 . Method for operating a microcontroller (101), wherein in one

Memory protection unit (120) access rights of executed in the microcontroller (101) processes (1 1 1, 1 12, 1 13, 1 14) to different

Memory areas (131, 132, 133) are deposited, wherein, if a first process (1 13) to access a particular memory area (132) in a certain way (402, 601), of the

Memory protection unit (120) in the event that an access condition is met,

Checks whether the first process (1 13) on the particular

Memory area (132) may access (403, 604), and not whether the first process (1 13) may access in the specific way, and

the access to the memory area (132) is only allowed (404, 605) if the first process (13) is allowed to access the particular memory area (132).

The method of claim 1, wherein the access condition is met when a second process (1 1 1) for the first process (1 13) wants to access the particular memory area (132) in the particular manner (601, 602) and the second process (1 1 1) is allowed to access the particular memory area (132) in the specific manner.

3. The method of claim 1 or 2, wherein the access condition is satisfied when the memory protection unit (120) is operated in a first operating mode in which is not checked by the memory protection unit (120), whether the first process (1 13) in the certain way. The method of claim 3, wherein the memory protection unit (120) is operable in a second mode of operation, in which of the

Memory protection unit (120) is checked whether the first process (1 13) may access in the specific way, (202, 302), and based on this review, the access of the first process (1 13) on the

Memory area (132) is allowed (203) or denied (303).

The method of claim 4, wherein a second process (1 1 1) having a higher privilege level than the first process (1 13) the

Memory protection unit (120) between the second and the first

Operating mode switches (401).

The method of claim 5, wherein the second process (1 1 1) of the

Memory protection unit (120) transmits its privilege level (401).

The method of claim 5 or 6, wherein the second process (1 1 1) switches the memory protection unit to the first operating mode (401) before the first process wants to access the memory area.

Method according to one of claims 4 to 7, wherein the

Memory protection unit (120), if a third process (1 14) with a lower privilege level than the first process (1 13) the

Memory protection unit wants to switch to the first mode of operation (502), a fourth process (1 1 1) with a higher privilege level than the first process informed (503).

Method according to one of the preceding claims 2 or 5 to 8, wherein the second process (1 1 1) and / or the fourth process (1 1 1) a

Operating system are.

10. The method according to any one of the preceding claims, wherein the

Memory protection unit (120) is formed as a unit of the microcontroller (101) and / or wherein the memory protection unit is formed as an external unit, which is connected to the microcontroller (101).

1 1. Arithmetic unit (100) adapted to perform a method according to any one of the preceding claims.

A computer program that causes a computing unit (100) to perform a method according to any one of claims 1 to 10 when executed on the computing unit (100).

13. Machine-readable storage medium with a stored thereon

Computer program according to claim 12.