Method for protecting a program code, corresponding system and processor

Program code intended to be copied into the cache memory of a microprocessor is transferred encrypted between the random-access memory and the processor, and the decryption is carried out at the level of the cache memory. A checksum may be inserted into the cache lines in order to allow integrity verification, and this checksum is then replaced with a specific instruction before delivery of an instruction word to the central unit of the microprocessor.

BACKGROUND

Technical Field

The disclosure relates to the protection of program codes intended to be executed by an information processing module, for example but not limitingly a microprocessor.

The disclosure applies more particularly but not exclusively to “systems-on-chip” (SoC).

Description of the Related Art

Currently, a complex system-on-chip may comprise, in addition to a microprocessor, hundreds of different modules commonly referred to by the person skilled in the art by the acronym IP (Intellectual Property). Most of these modules may contain microcontrollers which execute code. Furthermore, these modules may be used by attackers as entry points for spying, and possibly subsequently modifying the program code executed by the microprocessor.

BRIEF SUMMARY

One embodiment provides protection of a program code intended to be executed by a microprocessor, for example, which makes this program code less sensitive to attacks.

One embodiment also provides protection of a program code which allows verification of the integrity of this program code.

One embodiment furthermore provides a scheme for protecting the program code distributed all along the production and execution sequence, and not only in the startup sequence (better known to the person skilled in the art by the term “boot”).

One aspect provides a method for protecting a program code intended to be executed by an information processing module, for example a processor or a microprocessor, comprising at least one level-one cache of a cache memory containing cache lines, each having an address field and a data field, this data field being intended to store instruction words executable by the central unit of the information processing module.

The method according to this aspect comprises:

a) storage of the compiled and encrypted program code in memory locations of a first memory, for example a dynamic random-access memory (DRAM memory), external to the information processing module, these memory locations corresponding to data fields of cache lines, and

in the event of a request by the central unit for an instruction word not present in the data field of a cache line of the cache memory,

b) extraction from the first memory of the encrypted content of the memory location containing the requested instruction word, and delivery of this encrypted content to the information processing module, and

c) decryption of the encrypted content within the information processing module.

Thus, in the event of a “cache miss”, the content of a memory location of the first memory, for example the DRAM memory, is delivered encrypted on the communication medium, for example a “network-on-chip” (NoC), to the microprocessor, which carries out the decryption only inside itself, and more particularly locally at the level of the cache memory. For this reason, no unencrypted content of a part of the program code is accessible by an attacker at an entry point of the system.

It is possible for the cache memory to be a hierarchy of caches and, in addition to the level-one cache, to contain at least one higher-level cache, for example a level-two cache and a level-three cache, in which case the level-three cache may optionally be outside the information processing module. In this case, the decryption of the encrypted content is advantageously carried out locally at the level of the level-one cache, that is to say between the level-two cache and the level-one cache, or alternatively downstream of the level-one cache, and the encrypted content delivered to the cache memory remains stored encrypted in the various cache levels of levels greater than or equal to two.

This being the case, there are several possibilities in respect of the time of this decryption in relation to the storage in the cache memory.

Thus, it is possible to carry out, before the decryption of the encrypted content, storage of this encrypted content in the data field of a cache line of the cache memory. In other words, the encrypted content is first stored in the cache memory before carrying out the decryption.

As a variant, it sometimes appears preferable to carry out decryption of the encrypted content then, after this decryption, storage of the decrypted content in the data field of a cache line of the level-one cache of the cache memory.

According to one embodiment, in the event of a request by the central unit for an instruction word already present in an encrypted content of the data field of a cache line of the cache memory, the method advantageously comprises decryption of the encrypted content within the information processing module.

According to a simplified variant, the method comprises, after the decryption, delivery of the requested instruction word to the central unit. In other words, for example, no verification of the integrity of this decrypted content is then carried out before delivery of the requested instruction word to the central unit.

This being the case, in order to further increase the level of security, it is preferable to carry out verification of the integrity of the program code.

Thus, according to one embodiment, the method furthermore comprises, before delivery of the requested instruction word, verification of the integrity of the decrypted content and delivery of the requested instruction word if the result of the verification is representative of an integral content.

More particularly, according to one embodiment, the method comprises:an initial phase, for example during the compilation of the program code, prior to step a), comprising storage of the modified, compiled and encrypted program code in memory locations of an initial memory, for example a nonvolatile memory of the FLASH type, external to the information processing module, these memory locations here again corresponding to data fields of cache lines, the modified compiled program code comprising instruction word groups which are stored in the memory locations of the initial memory, each instruction word group comprising first instruction words resulting from the compilation of the program code and a second instruction word, for example a “no operation” (better known to the person skilled in the art by the acronym “NOP instruction”: No OPeration), all the second instruction words being identical and located respectively at reference positions in the corresponding instruction groups (these reference positions may occupy identical places, for example the last place, in the corresponding instruction groups, or the place of a reference position in the corresponding group may be calculable on the basis of a parameter of the group, for example the address of the cache line or that of its associated memory location),a first phase, for example during the startup (boot) phase, comprising decryption of the modified and compiled code, replacement of the second instruction word of each instruction group with a check indication obtained on the basis of at least some of the first instruction words of the instruction group, for example a “checksum” so as to form a modified instruction group, and encryption of the modified instruction groups, the step a) then comprising storage of the modified encrypted instruction groups in the memory locations of the first memory, for example the DRAM memory,and the verification of the integrity of the decrypted content comprises verification of the integrity of the check indication, an integral check indication being representative of the integral nature of the decrypted content, and if the result of the verification is representative of an integral content, the method furthermore then comprises, before delivery of the requested instruction word to the central unit, replacement of the check indication with the second instruction word, in the case in point the NOP instruction.

A scheme for protecting the program code is then obtained, which is distributed all along the production and execution sequence of this program code, that is to say during the compilation of the program code, during the delivery of this program code from the FLASH memory to the DRAM memory, and during the execution of the program code, by virtue of the fact that the decryption of the program code portion delivered to the microprocessor in the event of a cache miss is only carried out inside the microprocessor, and more particularly locally at the level of the cache memory.

As indicated above, the control indication may be a checksum, and the verification of the integrity of the check indication then comprises, after decryption of the encrypted content, a new calculation of a checksum and a comparison of the checksum present in the decrypted content and the newly calculated checksum.

In order to increase the level of security even more, it is particularly favorable for the first phase to furthermore comprise verification of the integrity of the modified compiled program code before replacement of each second instruction word.

In this regard, the verification of the integrity of the modified program code may here again be carried out with the aid of an additional checksum calculated on the basis of the modified program code. Thus, by way of example, a checksum may be calculated before encryption of the modified program code and storage in the FLASH memory.

As indicated above, the first phase may be carried out when launching a startup program.

Another aspect provides a system, comprisingan information processing module comprising at least one level-one cache of a cache memory containing cache lines, each having an address field and a data field intended to store instruction words executable by the central unit of the information processing module,a first memory, external to the information processing module, having memory locations corresponding to data fields of cache lines and intended to store the compiled and encrypted program code,a first memory controller coupled to the first external memory,a communication medium coupled to the first memory controller and to the information processing module,the information processing module furthermore comprising control means configured in order, in the event of a request by the central unit for an instruction word not present in the data field of a cache line of the cache memory, to deliver on the communication medium to the first memory controller a command to read the encrypted content of the memory location containing the requested instruction word,the first memory controller being configured in order to deliver this encrypted content to the information processing module,the information processing module furthermore comprising decryption means configured in order to decrypt this encrypted content.

When the cache memory comprises the level-one cache and at least one higher-level cache, the decryption means are advantageously configured in order to carry out the decryption of the encrypted content at the level of the level-one cache.

According to one embodiment, the control means are configured in order, before the decryption of the encrypted content, to carry out storage of this encrypted content in the data field of a cache line of the cache memory.

According to another possible configuration, the control means are configured in order, after the decryption of the encrypted content, to carry out storage of the decrypted content in the data field of a cache line of the level-one cache of the cache memory.

According to another configuration, in the event of a request by the central unit for an instruction word present in the encrypted content of the data field of a cache line of the cache memory, the decryption means are configured in order to carry out decryption of the encrypted content locally at the level of the level-one cache.

According to a first variant, the control means are configured in order, after the decryption, to deliver the requested instruction word to the central unit.

According to another variant, the system furthermore comprises verification means configured in order, before delivery of the requested instruction word, to carry out verification of the integrity of the decrypted content and to deliver the requested instruction word if the result of the verification is representative of an integral content.

According to one embodiment, the system furthermore comprisesan initial memory, external to the information processing module, comprising memory locations corresponding to data fields of cache lines and intended to store a compiled and encrypted modified program code comprising instruction word groups, each instruction word group comprising first instruction words resulting from the compilation of the program code and a second instruction word, all the second instruction words being identical and located at reference positions, for example at the same reference position, in the corresponding instruction groups,an initial memory controller coupled to the external initial memory and to the communication medium,processing means configured in order to carry out decryption of the compiled modified code, to replace the second instruction word of each instruction group with a check indication obtained on the basis of at least some of the first instruction words of the instruction group, so as to form a modified instruction group, and to encrypt the modified instruction groups with a view to the storage of the encrypted modified instruction groups in memory locations of the first memory,and the verification means are configured in order to carry out verification of the integrity of the check indication, an integral check indication being representative of the integral nature of the decrypted content, and if the result of the verification is representative of an integral content, in order to replace, before delivery of the requested instruction word to the central unit, the check indication with the second instruction word.

According to one embodiment, the check indication is a checksum, and the verification means comprise calculation means configured in order to carry out, after decryption of the encrypted content, a new calculation of a checksum and a comparison of the checksum present in the decrypted content and the newly calculated checksum.

According to one embodiment, the processing means furthermore comprise initial verification means configured in order to carry out verification of the integrity of the modified compiled program code before replacement of each second instruction word.

In this regard, the initial verification means may comprise initial calculation means configured in order to calculate an additional checksum on the basis of the modified program code.

The system may comprise a startup controller advantageously containing the processing means.

The system may be a system-on-chip.

Another aspect provides an information processing module, for example a processor or a microprocessor, comprisingan interface intended to be coupled to a communication medium,a central unit,at least one level-one cache of a cache memory containing cache lines, each having an address field and a data field intended to store instruction words executable by the central unit of the information processing module,control means configured in order, in the event of a request by the central unit for an instruction word not present in the data field of a cache line of the cache memory, to deliver on the communication medium to an external memory a command to read the encrypted content of the memory location of this external memory containing the requested instruction word, the interface being configured in order to receive this encrypted content, anddecryption means configured in order to decrypt this encrypted content.

According to one embodiment, the control means are configured in order, before the decryption of the encrypted content, to carry out storage of this encrypted content in the data field of a cache line of the cache memory.

According to another possible embodiment, the control means are configured in order, after the decryption of the encrypted content, to carry out storage of the decrypted content in the data field of a cache line of the level-one cache of the cache memory.

According to one embodiment, in the event of a request by the central unit for an instruction word present in an encrypted content of the data field of a cache line of the cache memory, the decryption means are configured in order to carry out decryption of the encrypted content locally at the level of the level-one cache.

According to a first possible variant, the control means are configured in order, after the decryption, to deliver the requested instruction word to the central unit.

According to another possible variant, the module furthermore comprises verification means configured in order, before delivery of the requested instruction word, to carry out verification of the integrity of the decrypted content of the data field of a cache line and to deliver the requested instruction word if the result of the verification is representative of an integral content.

According to one embodiment, the decrypted content of the data field of a cache line contains an instruction word group comprising first instruction words relating to a compiled program code and a check indication, obtained on the basis of at least some of the first instruction words and located at a reference position in the cache line, which may be the same for all the cache lines, and the verification means are configured in order to carry out verification the integrity of the check indication, an integral check indication being representative of the integral nature of the decrypted content, and if the result of the verification is representative of an integral content, in order to replace, before delivery of the requested instruction word to the central unit, the check indication with a second instruction word, this instruction word being identical for all the cache lines.

The second instruction word may be a no operation instruction, and the check indication may be a checksum, and the verification means then for example comprise calculation means configured in order to carry out, after decryption of the decrypted content, a new calculation of a checksum and a comparison of the checksum present in the decrypted content and the newly calculated checksum.

DETAILED DESCRIPTION

InFIG. 1, the reference SYS denotes a system, for example a system-on-chip (SoC), comprising an information processing module1, for example a microprocessor, coupled to a communication medium2, in the case in point a network-on-chip (NoC).

Further to the microprocessor1, the system SYS comprises a memory4, also referred to as the initial memory, for example a nonvolatile memory of the FLASH type, associated with an initial memory controller3coupled to the network2.

The system SYS also comprises another memory6, also referred to as the first memory, for example a DRAM memory, as well as an associated first memory controller5also coupled to the network2.

The system SYS also comprises various modules or IP,7(a single one being represented for the sake of simplicity) also coupled to the network2.

Lastly, in the present case the system SYS comprises a startup controller18(“boot controller”), also coupled to the network2and configured in order to launch a startup (“boot”) sequence of the system SYS, and in particular of the microprocessor1.

In the present case, the startup controller18comprises processing means180, themselves comprising initial verification means1800including initial calculation means1801, which may for example be implemented as software, and which will be returned to in more detail below regarding their function.

The microprocessor1comprises an interface10coupled to the network2, a central unit11(also known to the person skilled in the art by the acronym CPU: “Central Processing Unit”).

In this exemplary embodiment, the processor1also comprises a cache memory12, which will be assumed here only to be of level 1 comprising a level-1 instruction cache120and a level-1 data cache130.

The processor1also comprises a cache controller14, as well as control means15, decryption means16and verification means17, the functions of which will be returned to in more detail below.

The system SYS furthermore comprises a compiler19.

As is conventional in the art, and illustrated inFIG. 2, the instruction cache120comprises cache lines LCHj, each comprising an address field TGjand a data field CHDj. The data field CHDjcomprises a plurality of instruction words executable by the central unit11of the microprocessor, and the address field TGjcomprises the address of the data field CHDjin the first memory6.

Some bits of this address make it possible to identify the various instruction words present in the data field CHDj.

Various embodiments of the method according to the disclosure will now be described with reference toFIGS. 3 to 9.

InFIG. 3, the reference CP denotes a program code intended to be executed by the microprocessor1.

In step30, the program code CP is compiled and supplemented with specific instruction words, in the case in point no operation instructions (NOP instructions), so as to obtain a compiled and modified program code CPM.

As illustrated in thisFIG. 3, this compiled modified program code CPM comprises instruction word groups Ji.

Each instruction word group Jicomprises first instruction words MI1resulting from the compilation of the program code and a second instruction word, in the case in point an NOP instruction, all the second instruction words being identical and located at the same position in the corresponding instruction groups.

In the example described here, the NOP instruction is placed at the last place of each instruction group Ji.

This being the case, this place could be different so long as it is, for example, identical in each of the groups or easily calculable.

Likewise, the second instruction word could be an instruction other than the NOP instruction, but this would then require the sacrifice of a register of the microprocessor because such an instruction can be executed by the processor.

So as to allow a first level of integrity verification, the compiler19carries out a calculation31of a checksum CHS1on the basis of at least some, and in practice all, of the instruction words of the compiled modified program code. The compiled modified program code CPM, as well as the checksum CHS1, are encrypted (step32) by conventional encryption means, which may be incorporated in the compiler19. By way of nonlimiting example, an algorithm of the AES type may be used as the encryption algorithm.

The modified, compiled and encrypted program code is then stored (step33) under the control of the memory controller3, in memory locations EM0iof the initial memory4. These memory locations correspond to data fields of cache lines.

The protection method then comprises a first phase, advantageously carried out during the startup (“boot”) phase34of the processor. The operations which will now be described are typically carried out by the startup controller18.

The processing means180of the startup controller18carry out decryption35of the compiled modified program code and of the checksum CHS1, which are stored in the initial memory4and extracted from this memory via the memory controller3.

The initial verification means1800then carries out verification36of the checksum CHS1. More particularly, in a conventional way, the initial calculation means1801are configured in order to calculate again an additional checksum on the basis of the modified program code CPM, and the initial verification means1800compare the checksum CHS1with the additional checksum which has just been calculated (step37,FIG. 4).

If the verification is found to be negative, that is to say if the two checksums are different, then this is representative of a nonintegral modified program code having been potentially corrupted.

In this case, specific error handling38may be applied. The content of such error handling varies depending on the applications and may for example consist in blocking the system SYS.

In the case in which the result of the comparison is positive, that is to say representative of an integral content of the modified program code CPM, the processing means180determine (step39) for each instruction group Jia checksum CHS2iobtained on the basis of the instruction words MI1and NOP of the group Jiand replace the second instruction word, in the case in point the NOP instruction, with this checksum CHS2i, so as to form a modified instruction group JMi.

The processing means180then carries out encryption40of the modified instruction groups JMiand stores them (step41) via the memory controller5in the memory locations EM1iof the first memory6.

Here again, these memory locations EM1icorrespond to data fields of cache lines.

At this stage, the program code is ready to be executed by the microprocessor1.

This will be explained in more detail with reference toFIGS. 5 to 9.

It is assumed inFIG. 5that, in a step50, the central unit11of the microprocessor requests the instruction word MI.

The control means15, which in practice may for example be implemented as software within the cache controller14, verify by comparison of addresses in the various address fields TGjof the cache12whether this instruction word MI is present in a cache line LCH of the cache120.

If this is not the case, that is to say in the event of a cache miss, the control means deliver on the network2(step52) a command CMD to read the encrypted content of the memory location of the first memory6containing the requested instruction word. This command consequently contains the address of this memory location.

The memory controller5then extracts from this memory location its encrypted content, that is to say the modified encrypted instruction group, which is assumed in this example to be the group JMj.

The memory controller then delivers this encrypted group JMjon the network2to the microprocessor1(step54).

In this alternative embodiment, the decryption means16, which may also be implemented as software within the cache controller14, then carry out decryption55of the modified encrypted instruction group JMj, and the verification means17, which may also be incorporated as software within the cache controller, carry out verification56of the integrity of this decrypted content, that is to say of the decrypted modified instruction group JMj.

In this regard, the verification means will verify the integrity of the checksum CHS2j(step57).

This verification is carried out in a conventional way by recalculation of a new checksum CHS2′jand by a comparison of the received checksum CHS2jand the calculated checksum CHS2′j.

In the event of a negative comparison, representative of nonintegrity of the received modified instruction group, the cache controller may implement specific error handling58.

In the event that the verification of the checksum is representative of an integral content of the modified instruction group JMjreceived, the verification means17replace the checksum CHS2jwith the second instruction word, in the case in point the NOP instruction, so as to obtain again the instruction group Jjwhich had been obtained at the end of step30inFIG. 3.

This instruction group Jj, which comprises the first instruction words MI1and the NOP instruction, is then stored (step60) in the data field of a cache line, in the case in point the cache line LCHm.

The requested instruction word MI is then delivered (step61) to the central unit11with a view to its execution, in which case the requested instruction word MI may be either one of the instruction words MI1or the NOP instruction.

In this embodiment, it is assumed that the decryption of an encrypted content and the verification of the integrity of the decrypted content were carried out before storage in a cache line. Under these conditions, if in step51the requested instruction word MI already belongs to a cache line LCH its delivery is carried out directly (step61).

Other alternative embodiments are possible.

Thus, as illustrated inFIG. 7, after delivery of the encrypted modified instruction group JMjto the microprocessor1, storage of this encrypted group JMjin a cache line, in the case in point the cache line LCHm, may be carried out directly (step70).

The decryption means16then carry out the decryption of the modified instruction group JMj(step71), and the verification means17carry out (step72) verification of the integrity of the decrypted modified instruction group in a similar way to that described above with reference to step56ofFIG. 5.

In the case in which this verification processing is representative of a nonintegral content (step73), error handling74is implemented.

If the verification processing is found to be positive, that is to say representative of an integral content of the modified instruction group JMj, the verification means then carry out (step75) replacement of the checksum CHS2jwith the NOP instruction in a similar way to that described with reference to step59ofFIG. 6, so as to restore the instruction group Jjthen, in step76, deliver the requested instruction word MI.

If, as illustrated inFIG. 8, the requested instruction word MI belongs to a line LCH, for example the cache line LCHm, the data field which is encrypted, then step71ofFIG. 7is proceeded to directly (step81) in order then to carry out steps72,73, optionally74,75and76.

It is also possible, as illustrated inFIG. 9, in the case in which the requested instruction word MI belongs to a cache line LCH (step90), for example the cache line LCHmalready decrypted, that the verification processing is carried out not before the storage of the decrypted content in the cache line but after the storage, before delivery of the requested instruction word.

In this case, step91leads directly to step56ofFIG. 5so as to execute steps56,57, optionally58and59to61.

Throughout the description above, it was assumed that the cache memory comprised only a level-one cache.

This being the case, as illustrated inFIG. 10, the cache memory may be a hierarchy of caches and comprise caches of different levels, for example a level-one cache1201, a level-two cache1202and a level-three cache1203.

Some of these caches, for example the level-three cache, may even be located outside the microprocessor.

In this case, the features discussion above, namely the decryption and the integrity verification, are carried out locally at the level of the level-one cache. In other words, any content decryption will be carried out only either between the level-two cache and the level-one cache or downstream of the level-one cache before delivery of the instruction word to the central unit. Furthermore, any content extracted from the memory6will remain encrypted so long as it remains present in a cache of a level higher than level one.

Each cache is associated with a cache controller.

If the requested instruction word is not present in the level-one cache but is present in the level-two cache, for example, the content of the corresponding cache line of the level-two cache remains encrypted in the level-two cache and is delivered by the level-two cache controller to the level-one cache controller. The latter may then store the encrypted content in the cache line of the level-one cache before the decryption, or may alternatively carry out the decryption first before storage.

In the case in which the requested instruction word does not belong to any cache, that is to say in the event of a cache miss, the encrypted content extracted from the DRAM memory is delivered to the level-three cache controller, which is assumed here to be outside the microprocessor. At this stage, the level-three controller may either update the level-3 cache by storing the encrypted content therein then deliver the encrypted content to the microprocessor, and more particularly to the level-two cache controller, or may alternatively deliver the encrypted content directly to the level-two cache controller before updating the level-three cache.

The level-two cache controller may either update the level-2 cache by storing the encrypted content therein then deliver the encrypted content to the level-one cache controller, or alternatively deliver the encrypted content directly to the level-one cache controller before updating the level-two cache. Furthermore, here again, the level-one cache controller may then store the encrypted content in the cache line of the level-one cache before decryption, or alternatively carry out the decryption first before storage.

The invention is not limited to the embodiments which have just been described, but encompasses all variants thereof.

Thus, in a simplified variant, if conduct of the integrity verification processing is not desired, it is possible simply to carry out decryption of the encrypted content extracted from the DRAM memory and deliver the requested instruction word.

Furthermore, the system is not necessarily a system-on-chip (SoC) but may, for example, comprise a processor and external memories connected on a board and mutually coupled by a conventional bus.

A means, or module, as used herein may include a hardware module, such as one or more electronic circuits; a software module, such as one or more processor-executable instructions or one or more representations of processor-executable instructions; or a combined hardware and software module.