MULTI-CIRCUIT PROCESSOR DEVICE AND METHOD

Abstract: A multi-circuit processor device, such as a personal digital assistant, having a processor (11). The processor (11) has a memory select output (19 or 14). A program memory (12) with a memory select input (18 or 14) is coupled to the memory select output of the processor for selecting the program memory for addressing by the processor. A peripheral circuit (20) such as a radio modem has a data memory (40) for storing secure data. A connection (16) couples the processor and the peripheral circuit for communicating data between the processor and the data memory. A gate element (17) is associated with the connection between the processor and the peripheral circuit. The gate element is coupled to the memory select output of the processor for opening the gate element, thus allowing for security of access to the critical data in the data memory (40).

Description: MULTI-CIRCUIT PROCESSOR DEVICE AND METHOD Field of the Invention This invention relates to a multi-circuit processor device, such as a personal digital assistant (PDA), personal computer, cellular radio or other such device having a processor and at least one peripheral circuit having secure data. It also relates to a method of operation of such a device. Background cf the Invention In an open system (an architecture that supports third-party applications), it is often necessary to protect various sub-circuits from being accessed by unauthorized code The reasons are that codes and/or identification information which established the user's priorities, billing identification for service usage, warranty information, etc. are stored in sections of hardware. These items are stored in data registers of peripheral circuits or in memory If a user changes these codes, he could conceivably violate circuit access codes on networks, steal time on a service or receive warranty repairs that were not purchased. In the past, efforts have been directed towards achieving data security by scrambling the data or by validating a user in the operating system. Software solutions can be circumvented if the open system allows changes to the operating system. There is a need for a simple manner of improving system security in a multi-circuit processor device which does not require extensive additional hardware and does not substantially increase tne power consumption. A preferred embodiment of the invention is now described by way of example only. Brief Description of the Drawings FIG. 1 is a block diagram of a multi-circuit processor device in accordance with the preferred embodiment of the invention. FIG. 2 is a circuit diagram of the gate element (element 17) of FIG. 1. FIG. 3 is a timing diagram illustrating the operation of the circuit of FIG. 2. Detailed Description of the Preferred Embodiment Referring to FIG. 1, a multi-circuit processor device 10 in the form of a personal digital assistant is shown comprising a number of circuits. The processor device comprises a processor and associated code in RAM and ROM (hereafter simply "processor 11"), a program memory 12 preferably in the form of the lowest layers of code in read-only memory (ROM) , a set of hardware processor registers 13, and a peripheral circuit 20 such as a modem. Connected between the processor 11, the program memory 12 and the processor registers 13 is an address bus 14 and a data bus 15. A memory chip select output 19 passes from the processor 11 to a memory select input 18 (otherwise referred to as "chip enable" or "CE") of the program memory 12. A connection 16 in the form of a peripheral circuit select line (or a chip select line) passes from the processor 11 to the peripheral circuit 20 via a gate element 17. The memory chip select output 19 is connected to a control input of the gate element 17. The processor 11 is shown as having a number of functions including internal request functions 30, external request functions 31, and driver interface functions 32. The internal request functions 30 are ROM applications. The external request functions 31 are externally loaded applications from a PCMCIA card or random access memory (RAM) or loaded into the processor device by the modem or other peripheral circuit or elsewhere. User data flows from the internal request functions 30 to the driver interface 32 and from the external request functions 31 to the driver interface 32. Program memory 12 is shown as comprising a number of sub-blocks of program code. Sub-block 35 implements critical data READ functions from a critical data memory (see below) . Sub-block 36 is a final data builder. Data build by sub-block 36 is stored in RAM (not shownj . Sub- block 37 implements final data WRITE functions and is preferably ROM based so that the software cannot change it . The hardware registers 13 are shown as comprising a critical data memory 40 for storing secure data such as an identification (ID) number and final data registers 41 for storing final data received from final data WRITE functions 37 and for passing on to peripheral circuit 20. Critical data cannot be read from critical data memory 40 except by opening of gate element 17. Gate element 17 only opens in response to an immediately preceding memory select signal from memory select output 19. In other words, only if the immediately preceding operation instruction addressed by address bus 14 was an instruction fetched from program memory 12 will gate element 17 open peripheral circuit select line 16 for reading or writing of data from or to critical data memory 40. In operation, the driver structure illustrated in FIG. 1 operates by internal or external requests 30 or 31 generating data which is built in final data builder 36, taking critical data from memory 40 through sub-block 35 and writing final data in final data WRITE functions 37 and passing this via data output 50 to final data registers 41, for transmitting tnrough peripheral circuit 20 Op code and operand fetches from final data WRITE function 37 must be "non-RAM fetches" to keep gate element 17 open For the purposes of building the final data in final data builder 36, certain critical data is necessary from critical data READ functions 35 Critical data READ functions 35 obtain the critical data from cut cal data memory 40 The arrangement has the advantage that secure data can only be read from critical data memory 40 in response to an instruction read from program memory 12 It will not output the critical data in response to an instruction from a PCMCIA card or from RAM or any other external request 31 This provides a robust arrangement that is secure from modification or "hacking" When gate element 17 is closed, accesses to the peripheral circuit 13 become "no operation" instructions Instead of gate element 17 being connected to memory select output 19 of processor 11 and selectively opening the gate element in response to this memory select output, gate element 17 can be connected to one of the address lines 45 of address bus 14 This is a suitable arrangement where one address l ne of address bus 14 is in effect the chip select input for program memory 12 It will be appreciated that memory select output 19 can notionally be considered a dedicated memory select line, or can equally be considered to be a memory select output when comprised within the address bus 14 Equally, gate element 17 can be activated by a signal from a memory management circuit The particular arrangement can be tailored to the memory allocation structure. Modifications to FIG 1 can be made within the scope of the invention Gate element 17 is shown in the peripheral circuit select line 16, but it will be appreciated that the peripheral circuit select line 16 can be configured as one of the lines of the address bus 14 and the gate element 17, in which case the connection between the processor 11 and the peripheral circuit 13 which is controlled by gate 17 is the address bus 14 Alternatively the the connection between the processor 11 and the peripheral circuit 13 which is controlled by gate l 7 can be the data bus 15 Additional peripheral circuits can be connected to address bus 14 and data bus 15 The additional peripheral circuits may themselves have critical data memories or registers for storing secure data, m which case additional gate elements can be provided to control access to those critical data memories or registers Peripheral circuit 20 is m the preferred embodiment, a radio modem and the critical data stored in memory 40 is preferably a network security access code, an air service billing identification code or malfunction record information Alternatively the peripheral circuit can be a cellular telephone or a wireline modem or indeed some otner input/output device, such as a solenoid for operating a door opener The function of peripneral circuit 20 is not material to the invention In the arrangement illustrated m FIG 1, certain software design rules must be adhered to All sub-blocks in the driver program memory 12 must be sequential code (i.e no function calls) In an obηect-oπented environment, sub-blocks cannot be patchable The entire driver code stored in program memory 12 is non- mterruptable from user generated interrupts All accesses (whether READ or WRITE) to the critical data memory 40 implement the non-RAM fetch macro code of program memory 12 which will pass through the gate element 17. Details of the circuitry of gate element 17 are shown in FIG. 2. FIG. 2 shows that the gate element 17 comprises a flip-flop 100 comprising first and second gates 101 and 102 together forming a bi-stable element. Flip-flop 100 has inputs 103 and 104 which are derived from AND gate 105 and OR gate 106 respectively. Flip-flop 100 has an output 109 connected to AND gate 110. The various gates have symbols which are standard in the art and inverted inputs or outputs are shown in a manner standard in the art. The various signals at the various inputs and outputs are labeled. The meanings of the various labels are given in the following table: Table 1 IFETCH instruction fetch C30 chip select 0 DSACK(O) data acknowledge 0 DSACK(l) data acknowledge 1 ROMCODE ROM instruction DSACKX any data acknowledge FFOUT flip flop output ENMODEM enable modem MODEMCS modem chip select SECMODEMCS secure modem chip select AS address strobe The general operation of the gate element 17 is that input 103 sets the flip-flop 100 when there is an instruction fetch command from processor 11 and when that instruction fetch command is associated with an address within the address space of program memory 12. When flip- flop 100 is set, it is open for transfer of one bit of data from input 104 to output 109. Gate 106 closes security gate element 17 by clearing flip-flop 100 and blocking MODEMCS through gate 110. When gate 110 is closed, all accesses to peripheral circuit 13 (read and write) are blocked. Gate 110 allows the peripheral circuit 13 to be selected. FIG. 3 is a timing diagram illustrating the operation of the circuit of FIG. 2, starting with a code fetch or instruction fetch at time t 0 . At time ti the processor 11 declares that it is making an external access by asserting Address Strobe. This starts a first instruction cycle. At time t2 the processor declares that the access is directed to ROM 12. At time t3 the processor declares that the external access is an instruction fetch (from ROM 12). At time t4 the signal ROMCODE is generated by the combination of IFETCH and CSO in gate 105 to open flip-flop 100. At time ts gate 101, internal to flip-flop 100 reacts to ROMCODE by going low. At time tg ENMODEM is asserted and security gate flip-flop 100 is open and gate 110 is enabled to fire when MODEMCS arrives . At time t7 the processor completes the instruction fetch to ROM and deasserts IFETCH At time τ.Q ROMCODE reacts to the deassertion of IFETCH by deasserting (e.g. the processor is no longer generating a fetch from ROMCODE) however, note that the gate remains open (ENMODEM is still asserted) At time tg the processor ends it's external cycle (all external circuits cease to react to the processor, but even so, security gate element 17 is open). At time tio the processor again declares its intention to generate an external access and a second instruction cycle begins. At time tχι the access is towards the modem as indicated by the assertion of MODEMCS. At time ti2 SECMODEMCS is generated towards the modem circuits (13 and/or 20) because ENMODEM is still true. At time tχ4 DSACK asserts from the modem to the processor indicating that the data access has completed successfully which in turn clears flip-flop 100 and closes security gate element 17. At time ti5 ENMODEM reacts to the closing of flip-flop 100 by deasserting At time tig FFOUT deassertε thereby changing the state of the flip-flop, also SECMODEMCS deasserts towards the modem circuits 13 & 20 At time ti7 ~ tl8 the processor shuts down the external cycle and has no further effect on security gate element 17 and the second instruction cycle is completed. Certain software restrictions apply the processor cache must be turned off (I e previous instruction fetch must not be a hit or gate element 17 will be n an unguaranteed state) , there must be no data transfer between instruction fetch which controls data movement and modem access - l e an item of modem data must be immediate or m the register but not in RAM a previous instruction must not be executing data transfer from the current executing circuit (this is a pipeline issue), all READS and WRITES to any modem address must be pre-charged by an access to ROM 12 and code can never patched In operation, the gate element 17 is pre-charged bi a code fetch from ROM 12 Once pre-charged, the circuit allows one opportunity for an access to the modem If the next non-PROM/OTP access is not to the modem, the gate element 17 disables modem access until the next pre-charge There can be multiple gates identical to gate 110, such as gate 120 shown in phantom outline in FIG 2, each gate receiving flip-flop output 109 as an input and each receiving a different circuit select input for selecting a different peripheral circuit In this way security gate element 17 can control access to critical data m a number of different peripheral circuits Flip-flop 100 can be any storage element such as a D- type flip-flop or a J-K flip-flop. Any non-ROM access complete event (not ust DSACK) can cause gate element 17 to close

Claims: Claims 1 A multi-circuit processor device comprising a processor having a memory select output, a program memory having a memory select input coupled to the memory select output of the processor for selecting the program memory for addressing by the processoi , a peripheral circuit having a data memory for storing secure data, a connection between the processor and the peripheral circuit, and a gate element m the connection between the processor and the peripheral circuit, the gate element being coupled to the memory select output of the processor for selectively opening the gate element 2 A multi-circuit processor device according to claim 1 wherein the connection between the processor and the peripheral circuit is a peripheral circuit select line 3 A multi-circuit processor device according to claim 1 wherein the connection between tne processor and the peripheral circuit is an address line of an address bus 4 A multi-circuit processor device according to claim 1 wherein the connection between the processor and the peripheral circuit is a data bus 5 A multi-circuit processor device according to claim 1 wherein the memory select output of the processor is an address line of an address bus 6 A multi-circuit processor device according to claim 1 further comprising an address bus extending between the processor, the program memory and the peripheral circuit, wherein the processor has a memory select output separate from the address bus for selecting the program memory 7 A multi-circuit processor device according to claim 1 therein the gate element is a bi-stable element 8 A multi-circuit processor device according to claim 1, wherein the peripheral circuit is an input/output device 9 A multi-circuit processor device according to claim 8 , wherein the input/output device is a radio modem 10 A multi-circuit processor device according to claim 9 wherein the data memory contains information selected from the group consisting of a network security access code an air service billing identification code and malfunction record information 11 A multi-circuit processor device according to claim 1 wherein the gate element comprises a flip-flop and a plurality of gates each gate coupled to an output of the flip-flop and each receiving a circuit select input for selecting a different peripheral circuit 12 In a multi-circuit processor device comprising a processor having a memory select output, a program memory having a memory select input coupled to the memory select output of the processor for selecting the program memory for addressing by the processor, a peripheral circuit having a data memory for storing secure data, a connection between the processor and the peripheral circuit, and a gate element associated witn tne connection between the processor and the peripheral circuit, a method comprising the steps of providing a memory select signal to the program memory in a first instruction cycle, providing the memory select signal to the gate element, setting the gate element m response to the memory select signal to open m a second instruction cycle and communicating with the data memory through the gate element in the second instruction cvcle

Inventors: LEE JIN WOO, MATHIS JAMES EARL, SOMMERS DANIEL RAY, LEE, JIN, WOO, MATHIS, JAMES, EARL, SOMMERS, DANIEL, RAY
Applicants: MOTOROLA INC, MOTOROLA INC.
Application year: 1996
Main classification: G06F13
IPC codes: G06F12