Abstract:
The present disclosure relates to a method for executing, by a processor, a program read in a program memory, comprising steps of: detecting a program memory read address jump; providing prior to a jump address instruction for jumping a program memory read address, an instruction for storing the presence of the jump address instruction; and activating an error signal if an address jump has been detected and if the presence of a jump address instruction has not been stored. The present disclosure also relates to securing integrated circuits.

Description:
BACKGROUND 
     1. Technical Field 
     The present disclosure relates to the protection of integrated circuits against attacks by error injection, and particularly to the protection of integrated circuits present in smart cards. 
     The present disclosure relates more particularly to a method for securing the execution of a program by a processor (microprocessor or microcontroller) of the chip. 
     2. Description of the Related Art 
       FIG. 1  shows an example of an integrated circuit IC for smart card or electronic tag. The integrated circuit IC comprises a microprocessor central processing unit UC, one or more non-volatile memories MEM 1  (e.g., ROM, EEPROM, FLASH), one or more volatile memories MEM 2  (e.g., RAM), an encryption circuit CRYCT enabling the integrated circuit to authenticate itself during a transaction, and an interface circuit INTCT enabling it to communicate with external smart card or electronic tag readers (EXT). The interface circuit INTCT can be of the contact type and comprise for example ISO 7816 contacts (e.g., clock, data, supply, ground contacts). The interface circuit INTCT can also be of the RFID contactless type (Radio Frequency Identification) and comprise an antenna coil RF or an antenna circuit UHF, modulation and demodulation circuits for modulating and demodulating incoming and outgoing data, a clock extractor circuit, etc. The central processing unit UC, the memories MEM 1 , MEM 2  and the circuit CRYCT are linked to each other by a data bus DTB and an address bus ADB. 
     Secured integrated circuits, such as integrated circuits for smart cards, are the subject of various attacks by hackers who try to discover their structure and/or the secrets they contain. They are for example cryptography circuits of DES, AES, RSA, etc. type, microprocessors programmed to execute cryptography algorithms, register banks containing secret keys, etc. 
     The most advanced hacking methods currently involve injecting errors into an integrated circuit during the execution of so-called sensitive operations, such as authentication operations or operations of executing a cryptography algorithm for example. 
     Such attacks, referred to as attacks by error injection or fault injection, can occur during so-called sensitive calculation phases, such as during phases of calculating an identification code or during the reading of an encryption key in a memory. They enable, in combination with mathematical models and from false results obtained intentionally thanks to glitches, a secret element such as an encryption key or a password to be defined, the structure of a cryptography algorithm and/or the secret keys the algorithm uses to be deduced, etc. 
     In particular, localized attacks involve introducing glitches at a determined point of the circuit, for example by means of a laser beam or an X-ray beam. A localized attack can concern the supply voltage, a data or address path, or the clock signal of the integrated circuit. 
     Thus an attack can concern the data read in the program memory (bus DTB), and cause a modification of an instruction code passing through a data bus. The modified instruction code can be interpreted as a jump although the instruction read was not a jump instruction, or as another instruction although the instruction read was a jump instruction. Such a modification can also cause a modification of the operand associated with a jump instruction code, i.e., modify the destination address of the jump. The jump or the absence of jump thus caused is then final. 
     The attack can also concern the program memory read address, it can cause a jump in the absence of any jump instruction code. If the attack concerns the path of the program memory read addresses (bus ADB), the jump is fleeting and only relates to a single address read, since the program counter of the central processing unit is not modified, except if the instruction code read is a jump. If the attack causes a modification of the program counter, the jump is final. 
     When the jump is final, it can lead to the execution of a data discharge routine that is inaccessible in normal operation, or to checking procedures being bypassed. 
     BRIEF SUMMARY 
     One embodiment of the present disclosure increases the protection of a secure processor executing a program, by detecting erroneous address jumps. 
     One embodiment is a method for executing, by a processor, a program read in a program memory, the method comprising steps of:
         detecting a program memory read address jump,   prior to a jump address instruction for jumping an address in the program, providing an instruction for storing the presence of the jump address instruction, and   activating an error signal if an address jump has been detected and if the presence of a jump address instruction has not been stored.       

     According to one embodiment, the method comprises a step of providing, at a destination address of the jump address instruction, an instruction for storing an access to the destination address. 
     According to one embodiment, the method comprises a step of activating the error signal if the presence of a jump instruction has not been stored before the access to the destination address was stored. 
     According to one embodiment, the method comprises steps of:
         activating a counter further to storing the presence of the jump address instruction,   erasing the storing of the presence of the jump address instruction further to storing the access to the destination address of the jump, and   activating the error signal when the counter arrives at the end of counting if the storing of the presence of the jump address instruction has not been erased.       

     According to one embodiment, the method comprises steps of erasing the storing of the presence of the jump address instruction upon each program memory read cycle while the counter is not active. 
     According to one embodiment, the method comprises a step of providing an instruction for erasing the storing of the presence of a jump instruction further to a conditional jump instruction in the program memory. 
     According to one embodiment, the method comprises steps of providing an unconditional jump instruction further to a conditional jump instruction in the program memory, instructions for storing the presence of jump instructions before the conditional and unconditional jump instructions, and instructions for storing the access to the destination addresses of the unconditional and conditional jumps. 
     According to one embodiment, the presence of the jump address instruction is stored by loading a value in a first register, and the access to the destination address of the jump is stored by loading the same value in a second register, the error signal being activated if the first and second registers do not save the same value further to the write in the second register. 
     According to one embodiment, the value loaded in the first and second registers is different for each jump instruction. 
     According to one embodiment, the detection of erroneous jumps is inhibited during the triggering and at the end of the execution of an interrupt handler. 
     The present disclosure also relates to an integrated circuit comprising a program memory and a central processing unit to execute a program stored in the program memory. According to one embodiment, the integrated circuit comprises a device for detecting an erroneous jump comprising:
         a detector circuit for detecting a program memory read address jump,   a first register for storing the execution of a jump address instruction by the central processing unit, the first register being write-accessible by an instruction executable by the central processing unit, and   an address jump error detector circuit comprising means for activating an error signal if an address jump has been detected by the address detector circuit and if the first register does not indicate that a jump address instruction has been executed by the central processing unit.       

     According to one embodiment, the device for detecting an erroneous jump comprises a second register for storing the access to a destination address of a jump address instruction, the second register being write-accessible by an instruction executable by the central processing unit. 
     According to one embodiment, the error detector circuit comprises means for activating the error signal if the second register has been write-accessed before the first register. 
     According to one embodiment, the error detector circuit comprises:
         a counter which is activated further to a write in the first register,   means for erasing the first register further to a write in the second register, and   means for activating the error signal when the counter arrives at the end of counting if the first register has not been erased.       

     According to one embodiment, the error detector circuit comprises means for erasing the first register upon each program memory read cycle while the counter is not active. 
     According to one embodiment, the error detector circuit comprises means for comparing the content of the first and second registers further to the write in the second register, and for activating the error signal if the first and second registers do not save the same value. 
     According to one embodiment, the jump detector circuit comprises two registers loaded with the last two addresses read in the program memory and a comparator for determining whether or not the addresses stored in the two registers are successive. 
    
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
       Features and advantages of the present disclosure shall be presented in greater detail in the following description of an embodiment of the present disclosure, given in relation with, but not limited to the following figures, in which: 
         FIG. 1  previously described represents an integrated circuit in block form, 
         FIG. 2  represents in block form an integrated circuit equipped with a device for detecting an erroneous jump according to one embodiment, 
         FIG. 3  is an electronic circuit of one embodiment of the device for detecting an erroneous jump. 
     
    
    
     DETAILED DESCRIPTION 
       FIG. 2  represents an embodiment of an integrated circuit IC 1  that may be used for a smart card or an electronic tag. The integrated circuit IC 1  comprises a microprocessor central processing unit UC, one or more non-volatile memories MEM 1  (e.g., ROM, EEPROM, FLASH), one or more volatile memories MEM 2  (e.g., RAM), an encryption circuit CRYCT enabling the integrated circuit to authenticate itself during a transaction, and an interface circuit INTCT enabling it to communicate with an external reader EXT, such as an external smart card reader or an electronic tag reader. The interface circuit INTCT can be of the contact type and comprise for example ISO 7816 contacts (clock, data, supply, ground contacts, etc.). The interface circuit INTCT can also be of the RFID contactless type (Radio Frequency Identification) and comprise an antenna coil RF or an antenna circuit UHF, modulation and demodulation circuits for modulating and demodulating incoming and outgoing data, a clock extractor circuit, etc. The central processing unit UC, the memories MEM 1 , MEM 2  and the circuit CRYCT are linked to each other by a data bus DTB and an address bus ADB. 
     According to one embodiment, the integrated circuit IC 1  comprises a detection device JPCT configured to detect the erroneous jumps which may occur, during the execution of a program stored in the non-volatile memory MEM 1 , due to an attack by error injection. The device JPCT is connected to the address bus ADB and to the data bus DTB and receives from the integrated circuit IC 1  a clock signal CK pacing the reading of the program memory. The device JPCT receives from the central processing unit UC an instruction read signal INS indicating when an instruction code is being read in the program memory, and a write- or read-access selection signal RW. The device JPCT supplies a signal for detecting an erroneous jump ERR which is for example applied to the central processing unit UC. The central processing unit can thus take any appropriate action in response to an erroneous program jump being detected. 
       FIG. 3  represents one embodiment of the device JPCT. The device JPCT comprises a jump detector circuit JDCT for detecting a jump in the program memory read address, and a jump error detector circuit JEDCT. 
     The circuit JDCT comprises two address registers RGAD 1 , RGAD 2 , an increment circuit INC, a comparator COMP 1  and an AND-type logic gate AG 1 . The register RGAD 1  is connected to the address bus ADB of the integrated circuit IC 1 . The register RGAD 2  is connected to the output of the register RGAD 1 . The output of the register RGAD 2  is connected to the input of the circuit INC. The registers RGAD 1  and RGAD 2  are write-controlled by the output signal of the gate AG 1  receiving at input the clock signal CK of the circuit IC 1  and the signal INS indicating the read of an instruction code in the program memory. Therefore, at the start of each program memory read cycle, the register RGAD 1  is loaded with the address circulating on the address bus ADB, and the register RGAD 2  is loaded with the address stored in the register RGAD 1  during the previous read cycle. The address saved in the register RGAD 2  is incremented by one by the circuit INC, and then applied to an input of the comparator COMP 1 . The address saved in the register RGAD 1  is applied to another input of the comparator COMP 1 . Therefore, the comparator COMP 1  supplies a signal JDT indicating whether or not the last two successive program memory read addresses are consecutive. 
     At the start of the execution of a program, further to the initialization of the circuit JDCT, the two registers RGAD 1  and RGAD 2  save an initial value which does not correspond to the first program memory MEM 1  read address. It is therefore preferable to inhibit the circuit during the two read cycles used to load the register RGAD 2  with the first program memory MEM 1  read address. 
     The circuit JEDCT comprises an address decoder DECA connected to the address bus ADB, and two registers RGT 1 , RGT 2  connected to the data bus DTB of the integrated circuit IC 1 , and receiving a write command signal RW from the integrated circuit IC 1 . The address decoder DECA supplies two selection signals S 1 , S 2  enabling one or other of the registers RGT 1 , RGT 2  to be accessed according to the address sent by the bus ADB. Thus, the central processing unit UC can address one or other of the two registers RGT 1 , RGT 2  to write a datum sent by the bus DTB therein. 
     The circuit JEDCT comprises two comparators COMP 2 , COMP 3 . The comparator COMP 2  compares the content of the register RGT 1  with 0, and the comparator COMP 3  compares the content of the two registers RGT 1  and RGT 2 . 
     The circuit JEDCT comprises a counter CPT paced by the clock signal CK and an AND-type logic gate AG 2  receiving the signal RW and the signal S 1 . The output of the gate AG 2  is connected to an activation input of the counter CPT. Thus, the counter CPT is activated when the register RGT 1  is write-selected. 
     The circuit JEDCT comprises an AND-type logic gate AG 3 , two flip-flops FF 4 , FF 5  paced by the clock signal CK, and an OR-type logic gate OG 2  one input of which is connected to the output of the counter CPT. The gate AG 3  receives the signal RW and the signal S 2  for selecting the register RGT 2 . The output of the gate AG 3  is connected to the input of the flip-flop FF 4 . Therefore the flip-flop FF 4  changes state when the register RGT 2  is write-selected. The output of the flip-flop FF 4  is connected to the input of the flip-flop FF 5 . The output of the flip-flop FF 5  supplies a signal RST which is sent to the input of the gate OG 2 . The output of the gate OG 2  controls the initialization of the register RGT 1 . 
     The circuit JEDCT comprises three flip-flops FF 1 , FF 2 , FF 3 . The clock signal input of the flip-flop FF 1  receives the jump detection signal JDT at output of the comparator COMP 1 . The flip-flop FF 1  comprises an input connected to the output of the comparator COMP 2 . The clock signal input of the flip-flop FF 2  is connected to the output of the counter CPT. The flip-flop FF 2  comprises an inverted input connected to the output of the comparator COMP 2 . The clock signal input of the flip-flop FF 3  is connected to the output of the flip-flop FF 4 . The flip-flop FF 3  comprises an inverted input connected to the output of the comparator COMP 3 . Each of the outputs of the flip-flops FF 1 , FF 2 , FF 3  is connected to an input of an OR-type logic gate OG 1 . The output of the gate OG 1  supplies the erroneous jump detection signal ERR. 
     The register RGT 1  is initialized at each cycle of the clock signal CK when the counter is on 0. The register RGT 2  is on 0 when the device JPCT is initialized. A write in the register RGT 2  automatically triggers the comparator COMP 3 . After a clock cycle, the flip-flop FF 4  triggers the flip-flop FF 3 . If the two registers RGT 1  and RGT 2  do not save the same value, the flip-flop FF 3  causes the error signal ERR to go to 1. After the next clock cycle, the signal RST at output of the flip-flop FF 5  changes to 1, which triggers the initialization of the register RGT 1 . 
     Upon each write in the register RGT 1 , the counter CPT is triggered to count a few cycles of the clock signal CK. At the end of the counting, the counter initializes the register RGT 1  and triggers the flip-flop FF 2 . 
     If the jump is triggered by the execution of a jump instruction, the register RGT 1  has been previously loaded to a non-zero value. If the jump is not performed to an address provided in the program, the register RGT 2  remains on 0. The result is that the comparator COMP 3  is not triggered before the counter CPT reaches the value 0. When the counter CPT changes to 0, the flip-flop FF 2  is triggered. If the value of the register RGT 1  is non-zero, the output signal of the flip-flop FF 2  and therefore the error signal ERR change to 1. 
     Implementing the device JPCT involves providing sequences of instructions for loading registers RGT 1 , RGT 2  before and after a jump. 
     The following sequences of instructions, given as an example, are provided for each instruction which produces an unconditional jump (e.g., unconditional jump instruction, instruction for calling a subprogram or for returning from a subprogram): 
     
       
         
               
               
               
               
             
           
               
                   
                   
               
             
             
               
                   
                   
                 ...... 
                   
               
               
                   
                   
                 LD A,VAL1 
                 / Loading VAL1 
               
               
                   
                   
                 LD RGT1,A 
                 /  in the register RGT1 
               
               
                   
                   
                 JP LABEL1 
                 / Jump to the address LABEL1 
               
               
                   
                   
                 ...... 
               
               
                   
                 LABEL1 
                 LD A,VAL1 
                 / At the address LABEL1, 
               
               
                   
                   
                 LD RGT2,A 
                 /  loading VAL1 in 
               
               
                   
                   
                 ...... 
                 /  the register RGT2 
               
               
                   
                   
               
             
          
         
       
     
     In the sequences of instructions above, each instruction which produces an unconditional jump is preceded by instructions for loading a non-zero value VAL 1  in the register RGT 1 . At the address LABEL 1  reached by the jump (or at the beginning of the subprogram called, or after an instruction calling the subprogram), instructions for loading the same value VAL 1  in the register RGT 2  are provided. 
     If a program memory read address jump is detected by the circuit JDCT, the signal JDT is on 1. If the register RGT 1  is on 0, this means that the jump detected is not triggered by the execution of a jump instruction. The comparator COMP 2  then supplies a signal of 1 to the input of the flip-flop FF 1  which causes the error signal ERR to go to 1. 
     When the program loads the value VAL 1  in the register RGT 1 , this triggers the counter CPT and therefore stops the initialization of the register RGT 1 . If when the jump is executed, the program memory read address changes to the address of the jump LABEL 1 , the circuit JDCT detects the jump. The flip-flop FF 1  is then triggered, but does not cause the error signal to go to 1 since the register RGT 1  is not on 0. In parallel, the program at the address LABEL 1  loads the value VAL 1  in the register RGT 2 , which triggers the comparison by the comparator COMP 3  between the two registers RGT 1  and RGT 2 . After a cycle of the signal CK, the flip-flop FF 3  copies the output signal of the comparator COMP 3 . If the contents of the two registers RGT 1  and RGT 2  are identical, the address jump in the program memory is indeed triggered by the program and has been performed to the proper address LABEL 1 . The signal ERR thus remains on 0. If the jump is performed to another address, two cases can occur depending on whether or not the destination address provided for the jump is a destination address of a jump. 
     If the jump reaches an address that does not correspond to a destination address of a jump, the register RGT 2  is not write-accessed and the comparator COMP 3  is not triggered before the counter CPT reaches the end of the counting. At the end of the counting, the counter CPT reaches the value 0. The flip-flop FF 2  is then triggered. If the register RGT 1  is on a non-zero value (indicating the presence of a jump instruction), the signal at output of the flip-flop FF 2  and therefore the error signal ERR change to 1. The end of the counting also triggers the initialization of the register RGT 1 . 
     If the jump reaches a destination address of another jump provided in the program, the register RGT 2  is write-accessed, which triggers the comparison of the registers RGT 1  and RGT 2 . The erroneous jump will not be detected if the registers RGT 1  and RGT 2  are always loaded with the same value VAL 1 . On the other hand, if for each jump provided in the program, different values are loaded in the registers RGT 1  and RGT 2 , the comparison of the registers RGT 1  and RGT 2  performed by the comparator COMP 3  will show a difference if the jump is performed to an erroneous jump address. 
     The following sequences of instructions, given as an example, are provided for each conditional jump of the program. 
     
       
         
               
               
               
               
             
           
               
                   
                   
               
             
             
               
                   
                   
                 ...... 
                   
               
               
                   
                   
                 LD A,VAL1 
                 / Loading VAL1 
               
               
                   
                   
                 LD RGT1,A 
                 / in the register RGT1 
               
               
                   
                   
                 CP X,#$DD 
                 / comparison instruction 
               
               
                   
                   
                 JREQ LABEL1 
                 / conditional jump according 
               
               
                   
                   
                   
                 / to the result of the 
               
               
                   
                   
                   
                 / comparison 
               
               
                   
                   
                   
                 / to the address LABEL1 
               
               
                   
                   
                 CLR RGT1 
                 / erasing register RGT1 
               
               
                   
                   
                 ...... 
               
               
                   
                 LABEL 1 
                 LD A,VAL1 
                 / At the address LABEL1, 
               
               
                   
                   
                 LD RGT2,A 
                 / loading VAL1 in 
               
               
                   
                   
                 ...... 
                 / the register RGT2 
               
               
                   
                   
               
             
          
         
       
     
     Each instruction which produces a conditional jump is preceded by instructions for loading a non-zero value VAL 1  in the register RGT 1 . The instruction following the conditional jump is followed by an instruction for setting the register RGT 1  to 0 (executed in the event that the jump condition is not met). At the address reached by the conditional jump LABEL 1 , instructions for loading the same value VAL 1  in the register RGT 2  are provided. 
     If the jump is not performed, the register RGT 1  is initialized. As a result, when the counter CPT arrives at the end of counting, the comparator COMP 2  detects that the register RGT 1  is on 0 and does not trigger the rise of the signal ERR to 1. 
     This solution is not totally reliable, because if the jump address is distorted and corresponds to the current address (of the jump instruction) incremented by 1, the register RGT 1  is erased, and the jump error will not be detected. To avoid this disadvantage, it is sufficient to duplicate the sequences of test and conditional jump instructions with an instruction for setting the register RGT 1  to 0 between the two sequences. 
     It shall be noted that, in some embodiments, the loading of a value different from 0 in the register RGT 1 , when the latter is not on 0, is not authorized. Indeed, in some such embodiments, it may be necessary to wait for the counter CPT to end its counting so as not to risk masking erroneous jumps. The counting time of the counter CPT is therefore preferably chosen as short as possible so as to avoid having to insert waiting instructions between two close jump instructions. Therefore, the duration of the counter CPT can be chosen equal to the maximum duration of the execution of a jump (e.g., jump instruction, instruction for calling a subprogram or for returning from a subprogram) to which the register RGT 2  loading time (1 cycle of the signal CK) and the state change time of the two flip-flops FF 4  and FF 5  (two cycles of the signal CK) have been added. 
     The counting time of the counter CPT should also be chosen as short as possible to be capable of detecting erroneous jumps which would be performed a few instructions before the destination address of a jump instruction. 
     Outside the periods in which the counter CPT is active (counting), the counter is on 0 and the output thereof is on 1. The register RGT 1  is therefore initialized at each cycle of the signal CK. This therefore avoids its content being durably modified by a glitch. 
     Further to the error signal ERR changing to the active state, any appropriate action can be taken, such as the erasing of sensitive data in one of the memories MEM 1 . If the signal ERR is applied to the central processing unit UC, the re-initialization of the central processing unit, or even completely taking the integrated circuit IC 1  out of service can be provided. Any other emergency measure well known to those skilled in the art can be taken when the error signal ERR changes to the active state. 
     It shall be noted that if the instructions for loading the register RGT 2  are executed in the absence of a jump (register RGT 1  on 0), a jump error is generated (signal ERR on 1) due to the fact that the write in the register. RGT 2  triggers the comparison of the content of the two registers by the comparator COMP 3  and the flip-flop FF 3 . To avoid this disadvantage, it is sufficient to previously load the value of the register RGT 2  in the register RGT 1  or to provide a jump instruction so as not to execute these instructions. 
     For the sake of simplicity, various signals that can easily be provided by those skilled in the art have not been described above. For example, although the signals enabling the registers and the flip-flops of the device JPCT to be initialized have not been described, it goes without saying that such initialization signals may be provided. 
     If the execution of the program executed by the central processing unit UC can be interrupted by an interrupt signal triggering the execution of an interrupt handler, the central processing unit should not take into account the error signal ERR at least when launching and at the end of the execution of an interrupt handler. Indeed, the launch of the execution of an interrupt handler causes an address jump which can appear at any time during the execution of the program. It is not therefore possible to load the registers RGT 1  and RGT 2  before and after the jumps resulting from the execution of an interrupt handler. 
     Alternatively, means can be provided for inhibiting the device JPCT so that it does not generate any error. The device JPCT can be inhibited by masking the error signal ERR at output of the device JPCT, for example using an AND-type logic gate receiving the error signal and an inhibiting signal. The device can also be inhibited by forcing the signal INS to 0 at least when launching and at the end of the execution of the interrupt handler. Therefore, the device JPCT or the circuit JDCT can be inhibited further to the jump to the interrupt handler, during only two program memory read cycles used to load the register RGAD 2  with the first address of the interrupt handler. For the same reason, the device JPCT or the circuit JDCT should also be inhibited during two program memory read cycles after the end of the execution of the interrupt handler. 
     It will be understood by those skilled in the art that various alternative embodiments and applications of the present disclosure may be made. In particular, the present disclosure is not limited to a device for detecting jump errors which checks whether each jump performed during the execution of a jump instruction by the integrated circuit is performed to the address specified in the operand associated with the jump instruction. Indeed, an embodiment of the present disclosure may be limited to checking that each jump detected results from the execution of a jump instruction. In some such embodiments, only the jump detector circuit JDCT, the register RGT 1 , the comparator COMP 2  and the flip-flop FF 1  are used. Providing these components merely enables the detection of jump errors to be made more systematic. 
     Furthermore, it is not necessary to provide registers of several bits to store the fact that a jump instruction will be executed or that the destination address of the jump has been accessed. Indeed, these two events can be simply stored by raising a flag, i.e., by changing the state of a flip-flop. Providing registers of several bits making it possible to store different values enables the detection of jump errors to be refined. Indeed, by establishing a link between the jump instruction and its jump destination address, it is possible to check that a jump is not performed to a destination address of another jump. 
     It will be understood that the present disclosure is applicable to any processor (e.g., microprocessor or microcontroller) and not solely to integrated circuits of smart cards. 
     The various embodiments described above can be combined to provide further embodiments. These and other changes can be made to the embodiments in light of the above-detailed description. In general, in the following claims, the terms used should not be construed to limit the claims to the specific embodiments disclosed in the specification and the claims, but should be construed to include all possible embodiments along with the full scope of equivalents to which such claims are entitled. Accordingly, the claims are not limited by the disclosure.