Patent Publication Number: US-11651064-B2

Title: Processor authentication method

Description:
BACKGROUND 
     Technical Field 
     The present disclosure generally concerns electronic devices and, more particularly, processors. 
     Description of the Related Art 
     A processor, comprised within most current electronic devices, is a processing unit which executes opcodes. 
     Processors are frequently subject to attempts of cloning and of emulation of the opcodes that they have to execute. 
     It would be desirable to at least partly improve certain aspects of known processor implementation methods and, more particularly, to at least partly improve authentication methods executed by a processor. 
     BRIEF SUMMARY 
     An embodiment overcomes all or part of the disadvantages of known processor forming methods. 
     An embodiment overcomes all or part of the disadvantages of known authentication methods implemented by a processor. 
     An embodiment provides a method of authenticating a processor, comprising an arithmetic and logic unit, comprising the steps of: receiving, on a first terminal of the arithmetic and logic unit, at least one decoded operand of at least a portion of an opcode to be executed; and receiving, on a second terminal of the arithmetic and logic unit, a first instruction combining a second decoded instruction of the opcode to be executed and at least one previously-executed opcode. 
     According to an embodiment, said at least one portion of the opcode to be executed represents the entire opcode to be executed. 
     According to an embodiment, said first instruction is delivered by an output of a combination circuit. 
     According to an embodiment, the combination circuit receives as an input said second instruction of the opcode to be executed and data taking into account said at least one previously-executed opcode. 
     According to an embodiment, said at least one previously-executed opcode is stored in a context register bank. 
     According to an embodiment, the method comprises the processing, by the arithmetic and logic unit, of said first instruction and of the at least one operand. 
     According to an embodiment, said first instruction combines said second decoded instruction of the opcode to be executed, said at least one previously-executed opcode and at least one previous result of said arithmetic and logic unit. 
     An embodiment provides a processor wherein an arithmetic and logic unit comprises: a first terminal capable of receiving at least one decoded operand of at least a portion of an opcode to be executed; and a second terminal capable of receiving a first instruction combining a second decoded instruction of an opcode to be executed and at least one previously-executed opcode. 
     According to an embodiment, the processor comprises a combination circuit capable of delivering said first instruction to the second terminal of the arithmetic and logic unit. 
     According to an embodiment, the combination circuit is capable of receiving, as an input, said second instruction of the opcode to be executed and data taking into account said at least one previously-executed opcode. 
     According to an embodiment, the processor comprises a context register bank capable of storing said at least one previously-executed opcode. 
     According to an embodiment, the arithmetic and logic unit is capable of processing said first instruction received on its first terminal and said at least one operand received on its second terminal. 
     According to an embodiment, said first instruction combines said second decoded instruction of the opcode to be executed, said at least one previously-executed opcode, and at least one previous result of said arithmetic and logic unit. 
     According to an embodiment, the processor comprises a decoding circuit capable of decoding the opcode into at least one operand and into said second instruction. 
     According to an embodiment, the processor comprises a multiplexer capable of receiving said at least one operand and of delivering it to the first terminal of the arithmetic and logic unit. 
     An embodiment provides an instruction implemented by the previously described processor comprising an arithmetic and logic unit taking into account at least a portion of an opcode previously executed by said arithmetic and logic unit. 
     The foregoing and other features and advantages will be discussed in detail in the following non-limiting description of specific embodiments in connection with the accompanying drawings. 
    
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
         FIG.  1    shows a flowchart illustrating an embodiment of a processor; 
         FIG.  2    shows a flowchart (a) illustrating an implementation mode of an authentication method executed by a processor, and a block diagram (b) illustrating the architecture of a processor; 
         FIG.  3    shows a flowchart (a) illustrating an implementation mode of an authentication method executed by a processor, and a block diagram (b) illustrating the architecture of a processor; and 
         FIG.  4    shows a flowchart (a) illustrating an embodiment of an authentication method executed by a processor, and a block diagram (b) illustrating the architecture of a processor. 
     
    
    
     DETAILED DESCRIPTION 
     The same elements have been designated with the same reference numerals in the different drawings. In particular, the structural and/or functional elements common to the different embodiments may be designated with the same reference numerals and may have identical structural, dimensional, and material properties. 
     For clarity, only those steps and elements which are useful to the understanding of the described embodiments have been shown and are detailed. In particular, all the elements forming the architecture of a processor will not be described, only the elements relative to the described embodiments will be detailed, such elements adapting the usual processor architectures. 
     Throughout the present disclosure, the term “connected” is used to designate a direct electrical connection between circuit elements with no intermediate elements other than conductors, whereas the term “coupled” is used to designate an electrical connection between circuit elements that may be direct, or may be via one or more other elements. 
     In the following description, when reference is made to terms qualifying absolute positions, such as terms “front”, “back”, “top”, “bottom”, “left”, “right”, etc., or relative positions, such as terms “above”, “under”, “upper”, “lower”, etc., or to terms qualifying directions, such as terms “horizontal”, “vertical”, etc., unless otherwise specified, it is referred to the orientation of the drawings. 
     The terms “about”, “approximately”, “substantially”, and “in the order of” are used herein to designate a tolerance of plus or minus 10%, preferably of plus or minus 5%, of the value in question. 
     The following notations are used:
         opcode: an operation to be executed by a processor and comprising an instruction and one or a plurality of operands;   operand of an opcode: a numerical, logic, alphanumerical, etc., value contained by the opcode;   instruction of an opcode: an effective mathematical or logic operation which is applied to one or a plurality of operands of the opcode; and command: a set or a succession of opcodes.       

       FIG.  1    is a flowchart illustrating a method of processing, by a processor, of an opcode to be executed. The processing method is a processing method used by a processor. As an example, the processor is a processor of RISC (“Reduced Instruction Set Computing”) type. 
     At a step  10  (IF, “Instruction Fetch”), an opcode is delivered, for example, by a bus, to the processor. As an example, the opcode is uploaded from a memory. 
     At a step  12  (ID, “Instruction Decode”), the opcode is decoded by a decoding unit of the processor. More particularly, the opcode is converted into an instruction and one or a plurality of operands. 
     At a step  14  (EX, “Execution”), the decoded opcode, that is, the instruction and the operand(s), is delivered to an arithmetic and logic unit comprised within the processor. The arithmetic and logic unit is in charge of implementing the opcode, by performed calculations on the operands of the opcode in accordance with the instruction of the opcode to be executed. 
     At a step  16  (MEM, “Memory Access”), the arithmetic and logic unit requires access to a register of a register bank or stack, to store therein the result of the calculations of the executed opcode. At this step, the processor may, further, access an external memory to, for example, read therefrom and/or write into it one or a plurality of data. 
     At a step  18  (WB, “Write Back”), the arithmetic and logic unit provides the result of its calculations to the register bank to store it into a register. 
       FIG.  2    illustrates an embodiment of a method  100  of authentication of a processor  1000 .  FIG.  2    comprises a flowchart (a) illustrating the steps of authentication method  100 , and a diagram (b), in the form of blocks, illustrating a simplified architecture of processor  1000 . 
     Authentication method  100  comprises:
         a step  110  of uploading, by processor  1000 , of an opcode to be executed;   a step  120  of decoding of the opcode to be executed; and   a step  130  of processing of the opcode to be executed.       

     Step  110  is similar to step  10  described in relation with  FIG.  1   . An opcode OPCODE is received and uploaded by processor  1000 . 
     Step  120  is similar to step  12  described in relation with  FIG.  1   . Opcode OPCODE is decoded, by a decoding unit  1010  (DEC), into one or a plurality of operands OP 1 , . . . , OPN, and into an instruction INSTR. 
     Step  130  comprises steps similar to steps  14 ,  16 , and  18  described in relation with  FIG.  1    and further comprises the use of one or a plurality of opcodes previously executed by processor  1000 . The detail of step  130  will be described hereafter in relation with the description of the architecture of processor  1000 . 
     Device  1000  comprises:
         decoding unit  1010 ;   a multiplexer  1020  (MUX);   a register bank  1030  (REGLIST);   a context register bank  1040  (CONTEXT);   a combination circuit  1050  (COMB); and   an arithmetic and logic unit  1060  (ALU).       

     A previously indicated, decoding unit  1010  operates to decode the opcode OPCODE into a plurality of operands OP 1 , . . . , OPN, and into an instruction INSTR. Thus, decoding unit  1010  receives as an input the opcode OPCODE uploaded at step  110  and outputs operands OP 1 , . . . , OPN, and instruction INSTR (step  120 ). In some embodiments, decoding unit  1010  supplies operands OP 1 , . . . , OPN to inputs of multiplexer  1020 , and instruction INSTR to an input of combination circuit  1050 . 
     Multiplexer  1020  operates to select and to direct the operands OP 1 , . . . , OPN for the processing of opcode OPCODE towards arithmetic and logic unit  1060 , which may be received by a first input terminal of arithmetic and logic unit  1060 . In some embodiments, multiplexer  1020  directs all or part of the operands towards combination circuit  1050 . Multiplexer  1020  receives as inputs operands OP 1 , . . . , OPN and for example an output of register bank  1030 . Multiplexer  1020  transmits at its output operands OP 1 , . . . , OPN to arithmetic and logic unit  1060  and to an input of combination circuit  1050 . In some embodiments, multiplexer  1020  also outputs all or part of operands OP 1 , . . . , OPN of opcode OPCODE to register bank  1030 . 
     Register bank  1030  operates to temporarily store, into registers, data, for example, operands OP 1 , . . . , OPN of opcode OPCODE, and results R of arithmetic and logic unit  1060 , etc. Register bank  1030  may further operate to provide other operands, for example, directly or via multiplexer  1020 , to arithmetic and logic unit  1060 . Register bank  1030  receives as an input an output of arithmetic and logic unit  1060  and for example the output of multiplexer  1020 . Register bank  1030  delivers at its output data to arithmetic and logic unit  1060  and, for example, to multiplexer  1020 . 
     Context register bank  1040  is a register bank storing, in registers, the opcodes previously executed by processor  1000 . For example, the previously-executed opcode is decoded by the decoding unit  1010  before the opcode OPCODE. As an example, context register bank  1040  may store all or part of the previously-executed opcodes in a stack, or in a circular buffer, and/or it may apply thereto, for storage, a mathematical function, for example, a permutation. As an example, context register bank  1040  may take into account the opcode to be executed or being executed. Context register bank  1040  receives as an input opcode OPCODE in order to store it. Context register bank  1040  delivers as an output data to combination circuit  1050 . The output data of context register bank  1040  may be all or a part of the previously-executed opcode and may be referred to as a “signature data” for descriptive purposes. 
     Combination circuit  1050  operates to combine the decoded instruction INSTR of opcode OPCODE with the data of the output of context register bank  1040 . In some embodiments, combination circuit  1050  operates to deliver to arithmetic and logic unit  1060  a new instruction comprising a data signature depending on the opcodes previously executed by processor  1000 . Combination circuit  1050  may for example be controlled by one or more of the decoded operands of opcode OPCODE, e.g., selected and delivered by multiplexer  1020 . For example, the one or more of the decoded operands may select the signature data to be combined with the instruction INSTR. This new instruction will be called in the rest of the description as a signed instruction INSTR-SIG. Thus, combination circuit  1050  receives, as an input, instruction INSTR and the output of context register bank  1040 . Combination circuit  1050  delivers, as an output, signed instruction INSTR-SIG to arithmetic and logic unit  1060 , which may be received at a second input terminal of arithmetic and logic unit  1060  that is different from the first input terminal. According to an alternative embodiment, combination circuit  1050  may only combine certain decoded instructions INSTR with the data of the output of context register bank  1040 , and transmit the other decoded instructions INSTR, without signing them, directly to arithmetic and logic unit  1060 . 
     Arithmetic and logic unit  1060  operates to implement the processing and the calculations of opcode OPCODE. In some embodiments, arithmetic and logic unit  1060  applies signed instruction INSTR-SIG to the operands delivered by multiplexer  1020 . In some embodiments, arithmetic and logic unit  1060  may also take into account data supplied by register bank  1030 . Arithmetic and logic unit  1060  receives as an input signed instruction INSTR-SIG from combination circuit  1050 , the output of multiplexer  1040 , and the output of register bank  1030 . Arithmetic and logic unit  1060  delivers, as an output, a result signal R to the input of register bank  1030 . 
     Step  130  is carried out as follows. Combination circuit  1050  combines instruction INSTR with data received from context register bank  1040  to supply arithmetic and logic unit  1060  with signed instruction INSTR-SIG. Arithmetic and logic unit  1060  performs the calculations relative to, e.g., using, signed instruction INSTR-SIG and the operands supplied by multiplexer  1020 . The arithmetic and logic unit  1060  then requires access to register bank  1030  to store result signal R therein. 
     An advantage of this embodiment is that, for an identical opcode OPCODE, an arithmetic and logic unit of a usual processor will generate result signals different from those generated by the arithmetic and logic unit  1060  of processor  1000  of the embodiments because a usual processor does not access the signed instruction INSTR-SIG. Result signal R might for example be used as a control signal used as means for authenticating a device during its use. 
     An example of application of this embodiment is the following. A processor generally receives one or a plurality of commands each comprising a plurality of opcodes. To use the method of this embodiment, it is sufficient for a single instruction relative to one of the opcodes to be signed by combination circuit  1050 . As an example, a command may comprise a single signed instruction configured to authenticate the device. According to some embodiments, all the instructions linked to a same command may be signed by combination circuit  1050 . 
     An illustrative example of application may be the following. A printer comprising a processor of the type of processor  1000  and an ink cartridge capable of communicating data to the printer are considered. The data are, for example, filling levels or ink cartridge authentication data. The installation of the cartridge in the printer may be followed by a series of commands sent by the cartridge to the printer. If the cartridge is intended to be installed in the considered printer, the designer of the cartridge will have prepared the opcodes of the series of commands so that they are adapted to the architecture of the printer processor. In other words, in this case, the opcodes will be capable of taking into account the data of context register bank  1040 . However, if the opcodes of the series of commands are not adapted to the architecture of processor  1000 , the results R delivered by arithmetic and logic unit  1060  will not be those expected by the other printer circuits, which may for example switch to the default mode. It should be noted that it is sufficient for a single instruction in the series of commands to be signed to, for example, actuate a default mode of the other printer circuits. It may also be configured to sign all the instructions of the series of commands. 
       FIG.  3    illustrates an embodiment of a method  200  of authenticating a processor  2000 .  FIG.  3    comprises a flowchart (a) illustrating the steps of the authentication method and a diagram (b), in the form of blocks, illustrating a simplified architecture of processor  2000 . Parts of method  200  and processor  2000  are similar to the method  100  and to the processor  1000  described in relation with  FIG.  2   , the differences between them being described hereafter. 
     Authentication method  200  comprises:
         a step  210  of uploading an opcode to be executed;   a step  220  of decoding the opcode to be executed; and   a step  230  of processing the opcode to be executed.       

     Step  210  is similar to step  110  described in relation with  FIG.  2   . An opcode OPCODE is received and uploaded by processor  2000 . 
     Step  220  is similar to step  120  described in relation with  FIG.  2   . Opcode OPCODE is decoded, by decoding unit  1010  (DEC) of processor  2000 , into one or a plurality of operands OP 1 , . . . , OPN, and into an instruction INSTR. 
     Step  230  differs from step  130  described in relation to  FIG.  2    in that the use of previously-executed opcodes is replaced with the use of one or more of a plurality of previous results of the arithmetic and logic unit  2060  of processor  2000 . The detail of step  230  will be described hereafter in relation with the description of the architecture of processor  2000 . 
     Processor  2000  comprises elements in common with processor  1000 , which elements will not be described again. Thus, processor  2000  comprises:
         decoding unit  1010 ;   multiplexer  1020  (MUX);   register bank  1030  (REGLIST);   a result register bank  2040  (RESULT);   a combination circuit  2050  (COMB); and   arithmetic and logic unit  2060  (ALU).       

     Result register bank  2040  is a register bank storing the previous results of arithmetic and logic unit  2060 . As an example, result register bank  2040  may store the previous results in a stack, and/or it may apply thereto, for storage, a mathematical function, for example, a permutation. Result register bank  2040  receives as an input result R of arithmetic and logic unit  2060  in order to store it. Result register bank  2040  delivers, at its output, data to combination circuit  2050 , the data thus depending on the previous results of arithmetic and logic unit  2060 . Result register bank  2040  is for example a register capable of operating as a shift register where the last stored information is the first information to be suppressed, or as a linear feedback shift register. In some embodiments, a result R of arithmetic and logic unit  2060  is a result of the arithmetic and logic unit  2060  with respect to a previously-executed opcode. That is, the result R corresponds to a previously-executed opcode. 
     Combination circuit  2050  differs from the combination circuit  1050  described in relation with  FIG.  2    in that combination circuit  2050  receives the output of result register bank  2040 . Combination circuit  2050  combines the decoded instruction INSTR of opcode OPCODE with the data of the output of result register bank  2040 . In some embodiments, combination circuit  2050  delivers an instruction INSTR-SIG signed by the previous results of arithmetic and logic unit  2060 . Thus, the combination circuit receives, as an input, instruction INSTR and the output of result register bank  2040 . Combination circuit  2050  delivers at its output the new instruction INSTR-SIG to arithmetic and logic unit  2060 . According to an embodiment, combination circuit  2050  may only combine certain decoded instructions INSTR with the data of the output of result register bank  2040  and transmit the other instructions INSTR, without signing them, directly to arithmetic and logic unit  2060 . 
     Arithmetic and logic unit  2060  differs from the arithmetic and logic unit  1060  described in relation with  FIG.  2    in that it delivers, at its output, output signal R to register bank  1030  and to result register bank  2040 . 
     Step  230  is thus carried out differently from the step  130  described in relation with  FIG.  1   , in that the instructions which are signed are signed with data taking into account the previous results of arithmetic and logic unit  2060 . 
     This embodiment has the similar advantages as the embodiment described in relation with  FIG.  2   . 
       FIG.  4    illustrates an embodiment of a method  300  of authentication of a processor  3000 .  FIG.  4    comprises a flowchart (a) illustrating the steps of the authentication method and a diagram (b), in the form of blocks, illustrating a simplified architecture of processor  3000 . 
     The embodiments described hereafter are a combination of the embodiments described in relation with  FIGS.  2  and  3   . 
     Authentication method  300  comprises:
         a step  310  of uploading an opcode to be executed;   a step  320  of decoding the opcode to be executed; and   a step  330  of processing the opcode to be executed.       

     Step  310  is similar to step  110 ,  210  described in relation with  FIGS.  2  and  3   . An opcode OPCODE is received and uploaded by processor  3000 . 
     Step  320  is similar to step  120 ,  220  described in relation with  FIGS.  2  and  3   . Opcode OPCODE is decoded, by decoding unit  1010 , into one or a plurality of operands OP 1 , . . . , OPN, and into an instruction INSTR. 
     Step  330  is a combination of steps  130  and  230  described in relation with  FIGS.  2  and  3   . For example, step  330  comprises the use of a plurality of previous results of arithmetic and logic unit  3060  of processor  3000 , and the use of one of a plurality of opcodes previously executed by processor  3000 . The detail of step  330  will be described hereafter in relation with the description of the architecture of processor  3000 . 
     Processor  3000  comprises elements in common with processors  1000  and  2000 , which elements will not be described again. Thus, processor  3000  comprises:
         decoding unit  1010  (DEC);   multiplexer  1020  (MUX);   register bank  1030  (REGLIST);   a context and result register bank  3040  (CONTEXT RESULT);   a combination circuit  3050  (COMB); and   an arithmetic and logic unit  3060  (ALU).       

     Context and result register bank  3040  is a combination of the context register bank  1040  described in relation with  FIG.  2    and the result register bank  2040  described in relation with  FIG.  3   . More particularly, context and result register bank  3040  is configured to store opcodes previously executed by processor  3000  and previous results of arithmetic and logic unit  3060 . As an example, context and result register bank  3040  may store the data in a stack, and/or it may apply thereto, for storage, a mathematical function, for example, a permutation. Context and result register bank  3040  receives, as an input, result R of arithmetic and logic unit  3060  and opcode OPCODE in order to store them. In some embodiments, the result R in the context and result register bank  3040  is a calculated result of a previously-executed opcode stored in the context and result register bank  3040 . The context and result register bank  3040  corresponds the previously-executed opcode and result R in generating the signature data output. In some embodiments, the context and result register bank  3040  does not correspond the stored previously-executed opcode and result R in generating the signature data output. For example, the signature data output may include a previously-executed opcode and a result R that is not related to the previously-executed opcode. Context and result register bank  3040  delivers, as an output, data to combination circuit  3050 . 
     Combination circuit  3050  is similar to the combination circuits  1050  and  2050  described in relation with  FIGS.  1  and  2   . Combination circuit  3050  combines the decoded instruction INSTR of opcode OPCODE with the data of the output of context and result register bank  3040 . In some embodiments, combination circuit  3050  delivers an instruction INSTR-SIG signed by the opcodes previously executed by processor  3000  and by the previous results of arithmetic and logic unit  3060 . Thus, the combination circuit receives, as an input, instruction INSTR and the output of context and result register bank  3040 . Combination circuit  3050  delivers at its output the new instruction INSTR-SIG to arithmetic and logic unit  3060 . According to an embodiment, combination circuit  3050  may only combine certain decoded instructions INSTR with the data of the output of context and result register bank  3040  and transmit the other decoded instructions INSTR, without signing them, directly to arithmetic and logic unit  3060 . 
     Arithmetic and logic unit  3060  is similar to the arithmetic and logic unit  2060  described in relation with  FIG.  3   . For example, arithmetic and logic unit  3060  delivers output signal R to register bank  1030  and to context and result register bank  3040 . 
     Step  330  thus operates differently from steps  130  and  230  described in relation with  FIGS.  2  and  3   , in that the instructions which are signed are signed with data taking into account the opcodes previously executed by processor  3000  and taking into account the previous results of arithmetic and logic unit  3060 . 
     This embodiment has the similar advantage as the embodiments described in relation with  FIGS.  2  and  3   . 
     Various embodiments and variations have been described. It will be understood by those skilled in the art that certain features of these various embodiments and variations may be combined, and other variations will occur to those skilled in the art. 
     Finally, the practical implementation of the described embodiments and variations is within the abilities of those skilled in the art based on the functional indications given hereabove. 
     Such alterations, modifications, and improvements are intended to be part of this disclosure, and are intended to be within the spirit and the scope of the present disclosure. Accordingly, the foregoing description is by way of example only and is not intended to be limiting. The present disclosure is limited only as defined in the following claims and the equivalents thereto. 
     The various embodiments described above can be combined to provide embodiments. These and other changes can be made to the embodiments in light of the above-detailed description. In general, in the following claims, the terms used should not be construed to limit the claims to the specific embodiments disclosed in the specification and the claims, but should be construed to include all possible embodiments along with the full scope of equivalents to which such claims are entitled. Accordingly, the claims are not limited by the disclosure.