Abstract:
The invention relates to a method for protecting user data of a read/write storage device of an electronic computing system in a motor vehicle. Using test data relating to the run time of the electronic computing system, at least one protection region for protecting a storage region of the read/write storage device is established or removed or is specified in such a manner that the extent and/or position of the protection region with respect to a total storage region comprised by the read/write storage device is changed. The invention further relates to a corresponding electronic computing system.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    This U.S. patent application claims the benefit of PCT patent application No., PCT/EP2015/069662 filed Aug. 27, 2015, which claims the benefit of German patent application No., 10 2014 217 329.9 filed Aug. 29, 2014 all of which are hereby incorporated by reference. 
     
    
     TECHNICAL FIELD 
       [0002]    The present invention relates to a method for protecting user data in a memory and to an electronic data processing system. 
       BACKGROUND 
       [0003]    In order to comply with requirements for safety-related electronic systems in motor vehicles (e.g. ISO 26262), for safety-related control units in motor vehicles it is necessary that microprocessors and their interface modules and also externally connected functional modules such as e.g. bus drivers, memories, A/D converters etc. either have a safe structural design, i.e. exist redundantly, (=spatial), or are repeatedly checked at runtime (=temporal). The problem here in particular is the protection of memory chips such as e.g. DRAMs. Spatial redundancy is in this case a key cost driver, because full redundancy doubles the chip area, which is uneconomic especially for large datasets. Temporal checking can require extensive time resources for modern vehicle systems, with the FTTI, the time that can be tolerated between the occurrence and detection of a fault, being too long for safety-related data processing systems. A compromise is often used for DRAMs. Instead of holding memory elements redundantly available, ECC/EDC units (error correcting code and error detecting code units) are used to save in standard memory elements in addition to the user data also check data (ECC/CRC), which is automatically generated at the time of saving, and automatically compared at the time of reading. This check data is generated for a defined memory area, which means that there is no need to hold available the entire memory area several times over, and check data only needs to be added to safety-critical areas. This check data encompasses about 25 to 100% of the memory to be protected, depending on the size of the user datum to be written, or encompasses about 12.5 to 20% if the corresponding address data is taken into account in addition to the user data. DE 195 29 434 B4, for instance, describes such a system. 
         [0004]    The address information inside this protected memory area is given less weight in favor of a higher error correction performance for the user data. This is achieved by weighting the respective address bits differently in the check-data calculation, with the higher address bits typically being included with less weight. The error detection and correction capability of the check codes with regard to the user data is thus inversely proportional to the size of the protected memory areas. The error detection and/or error correction capability thus decreases as the memory areas to be protected increase. This weighting is implemented by hardware (hard-wired) and sets the basis for the mathematical calculation of the check codes. For modern applications in motor vehicles, the defined memory area may be designed too small, for example, if using known systems only 8 Mbytes would be usable in protected form even though 256 Mbytes are needed. Thus saving program data and/or user data either does not achieve a required safety level or the protected memory area for this is very limited. 
         [0005]    The background description provided herein is for the purpose of generally presenting the context of the disclosure. Work of the presently named inventors, to the extent it is described in this background section, as well as aspects of the description that may not otherwise qualify as prior art at the time of filing, are neither expressly nor impliedly admitted as prior art against the present disclosure. 
       SUMMARY 
       [0006]    The system provides means for protecting data in a memory, which allow an improved ratio of the error detection and/or error correction capability to a memory requirement for check data that must be provided for said capability, and thereby can be implemented as cheaply as possible. 
         [0007]    A method for protecting user data in a read/write memory of an electronic data processing system in a motor vehicle, comprises at runtime of the electronic data processing system at least one protection area for protecting the user data in the memory area of the read/write memory by means of check data is specified or removed or defined in such a way that the extent and/or position of said protection area with respect to a total memory area encompassed by the read/write memory is changed. 
         [0008]    It is thus possible during the running operation of an underlying electronic data processing system or during the execution of a program, to select memory areas to be protected, thereby considerably improving the configurability. “Running operation” of the electronic data processing system shall be understood to mean here in particular an active state in which this system executes processing operations. Hence allowing an improved ratio of the error detection and/or error correction capability to a memory requirement to be provided for said capability, and thereby can be implemented more cheaply than, for example, redundant memory solutions. Also the check data can additionally be protected. 
         [0009]    Using check data to protect the memory area(s) is preferably performed using hardware-implemented and/or software-implemented error detection techniques and/or error correction techniques such as e.g. ECC or EDC, which can be used to check and/or correct the user data present in the read/write memory. In this case, the check data is generated in particular during writing to the read/write memory, whereas a check and, if applicable, correction, takes place during readout of the user data. An extremely wide variety of embodiments of data storage devices for electronic systems can be used as the read/write memory, for instance devices such as semiconductor memories or magnetic storage devices. 
         [0010]    According to one embodiment, an assignment is provided between a program module being executed by the electronic data processing system and/or memory area of a program code and the memory area to be protected defined by the protection area. In particular, the memory area of the program code is defined by the underlying virtual or physical memory. Which program module is being executed at a particular time is in this case preferably determined by means of the memory addresses of the underlying memory area of a program code. 
         [0011]    According to another embodiment, when a plurality of protection areas exist in the memory area of the read/write memory, these protection areas can be configured independently of one another. This achieves an increase in the focusing in particular solely on safety-critical data, and improves the configurability of the data protection. 
         [0012]    As a result of changing a protection area from a first memory area to a second memory area of the read-write memory, or removing a first protection area of a first memory area and generating a new protection area for a second memory area, preferably no memory access can be made to the first memory area. This is advantageous particularly for partitioning the safety-related and/or security-related data and for preventing software modules involved in each case from being able to access a memory area to which these modules are not assigned and/or which they are not allowed to access for other reasons such as e.g. a lower safety level. 
         [0013]    An electronic data processing system for a motor vehicle comprises at least one central processing unit, a read/write memory and a memory protection unit for protecting user data in at least one memory area of the read/write memory by means of check data, wherein the memory protection unit is designed to specify, remove or define at runtime of the electronic data processing system at least one protection area for protecting a memory area of the read/write memory in such a way that the extent and/or position of said protection area with respect to a total memory area encompassed by the read/write memory is changed. 
         [0014]    An assignment means is preferably provided for the assignment between a program module being executed by the electronic data processing system and/or memory area of a program code and the memory area to be protected defined by the protection area. 
         [0015]    Preferably, the system is used in, or in conjunction with, one or more digital signal processors, FPGAs (field programmable gate arrays), or RISC/CISC-CPUs, in particular devices with a fast clock speed. 
         [0016]    Other objects, features and characteristics of the present invention, as well as the methods of operation and the functions of the related elements of the structure, the combination of parts and economics of manufacture will become more apparent upon consideration of the following detailed description and appended claims with reference to the accompanying drawings, all of which form a part of this specification. It should be understood that the detailed description and specific examples, while indicating the preferred embodiment of the disclosure, are intended for purposes of illustration only and are not intended to limit the scope of the disclosure. 
     
    
     
       DETAILED DESCRIPTION OF THE DRAWINGS 
         [0017]    The present disclosure will become more fully understood from the detailed description and the accompanying drawings, wherein: 
           [0018]      FIG. 1  shows in a schematic diagram an electronic data processing system for the purpose of explaining the protection according to the invention of data in a memory. 
       
    
    
     DETAILED DESCRIPTION 
       [0019]      FIG. 1  shows a schematic diagram of an electronic data processing system  4 , e.g. a microprocessor system, for the purpose of explaining the invention. According to this exemplary embodiment, memory  3  is assigned to the central processing unit (CPU)  1 , with memory protection unit  2  using check data PD to protect user data ND in memory  3 . Memory  3 , for example, is a direct random access semiconductor memory, e.g. a RAM. Error detection and/or error correction techniques known per se such as ECC, for example, can be used to generate the check data PD. This check data PD is generated by memory protection unit  2  at the time of saving user data ND in memory  3 , and at the time of reading is compared in a manner known per se with check data recalculated from the read user data ND. To provide greater clarification, the lower part of  FIG. 1  shows an example allocation of check data PD and user data ND in RAM  3 , where a cell  3 . 1  is in particular an individual memory cell or, depending on the granularity of memory  3 , a smallest possible readable or writable unit, e.g. a word. 
         [0020]    According to an exemplary embodiment, memory protection unit  2  specifies the protection areas F 1  and F 2  inside the total memory area of memory  3  that are meant to be protected, or are protected, by means of check data PD. In this example, two protected memory areas F 1 , F 2  are defined, although it is also possible to have more than two or only a single memory area at the same time or even no protected memory area. At runtime of data processing system  4 , memory areas that are meant to be protected by user data ND can be specified multiple times independently of one another by memory protection unit  2  or can be reclassified by said unit as not to be protected. In addition, the size of each existing protected memory area or protection area F 1 , F 2  can be defined, and changed during running operation of the data processing system  4 . 
         [0021]    The memory areas to be protected and/or the size thereof are preferably specified by the assignment of a program module being executed at the current time by the data processing system  4  in such a way that the program module being executed at the current time defines the memory area to be protected, or a memory area to be protected is assigned to this module. Which program module is being executed at the current time can be determined here, for example, by means of the memory addresses of the underlying memory area of a program code. The assignment or allocation of a program module or its program memory area to a memory area to be protected can be performed by the memory protection unit  2  using an allocation table, for example. This allocation table can be created, managed and statically stored by the relevant part of the operating system software in order to be available to the memory protection unit  2  (hardware) at all times regardless of the current status of the actual program execution. This implementation would allow the memory protection unit  2  to configure the protection areas itself. 
         [0022]    According to an alternative embodiment, memory protection unit  2  is only ever configured for one area to be protected, this being done by software implementing the relevant configuration when a program area requiring protection in terms of data and/or instructions is jumped to or activated at system runtime. According to this implementation, the corresponding allocation table is managed by software, and is not necessarily made available to memory protection unit  2 , but prior to program execution is checked by the software according to need for configuring memory protection unit  2 . This alternative embodiment advantageously does not require any additional resources, for instance resources such as an integrated logic circuit for accessing and reading the access table or an integrated logic circuit for dynamic configuration of memory protection unit  2 . It can be implemented in existing systems by suitable adaptation of the software. 
         [0023]    The additional memory requirement for the check data PD needed for implementing the invention is calculated for the exemplary embodiment shown in  FIG. 1  as follows: 
         [0000]        S   PD   =S   NDF1 *Size PD /Size ND   +S   NDF2 *Size PD /Size ND    
         [0024]    where 
         [0025]    S PD —total additional memory volume for the check data 
         [0026]    S NDF1 —memory volume inside protection window F 1   
         [0027]    S NDF2 —memory volume inside protection window F 2   
         [0028]    Size ND —memory volume of a memory cell  3 . 1  for the user data 
         [0029]    Size PD —memory volume of the check data for protecting a memory cell containing user data 
         [0030]    The software architecture is preferably designed in such a way that after a change to a protection area from a first memory area to a second memory area, or removing a first protection area of a first memory area and generating a new protection area for a second memory area, no memory access can be made to the first memory area. The removal of protection for a memory area does not change the content or extent of the stored data, which comprises user data and check data, but allows it to be overwritten. One advantage, for example, is that an application on microcontroller units (MCU) can specify or manage for its ECC logic (memory error correction) just one memory area, because this logic also only has available that number of configuration registers, e.g. offset, length, status, config, etc., that are needed for one protection area. By virtue of the invention, just one reconfigurable protection area can thus be used to operate a plurality of protection areas practically simultaneously. In the case of a data access (not an access to program code), a correct address assignment to the user data is implemented in particular by adapting the software, because incrementing the physical memory address automatically could result in access to a memory cell  3 . 1  containing check data, since after removing the protection for a memory area, the addressing can no longer be performed selectively according to user data or check data. Thus there would inevitably be read operations in which user data would be read from check data addresses. To avoid this, the manner in which the data is accessed and interpreted by the addressing, decoding and checking blocks located directly in the signal path is modified such that the check data PD is not read and instead is largely ignored. The same applies to instructions, although, in particular apart from self-modifying program code, primarily for the read case. In a situation in which a program module, for example, needs to read both data and program code from a memory in a read-only and not necessarily protected manner, as is the case for a checksum calculation covering the entire memory area, the check data PD is thus not included in the checksum. For these and comparable cases, instructions are preferably likewise skipped accordingly. Alternatively, a repeated new configuration or reconfiguration of the protection area is possible on entering or leaving the protection area. 
         [0031]    The foregoing preferred embodiments have been shown and described for the purposes of illustrating the structural and functional principles of the present invention, as well as illustrating the methods of employing the preferred embodiments and are subject to change without departing from such principles. Therefore, this invention includes all modifications encompassed within the scope of the following claims.