Patent Description:
Embedded processing systems can include control system software that is critical to the physical performance of a control system. For example, a vehicle control system relies on a combination of carefully crafted control processes using a combination of instructions, constant data, and dynamically adjusted data to operate one or more electromechanical systems. If configuration items, such as software and/or data are modified, whether intentionally or unintentionally, the control system may be at risk of exhibiting undesirable behavior and/or degraded performance.

<CIT> discloses a method of initializing a device and a method of updating a firmware, which can secure against hacking from the outside by mounting a security module hardware in the device.

<CIT> discloses a method for reprogramming a device to alter device functionality in keeping with rights and privileges added or deleted therefrom with regard to software installed thereon, where such right and privileges affect operation of the device.

<CIT> discloses a reprogramming system which provides for field reprogramming of programmable devices and uses a key encryption and decryption system to unlock the device to allow reprogramming of the device.

According to a first aspect of the invention an embedded processing system according to claim <NUM> is provided.

In addition to one or more of the features described above or below, or as an alternative, further embodiments may include where the reprogramming control is further configured to authenticate the user based on one or more user credentials received from a reprogramming system and user authentication data stored in the embedded processing system.

In addition to one or more of the features described above or below, or as an alternative, further embodiments may include where the reprogramming control is further configured to receive a transaction indicator associated with the encrypted configuration item.

In addition to one or more of the features described above or below, or as an alternative, further embodiments may include where authentication of the user is based on the transaction indicator, the one or more user credentials received from the reprogramming system, and the user authentication data.

In addition to one or more of the features described above or below, or as an alternative, further embodiments may include configuration item authentication includes one or more asymmetric cryptographic methods using unique key pairs that result in an authentication failure based on an incorrect key, a missing key, or software that is tampered with resulting in an authentication failure.

In addition to one or more of the features described above or below, or as an alternative, further embodiments may include where the reprogramming control is further configured to encrypt a configuration item extracted from the memory system prior to transferring the configuration item external to the embedded processing system.

According to a second aspect of the invention a method is provided according to claim <NUM>.

A technical effect of the apparatus, systems and methods is achieved by secure reprogramming of an embedded processing system as described herein.

The following descriptions are provided by way of example only and should not be considered limiting in any way.

Referring now to the drawings, <FIG> illustrates a system <NUM> that includes an embedded processing system <NUM> and a controlled system <NUM>. The controlled system <NUM> can be any type of physical system that includes one or more effectors <NUM> controlled by one or more effector commands <NUM> generated by the embedded processing system <NUM>. Examples of effectors <NUM> can include one or more motors, solenoids, valves, relays, pumps, heaters, and/or other such actuation control components. A plurality of sensors <NUM> can capture state data associated with the controlled system <NUM> and provide sensed values <NUM> as feedback to the embedded processing system <NUM> to enable closed-loop control of the controlled system <NUM> according to one or more control laws. Examples of the sensors <NUM> can include one or more temperature sensors, pressure sensors, strain gauges, level sensors, accelerometers, rate sensors, and the like. The controlled system <NUM> is an engine system of an aircraft, i.e. a gas turbine engine, where the embedded processing system <NUM> may provide one or more control channels and/or monitoring systems of a controller (e.g., a full authority digital engine control) of one or more gas turbine engines.

In the example of <FIG>, the embedded processing system <NUM> includes processing circuitry <NUM> and a memory system <NUM> configured to store a plurality of configuration items, where at least one of the configuration items includes a sequence of the computer executable instructions for execution by the processing circuitry <NUM>. Other types of configuration items can include data, such as constants, configurable data, and/or fault data. Examples of computer executable instructions can include boot software, operating system software, and/or application software. The executable instructions may be stored or organized in any manner and at any level of abstraction, such as in connection with controlling and/or monitoring operation of the controlled system <NUM>. The processing circuitry <NUM> can be any type or combination of central processing unit (CPU), including one or more of: a microprocessor, a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like. Also, the memory system <NUM> includes non-volatile memory and may include volatile memory <NUM>, such as random access memory (RAM), the non-volatile memory <NUM> may be Flash memory, read only memory (ROM), and/or other electronic, optical, magnetic, or any other computer readable medium onto which is stored data and algorithms in a non-transitory form.

The embedded processing system <NUM> can also include one or more of an input/output interface <NUM>, a communication interface <NUM>, a reprogramming control <NUM>, and/or other elements (not depicted). The input/output interface <NUM> can include support circuitry for interfacing with the effectors <NUM> and sensors <NUM>, such as filters, amplifiers, digital-to-analog converters, analog-to-digital converters, and other such circuits to support digital and/or analog interfaces. Further, the input/output interface <NUM> can receive or output signals to/from other sources. As one example, discrete inputs <NUM> can be input to the input/output interface <NUM> to establish an operating mode of the embedded processing system <NUM> or to trigger actions by the embedded processing system <NUM>. A reset signal <NUM> may also be received as a signal by the input/output interface <NUM> or may interface with other circuitry of the embedded processing system <NUM>, such as power conditioning circuitry (not depicted), where the reset signal <NUM> can trigger a mode of operation check that enables the reprogramming control <NUM>. The communication interface <NUM> can be communicatively coupled to a communication system <NUM>, which can include one or more direct or networked communication links to systems, such as a reprogramming system <NUM>, a data repository <NUM>, or another system (not depicted). The reprogramming system <NUM> can be any type of computer system operable to load new/updated configuration items to the embedded processing system <NUM> for storage in the memory system <NUM>. The reprogramming system <NUM> can interface to the communication system <NUM> through a wired, wireless, optical, or magnetic coupling. The data repository <NUM> can serve as a data source for updating the memory system <NUM>, for instance, with control system data, or as a data sink to offload and clear data from the memory system <NUM>, such as fault data, history data, and the like.

In embodiments, the reprogramming control <NUM> can be implemented in dedicated circuitry, such as an application specific integrated circuit, programmable logic device, field programmable gate array, or the like. Alternatively, the reprogramming control <NUM> can be implemented in software, such as boot software. In some embodiments, a processing core of the processing circuitry <NUM> can be dedicated for use by the reprogramming control <NUM>. The reprogramming control <NUM> can be configured to implement embodiments as further described herein.

Referring now to <FIG>, an example of an authentication system <NUM> is depicted that can be part of the reprogramming control <NUM> of <FIG>. The authentication system <NUM> of <FIG> can include an authentication control <NUM> configured to receive a transaction indicator <NUM> and user credentials <NUM> to support user authentication with user authentication data <NUM> as part of a reprogramming process of the embedded processing system <NUM> of <FIG>. The transaction indicator <NUM> and user credentials <NUM> can be received at the reprogramming control <NUM> of <FIG> from the reprogramming system <NUM> via communication system <NUM> and communication interface <NUM> of <FIG>. User authentication data <NUM> can be defined for particular users or classes of users, such as equipment-owner users, maintenance technicians, engineering users, and the like. The transaction indicator <NUM> may indicate a type of configuration item or reprogramming option desired by a user of the reprogramming system <NUM>. For example, an equipment-owner user may have authority to clear fault data records or set a subset of configuration parameters in the memory system <NUM> of <FIG>. A maintenance technician may have authority to adjust trimmable constants or reprogram certain regions of the non-volatile memory <NUM> of <FIG>. An engineering user may have authority to reprogram an operating system, boot program code, or application software in the non-volatile memory <NUM>, in addition to having permissions of the maintenance technician and the equipment-owner user. If user authentication fails, for instance, by the user credentials <NUM> not being recognized with respect to the user authentication data <NUM>, or user permissions associated with the transaction indicator <NUM> do not align with expected permissions of the user authentication data <NUM>, then the authentication control <NUM> can record the failure in a failure log <NUM>.

The authentication control <NUM> can also receive transmitted cryptographic information <NUM> and an encrypted configuration item <NUM> from the reprogramming system <NUM> via communication system <NUM> and communication interface <NUM> of <FIG>. The authentication control <NUM> can apply a cryptographic algorithm using one or more parameters received in the transmitted cryptographic information <NUM> and stored cryptographic information <NUM> to decrypt the encrypted configuration item <NUM>. The transmitted cryptographic information <NUM> and stored cryptographic information <NUM> can be used together for decryption based on 'shared secrets' such that not all of the information is sent from outside of the embedded processing system <NUM> of <FIG> nor stored completely within the embedded processing system <NUM>. After decryption, authenticity of the configuration item can be verified using, for example, a digital signature of the configuration item. The resulting file can be a decrypted and authenticated configuration item <NUM>, which may be temporarily stored in volatile memory <NUM> or otherwise buffered during authentication and is written by the reprogramming control <NUM> into the non-volatile memory <NUM> of <FIG> upon authentication. The authentication control <NUM> can acknowledge successful completion of decryption, authentication, and writing of the decrypted and authenticated configuration item <NUM> in the memory system <NUM> of <FIG> with a response to the reprogramming system <NUM>. If an error is detected, the error can be logged in the failure log <NUM>, and the reprogramming system <NUM> can be notified of the error condition.

<FIG> depicts an example of a reprogramming process <NUM> that can be performed by the system <NUM> of <FIG> and is described in reference to <FIG>. At block <NUM>, the reprogramming system <NUM> can start a transaction and provide a transaction indicator <NUM> and user credentials <NUM> to the embedded processing system <NUM>. At block <NUM>, the embedded processing system <NUM> can examine the information and authenticate the user based on the transaction indicator <NUM>, the one or more user credentials <NUM> received from the reprogramming system <NUM>, and the user authentication data <NUM>. If an authentication failure is detected at block <NUM>, the embedded processing system <NUM> can log the failure in the failure log <NUM> of <FIG>. Upon a failure, the reprogramming process <NUM> can be stopped at block <NUM>. Based on a successful authentication, a success indicator can be returned to the reprogramming system <NUM> at block <NUM>. At block <NUM>, the reprogramming system <NUM> can transmit a load command and the transmitted cryptographic information <NUM>. At block <NUM>, the embedded processing system <NUM> can store information for a transaction duration to enable decryption based on the transmitted cryptographic information <NUM>. The transmitted cryptographic information <NUM> can be temporarily stored in the volatile memory <NUM> of <FIG> while the transaction is in process and be erased upon completion of the load transaction. In contrast, the stored cryptographic information <NUM> is retained and not erased upon completion of the load transaction.

At block <NUM>, the reprogramming system <NUM> can transmit an encrypted configuration item <NUM>. The embedded processing system <NUM> can use the transmitted cryptographic information <NUM> and stored cryptographic information <NUM> to decrypt the encrypted configuration item <NUM> and use cryptographic methods to authenticate the configuration item at block <NUM>. Configuration item authentication can include one or more asymmetric cryptographic methods using unique key pairs that result in an authentication failure based on an incorrect key, a missing key, or software that is tampered with resulting in the authentication failure. For instance, if an incorrect key was used to sign the software, the corresponding key pair does not exist in the embedded processing system <NUM>, or the software was tampered with, an authentication result may be a failure of a signature to authenticate. As a further example, an authentication failure can be detected for a memory range due to tampering of the memory content in the address range when the correct key exists. If authentication is successful, the decrypted and authenticated configuration item <NUM> can be stored to the memory system <NUM> and a success indicator can be transmitted to the reprogramming system <NUM>. If the authentication fails at block <NUM>, a failure indicator can be transmitted to the reprogramming system <NUM>, and the failure can be logged in the failure log <NUM>. At block <NUM>, the reprogramming system <NUM> can receive the success or failure indicator from the embedded processing system <NUM> and display the result to a user of the reprogramming system <NUM>.

Thus, rather than using a technique, such as a cyclic redundancy check (CRC) to confirm that underlying data has not been modified, embodiments of the invention can use cryptographic technology to protect from tampering in combination with decryption and validation, making it more difficult to corrupt a configuration item without detection. Embodiments of the invention can use cryptographic algorithms to ensure the integrity of the software that is loaded into the embedded processing system <NUM>. Encryption of the encrypted configuration item <NUM> can be performed at a point of origin where a loadable/executable file is created. Thus, the reprogramming system <NUM> may not be able to decrypt and/or modify the encrypted configuration item <NUM> without an authentication error being detected by the embedded processing system <NUM>.

Referring now to <FIG> with continued reference to <FIG>, <FIG> is a flow chart illustrating a method <NUM> for secure reprogramming of the embedded processing system <NUM> of <FIG>, in accordance with an embodiment. The method <NUM> may be performed, for example, by the reprogramming control <NUM> of <FIG>.

At block <NUM>, the reprogramming control <NUM> can authenticate a user associated with a reprogramming operation of the embedded processing system <NUM>. At block <NUM>, the reprogramming control <NUM> can receive an encrypted configuration item <NUM>. At block <NUM>, the reprogramming control <NUM> can decrypt and authenticate the encrypted configuration item <NUM>, using the transmitted cryptographic information <NUM> and the stored cryptographic information <NUM>, as a decrypted and authenticated configuration item <NUM> responsive to authenticating the user. At block <NUM>, the reprogramming control <NUM> can store the decrypted and authenticated configuration item <NUM> in the memory system <NUM>.

In embodiments, the reprogramming control <NUM> can be further configured to authenticate the user based on one or more user credentials <NUM> received from the reprogramming system <NUM> and user authentication data <NUM> stored in the embedded processing system <NUM>. The reprogramming control <NUM> can be further configured to receive a transaction indicator <NUM> associated with the encrypted configuration item <NUM>. The reprogramming control <NUM> can receive transmitted cryptographic information <NUM> including one or more encryption parameters (e.g., digital signatures) associated with the encrypted configuration item <NUM>. The reprogramming control <NUM> can be configured to use the transmitted cryptographic information <NUM> and stored cryptographic information <NUM> to decrypt the encrypted configuration item <NUM>. The transmitted cryptographic information <NUM> can be stored for a transaction duration within the embedded processing system <NUM> and erased upon completion of a load transaction, while the stored cryptographic information <NUM> was already stored and remains stored for use in future transactions. The reprogramming control <NUM> can be configured to encrypt a configuration item extracted from the memory system <NUM> prior to transferring the configuration item external to the embedded processing system <NUM>. In some embodiments, the embedded processing system <NUM> can be a controller of a gas turbine engine, and the encrypted configuration item <NUM> can be an application configured to control operation of the gas turbine engine.

Claim 1:
An embedded processing system (<NUM>) comprising:
processing circuitry (<NUM>);
a memory system (<NUM>) comprising a non-volatile memory (<NUM>); and
a reprogramming control (<NUM>) configured to:
authenticate (<NUM>) a user associated with a transaction comprising a reprogramming operation of the embedded processing system, wherein based on a successful authentication a success indicator is returned to a reprogramming system;
receive a load command and transmitted cryptographic information (<NUM>) comprising one or more encryption parameters associated with an encrypted configuration item (<NUM>), wherein the transmitted cryptographic information is received from the reprogramming system after the success indicator is sent to the reprogramming system;
receive (<NUM>), from the reprogramming system, the encrypted configuration item (<NUM>);
decrypt and authenticate (<NUM>) the encrypted configuration item as a decrypted and authenticated configuration item (<NUM>) responsive to authenticating the user, wherein the transmitted cryptographic information (<NUM>) and stored cryptographic information (<NUM>) are used to decrypt the encrypted configuration item; and
store (<NUM>) the decrypted and authenticated configuration item in the non-volatile memory of the memory system, wherein the transmitted cryptographic information (<NUM>) is stored for a transaction duration within the embedded processing system and erased upon completion of a load transaction, and the stored cryptographic information (<NUM>) is retained after completion of the load transaction,
wherein the embedded processing system is a controller of a gas turbine engine, and the encrypted configuration item (<NUM>) comprises an application configured to control operation of the gas turbine engine.