Patent Description:
One solution is to separate legally relevant and legally non-relevant data and operate a device that has two micro-controllers. One of the micro-controllers is dedicated to the legally relevant functionality and one of the micro-controllers is dedicated to the legally non-relevant functionality. This allows at least the portion of the device running the legally relevant system to be secure and safe from tampering. Typically, the legally relevant portion of the system cannot be upgraded while the legally non-relevant portion allows for remote firmware upgrades. This is a less than optimal solution. Multiple micro-controllers require more PCB space, consume more power, and offer less flexibility.

It would be desirable for a system that has <NUM>) a single micro-controller that is capable of handling both legally relevant and legally-non relevant applications; and <NUM>) has the inherent security and trustworthiness while also being expandable to adapt to the ever changing needs of the "Internet of Things".

<CIT> discloses a secure engine method providing an embedded microcontroller in an embedded device, the embedded microcontroller having internal memory. The method also includes providing a secure environment in the internal memory. The secure environment method recognizes a boot sequence and restricts user-level access to the secure environment by taking control over the secure environment memory.

<CIT> discloses an integrated-circuit device that includes a bus system, a plurality of master components, a plurality of slave components, and hardware filter logic. The bus system is configured to carry bus transactions and security-state signals for distinguishing between secure and non-secure transactions. The master components are switchable between a secure and a non-secure state. The hardware filter logic is configured to intercept bus transactions at an interception point, positioned within the bus system such that bus transactions from at least two of the master components and at least two slave components pass the interception point. It is also configured to use i) a slave address of the intercepted bus transaction, and ii) the security state of the intercepted bus transaction, to determine whether to allow the transaction, in accordance with a set of filtering rules, and to block intercepted bus transaction that are determined not to be allowed.

<CIT> discloses security systems for microelectronic devices physically lock the hardware itself and serve as a first line of defense by preventing overwriting, modification, maniplation or erasure of data stored in a device's memory. Implementations of the security systems can respond to lock/unlock commands that do not require signal or software interactivity with the functionality of the protected device, and which therefore may be consistent across devices.

<CIT> discloses a electronic device that comprises a processor, a memory, a memory controller for controlling access to the memory, a hardware security module, and a bus system, to which the processor, the memory controller, and the hardware security module are connected. The hardware security module uses its connection to the bus system to detect requests on the bus system that are sent by the processor. The hardware security module has a secure state and a non-secure state. When in the secure state, the hardware security module adds a secure-state signal to requests sent by the processor over the bus system. The memory controller determines whether memory-access requests include the secure-state signal, and denies access to a secure region of the memory in response to receiving memory-access requests that do not include the secure-state signal.

The present invention in its various aspects is as set out in the appended claims. One implementation is for a device. The device includes a controller having a memory protection unit, a legally relevant memory portion capable of interacting with the controller, a legally non-relevant memory portion capable of interacting with the controller, an interface in the memory protection unit that allows a privileged application to access the legally relevant memory portion and disallows an unprivileged application to access to the legally relevant portion, and an interrupt system, wherein when the unprivileged application makes an attempt to interact with the legally relevant memory portion, the memory protection unit takes an action associated with the unprivileged application.

Another implementation includes one or more hardware-based non-transitory memory devices storing computer-readable instructions which, when executed by the one or more processors disposed in a computing device, cause the computing device to enable an interaction between a controller and a legally relevant portion using a memory protection unit, enable an interaction between the controller and a legally non-relevant portion using the memory protection unit, allow a privileged application to access the legally relevant portion, receive an attempt from the unprivileged application to access the legally relevant portion, and perform at least one action with respect to the unprivileged application.

Another implementation is for a method for protecting a device. The method includes enabling an interaction between a controller and a legally relevant portion using a memory protection unit, enabling an interaction between the controller and a legally non-relevant portion using the memory protection unit, allowing a privileged application to access the legally relevant portion, receiving an interrupt from an unprivileged application configured to interact with the legally relevant portion, and performing an operating system level response to the interrupt.

<FIG> is a simplified block diagram of a computer system which can be used to implement a memory protection unit. In one example, the computer system <NUM> includes a processor <NUM>, a system memory <NUM> (which can also include the memory protection unit), and a system bus <NUM> that couples various system components including the system memory <NUM> to the processor <NUM>. The system bus <NUM> may be any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, or a local bus using any of a variety of bus architectures. The system memory <NUM> includes read only memory (ROM) <NUM> and random-access memory (RAM) <NUM>. A basic input/output system (BIOS) <NUM>, containing the basic routines that help to transfer information between elements within the computer system <NUM>, such as during startup, is stored in ROM <NUM>. The computer system <NUM> may further include a hard disk drive <NUM> for reading from and writing to an internally disposed hard disk (not shown), a magnetic disk drive <NUM> for reading from or writing to a removable magnetic disk <NUM> (e.g., a floppy disk), and an optical disk drive <NUM> for reading from or writing to a removable optical disk <NUM> such as a CD (compact disc), DVD (digital versatile disc), or other optical media. The hard disk drive <NUM>, magnetic disk drive <NUM>, and optical disk drive <NUM> are connected to the system bus <NUM> by a hard disk drive interface <NUM>, a magnetic disk drive interface <NUM>, and an optical drive interface <NUM>, respectively. The drives and their associated computer-readable storage media provide non-volatile storage of computer-readable instructions, data structures, program modules, and other data for the computer system <NUM>.

Although this illustrative example includes a hard disk, a removable magnetic disk <NUM>, and a removable optical disk <NUM>, other types of computer-readable storage media, which can store data accessible by a computer such as magnetic cassettes, Flash memory cards, digital video disks, data cartridges, random access memories (RAMs), read only memories (ROMs), and the like, may also be used in some applications of the present use of a memory protection unit.

In addition, as used herein, the term computer-readable storage media includes one or more instances of a media type (e.g., one or more magnetic disks, one or more CDs, etc.). For purposes of this specification and the claims, the phrase "computer-readable storage media" and variations thereof, are intended to cover non-transitory embodiments, and do not include waves, signals, and/or other transitory and/or intangible communication media.

A number of program modules may be stored on the hard disk, magnetic disk <NUM>, optical disk <NUM>, ROM <NUM>, or RAM <NUM>, including an operating system <NUM>, one or more application programs <NUM>, other program modules <NUM>, and program data <NUM>. A user may enter commands and information into the computer system <NUM> through input devices such as a keyboard <NUM> and pointing device <NUM> such as a mouse. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, trackball, touchpad, touchscreen, touch-sensitive device, voice-command module or device, user motion or user gesture capture device, or the like. Additional input devices (not shown) can include both privileged and unprivileged devices, including but not limited to: a P0 comm interface, a P1 comm interface, a P3 comm interface, an integrated breaker, a relay, an external metrologic chip including sensors, a metrologic LED, an LCD, a button, an external FLASH memory, a tamper sensor, a power supply, a client breaker, and a downstream voltage.

These and other input devices are often connected to the processor <NUM> through a serial port interface <NUM> that is coupled to the system bus <NUM>, but may be connected by other interfaces, such as a parallel port, game port, or universal serial bus (USB). A monitor <NUM> or other type of display device is also connected to the system bus <NUM> via an interface, such as a video adapter <NUM>. In addition to the monitor <NUM>, personal computers typically include other peripheral output devices (not shown), such as speakers and printers. The illustrative example shown in <FIG> also includes a host adapter <NUM>, a Small Computer System Interface (SCSI) bus <NUM>, and an external storage device <NUM> connected to the SCSI bus <NUM>.

The computer system <NUM> is operable in a networked environment using logical connections to one or more remote computers, such as a remote computer <NUM>. The remote computer <NUM> may be selected as another personal computer, a server, a router, a network PC, a peer device, or other common network node, and typically includes many or all of the elements described above relative to the computer system <NUM>, although only a single representative remote memory/storage device <NUM> is shown in <FIG>. The logical connections depicted in <FIG> include a local area network (LAN) <NUM> and a wide area network (WAN) <NUM>. Such networking environments are often deployed, for example, in offices, enterprise-wide computer networks, intranets, and the Internet.

When used in a LAN networking environment, the computer system <NUM> is connected to the local area network <NUM> through a network interface or adapter <NUM>. When used in a WAN networking environment, the computer system <NUM> typically includes a broadband modem <NUM>, network gateway, or other means for establishing communications over the wide area network <NUM>, such as the Internet. The broadband modem <NUM>, which may be internal or external, is connected to the system bus <NUM> via a serial port interface <NUM>. In a networked environment, program modules related to the computer system <NUM>, or portions thereof, may be stored in the remote memory storage device <NUM>. It is noted the network connections shown in <FIG> are illustrative and other means of establishing a communications link between the computers may be used depending on the specific requirements of an application of the present use of an enhanced temperature range power supply.

<FIG> is a simplified block diagram of a device that includes a memory protection unit. The memory protection unit <NUM> is used by a device <NUM>, in one implementation, as a basis for software separation in a single controller <NUM>. In one example, the controller <NUM> can be based on an ARM® Cortex® M23 and/or M33 core as well as an ARM® Cortex® M0+, M3 and/or M4 core. In these designs, they allow the controller <NUM> to enforce a separation based on addresses in a memory <NUM>.

An execution context managed by the controller <NUM> can be either privileged, or unprivileged. In one example, an unprivileged execution context might be initiated by unprivileged device A <NUM> or unprivileged device B <NUM>. Likewise, a privileged execution context might be initiated by privileged device A <NUM> or privileged device B <NUM>. It is also possible for unprivileged device A <NUM> or unprivileged device B <NUM> to initiate a privileged execution context. This may or may not be allowed by the memory protection unit <NUM> as will be described in more detail hereafter).

Exemplary privileged and unprivileged devices, such as devices <NUM>, <NUM>, <NUM>, and <NUM>, include but are not limited to: a P0 comm interface, a P1 comm interface, a P3 comm interface, an integrated breaker, a relay, an external metrologic chip including sensors, a metrologic LED, an LCD, a button, an external FLASH memory, a tamper sensor, a power supply, a client breaker, and a downstream voltage. In operation, when one of the devices <NUM>, <NUM>, <NUM> and <NUM> communicate with the device <NUM> they do so via the controller <NUM>. The controller <NUM> includes a privileged mode interface <NUM> and an unprivileged mode interface <NUM>. When one or more of unprivileged device A <NUM> or unprivileged device B <NUM> communicates with the device <NUM> it does so via the unprivileged mode interface <NUM>. Similarly, when one or more of privileged device A <NUM> or unprivileged device B <NUM> communicates with the device <NUM> it does so via the privileged mode interface <NUM>.

The memory protection unit <NUM> uses the interfaces <NUM> and <NUM> to enforce a physical separation of the memory <NUM> to a legally relevant memory portion <NUM> and a legally non-relevant memory portion <NUM>. Unprivileged execution contexts cannot directly be granted access to the legally relevant memory portion <NUM> as it is possible that it could compromise the security of the device <NUM>. For example, unprivileged device A <NUM> may attempt to alter the settings of the memory protection unit <NUM> in a privileged execution context, and thereby disable the memory protection unit <NUM>. Table <NUM>, for example, describes some of the actions which are allowed and/or not allowed in the various execution contexts.

An interrupt module <NUM> can be configured such that when one of the unprivileged devices <NUM> or <NUM> uses an execution context that impacts the legally relevant memory portion <NUM>, the interrupt module can take one or more actions to handle or deny the request. In one example, the memory protection unit <NUM> can create a buffer in the legally relevant memory portion <NUM>, such that the buffer is used to handle the request and the unprivileged devices <NUM> or <NUM> only receive results and aren't permitted to handle the request directly.

<FIG> is a simplified block diagram of an interrupt handler that is used by the memory protection unit. <FIG> includes an unprivileged device A <NUM>, which can attempt to interact with both a legally relevant portion <NUM> and a legally non-relevant portion <NUM>. The legally relevant portion has an interface <NUM>. The legally non-relevant portion has an interface <NUM>. The interface <NUM> of the legally relevant portion <NUM> has a buffer creation module <NUM> and a device disabling module <NUM>.

When an interrupt is made from the unprivileged device <NUM> it is received by the interface <NUM> via a communication path <NUM>. In the case where the device is privileged (not shown), the interface <NUM> could directly process the interrupt in the legally relevant portion <NUM>. If the interrupt from the unprivileged device <NUM> is a task that only requires using the legally non-relevant portion <NUM>, then it can be sent for processing via interface <NUM>. When the interrupt from the unprivileged device <NUM> is a task that requires using any of the legally relevant portion <NUM>, the interface <NUM> can be used and it can handle it in a variety of ways in different examples.

In one example, the interface <NUM> merely acknowledges receipt of the request or denies the request directly via path <NUM>. In another example, the interface <NUM> uses the buffer creation module <NUM> and the device disabling module <NUM>. For example, it could create a new buffer in the legally relevant portion <NUM> and handle the code needed to execute the request there. Similarly, the interface <NUM> could use the device disabling module <NUM> to disable the unprivileged device <NUM> temporarily while the code is being executed. Thereafter, results can be sent back to the unprivileged device <NUM> from the interface <NUM> via the path <NUM>.

<FIG> is a flowchart that illustrates the present use of a memory protection unit. At step <NUM>, the memory protection unit allows privileged applications to access a legally relevant portion of memory. Thereafter, an unprivileged application requests access to the memory at step <NUM>. Examples of unprivileged applications, include, for example, a P0 comm interface, a P1 comm interface, a P3 comm interface, an integrated breaker, a relay, an external metrologic chip including sensors, a metrologic LED, an LCD, a button, an external FLASH memory, a tamper sensor, a power supply, a client breaker, and a downstream voltage detection circuit.

At step <NUM>, the memory protection unit determines whether the request impacts any aspect of the legally relevant portion of the memory. If it does not, the memory protection unit grants the request at step <NUM>. Otherwise, the memory protection unit takes at least one action with respect to the request at step <NUM>. This is designed to ensure, in one example, that the unprivileged application is not able to take an action that can compromise the security provided by the memory protection unit. See Table <NUM> for example, as previously discussed.

<FIG> is a flowchart that illustrates the present use of a memory protection unit. At step <NUM>, the memory protection unit allows privileged applications to access a legally relevant portion of memory. Thereafter, an unprivileged application requests access to the memory at step <NUM>. Examples of unprivileged applications, include, for example, a P0 comm interface, a P1 comm interface, a P3 comm interface, an integrated breaker, a relay, an external metrologic chip including sensors, a metrologic LED, an LCD, a button, an external FLASH memory, a tamper sensor, a power supply, a client breaker, and a downstream voltage.

At step <NUM>, the memory protection unit determines whether the request impacts any of the legally relevant portion of the memory. If it does not, the memory protection unit grants the request at step <NUM>. Otherwise, the memory protection unit creates a buffer in the legally relevant memory portion <NUM>. The attempt to access the legally relevant portion is handled at step <NUM>. For example, a device can execute the code in the legally relevant portion solely via an interface or interrupt handler configured for the legally relevant portion. At step <NUM>, results are returned to the unprivileged application.

<FIG> is a flowchart that illustrates the present use of a memory protection unit. At step <NUM>, a device or system receives a request from a remote device or process which is requesting that it be allowed to update the firmware on the device or system. The device, thereafter, provides the request to a memory protection unit at step <NUM>. At step <NUM>, the memory protection unit determines whether the request is from an unprivileged application. Examples of unprivileged applications, include, for example, a P0 comm interface, a P1 comm interface, a P3 comm interface, an integrated breaker, a relay, an external metrologic chip including sensors, a metrologic LED, an LCD, a button, an external FLASH memory, a tamper sensor, a power supply, a client breaker, and a downstream voltage. If the request is not from an unprivileged application, the request is typically granted at step <NUM> as the application is privileged and has access to the legally relevant memory are which might be impacted by a remote firmware update. If, on the other hand, at step <NUM>, the request is from an unprivileged application, then the memory protection unit determines at step <NUM>, whether the request impacts solely a legally non-relevant memory area. If it does then the request is typically granted at step <NUM>. Otherwise at step <NUM> the request is typically denied.

<FIG> is a flowchart that illustrates the present use of a memory protection unit. At step <NUM> an operating system, computing device, or other application, executing an interrupt system, and separating it's memory into at least a legally relevant memory area and a legally non-relevant memory area, waits until an interrupt occurs at step <NUM>. At step <NUM>, the system determines whether the interrupt was initiated by a privileged application. If it was, the system can typically grant the request at step <NUM>, as privileged applications typically have access to both legally relevant and legally non-relevant memory areas in the system.

On the other hand, if the interrupt was initiated by an unprivileged application at step <NUM>, then at step <NUM>, the system determines whether interrupt request impacts solely the legally non-relevant memory area. Examples of unprivileged applications, include, for example, a P0 comm interface, a P1 comm interface, a P3 comm interface, an integrated breaker, a relay, an external metrologic chip including sensors, a metrologic LED, an LCD, a button, an external FLASH memory, a tamper sensor, a power supply, a client breaker, and a downstream voltage.

If one of the aforementioned applications is making an attempt that doesn't impact the legally relevant memory area, flow proceeds to step <NUM> where the request can be granted, as the unprivileged application typically has access to the legally non-relevant memory area and associated processing. If the interrupt request impacts the legally relevant memory even partially, at step <NUM>, then the system determines whether it needs to create a buffer in the legally relevant memory area.

If a buffer is not needed, then an option is for the system to acknowledge or deny the request at step <NUM> and optionally send results to the unprivileged application at step <NUM>. When the buffer is needed, the system creates it in the legally relevant memory area at step <NUM> and at step <NUM>, the system uses the controller to handle the interrupt in the legally relevant memory portion. Optionally, at step <NUM> the system sends results to the unprivileged application.

Claim 1:
A device comprising:
a controller having a memory protection unit (<NUM>);
a privileged memory portion (<NUM>) capable of interacting with the controller;
an unprivileged memory portion (<NUM>) capable of interacting with the controller;
an interface in the memory protection unit (<NUM>) that allows a privileged device to access the privileged memory portion (<NUM>) and disallows an unprivileged device to access the privileged memory portion (<NUM>);
an interrupt system, wherein when the unprivileged device makes an attempt to interact with the privileged memory portion (<NUM>), the memory protection unit (<NUM>) takes an action associated with the unprivileged device;
characterized by further comprising:
a buffer in the privileged memory portion (<NUM>), wherein the action includes the controller using the buffer to handle the attempt and return a result to the unprivileged device.