Patent ID: 12204647

DESCRIPTION OF THE PREFERRED EMBODIMENTS

System

With reference toFIG.1, one embodiment of the computer is shown comprising a microcontroller1comprising a non-volatile memory10, in other words a memory in which the data are retained even in the absence of a power supply, and at least one core20.FIG.1shows a microcontroller1comprising only one core20in order to simplify the description.

Memory10

Said non-volatile memory10is in particular a “flash” memory, known to those skilled in the art, possessing the characteristics of a random-access memory but with its data retained in the memory even when without power.

Z1

The non-volatile memory10comprises a “control” memory storage region Z1comprising a set of startup instructions, said startup instructions having to be carried out before computer startup. However, said control memory region Z1may also be located in another non-volatile memory of the microcontroller1.

The control memory region Z1also comprises a counter, the function of which will be explained in the following paragraphs.

Z2

The non-volatile memory10also comprises an application memory storage region Z2comprising at least one set of application instructions that is configured to implement an application of the computer, for example the injection function of the engine of the vehicle, by means of the at least one core20.

With reference toFIG.2, said application memory region Z2is composed of at least one sector SZ2comprising a plurality of pages PZ2, each page PZ2comprising a set of bits at 0 or 1 constituting an application implemented by the computer of the vehicle.

The smallest erase possible in the application memory region Z2corresponds to the erasing of a sector SZ2, and more precisely the transition of all of the bits in an entire sector SZ2to the default value.

The default value may be 0 or 1, and depends on the type of the application memory region Z2.

Thus, an “erased” sector SZ2comprises only bits that are equal to the default value. Additionally, in the case of a rewrite in a sector SZ2of the application memory region Z2, an erase is also implemented so as then to write in this sector SZ2which was previously erased. Obviously, a plurality of sectors SZ2may be modified simultaneously and/or independently.

Z3

Referring again toFIG.1, the non-volatile memory10also comprises a “detection” memory storage region Z3. Said detection memory region Z3may also be located in another non-volatile memory of the microcontroller1.

The detection memory region Z3is configured to have a bit that is transformed for each erase of a sector SZ2in the application memory region Z2. A transformed bit is here a bit that transitions from the default value to the opposite value, i.e. transitions from 0 to 1 or from 1 to 0. Furthermore, it is impossible to return the “transformed” bits to the default value. Each bit transformation is performed systematically and automatically either at the same time as the erase or between an erase request and the erase itself. The total number of transformed bits is registered in the counter of the control memory region Z3.

Core20

At least one core20est configured to implement the set of startup instructions stored in the control memory region Z1and the set of application instructions.

The microcontroller1, being switched off or on standby, is configured to start up after powering up or waking up the computer and, by implementing the set of startup instructions, to detect whether there has been at least one erase in the application memory region Z2of the non-volatile memory10between the last switch-off or standby and the starting up of the computer.

The microcontroller1is thus configured to initiate authentication of the application memory region Z2if at least one erase has been detected, and/or to execute the at least one set of application instructions if no erase has been detected, and therefore if the application memory region Z2is deemed to be authentic.

Method

With reference toFIG.3, one embodiment of the method for securing a vehicle computer is shown, implemented by the embodiment of the computer as presented above.

The computer, and therefore the microcontroller1, is first of all considered to be switched off or on standby.

The method first comprises a step E1of starting up the computer. For example, in the case where the computer is on board a vehicle, on starting the vehicle or on unlocking the doors of the vehicle, directly or after a certain defined period of time, the computer starts up, or in other words is powered up or comes out of its state of standby. Additionally, the computer may also, by itself, restart or come out of its state of standby regularly during use of the vehicle, in particular in the event of the detection of an error in its operation or in the operation of the system to which it belongs.

After starting up the computer, the method comprises a step E2of detecting an erase of a portion of the application memory region Z2of the non-volatile memory10between the last switch-off or standby and the starting up of the computer. To do this, the core20of the microcontroller1implements the set of startup instructions stored in the control memory region Z1.

Thus, the number of bits that are transformed in the detection memory region Z3is counted, and is compared with the number preregistered in the counter of the control memory region Z1.

As described above, an erase is more particularly the erasing of a sector SZ2of the application memory region Z2. Specifically, the smallest unit that can be erased corresponds to a sector SZ2.

If the number of bits that are transformed in the detection memory region Z3is equal to the number preregistered in the counter, this proves that there has been no erase between the last switch-off or standby and the starting up of the computer. In the absence of an erase, the application memory region Z2remains authentic and the method comprises a step E3of the core20of the microcontroller1executing at least one set of application instructions.

Additionally, if the number of bits that are transformed in the detection memory region Z3is different from the number preregistered in the counter, this means that there has been at least one erase between the last switch-off or standby and the starting up of the computer.

In the case of an erase, this means that the application memory region Z2is no longer authentic. Said erase may in particular be due to reprogramming of the application memory region Z2. Specifically, during licit reprogramming, by a mechanic for example, or illicit reprogramming, said application memory region Z2was at least partially erased, causing the transformation of at least one bit, previously at the default value, in the detection memory region Z3.

Thus, for each sector SZ2erased, one bit in the detection memory region Z3is transformed.

Because of the doubt dispelled previously via the detection of at least one erase, the method comprises a step E4of authenticating the application memory region Z2.

If the authentication step is “successful”, in other words if the program held in the application memory region Z2is deemed to be authentic, the method comprises a step E5of updating the value preregistered in the counter, in other words the value of the number of bits that are transformed of the detection memory region Z3is recorded in the control memory region Z1.

Once the updating step E5has been carried out, the method may comprise a step E3of executing the at least one set of application instructions.

Otherwise, if authentication is not successful, for example because the application memory region Z2is actually not authentic or because the computer was switched off prematurely during reprogramming, the program held in the application memory region Z2is not deemed to be authentic and is not executed. In such a case, only a step E6of reprogramming the application memory region Z2is possible.

Optionally, at the end of the reprogramming step E6, the method may comprise a step E4of authenticating the application memory region Z2without even having to restart the computer.

Additionally, the number preregistered in the counter of the control memory region Z1is determined beforehand, in each updating step E5of the method.

Thus, the computer and the method implemented by said computer make it possible to avoid needlessly iterating the authentication step E4and therefore needlessly wasting time between starting up the computer and implementing the program held in the application memory region Z2.