Method of secure management of a memory space for microcontroller

• US 9,703,727 B2
• Filed: 04/04/2013
• Issued: 07/11/2017
• Est. Priority Date: 04/18/2012
• Status: Active Grant

• Current Assignee: Schneider Electric Industries SAS (Schneider Electric SE)
• Original Assignee: Schneider Electric Industries SAS (Schneider Electric SE)
• Inventors: Jaraudias, Patrice, Chapier, Pascal
• Primary Examiner(s): Rones, Charles
• Assistant Examiner(s): Li, Sidney
• Application Number:
  US14/382,674
• Publication Number:
  US 20150032976A1
• Time in Patent Office: 1,559 Days
• Field of Search: 711152
• CPC Class Codes: G06F 12/1036 for multiple virtual address spaces, e.g. segmentation G06F12/1045 takes precedence
• CPC Class Codes: G06F 12/145 the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
• CPC Class Codes: G06F 12/1491 in a hierarchical protection system, e.g. privilege levels, memory rings
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2221/2147 Locking files

Abstract

A method of managing an electronic microcontroller system, the microcontroller system including: two processors with a first processor configured for execution of a nonsecure application exhibiting a nonguaranteed level of functional security and integrity, and a second processor dedicated to execution of a secure application implementing code and data, and involving a guaranteed level of functional security and integrity, the secure application to implement a security function; and a mechanism to access to a shared memory space. The first processor includes a unit for managing the memory configured to implement a write access control, to manage write access to the shared memory space, that is not modifiable when the secure application implements its security function.

Claims

1. A method of management of an electronic microcontroller system for ensuring a check of write-access rendered non-modifiable, the microcontroller system including:

a first processor configured to execute a non-secure application, and

a second processor configured to execute a secure application that implements a security function,

the first and second processors configured to access to a shared memory space, and

the first processor configured to implement the check of write-access, and to manage write-access to the shared memory space that is non-modifiable when the secure application implements the security function,

the method, comprising;

apportioning the shared memory space between a memory area allocated to the secure application and a memory area allocated to the non-secure application, the memory area allocated to the secure application including a reserved area for the secure application;

allocating a buffer in the memory space allocated to the non-secure application;

loading a set of rules of access to the shared memory space into the buffer, the set of rules including a rule prohibiting writing by the non-secure application in the reserved area of the memory area allocated to the secure application;

checking, by the secure application, whether the non-secure application writes in the reserved area of the memory area allocated to the secure application according to the set of rules of access to the shared memory space;

controlling, by the first processor, access of the non-secure application to the reserved area of the memory area allocated to the secure application according to the set of rules of access to the shared memory space, wherein

the secure application implements the security function to verify integrity of the reserved area of the memory area allocated to the secure application and integrity of code and data corresponding to the secure application, and

the non-secure application involves a non-guaranteed level of functional security and integrity without the security function implemented in the secure application.

2. The method as claimed in claim 1, further comprising verifying integrity of the buffer and integrity of the code and of the data corresponding to the secure application.

3. The method as claimed in claim 1, further comprising constructing a security CRC (cyclic redundancy check) configured to detect errors of transmission or of transfer, the security CRC being associated with the buffer.

4. The method as claimed in claim 1, further comprising, after each operation, verifying a proper progress of a previous operation.