DE102020106811A1 - DATA PROCESSING DEVICE AND METHOD FOR HANDLING A SECURITY THREAT IN A DATA PROCESSING DEVICE - Google Patents

Abstract

According to various embodiments, a data processing device is described which comprises a power supply circuit, a security module and one or more communication interface circuits. The security module is configured to detect a security threat and to signal a recognized security threat to the power supply circuit, and the power supply circuit is configured such that it interrupts or in response to a recognized security threat which is signaled by the security module, the power supply of the one or more communication interface circuits resets the data processing device at least partially, or both.

Description

The present disclosure relates to data processing devices and methods for handling a security threat in a data processing device.

Electronic devices, for example control devices that comprise one or more microcontrollers, typically have to meet high protection and safety requirements. In automotive applications in particular, the safety of an electronic control device (e.g. an electronic control unit (ECU)) is of great importance, since a malfunction of a control device in a vehicle, e.g. due to malicious software, can lead to accidents. Therefore, approaches to increasing the security of data processing devices are desirable.

According to various embodiments, a data processing device is provided which comprises a power supply circuit, a security module and one or more communication interface circuits. The security module is configured to detect a security threat and to signal a recognized security threat to the power supply circuit, and the power supply circuit is configured to interrupt the power supply of the one or more communication interface circuits in response to a recognized security threat signaled by the security module Data processing device at least partially resets or both.

According to a further embodiment, a method for handling a security threat in a data processing device according to the data processing device described above is provided.

• 1 eine elektronische Steuereinheit (ECU) in einem Fahrzeug darstellt.
• 2 stellt eine elektronische Steuereinheit gemäß einer Ausführungsform dar.
• 3 stellt ein Zustandsübergangsdiagramm der Zustandsmaschine einer integrierten Leistungsverwaltungsschaltung (PMIC - Power Management Integrated Circuit) dar.
• 4 stellt eine ECU mit einer Mikrocontrollereinheit (MCU - Microcontroller Unit) und einer PMIC detaillierter dar.
• 5 stellt eine Datenverarbeitungsvorrichtung gemäß einer Ausführungsform dar.
• 6 stellt ein Flussdiagramm dar, das ein Verfahren zur Handhabung einer Sicherheitsbedrohung in einer Datenverarbeitungsvorrichtung veranschaulicht.

In the drawings, like reference characters generally refer to the same parts throughout the different views. The drawings are not necessarily to scale, instead emphasis generally lies on illustrating the principles of the invention. In the following description, various aspects are described with reference to the following drawings, wherein:

• 1 represents an electronic control unit (ECU) in a vehicle.
• 2 illustrates an electronic control unit according to an embodiment.
• 3 FIG. 10 is a state transition diagram of the state machine of a Power Management Integrated Circuit (PMIC).
• 4th shows an ECU with a microcontroller unit (MCU) and a PMIC in more detail.
• 5 illustrates a data processing device according to an embodiment.
• 6th Figure 10 is a flow diagram illustrating a method for handling a security threat in a computing device.

The following detailed description refers to the accompanying drawings, which illustrate specific details and aspects of this disclosure in which the invention can be practiced. Other aspects can be used and structural, logical, and electrical changes can be made without departing from the scope of the invention. The various aspects of this disclosure are not necessarily mutually exclusive, as some aspects of this disclosure can be combined with one or more other aspects of this disclosure to form new aspects.

1 represents an electronic control unit 101 in a vehicle 100 represent.

The Electronic Control Unit (ECU) 101 is an embedded system that includes one or more of the electrical systems or subsystems in the vehicle 100 controls. Examples are an engine control module (ECM - Engine Control Module), a transmission control module (TCM - Transmission Control Module), a brake control module (BCM or EBCM - Brake Control Module) and a central control module (CCM - Central Control Module).

The ECU 101 comprises a microcontroller unit (MCU - Microcontroller Unit) 102, which performs data processing (z. B. generation of control signals by processing input sensor signals), and an integrated power management circuit (PMIC - Power Management Integrated Circuit) 103, which is used to supply the MCU 102 and other components of the ECU 101 configured with power, for example using power from the vehicle battery.

The MCU 102 and the PMIC 103 are through an MCU-PMIC power management interface 104 tied together. Typically, a power management interface between the MCU and the PMIC is not secure and has no safety-related function. Furthermore, there are typically no specific responses from the PMIC to a security threat. More accurate In other words, such an interface typically only includes power management functions (power supplies, voltage regulation and associated communications) with no specific security functions.

In contrast to this is the MCU / PMIC interface 104 provided with security features, for example a safe state, and security functions in accordance with various embodiments. This enables the security of the ECU to be increased 101 in particular on communication interfaces of the MCU through power management measures that can be triggered, for example, by the MCU security module's knowledge of potential security threats, as described in more detail below.

2 provides an electronic control unit (ECU) 200 according to one embodiment.

The ECU 200 corresponds for example to the ECU 101 from 1 . Similar to the ECU 101 it includes an MCU 201 and a PMIC 202 that are connected by an MCU-PMIC interface, in particular an alarm signaling interface 203 includes. The PMIC 202 supplies the MCU 201 with performance.

The MCU 201 includes a security module (trusted entity) 204 . When the security module 204 detects a security threat, it sends a security alarm via the alarm signaling interface 203 directly to the PMIC 202 . The MCU-PMIC interface between the PMIC 202 and the MCU 201 can therefore be viewed as an interface (ie a security interface) enhanced with security features. It can also act as a performance management interface between the MCU 201 and the PMIC 202 act.

The MCU-PMIC interface can be the dedicated alarm signaling interface 203 implement via which the security module 204 can send the security alarm using one or more hardware signals. The PMIC 202 is configured in such a way that it reacts to the safety alarm by entering a safe state and triggering defined (safety) actions that improve the safety of the ECU 200 (e.g. especially the MCU 201 ) raise.

For example, the PMIC supplies 202 especially MCU communication interface components 205 as well as ECU interface components 206 with performance. For example, the MCU 201 with the ECU interface components 206 for communication with other components of the ECU 200 communicate. The ECU 200 can via the ECU interface components 206 also with other components (e.g. external components, e.g. other ECUs or sensors of the vehicle 100 ) communicate.

A security action that the PMIC 202 in the event of a security alarm being received is, for example, switching off threatened interfaces, for example MCU interfaces, by interrupting the power supply to the MCU communication components 205 . Since communication interfaces are potential doors for security breaches (propagation of security threats and attacks), one of the security actions of the PMIC may be to turn off the power to such interfaces. That way, not just the MCU 201 isolated from potential security attacks entering through these interfaces, it also gets the potential spread of security threats or attacks from the MCU 201 to other connected components.

The PMIC 202 only works in its normal mode as long as there is no safety alarm from the MCU 201 on the alarm signaling interface 203 is signaled. As soon as a security alarm occurs, the PMIC kicks in 202 into a dedicated security mode in which the can only have a limited functionality.

1. 1. Das Sicherheitsmodul 204 erkennt eine Sicherheitsbedrohung und erzeugt einen Sicherheitsalarm.
2. 2. Das Sicherheitsmodul 204 propagiert den Sicherheitsalarm über die Alarmsignalisierungsschnittstellte 203 zur PMIC 202.
3. 3. Die PMIC 202 reagiert auf den Sicherheitsalarm, in dem sie in einen sicheren Zustand einer Zustandsmaschine 207 der PMIC 202 eintritt.
4. 4. Die PMIC 202 unterbricht die Leistungszufuhr (über eine oder mehrere Leistungsversorgungsleitungen 208) zu verschiedenen versorgten Teilen oder Modulen, einschließlich der MCU-Kommunikationsschnittstellenkomponenten 205 und/oder der ECU-Kommunikationsschnittstellenkomponenten 206, die von der PMIC 202 (d. h., vom Gesichtspunkt der MCU 201, externen

The following is an example of an operation of the ECU 200 in response to a security threat.

1. 1. The security module 204 detects a security threat and generates a security alert.
2. 2. The security module 204 propagates the security alarm via the alarm signaling interface 203 to the PMIC 202 .
3. 3. The PMIC 202 reacts to the safety alarm by placing a state machine in a safe state 207 the PMIC 202 entry.
4. 4. The PMIC 202 interrupts the power supply (via one or more power supply lines 208 ) to various powered parts or modules, including the MCU communication interface components 205 and / or the ECU communication interface components 206 by the PMIC 202 (ie, from the MCU point of view 201 , external

Components as well as internal components, e.g. B. to provide an interface between the MCU and other ECU components).

3 represents a state transition diagram 300 the state machine 207 the PMIC 202 represent.

The PMIC 202 has an initialization (INIT) state 301, a normal state 302 and a safe state 303 on.

In the initialization state 301 are the PMIC power supply states for supplying power to the MCU 201 and the interface components 205 , 206 as well as possible other components of the ECU 200 z. B. either on or off as required for the MCU initialization phase.

In normal mode operating status 302 are all necessary power supplies (e.g. the MCU 201 and the interface components 205 , 206 as well as possible other components of the ECU 200 ) switched on.

If in 304 (from the initialization state 301 ) or in 305 (from the normal state 302 ) a security alarm occurs (i.e. the PMIC 202 a safety alarm signal from the MCU 201 receives), an MCU reset occurs 306 triggered, ie the PMIC activates a reset of the MCU 201 . It should be noted that the PMIC 202 before resetting the MCU 201 Information about a state of the MCU 201 (and / or other components of the ECU 200 ) can save.

When an MCU reset 306 was triggered by a safety alarm, the PMIC enters the defined safe state in 307 303 a.

In a safe state 303 Power supplies to the secured modules (e.g. communication interface) are switched off.

If the security alarm persists or a security alarm occurs again, the PMIC initiates another MCU reset cycle in 308.

In 309 the PMIC goes 202 into the normal initialization flow after the safety alarm has been deactivated and no further safety alarms have occurred for a defined period of time. The PMIC 202 At this point in time, the stored status information for the MCU (and / or other components of the ECU 200 ) and / or the MCU 201 inform about the reason for the reset. The status information can be the contents of certain registers, etc., for example.

4th represents an ECU 400 with an MCU and a PMIC in more detail.

Similar to the PMIC 202 from 2 are the PMIC 402 and the MCU 401 coupled via an MCU-PMIC interface, which in particular is an alarm signaling interface 403 which enables transmission of a security alarm signal, the MCU 401 includes a security module 404 , and the PMIC 202 assigns a state machine 412 on, the z. B. works as with reference to FIG 3 described, and in particular implemented one or more safe states.

According to the MCU interface components 205 instructs the MCU 401 Communication interface components, which together with corresponding interface components of the ECU 400 outside of the MCU 401 Communication interfaces 405 for exchanging communication signals 406 between the MCU and the external communication interface components.

The PMIC 402 supplies the communication interfaces 405 (ie the communication interface components of the MCU and the corresponding communication interface components of the ECU) via power supply rails 407 with performance.

For regulating the power supply to the communication interfaces 405 different variants can be used, e.g. B. one or more controllers 408 (e.g. buck converter or linear low-dropout regulator), which is determined by the states of the state machine 412 being controlled. Specifically, for example, they are controlled in such a way that they connect to the communication interfaces 405 Do not supply any power when the state machine is in a safe state (e.g. the safe state 303 ) is.

The state machine 412 for example sends control signals via control lines 410 to the controller 408 depending on the state of the state machine 412 switch on or off (supply power or not).

Alternatively or additionally, the PMIC supplies 402 the communication interfaces 405 via disconnector 409 with power that supplies the communication interfaces 405 (e.g. through the power supplied by one of the controllers 408 come) individually. The PMIC 402 for example operates the switch 409 to get power supply from a regulator 408 to at least a subset of the communication interfaces 405 (individually per communication interface 405 ) to be interrupted when the state machine is in a safe state (e.g. the safe state 303 ) is.

The state machine 412 for example sends control signals via control lines 411 , around the regulator 408 depending on the state of the state machine 412 on or off (power to be disconnected or not).

The security module 404 can be configured to send a security alert in response to detecting various types of security threats. For example, the detection of a malicious program running on the MCU 201 running or detecting malicious code that the MCU 201 via one of the communication interfaces 405 receives. The security module 404 can also be used with other components of the ECU 400 , e.g. B. Interface components that interface with devices outside the ECU 400 , a memory of the ECU 400 or other microprocessors or microcontrollers to detect security threats, e.g. B. malicious code or attacks, such as denial of service attacks, in or via these components. However, it should be noted that, according to various embodiments, the operation of the security module 204 and the PMIC 202 Designed (in terms of handling security threats) to avoid interactions with the (e.g. customer or user) software running on the MCU in order to minimize security risks. In addition, the security module 204 also (in addition to the PMIC) connected to other safe interfaces and functions at the ECU level, provided that they can respond to safety alarms from the MCU safety module.

In summary, according to various embodiments, a data processing device is provided, as in FIG 5 illustrated.

5 represents a data processing device 500 according to one embodiment.

The data processing device 500 includes a power supply circuit 501 , a security module 502 and one or more communication interface circuits 503 . The security module 502 is for recognizing a security threat and for signaling a recognized security threat to the power supply circuit 501 configured. The power supply circuit 501 is configured to provide power to the one or more communication interface circuits in response to the security module signaling a detected security threat 503 interrupts or the data processing device 500 resets at least partially or both (ie, the power supply of the one or more communication interface circuits 503 interrupts and the data processing device 500 at least partially resets).

An at least partial reset of the data processing device 500 can, for example, trigger a reset of one or more other components of the data processing device 500 than the power supply circuit 501 , for example the safety module 502 or a processing element (e.g. a microcontroller), which the security module 502 includes, mean.

In other words, according to various embodiments, an alarm signaling interface is used between a power supply circuit (e.g. a PMIC) and a security module (e.g. from an MCU) for propagating a security alarm signal (e.g. as part of an MCU-PMIC interface) provided. The alarm signaling interface can be implemented as an interface extension (for propagating safety alarm signals) of a power management interface (e.g. an MCU-PMIC power management interface).

The power supply circuit can be provided with safety functions, for example alarm monitoring circuits, functions for controlling safe states, defined safe states and safe circuit arrangement.

The security module (which e.g. implements a secure entity within the trusted zone of an MCU, ie can be a secure module) has control over the alarm signaling interface with the power supply circuit. The control of the alarm signaling can be limited to the trustworthy zone so that no other software instance (e.g. that is executed on the MCU) can influence this alarm signaling. The security mechanism (e.g. transmission of the security alarm signal and triggering of security actions) can be hardware-controlled, whereby no actions by untrustworthy software are involved in order to avoid potential software attacks. For example, only the trusted security module within an MCU is able to trigger the security alarm signals. The alarm signaling interface makes it possible to provide additional security for the communication interfaces: in the event of a security threat, these communication interfaces are switched off by hardware circuitry and can no longer serve as paths for attacks. The security actions are effective and deactivate on the physical communication level (communication interface components, modules and / or transceivers of the physical layer (PHY)) Communication links over the communication interfaces in an effective manner.

The power supply circuit, together with the security module, can be seen to implement a cybersecurity subsystem of the data processing device. The cybersecurity system takes protective measures for the entire system (i.e. the entire data processing device). There may be additional protection measures for the entire system that are taken by components so that the cybersecurity system does not necessarily take all protection measures.

An at least partial reset of the data processing device 500 can, for example, trigger a reset of one or more other components of the data processing device 500 than the power supply circuit 501 , for example the safety module 502 or a processing element (e.g. a microcontroller), which the security module 502 includes, mean.

Therefore, the power supply circuit can act as a protective element in the control for reaching a safe state while the rest (i.e. other components) of the data processing device (e.g. a microcontroller of the data processing device) is reset, i.e. H. is in a reset state. More generally, the power supply circuit has control over protection when a security threat is detected and can take such protective measures as disabling functions of the data processing device and disabling the power supply. The power supply circuit also takes action on one or more devices controlled by the data processing system when a security threat is detected, e.g. B. in a case where the data processing device is an electric power steering control device, it can cut off the connection of the battery voltage from an electric machine.

A security threat that is detected by the security module can be, for example, malicious code or attacks via the one or more communication interface circuits, e.g. B. Denial of Service attacks act. The communication interface circuits can be configured to provide one or more interfaces between components of the data processing device or between a component of the data processing device and a device external to the data processing device. Examples include a CAN (Controller Area Network) bus interface and an Ethernet interface.

• • es der Leistungsversorgungsschaltung ermöglicht, Leistungsverwaltungssicherheitsaktionen auf der MCU und ihren Kommunikationsschnittstellen durchzuführen.
• • Das sichere Modul kann zum Kommunizieren einer Sicherheitsbedrohung der oder eines Sicherheitsangriffs auf die Leistungsversorgungsschaltung (die den Microcontroller versorgt) verwendet werden. Dies bedeutet, dass die Sicherheitsschnittstelle zwischen dem Mikrocontroller und der Leistungsversorgungsschaltung insbesondere eine Alarmsignalisierungsschnittstelle zur Übertragung eines Sicherheitsalarms umfasst.
• • Sie ermöglicht der Leistungsversorgungsschaltung, die Kommunikationsschnittstellen der MCU zu deaktivieren, wenn ein Sicherheitsalarm ausgelöst wird.
• • Sie stellt eine hardwaregesteuerte Sicherheitsmaßnahme zum Deaktivieren bestimmter Leistungsversorgungen des Mikrocontrollers oder seiner Peripheriegeräte bereit.
• • Sie kann bei Bedarf durch Hardwaredesign definiert sein, um auszuwählen, welche Leistungsversorgungen im Falle einer Sicherheitsbedrohung oder eines Sicherheitsangriffs ausgeschaltet werden.
• • Sie stellt einen sicheren Zustand bereit, in welchem vordefinierte Leistungsversorgungen ausgeschaltet werden und unter Verwendung von Softwaresteuerung nicht wieder eingeschaltet werden können, und/oder
• • verhindert unbeabsichtigte Übergänge vom sicheren Zustand der Leistungsversorgungen in den Normalzustand ohne Rücksetzzyklus.

The security module can be part of a microcontroller (generally a processing element) of the data processing device. According to various embodiments, a safety interface is formed between the microcontroller and the power supply circuit, which

• • allows the power supply circuit to perform power management security actions on the MCU and its communication interfaces.
• The secure module can be used to communicate a security threat or a security attack on the power supply circuit (which supplies the microcontroller). This means that the safety interface between the microcontroller and the power supply circuit comprises, in particular, an alarm signaling interface for transmitting a safety alarm.
• • It enables the power supply circuit to disable the MCU's communication interfaces when a safety alarm is triggered.
• • It provides a hardware-controlled safety measure for deactivating certain power supplies to the microcontroller or its peripheral devices.
• • If necessary, it can be defined by hardware design in order to select which power supplies are switched off in the event of a security threat or security attack.
• • It provides a safe state in which predefined power supplies are switched off and cannot be switched on again using software control, and / or
• • prevents unintentional transitions from the safe state of the power supplies to the normal state without a reset cycle.

The components of the data processing device 500 can be implemented by one or more circuits. In one embodiment, a “circuit” can be understood as any type of logic implementing entity, which can be hardware, software, firmware, or any combination thereof. Accordingly, in one embodiment, a "circuit" may be a hardwired logic circuit or a programmable logic circuit, for example a programmable processor, e.g. B. a microprocessor. A “circuit” can also be software that is created by a Processor, e.g. Any type of computer program being implemented or executed. Any other type of implementation of the respective functions described herein can also be understood as “circuitry” according to an alternative embodiment. It should be noted, however, that at least some of the components may be implemented in hardware, ie hard-wired hardware circuits (e.g. as combinations of hard-wired logic gates configured to perform predetermined Boolean functions) in order to protect against software attacks raise.

The power supply circuit and the safe module can for example be implemented by different chips (ie different integrated circuits, e.g. in separate housings, e.g. arranged in different integrated circuit devices, e.g. surface mount devices) such that the interface between the power supply circuit and the secure module is an interface between chips. For example, the power supply circuit and the secure module are mounted on a printed circuit board, and the security interface between them (in particular the alarm signaling interface) can be formed by one or more lines on the printed circuit board. For example, the secure module can be implemented as part of a microcontroller chip that implements a microcontroller. Similarly, other components of the ECU (particularly communication interface components) may be separate from the power supply circuit (e.g. implemented by different chips arranged in different housings, e.g., different integrated circuit devices, e.g., surface mount devices).

The data processing device 500 for example, performs a procedure as in 6th shown.

6th represents a flow chart 600 which illustrates a method for handling a security threat in a computing device.

At 601, a security module detects a security threat.

At 602, the security module signals the identified security threat to a power supply circuit.

At 603, in response to signaling the identified security threat, the power supply circuit interrupts power supply to one or more communication interface circuits, or at least partially resets the computing device, or performs both.

One example operation is for the secure (e.g., hardware) module to detect a security threat and to issue an alarm to the power supply circuit. The power supply circuit then triggers a warm or (soft) reset of a microcontroller (e.g. an MCU) that includes the safe module and stores the cause of the reset (e.g. by setting a sticky bit before the reset) . After restarting the microcontroller, the safe module can perform a series of tests on the power supply circuit and receives the information that the reset was triggered by a security threat. As a result, the secure module can initiate the appropriate security actions (which may be user configurable). The origin of the alarm can be configured by the user (e.g. on the MCU side by security software). After the reset, a safe start can be carried out to ensure that the microcontroller is in a safe state and can initiate suitable actions. It is assumed that the microcontroller is in a safe state after a microcontroller restart, since, for example, a safe start is being carried out. Therefore, there is the flexibility to trigger any suitable action. Potential actions can be user-configurable (e.g. limp home mode, not limited to a specific action). For example, if there are redundant communication interfaces, only the main interface (e.g. Ethernet) can be switched off in the event of a security threat, but another interface (e.g. CAN) can remain switched on. It depends on the user to decide whether CAN communication alone is sufficient for a limp home mode. In this way, there can be a restricted operation such as keep-alive.

After the security-controlled reset, some interfaces can remain switched off in order to prevent further attacks. The user software can individually deactivate selected connections at risk of attack and then reactivate the power supplies individually. In a motor vehicle application, for example, in contrast to the safe module, the secondary protection path in the PMIC can be ASIL-D. Once started, the secondary protection path is activated and the MCU can only deactivate the secondary protection path with the correct protocol (which ensures that the MCU is functional). A fallback state (“init” mode with secondary protection path) can be provided in the power supply circuit arrangement in the event that the Security handling protocol failed. According to various embodiments, the safety alarm signal leads to a reset of the microcontroller, and the power supply of the power supply circuit arrangement (via which, for example, the communication interface components are supplied) switches to a safe state. The microcontroller may be informed (e.g., through the power supply circuitry) that the most recent reset was triggered by a security threat. The microcontroller can configure the power supply circuitry to regain access to the communication interfaces (ie, cause the power supply circuitry to restore power to the communication interface components).

• Beispiel 1 ist eine Datenverarbeitungsvorrichtung, wie in 5 veranschaulicht.
• Beispiel 2 ist die Datenverarbeitungsvorrichtung nach Beispiel 1, wobei die Leistungsversorgungsschaltung so konfiguriert ist, dass sie in Reaktion auf eine erkannte Sicherheitsbedrohung, die vom Sicherheitsmodul signalisiert wird, ein Rücksetzsignal an eine oder mehrere Komponenten der Datenverarbeitungsvorrichtung sendet.
• Beispiel 3 ist die Datenverarbeitungsvorrichtung nach Beispiel 1 oder 2, wobei die Leistungsversorgungsschaltung so konfiguriert ist, dass sie in Reaktion auf eine erkannte Sicherheitsbedrohung, die vom Sicherheitsmodul signalisiert wird, vor dem wenigstens teilweisen Rücksetzen der Datenverarbeitungsvorrichtung ein Speichern von Informationen über einen Zustand der Datenverarbeitungsvorrichtung initiiert.
• Beispiel 4 ist die Datenverarbeitungsvorrichtung nach Beispiel 3, wobei die Leistungsversorgungsschaltung so konfiguriert ist, dass sie die gespeicherten Informationen über den Zustand für eine oder mehrere Komponenten der Datenverarbeitungsvorrichtung bereitstellt, nachdem die Datenverarbeitungsvorrichtung wenigstens teilweise zurückgesetzt wurde.
• Beispiel 5 ist die Datenverarbeitungsvorrichtung nach einem der Beispiel 1 bis 4, wobei die Leistungsversorgungsschaltung so konfiguriert ist, dass sie eine Information über den Grund für das Rücksetzen für eine oder mehrere Komponenten der Datenverarbeitungsvorrichtung bereitstellt, nachdem die Datenverarbeitungsvorrichtung wenigstens teilweise zurückgesetzt wurde.
• Beispiel 6 ist die Datenverarbeitungsvorrichtung nach einem der Beispiele 1 bis 5, wobei die Datenverarbeitungsvorrichtung einen Mikrocontroller umfasst, und wobei das wenigstens teilweise Rücksetzen der Datenverarbeitungsvorrichtung ein Rücksetzen des Mikrocontrollers umfasst.
• Beispiel 7 ist die Datenverarbeitungsvorrichtung nach einem der Beispiele 1 bis 6, wobei die Datenverarbeitungsvorrichtung einen Mikrocontroller umfasst, wobei das wenigstens teilweise Rücksetzen der Datenverarbeitungsvorrichtung ein Rücksetzen des Mikrocontrollers umfasst, und wobei die eine oder die mehreren Komponenten den Mikrocontroller umfassen.
• Beispiel 8 ist die Datenverarbeitungsvorrichtung nach einem der Beispiele 1 bis 7, wobei die Datenverarbeitungsvorrichtung einen Mikrocontroller umfasst, der zum Ausführen von Software konfiguriert ist, und wobei das Sicherheitsmodul zum Erkennen von Sicherheitsbedrohungen der Software konfiguriert ist.
• Beispiel 9 ist die Datenverarbeitungsvorrichtung nach einem der Beispiele 1 bis 8, wobei das Sicherheitsmodul so konfiguriert ist, dass es bösartigen Code erkennt, der durch die Datenverarbeitungsvorrichtung über die eine oder die mehreren Kommunikationsschnittstellenschaltungen empfangen wird.
• Beispiel 10 ist die Datenverarbeitungsvorrichtung nach einem der Beispiele 1 bis 9, umfassend eine Alarmsignalisierungsschnittstelle zwischen der Leistungsversorgungsschaltung und dem Sicherheitsmodul, wobei das Sicherheitsmodul so konfiguriert ist, dass es eine erkannte Sicherheitsbedrohung an die Leistungsversorgungsschaltung signalisiert, indem sie ein Sicherheitsalarmsignal über die Alarmsignalisierungsschnittstelle an die Leistungsversorgungsschaltung sendet.
• Beispiel 11 ist die Datenverarbeitungsvorrichtung nach Beispiel 10, wobei die Datenverarbeitungsvorrichtung einen Mikrocontroller umfasst, der das sichere Modul umfasst, und wobei die Datenverarbeitungsvorrichtung eine Sicherheitsschnittstelle zwischen der Leistungsversorgungsschaltung und dem Mikrocontroller umfasst, die eine Leistungsverwaltungsschnittstelle und die Alarmsignalisierungsschnittstelle umfasst.
• Beispiel 12 ist die Datenverarbeitungsvorrichtung nach einem der Beispiele 1 bis 11, wobei die Leistungsversorgungsschaltung, das Sicherheitsmodul und die eine oder die mehreren Kommunikationsschnittstellenschaltungen durch separate integrierte Schaltungsvorrichtungen implementiert sind.
• Beispiel 13 ist ein Verfahren zur Handhabung einer Sicherheitsbedrohung in einer Datenverarbeitungsvorrichtung, wie in 6 veranschaulicht.
• Beispiel 14 ist das Verfahren nach Beispiel 13, das umfasst, dass die Leistungsversorgungsschaltung in Reaktion auf eine erkannte Sicherheitsbedrohung, die vom Sicherheitsmodul signalisiert wird, ein Rücksetzsignal an eine oder mehrere Komponenten der Datenverarbeitungsvorrichtung sendet.
• Beispiel 15 ist das Verfahren nach Beispiel 13 oder 14, das umfasst, dass die Leistungsversorgungsschaltung in Reaktion auf eine erkannte Sicherheitsbedrohung, die vom Sicherheitsmodul signalisiert wird, vor dem wenigstens teilweisen Rücksetzen der Datenverarbeitungsvorrichtung das Speichern von Informationen über einen Zustand der Datenverarbeitungsvorrichtung initiiert.
• Beispiel 16 ist das Verfahren nach Beispiel 15, das umfasst, dass die Leistungsversorgungsschaltung die gespeicherten Informationen über den Zustand für eine oder mehrere Komponenten der Datenverarbeitungsvorrichtung bereitstellt, nachdem die Datenverarbeitungsvorrichtung wenigstens teilweise zurückgesetzt wurde.
• Beispiel 17 ist das Verfahren nach einem der Beispiel 13 bis 16, das, umfasst, dass die Leistungsversorgungsschaltung eine Information über den Grund für das Rücksetzen für eine oder mehrere Komponenten der Datenverarbeitungsvorrichtung bereitstellt, nachdem die Datenverarbeitungsvorrichtung wenigstens teilweise zurückgesetzt wurde. Beispiel 18 ist das Verfahren nach einem der Beispiele 13 bis 17, wobei die Datenverarbeitungsvorrichtung einen Mikrocontroller umfasst, und wobei das wenigstens teilweise Rücksetzen der Datenverarbeitungsvorrichtung ein Rücksetzen des Mikrocontrollers umfasst.
• Beispiel 19 ist das Verfahren nach einem der Beispiele 13 bis 18, wobei die Datenverarbeitungsvorrichtung einen Mikrocontroller umfasst, wobei das wenigstens teilweise Rücksetzen der Datenverarbeitungsvorrichtung ein Rücksetzen des Mikrocontrollers umfasst, und wobei die eine oder die mehreren Komponenten den Mikrocontroller umfassen.
• Beispiel 20 ist das Verfahren nach einem der Beispiele 13 bis 19, wobei die Datenverarbeitungsvorrichtung einen Mikrocontroller umfasst, der Software ausführt, und wobei das Sicherheitsmodul Sicherheitsbedrohungen der Software erkennt.
• Beispiel 21 ist das Verfahren nach einem der Beispiele 13 bis 20, wobei das Sicherheitsmodul bösartigen Code erkennt, der durch die Datenverarbeitungsvorrichtung über die eine oder die mehreren Kommunikationsschnittstellenschaltungen empfangen wird.
• Beispiel 22 ist das Verfahren nach einem der Beispiele 13 bis 21, umfassend eine Alarmsignalisierungsschnittstelle zwischen der Leistungsversorgungsschaltung und dem Sicherheitsmodul, wobei das Sicherheitsmodul eine erkannte Sicherheitsbedrohung an die Leistungsversorgungsschaltung signalisiert, indem sie ein Sicherheitsalarmsignal über die Alarmsignalisierungsschnittstelle an die Leistungsversorgungsschaltung sendet.
• Beispiel 23 ist das Verfahren nach Beispiel 22, wobei die Datenverarbeitungsvorrichtung einen Mikrocontroller umfasst, der das sichere Modul umfasst, und wobei die Datenverarbeitungsvorrichtung eine Sicherheitsschnittstelle zwischen der Leistungsversorgungsschaltung und dem Mikrocontroller umfasst, die eine Leistungsverwaltungsschnittstelle und die Alarmsignalisierungsschnittstelle umfasst. Beispiel 24 ist das Verfahren nach einem der Beispiele 13 bis 23, wobei die Leistungsversorgungsschaltung, das Sicherheitsmodul und die eine oder die mehreren Kommunikationsschnittstellenschaltungen durch separate integrierte Schaltungsvorrichtungen implementiert sind.

Various examples are described below:

• Example 1 is a data processing device as in FIG 5 illustrated.
• Example 2 is the data processing device according to Example 1, wherein the power supply circuit is configured such that it sends a reset signal to one or more components of the data processing device in response to a detected security threat which is signaled by the security module.
• Example 3 is the data processing device according to Example 1 or 2, wherein the power supply circuit is configured in such a way that it initiates storage of information about a state of the data processing device in response to a recognized security threat that is signaled by the security module before the data processing device is at least partially reset .
• Example 4 is the data processing device according to Example 3, wherein the power supply circuit is configured to provide the stored information about the state for one or more components of the data processing device after the data processing device has been at least partially reset.
• Example 5 is the data processing device according to any one of Examples 1 to 4, wherein the power supply circuit is configured to provide information about the reason for the reset for one or more components of the data processing device after the data processing device has been at least partially reset.
• Example 6 is the data processing device according to one of Examples 1 to 5, wherein the data processing device comprises a microcontroller, and wherein the at least partial resetting of the data processing device comprises a resetting of the microcontroller.
• Example 7 is the data processing device according to one of Examples 1 to 6, wherein the data processing device comprises a microcontroller, wherein the at least partial resetting of the data processing device comprises resetting the microcontroller, and wherein the one or more components comprise the microcontroller.
• Example 8 is the data processing device according to one of Examples 1 to 7, wherein the data processing device comprises a microcontroller which is configured to execute software, and wherein the security module is configured to detect security threats to the software.
• Example 9 is the computing device of any one of Examples 1 to 8, wherein the security module is configured to detect malicious code received by the computing device via the one or more communication interface circuits.
• Example 10 is the data processing device according to one of Examples 1 to 9, comprising an alarm signaling interface between the power supply circuit and the security module, wherein the security module is configured such that it signals a detected security threat to the power supply circuit by sending a security alarm signal via the alarm signaling interface to the power supply circuit sends.
• Example 11 is the data processing device according to example 10, wherein the data processing device comprises a microcontroller which comprises the secure module, and wherein the data processing device comprises a security interface between the power supply circuit and the microcontroller which comprises a power management interface and the alarm signaling interface.
• Example 12 is the data processing device according to any one of Examples 1 to 11, wherein the power supply circuit, the security module and the one or more communication interface circuits are implemented by separate integrated circuit devices.
• Example 13 is a method of handling a security threat in a computing device as in FIG 6th illustrated.
• Example 14 is the method according to Example 13, which includes the power supply circuit sending a reset signal to one or more components of the data processing device in response to a detected security threat which is signaled by the security module.
• Example 15 is the method according to Example 13 or 14, which includes the power supply circuit initiating the storage of information about a state of the data processing device in response to a recognized security threat that is signaled by the security module before the at least partial reset of the data processing device.
• Example 16 is the method of Example 15, including the power supply circuit providing the stored information about the state for one or more components of the computing device after the computing device has been at least partially reset.
• Example 17 is the method of any one of Examples 13 to 16, including the power supply circuit providing information about the reason for the reset to one or more components of the computing device after the computing device has been at least partially reset. Example 18 is the method according to any one of Examples 13 to 17, wherein the data processing device comprises a microcontroller, and wherein the at least partially resetting the data processing device comprises resetting the microcontroller.
• Example 19 is the method according to any one of Examples 13 to 18, wherein the data processing device comprises a microcontroller, wherein the at least partially resetting the data processing device comprises resetting the microcontroller, and wherein the one or more components comprise the microcontroller.
• Example 20 is the method according to one of Examples 13 to 19, wherein the data processing device comprises a microcontroller that executes software, and wherein the security module detects security threats to the software.
• Example 21 is the method of any one of Examples 13-20, wherein the security module detects malicious code received by the computing device via the one or more communication interface circuits.
• Example 22 is the method according to one of Examples 13 to 21, comprising an alarm signaling interface between the power supply circuit and the security module, wherein the security module signals a recognized security threat to the power supply circuit by sending a security alarm signal to the power supply circuit via the alarm signaling interface.
• Example 23 is the method of Example 22, wherein the data processing device comprises a microcontroller comprising the secure module, and wherein the data processing device comprises a security interface between the power supply circuit and the microcontroller comprising a power management interface and the alarm signaling interface. Example 24 is the method of any one of Examples 13 to 23, wherein the power supply circuit, the security module, and the one or more communication interface circuits are implemented by separate integrated circuit devices.

While specific embodiments have been illustrated and described herein, it will be appreciated by those of ordinary skill in the art that the specific embodiments shown and described can be replaced by a variety of alternative and / or equivalent implementations without departing from the scope of the present invention. This application is intended to cover any adaptations or changes to the specific embodiments discussed herein. It is therefore intended that this invention be limited only by the claims and their equivalents.

List of reference symbols

100

vehicle

101

Electronic control unit (ECU)

102

Microcontroller unit (MCU)

103

Integrated power management circuit (PMIC)

104

MCU-PMIC interface

200

ECU

201

MCU

202

PMIC

203

Alarm signaling interface

204

Security module

205

MCU communication interface components

206

ECU interface components

207

State machine

208

Power supply lines

300

State transition diagram

301

Initialization state

302

Normal state

303

Safe state

304,305

processing

306

MCU reset

307-309

processing

400

ECU

401

MCU

402

PMIC

403

Alarm signaling interface

404

Security module

405

Communication interfaces

406

Communication signals

407

Power supply rails

408

Regulator

409

Circuit breaker

410, 411

Control lines

412

State machine

500

Data processing device

501

Power supply circuit

502

Security module

503

Communication interface circuits

600

flow chart

601-603

processing

Claims (13)

A data processing device comprising: a power supply circuit; a security module; and one or more communication interface circuits; wherein the security module is configured to detect a security threat and to signal a recognized security threat to the power supply circuit, and wherein the power supply circuit is configured to respond to a recognized security threat signaled by the security module, Interrupts the power supply to the one or more communication interface circuits or at least partially resets the data processing device, or both. Data processing device according to Claim 1 wherein the power supply circuit is configured to send a reset signal to one or more components of the data processing device in response to a detected security threat that is signaled by the security module. Data processing device according to Claim 1 or 2 , wherein the power supply circuit is configured in such a way that it initiates a storage of information about a state of the data processing device in response to a recognized security threat which is signaled by the security module before the at least partial reset of the data processing device. Data processing device according to Claim 3 wherein the power supply circuit is configured to provide the stored information about the state for one or more components of the data processing device after the data processing device has been at least partially reset. Data processing device according to one of the Claims 1 until 4th wherein the power supply circuit is configured to provide information about the reason for the reset for one or more components of the data processing device after the data processing device has been at least partially reset. Data processing device according to one of the Claims 1 until 5 wherein the data processing device comprises a microcontroller, and wherein the at least partial resetting of the data processing device comprises resetting the microcontroller. Data processing device according to one of the Claims 1 until 6th wherein the data processing device comprises a microcontroller, wherein the at least partial resetting of the data processing device comprises resetting the microcontroller, and wherein the one or more components comprise the microcontroller. Data processing device according to one of the Claims 1 until 7th , wherein the data processing device comprises a microcontroller configured to execute software, and wherein the Security module is configured to detect security threats to the software. Data processing device according to one of the Claims 1 until 8th wherein the security module is configured to detect malicious code received by the computing device via the one or more communication interface circuits. Data processing device according to one of the Claims 1 until 9 , comprising an alarm signaling interface between the power supply circuit and the security module, wherein the security module is configured to signal a detected security threat to the power supply circuit by sending a security alarm signal to the power supply circuit via the alarm signaling interface. Data processing device according to Claim 10 wherein the data processing device comprises a microcontroller comprising the secure module, and wherein the data processing device comprises a security interface between the power supply circuit and the microcontroller comprising a power management interface and the alarm signaling interface. Data processing device according to one of the Claims 1 until 11 wherein the power supply circuit, the security module, and the one or more communication interface circuits are implemented by separate integrated circuit devices. A method for handling a security threat in a computing device, comprising: Detection of a security threat by a security module; Signaling the identified security threat from the security module to a power supply circuit; Interrupting the power supply to one or more communication interface circuits by the power supply circuit or at least partially resetting the data processing device by the power supply circuit, or both in response to the signaling of the identified security threat.

Images