Protection of memory areas
A method for loading a program, contained in at least a first memory, into a second memory accessible by an execution unit, in which the program is in a cyphered form in the first memory, a circuit for controlling the access to the second memory is configured from program initialization data, instructions of the program, and at least initialization data being decyphered to be transferred into the second memory after configuration of the circuit.
1. A method to load a program from a first memory where the program is stored in a ciphered form, into a second memory accessible by an execution unit, the method comprising:
at initialization, before the program is ciphered, configuring a circuit with the program, the circuit then configured to control access to the second memory;
ciphering at least a first portion of the program with a ciphering key to create configuration data associated with the program, the configuration data used with at least header information of the program, wherein the header information is not ciphered;
providing a cryptographic signature to the remaining portions of the program that are not ciphered; and
controlling access to the second memory using the configured circuit.
2. The method of claim 1 , further comprising
a third memory and transferring the program to the first memory from the third memory.
3. The method of claim 2 , wherein the first and second memories are each separate memory portions contained within a single memory.
4. A method to load an application from an external first memory where the application is stored into an internal second memory accessible by an execution unit, the method comprising:
at initialization, when the application is not ciphered, configuring a control circuit to control access to the internal second memory;
receiving a header portion of the application, a program code portion of the application, and an initialization data portion of the application;
in a trusted external environment, executing a function to cypher with a cyphering key the program code portion of the application and the initialization data portion of the application;
storing the cyphered program code portion of the application and the cyphered initialization data portion of the application in the internal second memory;
in the trusted external environment, generating configuration data having a cryptographic signature, the configuration data associated with the cyphered program code portion and the cyphered initialization data portion;
storing the configuration data in the internal second memory; and
storing the header portion of the application in the internal second memory.
5. The method of claim 4 , wherein receiving the header portion, the program code portion, and the initialization data portion includes receiving said portions from an Internet accessible server device.
6. The method of claim 4 , wherein receiving the header portion, the program code portion, and the initialization data portion includes receiving said portions from a hard disk.
7. The method of claim 4 , wherein receiving the header portion, the program code portion, and the initialization data portion includes receiving said portions from an EEPROM.
8. The method of claim 4 , wherein storing the configuration data in the internal second memory includes storing un-cyphered configuration data.
9. The method of claim 4 , wherein the trusted external environment includes a secondary processor.
10. The method of claim 4 , comprising:
retrieving, via the control circuit, the program code portion and the initialization data portion from the second memory; and
using the cryptographic signature to authenticate the program code portion and the initialization data portion.
11. The method of claim 10 , wherein the retrieving is performed when the execution unit is operating in a supervisor mode and wherein the application is executed by the execution unit when the execution unit is operating in a mode that is not the supervisor mode.