Integrated circuit

1 . An integrated circuit comprising:

a safety processor;

a memory;

a secure computing module comprising:

a secure processor;

first and second cryptographic units for encrypting and decrypting data in the memory; and

first and second data transfer units for transferring data between the memory and the first and second cryptographic units respectively,

wherein the first cryptographic unit and the first data transfer unit provide a first cryptographic data handling system, and the second cryptographic unit and the second data transfer unit provide a second cryptographic data handling system; and

a switch,

wherein the secure computing module further comprises:

selector circuitry for selectively coupling and uncoupling the first and second cryptographic data handling systems in response to control signals from the switch, such that:

in a first mode, the first and second cryptographic data handling systems are uncoupled and operable independently of each other; and

in a second mode, the first and second cryptographic data handling system are coupled and operable together to provide hardware redundancy,

wherein the secure computing module further comprises a first cryptographic signature or hash engine and a second cryptographic signature or hash engine, and

wherein:

the first cryptographic data handling system and the first cryptographic signature or hash engine are operable to process a first code block in a booting process; and

the second cryptographic data handling system and the second cryptographic signature or hash engine are operable to process a second code block during the booting process.

2 . The integrated circuit of claim 1 , wherein:

in the first mode, the first cryptographic data handling system is operable to process first data stored in the memory and the second cryptographic data handling system is operable to process second, different data stored the memory, simultaneously; and

in the second mode, the first and second cryptographic data handling systems are operable to process the first and second data sequentially.

3 . The integrated circuit of claim 1 , wherein, the safety processor is configured, in response to receiving or transmitting encrypted safety data, to send a request to the switch to cause the secure computing module to switch from the first mode to the second mode.

4 . The integrated circuit of claim 1 ,

wherein the switch comprises state monitor,

wherein the selector circuitry comprises a set of selectors, and

wherein each selector in the set of selectors is arranged to communicate its state to the state monitor and wherein the switch is configured to determine the respective states of the selectors in the set of selectors and, upon determining the respective states are correct, to switch between a first state and a second state.

5 . The integrated circuit of claim 1 , further comprising:

a communications controller for receiving and transmitting data from a bus,

wherein the communications controller is operable to:

receive received data and to store the received data in the memory; and

retrieve transmit data from the memory and to transmit the transmit data.

6 . The integrated circuit of claim 1 , wherein the switch comprises:

a scheduler; and

a timer,

wherein the scheduler is configured:

in response to the timer reaching a first pre-defined value, to cause the secure computing module to switch from the first mode to the second mode, and

in response to the time reaching a second pre-defined value, to cause the secure computing module to switch from the second mode to the first mode.

7 . The integrated circuit of claim 1 , further comprising:

an error module,

wherein the switch is configured to monitor states of selectors in the selector circuitry and, in response to a given selector or the switch determining that the given selector is in an erroneous state, the given selector and/or switch sending an error signal to the error module.

8 . The integrated circuit of claim 1 , wherein the hardware redundancy is sufficient to support Automotive Safety Integrity Level (ASIL) level D.

9 . The integrated circuit of claim 1 , wherein the integrated circuit is a microcontroller or a system-on-a-chip.

10 . A vehicle comprising:

a bus; and

at least two nodes arranged to communicate via the bus, each node comprising the integrated circuit of claim 1 .

11 . A switching method comprising:

selectively coupling and uncoupling, by a secure computing module, first and second cryptographic data handling systems, wherein the first cryptographic data handling system comprises a first cryptographic unit and a first data transfer unit, and the second cryptographic data handling system comprises a second cryptographic unit and a second data transfer unit, such that:

in a first mode, the first and second cryptographic data handling systems are uncoupled and operable independently of each other; and

in a second mode, the first and second cryptographic data handling system are coupled and operable together to provide hardware redundancy,

wherein the secure computing module comprises a first cryptographic signature or hash engine and a second cryptographic signature or hash engine, and

wherein:

the first cryptographic data handling system and the first cryptographic signature or hash engine are operable to process a first code block in a booting process; and

the second cryptographic data handling system and the second cryptographic signature or hash engine are operable to process a second code block during the booting process.

12 . The switching method of claim 11 , comprising:

coupling the first and second cryptographic data handling systems in response to a request from a safety processor; and

later, uncoupling the first and second cryptographic data handling systems.

13 . The switching method of claim 11 , comprising:

coupling the first and second cryptographic data handling systems in response to a timer value reaching a predetermined timer value threshold; and

later, uncoupling the first and second cryptographic data handling systems.