Security Method for Protecting Electronically Stored Data

This invention relates to a method of operating an electronic control module and particularly to a method of securing protected data stored in such a module.

Internal combustion engines used for automotive vehicles, marine applications and other uses are efficiently controlled by microprocessor based electronic control modules which receive information on operator commands, engine operation parameters and the like and issue control signals for spark timing and fuel control. Such controls are necessary to achieve fuel economy, optimum vehicle performance and compliance with emissions standards. The task of defining the optimum control parameters or calibrations requires the expenditure of much development time and expense for each engine type by the engine manufacturer, and results in an advantage over competitors lacking the optimized parameters.

The control modules are available to any engine manufacturer along with field service tools, calibrations installation tools and calibrations development tools. Heretofore each manufacturer could retrieve the valuable calibrations data from a module using standard tools and pirate the data for use in a similar competing engine. It is thus desirable for an engine manufacturer to safeguard the information installed in such a module. It is generally known to secure electronically stored data such as bank accounts by requiring passwords for access to the information. The same approach can be used for securing the calibration data. That is, a password must be entered in order to retrieve the sensitive data stored in the control module.

A disadvantage of password protection is that if the password becomes lost or forgotten, and it is necessary to access the memory to change the calibration, the module becomes useless. If the module hardware manufacturer becomes a repository of secret passwords, the chance of a security breach is increased, and it is a burden to both the repository and the user to retrieve the password. Moreover it is important for the sake of flexibility that the user create and install the password as required. Thus it is desirable to recover a unit having an unknown password without reducing the security.

Since modules for controlling various engine types have different embodied software, it is desirable to use different passwords for different types to increase security. The modules, however, are identical in physical appearance, and it sometimes occurs that the identity of a module is unknown and thus an authorized user has difficulty in determining which of several passwords to use. Thus it is desirable to establish a way for an authorized user to determine the correct password.

Because it is often necessary for service technicians to access information in the module to analyze engine operation, it is unrealistic to require a password for access to all data. Thus it is desirable to allow free access to that information which does not have to be protected while safeguarding other information.

It is therefore an object of the invention to safeguard sensitive data in an electronic module by a password scheme while allowing the module to be recovered for use when the password is unknown. Another object is to assist in identifying the type of module to permit an authorized user to determine which password to use in accessing secure data. Still another object is to allow free access to non-sensitive data while safeguarding sensitive data.

A microprocessor-based engine control module suitable for use with a variety of engines contains software supplied by the module manufacturer for spark and fuel control. Specific control parameters or calibrations are developed for each type of engine by the engine manufacturer and loaded into a protected portion of non-volatile read/write memory such as an EEPROM. A password is also loaded into the same memory at a specific address. A part of the software is logic for password protection of the data in the protected portion of memory. Other data loaded into the module or generated by the module are not protected. At the time of manufacture the password address is loaded with a null password and the security is deactivated.

The module is coupled by a serial communication interface to calibrations development or calibrations installation tools which send digital messages to the module to load the calibrations and password, or to write other data to update the module, and read the calibrations, or other service tools to retrieve data useful in trouble shooting the module operation. The protection logic allows free access to unprotected data without the use of any password. Other communication of unprotected data is also allowed as between modules of two engines on the same watercraft or to an instrument panel.

Security is activated by writing a password to the EEPROM password address and removing the operating voltage from the module. This is accomplished by sending a code including the password via the serial communication interface. Once the password is installed and the security is activated, any request for protected data is refused. If the password is entered the security is deactivated for the remainder of the ignition cycle, and a subsequent request during the cycle for calibration data will then be honored, and if desired, the password itself may be changed.

If an incorrect password is entered, the logic will not deactivate the security and any subsequent password entry will not be entertained until the operating voltage is removed and then reapplied to the module. This feature makes it impossible to rapidly try a series of possible passwords to find the correct one. Instead, about two seconds is required to turn the voltage off and on and attempt another password. Because of this time delay feature it would take a single automated device up to 272 years to guess the password if an eight digit password is used. The module has no alternative paths to access the protected data so that there is no practical way for an unauthorized person to discover the data, even by disassembling the module.

Each type of engine control is preferably assigned a unique password and a corresponding identification number. Thus the manufacturer will list all the passwords in use and the corresponding identification numbers. The ID is entered into unprotected memory when the password is loaded. By requesting the ID from the module, the authorized user can determine the correct password from the password list.

If a password cannot be determined from the ID and the password list and is otherwise unknown, the module can be recovered for use by requesting recovery. This is done in two steps to prevent accidental recovery. The first step requires an arming request and the second step requires a recovery request. The protection logic responds to the two requests by first erasing all the protected data and then deactivating security. Then the module may be reloaded with calibration data, a new password and corresponding ID.

The above and other advantages of the invention will become more apparent from the following description taken in conjunction with the accompanying drawings wherein like references refer to like parts and wherein:

FIG. 1 is a block diagram of an engine control module suitable for use with the method of the invention; and

FIGS. 2A and 2B comprise a flow chart representing the security program embedded in the module of FIG. 1 according to the invention.

Referring to FIG. 1, an engine control module 10 is supplied with operating voltage through a vehicle ignition switch 11. The module 10 is a single semiconductor chip which includes a microprocessor unit (MPU) 12, an analog-to-digital converter (ADC) 14, a read-only-memory (ROM) 16, a random access memory (RAM) 18, an electrically erasable programmable read-only-memory (EEPROM) 20, an engine control unit (ECU) 22, and a serial communication interface (SCI) 24. The MPU 12 may be a microprocessor model MC-6100 manufactured by Motorola Semiconductor Products, Inc. Phoenix, Ariz. The MPU 12 communicates with the rest of the system by an 8 bit bi-directional data bus 25.

The ROM 16 contains the program steps for operating the MPU 12, and tables and non-sensitive constants used in determining engine fuel and ignition control parameters. The ROM 16 also contains security logic which is used to prevent unauthorized access to sensitive data stored in the EEPROM 20. The EEPROM has an address for a password, and addresses for sensitive data, particularly calibration parameters, as well as addresses for non-sensitive data. The RAM 18 temporarily stores data which may be read from various locations determined in accord with the program stored in the ROM. Discrete inputs are directly coupled to the MPU and analog Inputs from operator controls or engine sensors are received at the ADC 14 and digitized for use by the MPU. The ECU 22 produces module outputs to the engine for fuel control and spark control.

The SCI 24 receives messages from and responds to external tools such as field service diagnostic tools 26, calibration burn-in tools 28 and calibration development tools 30. The diagnostic tools 26 are used by service technicians to trouble shoot engine operation, and request and receive non-sensitive information such as engine speed. The calibration development tools 30 are used by engineers in the development of calibration data which, when finalized, is saved in a file which is given to the engine manufacturer. The calibration burn-in tools 28 are used by the engine manufacturer to enter the file of calibration data into the EEPROM. The tools issue a number of digital codes which are interpreted by the module as requests or commands to read data from the module, write data into a memory location, or other instructions. The messages are routed to the security logic program which filters the messages, passing those dealing with non-sensitive data, and evaluating whether other messages should be honored. The SCI also handles communication with other on-board devices.

It is well known to provide an ECM with a bootstrap mode which is permitted by a special boot ROM area which manages the downloading of a program into RAM via the SCI, and access to calibration data can be obtained. The module may have architecture which provides the bootstrap capability, but it also has a security flag preventing such operation. The security flag is burned into the chip at the time of manufacture to positively prevent access to the calibration data. Further since the protection program and the EEPROM containing the protected data are on the same chip, it is not possible to physically remove the EEPROM from the protected environment to read the memory contents.

Upon manufacture of the module chip the password by default is set at FFFFFFFF. The program recognizes two password states, 00000000 and FFFFFFFF as null passwords and the security is deactivated for that condition. Thus the module is in condition to be loaded with secure data, a password and ID number by the engine manufacturer.

The security logic program is represented by the flow chart of FIGS. 2A and 2B. In the following description, numerals in angle brackets <nn> refer to functions in flow chart blocks bearing the corresponding reference number. When an incoming message is received from a tool or on-board device <40>, the logic examines the message code to determine the response to be sent via the SCI. If the request is for non-secure data from an on-board device such as an instrument panel or a twin engine <42> the module responds by providing non-secure on-board data <44>. If the message is a request for field service data <46>, then that data is supplied in response <48>. All other requests affect the security of the protected data. The program checks to determine whether a null password is present <50> and if so, the security is deactivated <52>. Next the program checks for a request for an ID number <54>. If ID is requested it is supplied to the requesting tool <56>.

When the message is an attempt to enter a password <58>, it is first determined if a previous attempt has been made during the same ignition cycle <60> and if so an error message to that effect is given in response <62>. If there was no previous attempt and the password is incorrect <64> a password incorrect message is given <66> and an "attempt" flag is set for subsequent use by block 60. The flag will be cleared when the ignition cycle ends, i.e., when operating voltage is removed from the module. This feature imposes a time delay which defeats a brute force attempt to gain access by rapidly trying all possible passwords. If the password is correct <64> the security is deactivated <70> and a password correct message is returned <72>. The security will remain deactivated until the operating voltage is removed to allow free access to the protected data and the password.

If a calibration read or write message is received <74> and the security is not active <76> the request will be serviced <78>, and if security is active a security violation message will be sent <80>. Similarly, if a request to change the password or initially enter a password is received <82>, and security is not active <84> it will be honored <86> and if security is active the violation message will be sent <80>. Thus changes in protected data are easily made by one who has the correct password. When a password is entered the security is activated when the operating voltage is removed from the module.

If a password has been lost and it is necessary to change the calibration of the module, and even the report of the ID number does not yield a listed password, the unit is recovered by first requesting to arm for recovery. If such a request is received <88> a recovery procedure "armed" flag is set <90>. Then if a request to recover message is received <92> and the "armed" flag has been set <94>, the calibrations are cleared from the EEPROM and the password is set to null <96>. If the "armed" flag is not set a recovery procedure error message is sent <98>. If the message does not fit any of the above categories or a response to a message has been made, the logic is reset to receive another message <100] at block 40.

It will thus be appreciated that the control module is furnished with a very high degree of security of data which must be protected while affording the user manufacturer ease of access to load or change the calibrations and even to reuse a module for which the password is unknown.