Semiconductor memory device and safe operation method thereof

Abstract

A semiconductor memory device and a method for performing security operations on the semiconductor memory device are provided. The semiconductor memory device includes a memory core having a plurality of memory cells, an on-chip processor, and a memory security controller. The on-chip processor performs on-chip data processing. The memory security controller decrypts encrypted data provided from the memory core or from the memory controller to provide the decrypted data to the on-chip processor, and encrypts result data from the on-chip processor to provide the encrypted result data to the memory core or the memory controller. By decrypting the encrypted data in the semiconductor memory device to perform on-chip data processing, data processing efficiency can be improved without reducing data security.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of Korean Patent Application No. 10-2017-0176887 filed on December 21, 2017 in the Korean Intellectual Property Office (KIPO), the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] Example embodiments relate generally to semiconductor integrated circuits, and more particularly, to a semiconductor memory device, a memory system, and a memory module. Background Art

[0004] In a system that processes or stores data, information security is a very important issue. For example, an on-chip memory may be used to protect important information or data from external attacks. The probability of exposure of important data may be reduced by storing the data in an on-chip memory formed in a host processor. However, in order to implement a processor including an on-chip memory, the size and cost may be increased. As an alternative, the important data may be encrypted, and the encrypted data may be stored in a memory external to the host device. The external memory may not be able to control the content of the encrypted data, so the efficiency of processing the encrypted data stored in the external memory may be reduced. Summary of the invention

[0005] Some example embodiments may provide a semiconductor memory device capable of improving data processing efficiency without reducing data security.

[0006] Some example embodiments may provide a memory system and a memory module including a semiconductor memory device capable of improving data processing efficiency without reducing data security.

[0007] According to an example embodiment, a semiconductor memory device includes: a memory core, which includes a plurality of memory cells; an on-chip processor, which is configured to perform on-chip data processing; and a memory security controller, which is configured to decrypt encrypted data provided from the memory core or from the memory controller to provide the decrypted data to the on-chip processor, and is configured to encrypt result data from the on-chip processor to provide the encrypted result data to the memory core or the memory controller.

[0008] According to an example embodiment, a semiconductor memory device includes: a buffer semiconductor wafer; a plurality of memory semiconductor wafers stacked with the buffer semiconductor wafer; a through silicon via electrically connecting the buffer semiconductor wafer with the plurality of memory semiconductor wafers; an on-chip processor on one of the memory semiconductor wafers, which is configured to perform on-chip data processing on input data to provide result data; and a security controller, which is configured to decrypt encrypted data to provide the decrypted data as input data to the on-chip processor, and to encrypt the result data from the on-chip processor to provide re-encrypted data.

[0009] A method for performing security operations on a semiconductor memory device, wherein the semiconductor memory device has at least a first memory chip, the first memory chip having a memory core including a plurality of memory cells, the method comprising the following steps: decrypting encrypted data provided from the memory core or from a memory controller at the first memory chip; receiving the decrypted data by an on-chip processor of the first memory chip to perform on-chip processing operations and output result data; and encrypting the result data from the on-chip processor at the first memory chip to provide the encrypted result data to the memory core or the memory controller.

[0010] A semiconductor memory device, a memory system, and a method according to example embodiments may improve data processing efficiency without reducing data security by decrypting encrypted data in the semiconductor memory device to perform an on-chip processing operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Example embodiments of the present disclosure will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings.

[0012] Figure 1 is a block diagram illustrating a memory system according to an example embodiment;

[0013] Figure 2 is a diagram illustrating data flow in a memory system according to an example embodiment;

[0014] Figure 3 is a block diagram illustrating a semiconductor memory device according to an example embodiment;

[0015] Figure 4 It is shown that the Figure 2 FIG. 1 is a diagram of an example construction of a security engine in a security controller of FIG. 1 ;

[0016] Figures 5 to 9 is a flowchart illustrating the operation of a semiconductor memory device according to an example embodiment;

[0017] Figures 10 to 13is a diagram for describing an example embodiment of generating a security key in a memory system according to an example embodiment;

[0018] Fig.14 is a diagram illustrating a key register according to an example embodiment;

[0019] Fig.15 It is shown that the Figure 2 FIG. 1 is a diagram of an example construction of a security engine in a security controller of FIG. 1 ;

[0020] Fig.16 is a diagram illustrating an example embodiment of a memory security controller included in a semiconductor memory device according to an example embodiment;

[0021] Fig.17 is an exploded perspective view of a system including stacked memory devices according to an example embodiment;

[0022] Fig.18 is an exploded perspective view of a stacked memory device according to an example embodiment;

[0023] Figures 19 to 20 is a diagram illustrating a packaging structure of a stacked memory device according to example embodiments;

[0024] Fig.21 is a diagram showing an example structure of a high bandwidth memory (HBM);

[0025] Fig. 22 , Fig.23 and Fig.24 is a diagram illustrating a memory system according to an example embodiment;

[0026] Fig.25 is a block diagram illustrating a computing system according to an example embodiment. DETAILED DESCRIPTION

[0027] Various example embodiments will be described more fully hereinafter with reference to the accompanying drawings showing some example embodiments. In the accompanying drawings, the same reference numerals always refer to the same elements. Repeated descriptions may be omitted.

[0028] Figure 1 is a block diagram illustrating a memory system according to example embodiments.

[0029] Reference Figure 1 , the memory system 10 includes a memory controller 300 and a semiconductor memory device 400 .

[0030] The memory controller 300 may control the overall operation of the semiconductor memory device 400 through the channel 20 or the interconnection device. The memory controller 300 may control the overall data exchange between the external host device and the semiconductor memory device 400. For example, the memory controller 300 may write data in the semiconductor memory device 400 in response to a request from the host device or may read data from the semiconductor memory device 400. The memory controller 300 may send an operation command CMD and an address ADD to the semiconductor memory device 400 to control the semiconductor memory device 400. The channel 20 may include a data bus for transferring data and a control bus for transferring a command CMD and an address ADD.

[0031] The memory controller 300 may include a host security controller HSCON 100. The host security controller 100 may encrypt write data to be stored in the semiconductor memory device 400 to generate encrypted data and decrypt encrypted data read from the semiconductor memory device 400.

[0032] The semiconductor memory device 400 may include a memory core MCR, a control circuit CTRL, an on-chip processor OCP, and a memory security controller MSCON 200. As described herein, a "semiconductor memory device" refers to a semiconductor chip (e.g., an integrated circuit formed on a wafer) or a semiconductor package including one or more semiconductor chips stacked on a package substrate. The term "on-chip processor" described herein refers to a processor included in a semiconductor chip or a semiconductor package for performing processing operations on data stored in or written to the semiconductor chip or the semiconductor package. The electronic device described herein may refer to such a semiconductor memory device or a device including such a semiconductor memory device, such as a memory module or a computer system. The memory core MCR may include a plurality of memory cells for storing data. The memory security controller 200 may decrypt encrypted data provided from the memory controller 300 or the memory core MCR to generate decrypted data and provide it to the on-chip processor OCP. The on-chip processor OCP may perform in-memory processing (PIM) on the decrypted data to generate and provide result data of the PIM. For example, in-memory processing refers to performing one or more operations on data, rather than simply storing or buffering data, and transformed data or result data may be obtained. In-memory processing may refer to on-chip data processing. The memory security controller 200 may encrypt the result data from the on-chip processor OCP again to generate re-encrypted data and provide it to the memory controller 300 or the memory core MCR. The memory security controller 200 may perform the same encryption and decryption as that performed by the host security controller 100.

[0033] Figure 2is a diagram illustrating a data flow in a memory system according to example embodiments.

[0034] Figure 2 The host security controller 100 included in the memory controller 300 and the memory security controller 200 , the on-chip processor OCP, and the memory core MCR included in the semiconductor memory device 400 are shown.

[0035] The host security controller 100 may include a first key provider KPRV1 and a first security engine ENG1. The first key provider KPRV1 may provide a first security key KY1, and the first security engine ENG1 may perform encryption and decryption on the first data DT1 based on the first security key KY1 to generate first encrypted data EDT1. The first encrypted data EDT1 may be transferred to the semiconductor memory device 400 as write data. In addition, the first security engine ENG1 may decrypt the second encrypted data EDT2 transferred from the semiconductor memory device 400 based on the first security key KY1 to generate second data DT2. The first data DT1 and the second data DT2 are unencrypted data or decrypted data.

[0036] The memory security controller 200 may include a second key provider KPRV2 and a second security engine ENG2. The second key provider KPRV2 may provide a second security key KY2 that is the same as the first security key KY1, and the second security engine ENG2 may decrypt the first encrypted data EDT1 provided from the host security controller 100 or the third encrypted data EDT3 provided from the memory core MCR based on the second security key KY2 to generate third data DT3. In addition, the memory security controller 200 may encrypt the fourth data DT4 corresponding to the result data of the on-chip processor OCR based on the second security key KY2 to provide the second encrypted data EDT2 to the memory controller 300 or provide the fourth encrypted data EDT4 to the memory core MCR. The third data DT3 and the fourth data DT4 are unencrypted data or decrypted data.

[0037] The first encrypted data EDT1 corresponding to the write data and the second encrypted data EDT2 corresponding to the read data may be transmitted through the data bus 21. The data bus 21 may be included in Figure 1 In channel 20.

[0038] In order to identify the first security key KY1 and the second security key KY2, security information SINF may be transmitted between the memory controller 300 and the semiconductor memory device 400. In some example embodiments, Figure 2As shown, the security information SINF may be transmitted via a sideband channel 30 that directly connects the first key provider KPRV1 with the second key provider KPRV2. Figure 1 20 in the memory system 10. According to example embodiments, the security information SINF may be transferred from the memory controller 300 to the semiconductor memory device 400, or from the semiconductor memory device 400 to the memory controller 300. The security information SINF may be transferred in a startup process, a power-on process, or a normal operation of the memory system 10. As will be described below, the security information SINF may include a security key, a seed value, and other parameters.

[0039] The first security engine ENG1 and the second security engine ENG2 can perform the same encryption and decryption based on the same security key. Each of the first security engine ENG1 and the second security engine ENG2 can be implemented as hardware, software, or a combination of hardware and software that performs encryption and decryption based on the Advanced Encryption Standard (AES), for example.

[0040] As such, the semiconductor memory device 400 and the memory system 10 according to example embodiments may improve data processing efficiency without reducing data security by decrypting encrypted data in the semiconductor memory device 400 to perform PIM.

[0041] Figure 3 is a block diagram illustrating a semiconductor memory device according to example embodiments.

[0042] Although dynamic random access memory (DRAM) is described as an example of a semiconductor memory device, the semiconductor memory device may be any of a variety of memory cell architectures, including but not limited to volatile memory architectures (such as DRAM, thyristor RAM (TRAM), and static RAM (SRAM)) or non-volatile memory architectures (such as read-only memory (ROM), flash memory, phase change RAM (PRAM), ferroelectric RAM (FRAM), magnetic RAM (MRAM), etc.

[0043] Reference Figure 3 , the semiconductor memory device 400 includes a control logic 410, an address register 420, a block control logic 430, a row address multiplexer 440, a refresh counter 445, a column address latch 450, a row decoder 460, a column decoder 470, a memory cell array 480, a sense amplifier unit 485, an input / output (I / O) gating circuit 490, a data input / output (I / O) buffer 495, an on-chip processor OCP and a memory security controller MSCON.

[0044] The memory cell array 480 may include a plurality of block arrays 480a to 480h. The row decoder 460 may include a plurality of block row decoders 460a to 460h respectively coupled to the block arrays 480a to 480h, the column decoder 470 may include a plurality of block column decoders 470a to 470h respectively coupled to the block arrays 480a to 480h, and the sense amplifier unit 485 may include a plurality of block sense amplifiers 485a to 485h respectively coupled to the block arrays 480a to 480h.

[0045] The address register 420 may receive an address ADDR including a block address BANK_ADDR, a row address ROW_ADDR, and a column address COL_ADDR from the memory controller. The address register 420 may provide the received block address BANK_ADDR to the block control logic 430, may provide the received row address ROW_ADDR to the row address multiplexer 440, and may provide the received column address COL_ADDR to the column address latch 450.

[0046] The block control logic 430 may generate a block control signal in response to the block address BANK_ADDR. One of the block row decoders 460a to 460h corresponding to the block address BANK_ADDR may be activated in response to the block control signal, and one of the block column decoders 470a to 470h corresponding to the block address BANK_ADDR may be activated in response to the block control signal.

[0047] The row address multiplexer 440 may receive the row address ROW_ADDR from the address register 420, and may receive the refresh row address REF_ADDR from the refresh counter 445. The row address multiplexer 440 may selectively output the row address ROW_ADDR or the refresh row address REF_ADDR as the row address RA. The row address RA output from the row address multiplexer 440 may be applied to the block row decoders 460a to 460h.

[0048] The activated one of the block row decoders 460a to 460h may decode the row address RA output from the row address multiplexer 440 and may activate a word line corresponding to the row address RA. For example, the activated block row decoder may apply a word line driving voltage to the word line corresponding to the row address RA.

[0049] The column address latch 450 may receive the column address COL_ADDR from the address register 420 and may temporarily store the received column address COL_ADDR. In some embodiments, in the burst mode, the column address latch 450 may generate a column address that is increased relative to the received column address COL_ADDR. The column address latch 450 may apply the temporarily stored or generated column address to the block column decoders 470a to 470h.

[0050] The activated one of the block column decoders 470 a to 470 h may decode the column address COL_ADDR output from the column address latch 450 and may control the input / output gating circuit 490 to output data corresponding to the column address COL_ADDR.

[0051] The I / O gating circuit 490 may include a circuit system for gating input / output data. The I / O gating circuit 490 may also include a read data latch for storing data output from the block arrays 480a to 480h and a write driver for writing data to the block arrays 480a to 480h.

[0052] Data to be read from one of the block arrays 480a to 480h may be sensed by a sense amplifier 485 coupled to the one of the block arrays from which the data is read, and may be stored in a read data latch. The data stored in the read data latch may be provided to a memory controller via a data I / O buffer 495. Data DQ to be written to one of the block arrays 480a to 480h may be provided from the memory controller to the data I / O buffer 495. The write driver may write the data DQ in one of the block arrays 480a to 480h.

[0053] The control logic 410 may control the operation of the semiconductor memory device 400. For example, the control logic 410 may generate a control signal for the semiconductor memory device 400 to perform a write operation or a read operation. The control logic 410 may include a command decoder 411 that decodes a command CMD received from a memory controller and a mode register 412 that sets an operation mode of the semiconductor memory device 400. For example, the command decoder 411 may generate a control signal corresponding to the command CMD by decoding a write enable signal, a row address strobe signal, a column address strobe signal, a chip select signal, etc.

[0054] The memory security controller MSCON may decrypt the encrypted data EDT provided from the memory controller 300 or the memory core MCR (e.g., a block array) to generate the decrypted data DDT and provide it to the on-chip processor OCP. The on-chip processor OCP may perform in-memory processing (PIM) on the decrypted data DDT to generate and provide the result data RDT of the PIM. The memory security controller MSCON may encrypt the result data RDT from the on-chip processor OCP again to generate the encrypted result data REDT and provide it to the memory controller 300 or the memory core MCR. In some embodiments, the encrypted result data REDT may be encrypted using the same key as the key used when encrypting the data to form the encrypted data EDT, so the encrypted result data REDT in this case may be referred to as re-encrypted data.

[0055] Figure 4 It is shown that the Figure 2 FIG. 1 is a diagram of an example configuration of a security engine in a security controller. In addition, Figure 4 The on-chip processor OCP and memory core MCR are shown in FIG.

[0056] Reference Figure 4 , the first security engine 101 of the host security controller 100 may include a first encryption machine ENC1 and a first decryption machine EDC1, and the second security engine 201 of the memory security controller 200 may include a second encryption machine ENC2, a second decryption machine DEC2, a first selector MX1, a second selector MX2, a third selector MX3, and a fourth selector MX4. The encryption machine and decryption machine described herein may be an encryption circuit or a decryption circuit including a circuit system configured to encrypt data or decrypt data, and each selector may be a selection circuit including a circuit system configured to select between two or more inputs or outputs.

[0057] The first encryption engine ENC1 encrypts the first data DT1 based on the first security key KY1 to generate the first encrypted data EDT1 and provides the first encrypted data EDT1 to the semiconductor memory device through the first data path 25. The first selector MX1 ​​selects one of the first encrypted data EDT1 and the second encrypted data EDT2 in response to the first selection signal SEL1 to provide the third encrypted data EDT3 to the memory core MCR. The second selector MX2 selects one of the first encrypted data EDT1 and the seventh encrypted data EDT7 in response to the second selection signal SEL2 to provide the fourth encrypted data EDT4. The second decryption engine DEC2 decrypts the fourth encrypted data EDT4 based on the second security key KY2 to generate the second data DT2 corresponding to the decrypted data. The on-chip processor OCP performs PIM on the second data DT2 to generate the third data DT3 corresponding to the result data. The second encryption engine ENC2 encrypts the third data DT3 again based on the second security key KY2 to generate the fifth encrypted data EDT5 corresponding to the encrypted result data. The third selector MX3 provides the fifth encrypted data EDT5 as the second encrypted data EDT2 to the first selector MX1 ​​in response to the third selection signal SEL3, or provides it as the eighth data EDT8 to the memory controller through the second path 26. The fourth selector MX4 provides the sixth encrypted data EDT6 as the seventh encrypted data EDT7 from the memory core MCR to the second selector MX2 in response to the fourth selection signal SEL4, or provides it as the eighth data EDT8 to the memory controller through the second path 26. The first decryptor DEC1 decrypts the eighth data EDT8 based on the first security key KY1 to generate the fourth data DT4.

[0058] For example, the memory controller may be configured based on a command from the memory controller. Figure 3 The control logic 410 in generates the first to fourth selection signals SEL1 to SEL4. If a bidirectional data bus connects the memory controller and the semiconductor memory device, the first data bus 25 and the second data bus 26 may be the same bus.

[0059] In the field of disclosed technology, according to conventional practice, embodiments are described and shown in the accompanying drawings according to functional blocks, units and / or modules. It should be understood by those skilled in the art that electronic (or optical) circuits such as logic circuits, discrete components, microprocessors, hard-wired circuits, memory elements, wiring connections, etc., which can be formed using semiconductor-based manufacturing technology or other processing technology, are physically implemented to realize these blocks, units and / or modules. In the case of realizing blocks, units and / or modules by microprocessors or similar elements, they can be programmed with software (e.g., microcode) to perform various functions discussed herein, and they can be optionally driven by firmware and / or software. Alternatively, each block, unit and / or module can be implemented by dedicated hardware, or implemented as a combination of dedicated hardware for performing some functions and a processor (e.g., one or more programmed microprocessors and associated circuit systems) for performing other functions. In addition, without departing from the scope of the inventive concept, each block, unit and / or module of the embodiment can be physically divided into two or more mutually coordinated and discrete blocks, units and / or modules. Furthermore, without departing from the scope of the inventive concept, the blocks, units and / or modules of the embodiments may be physically combined into more complex blocks, units and / or modules. A specific block is referred to herein as an engine.

[0060] In the following, reference will be made to Figures 5 to 9 Describe the adoption Figure 4 Example operations of the constructed memory system.

[0061] Figure 5 is a flowchart illustrating a normal write operation of a semiconductor memory device according to example embodiments.

[0062] Reference Figure 4 and Figure 5 , the memory controller transmits a normal write command WR having a target address TADD corresponding to the write address to the semiconductor memory device (S110). In addition, the memory controller transmits the first encrypted data EDT1 corresponding to the write data WDATA to the semiconductor memory device (S120). The first selector MX1 ​​selects the first encrypted data EDT1 in response to the first selection signal SEL1 and outputs the first encrypted data EDT1 as the third encrypted data EDT3. The semiconductor memory device writes the third encrypted data EDT3 to the target address TADD of the memory core MCR (S130).

[0063] Figure 6 is a flowchart illustrating a normal read operation of a semiconductor memory device according to example embodiments.

[0064] Reference Figure 4 and Figure 6, the memory controller transmits a normal read command RD having a source address SADD corresponding to the read address to the semiconductor memory device (S210). The semiconductor memory device reads out the sixth encrypted data EDT6 from the source address SADD of the memory core MCR (S220). The fourth selector MX4 provides the sixth encrypted data EDT6 as the eighth encrypted data EDT8 corresponding to the read data RDATA to the memory controller through the second data path 26 in response to the fourth selection signal SEL4 (S230).

[0065] Figure 7 is a flowchart illustrating processing and write operations of a semiconductor memory device according to example embodiments.

[0066] Reference Figure 4 and Figure 7 , the memory controller transmits a process and a write command PWR having a target address TADD corresponding to the write address to the semiconductor memory device (S310). In addition, the memory controller transmits the first encrypted data EDT1 corresponding to the write data WDATA to the semiconductor memory device (S320). The second selector MX2 selects the first encrypted data EDT1 and outputs the first encrypted data EDT1 as the fourth encrypted data EDT4. The second decryptor DEC2 decrypts the fourth encrypted data EDT4 based on the second security key KY2 to generate the second data DT2 (S330). The on-chip processor OCP performs PIM of the second data DT2 to generate the third data DT3 (S340). The second encryption engine ENC2 encrypts the third data DT3 based on the second security key KY2 to generate the fifth encrypted data EDT5 (S350). The third selector MX3 provides the fifth encrypted data EDT5 as the second encrypted data EDT2 to the first selector MX1 ​​in response to the third selection signal SEL3. The first selector MX1 ​​selects the second encrypted data EDT2 in response to the first selection signal SEL1, and outputs the second encrypted data EDT2 as the third encrypted data EDT3. The semiconductor memory device writes the third encrypted data EDT3 to the target address TADD of the memory core MCR (S360).

[0067] Figure 8 is a flowchart illustrating processing and read operations of a semiconductor memory device according to example embodiments.

[0068] Reference Figure 4 and Figure 8, the memory controller transmits a process and a read command PRD having a source address SADD corresponding to the read address to the semiconductor memory device (S410). The semiconductor memory device reads out the sixth encrypted data EDT6 from the source address SADD of the memory core MCR (S420). The fourth selector MX4 provides the sixth encrypted data EDT6 as the seventh encrypted data EDT7 to the second selector MX2 in response to the fourth selection signal SEL4. The second selector MX2 selects and outputs the seventh encrypted data EDT7 as the fourth encrypted data EDT4 in response to the second selection signal SEL2. The second decryptor DEC2 decrypts the fourth encrypted data EDT4 based on the second security key KY2 to generate the second data DT2 (S430). The on-chip processor OCP performs PIM of the second data DT2 to generate the third data DT3 (S440). The second encryption engine ENC2 encrypts the third data DT3 based on the second security key KY2 to generate the fifth encrypted data EDT5 (S450). The third selector MX3 provides the fifth encrypted data EDT5 as the eighth encrypted data EDT8 corresponding to the read data RDATA to the memory controller through the second data path 26 in response to the third selection signal SEL3 (S460).

[0069] Fig. 9 is a flowchart illustrating an internal processing operation of a semiconductor memory device according to example embodiments.

[0070] Reference Figure 4 and Fig. 9, the memory controller transmits an internal processing command INP having a source address SADD corresponding to a read address and a target address TADD corresponding to a write address to the semiconductor memory device (S510). The semiconductor memory device reads out the sixth encrypted data EDT6 from the source address SADD of the memory core MCR (S520). The fourth selector MX4 provides the sixth encrypted data EDT6 as the seventh encrypted data EDT7 to the second selector MX2 in response to the fourth selection signal SEL4. The second selector MX2 selects and outputs the seventh encrypted data EDT7 as the fourth encrypted data EDT4 in response to the second selection signal SEL2. The second decryptor DEC2 decrypts the fourth encrypted data EDT4 based on the second security key KY2 to generate the second data DT2 (S530). The on-chip processor OCP performs PIM of the second data DT2 to generate the third data DT3 (S540). The second encryption engine ENC2 encrypts the third data DT3 based on the second security key KY2 to generate the fifth encrypted data EDT5 (S550). The third selector MX3 provides the fifth encrypted data EDT5 as the second encrypted data EDT2 to the first selector MX1 ​​in response to the third selection signal SEL3. The first selector MX1 ​​selects the second encrypted data EDT2 in response to the first selection signal SEL1 and outputs the second encrypted data EDT2 as the third encrypted data EDT3. The semiconductor memory device writes the third encrypted data EDT3 to the target address TADD of the memory core MCR (S560).

[0071] Figures 10 to 13 is a diagram for describing an example embodiment of generating a security key in a memory system according to example embodiments.

[0072] Reference Fig.10 , the host security controller 102 of the memory controller may include a first key register KREG1 and a first security engine ENG1, and the memory security controller 202 of the semiconductor memory device may include a second key register KREG2 and a second security engine ENG2.

[0073] The first key register KREG1 may store and provide a first security key KY1. The first security engine ENG1 may perform encryption and decryption on input data based on the first security key KY1. The second key register KREG2 may receive the first security key KY1 from the memory controller to store and provide the first security key KY1 as a second security key KY2. The second security engine ENG2 may perform encryption and decryption on input data based on the second security key KY2.

[0074] Reference Fig.11The host security controller 103 of the memory controller may include a first seed register SREG1, a first on-chip timer OCTMR1, a first key generator KGEN1, a first key register KREG1 and a first security engine ENG1, and the memory security controller 203 of the semiconductor memory device may include a second seed register SREG2, a second on-chip timer OCTMR2, a second key generator KGEN2, a second key register KREG2 and a second security engine ENG2.

[0075] The first seed register SREG1 may store and provide a first seed value SD1, and the first on-chip timer OCTMR1 may provide first time information TM1. The first key generator KGEN1 may generate a first security key KY1 based on the first seed value SD1 and the first time information TM1. The first key register KREG1 may store and provide the first security key KY1. The first security engine ENG1 may perform encryption and decryption on input data based on the first security key KY1.

[0076] The second seed register SREG2 may receive the first seed value SD1 from the first seed register SREG1 to store and provide the first seed value SD1 as the second seed value SD2. The second on-chip timer OCTMR2 may provide the second time information TM2, and the second on-chip timer OCTMR2 may be synchronized with the first on-chip timer OCTMR1. The second key generator KGEN2 may generate a second security key KY2 based on the second seed value SD2 and the second time information TM2. The second key register KREG2 may store and provide the second security key KY2. The second security engine ENG2 may perform encryption and decryption on input data based on the second security key KY2.

[0077] In some example embodiments, each of the first key generator KGEN1 and the second key generator KGEN2 may include a random number generator configured to generate a random number for a security key based on a seed value and time information.

[0078] In this way, the memory controller may not directly transfer the security key to the semiconductor memory device. The security key may be generated in the semiconductor memory device using the seed value and the time information, thereby improving the security level.

[0079] Reference Fig.12The host security controller 104 of the memory controller may include a first seed register SREG1, a first on-chip timer OCTMR1, a first key generator KGEN1, a first key register KREG1 and a first security engine ENG1, and the memory security controller 203 of the semiconductor memory device may include a second seed register SREG2, a second key generator KGEN2, a second key register KREG2 and a second security engine ENG2.

[0080] The first seed register SREG1 may store and provide a first seed value SD1, and the first on-chip timer OCTMR1 may provide first time information TM1. The first key generator KGEN1 may generate a first security key KY1 based on the first seed value SD1 and the first time information TM1. The first key register KREG1 may store and provide the first security key KY1. The first security engine ENG1 may perform encryption and decryption on input data based on the first security key KY1.

[0081] The second seed register SREG2 may receive the first seed value SD1 from the first seed register SREG1 to store and provide the first seed value SD1 as the second seed value SD2. The second key generator KGEN2 may generate a second security key KY2 based on the second seed value SD2 provided from the first on-chip timer OCTMR1 and the first time information TM1. The second key register KREG2 may store and provide the second security key KY2. The second security engine ENG2 may perform encryption and decryption on input data based on the second security key KY2.

[0082] Reference Fig.13 The host security controller 105 of the memory controller may include a first seed register SREG1, a first key generator KGEN1, a first key register KREG1 and a first security engine ENG1, and the memory security controller 205 of the semiconductor memory device may include a second seed register SREG2, a second key generator KGEN2, a second key register KREG2 and a second security engine ENG2.

[0083] The first seed register SREG1 may store and provide a first seed value SD1. The first key generator KGEN1 may generate a first security key KY1 based on the first seed value SD1 and time information TM provided from the system timer SYSTMR. The first key register KREG1 may store and provide the first security key KY1. The first security engine ENG1 may perform encryption and decryption on input data based on the first security key KY1.

[0084] The second seed register SREG2 may receive the first seed value SD1 from the first seed register SREG1 to store and provide the first seed value SD1 as the second seed value SD2. The second key generator KGEN2 may generate a second security key KY2 based on the second seed value SD2 and the time information TM provided from the system timer SYSTMR. The second key register KREG2 may store and provide the second security key KY2. The second security engine ENG2 may perform encryption and decryption on input data based on the second security key KY2.

[0085] Fig.14 is a diagram illustrating a key register according to an example embodiment.

[0086] Reference Fig.14 , the key register may include tag values ​​S and N indicating whether a security scenario is applied to each of the memory areas REG_A, REG_B, and REG_C. For example, a first tag value S may be assigned to the memory areas REG_A and REG_B in which encrypted data is stored, and a second tag value N may be assigned to the memory area REG_C in which unencrypted data is stored, according to the security scenario. Security keys KY_A and KY_B may be assigned to the memory areas REG_A and REG_B in which the security scenario is applied.

[0087] The memory regions REG_A, REG_B, and REG_C may be divided based on the addresses of the semiconductor memory device. In this case, Figure 3 The control logic 410 in the semiconductor memory device may generate a control signal indicating a memory area corresponding to the address ADD from the memory controller. Fig.14 The key register shown may provide a corresponding security key based on a control signal. The control logic 410 may generate a corresponding security key based on a command CMD and an address ADD from a memory controller. Fig.15 selection signal.

[0088] Fig.15 It is shown that the Figure 2 FIG. 1 is a diagram of an example configuration of a security engine in a security controller. In addition, Fig.15 The on-chip processor OCP and memory core MCR are shown in FIG.

[0089] Reference Fig.15 The first security engine 106 of the host security controller 100 may include a first encryption machine ENC1, a first decryption machine EDC1, an output selector MXO and an input selector MXI, and the second security engine 206 of the memory security controller 200 may include a second encryption machine ENC2, a second decryption machine DEC2, a first selector MX1, a second selector MX2, a third selector MX3, a fourth selector MX4 and a fifth selector MX5.

[0090] The first encryption engine ENC1 encrypts the first data DT1 based on the first security key KY1 to generate the first encrypted data as the second data DT2. The output selector MXO selects one of the first data DT1 and the second data DT2, and provides the selected data as the third data DT3 to the semiconductor memory device through the first data path 25. The first selector MX1 ​​selects one of the third data DT3 and the fourth data DT4 in response to the first selection signal SEL1 to provide the fifth data DT5 to the memory core MCR. The second selector MX2 selects one of the third data DT3 and the twelfth data DT12 in response to the second selection signal SEL2 to provide the sixth data DT6, which may be the encrypted data. The second decryption engine DEC2 decrypts the sixth data DT6 based on the second security key KY2 to generate the seventh data DT7 corresponding to the decrypted data. The fifth selector MX5 selects one of the sixth data DT6 and the seventh data DT7 in response to the fifth selection signal SEL5 to output the eighth data DT8. The on-chip processor OCP performs PIM on the eighth data DT8 to generate the ninth data DT9 corresponding to the result data. The second encryption machine ENC2 encrypts the ninth data DT9 again based on the second security key KY2 to generate the tenth data DT10 corresponding to the encrypted result data. The third selector MX3 selects one of the ninth data DT9 and the tenth data DT10 in response to the third selection signal SEL3, and provides the selected signal to the first selector MX1 ​​as the fourth data DT4, or provides it to the memory controller through the second path 26 as the thirteenth data DT13. The fourth selector MX4 provides the eleventh data DT11 from the memory core MCR in response to the fourth selection signal SEL4, and provides it to the second selector MX2 as the twelfth data DT12 (which may be encrypted data) or provides it to the memory controller through the second path 26 as the thirteenth data DT13. The first decryption machine DEC1 decrypts the thirteenth data DT13 based on the first security key KY1 to generate the fourteenth data DT14. The input selector MXI selects one of the thirteenth data DT14 and the fourteenth data DT14 in response to the input selection signal SELI to output the fifteenth data DT15.

[0091] and Figure 4 Compared with the second security engine 201, Fig.15 The second security engine 206 in further includes a fifth selector MX5. The selector including the second selector MX2 and the fifth selector MX5 may provide the received data (that is, the third data DT3 or the twelfth data DT12) to the second decryption engine DEC2 when the received data corresponds to encrypted data, and directly provide the received data to the on-chip processor when the received data corresponds to unencrypted data.

[0092] Can be used as Fig.15 The illustrated architecture performs various combinations of read operations, write operations, and PIM on either encrypted or unencrypted data.

[0093] Fig.16 is a diagram illustrating an example embodiment of a memory security controller included in a semiconductor memory device according to example embodiments.

[0094] Reference Fig.16 , the memory security controller 207 may include a key provider KPRV, a security engine ENG, and a configuration controller CONFCTR. As described above, the key provider KPRV may store and provide a security key KY that is the same as a security key of the memory controller based on security information from the memory controller.

[0095] The security engine ENG may be implemented as a reconfigurable configuration. In some example embodiments, the security engine ENG may include a field programmable gate array (FPGA). The configuration controller CONFCTR may program the security engine ENG to have the same configuration as the security engine of the memory controller based on information from the memory controller. For example, the configuration controller CONFCTR may program the security engine ENG based on a command CMD from the memory controller, and provide a resulting signal RSLT indicating whether the programming of the memory controller succeeded or failed. According to example embodiments, the programming of the security engine ENG may be performed in a chip packaging stage or a system assembly stage, in which case the configuration controller CONFCTR may be omitted.

[0096] In some example embodiments, the security engine ENG may be implemented in a software form. In this case, an instruction set for an encryption algorithm may be provided from a memory controller to a semiconductor memory device, and the security engine may be implemented using the instruction set.

[0097] According to the development of hardware and software, the requirements for the memory capacity and operation speed of memory devices are constantly increasing. Memory bandwidth and delay are performance bottlenecks in many processing systems. The memory capacity can be increased by using a stacked memory device in which multiple semiconductor devices are stacked in a package of a memory chip. The stacked semiconductor wafers can be electrically connected by using through silicon vias or through substrate vias (TSV). This stacking technology can increase the memory capacity and can also suppress the negative effects of bandwidth and delay. Generally, system memory devices and other large-scale memories are usually implemented as being separated from other components of the system. Each access of an external device to a stacked memory device requires data communication between stacked semiconductor wafers, so each access can cause a negative impact of two inter-device bandwidths and inter-device delays. Therefore, when the task of an external device requires multiple accesses to the stacked memory device, the inter-device bandwidth and inter-device delay have a serious impact on the processing efficiency and power consumption of the system.

[0098] Hereinafter, example embodiments of a stacked semiconductor device and a system including the stacked semiconductor device are described.

[0099] Fig.17 is an exploded perspective view of a system including stacked memory devices according to example embodiments.

[0100] Reference Fig.17 , the system 50 includes a stacked memory device 1000 and a host device 2000 .

[0101] The stacked memory device 1000 may include a buffer semiconductor wafer or a logic semiconductor wafer 1010, a plurality of memory semiconductor wafers 1070 and 1080 stacked with the buffer semiconductor wafer 1010, and through silicon vias TSVs electrically connecting the semiconductor wafers 1010, 1070, and 1080. The memory semiconductor wafers 1070 and 1080 may include memory integrated circuits MEM1071 and 1081, respectively. Fig.17 A non-limiting example of one buffer semiconductor die and two memory semiconductor dies is shown. For example, two or more logic semiconductor dies and one, three or more memory semiconductor dies may be included in the Fig.17 In the stacking structure. In addition, Fig.17 A non-limiting example is shown in which memory semiconductor wafers 1070 and 1080 are stacked vertically with buffer semiconductor wafer 1010. As will be described below with reference to Fig.19 , the memory semiconductor chips 1070 and 1080 may be vertically stacked, and the buffer semiconductor chip 1010 may not be stacked with the memory semiconductor chips 1070 and 1080, but may be electrically connected to the memory semiconductor chips 1070 and 1080 through an insert and / or a substrate.

[0102] The buffer semiconductor die 1010 may include a memory interface MIF 1020 , a control circuit CTRL 1030 , an on-chip processor OCP 1040 , and a memory security controller MSCON 1050 .

[0103] The memory interface 1020 may communicate with an external device such as a host device 2000 through the interconnect device 20. The control circuit 1030 may control the overall operation of the stacked memory device 1000. The on-chip processor 1040 performs processing in memory (PIM). As described above, the memory security controller 1050 may be used to implement decryption of data input to the PIM and data encryption of result data of the on-chip processor 1040.

[0104] The host device 2000 may include a host interface HIF 2110 and processor cores CR1 2120 and CR2 2130. The host interface 2110 may perform communication with an external device such as the stacked memory device 1000 through the interconnection device 12. The host device 2000 may include the above-described host security controller HSCON.

[0105] Fig.18 is an exploded perspective view of a stacked memory device according to an example embodiment. Fig.17 Duplicate description.

[0106] Reference Fig.18 , a stacked memory device 1000 a includes a buffer semiconductor wafer 1010 , a plurality of memory semiconductor wafers 1070 and 1080 , and through silicon vias TSVs electrically connecting the semiconductor wafers 1010 , 1070 , and 1080 .

[0107] like Fig.18 As shown, the global processor GP 1041 may be formed in the buffer semiconductor wafer 1010. The global processor 1041 may perform a global sub-process corresponding to a portion of the process in memory (PIM). In addition, the global security controller GSC 1051 may be formed in the buffer semiconductor wafer 1010. The global security controller 1051 may perform encryption and decryption for input data and output data of the global processor 1041.

[0108] One or more local processors LP1 1072 and LP2 1082 may be formed in the memory semiconductor wafers 1070 and 1080, respectively. The local processors 1072 and 1082 may perform local sub-processing corresponding to other parts of the PIM. In addition, one or more local security controllers LSC1 1073 and LSC2 1083 may be formed in the memory semiconductor wafers 1070 and 1080, respectively. The local security controllers 1073 and 1083 may perform encryption and decryption for input data and output data of the local processors 1072 and 1082.

[0109] In this way, PIM can be distributedly executed using a global processor and a global security controller in the buffer semiconductor die and a local processor and a local security controller in the memory semiconductor die. Through the effective combination of PIM and data security, operation time and power consumption can be reduced.

[0110] Fig.19 and Fig. 20 is a diagram illustrating a package structure of a stacked memory device according to example embodiments.

[0111] Reference Fig.19 , the memory device 1000b may be a memory package and may include a substrate substrate or an interposer ITP and a stacked memory device stacked on the interposer ITP. The stacked memory device may include a logic semiconductor wafer LSD (or a buffer semiconductor wafer) and a plurality of memory semiconductor wafers MSD1 to MSD4.

[0112] Reference Fig. 20 , the memory device 1000c may be a memory package, and may include a base substrate BSUB and a stacked memory device stacked on the base substrate BSUB. The stacked memory device may include a logic semiconductor wafer LSD and a plurality of memory semiconductor wafers MSD1 to MSD4.

[0113] Fig.19 A structure is shown in which memory semiconductor wafers MSD1 to MSD4 other than the logic semiconductor wafer LSD are vertically stacked and the logic semiconductor wafer LSD is electrically connected to the memory semiconductor wafers MSD1 to MSD4 through an interposer ITP or a base substrate. Fig. 20 A structure in which the logic semiconductor wafer LSD and the memory semiconductor wafers MSD1 to MSD4 are vertically stacked is shown.

[0114] The global processor GP and the global security controller GSC may be formed in the logic semiconductor wafer LSD, and the local processors LP1 to LP4 and the local security controllers LSC1 to LSC4 may be formed in the memory semiconductor wafers MSD1 to MSD4. Through this configuration, a distributed PIM of encrypted data according to example embodiments may be performed.

[0115] The substrate base plate BSUB may be the same as the insert part ITP, or include the insert part ITP. The substrate base plate BSUB may be a printed circuit board (PCB). External connection elements such as conductive bumps BMP may be formed on the lower surface of the substrate base plate BSUB, and internal connection elements such as conductive bumps may be formed on the upper surface of the substrate base plate BSUB. In some example embodiments, the semiconductor wafer LSD and MSD1 to MSD4 may be electrically connected via through silicon vias. In other example embodiments, the semiconductor wafer LSD and MSD1 to MSD4 may be electrically connected via bonding wires. In other example embodiments, the semiconductor wafer LSD and MSD1 to MSD4 may be electrically connected via a combination of through silicon vias and bonding wires. Fig.19 In an example embodiment of FIG. 1 , the logic semiconductor wafer LSD may be electrically connected to the memory semiconductor wafers MSD1 to MSD4 through a conductor pattern formed in the interposer ITP. The stacked semiconductor wafers LSD and MSD1 to MSD4 may be packaged using a sealant such as a resin RSN.

[0116] Fig.21 is a diagram showing an example structure of a high bandwidth memory (HBM).

[0117] Reference Fig.21 , HBM 1100 can be constructed as a stack having multiple DRAM semiconductor wafers 1120, 1130, 1140, and 1150. The stacked HBM can be optimized through multiple independent interfaces called channels. Each DRAM stack can support up to 8 channels according to the HBM standard. Fig.21 An example stack including four DRAM semiconductor dies 1120, 1130, 1140, and 1150 is shown, and each DRAM semiconductor die supports two channels CHANNEL0 and CHANNEL1.

[0118] Each channel provides access to an independent set of DRAM blocks. A request from one channel may not access data attached to a different channel. Channels are independently timed and do not need to be synchronized. HBM 1100 may also include an interface wafer 1110 or a logic wafer arranged at the bottom of the stacked structure to provide signal routing and other functions. Some functions for DRAM semiconductor wafers 1120, 1130, 1140, and 1150 may be implemented in interface wafer 1110.

[0119] At least one of the DRAM semiconductor wafers 1120 , 1130 , 1140 , and 1150 may include an on-chip processor and a memory security controller according to example embodiments to perform PIM of encrypted data as described above.

[0120] Fig. 22 , Fig.23 and Fig.24 is a diagram illustrating a memory system according to example embodiments.

[0121] like Fig. 22 , Fig.23 and Fig.24 As shown, each of the memory systems 70a, 70b, and 70c may include each of the memory modules 1200a, 1200b, and 1200c and each of the memory controllers 200a, 200b, and 200c, respectively. Each of the memory modules 1200a, 1200b, and 1200c may include a module substrate and a plurality of memory chips 401a to 401h mounted on the module substrate. Fig. 22 , Fig.23 and Fig.24 A non-limiting example of eight memory chips 401 a to 401 h is shown, however, the number of memory chips included in each memory module may be determined differently.

[0122] Reference Fig. 22 , the memory module 1200a can be connected to the memory controller 200a via the data bus 1210 and the control bus 1220. The memory module 1200a can be inserted into a socket connector of a larger memory system or computing system. The electrical connector (or pin) of the memory module 1200a can be connected to the electrical contacts of the socket connector. The electrical connector and buses 1210 and 1220 connected to the electrical contacts allow direct access to the memory buffer or buffer chip 1270a and indirect access to the memory chips 401a to 401h of the memory module 1200a. The data bus 1210 may include signal lines (conductive wiring) for transmitting data signals DQ and data strobe signals DQS, and the control bus 1220 includes at least one of a command (CMD) line and / or an address (ADD) line.

[0123] The data bus 1210 and the control bus 1220 are directly connected to the buffer chip 1270a via corresponding sockets / pins and bus signal line arrangements. In turn, the buffer chip 1270a is connected to the corresponding memory chips 401a to 401h via at least a commonly connected first bus 1230 and a separately connected second bus 1240a to 1240h from a specific port of the buffer chip 1270a to a corresponding port of the memory chips 401a to 401h. The buffer chip 1270a can be used to pass received commands and / or addresses received from the memory controller 200a via the control bus 1220 to the corresponding memory chips 401a to 401h via the first bus 1230.

[0124] The buffer chip 1270a may transfer write data DQ (i.e., data to be written to one or more of the memory chips 400a to 400h) and a data strobe signal DQS received from the memory controller 200a via the data bus 1210 to the memory chips 401a to 401h via the corresponding second buses 1240a to 1240h. Alternatively, the buffer chip 1270a may transfer read data DQ (data retrieved from one or more of the memory chips 401a to 401h) obtained from one or more of the memory chips 401a to 401h via the second buses 1240a to 1240h to the memory controller 200a via the data bus 1210.

[0125] The buffer chip 1270a may additionally include the global processor GP and the global security controller GSC as described above, and the memory chips 400a to 400h may include the local processor LP and the local security controller LSC as described above.

[0126] Reference Fig.23 , the memory module 1200b includes a plurality of memory chips 402a to 402h, a command (CMD) / address (ADD) register 1270b, and data buffer chips 250a to 250h respectively connected to the memory chips 402a to 402h. The CMD / ADD register 1270b receives command and address information from the memory controller 200b via the control bus 1220, and then buffers / re-drives the command and address information. The command and address information output from the CMD / ADD register 1270b is provided to the memory chips 402a to 402h via the commonly connected first bus 1230.

[0127] The data buffer chips 250a to 250h are connected between the memory chips 402a to 402h, respectively. Each of the data buffer chips 250a to 250h is configured to receive the write data signal DQ and the data strobe signal DQS and provide them to a corresponding one of the memory chips 402a to 402h while communicating with the memory controller 200b via the data bus 1210. In a similar manner, each of the data buffer chips 250a to 250h can be used to receive, buffer, and transfer the read data signal DQ and the data strobe signal DQS retrieved from its corresponding one of the memory chips 402a to 402h to the memory controller 200b via the data bus 1210.

[0128] Each of the data buffer chips 250 a to 250 h may include the above-mentioned on-chip processor OCP and memory security controller MSCON.

[0129] Reference Fig.24 , the memory module 1200c includes a plurality of memory chips 403a to 403h and a CMD / ADD register chip 1270c. As described above, the CMD / ADD register chip 1270c receives command and address information from the memory controller 200c via the control bus 1220, and then buffers and re-drives the command and address information. The command and address information provided by the CMD / ADD register chip 1270c can be transmitted to the corresponding memory chips 403a to 403h via the first bus 1230.

[0130] Each of the memory chips 403a to 403h is connected to the memory controller 200c via a corresponding one of the plurality of data buses 1210a to 1210h, so that each memory chip is directly connected to the memory controller 200c via wiring to receive and transfer the data signal DQ and the data strobe signal DQS. Each of the memory chips 403a to 403h can receive the write data signal DQ and the data strobe signal DQS from the memory controller 200c via a corresponding one of the data buses 1210a to 1210h respectively connected to the memory chips 403a to 403h, and can also transfer the read data signal DQ and the data strobe signal DQS retrieved from each of the memory chips 403a to 403h to the memory controller 200c via one of the data buses 1210a to 1210h.

[0131] Each of the memory chips 403 a to 403 h may include the above-mentioned on-chip processor OCP and memory security controller MSCON.

[0132] Fig.25 is a block diagram illustrating a computing system according to an example embodiment.

[0133] Reference Fig.25 , the computing system 1300 includes a processor 1310 , an input / output hub (IOH) 1320 , an input / output controller hub (ICH) 1330 , at least one memory module 1340 , and a graphic card 1350 .

[0134] The processor 1310 may perform various computing functions such as executing specific software for performing specific calculations or tasks. The processor 1310 may include a memory controller MC 1311 for controlling the operation of the memory module 1340. The memory controller 1311 may include the above-mentioned host security controller HSCON 1312. The memory module 1340 may include the above-mentioned at least one memory chip, the on-chip processor OCP 1341, and the memory security controller MSCON 1342. According to an example embodiment, the memory security controller 1342 may perform the same encryption and decryption as the host security controller 1312 to support the PIM of the on-chip processor 1341.

[0135] The input / output hub 1320 may manage data transfer between the processor 1310 and a device such as a graphics card 1350. The input / output hub 1320 may be coupled to the processor 1310 via various interfaces. For example, the interface between the component and the input / output hub 1320 may be an accelerated graphics port (AGP) interface, a peripheral component interface express (PCIe), a communication stream architecture (CSA) interface, etc. The graphics card 1350 may be coupled to the input / output hub 1320 via AGP or PCIe. The graphics card 1350 may control a display device (not shown) for displaying an image.

[0136] The input / output controller hub 1330 may perform data buffering and interface arbitration to efficiently operate various system interfaces. The input / output controller hub 1330 may be coupled to the input / output hub 1320 via an internal bus such as a direct media interface (DMI), a hub interface, an enterprise south bridge interface (ESI), PCIe, etc. The input / output controller hub 1330 may provide various interfaces with peripheral devices. For example, the input / output controller hub 1330 may provide a universal serial bus (USB) port, a serial advanced technology attachment (SATA) port, a general purpose input / output (GPIO), a low pin count (LPC) bus, a serial peripheral interface (SPI), PCI, PCIe, etc.

[0137] As described above, a semiconductor memory device, a memory system, and a memory module according to example embodiments may improve data processing efficiency without reducing data security by decrypting encrypted data in a semiconductor memory device to perform process-in-memory (PIM).

[0138] The inventive concept can be applied to any electronic device and system requiring a PIM of encrypted data. For example, the inventive concept can be applied to systems such as memory cards, solid-state drives (SSDs), embedded multimedia cards (eMMCs), mobile phones, smart phones, personal digital assistants (PDAs), portable multimedia players (PMPs), digital cameras, video cameras, personal computers (PCs), server computers, workstations, notebook computers, digital TVs, set-top boxes, portable game consoles, navigation systems, wearable devices, Internet of Things (IoT) devices, Internet of Everything (IoE) devices, e-books, virtual reality (VR) devices, augmented reality (AR) devices, etc.

[0139] The above illustrates example embodiments and should not be construed as limiting the example embodiments. Although some example embodiments have been described, it should be readily appreciated by those skilled in the art that many modifications are possible in the example embodiments without materially departing from the concept of the present invention.

Claims

1. A semiconductor memory device, comprising: A plurality of stacked memory semiconductor wafers, Wherein, at least one of the plurality of stacked memory semiconductor wafers comprises: an on-chip processor configured to perform on-chip data processing; and a memory security controller configured to decrypt encrypted data provided from one of the memory semiconductor die and the memory controller, provide the decrypted data to the on-chip processor, receive result data generated by performing the on-chip data processing on the decrypted data from the on-chip processor, encrypt the result data, and provide the encrypted result data to the other of the memory semiconductor die and the memory controller, and The memory controller is located outside the semiconductor memory device and is configured to encrypt data to be provided to the semiconductor memory device to generate encrypted data, and to decrypt the encrypted result data received from the semiconductor memory device.

2. The semiconductor memory device according to claim 1, wherein The memory security controller comprises: a key provider configured to provide a security key; and A security engine is configured to decrypt the encrypted data based on the security key to generate the decrypted data, and is configured to encrypt the result data based on the security key to generate the encrypted result data.

3. The semiconductor memory device according to claim 2, wherein: The key provider stores and provides a security key identical to that of the memory controller based on security information provided from the memory controller so that the security engine performs encryption and decryption identical to those performed in the memory controller.

4. The semiconductor memory device according to claim 2, further comprising: A selector is configured to provide the received data to a decryptor in the security engine when the received data corresponds to the encrypted data, and to provide the received data directly to the on-chip processor when the received data corresponds to unencrypted data.

5. The semiconductor memory device according to claim 2, wherein: The security engine has a reconfigurable configuration, and the security engine is programmed to have the same configuration as a security engine of the memory controller.

6. The semiconductor memory device according to claim 1, wherein: The memory controller comprises: A first key provider configured to provide a first security key; and A first security engine is configured to perform encryption and decryption on input data based on the first security key.

7. The semiconductor memory device according to claim 6, wherein: The memory security controller comprises: a second key provider configured to provide a second security key that is the same as the first security key; and A second security engine is configured to perform encryption and decryption identical to that of the memory controller based on the second security key.

8. The semiconductor memory device according to claim 7, wherein: The first key provider comprises: a first key register configured to store and provide the first security key, and Wherein, the second key provider comprises: A second key register is configured to receive the first security key from the memory controller to store and provide the first security key as the second security key.

9. The semiconductor memory device according to claim 7, wherein: The first key provider comprises: a first seed register configured to store and provide a first seed value; a first on-chip timer configured to provide first time information; a first key generator configured to generate the first security key based on the first seed value and the first time information; and A first key register is configured to store and provide the first security key.

10. The semiconductor memory device according to claim 9, wherein: The second key provider comprises: a second seed register configured to receive the first seed value from the first seed register to store and provide the first seed value as a second seed value; a second on-chip timer configured to provide second time information, the second on-chip timer being synchronized with the first on-chip timer; a second key generator configured to generate the second security key based on the second seed value and the second time information; and A second key register is configured to store and provide the second security key.

11. The semiconductor memory device according to claim 9, wherein: The second key provider comprises: a second seed register configured to receive the first seed value from the first seed register to store and provide the first seed value as a second seed value; a second key generator configured to generate the second security key based on the second seed value and first time information provided from the first on-chip timer; and A second key register is configured to store and provide the second security key.

12. The semiconductor memory device according to claim 7, wherein: The first key provider comprises: a first seed register configured to store and provide a first seed value; a first key generator configured to generate the first security key based on the first seed value and time information provided from a system timer; and a first key register configured to store and provide the first security key, and Wherein, the second key provider comprises: a second seed register configured to receive the first seed value from the first seed register to store and provide the first seed value as a second seed value; a second key generator configured to generate the second security key based on the second seed value and the time information provided from the system timer; and A second key register is configured to store and provide the second security key.

13. The semiconductor memory device according to claim 1, wherein: When the semiconductor memory device receives processing and write commands from the memory controller, the semiconductor memory device decrypts the encrypted data provided from the memory controller to perform the on-chip data processing on the decrypted data, and encrypts the result data of the on-chip data processing to write the encrypted result data in the memory semiconductor chip.

14. The semiconductor memory device according to claim 1, wherein: When the semiconductor memory device receives a process and a read command from the memory controller, the semiconductor memory device decrypts the encrypted data read from the memory semiconductor chip to perform the on-chip data processing on the decrypted data, and encrypts the result data of the on-chip data processing to provide the encrypted result data to the memory controller.

15. The semiconductor memory device according to claim 1, wherein: When the semiconductor memory device receives an internal processing command from the memory controller, the semiconductor memory device decrypts the encrypted data read from the memory semiconductor chip to perform the on-chip data processing on the decrypted data, and encrypts the result data of the on-chip data processing to write the encrypted result data in the memory semiconductor chip.

16. A semiconductor memory device comprising: Buffer semiconductor chips; a plurality of memory semiconductor wafers stacked with the buffer semiconductor wafer; a through silicon via electrically connecting the buffer semiconductor wafer with the plurality of memory semiconductor wafers; an on-chip processor configured to perform on-chip data processing on input data to provide result data; as well as a security controller configured to decrypt the encrypted data to provide the decrypted data as the input data to the on-chip processor, and to encrypt the result data from the on-chip processor to provide re-encrypted data, wherein a host security controller located outside the semiconductor memory device is configured to encrypt data to be provided to the semiconductor memory device to generate the encrypted data, and to decrypt the re-encrypted data received from the semiconductor memory device, and Wherein, the on-chip processor comprises: a global processor formed in the buffer semiconductor die and configured to perform a global sub-process corresponding to a portion of the on-chip data processing; and One or more local processors are respectively formed in the memory semiconductor die and are configured to perform local sub-processing corresponding to other parts of the on-chip data processing.

17. The semiconductor memory device according to claim 16, wherein: The security controller is formed on the buffer semiconductor wafer.

18. The semiconductor memory device according to claim 16, wherein: The safety controller comprises: a global security controller formed in the buffer semiconductor die and configured to perform encryption and decryption on input data and output data of the global processor; and One or more local security controllers are respectively formed in the memory semiconductor die and are configured to perform encryption and decryption on input data and output data of the local processors.

19. A method for performing security operations on a semiconductor memory device, the semiconductor memory device comprising a plurality of stacked memory semiconductor dies having an on-chip processor and a memory security controller, the method comprising the steps of: decrypting, at the memory security controller, encrypted data provided from one of the memory semiconductor die and from a memory controller; receiving the decrypted data by the on-chip processor to perform an on-chip processing operation and outputting result data; encrypting result data from the on-chip processor at the memory security controller to provide the encrypted result data to the other of the memory semiconductor die and the memory controller, The memory controller is located outside the semiconductor memory device and is configured to encrypt data to be provided to the semiconductor memory device to generate encrypted data, and to decrypt the encrypted result data received from the semiconductor memory device.

Images