Secure identity linking between components of a trusted computing base

Abstract

This application relates to secure identity linking between components of a trusted computing base. A memory device includes a secure memory region with encryption-based access control. The secure memory region stores component information about a second component configured to execute after a first component during boot. A health of the second component to be executed is verified based on the component information stored in the secure memory region before a composite identifier of the first component is generated using a component identity of the second component.

Description

TECHNICAL FIELD

[0001] At least some embodiments disclosed herein relate generally to computer security, and more particularly, but not by way of limitation, to securely loading software components from a memory device during booting of a computing device. BACKGROUND

[0002] A memory sub-system can include one or more memory devices that store data. The memory devices can be, for example, non-volatile memory devices and volatile memory devices. Generally, a host system can utilize a memory sub-system to store and retrieve data at the memory devices. SUMMARY

[0003] One aspect of the disclosure provides a memory device comprising: a communication interface configured to connect to a host system; a memory unit having a memory region; and a logic circuit configured to control access to the memory region through the communication interface based on encryption; wherein the memory unit is configured to store a first component and a second component; and the memory region is configured to store component information about the second component; and wherein the logic circuit is configured to verify a health of the second component stored in the memory unit based on the component information stored in the memory region before a composite identifier of the second component is generated using a component identity of the second component.

[0004] Another aspect of the disclosure provides a method comprising: controlling, by a memory device, access to a memory region in the memory device by a host system through a communication interface of the memory device based on encryption; storing a first component and a second component that are executable in the host system in the memory device; storing component information about the second component in the memory region; verifying a health of the second component stored in the memory device based on the component information stored in the memory region; and in response to determining that the second component stored in the memory device is healthy, generating a composite identifier of the second component using a component identity of the second component.

[0005] Another aspect of the present disclosure provides a computing device comprising: a host system; and a memory device having: a communication interface connected to the host system; a memory unit having a memory region; and a logic circuit configured to secure access to the memory region by the communication interface based on encryption control; wherein the computing device is configured to store a first component and a second component; wherein the memory region is configured to store component information about the second component; and wherein during a boot-up of the computing device and before a component identity of the second component is used to generate a composite identifier of the second component by a component tag of the second component, the computing device is configured to verify a health of the second component stored in the memory unit based on the component information stored in the memory region. BRIEF DESCRIPTION OF DRAWINGS

[0006] Embodiments are illustrated by way of example and not limitation in the figures of the accompanying drawings in which like references indicate similar elements.

[0007] Figure 1 An integrated circuit memory device according to one embodiment is described.

[0008] Figure 2 Generation of identity data in an integrated circuit memory device according to one embodiment is described.

[0009] Figure 3 Techniques for controlling command execution in a memory device according to one embodiment are described.

[0010] Figure 4 Component information facilitating secure identity linking between components of a trusted computing base according to one embodiment is described.

[0011] Figure 5 Secure identity linking between components of a trusted computing base according to one embodiment is shown.

[0012] Figure 6 A secure server facilitating installation of component information according to one embodiment is described.

[0013] Figure 7 A method for booting a computing device according to one embodiment is shown.

[0014] Figure 8 An example computing system having a memory subsystem according to some embodiments of the present disclosure is described.

[0015] Figure 9 A block diagram of an example computer system in which embodiments of the present disclosure can operate is shown. DETAILED DESCRIPTION

[0016] At least some aspects of the present disclosure relate to secure boot of a computing device having multiple layers of components with a trusted computing base.

[0017] A computing device, such as an Internet of Things (IoT) device, can be configured to have a unique identity among a population of similar devices based on encryption and unique secrets stored in the computing device. For example, the identity can be established based on a combination of hardware and software / firmware of the computing device according to operations and requirements specified for a Device Identifier Composition Engine (DICE). The unique identity of the computing device and its confirmation as a computing device provide a basis of trust for use, deployment, and service of the computing device.

[0018] Software / firmware of the computing device can include multiple layers of components of a trusted computing base (TCB), such as a bootloader, an operating system, and an application. During a boot process, components can be loaded into the computing device to be executed in an order corresponding to the order of the layers. The computing device that has loaded components at a particular layer, such as a bootloader, an operating system, or an application, can have a composite device identifier (CDI) representing the computing device running the loaded components and a corresponding cryptographic key that can be used to attest that the computing device has the composite device identifier (CDI). The composite device identifier (CDI) can be an identifier of the last component of the particular layer that has been loaded into the computing device.

[0019] Each component can have a TCB component identity (TCI) characterizing the component. For example, the TCB component identity (TCI) of a software / firmware component can be based on a cryptographic measurement of the component and other information, such as an identification of a manufacturer / supplier of the component, a version number, a build number, a serial number, a component name, etc. For example, the cryptographic measurement can be a value computed by applying a cryptographic hash function to data of the component, such as instructions and resources of the component. This measurement or value can be referred to as a digest of the component.

[0020] Layers of components can be linked to enhance security of the basis of trust. For example, the composite device identifier (CDI) of a current layer component, such as layer i, can be generated by a previous layer component, such as layer i-1, based on a secret of the previous layer component and a TCB component identity (TCI) of the current component; and the composite device identifier (CDI) of the current layer component, such as layer i, can be used as a unique secret of a next layer component, such as layer i+1.

[0021] When a component is compromised, such as corrupted, tampered, its composite device identifier (CDI) and thus the cryptographic key will be different than when the component is not compromised and thus cannot be confirmed. However, detection of such a compromised component can be delayed to a later stage of identity confirmation after use of its composite device identifier (CDI) and / or after booting the computing device and loading the component.

[0022] At least some aspects of the present disclosure address the above and / or other shortcomings and / or challenges by confirming a component's TCB component identity (TCI) and the component's integrity prior to using the component's TCB component identity (TCI). For example, information about a component that can be used to confirm its TCB component identity (TCI) and its integrity can be stored in a secure memory region of a secure memory device. Access to and / or modification of the secure memory region can be controlled via encryption and an encryption key that represents a privilege to access and / or modify the secure memory region.

[0023] For example, the component information stored in the secure memory region can include a digest (cryptographic measurement or hash value) of an uncorrupted healthy version of the component and a storage location(s) of a portion of the component. A current digest of the component as stored in the storage location(s) can be computed and compared to the digest of the uncorrupted healthy version of the component stored in the secure memory region. When there is a mismatch between the digests, the component as stored in the storage location(s) can be determined to have been corrupted; and in response, a repair or recovery operation can be performed prior to the component being loaded during a boot process and / or prior to the component's TCB component identity (TCI) being used to generate a composite device identifier (CDI) and a corresponding encryption key that can be used to prove possession of the composite device identifier (CDI).

[0024] The secure memory device can store a unique device secret that represents the memory device. An encryption key can be generated based at least in part on the unique device secret. A digital signature generated using the encryption key can be used to prove the identity of the memory device represented at least in part by the unique device secret, as discussed further below in connection with Figure 2 Further discussion.

[0025] The secure memory device can require a command to access the secure memory region to be signed using an encryption key prior to the command being executed. The encryption key represents a privilege to access the secure memory region. Thus, without the encryption key, an application or entity cannot access the secure memory region, as discussed further below in connection with Figure 3 Further discussion.

[0026] Figure 1 An integrated circuit memory device 130 according to one embodiment is illustrated.

[0027] In Figure 1 The memory device 130 has a secure memory region 133 that stores a component 161 (e.g., a zeroth layer component) and component information 163. The component information 163 includes data about components (e.g., 165, 167) that are to be loaded for execution after the component 161 (e.g., a first layer component loaded by the zeroth layer component, a second layer component loaded by the first layer component).

[0028] The memory device 130 stores a unique device secret 101 that is unique to the memory device 130 among a population of similar memory devices.

[0029] During booting of a computing system having the memory device 130, a composite device identifier (CDI) of the component 161 is generated based on the unique device secret 101 and a TCB component identity (TCI) of the component 161; a composite device identifier (CDI) of the component 165 is generated by the component 161 based on the composite device identifier (CDI) of the component 161 and a TCB component identity (TCI) of the component 165; and a composite device identifier (CDI) of the component 167 is generated by the component 165 based on the composite device identifier (CDI) of the component 165 and a TCB component identity (TCI) of the component 167; and so on.

[0030] The component information 163 can include at least a digest of the component 165 to be loaded by the component 161 and / or a digest of the component 167 to be loaded by the component 165. The component information 163 can further include an identification of a storage location of a portion of a component (e.g., 165, 167 and / or component 161). The storage location can also be referred to as a measurement location.

[0031] Accordingly, prior to the TCB component identity (TCI) of the component 165 being used by the component 161 to compute its composite device identifier (CDI), the security manager 113 of the memory device 130 (and / or a host system running the memory device 130 of the component 161) can compute a current digest of the component 165 as stored at the storage location identified by the component information 163. The computed current digest can be compared to the digest in the component information 163 to determine the validity of the TCB component identity (TCI) of the component 165 and / or the integrity of the component 165. If the stored component 165 is compromised or unhealthy, the booting process can be suspended; and repair and / or recovery operations can be performed. If the component 165 is healthy, its composite device identifier (CDI) can be computed by the component 161 from the TCB component identity (TCI) of the component 165 and the composite device identifier (CDI) of the component 161. Since the composite device identifier (CDI) of the component 161 is derived from the unique device secret 101, possession of the composite device identifier (CDI) of the component 165 attests that the component 165 can access the unique device secret 101.

[0032] Similarly, another component 167 (e.g., an application) will be loaded after component 165 (e.g., an operating system) and / or by component 165. The composite device identifier (CDI) of component 167 will be computed based on the composite device identifier (CDI) of component 165 as a secret of component 167, and the TCB component identity (TCI) of component 167 will be loaded after component 165. Since the composite device identifier (CDI) of component 165 is indirectly derived from the unique device secret 101, possession of the composite device identifier (CDI) of component 167 attests that component 165 can access the unique device secret 101. The component information 163 can include a digest of component 167 that will be loaded after component 165 and further include an identification of the storage location of the portion of component 167. Thus, before the TCB component identity (TCI) of component 167 is used to compute the composite device identifier (CDI) of component 167, the security manager 113 of memory device 130 (and / or the host system running component 161 and / or component 165) can compute the current digest of component 167 as stored at the storage location (measurement location) identified by component information 163. The computed current digest can be compared to the digest in component information 163 to determine the validity of the TCB component identity (TCI) of component 167 and / or the integrity of component 167 in a manner similar to the attestation of component 165.

[0033] In some implementations, there can be more component layers than Figure 1 illustrated in FIG. 1. In other implementations, fewer component layers than Figure 1 illustrated in FIG. 1 can be used in a computing device. Thus, the present disclosure is not limited to a particular number of component layers that are linked / chained to produce their composite device identifiers.

[0034] Figure 1 An example is illustrated in which components 161, 165,..., 167 are stored in non-secure memory region 131. Commands configured to access non-secure memory region 131 do not require a signature or attestation code generated using an encryption key that represents the privilege of executing commands within memory device 130. In other implementations, some or all of components 161, 165,..., 167 can also be stored in secure memory region 133 to enhance security.

[0035] Integrated circuit memory device 130 can be enclosed in a single integrated circuit package. Integrated circuit memory device 130 includes a plurality of memory regions 131,..., 133 that can be formed in one or more integrated circuit dies.

[0036] A memory region (e.g., 131 or 133) can be allocated for use by a host system as a partition or namespace. Memory locations in a memory region (e.g., 131 or 133) can be specified by a host system via logical block addressing (LBA) addresses; and the memory device 130 can include an address map that specifies a relationship between LBA addresses in a partition or namespace and corresponding physical addresses of memory cells used to provide the memory space allocated to the partition or namespace. In some implementations, the memory device 130 is configured in a memory subsystem (e.g., 110) as described in Figure 8

[0037] A typical memory cell in a memory region (e.g., 131,..., 133) can be programmed to store one or more bits of data.

[0038] The memory device 130 has a local media controller 150 that can implement at least a portion of the security manager 113.

[0039] The security manager 113 of the memory device 130 can include an access controller 109 and a cryptographic engine 107.

[0040] The cryptographic engine 107 can be implemented via logic circuitry and / or instructions or microcode to perform cryptographic computations, such as applying a cryptographic hash function to a data item to produce a hash value, encrypting a data item using a cryptographic key to produce ciphertext, decrypting ciphertext using a corresponding cryptographic key to recover a data item, generating a cryptographic key for symmetric encryption and / or a pair of cryptographic keys for asymmetric encryption, etc.

[0041] The access controller 109 controls access to at least one of the memory regions 131,..., 133 and / or other functions of the memory device 130 based on cryptographic keys that represent access privileges.

[0042] ​For example, the security manager 113 can control access to the secure memory area 133 based on encryption keys generated based on the secret 101 of the integrated circuit memory device 130 and / or encryption keys representing an owner or authorized user of the memory device 130. For example, when a request or command to write data into the secure memory area 133 is received in the integrated circuit memory device 130, the security manager 113 verifies whether the request is from a requester with an encryption key. If not, the security manager 113 can deny the write request. To prove that the request is from an authorized requester, the requester can digitally sign the request or challenge information using an encryption key. When the security memory device 130 determines that the digital signature is made using the correct encryption key, the requester is considered to have the privilege to write data into the secure memory area 133. For example, the memory device 130 can store an encryption key for authenticating the digital signature of the signed request / command.

[0043] The memory device 130 can be configured to use different encryption keys to control access for different commands. For example, one encryption key can represent the privilege to execute a secure command in the memory device 130; and the secure command is used to specify another encryption key representing the privilege to read and / or write in the secure memory area 133. For example, the memory device 130 can have multiple secure memory areas (e.g., 133); and access to each of the secure memory areas (e.g., 133) can be controlled via a separate encryption key.

[0044] For example, the memory device 130 can have a unique device secret 101 representing the identity of the memory device 130; and an encryption key derived from the unique device secret 101 can represent the owner's privilege to operate the memory device 130 and thus execute a secure command in the memory device.

[0045] In general, the secure memory area 133 can have different security requirements for different types of access (e.g., read, write, erase). For example, the secure memory area 133 can be configured to require a digital signature verifiable via an encryption key to write data in the secure memory area 133 or change data in the secure memory area 133 but not require a signed command to read data from the secure memory area 133. Alternatively, the secure memory area 133 can be configured to require a digital signature verifiable via an encryption key to read, write, and / or change data in the secure memory area 133. Alternatively, the secure memory area 133 can be configured to require a digital signature verifiable via different encryption keys for different operations (e.g., read, write, change, erase, etc.) made in the secure memory area 133.

[0046] The integrated circuit memory device 130 has a communication interface 147 to receive a command with an address 135. In response to the address 135 identifying a secure memory region (e.g. 133) configured with access control, the security manager 113 uses the cryptographic engine 107 to perform a cryptographic operation to verify that the request is from a requester with an encryption key authorized to access the memory region 133 before providing memory data retrieved from the memory region 133 using an address decoder 141. The address decoder 141 of the integrated circuit memory device 130 converts the address 135 into control signals to select a group of memory cells in the integrated circuit memory device 130; and the local media controller 150 of the integrated circuit memory device 130 performs operations to determine the memory data stored in the memory cells at the address 135.

[0047] Figure 2 The generation of identity data in an integrated circuit memory device according to one embodiment is described. For example, Figure 2 The techniques can be implemented in Figure 1 The memory device 130 of

[0048] In Figure 2 The cryptographic engine 107 of the memory device 130 (e.g. as in Figure 1 is used to generate at least one secret key 137 using its unique device secret 101 and device information 121.

[0049] For example, when asymmetric encryption is used, the secret key 137 is the private key of a cryptographic key pair 129. The associated public key 139 is generated with the private key using the cryptographic engine 107.

[0050] Alternatively, when symmetric encryption is used, the secret key 137 can be generated and used without a public key 139 and without a key pair 129.

[0051] In some implementations, multiple key pairs 129 are generated and used. For example, when using methods of Device Identity Composition Engine (DICE) and Robust Internet of Things (RIoT), a first pair of asymmetric keys is called a device identification key; and a second pair of asymmetric keys is called an alias key. The private device identification key can be used to validate authenticity of the alias key, and then is immediately deleted and purged from the memory device 130 and protected in secrecy, especially when the generation or use of the private device identification key occurs at least in part in the host system 120. The alias key can be used for authentication in additional transactions and / or communications. For example, the private device identification key can be generated at boot time and used to sign a certificate, such as a certificate of an alias public key, and then deleted. After the identity of the memory device 130 and authenticity of the public alias key are validated with a certificate signed using the private device identification key as a secret key 137, then the private alias key can be used as the secret key 137 of the memory device 130 in subsequent operations until the host system 120 is rebooted.

[0052] For example, the data 123 of the device information 121 stored in the memory unit 103 can include a set of instructions (e.g., software, firmware, operating system, application program) to be executed by the processing device 118 of the host system 120 to which the communication interface 147 of the memory device 130 is connected.

[0053] For example, the data 123 can include a cryptographic hash value of the set of instructions. For example, a known hash value of the set of instructions can be stored in the memory unit 103; and a current hash value of the set of instructions can be computed for comparison with the known hash value. If the two hash values agree with each other, the integrity of the set of instructions is verified; and the hash value of the integrity of the set of instructions can be used as part of the device information 121 to compute the secret key 137.

[0054] Alternatively, the current hash value of the set of instructions stored in the memory unit 103 can be used directly for the computation of the secret key 137. If the instructions have changed (e.g., due to data corruption and / or tampering or hacking), the validation of the secret key 137 by the secure server will fail.

[0055] Optionally, the data 123 can include an identification of the set of instructions, such as a hash value of the source code of the instructions, a name of a software / firmware package represented by the instructions, a version number and / or release date of the package, etc.

[0056] Optionally, the data 123 can include tracking data stored into the memory cell 103 during a process of building and / or customizing a computing system having the host system 120 and the memory device 130. For example, when the memory device 130 is assembled into a component device, such as a memory subsystem, a piece of tracking data representing a manufacturer of the component device, a model of the component device, and / or a serial number of the component device is stored into the memory cell 103 as part of the device information 121. Subsequently, when the component device is assembled into a computing system, a piece of tracking data is added into the memory cell as part of the device information 121. Additional tracking data can be added into the memory cell 103 as part of the device information 121 to reflect a history of the memory device 130 to individualize an identity of the memory device 130.

[0057] Optionally, the device information 121 can further include the data 125 received from the host system 120 to which the communication interface 147 of the memory device 130 is connected.

[0058] For example, a computing system can have at least the host system 120 and the memory device 130. Some components in the host system 120 can be removed or replaced. Upon booting up the host system 120, a portion of the instructions stored in the memory cell 103 is executed to collect the data 125 about the components present in the host system 120 at the boot time. Accordingly, the device information 121 can represent a particular configuration of the software / data and hardware combination of the memory device 130 and / or the host system 120. The secret key 137 generated based on the device information 121 and the unique device secret 101 represents an identity of the memory device 130 having the particular configuration.

[0059] To attest the identity of the memory device 130 and / or the host system 120, the cryptographic engine 107 generates a verification code 153 from the message 143 and the secret key 137.

[0060] The secret key 137 and the verification code 153 of the message 143 can be constructed and / or confirmed using various techniques, such as a hash digest, a digital signature or a hash-based message authentication code, symmetric encryption, and / or asymmetric encryption. Accordingly, the verification code 153 is not limited to a particular implementation.

[0061] In general, verifying that the sender of a message (e.g., 143) has a cryptographic key (e.g., 145) involves authentication of a verification code (e.g., 153) of the message (e.g., 143). The verification code can be in the form of a hash digest, a digital signature, a hash-based message authentication code (HMAC), a cipher-based message authentication code (CMAC), etc. The verification code is generated using the cryptographic key and the message as inputs to a cryptographic operation such as a hash, encryption, and / or other computation, such that it is generally impractical to generate the verification code without the cryptographic key and to generate the verification code from a modified version of the message. Thus, when a recipient confirms that a received verification code is valid for a received message and a cryptographic key, the recipient can conclude that the sender has the corresponding cryptographic key and that the received message is the same as the message used to generate the received cryptographic key.

[0062] In some implementations, the recipient performs the confirmation of the verification code of the message using the same cryptographic key that was used by the sender to generate the verification code. For example, the recipient generates a verification code for the received message using the same cryptographic key and compares the generated verification code to the received verification code. If there is a match, the received verification code is valid for the received message; and the sender can be considered to have the cryptographic key. Otherwise, the received verification code is not valid for the received message; the received message has changed since the verification code was generated, or the received verification code was generated using a different cryptographic key, or both.

[0063] In some implementations, the recipient performs the confirmation of the verification code of the message using a public cryptographic key of a key pair; and the sender generates the verification code using a private cryptographic key of the key pair. For example, the verification code can be generated by applying a hash function to the message to produce a hash value of the message. A ciphertext of the hash value obtained by encrypting the hash value using the cryptographic key can be used as the verification code. The recipient of the message and the verification code performs the confirmation using a corresponding decryption key, which is the same as the encryption key when symmetric encryption is used, and which is a different key of the key pair when asymmetric encryption is used. In recovering the hash value from the ciphertext using the decryption key, the recovered hash value can be compared to the hash value of the received message; if there is a match, the received verification code is valid for the received message; otherwise, the received verification code is not valid for the received message. Alternatively, the recipient can perform the confirmation using the encryption key without performing decryption. The recipient can generate a verification code for the message using the encryption key to compare to the received verification code.

[0064] In some implementations, the message and encryption key are combined to produce a hash value as a verification code, as in a hash-based message authentication code (HMAC) technique. For example, the encryption key can be used to produce two keys. After one of the two keys is combined with the message to produce a key-modified message, a cryptographic hash function can be applied to the key-modified message to produce a hash value, which is further combined with the other key to produce another message. After the cryptographic hash function (or another cryptographic hash function) is applied to the other message, a hash-based message authentication code is produced. A recipient of the message can produce a hash-based message authentication code for the received message using the same encryption key to compare with the received hash-based message authentication code. If there is a match, success is confirmed; otherwise, failure is confirmed.

[0065] In general, any technique for producing and confirming a verification code for a message from a sender and an encryption key used by the sender to produce the verification code can be used to determine whether the sender has the encryption key. The recipient will perform the confirmation using the appropriate encryption key, which can be the same as the encryption key used to produce the verification code or in the same pair of asymmetric encryption keys. Thus, the present disclosure is not limited to the particular techniques of hash digests, digital signatures, and / or hash-based message authentication codes.

[0066] For convenience, a verification code (e.g., 153) produced for a message (e.g., 143) using an encryption key (e.g., 145) to represent the message (e.g., 143) and the encryption key (e.g., 145) can be generally referred to as a digital signature of the message (e.g., 143) signed using the encryption key (e.g., 145), with the understanding that the verification code can be produced using various techniques, such as a hash-based message authentication code.

[0067] Optionally, the message 143 can include a user identification, such as a name, an electronic mail address, a registered user name, or another identifier of an owner or authorized user of the host system 120 in which the identity data 112 is produced.

[0068] Optionally, portions of the message 143 can provide information in encrypted form. For example, the information can be encrypted using a public key of a secure server so that the information cannot be accessed by third parties.

[0069] The message 143 can be a certificate that presents the unique identification 111 of the memory device 130 and / or the host system 120. The message 143 can further present other data 127, such as a counter value maintained in the memory device 130, an encrypted random number, and / or other information related to confirmation of the identity data 112. The memory device 130 can monotonically increase the counter value to invalidate identity data with a lower counter value to prevent replay attacks.

[0070] In some implementations, the data 127 can include a portion of the device information 121 used to generate the secret key 137.

[0071] In some implementations, the secret key 137 is a private alias key of a pair of asymmetric keys. The data 127 includes a certificate of a corresponding public alias key of the pair of asymmetric keys. The certificate of the public alias key is signed using a device identification key of the memory device 130. The public alias key can be used to confirm the verification code 153 of the message 143 and as the private alias key for the secret key 137. Once the security server confirms the certificate of the public alias key that is presented using the device identification key of the memory device 130 and provided as part of the data 127, the security server can use the public alias key to confirm the verification code 153 signed with the private alias key used as the secret key 137. In this implementation, the security server can use the public alias key provided in the message 143 to confirm the verification code 153 without having to regenerate a pair of alias keys; and the memory device 130 can generate the pair of alias keys 129 using data that is not known to the security server.

[0072] The certificate of the public alias key can be generated and confirmed in the manner as in Figure 2 where the secret key 137 is a device identification key generated using the device information 121 and the unique device secret 101. Optionally, the memory device 130 initially provides the security server with the certificate of the public alias key. Subsequently, the memory device 130 can use the private alias key as the secret key 137 without having to include the public alias key in the message 143 or without having to include the certificate of the public alias key in the message 143.

[0073] Further, the verification of the identity of the memory device 130 can include multiple secret keys and the use of verification codes signed using the secret keys. For example, a device identification secret key can be used to first establish the authenticity of the alias secret key and the identity of the memory device 130; and subsequently, the alias secret key can be used to confirm the authenticity of the identity of the memory device 130. In general, the device identification secret key and the alias secret key can be based on asymmetric encryption or symmetric encryption as the security server can generate the corresponding encryption key generated by the memory device 130.

[0074] To improve security, the memory device 130 does not use processing power outside of the memory device 130 to generate a copy of its secret key 137 and does not communicate the secret key 137 outside of the memory device 130. The generation and use of the secret key 137 is performed using logic circuitry of the encryption engine 107 that is sealed within the memory device 130.

[0075] Alternatively, portions of the operations to generate and use the secret key 137 can be implemented via a set of instructions stored in the memory unit 103 and loaded into the processing device 118 of the host system 120 for execution. To improve security, the secret key 137 is not passed across the communication interface 147 in plaintext; and the instructions can be configured to clear the secret key 137 from the host system 120 after generation and / or after use.

[0076] The identity data 112 can be generated in response to the memory device 130 being powered up, in response to receiving a request in the communication interface 147, and / or in response to the host system 120 being booted (e.g., by executing a boot loader stored in the memory unit 103). The data 127 can include a count value maintained in the memory device 130. When the operation to generate the identity data 112 is performed, the count value is increased. Thus, a version of the identity data 112 having the count value invalidates a previous version of the identity data 112 having a count value lower than the count value.

[0077] In some implementations, the data 123 includes a plurality of layers of components (e.g., component A 161, component B 165, component C 167); and the device information 121 includes component information 163 and a composite device identifier for at least some of the components.

[0078] Figure 3 Techniques are described for controlling execution of commands in a memory device, in accordance with one embodiment. For example, Figure 3 Techniques can be implemented in a memory device 130 of Figure 1

[0079] In Figure 3 The access controller 109 is configured with an access control key 149 to determine whether a signed command 156 received in the communication interface 147 is from an entity having privileges to execute a command 155 in the secure memory device 130.

[0080] When a controller 116 of the host system 120 sends a command 155 to the communication interface 147 of the memory device 130, the access controller 109 determines whether the sender of the command 155 has privileges to request the memory device 130 to execute the command 155. The host system 120 can include one or more processing devices 118 that execute instructions implementing an operating system and / or an application program.

[0081] The encryption key 145 is configured to represent privileges to be checked using the access control key 149. The sender of the command 155 can generate a verification code 153 from the encryption key 145 and the message 143 containing the command 155.

[0082] Similar to the above in connection with Figure 2 ​The verification code 153, encryption key 145, and verification code 153 of the message 143 can be constructed and / or confirmed using various techniques, such as a hash digest, a digital signature, or a hash-based message authentication code, symmetric encryption, and / or asymmetric encryption. Thus, the verification code 153 is not limited to a particular implementation; and the verification code 153 can be generally referred to as a digital signature of the message 143 signed using the encryption key 145, it should be understood that the verification code 153 can be generated using various techniques, such as a hash-based message authentication code.

[0083] In some implementations, the access controller 109 uses the access control key 149 to confirm the verification code 153 submitted to the communication interface 147 for the command 155. The access controller 109 uses the encryption engine 107 to generate a confirmation result 159 of the received message 143 and the received verification code 153. Based on the confirmation result 159, the access controller 109 can selectively allow the command 155 to execute within the memory device 130 or prevent execution of the command 155. Figure 3

[0084] For example, the access control key 149 can be one of the encryption keys stored in the memory device 130. Different access control keys can be used to control different privileges of executing different commands and / or executing commands operating on different sections or regions of memory cells.

[0085] For example, one encryption key 145 can represent a privilege to execute a secure command in the memory device 130. When the secure command is executed, the access control key 149 is installed (or uninstalled) in the memory device 130 to confirm a verification code of another encryption key representing a privilege to execute a read command (or a write command) to access a secure memory region 133.

[0086] Optionally, the encryption key 145 is generated in a process of confirming an identity of the memory device 130 based on a unique device secret 101 of the memory device 130; and a secret known between the memory device 130 and an owner of the memory device 130 allows a session key to be generated as the encryption key 145 to represent a privilege to execute a selected command in the memory device 130 during a communication session. The communication session can have a time limit and / or can be terminated via a command to the memory device 130.

[0087] In some implementations, the same session key is used as the encryption key 145 representing a privilege (e.g., reading or writing data in a secure memory region 133) and as the access control key 149 for confirming a verification code (e.g., 153) generated using the encryption key 145.

[0088] ​In another implementation, a pair of encryption keys for asymmetric encryption can be used for the session. The public key of the pair is used as the access control key 149; and the private key of the pair can be used as the encryption key 145 representing the corresponding privilege.

[0089] After the access control key 149 for validating a verification code (e.g., 153) generated using the encryption key 145 representing a privilege for reading or writing in the secure memory region 133 is installed in the memory device 130, the encryption key 145 can be used by an authorized entity to generate a signed command 156. The signed command 156 can be transmitted by the host system 120 to the communication interface 147 of the memory device 130. After the access controller 109 validates the verification code 153 in the signed command 156, the access controller 109 allows the memory device 130 to execute the command 155.

[0090] The message 143 can include data 157 representing a constraint on the request to execute the command 155.

[0091] For example, the data 157 can include an execution count value that is maintained within the memory device 130 such that a verification code generated for a lower count is invalid.

[0092] For example, the data 157 can include a cryptographic nonce that establishes for a particular instance of the request to execute the command 155 such that the verification code 153 cannot be reused for another instance.

[0093] For example, the data 157 can include a time window in which the verification code 153 is valid.

[0094] For example, the data 157 can include an identification of a memory region in which the command 155 is allowed to be executed.

[0095] For example, the data 157 can include an operation type that is allowed to execute the command 155 in the memory device 130.

[0096] Figure 4 Component information 163 is described that facilitates secure identity linking between components of a trusted computing base according to one embodiment. For example, Figure 4 The techniques of Figure 2 and Figure 3 may be implemented in a memory device 130 having Figure 1 security features.

[0097] In Figure 4 , the component information 163 designated for validating a component 165 includes component data locations 172,..., 174 and a component digest 175.

[0098] For example, locations 172,..., 174 can be identified via physical addresses of memory units 103 in memory region 131 or local addresses of memory units 103 in memory region 131.

[0099] When component 165 is loaded after operating system execution, locations 172,..., 174 can be identified via files and / or dictionaries in a file system controlled by the operating system. In addition, memory region 131 can be in another memory device separate from memory device 130 in which component information 163 is stored. Portions 171,..., 173 can be accessed via a file system serviced by the operating system.

[0100] For example, component information 163 can be stored in a secure memory region 133 to prevent tampering. Component 165 can be stored in another memory region 131 (e.g., a secure region or a non-secure region). Each of locations 172,..., 174 identifies a respective portion (e.g., 171,..., 173) of component 165. Thus, locations 172,..., 174 allow security manager 113 to read and compute a current digest 175 for comparison with component digest 175 specified in component information 163 for component 165. The comparison can be performed before component 165 is used and / or before a TCB component identity (TCI) for component 165 is used (e.g., for generating a composite device identifier (CDI) for component 165).

[0101] Security manager 113 can compute a confirmed TCB component identity (TCI) for component 165 using component information 163. For example, after determining that a current digest for component 165 as stored at locations 172,..., 174 is consistent with component digest 175, security manager 113 can compute a TCB component identity (TCI) for component 165 from digest 175 and other information about component 165, such as an identification of a manufacturer of the component 176, a version of the component 177, a build of the component 178, a level of the component in a hierarchy of software / firmware 179, etc. Additional information, such as a hash value of source code for component 165, can also be used to generate a TCB component identity (TCI) for component 165. In some implementations, component digest 175 is computed from a combination of portions 171,..., 173 and other information about component 165, such as an identification of a manufacturer of the component 176, a version of the component 177, a build of the component 178, a level of the component in a hierarchy of software / firmware 179, etc.

[0102] Accordingly, when a component 165 stored in the memory region 131 is compromised, the boot process can be interrupted (e.g., to alert, repair, and / or recover); and use of the TCB component identity (TCI) of the component 165 can be prevented until the component 165 is repaired and / or recovered. Techniques can prevent the compromised component 165 from executing and / or using.

[0103] Figure 5 A secure identity link between components of a trusted computing base is shown in accordance with one embodiment. For example, Figure 5 Techniques can be used in computing devices having Figure 1 a memory device, Figure 2 and Figure 3 a secure feature and component information 163 stored in a secure memory region of the memory device 130.

[0104] In Figure 5 , components of the computing device are loaded to execute sequentially. Before a current component 181 is loaded, a measured digest 164 of the current component 181 is compared to a stored digest of a corresponding healthy version of the component 181 to determine the integrity of the current component 181.

[0105] After determining that the current component 181 is healthy based on the measured digest 164, a composite identifier 185 of the current component 181 is computed; and the current component 181 can be loaded to execute. During execution of the current component 181, the security manager 113 can use the composite identifier 185 and a confirmed digest 184 of a next component 182 to generate a composite identifier 186 of the next component 181.

[0106] Because the composite identifier 186 is generated using the composite identifier 185, possession of the composite identifier 186 indicates that the next component 181 has the secret associated with the composite identifier 185.

[0107] In one instance, when the current component 181 is the component that will first be loaded to execute, the composite identifier 185 can be computed using the unique device secret 101 of the memory device 130 (or another identifier derived from the unique device secret 101). Thus, verifying that the component 181 has the correct composite identifier 185 indicates that the component 181 was loaded from the memory device 130 having the unique device secret 101.

[0108] In another example, when the current component 181 is a component that is loaded to execute after one or more other components have been loaded to execute, the identifier 185 can be based on the composite identifier of the component that was loaded immediately prior to the current component 181. Having the correct composite identifier 185 indicates that the current component 181 was loaded after a previous component that has the correct composite identifier. By chaining the composite identifiers, the current component 181 is considered to be loaded from the memory device 130 that has the unique device secret 101 of the memory device 130.

[0109] The composite identifier 185 can be considered a secret in the memory device 130 and / or computing device. To prove that the current component 181 has the composite identifier 185, an encryption key 187 is generated from the composite identifier 185. The encryption key 187 can be used to sign a challenge message in a manner that the verification code 153 in the message 143 was signed with the secret key 137 to prove that the current component 181 has the correct encryption key 187. Figure 2 The challenge message can be signed in a manner that the verification code 153 in the message 143 was signed with the secret key 137 to prove that the current component 181 has the correct encryption key 187.

[0110] For example, when symmetric encryption is used, the encryption key 187 is the secret key. Alternatively, when asymmetric encryption is used, the encryption key 187 is the private key in a pair of asymmetric encryption keys; and the public key in the key pair can be disclosed to a third party to confirm a signature created using the private key. A certificate can be used to present the public key of the current component 181. To prevent tampering and / or forgery of the certificate presenting the public key of the current component 181, the certificate can be signed using a private key that has a trusted public key (e.g., the private key of a component that was loaded prior to the current component) or signed by a trusted authority or secure server.

[0111] In some implementations, the composite identifier 186 is computed as a result and / or computed during the initial execution of the current component 181. In other implementations, the security manager 113 within the memory device 130 computes the composite identifier 186 and prevents the composite identifier 186 from being disclosed outside of the memory device 130 through the communication interface 147.

[0112] In some implementations, the composite identifier 186 is computed as a result and / or computed during the initial execution of the current component 181. In other implementations, the security manager 113 within the memory device 130 computes the composite identifier 186 and prevents the composite identifier 186 from being disclosed outside of the memory device 130 through the communication interface 147. Figure 5In some embodiments, the measured summary 194 is compared to the component summary 175 recorded in the component information 163 to validate 183 the next component 182. If the measured summary 194 is the same as the component summary 175, then a validated summary 184 of the next component 182 can be used to compute the composite identifier 186 of the current component 181. For example, the validated summary 184 can be used to form a TCB component identity (TCI) of the next component 182. In some embodiments, the TCB component identity (TCI) of the next component 182 is based on a combination of the validated summary 184 and additional information about the next component 182 specified in the component information 163. In other embodiments, the validated summary 184 is based on a combination of the portions 171,..., 173 of the component 165 and additional information about the next component 182 (e.g., manufacturer 176, version 177, build 178, level 179).

[0113] If the next component 182 as stored in the memory region 131 is healthy, then a composite identifier 186 of the next component 182 can be computed from the validated summary 184 of the next component 182 and the composite identifier 185 of the current component 181. A corresponding encryption key 197 of the next component 182 can be computed in a similar manner as the corresponding encryption key 187 of the current component 181.

[0114] In an example, if there is another component to be loaded after the next component 182, then a composite identifier 196 of the other component will be computed from a validated summary 189 of the other component and the composite identifier 186, just as the composite identifier 186 of the current component 181 is computed from the validated summary 184 of the next component 182 and the composite identifier 185.

[0115] Figure 6 A secure server 201 that facilitates installation of component information is described in accordance with one embodiment. For example, the secure server 201 can be used to install the component information 163 of Figure 4 in the memory device 130 of Figure 1 to facilitate the secure identity linkings discussed above in connection with Figure 5

[0116] In some embodiments, the secure server 201 is used to install the component information 163 in the memory device 130 of Figure 6 ​In one embodiment, the secure server 201 has access privilege keys 203 that can be used to sign commands to write data in the secure memory region 133 and / or modify data in the secure memory region 133. The secure manager 113 running in the host system 120 can provide a communication connection between the memory device 130 and the secure server 201. When the computer 205 (e.g., a manufacturer of the computing system 100) installs the component 182 into the memory device 130, the computer 205 can request the secure manager 113 to write component information 163 about the component 182 as stored in the memory device 130 into the secure memory region 133. After confirming the identity of the computer 205, the secure manager 113 can present the command 155 with its data 157 to be signed by the secure server 201 using the access privilege keys 203. After the secure server 201 generates the verification code 153 (e.g., using the access privilege keys 203 as the encryption key 145 described in the summary), the secure manager 113 can pass the signed command 156 to the communication interface 147 of the memory device 130. After the access controller 109 confirms the verification code 153 using the corresponding access control key 149, the command 155 can be executed to write the component information 163 in the secure memory region 133. Figure 3

[0117] When the validation 184 determines that the component 182 is compromised, the secure manager 113 can connect to the computer 205 to retrieve a fresh copy of the component 182 to repair or restore the component 182. Alternatively, a backup copy of the component 182 is stored in the secure server 201 (e.g., during the initial installation of the component 182 into the memory device 130); and the restoration or repair can be performed via the secure server 201 using the backup copy.

[0118] Figure 7 A method for booting a computing device is shown in accordance with one embodiment. Figure 7 The method of can be performed by processing logic that can include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, integrated circuit, etc.), software / firmware (e.g., instructions run or executed on a processing device), or a combination thereof. In some embodiments, the method of Figure 7 The method of can be implemented in Figure 6 The system of can be implemented in and at least partially controlled by Figure 3 the processing device 118 or the controller 116 of the host system 120 in Figure 8 the controller 115 of the memory sub-system 110 and / or the controller 150 or Figure 1 ​The processing logic executing in the memory device 130. Although shown in a particular order or sequence, unless otherwise specified, the order or sequence of the processes can be modified. Thus, the illustrated embodiments should be understood only as examples, and the illustrated processes can be performed in a different order, and some processes can be performed in parallel. Additionally, one or more processes can be omitted in individual embodiments. Thus, not all processes are required in every embodiment. Other process flows are possible.

[0119] At block 301, the memory device 130 controls access to the memory region 133 in the memory device 130 by the host system 120 through the communication interface 147 of the memory device 130 based on the encryption.

[0120] At block 303, the memory device 130 stores a first component 181 and a second component 182 that can be executed in the host system 120.

[0121] At block 305, the memory device 130 stores component information 163 about the second component 182 in the memory region 133.

[0122] For example, the component information 163 can include the first digest 175 and identify a storage location (e.g., 172 or 174) of at least a portion (e.g., 171 or 173) of the second component 182 in the memory device 130.

[0123] For example, the first component 181 can be a component 161 (e.g., a bootloader); the second component 182 can be an operating system loaded by the component 161 (e.g., a bootloader); and the storage location (e.g., 172 or 174) can be identified using a physical memory address in the memory device 130.

[0124] For example, the first component 181 can be an operating system; the second component 182 can be an application running under the operating system; and the storage location (e.g., 172 or 174) can be identified via a file system controlled by the operating system.

[0125] At block 307, the security manager 113 verifies a health of the second component 182 stored in the memory device 130 based on the component information 163 stored in the memory region 133.

[0126] For example, the security manager 113 can verify the health of the second component 182 by retrieving content (e.g., portion 171 or portion 173) from the storage location (e.g., 172 or 174); computing a second digest 194 based at least in part on the content; and comparing the first digest 175 and the second digest 194 to verify the health of the second component 182.

[0127] At block 309, the security manager 113 generates the composite identifier 186 for the second component 182 using a component identity for the second component 182 in response to determining that the second component 182 stored in the memory device 130 is healthy.

[0128] For example, the component identity for the second component 182 can be based at least in part on the second digest 194. The component information 163 can further include an identification of: the manufacturer 176 of the second component 182; the version 177 of the second component 182; the build 178 of the second component 182; or the level 179 of the second component 182; or any combination thereof. The component identity for the second component 182 can be further based on such identification.

[0129] For example, after determining that the second component 182 is healthy, the security manager 113 can compute the component identity for the second component 182 from the component information 163 including: the manufacturer 176 of the second component 182; the version 177 of the second component 182; the build 178 of the second component 182; and / or the level 179 of the second component 182, etc.

[0130] For example, the security manager 113 can compute the composite identifier 186 for the second component 182 from the component identity for the second component 182 and the secret for the first component 181. The secret for the first component 181 can be the composite identifier 185 for the first component 181 derived from the unique device secret 101 of the memory device.

[0131] For example, the composite identifier 185 for the first component 181 can be based on a composite identifier generation for a zeroth different component stored in the memory device 130 and configured to execute prior to the first component (e.g., in instances where the zeroth different component executes prior to the first component 181, the first component 181 executes prior to the second component 182); execution of the first component 181 is dependent on execution of the zeroth different component; execution of the second component 182 is dependent on execution of the first component 181. After the security manager 113 computes the encryption key 187 from the composite identifier 185 for the first component 181, the verification code 153 for the message 143 can be generated using the encryption key 187 (e.g., as the secret key 137) to attest that the first component 181, the memory device 130, and / or the computing system 100 having the memory device 130 has the composite identifier 186.

[0132] Figure 8 An example computing system 100 including a memory sub-system 110 according to some embodiments of the present disclosure is illustrated. The memory sub-system 110 can include media, such as one or more volatile memory devices (e.g., memory device 140), one or more non-volatile memory devices (e.g., memory device 130), or a combination of such.

[0133] The memory sub-system 110 can be a storage device, a memory module, or a hybrid of a storage device and a memory module. Examples of storage devices include a solid state drive (SSD), a flash drive, a universal serial bus (USB) flash drive, an embedded Multi-Media Controller (eMMC) drive, a Universal Flash Storage (UFS) drive, a Secure Digital (SD) card, and a hard disk drive (HDD). Examples of memory modules include a dual in-line memory module (DIMM), a small outline DIMM (SO-DIMM), and various types of non-volatile dual in-line memory modules (NVDIMMs).

[0134] The computing system 100 can be a computing device, such as a desktop computer, a laptop computer, a network server, a mobile device, a vehicle (e.g., an airplane, a drone, a train, a car, or other transportation vehicle), an Internet of Things (IoT) enabled device, an embedded computer (e.g., an embedded computer included in a vehicle, industrial equipment, or a networked commercial device), or such computing device that includes memory and a processing device.

[0135] The computing system 100 can include a host system 120 coupled to one or more memory sub-systems 110. Figure 8 An example of a host system 120 coupled to one memory sub-system 110 is described. As used herein, “coupled to” or “coupled with” generally refers to a connection between components that can be an indirect communicative connection or a direct communicative connection (e.g., without intervening components), whether wired or wireless, including connections such as electrical connections, optical connections, magnetic connections, etc.

[0136] The host system 120 can include a processor chipset (e.g., processing device 118) and a software stack executed by the processor chipset. The processor chipset can include one or more cores, one or more caches, a memory controller (e.g., controller 116) (e.g., a NVDIMM controller), and a storage protocol controller (e.g., a PCIe controller, a SATA controller). The host system 120 uses the memory sub-system 110, for example, to write data to and read data from the memory sub-system 110.

[0137] The host system 120 can be coupled to the memory sub-system 110 via a physical host interface. Examples of a physical host interface include, but are not limited to, a serial advanced technology attachment (SATA) interface, a peripheral component interconnect express (PCIe) interface, a universal serial bus (USB) interface, Fibre Channel, a serial attached SCSI (SAS) interface, a double data rate (DDR) memory bus interface, a small computer system interface (SCSI), a dual in-line memory module (DIMM) interface (e.g., a DIMM socket interface that supports double data rate (DDR)), an open NAND flash interface (ONFI), a double data rate (DDR) interface, a low power double data rate (LPDDR) interface, or any other interface. The physical host interface can be used to transfer data between the host system 120 and the memory sub-system 110. When the memory sub-system 110 is coupled with the host system 120 by a PCIe interface, the host system 120 can further access components (e.g., the memory devices 130) using an NVM Express (NVMe) interface. The physical host interface can provide an interface for passing control, address, data, and other signals between the memory sub-system 110 and the host system 120. Figure 8 The memory sub-system 110 is illustrated as an example. In general, the host system 120 can access multiple memory sub-systems via the same communication connection, multiple separate communication connections, and / or a combination of communication connections.

[0138] The processing device 118 of the host system 120 can be, for example, a microprocessor, a central processing unit (CPU), a processor core of a processor, an execution unit, etc. In some examples, the controller 116 can be referred to as a memory controller, a memory management unit, and / or an initiator. In one example, the controller 116 controls communication via a bus coupled between the host system 120 and the memory sub-system 110. In general, the controller 116 can send commands or requests to the memory sub-system 110 to make desired accesses to the memory devices 130, 140. The controller 116 can further include interface circuitry to communicate with the memory sub-system 110. The interface circuitry can convert responses received from the memory sub-system 110 into information for the host system 120.

[0139] The controller 116 of the host system 120 can communicate with the controller 115 of the memory sub-system 110 to perform operations such as reading data, writing data, or erasing data at the memory devices 130, 140, and other such operations. In some examples, the controller 116 is integrated within the same package as the processing device 118. In other examples, the controller 116 is separate from the package of the processing device 118. The controller 116 and / or the processing device 118 can include hardware such as one or more integrated circuits (ICs) and / or discrete components, a buffer memory, a cache memory, or a combination thereof. The controller 116 and / or the processing device 118 can be a microcontroller, special purpose logic circuitry (e.g., a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc.), or another suitable processor.

[0140] The memory devices 130, 140 can include any combination of different types of non-volatile and / or volatile memory components. Volatile memory devices (e.g., the memory device 140) can be, for example, random access memory (RAM) such as dynamic random access memory (DRAM) and synchronous dynamic random access memory (SDRAM).

[0141] Some examples of non-volatile memory components include “not and” (or NOT AND) (NAND)-type flash memory and in-situ write memory such as three-dimensional cross-point (“3D cross-point”) memory. Non-volatile memory cross-point arrays can perform bit storage based on bulk resistance changes in conjunction with a stacked cross-gate format data access array. Additionally, cross-point non-volatile memory can perform in-situ write operations in which a non-volatile memory cell can be programmed without the need to previously erase the non-volatile memory cell, in contrast to many flash-based memories. NAND-type flash memory includes, for example, two-dimensional NAND (2D NAND) and three-dimensional NAND (3D NAND).

[0142] Each of the memory devices 130 can include one or more arrays of memory cells. One type of memory cell, a single-level cell (SLC), can store one bit per cell. Other types of memory cells, such as multi-level cells (MLCs), triple-level cells (TLCs), and quad-level cells (QLCs), and five-level cells (PLCs), can store multiple bits per cell. In some embodiments, each of the memory devices 130 can include one or more arrays of memory cells, such as SLC, MLC, TLC, QLC, PLC, or any combination of such. In some embodiments, a particular memory device can include SLC, MLC, TLC, QLC, and / or PLC portions of memory cells. The memory cells of the memory devices 130 can be grouped into pages, which can refer to a logical unit of the memory device for storing data. For some types of memory (e.g., NAND), pages can be grouped to form blocks.

[0143] Although non-volatile memory devices such as 3D cross-point type and NAND type memory (e.g., 2D NAND, 3D NAND) are described, the memory devices 130 can be based on any other type of non-volatile memory, such as read-only memory (ROM), phase change memory (PCM), self-selecting memory, other chalcogenide-based memory, ferroelectric transistor random access memory (FeTRAM), ferroelectric random access memory (FeRAM), magnetic random access memory (MRAM), spin-transfer torque (STT)-MRAM, conductive-bridge RAM (CBRAM), resistive random access memory (RRAM), oxide-based RRAM (OxRAM), “not- or” (NOR) flash memory, and electrically erasable programmable read-only memory (EEPROM).

[0144] The memory sub-system controller 115 (or, for simplicity, the controller 115) can communicate with the memory devices 130 to perform operations such as reading data, writing data, or erasing data at the memory devices 130, and other such operations (e.g., in response to commands scheduled by the controller 116 on a command bus). The controller 115 can include hardware such as one or more integrated circuits (ICs) and / or discrete components, a buffer memory, or a combination thereof. The hardware can include digital circuitry with dedicated (e.g., hard-coded) logic for performing the operations described herein. The controller 115 can be a microcontroller, special purpose logic circuitry (e.g., a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc.), or another suitable processor.

[0145] The controller 115 can include a processing device 117 (e.g., a processor) configured to execute instructions stored in local memory 119. In the illustrated example, the local memory 119 of the controller 115 includes embedded memory configured to store instructions for executing various processes, operations, logic flows, and routines for controlling operations of the memory sub-system 110, including handling communications between the memory sub-system 110 and the host system 120.

[0146] In some embodiments, the local memory 119 can include memory registers that store memory pointers, fetched data, etc. The local memory 119 can also include read-only memory (ROM) for storing microcode. Although the example memory sub-system 110 has been illustrated as including the controller 115, in another embodiment of the disclosure, the memory sub-system 110 does not include the controller 115 and can instead rely on external control (e.g., provided by an external host, or by a processor or controller separate from the memory sub-system). Figure 8

[0147] Generally, the controller 115 can receive commands or operations from the host system 120 and can convert the commands or operations into instructions or appropriate commands to achieve the desired access to the memory devices 130. The controller 115 can be responsible for other operations such as wear leveling operations, garbage collection operations, error detection and error-correcting code (ECC) operations, encryption operations, caching operations, and address translations between logical addresses (e.g., logical block addresses (LBAs), namespaces) associated with the memory devices 130 and physical addresses (e.g., physical block addresses). The controller 115 can further include host interface circuitry to communicate with the host system 120 via the physical host interface. The host interface circuitry can convert commands received from the host system into command instructions to access the memory devices 130, and also convert responses associated with the memory devices 130 into information for the host system 120.

[0148] The memory sub-system 110 can also include additional circuitry or components that are not illustrated. In some embodiments, the memory sub-system 110 can include a cache or buffer (e.g., DRAM) and address circuitry (e.g., row and column decoders) that can receive addresses from the controller 115 and decode the addresses to access the memory devices 130.

[0149] ​In some embodiments, the memory device 130 includes a local media controller 150 that operates in conjunction with the memory sub-system controller 115 to perform operations on one or more memory units of the memory device 130. An external controller (e.g., the memory sub-system controller 115) can externally manage the memory device 130 (e.g., perform media management operations on the memory device 130). In some embodiments, the memory device 130 is a managed memory device, which is a raw memory device combined with a local controller (e.g., the local media controller 150) for media management within the same memory device package. An example of a managed memory device is a managed NAND (MNAND) device.

[0150] The controller 115 and / or the memory device 130 can include the security manager 113 discussed above. In some embodiments, the controller 115 in the memory sub-system 110 and / or the local media controller 150 can include at least a portion of the security manager 113. In other embodiments, or in combination, the controller 116 and / or the processing device 118 in the host system 120 can include at least a portion of the security manager 113. For example, the controller 115, the controller 116, and / or the processing device 118 can include logic circuitry that implements the security manager 113. For example, the controller 115 or the processing device 118 (e.g., a processor) of the host system 120 can be configured to execute instructions stored in a memory for performing the operations of the security manager 113 described herein. In some embodiments, the security manager 113 is implemented in an integrated circuit chip that is disposed in the memory sub-system 110. In other embodiments, the security manager 113 can be part of a firmware of the memory sub-system 110, an operating system, a device driver, or an application program of the host system 120, or any combination thereof.

[0151] Figure 9 An example machine in which a set of instructions for causing a machine to perform any one or more of the methodologies discussed herein can be executed is a computer system 400. In some embodiments, the computer system 400 can correspond to a host system (e.g., the host system 120 of FIG. 1) that includes, is coupled to, or utilizes a memory sub-system (e.g., the memory sub-system 110 of FIG. 1) or can be used to perform the operations of the security manager 113 (e.g., execute instructions to perform operations corresponding to the references Figure 8 Figure 8 Figures 1 to 8 ​​The machine can be a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a cellular telephone, a web appliance, a server, a network router, a switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while a single machine is illustrated, the term "machine" shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

[0152] The machine can be a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a cellular telephone, a web appliance, a server, a network router, a switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while a single machine is illustrated, the term "machine" shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

[0153] The example computer system 400 includes a processing device 402, a main memory 404 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM), static random access memory (SRAM), etc.), and a data storage device 418, which communicate with each other via a bus 430 (which can include multiple buses).

[0154] The processing device 402 represents one or more general -purpose processing devices such as a microprocessor, a central processing unit, or the like. More particularly, the processing device can be a complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or a processor implementing other instruction sets, or processors implementing a combination of instruction sets. The processing device 402 can also be one or more special-purpose processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), network processor, or the like. The processing device 402 is configured to execute instructions 426 for performing the operations and steps discussed herein. The computer system 400 can further include a network interface device 408 to communicate over the network 420.

[0155] The data storage system 418 can include a machine-readable medium 424 (also referred to as a computer-readable medium) on which is stored one or more sets of instructions 426 or software embodying any one or more of the methodologies or functions described herein. The instructions 426 can also reside, completely or at least partially, within the main memory 404 and / or within the processing device 402 during execution thereof by the computer system 400, the main memory 404 and the processing device 402 also constituting machine-readable storage media. The machine-readable medium 424, data storage system 418, and / or main memory 404 can correspond to memory subsystem 110 of FIG. 1. Figures 1 to 8

[0156] In one embodiment, the instructions 426 include instructions to implement functionality corresponding to the security manager 113 (e.g., the security manager 113 described with reference to FIG. 1). While the machine-readable medium 424 is shown in an example embodiment to be a single medium, the term "machine-readable storage medium" should be taken to include a single medium or multiple media that store one or more sets of instructions. The term "machine-readable storage medium" shall also be taken to include any medium that is capable of storing or encoding a set of instructions for execution by the machine and that cause the machine to perform any one or more of the methodologies of the present disclosure. The term "machine-readable storage medium" shall accordingly be taken to include, but not be limited to, solid-state memories, optical media, and magnetic media. Figures 1 to 8

[0157] Some portions of the preceding detailed descriptions have been presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These

[0158] It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. The present disclosure can refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage systems.

[0159] ​​The present disclosure also relates to an apparatus for performing the operations herein. This apparatus can be specially constructed for the intended purposes, or it can include a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program can be stored in a computer readable storage medium, such as, but not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, each coupled to a computer system bus.

[0160] The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Various general purpose systems can be used with programs in accordance with the teachings herein, or it can prove convenient to construct a more specialized apparatus to perform the method. The structure for a variety of these systems will appear as follows from the description. In addition, the present disclosure is not described with reference to any particular programming language. It will be appreciated that a variety of programming languages can be used to implement the teachings of the disclosure described herein.

[0161] The present disclosure can be provided as a computer program product, or software, that can include a machine-readable medium having stored thereon instructions, which can be used to program a computer system (or other electronic devices) to perform a process according to the present disclosure. A machine-readable medium includes any mechanism for storing information in a form readable by a machine (e.g., a computer). In some embodiments, a machine-readable (e.g., computer-readable) medium includes a machine (e.g., a computer) readable storage medium such as read only memory ("ROM"), random access memory ("RAM"), magnetic disk storage media, optical storage media, flash memory components, etc.

[0162] In this description, various functions and operations are described as being performed by or caused by computer instructions, e.g., software. However, it can be readily apparent to those skilled in the art that such expressions are used merely for convenience and that such functions and operations can be performed in different manners. For example, the data storage elements employed can be in memory locations that are separate from the computer instructions, e.g., software, used to execute the functions and operations. Alternatively, features of a single processor can be fabricated to perform one or more of the functions and operations described herein. Accordingly, it is appropriate that the functions and operations be referred to as being performed by or caused by a data processing system, e.g., a computer, a processor, or a controller, which can include a single processor or a plurality of processors, and that the data processing system be considered to be specially adapted to perform the functions and operations.

[0163] In the foregoing specification, embodiments of the disclosure have been described with reference to specific examples thereof. It is plain that various modifications can be made to the disclosure without departing from the broader spirit and scope of embodiments of the disclosure as set forth in the appended claims. The Specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.

Claims

1. A memory device comprising: a communication interface configured to connect to a host system; a memory unit having a memory region; and a logic circuit configured to control access to the memory region through the communication interface based on encryption; wherein the memory unit is configured to store a first component and a second component; and the memory region is configured to store component information about the second component; and wherein the logic circuit is configured to verify a health of the second component stored in the memory unit based on the component information stored in the memory region before a composite identifier of the second component is generated using a component identity of the second component.

2. The memory device of claim 1, wherein the component information includes a first digest and identifies a storage location of at least a portion of the second component in the memory unit; and the logic circuit is configured to retrieve content from the storage location to compute a second digest and compare the first digest with the second digest to verify the health of the second component.

3. The memory device of claim 2, wherein the component identity of the second component is based at least in part on the second digest.

4. The memory device of claim 3, wherein the component information includes an identification of each of: a manufacturer of the second component; a version of the second component; a build of the second component; or a level of the second component; or any combination thereof.

5. The memory device of claim 4, wherein the first component is a bootloader; the second component is an operating system; and the storage location is identified using a physical memory address.

6. The memory device of claim 4, wherein the first component is an operating system; the second component is an application; and the storage location is identified via a file system controlled by the operating system.

7. The memory device of claim 4, wherein the logic circuit is configured to, after determining that the second component is healthy, compute the component identity of the second component from the component information, and compute the composite identifier of the second component from the component identity of the second component and a secret of the first component.

8. The memory device of claim 7, further comprising: a unique device secret, wherein the secret of the first component is a composite identifier of the first component derived based on the unique device secret.

9. The memory device of claim 8, wherein the composite identifier of the first component is generated based on a composite identifier of a zeroth component stored in the memory unit and configured to execute before the first component; execution of the first component is dependent on execution of the zeroth component; and execution of the second component is dependent on execution of the first component.

10. The memory device of claim 9, wherein the logic circuit is further configured to compute an encryption key from the composite identifier of the first component and use the encryption key to generate a message authentication code of a message to prove possession of the composite identifier of the first component.

11. A method comprising: controlling, by a memory device, access to a memory region in the memory device based on encryption by a host system through a communication interface of the memory device; storing a first component and a second component that are executable in the host system in the memory device; storing component information about the second component in the memory region; verifying a health of the second component stored in the memory device based on the component information stored in the memory region; and in response to determining that the second component stored in the memory device is healthy, generating a composite identifier of the second component using a component identity of the second component.

12. The method of claim 11, wherein the component information includes a first digest and identifies a storage location of at least a portion of the second component in the memory device; and the method further comprises: retrieving content from the storage location; computing a second digest based at least in part on the content; and comparing the first digest and the second digest to verify the health of the second component.

13. The method of claim 12, wherein the component identity of the second component is based at least in part on the second digest; and the component information includes an identification of each of and the component identity of the second component is based on an identification of each of: a manufacturer of the second component; a version of the second component; a build of the second component; or a level of the second component; or any combination thereof.

14. The method of claim 13, wherein the first component is a bootloader; the second component is an operating system; and the storage location is identified using a physical memory address.

15. The method of claim 13, wherein the first component is an operating system; the second component is an application; and the storage location is identified via a file system controlled by the operating system.

16. The method of claim 13, further comprising: computing the component identity of the second component from the component information after determining that the second component is healthy; and computing the composite identifier of the second component from the component identity of the second component and a composite identifier of the first component, wherein the composite identifier of the first component is generated based on a unique device secret of the memory device.

17. The method of claim 16, wherein the composite identifier of the first component is generated based on a composite identifier of a zeroth component stored in the memory device and configured to execute prior to the first component; execution of the first component is dependent on execution of the zeroth component. execution of the second component depends on execution of the first component; and the method further comprises: computing an encryption key from the composite identifier of the first component; and generating a message authentication code of a message to prove possession of the composite identifier using the encryption key.

18. A computing device comprising: a host system; and a memory device having: a communication interface connected to the host system; a memory unit having a memory region; and a logic circuit configured to control access to the memory region over the communication interface based on encryption; wherein the computing device is configured to store a first component and a second component; wherein the memory region is configured to store component information regarding the second component; and wherein during a rooting of the computing device and prior to a component identity of the second component being used to generate a composite identifier of the second component, the computing device is configured to verify a health of the second component stored in the memory unit based on the component information stored in the memory region.

19. The computing device of claim 18, wherein the component information includes a first digest and identifies a storage location of at least a portion of the second component; and the computing device is further configured to, during execution of the first component in the host system: retrieve content from the storage location; compute a second digest based at least in part on the content; and compare the first digest to the second digest to verify the health of the second component.

20. The computing device of claim 19, wherein the component identity of the second component is based at least in part on the second digest; and the component information includes an identification of each of and the component identity of the second component is based on an identification of each of: a manufacturer of the second component; a version of the second component; a build of the second component; or a level of the second component; or any combination thereof.

Images