Secure memory device and method of accessing the same

Abstract

A secure memory device and an access method thereof are provided. The secure memory device includes a memory array, a secure access circuit, a normal access circuit, and a hardware protection measure. The memory array includes a secure storage partition assigned to a first address range and a normal storage partition assigned to a second address range disjoint from the first address range. The secure access circuit is configured to access the secure storage partition by generating an address in the first address range. The normal access circuit is configured to access the normal storage partition by generating an address in the second address range. The hardware protection measure is configured to prevent the normal access circuit from accessing the secure storage partition.

Description

Technical Field

[0001] The present invention generally relates to a memory device storing secure data, and more particularly to a secure memory device and a method for accessing secure data that can enhance the confidentiality and security of secure data. Background Technology

[0002] In various applications and host systems, memory devices are used to store both secure and general data. For example, sections of a memory device may be reserved for storing sensitive data such as encryption keys. Ensuring that secure data is accessed only by authorized parties is crucial, even when the device is vulnerable to a fault injection attack. Summary of the Invention

[0003] To prevent secure storage devices from being subjected to physical attacks or fault injection attacks, which could lead to the leakage of secure data, one embodiment of the present invention provides a secure storage device and its access method.

[0004] The embodiments of the present invention described herein provide a secure memory device, comprising a memory array, secure access circuitry, normal access circuitry, and hardware protection measures. The memory array includes a secure memory partition allocated to a first address range and a normal memory partition allocated to a second address range that does not intersect with the first address range. The secure access circuitry is configured to access the secure memory partition by generating an address within the first address range. The normal access circuitry is configured to access the normal memory partition by generating an address within the second address range. The hardware protection measures are configured to prevent the normal access circuitry from accessing the secure memory partition.

[0005] According to the embodiments described herein, an access method for a secure memory device is also provided. The method includes: in a memory array comprising a secure memory partition allocated to a first address range and a normal memory partition allocated to a second address range that does not intersect with the first address range, accessing the secure memory partition using secure access circuitry by generating an address in the first address range, and accessing the normal memory partition using normal access circuitry by generating an address in the second address range. Access to the secure memory partition by normal access circuitry is prevented.

[0006] The invention will be more fully understood from the following detailed description of embodiments of the invention taken in conjunction with the accompanying drawings. Attached Figure Description

[0007] Figure 1 This is a schematic diagram of a secure storage device according to an embodiment of the present invention;

[0008] Figure 2 This is a schematic diagram of a secure storage partition according to an embodiment of the present invention;

[0009] Figure 3 A flowchart illustrating a method for accessing secure data in a secure storage device according to an embodiment of the present invention is provided.

[0010] Explanation of icon numbers

[0011] 20: Secure storage device;

[0012] 24: Memory array;

[0013] 26: Secure partition access control circuit;

[0014] 28: Security Partition;

[0015] 32: Normal partition;

[0016] 36: Security access circuit;

[0017] 40: General access circuit;

[0018] 42: Hardware protection measures;

[0019] 44: Data area;

[0020] 48: CRC area;

[0021] 52: Address allocation phase;

[0022] 56: Data Input Stage;

[0023] 60: Inspection phase;

[0024] 64: Ordinary allocation phase;

[0025] 68: Safe allocation phase;

[0026] 72: Address generation stage;

[0027] 76: CRC calculation stage;

[0028] 80: Storage stage;

[0029] SEC: Dedicated control signal. Detailed Implementation

[0030] The embodiments of the present invention described herein provide improved techniques for storing both security data and general data in the same memory device.

[0031] In the disclosed embodiments, the secure memory device includes a memory array, wherein one or more memory regions in the memory array are designated as secure memory partitions, and one or more memory regions are designated as ordinary memory partitions. Each partition is assigned a corresponding address range. The secure memory device further includes: at least one secure access circuit configured to access the secure memory partitions, for example, generating an address located within the address range of the secure memory partitions; and at least one ordinary access circuit configured to access the ordinary memory partitions.

[0032] By using disjoint address ranges and independent access circuits (i.e., independent security access circuits and normal access circuits), a degree of logical separation can be provided between secure data and normal data. Nevertheless, this configuration is still vulnerable to physical attacks, such as fault injection or power outages, which could cause normal access circuits to unintentionally access the secure memory partition, i.e., generate addresses falling within the address range of the secure memory partition.

[0033] In some embodiments of the invention, the secure memory device includes hardware protection measures that prevent ordinary access circuitry from accessing the secure memory partition. For example, this hardware protection measure (in...) Figure 1 The notation 42) prevents the normal access circuit from generating addresses falling within the address range of the secure memory partition. For ease of explanation, the following description will use an example of a secure memory device comprising a single secure memory partition, a single normal memory partition, a single secure access circuit, and a single normal access circuit. However, the invention is not limited to this and may include any suitable number of secure memory partitions, normal memory partitions, secure access circuits, and normal access circuits.

[0034] In some embodiments, the memory is divided into a low address range and a high address range. The low address range includes addresses where a predefined number of Most Significant Bits (MSBs) are "0". The high address range includes addresses where one or more of these MSBs have values ​​different from those in the low address range. Any suitable number of MSBs (e.g., a single MSB) can be used for this partition. The low address range is designated as a normal memory partition, and the high address range is designated as a secure memory partition.

[0035] In this embodiment, to prevent ordinary access circuits from generating addresses in the high address range, a predefined number of MSBs on the address bus of the ordinary access circuit are hard-wired to the voltage corresponding to logic "0". Through this hardware protection measure, physical attacks or hardware failures cannot cause the ordinary access circuits to generate addresses belonging to the secure memory partition.

[0036] In some embodiments, address ranges for secure memory and ordinary memory partitions are allocated such that the Hamming distance between any address in the secure memory partition and any address in the ordinary memory partition is greater than one. This allows for a suitable offset between the address ranges, which is more stringent than simply allocating disjoint address ranges. In one instance, the lower address range includes addresses with four MSBs equal to "0", while the higher address range includes addresses with four MSBs equal to 0x3 (or 0x6, or any other four-bit value including at least two "1"s).

[0037] In some embodiments, hardware protection measures include a dedicated control signal that is asserted when the secure access circuitry accesses the secure memory partition. The memory array includes circuitry configured to monitor the dedicated control signal and only allow access to the secure memory partition when the dedicated control signal is activated. Because the ordinary access circuitry does not support this dedicated control signal, it can prevent the ordinary access circuitry from accessing the secure memory partition.

[0038] In some embodiments, when writing data to a memory line, the secure access circuitry and / or the normal access circuitry writes the data along with an error detection code (EDC), such as a cyclic redundancy check (CRC) code or an error correction code (ECC). When reading data from a memory line, the secure access circuitry and / or the normal access circuitry calculates the expected EDC based on the read data and compares the expected EDC with the EDC stored in the memory line (which may also be referred to herein as verification). To further prevent unauthorized access to the secure storage partition, the memory access circuitry calculates not only the EDC on the data but also the EDC on at least a portion of the addresses, and only returns the data to the user if the EDCs match. Thus, even if a physical attack or hardware failure successfully writes to a memory line in the secure storage partition, this illegal write is likely to be detected when reading the data because the expected EDC will not match the stored EDC.

[0039] In some embodiments, the secure storage device includes two or more hardware protection measures (also known as blocking points) as exemplified below, thereby blocking physical attacks as much as possible and reducing hardware failures.

[0040] The hardware protection measures described in some embodiments of the present invention can effectively prevent unauthorized access to the secure storage partition. Because some embodiments of the present invention are effective against physical attacks and hardware failures, they can enhance security and confidentiality in certain use cases (e.g., in automotive systems). This enhanced security and confidentiality facilitates the sharing of memory device resources, such as power supply, charge pumps, sense amplifiers, and logic control, between the general storage partition and the secure storage partition, thereby contributing to the miniaturization of the secure memory device.

[0041] Figure 1 A block diagram illustrating a secure memory device 20 according to an embodiment of the present invention is provided. The secure memory device 20 includes a memory array 24. The memory array 24 may include non-volatile memory such as flash memory, volatile memory such as random access memory (RAM), or any other suitable memory type.

[0042] In this example, a secure storage partition 28 and a general storage partition 32 (also referred to as the "secure partition" and the "general partition," respectively) are defined within the memory array 24. Secure partition 28 is used to store sensitive information, such as secret keys, passwords or other credentials, personal information (e.g., credit card numbers), or any other suitable information deemed secure or sensitive for any reason. Access to secure partition 28 may be restricted or require some form of encryption, such as encryption or authentication. General partition 32 can be used to store any suitable information that is generally considered less secure or sensitive than the information stored in secure partition 28.

[0043] In this embodiment, the security partition 28 and the normal partition 32 are respectively allocated to corresponding address ranges within the address space of the memory array 24. The address ranges may have the same size or different sizes, each address range may be contiguous or non-contiguous, and each address range may include any suitable number of addresses. Specifically, the address ranges allocated to partitions 28 and 32 do not overlap, that is, they do not intersect.

[0044] The secure storage device 20 further includes a secure access circuit 36 ​​for accessing (reading and writing) data in the secure partition 28, and a general access circuit 40 for accessing (reading and writing) data in the general partition 32.

[0045] Each memory access circuit (secure access circuit 36 ​​or normal access circuit 40) accesses the memory array 24 using both the data bus and the address bus. In a typical write operation, the memory access circuit receives data to be written to the memory array 24. The memory access circuit generates an address within the appropriate partition's address range (secure partition 28 or normal partition 32) and sends a write command with the address on the address bus and the data on the data bus to the memory array 24. In a typical read operation, the memory access circuit receives a request to read data from the memory array 24. The memory access circuit generates an address within the appropriate partition's address range and sends a read command with the address to the memory array 24 via the address bus. In response, the memory array 24 returns the requested data via the data bus.

[0046] The secure access circuit 36 ​​and the general access circuit 40 may include, for example, data paths or any other suitable circuitry that performs memory access operations. The secure access circuit 36 ​​and the general access circuit 40 may serve any suitable host, application, or other entity that stores data in the secure storage device 20.

[0047] The various components of the secure memory device 20 (including the memory array 24, secure access circuitry 36, and general access circuitry 40) are typically integrated into a single semiconductor device package, such as a single die or multiple dies. The secure memory device 20 can be installed in any suitable host system, such as a computer or automotive electronics unit.

[0048] Figure 1 The configuration of the secure memory device 20 shown is an example configuration chosen purely for clarity of concept. Any other suitable configuration may be used in alternative embodiments. For example, as mentioned above, the memory array 24 may include any suitable number of secure memory partitions 28 and general memory partitions 32, and the secure memory device 20 may include any suitable number of secure access circuits 36 and general access circuits 40.

[0049] In various embodiments, the secure memory device 20 may be implemented in hardware, for example, using one or more application-specific integrated circuits (ASICs) and / or field-programmable gate arrays (FPGAs). The memory array 24 may include any suitable type of volatile or non-volatile memory, such as RAM or flash memory.

[0050] One embodiment of the present invention provides a technique for preventing ordinary access circuitry from accessing a secure memory partition. In various embodiments, the secure memory device 20 may include various hardware protection measures (also referred to as blocking points) for preventing ordinary access circuitry 40 from generating addresses that fall within the address range of the secure memory partition 28.

[0051] In one embodiment, the blocking point can be a hardwired bus in the address bus of a typical access circuit. For example... Figure 1 As shown, the normal partition 32 corresponds to the low address range, and the secure partition 28 corresponds to the high address range. As previously stated, the low address range includes addresses where a predefined number of MSBs (one or more MSBs) are "0". The high address range includes addresses where a predefined number of MSBs are "1".

[0052] In detail, the blocking point, as described in this invention, can be implemented by hard-wired a predefined subset of the lines of the address bus of the normal access circuit 40 to a voltage corresponding to a logic "0", which corresponds to the MSB set to "0" in the address range of normal partition 32. Depending on the logic used, this voltage can be, for example, the power supply voltage Vcc, ground, or any other suitable voltage that causes the MSB to "0", regardless of the voltage that the normal access circuit 40 may attempt to send on these buses. In this embodiment, hard-wired the address bus to "0" corresponding to the MSB set to "0" in the address range of normal partition 32, effectively preventing the normal access circuit 40 from generating addresses located in the high address range (i.e., the address range of security partition 28).

[0053] In one example implementation, the address range of normal partition 32 is 00000000h to 00FFFFFFh, providing 16MB of normal access memory, and the address range of security partition 28 is greater than or equal to 01000000h. In one example, the predefined number of MSBs hardwired to "0" is 2. Alternatively, any other suitable address range and any other suitable number of MSBs can be used.

[0054] In an alternative embodiment, the lower address range can be allocated to the secure partition and the higher address range to the normal partition. Furthermore, the bits used to distinguish the address ranges of the secure partition from the normal partition do not necessarily have to be the MSB of the address. That is, more broadly speaking, the address range of the secure partition of the secure memory device 20 of the present invention can be configured to have one or more given addresses set to a corresponding first value; while the address range of the normal partition can be configured to have one or more given addresses set to a corresponding second value relative to the corresponding first value; and the secure memory device 20 may include hardware protection measures (42) that force one or more given addresses on the address bus of the normal access circuitry to be set to the corresponding second value.

[0055] In one embodiment, the blocking point may be maintaining a large Hamming distance between the address ranges of the normal partition and the secure partition. In some embodiments, the address ranges of secure partition 28 and normal partition 32 are allocated such that the Hamming distance between any address in secure partition 28 and any address in normal partition 32 is greater than one. The Hamming distance between two addresses is limited to the number of corresponding bits that differ between the addresses. By maintaining a Hamming distance greater than one between the address ranges of the normal partition and the secure partition, an attack or hardware failure would need to flip more than one bit to have a chance of changing an address in normal partition 32 to an address in secure partition 28, thereby significantly reducing the likelihood of an attack or hardware failure successfully accessing secure partition 28.

[0056] For example, when using a 32-bit address, if a normal partition 32 is allocated to an address range where four MSBs (bits [31:28]) are “0”, then to achieve a larger Hamming distance, a secure partition 28 can be allocated to an address range where four MSBs are 0x3 (“0011”). In another embodiment, a secure partition 28 can be allocated to an address range where four MSBs are 0x6 (“0110”). Alternatively, a secure partition 28 can be allocated to an address range that includes any other four-bit value containing at least two “1”s.

[0057] In one embodiment, the blocking point may be a dedicated control signal indicating access to the secure partition. Figure 1 For example, hardware protection 42 can be configured to activate a dedicated control signal SEC when accessing secure memory partition 28, and memory array 24 is configured to allow access to secure memory partition 28 only when the dedicated control signal SEC is activated. Specifically, secure access circuitry 36 is configured to activate the dedicated control signal SEC when accessing secure partition 28. Memory array 24 includes secure partition access control circuitry 26, which is configured to monitor the dedicated control signal SEC and allow access to secure partition 28 only when the dedicated control signal SEC is activated. Ordinary access circuitry 40 does not support the dedicated control signal SEC and cannot activate it. Therefore, even if a physical attack or hardware failure successfully causes ordinary access circuitry 40 to generate an address falling within the address range of secure partition 28, secure partition access control circuitry 26 in memory array 24 will still refuse access to secure partition 28 because the dedicated control signal SEC is not activated.

[0058] In one embodiment, the blocking point may be an EDC calculation and comparison of data and addresses. In some embodiments, when writing data to a memory line in memory array 24, memory access circuitry (secure access circuitry 36 or normal access circuitry 40) writes the data and an error detection code (EDC), such as a cyclic redundancy check (CRC) code or an error correction code (ECC). When reading data from a memory line, the memory access circuitry calculates an expected EDC based on the read data and compares the expected EDC with the EDC stored in the memory line. The read operation is considered legitimate (i.e., authorized access) only if the expected EDC matches the stored EDC. In some embodiments, to further block unauthorized access to secure partition 28, the memory access circuitry calculates not only the EDC on the data (or at least a portion of the data) but also the EDC on at least a portion of the addresses.

[0059] Figure 2 This is a schematic diagram of a secure storage partition according to an embodiment of the present invention. Figure 2 The diagram shows multiple memory lines in secure partition 28. Each memory line includes a data area 44 and a corresponding CRC area 48. In this embodiment, the secure access circuit 36 ​​can perform CRC calculations on the data in the data area 44 of the accessed memory line and the address of the memory line.

[0060] By performing EDC calculations on the data and address, even if a physical attack or hardware failure successfully causes the ordinary access circuit 40 to write to the memory line in the secure partition 28 (i.e., illegal write), when reading the data, because the expected EDC will not match the stored EDC, that is, an error will be detected based on the verification result of the error detection code or error correction code. This can identify the illegal write (i.e., identify the fault or attack), thereby preventing the output of read data.

[0061] Figure 3 A flowchart illustrating a method for accessing secure data in a secure storage device 20 according to an embodiment of the present invention is provided. It should be noted that, although... Figure 3 This example uses a write operation, but a read operation can be performed in a similar way.

[0062] like Figure 3 As shown, the secure data access method of this embodiment begins in address allocation phase 52 to allocate appropriate address ranges to the normal partition 32 and the secure partition 28. Next, in data input phase 56, the secure storage device 20 receives data for storage in the memory array 24. Then, in checking phase 60, the secure storage device 20 determines whether the data should be written to the normal storage partition 32 or the secure storage partition 28.

[0063] If it is determined that the data will be stored in the normal partition 32, the secure storage device 20 will execute the normal allocation phase 64, that is, designate the normal access circuit 40 to perform the write operation. Conversely, if it is determined that the data will be stored in the secure partition 28, the secure storage device 20 will execute the secure allocation phase 68, that is, designate the secure access circuit 36 ​​to perform the write operation.

[0064] Next, in address generation stage 72, the designated memory access circuit generates the desired storage address for the data to be stored. In CRC calculation stage 76, the memory access circuit performs a CRC calculation on the data to be stored and the generated address. In storage stage 80, the memory access circuit stores the data to be stored and the calculated CRC in the memory line corresponding to the generated address.

[0065] Figure 3 The method described is merely an example for the sake of conceptual clarity; in other alternative embodiments, those skilled in the art can derive any other suitable process based on the spirit of the invention and the prior art.

[0066] In some embodiments, it may be possible Figure 3 The secure memory device 20 employs any one or a combination of the aforementioned blocking points (hard-wired address bus lines of the normal access circuitry, maintaining a large Hamming distance between the address range of the normal partition and the address range of the secure partition, using dedicated control signals to indicate access to the secure partition, and performing EDC calculations and comparisons on data and addresses). The combined use of these blocking points can further reduce the probability that the normal access circuitry will generate addresses within the address range of the secure partition due to physical attacks or hardware failures. In various embodiments, suitable variations and combinations of these blocking points can be made based on the spirit of the invention.

[0067] This invention facilitates the miniaturization of secure memory devices, thereby increasing the total number of dies on a wafer. Consequently, this invention reduces the production cost and energy consumption of individual ICs, as well as the energy consumption of subsequent packaging, thus reducing carbon emissions during the production of secure memory devices. Furthermore, because the confidentiality and security of the secure memory devices of this invention are improved, their lifespan is extended, and they are suitable for applications requiring high security, such as electric vehicles and IoT devices, this invention provides a green semiconductor technology.

[0068] It should be understood that the present invention is not limited to the contents described above. In other words, the scope of the present invention includes both combinations of the various features described above and variations and modifications of the invention that will appear to those skilled in the art after reading the foregoing description and that are not disclosed in the prior art.

Claims

1. A secure storage device, comprising: The memory array includes a security storage partition allocated to a first address range and a normal storage partition allocated to a second address range that does not intersect with the first address range; A secure access circuit is configured to access the secure storage partition by generating an address within the first address range; A normal access circuit is configured to access the normal memory partition by generating an address in the second address range; as well as Hardware protection measures are configured to prevent the normal access circuitry from accessing the secure storage partition. The hardware protection measures are configured to be at least one of the following: Hardwire the corresponding line on the address bus of the normal access circuit to the voltage corresponding to the second bit value to prevent the normal access circuit from generating an address in the first address range allocated to the secure storage partition, the address in the first address range having one or more given positions set as the first bit value, and the address in the second address range having one or more given positions set as the second bit value relative to the first bit value. Ensure that the Hamming distance between any address in the first address range and any address in the second address range is greater than one; and A dedicated control signal is activated when the secure storage partition is accessed, and the memory array is configured to allow access to the secure storage partition only when the dedicated control signal is activated.

2. The secure storage device of claim 1, wherein the storage array further comprises a secure partition access control circuit disposed between the secure storage partition and the secure access circuit, and configured to receive the dedicated control signal and allow access to the secure storage partition according to the activated dedicated control signal.

3. The secure storage device of claim 1, wherein one or both of the secure access circuit and the normal access circuit are configured as follows: During the period of storing data at a specified address, error detection code calculation or error correction code calculation is performed on at least a portion of the data and at least a portion of the specified address, and the data and the error detection code or the error correction code are stored in the secure storage partition or the normal storage partition according to the specified address; During the reading of the data from the specified address, verify the error detection code or the error correction code; as well as In response to an error detected by the error detection code or the error correction code, a fault or attack is identified and the data is avoided as output.

4. The secure storage device according to claim 3, wherein the error detection code is a cyclic redundancy check code.

5. A method for accessing a secure storage device, comprising: In a memory array comprising a secure storage partition allocated to a first address range and a normal storage partition allocated to a second address range that does not intersect with the first address range, the secure storage partition is accessed using secure access circuitry by generating an address within the first address range, and the normal storage partition is accessed using normal access circuitry by generating an address within the second address range; and Prevent the normal access circuitry from accessing the secure storage partition. Preventing the normal access circuit from accessing the secure storage partition includes at least one of the following: Hardwire the corresponding lines on the address bus of the general access circuit to the voltage corresponding to the second bit value, wherein the address in the first address range has one or more given positions set as the first bit value, and the address in the second address range has one or more given positions set as the second bit value relative to the first bit value. Ensure that the Hamming distance between any address in the first address range and any address in the second address range is greater than one; and A dedicated control signal is activated when accessing the secure storage partition, and access to the secure storage partition is only permitted when the dedicated control signal is activated.

6. The method for accessing a secure storage device according to claim 5, wherein accessing one or both of the secure storage partition and the ordinary storage partition comprises: During the period of storing data at a specified address, error detection code calculation or error correction code calculation is performed on at least a portion of the data and at least a portion of the specified address, and the data and the error detection code or the error correction code are stored in the secure storage partition or the normal storage partition according to the specified address; During the reading of the data from the specified address, verify the error detection code or the error correction code; as well as In response to an error detected by the error detection code or the error correction code, a fault or attack is identified and the data is avoided as output.

7. The access method for a secure memory device according to claim 6, wherein the error detection code is a cyclic redundancy check code.

Images