Erase verification of non-volatile memory

Abstract

The invention relates to erase verification of non-volatile memory. In some examples, a system includes a non-volatile memory to store information and a controller subsystem to perform various tasks. The controller subsystem receives an input from an entity to trigger an erase verification operation after erasing a memory region of the non-volatile memory containing the information. The controller subsystem generates a pseudo-random pattern in response to the input and writes the pseudo-random pattern to the memory region as part of the erase verify operation. After the writing, the controller subsystem provides the pseudo-random pattern retrieved from the memory region from the non-volatile memory to the entity to verify that an erasure of the information of the memory region has occurred.

Description

Background Art

[0001] An electronic device may include a memory for storing information, including data, machine-readable instructions, configuration information, etc. The memory may include a non-volatile memory or a volatile memory. If the volatile memory loses power, the information stored in the volatile memory will be lost. On the other hand, even if the non-volatile memory loses power, the information stored in the non-volatile memory will be retained by the non-volatile memory. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] Some embodiments of the disclosure are described with respect to the following figures.

[0003] Figure 1 is a block diagram of a system including a controller capable of generating a pseudo-random pattern to write to an erased memory area of ​​a non-volatile memory for erase verification, according to some examples.

[0004] Figure 2A and Figure 2B is a flow chart of an erase verification process according to some examples.

[0005] Figure 3 is a block diagram of a system according to some examples.

[0006] Figure 4 is a block diagram of a storage medium storing machine-readable instructions according to some examples.

[0007] Figure 5 is a flow diagram of a process according to some examples.

[0008] Throughout the drawings, the same reference numerals refer to similar, but not necessarily identical, elements. The drawings are not necessarily drawn to scale, and the dimensions of some parts may be exaggerated to more clearly illustrate the examples shown. In addition, the drawings provide examples and / or implementations consistent with the description; however, the description is not limited to the examples and / or implementations provided in the drawings. DETAILED DESCRIPTION

[0009] Information stored in a memory area of ​​a non-volatile memory in a computer system can be erased using an erase operation that writes a specific erase pattern (e.g., all 0s or all 1s) to the memory area of ​​the non-volatile memory. If the computer system is compromised by an attacker, the attacker may prevent the erase operation on the memory area from being completed. The attacker may include malware executed in the computer system or a physical component inserted into the computer system. By preventing the erase operation from being completed, the attacker may retain the information stored in the memory area so that the information can be obtained and used in an unauthorized manner at a later time. The information in the memory area may include sensitive information that can be used to attack the system or other devices coupled to the system.

[0010] When the entity requesting the erase operation attempts to read the memory region to confirm that the erase operation has completed, an attacker may intercept the read request. Instead of returning the actual information in the memory region that should have been erased, the attacker may return the expected erase pattern to the entity. The entity receiving the erase pattern from the attacker is deceived into believing that the erase operation has completed, when in fact the sensitive information is still stored in the memory region.

[0011] According to some embodiments of the present disclosure, after a memory area of ​​a non-volatile memory has been erased, a controller in a computer system may participate in a secure erase verification operation for verifying that the memory area has been successfully erased. In some examples, a verifier (e.g., a person, a program, or a machine) sends an input (e.g., a request or any other type of input information) to the controller to initiate an erase verification operation. The controller generates a pseudo-random pattern in response to the input, and the controller writes the pseudo-random pattern to the erased memory area. The pseudo-random pattern is different from the erase pattern written to the non-volatile memory by the erase operation. The verifier may issue a read request to obtain the pseudo-random pattern from the memory area to confirm that the erase operation of the memory area has been successfully completed.

[0012] If an attacker is present in the computer system and intercepts a read request from the verifier, the attacker will return an erase pattern that is different from the pseudo-random pattern that the controller writes to the memory area. If the verifier does not receive the pseudo-random pattern (but instead receives the erase pattern or another different pattern), the verifier can determine that an anomaly has occurred, such as due to the presence of an attacker or a malfunction of the computer system. The verifier can provide an anomaly alert, or the verifier can initiate remedial action to resolve the anomaly, such as by powering off or otherwise disabling the computer system or a portion of the computer system.

[0013] A verifier may be an electronic component or a program in a computer system. Alternatively, a verifier may be external to the computer system and may include a user, a program, or a machine. A "computer system" may refer to one computer or an arrangement of multiple computers. A "computer" may refer to a desktop computer, a notebook computer, a tablet computer, a server computer, a vehicle, a home appliance, a storage system, a communication node, or any other type of electronic device.

[0014] A "pseudo-random pattern" that can be written to a memory area can refer to any information pattern that is not a uniform pattern (such as a pattern of all 0s or all 1s). Moreover, the pseudo-random pattern is unpredictable and incompressible. The pseudo-random pattern may include a random bit sequence generated by a deterministic random bit generator (DRBG) based on an initial value, such as a seed. A DRBG may also be referred to as a pseudo-random number generator or a deterministic random number generator. More generally, a pseudo-random pattern may be generated by a pattern generator based on a seed. A change in the seed value will cause the pattern generator to generate different pseudo-random patterns.

[0015] A pattern is pseudorandom when it is deterministic but also effectively random as long as the internal operations of the process that generates the pattern (e.g., the seed used and / or the algorithm used) are hidden from observation. For cryptographic purposes, a pattern is effectively random if it is computationally indistinguishable from random within a threshold of a target security strength. Examples of pseudorandom pattern generators include any one or some combination of the following: a linear congruence generator, a Lehmer generator, a Park-Miller generator, or any other type of random number generator.

[0016] A pattern is unpredictable if an entity without access to the internal processes of the pattern's generator cannot reproduce the pattern. A pattern is incompressible if the compressibility of the information in the pattern is less than a specified threshold, e.g., the compressibility of the information in the pattern is less than 1%, 2%, 5%, or any other value. The "compressibility" of information refers to the relative reduction in storage space used to store the compressed information compared to the storage space used to store the information before compression.

[0017] Figure 1 is a block diagram of a computer system 100 including one or more main processors 102 and a management module 104. The management module 104 includes a baseboard management controller (BMC) 106, a secure enclave 114, and secure memory 118. The management module 104 may be implemented with an integrated circuit chip, a circuit board, or an arrangement of discrete electronic components.

[0018] BMC 106 performs various management tasks, which will be discussed further below. Although reference is made to a BMC in some examples, other types of controllers may also be used in other examples. As used herein, a "controller" may refer to one or more hardware processing circuits, which may include any one or some combination of a microprocessor, a core of a multi-core microprocessor, a microcontroller, a programmable integrated circuit, a programmable gate array, or another hardware processing circuit. Alternatively, a "controller" may refer to a combination of one or more hardware processing circuits and machine-readable instructions (software and / or firmware) that may be executed on the one or more hardware processing circuits.

[0019] The processor may include a microprocessor, a core of a multi-core microprocessor, a microcontroller, a programmable integrated circuit, a programmable gate array, or another hardware processing circuit. One or more main processors 102 of the computer system 100 may execute various machine-readable instructions of the computer system 100, such as an operating system (OS) 108, application programs 110, firmware 112 (e.g., including basic input and output system (BIOS) code or unified extensible firmware interface (UEFI) code) and other machine-readable instructions. One or more main processors 102 may be coupled to the BMC 106, such as through an input / output (I / O) bridge (not shown), which is a device that interconnects various different components.

[0020] The secure enclave 114 (also referred to as a security boundary or security perimeter) includes a subsystem of the management module 104 for which access to and from the subsystem is more strictly controlled than access to other subsystems of the management module 104. For example, the secure enclave 114 is disposed entirely within a cryptographic boundary. A "cryptographic boundary" may refer to a continuous boundary or perimeter that contains logical and physical components of a cryptographic subsystem, such as components of the secure enclave 114. According to some examples, the secure enclave 114 is isolated from components outside of the secure enclave 114. The cryptographic boundary is defined using a secure access mechanism, such as by using encryption or another type of access control to protect components in the secure enclave 114 from unauthorized access by components outside of the secure enclave 114.

[0021] The secure enclave 114 includes a security processor 116 that can perform various security-related functions of the management module 104, including generating and / or maintaining keys associated with cryptographic operations, such as encryption keys for encrypting information and / or private keys for signing information. The security processor 116 can also maintain security certificates for authenticating the identity of an entity such as a user, program, website, organization, device, program, or any other type of entity. Further examples of security-related functions that can be performed by the security processor 116 include root of trust operations (including measuring information such as machine-readable instructions, performing signature verification, performing decryption, performing attestation, etc.), random number and entropy generation, or other security-related functions.

[0022] As part of the security functions performed by the security processor 116, the security processor 116 may store sensitive information in a secure memory 118 of the management module 104. The secure memory 118 may be implemented using one or more non-volatile memory devices, such as flash memory devices, erasable programmable read-only memory (EPROM) devices, electrically erasable programmable read-only memory (EEPROM) devices, and / or other types of non-volatile memory devices. In some examples, the secure memory 118 is accessible only to components of the secure enclave 114, and the secure memory 118 is not accessible to other components outside the secure enclave 114. Examples of sensitive information that may be stored in the secure memory 118 include keys (e.g., encryption keys, private keys, etc.), certificates, device identifiers, etc. If such sensitive information is accessed by an unauthorized entity (e.g., an attacker), the unauthorized entity may use the sensitive information to access other parts of the computer system 100 or perform operations in the computer system 100 that may cause errors or failures in the computer system 100.

[0023] The computer system 100 further includes an external memory 120 located outside the management module 104. The external memory 120 can be implemented using one or more non-volatile memory devices. In some examples, the external memory 120 can also store sensitive information, such as confidential information, proprietary information of the enterprise, etc. Figure 1 Not shown, but computer system 100 may include other memory, including memory accessible by host processor(s) 102 .

[0024] The BMC 106 and the security processor 116 of the secure enclave 114 are part of a controller subsystem 105 in the computer system 100. The controller subsystem 105 further includes one or more memory controllers 107 that can be used to access the secure memory 118 and / or the external memory 120. For example, the memory controller(s) 107 can be coupled to the secure memory 118 and / or the external memory 120 through a specific port, such as a universal serial bus (USB) port or another port. As an example, the memory controller(s) 107 can be used for certain types of memory access, such as memory reads for verifying the contents of the memory. The memory controller(s) 107 may not be used for other types of memory access, such as write operations.

[0025] More generally, a "controller subsystem" refers to a subsystem (ie, a portion of a computer system) that includes one or more controllers.

[0026] like Figure 1 As depicted, secure memory 118 includes one or more memory regions 122 storing corresponding sensitive information 124. Similarly, external memory 120 includes one or more memory regions 126 storing corresponding sensitive information 128. A "memory region" of memory may refer to a portion of memory, where the portion may consist of a contiguous segment of memory or consist of a non-contiguous segment of memory.

[0027] BMC 106 is coupled to secure enclave 114 and external memory 120 via bus 134. Bus 134 may refer to any type of communication link over which electronic components can communicate.

[0028] In some examples, BMC 106 includes an erase engine 130 capable of erasing information stored in any memory area of ​​secure memory 118 or external memory 120. An "engine" of BMC 106 includes a portion of hardware processing circuitry of BMC 106 or machine-readable instructions executable by BMC 106.

[0029] The erase engine 130 may issue an erase command 131, which is sent via a bus 134. The erase command 131 is issued by the erase engine 130 in response to an erase request 138 sent from an entity 132 to the BMC 106. The entity 132 may include machine-readable instructions executed on the host processor(s) 102, or alternatively, the entity 132 may include a hardware component in the computer system 100. In further examples, the entity 132 may be external to the computer system 100. For example, such a remote entity may include a remote management controller that communicates with the BMC 106 via a management network.

[0030] Entity 132 may issue wipe request 138 for any of a variety of different purposes. For example, wipe request 138 may be issued for the purpose of decommissioning computer system 100. As another example, wipe request 138 may be issued when computer system 100 is to be shipped to a repair facility to fix a problem in computer system 100. Wipe requests may also be issued for any of a variety of other reasons.

[0031] The erase command 131 from the erase engine 130 of the BMC 106 may target the secure memory 118 or the external memory 120. If the erase command 131 targets the secure memory 118, the secure processor 116 receives the erase command 131 through the bus 134 and issues an erase operation to erase the memory area of ​​the secure memory 118 specified by the erase command 131. If the erase command 131 targets the external memory 120, the external memory 120 receives the erase command 131 through the bus 134 and erases the memory area of ​​the external memory 120 specified by the erase command 131.

[0032] An erase command from erase engine 130 causes an erase pattern to be written to a designated memory region of secure memory 118 or external memory 120. The erase pattern may include a pattern of all zeros or all ones, or any other predefined pattern that overwrites information stored in a memory region.

[0033] According to some embodiments of the present disclosure, BMC 106 includes an erase verification engine 150 that is capable of performing erase verification operations to allow entity 132 (or any other entity) to verify that a memory region of memory (118 or 120) erased by erase engine 130 was actually successfully erased. Figure 1 In the example of FIG. 1 , entity 132 may include a seed generator 140 that performs a key negotiation process with an erase verification engine 150 of BMC 106 to generate a seed to be used as part of an erase verification operation.

[0034] Seed generator 140 may be implemented using a portion of hardware processing circuitry or machine-readable instructions of entity 132. In some examples, the seed may include a random number (also referred to as a nonce).

[0035] The key negotiation process takes place between two entities ( Figure 1A key agreement algorithm is implemented between entity 132 in and erasure verification engine 150 to establish a shared secret (the seed described above) to be used to perform the erasure verification operation. An example of a key agreement algorithm is the Diffie-Hellman key agreement algorithm. The key agreement algorithm allows two or more entities to agree on a shared secret in a way that these entities influence the result (the generated shared secret) without an unauthorized third party being able to force the selection of the shared secret. In an example according to some embodiments of the present disclosure, the seed generated at each of entity 132 and BMC 106 is not shared between entity 132 and BMC 106, but is generated on each side based on an exchange according to the key agreement algorithm.

[0036] Entity 132 may send an erase verification request 142 to erase verification engine 150 to trigger erase verification engine 150 to perform an erase verification operation. Erasure verification request 142 may refer to a signal, message, information element, or any other type of input indicating that an erase verification operation is to be initiated. Erasure verification request 142 may identify a memory region for which an erase operation is to be verified (i.e., to confirm that an erase operation for the memory region was successfully completed). Erasure verification request 142 may identify a memory region using a memory region identifier (e.g., a memory address of the memory region). Note that erase verification request 142 may identify multiple memory regions to be verified.

[0037] In response to the erase verification request 142, the DRBG 152 in the erase verification engine 150 generates a pseudo-random pattern based on a seed established using a key agreement process, which is to be written to the identified memory area (e.g., the memory area subject to the erase operation). In some examples, the pseudo-random pattern generated by the DRBG 152 includes a random bit sequence based on the seed. The seed is an input to the DRBG 152, which derives a random bit sequence based on the seed. Different seed values ​​will cause the DRBG to generate different random bit sequences.

[0038] The erase verification engine 150 issues a write command 154 to write the pseudo-random pattern generated by the DRBG 152 to the identified memory area. The write command 154 may be sent to the security processor 116 via the bus 134 to write the pseudo-random pattern to the identified memory area in the secure memory 118, or may be sent to the external memory 120 via the bus 134 to write the pseudo-random pattern to the identified memory area in the external memory 120.

[0039] At a later time, entity 132 (or a different entity) may issue a read request to controller subsystem 105 to retrieve the contents of the identified memory area from secure memory 118 or external memory 120. Entity 132 may determine whether the information retrieved from the identified memory area matches an expected pseudo-random pattern. For example, entity 132 may compare the pseudo-random pattern retrieved from the identified memory area to a stored pattern to determine a match. The stored pattern may be generated by a DRBG (not shown) in entity 132 based on a seed generated by entity 132 during a key negotiation process. The stored pattern may be stored in a memory accessible to entity 132.

[0040] If the pseudo-random pattern retrieved from the identified memory region matches the stored pattern, then entity 132 determines that the identified memory region is successfully erased. However, if the pseudo-random pattern retrieved from the identified memory region does not match the stored pattern, then entity 132 determines that the identified memory region is not successfully erased. In the latter case (mismatch), entity 132 may issue an alert (e.g., to an administrator) or may trigger remedial action in computer system 100.

[0041] In some examples, the read request from the entity 132 may be directed to the BMC 106 in the controller subsystem 105. In an alternative example, the read request from the entity 132 may be directed to another controller in the controller subsystem 105, where the other controller may be the security processor 116 or the memory controller(s) 107. The entity 132 may direct the read request to the BMC 106 by issuing a command to the BMC 106 through a port of the BMC 106. The entity 132 may direct the read request to the other controller by issuing a command to another port of the management module 104, such as a port connected to the security processor 116 or the memory controller(s) 107. A "port" may refer to any type of interface that communicates with a target component.

[0042] In some examples, a read request from entity 132 may specify an arbitrary sub-region of memory region 122 or 126 to be read. In a further example, multiple read requests from entity 132 may specify multiple arbitrary sub-regions of memory region 122 or 126 to be read. A "sub-region" of a memory region refers to a portion of a memory region (less than the entire memory region). An "arbitrary" sub-region may refer to a sub-region arbitrarily selected by entity 132 to read. For example, the selected sub-region may be randomly selected from multiple sub-regions of the memory region, or selected without any predefined rules. The ability to read an arbitrary sub-region of a memory region to perform secure erase verification reduces the possibility that an unauthorized entity (e.g., an attacker) between entity 132 and the memory can generate a pseudo-random pattern in time to deceive entity 132 into believing that the memory region has been erased when the memory region is not actually erased. For example, even if the attacker somehow determines the type of DRBG 152 used and the seed used as input to DRBG 152, reading an arbitrary sub-region of a memory region out of order would mean that the attacker would have to regenerate the entire random bit sequence to satisfy each read request. If the memory region is large (e.g., 1 Gigabit or another large size), it will take a relatively long time for an attacker to generate the entire random bit sequence to satisfy each read request. A delay in obtaining a response to a read request (e.g., a delay greater than the maximum expected time for controller subsystem 105 to read the memory) would be an indication of the presence of an attacker to entity 132 or the presence of some other anomaly.

[0043] Figure 2A is a flow chart of a process involving entity 132, BMC 106, and memory 200 (which may be, for example, secure memory 118 or external memory 120). Figure 2A A particular order of tasks is shown, but in other examples, the process may employ a different order of tasks, may include additional tasks, and / or may replace some tasks with different tasks.

[0044] The entity 132 sends (at 202) an erase request to the BMC 106. The erase request identifies a memory region to be erased. Note that identifying a memory region may refer to identifying one or more memory regions.

[0045] In response to the erase request, the erase engine 130 ( Figure 1 ) issues (at 204) an erase command to the memory 200 to perform an erase operation. The erase command causes an erase pattern to be written to the memory area identified by the erase command.

[0046] In some examples, in response to performing an erase operation, the BMC 106 may set itself (at 206) to a specified verification state that indicates that entities external to the BMC 106 can access the erased memory region, such as for verification of the erase operation. If the BMC 106 is not in the specified verification state, the BMC 106 may deny any request to access the erased memory region. In some examples of the present disclosure, access to the memory region is allowed in order to allow a special pattern (a pseudo-random pattern discussed further above) to be written to the erased memory region.

[0047] BMC 106 sends (at 208) an indication (e.g., a message, an information element of a message, etc.) to entity 132 that remote verification of erasure is enabled. In response to the indication that remote verification of erasure is enabled, entity 132 performs (at 210) a seed derivation process with BMC 106 (or more specifically, with erase verification engine 150 of BMC 106) to obtain a seed to be used in an erase verification operation. For example, the seed derivation process may use a key agreement algorithm as described above. As a result of the seed derivation process, a seed is generated at each of entity 132 and BMC 106.

[0048] Entity 132 sends (at 212) an erase verification request to BMC 106. The erase verification request identifies the memory region to be verified. In response to the seed and BMC 106 being in the specified verification state, DRBG 152 ( Figure 1 ) generates (at 214) a pseudo-random pattern. The BMC 106 issues (at 216) a write command to write the pseudo-random pattern to the memory area (in memory 200) identified by the erase verify request.

[0049] In some examples, after BMC 106 has written the pseudo-random pattern to the memory region, BMC 106 may grant entity 132 read-only access to the memory region. Read-only access prevents the memory region from being modified. Figure 2A An example is shown in which the BMC 106 is involved in reading a pseudo-random pattern from the memory 200 as part of an erase verify operation. Figure 2B An alternative example is shown in which BMC 106 is not part of the read path that fetches the pseudo-random pattern from memory 200 as part of an erase verify operation; rather, a different controller is involved in fetching the pseudo-random pattern from memory 200 as part of an erase verify operation.

[0050] Prior to requesting the pseudo-random pattern from the memory 200, the entity 132 sends (at 218) a restart request to cause a restart of the BMC 106. As an example, the BMC 106 may include a reset input that, when activated, causes a restart of the BMC 106. As another example, the restart request may be a signal issued to a circuit that controls power to the BMC 106; the signal, if activated, causes the BMC 106 to be powered off and then power is reapplied to the BMC 106. The BMC 106 is restarted (at 220) in response to the restart request. Restarting the BMC 106 may cause a power cycle of the BMC 106, wherein the BMC 106 is powered off and then power is reapplied to the BMC 106. Powering off the BMC 106 causes any information stored in the volatile memory of the BMC 106 to be lost. In some examples, a seed generated by the BMC 106 in a key agreement algorithm with the entity 132 may be stored in the volatile memory of the BMC 106. If the BMC 106 loses power, the seed is lost. By restarting the BMC 106, it is ensured that any malware executing on the BMC 106 will not be able to access the seed for regenerating the pseudo-random pattern.

[0051] The entity 132 sends (at 222) a read request to read the memory region (or any sub-region of the memory region) to the BMC 106. In response to the read request, the BMC 106 issues (at 224) a read command to the memory 200 to obtain the contents of the memory region (or any sub-region). In a further example, the entity 132 may send multiple read requests to the BMC 106 to read multiple arbitrary sub-regions of the memory region (to obtain a pseudo-random pattern in the multiple arbitrary sub-regions).

[0052] BMC 106 receives (at 226) the retrieved pseudo-random pattern from the memory region and returns (at 228) the retrieved pseudo-random pattern to entity 132. Entity 132 compares (at 230) the retrieved pseudo-random pattern with the stored pattern. The entity determines (at 232) whether the compared patterns match. If the compared patterns match, entity 132 determines (at 234) that the memory region is successfully erased.

[0053] If the compared patterns do not match, entity 132 determines (at 236) that the memory region was not successfully erased. In the latter case, entity 132 may take action to resolve the anomaly, such as by raising an alarm or triggering remedial action to resolve the anomaly.

[0054] Figure 2Bis a flow chart of a process involving entity 132, BMC 106, read controller 250, and memory 200 (which may be, for example, secure memory 118 or external memory 120). Figure 2B A particular order of tasks is shown, but in other examples, the process may employ a different order of tasks, may include additional tasks, and / or may replace some tasks with different tasks.

[0055] In accordance with Figure 2B In the example of FIG. 1 , a read controller 250 (which is separate from the BMC 106 ) is used to obtain a pseudo-random pattern from the memory 200 for an erase verification operation. Figure 2B In the embodiment, BMC 106 does not participate in reading the pseudo-random pattern from memory 200 for the erase verification operation. Read controller 250 may be, for example, Figure 1 security processor 116 or memory controller 107.

[0056] Assigned with Figure 2A The tasks with the same reference numerals in Figure 2A For example, Figure 2B Tasks 202 to 216 are similar to Figure 2A Corresponding tasks 202 to 216.

[0057] After the BMC 106 has written (at 216) the pseudo-random pattern to the memory 200, the entity 132 sends (at 252) a read request to read the memory region (or any sub-region of the memory region) to the read controller 250. In response to the read request, the read controller 250 issues (at 254) a read command to the memory 200 to obtain the contents of the memory region (or any sub-region). In a further example, the entity 132 may send multiple read requests to the read controller 250 to read multiple arbitrary sub-regions of the memory region (to obtain the pseudo-random pattern in the multiple arbitrary sub-regions).

[0058] The read controller 250 receives (at 256 ) the retrieved pseudo-random pattern from the memory region and returns (at 258 ) the retrieved pseudo-random pattern to the entity 132 . Figure 2B Tasks 230 to 236 in Figure 2A A corresponding task is used by entity 132 to determine whether the erasure is successful.

[0059] Figure 3 is a block diagram of a system 300 according to some examples. System 300 may be computer system 100 or another system. System 300 includes non-volatile memory 302 for storing information 304. For example, non-volatile memory 302 may be Figure 1 secure memory 118 or external memory 120.

[0060] System 300 includes a controller subsystem 306, such as Figure 1 Controller subsystem 105. Controller subsystem 306 includes one or more controllers that perform various tasks.

[0061] The tasks of the controller subsystem 306 include an erase verification input receiving task 308 for receiving an input (eg, a triggering input) from an entity for triggering an erase verification operation after erasing a memory area of ​​a non-volatile memory containing information. Figure 1 The entity may be Figure 1 Entity 132. The entity can be part of system 300 or external to system 300.

[0062] The tasks of the controller subsystem 306 include a pseudo-random pattern generation task 310 for generating a pseudo-random pattern in response to an input. The pseudo-random pattern may include a bit random pattern, such as a Figure 1 The DRBG 152 is generated based on a seed obtained by a controller (e.g., BMC) in the controller subsystem 306 using a key agreement algorithm. In some examples, the pseudo-random pattern written to the memory region as part of the erase verification operation is different from the erase pattern written to the memory region to erase information in the memory region.

[0063] The tasks of the controller subsystem 306 include a pseudo-random pattern write task 312, which is used to write a pseudo-random pattern to a memory area as part of an erase verification operation. The controller subsystem 306 performs the write by issuing a write command to the non-volatile memory 302. For example, the write command for writing the pseudo-random pattern can be executed by a BMC in the controller subsystem 306.

[0064] The tasks of the controller subsystem 306 include a pseudo-random pattern providing task 314 for providing a pseudo-random pattern retrieved from a memory region from the non-volatile memory 302 to an entity after writing to verify that erasure of information in the memory region has occurred. The entity may compare the retrieved pseudo-random pattern with a stored pattern to perform verification. In some examples, after a BMC restart, the pseudo-random pattern may be retrieved from the memory region by the BMC of the controller subsystem 306 (e.g., based on the BMC's memory region). Figure 2A In other examples, the pseudo-random pattern may be retrieved from a memory area by a read controller (separate from the BMC) of the controller subsystem 306 (eg, based on Figure 2B ).

[0065] In some examples, the controller subsystem 306 includes a first controller (e.g., a BMC) for receiving an input for triggering erase verification, generating a pseudo-random pattern, and writing the pseudo-random pattern to a memory area. The controller subsystem 306 includes a second controller for reading the pseudo-random pattern from a non-volatile memory and providing the pseudo-random pattern read from the memory area to an entity, wherein the second controller is different from the first controller.

[0066] In a further example, the controller subsystem 306 includes a controller (e.g., Figure 1 The controller is configured to receive an input for triggering erase verification, generate a pseudo-random pattern, and write the pseudo-random pattern to the memory area. The controller further receives a trigger for restarting the controller, the trigger causing the controller to be powered off. After the controller is restarted, a read request is received from the entity to obtain the pseudo-random pattern from the memory area. The controller provides the pseudo-random pattern obtained from the memory area after the controller is restarted to the entity for verification.

[0067] In some examples, the controller subsystem 306 receives a read request for reading a pseudo-random pattern from a non-volatile memory, wherein the pseudo-random pattern is obtained from a memory region based on the read request. In some examples, the read request is for one or more arbitrary sub-regions of the memory region, wherein the pseudo-random pattern provided to the entity is obtained from the one or more arbitrary sub-regions.

[0068] In some examples, the controller subsystem 306 generates the seed based on a key generation process with an entity.A pseudo-random pattern is a deterministic random bit sequence generated based on a seed.

[0069] In some examples, after erasing the memory area of ​​non-volatile memory 302 containing information 304, controller subsystem 306 enables remote verification of the erasure and sends an indication to the entity that remote verification of the erasure is enabled. The entity provides input to controller subsystem 306 for triggering an erase verification operation in response to the entity receiving the indication from controller subsystem 306.

[0070] Figure 4 is a block diagram of a non-transitory machine-readable or computer-readable storage medium 400 having stored thereon machine-readable instructions that, when executed, cause a computer to perform various tasks. The computer may be Figure 1 An example of entity 132 or another entity.

[0071] The machine-readable instructions include remote verification enabled indication receiving instructions 402 for receiving an indication from a controller in the system that remote verification of erasure of a memory region in a non-volatile memory of the system is enabled. For example, the controller may be Figure 1 The computer that executes the machine-readable instructions may be part of the system or separate from the system. For example, the system that provides the controller may be Figure 1 A computer system 100.

[0072] The machine-readable instructions include erase verification operation triggering instructions 404 for sending, after receiving the instruction, an input from the computer to the system for triggering an erase verification operation to verify the erasure of the memory region. The input may be an erase verification request (e.g., Figure 1 142 in FIG. 1 or 208 in FIG. 2 ).

[0073] The machine-readable instructions include pseudo-random pattern receiving instructions 406 for receiving, at a computer, from a system a pseudo-random pattern written by a controller to a memory region as part of an erase verification operation, wherein the pseudo-random pattern is generated based on a seed. For example, the pseudo-random pattern may be generated by a DRBG. The pseudo-random pattern may be obtained by a controller from a memory region (after a controller reboot) or by another controller without a seed.

[0074] The machine-readable instructions include pseudo-random pattern comparison instructions 408, which are used to compare the received pseudo-random pattern with the stored pattern to verify whether the erasure of the memory area has occurred. If the compared patterns match, it indicates that the memory area has been successfully erased. If the compared patterns do not match, it indicates that the memory area has not been successfully erased.

[0075] Figure 5 is a flow diagram of a process 500 according to some examples. The process includes receiving (at 502) at a controller in a system an erase request for erasing a memory region of a non-volatile memory. The controller may be a BMC or a different type of controller.

[0076] Based on the erase request, process 500 includes issuing (at 504) an erase command by the controller to the non-volatile memory to erase the memory region by writing an erase pattern to the memory region. The erase command may be issued to the security processor to erase the secure memory (e.g., Figure 1 118) in the memory area or to an external memory (e.g., Figure 1 120) issues an erase command.

[0077] Process 500 includes sending (at 506) from the controller to the entity an indication that verification of erasure of the memory region is enabled. The controller may include a verification state that is set by the controller in response to an erase operation of the non-volatile memory.

[0078] Process 500 includes performing (at 508) a key agreement process with an entity by the controller to generate a seed. For example, the key agreement process can be based on a key agreement algorithm, where the controller and the entity contribute to generating the seed without exchanging the seed with each other (so that the seed is not exposed to potential unauthorized access).

[0079] Process 500 includes receiving (at 510) at a controller a request to trigger an erase verify operation to verify the erasure of a memory region. The request may be, for example, Figure 1 Erasure verification request 142.

[0080] Process 500 includes generating (at 512) a pseudo-random pattern by a controller based on a seed. The pseudo-random pattern may include a DRBG (e.g., Figure 1 152) in the generated random bit sequence.

[0081] The process 500 includes issuing (at 512) a write command by the controller in response to a request to write a pseudo-random pattern to a memory region as part of an erase verification operation. After writing, the process 500 includes providing (at 514) a pseudo-random pattern retrieved from the memory region to an entity from the system to verify that erasure of the memory region has occurred. The entity compares the retrieved pseudo-random pattern to a stored pattern to perform verification.

[0082] "BMC" may refer to a professional service controller that uses sensors to monitor the physical state of a computer system and communicates with a remote management system (away from the computer system) via an independent "out-of-band" connection. A BMC may perform management tasks that manage components of a computer system. Examples of management tasks that may be performed by a BMC may include any one or some combination of the following: power control for power management of a computer system (such as transitioning a computer system between different power consumption states in response to a detected event), thermal monitoring and control of a computer system (such as monitoring the temperature of a computer system and controlling the thermal management state of the computer system), fan control of a fan in a computer system, system health monitoring based on monitoring measurement data of various sensors of a computer system, remote access to a computer system (e.g., accessing a computer system over a network), remote restart of a computer system (using a remote command to trigger a computer system restart), system setup and deployment of a computer system, system security for implementing security programs in a computer system, and the like.

[0083] In some examples, the BMC can provide a so-called "unattended" function for the computer system. The unattended function can allow users such as system administrators to perform management operations on the computer system even if the OS is not installed on the computer system or the OS is not functioning on the computer system.

[0084] Additionally, in some examples, the BMC can operate on auxiliary power provided by an auxiliary power source (e.g., a battery); thus, the computer system does not have to be powered on to allow the BMC to perform the operations of the BMC. The auxiliary power source is separate from the main power source that powers other components of the computer system (e.g., a main processor, memory, input / output (I / O) devices, etc.).

[0085] In some examples, in addition to the BMC in each computer system, an additional management controller (separate from the BMC) may be used to interact with the BMC to perform management of the computer system. In examples where the computer system is a server computer (or other type of computer system) installed in a rack, the additional management controller may be referred to as a rack management controller (RMC). A "rack" refers to a mounting structure with brackets for multiple computer systems.

[0086] Storage media (e.g. Figure 4 400) may include any one or some combination of the following: a semiconductor memory device, such as DRAM or SRAM, EPROM, EEPROM, and flash memory; a magnetic disk, such as a fixed disk, a floppy disk, and a removable disk; another magnetic medium, including a tape; an optical medium, such as a compact disk (CD) or a digital video disk (DVD); or another type of storage device. Note that the instructions discussed above may be provided on one computer-readable or machine-readable storage medium, or alternatively, may be provided on multiple computer-readable or machine-readable storage media distributed in a large system with possibly multiple nodes. Such one or more computer-readable or machine-readable storage media are considered to be part of an article (or product). An article or product may refer to any manufactured single component or multiple components. One or more storage media may be located in a machine running machine-readable instructions, or at a remote site, from which machine-readable instructions may be downloaded over a network for execution.

[0087] In the present disclosure, the use of the terms "a", "an" or "the" is intended to include the plural forms as well, unless the context clearly indicates otherwise. Similarly, when used in the present disclosure, the terms "includes / including / comprises / comprising", "have / having" specify the presence of stated elements, but do not exclude the presence or addition of other elements.

[0088] In the foregoing description, many details are set forth to enable an understanding of the subject matter disclosed herein. However, embodiments may be practiced without some of these details. Other embodiments may include modifications and variations of the details discussed above. The appended claims are intended to cover such modifications and variations.

Claims

1. A system comprising: Non-volatile memory for storing information; as well as Controller subsystem for: receiving an input for triggering an erase verification operation after erasing a memory area of ​​the non-volatile memory containing the information, generating a pseudo-random pattern in response to the input, writing the pseudo-random pattern to the memory region as part of the erase verify operation, and After the writing, the pseudo-random pattern retrieved from the memory region is provided from the non-volatile memory to an entity for the entity to verify that erasure of the information of the memory region has occurred.

2. The system of claim 1, wherein: The controller subsystem includes: a first controller for receiving the input for triggering the erase verification operation, generating the pseudo-random pattern, and writing the pseudo-random pattern to the memory area; and A second controller is configured to read the pseudo-random pattern from the non-volatile memory and provide the pseudo-random pattern read from the memory area to the entity, wherein the second controller is different from the first controller.

3. The system of claim 2, wherein: The first controller is a baseboard management controller.

4. The system of claim 1, wherein: The controller subsystem includes a controller configured to: receive the input for triggering the erase verification operation, generate the pseudo-random pattern, and write the pseudo-random pattern to the memory area, the controller further configured to: receiving a trigger for restarting the controller, the trigger causing the controller to be powered off; receiving, after the controller is restarted, from the entity a read request for retrieving the pseudo-random pattern from the memory region; as well as The pseudo-random pattern retrieved from the memory area after a restart of the controller is provided from the controller to the entity for the verification.

5. The system of claim 1, wherein: The controller subsystem is used to: receiving a read request for reading the pseudo-random pattern from the non-volatile memory, The pseudo-random pattern is obtained from the memory area based on the read request.

6. The system of claim 5, wherein: The read request is for one or more arbitrary sub-regions of the memory region, and wherein the pseudo-random pattern provided to the entity is taken from the one or more arbitrary sub-regions.

7. The system of claim 1, wherein: The controller subsystem is used to generate a seed based on a key generation process with the entity.

8. The system of claim 7, wherein: The pseudo-random pattern is a deterministic random bit sequence generated based on the seed.

9. The system of claim 1, wherein: The pseudo-random pattern written to the memory region as part of the erase verify operation is different from an erase pattern written to the memory region to erase the information in the memory region.

10. The system of claim 9, wherein: The controller subsystem is configured to erase the information in the memory area by writing the erase pattern into the memory area.

11. The system of claim 1, wherein: The controller subsystem is used to: After erasing a memory area of ​​said non-volatile memory containing said information, enabling remote verification of the erasure, and An indication is sent to the entity that remote authentication of the erase is enabled.

12. The system of claim 11, wherein: The entity provides the input for triggering the erase verify operation in response to the entity receiving the indication from the controller subsystem.

13. A non-transitory machine-readable storage medium comprising instructions that, when executed, cause a computer to: receiving, from a controller in a system, an indication that remote verification of erasure of a memory region in a non-volatile memory of the system is enabled; sending, from the computer to the system, input for triggering an erase verification operation to verify erasure of the memory region after receiving the indication; receiving, at the computer, from the system, a pseudo-random pattern written by the controller to the memory region as part of the erase verify operation, wherein the pseudo-random pattern is generated by the controller based on a seed; as well as The received pseudo-random pattern is compared to the stored pattern to verify whether erasure of the memory region has occurred.

14. The non-transitory machine-readable storage medium of claim 13, wherein: When the instructions are executed, the computer performs the following operations: The seed is generated based on a key agreement process between the computer and the controller.

15. The non-transitory machine-readable storage medium of claim 14, wherein: When the instructions are executed, the computer performs the following operations: generating the stored pattern using the seed; and The stored pattern is stored in a memory of the computer.

16. The non-transitory machine-readable storage medium of claim 13, wherein: When the instructions are executed, the computer performs the following operations: sending a read request to the system for one or more arbitrary sub-regions of the memory region, wherein the pseudo-random pattern received at the computer from the system is taken from the one or more arbitrary sub-regions of the memory region.

17. The non-transitory machine-readable storage medium of claim 13, wherein: The controller includes a first controller, and the pseudo-random pattern received at the computer from the system is derived by a second controller different from the first controller.

18. The non-transitory machine-readable storage medium of claim 13, wherein: The pseudo-random pattern received at the computer from the system is retrieved by the controller after the controller is restarted.

19. A method comprising: receiving, at a controller in the system, an erase request to erase a memory region of a non-volatile memory; Based on the erase request, the controller issues an erase command to the non-volatile memory to erase the memory area by writing an erase pattern to the memory area; sending, from the controller to an entity, an indication that verification of erasure of the memory region is enabled; performing, by the controller, a key negotiation process with the entity to generate a seed; receiving, at the controller, a request to trigger an erase verify operation to verify erasure of the memory region; generating, by the controller in response to the request, a pseudo-random pattern based on the seed; issuing, by the controller, a write command to write the pseudo-random pattern to the memory region as part of the erase verify operation; as well as After the writing, the pseudo-random pattern taken from the memory region is provided to the entity from the system to verify that erasure of the memory region has occurred.

20. The method of claim 19, wherein: The pseudo-random pattern is generated by a deterministic random bit generator of the controller based on the seed.

Images