Certificate generation associated with memory device based on active component identification information

Abstract

The invention relates to credential generation associated with a memory device based on active component identification information. A processing device in a memory subsystem receives a request to generate a digital certificate associated with a memory device including a set of active components, wherein each active component in the set of active components is associated with an active component identifier. In response to the request, a set of active component identifiers is identified. The digital certificate associated with the memory device is generated and provided to a host system based on at least a portion of the set of active component identifiers, where the digital certificate is used to authenticate the memory device.

Description

TECHNICAL FIELD

[0001] Embodiments of the present disclosure generally relate to memory sub-systems, and more specifically, to generating a certificate for authenticating a memory device based on identification information associated with one or more active components of a memory device of a memory sub-system. BACKGROUND

[0002] A memory sub-system can include one or more memory devices that store data. The memory devices can be, for example, non-volatile memory devices and volatile memory devices. Generally, a host system can utilize a memory sub-system to store and retrieve data at and from the memory devices. SUMMARY

[0003] One aspect of the present disclosure discloses a memory sub-system comprising: a memory device; and a processing device operably coupled to the memory device, the processing device performing operations comprising: receiving a request to generate a digital certificate associated with a memory device comprising a set of active components, wherein each active component of the set of active components is associated with an active component identifier; responsive to the request, identifying a set of active component identifiers; generating the digital certificate associated with the memory device based on at least a portion of the set of active component identifiers; and providing the digital certificate to a host system, wherein the digital certificate is used to authenticate the memory device.

[0004] Another aspect of the present disclosure discloses a method comprising: receiving a request to generate a digital certificate associated with a memory device comprising a set of active components, wherein each active component of the set of active components is associated with an active component identifier; responsive to the request, identifying a set of active component identifiers; generating the digital certificate associated with the memory device based on at least a portion of the set of active component identifiers; and providing the digital certificate to a host system, wherein the digital certificate is used to authenticate the memory device.

[0005] Another aspect of the present disclosure discloses a non-transitory computer- readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising: receiving a request to generate a digital certificate associated with a memory device comprising a set of active components, wherein each active component of the set of active components is associated with an active component identifier; responsive to the request, identifying a set of active component identifiers; generating the digital certificate associated with the memory device based on at least a portion of the set of active component identifiers; and providing the digital certificate to a host system, wherein the digital certificate is used to authenticate the memory device. BRIEF DESCRIPTION OF DRAWINGS

[0006] The disclosure can be more completely understood in consideration of the following detailed description in connection with the accompanying drawings, in which:

[0007] Figure 1A An example computing system including a memory sub-system is illustrated in accordance with one or more embodiments of the present disclosure.

[0008] Figure 1A is a block diagram of a memory device in communication with a memory sub-system controller of a memory sub-system in accordance with one or more embodiments of the present disclosure.

[0009] Figure 2 is an example host system coupled to a memory sub-system including a memory sub-system controller having a certificate generator for generating a device certificate associated with a memory device of the memory sub-system based on a set of active component identifiers in accordance with one or more embodiments of the present disclosure.

[0010] Figure 3 An example certificate generator for generating a device certificate associated with a memory device of a memory sub-system based on a set of active component identifiers in accordance with one or more embodiments of the present disclosure is illustrated.

[0011] Figure 4 is a flow diagram of an example of a device certificate generation process in accordance with one or more embodiments of the present disclosure.

[0012] Figure 5 is a block diagram of an example computer system in which embodiments of the present disclosure can operate. DETAILED DESCRIPTION

[0013] Aspects of the present disclosure relate to generating a certificate for authenticating a memory device of a memory sub-system based at least in part on identifying information associated with active components of the memory sub-system. The memory sub-system can be a storage device, a memory module, or a hybrid of a storage device and a memory module. The following description is made in connection with a storage device and a memory module. Figure 1A Examples of storage devices and memory modules are described. Generally, a host system can utilize a memory sub-system including one or more components, such as a memory device that stores data. The host system can provide data stored at the memory sub-system and can request data retrieved from the memory sub-system.

[0014] Memory subsystems can include high-density non-volatile memory devices in which it is desirable to retain data when power is not supplied to the memory device. For example, NAND memory, such as 3D flash NAND memory, provides a storage device in a compact, high-density configuration. Non-volatile memory devices are packages of one or more memory dies each including one or more planes. For some types of non-volatile memory devices, such as NAND memory, each plane includes a set of physical blocks. Each block includes a set of pages. Each page includes a set of memory cells (“cells”). A cell is an electronic circuit that stores information. Depending on the cell type, a cell can store one or more binary bits of information and have various logical states related to the number of bits stored. Logical states can be represented by binary values such as “0” and “1” or combinations of such values.

[0015] Memory devices can be composed of bits arranged in two-dimensional or three-dimensional grids. Memory cells are formed onto a silicon die in an array of columns (hereinafter also referred to as bit lines) and rows (hereinafter also referred to as word lines). A word line can refer to one or more rows of memory cells that, together with one or more bit lines, are used to generate an address for each of the memory cells. The intersection of a bit line and a word line constitutes an address of a memory cell. A block refers below to a unit of a memory device for storing data and can include a group of memory cells, a group of word lines, a word line, or individual memory cells. One or more blocks can be grouped together to form separate partitions (e.g., planes) of a memory device in order to allow concurrent operations to occur on each plane.

[0016] Memory dies are also referred to as logical units (LUNs). A LUN can contain one or more planes. A memory subsystem can use a striping scheme to treat groups of data as units when performing data operations (e.g., writes, reads, erasures). A LUN stripe is a collection of planes treated as one unit when writing, reading, or erasing data. Each plane in a LUN stripe can perform the same operation in parallel to all other planes in the LUN stripe. A block stripe is a collection of blocks treated as a unit. A block stripe can be a physical block stripe associated with a plane of a LUN or logical block stripe that includes blocks mapped to the logical block stripe by processing logic. Blocks in a block stripe have the same identifier (e.g., block number, block stripe index, etc.) that associates the block with the block stripe.

[0017] Some memory devices, such as three-dimensional (3D) cross-point devices, can include multiple tiers of respective two-dimensional (2D) arrays of memory cells that are electronically addressable by vertical access lines, such as word lines. The multiple tiers can be stacked within the memory device (e.g., vertically stacked). Certain memory devices are divided into multiple tiers to mitigate performance and reliability losses. However, as block size expansion is driven by, for example, the desire to increase storage capacity in memory devices, including an increase in the number of word lines in each block, the presence of such additional word lines presents certain challenges, including, for example, performance and reliability losses that can be attributed to various inefficiencies (e.g., associated with scrap collection or other media management operations for increasing block sizes). As such, a memory device can include a top (or “upper”) tier and a bottom (or “lower”) tier, each of which includes a respective set of word lines from the memory device. The separate tiers can be individually accessible such that a memory access operation (i.e., a program, read, or erase operation) can be performed on one tier without affecting the memory cells of the other tier.

[0018] For integrity and security purposes, a host system operatively coupled to a third party unit, such as a memory device of a memory subsystem, can want to authenticate the unit. For example, in certain systems, to authenticate a third party memory device coupled to a host system, control logic can generate an authentication certificate based on basic information associated with the unit, such as a combination of a part number of the memory device and a hash of an associated firmware version identifier. For example, when a memory device is coupled to a host system, an authentication check for the memory device can be initiated by generating a certificate based on the part number and firmware version number. The generated certificate can be provided to the host system, which can use a certificate authority to check the validity of the information stored in the certificate to determine whether the memory device is authenticated.

[0019] However, using certificates based on hardware model and firmware version number can result in generating certificates that are the same for multiple different memory devices rather than being specific to a particular memory device. Furthermore, this authentication method fails to detect the occurrence of post-manufacturing tampering or modification of one or more components or subcomponents of a physical memory device. In such cases, a certificate based on firmware version and hardware serial number associated with a completed physical system (as manufactured) fails to detect instances in which one or more subcomponents of the system have been tampered with after the physical system enters the commercial chain. Thus, a memory device that has been improperly modified still passes the authentication measure because the certificate based on hardware serial number and firmware version fails to provide a mechanism to detect these modifications.

[0020] Aspects of the present disclosure address the above and other shortcomings by implementing a process that is capable of authenticating a memory device having a set of active components (i.e., subcomponents of the memory device). The process includes generating an authentication certificate associated with the memory device that is based at least in part on one or more identifiers associated with respective active components of the memory device. Example active components include one or more microcontrollers, special-purpose logic circuitry (e.g., a field-programmable gate array (FPGA)), one or more application-specific integrated circuits (ASICs), one or more memory devices (e.g., read-only memory (ROM), flash memory, dynamic random-access memory (DRAM) (e.g., synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM)), etc.), static memory (e.g., flash memory, static random-access memory (SRAM), etc.), one or more non-volatile memory devices (e.g., a NAND memory device or NAND chip), one or more printed circuit boards (PCBs), one or more media card controllers, etc.

[0021] According to embodiments, each of the active components of a memory subsystem is associated with a unique identifier (referred to herein as an “active component identifier”). According to embodiments, a unique authentication certificate is generated for a memory subsystem based on a set of one or more active component identifiers corresponding to one or more components of the memory subsystem. The use of one or more active component identifiers in generating the authentication certificate enables each memory subsystem to be uniquely authenticated based on identifying information associated with one or more of the constituent active components or parts. This approach avoids generating certificates that broadly characterize more than one memory subsystem by creating a more robust certificate built on top of the larger set of identifying information that is specific to a particular memory subsystem. Advantageously, the certificate generation approach described herein establishes a chain of custody for a particular unit or system manufactured or constructed by an associated source manufacturer to reduce the risk associated with counterfeit construction and post-manufacture tampering.

[0022] Figure 1A An example computing system 100 including a memory subsystem 110 according to some embodiments of the present disclosure is illustrated. The memory subsystem 110 can include media, such as one or more ultra-high endurance storage class memory devices (e.g., memory devices 140), one or more non-volatile memory devices (e.g., one or more memory devices 130), or a combination thereof.

[0023] The memory sub-system 110 can be a storage device, a memory module, or a hybrid of a storage device and a memory module. Examples of storage devices include solid-state drives (SSDs), flash drives, universal serial bus (USB) flash drives, embedded Multi-Media Controllers (eMMC) drives, Universal Flash Storage (UFS) drives, Secure Digital (SD) cards, and hard disk drives (HDDs). Examples of memory modules include dual in-line memory modules (DIMMs), small outline DIMMs (SO-DIMMs), and various types of non-volatile dual in-line memory modules (NVDIMMs).

[0024] The computing system 100 can be, for example, a desktop computer, a laptop computer, a network server, a mobile device, a vehicle (e.g., an airplane, a drone, a train, a car, or other transportation vehicle), an Internet of Things (IoT) capable device, an embedded computer (e.g., an embedded computer included in a vehicle, industrial equipment, or a networked commercial device), or a computing device that includes a memory and a processing device.

[0025] The computing system 100 can include a host system 120 coupled to one or more memory sub-systems 110. In some embodiments, the host system 120 is coupled to different types of memory sub-systems 110. Figure 1A One example of a host system 120 coupled to one memory sub-system 110 is illustrated. As used herein, “coupled to” or “coupled with” generally refers to a connection between components that can be an indirect communicative connection or a direct communicative connection (e.g., without intervening components), whether wired or wireless, including connections such as electrical, optical, magnetic, etc.

[0026] The host system 120 can include a processor chipset and a software stack executed by the processor chipset. The processor chipset can include one or more cores, one or more caches, a memory controller (e.g., a NVDIMM controller), and a storage protocol controller (e.g., a PCIe controller, a SATA controller, a Compute Express Link (CXL) interface). The host system 120 uses the memory sub-system 110, for example, to write data to and read data from the memory sub-system 110.

[0027] The host system 120 can be coupled to the memory sub-system 110 via a physical host interface. Examples of a physical host interface include, but are not limited to, a serial advanced technology attachment (SATA) interface, a CXL interface, a peripheral component interconnect express (PCIe) interface, a universal serial bus (USB) interface, Fibre Channel, Serial Attached SCSI (SAS), double data rate (DDR) memory bus, a small computer system interface (SCSI), a dual in-line memory module (DIMM) interface (e.g., a DIMM socket interface that supports double data rate (DDR)), etc. The physical host interface can be used to transfer data between the host system 120 and the memory sub-system 110. When the memory sub-system 110 is coupled with the host system 120 by a physical host interface (e.g., a PCIe or CXL bus), the host system 120 can further access components (e.g., the memory devices 130) using an NVM Express (NVMe) interface. The physical host interface can provide an interface for passing control, address, data, and other signals between the memory sub-system 110 and the host system 120. Figure 1A The memory sub-system 110 is illustrated. In general, a host system 120 can access multiple memory sub-systems via the same communication connection, multiple separate communication connections, and / or a combination of communication connections.

[0028] The memory devices 130, 140 can include any combination of different types of non-volatile memory devices and / or volatile memory devices. For example, the ultra-high endurance storage class memory devices 140 can include any of a number of different types of memory media or “cells” that are non-volatile and provide lower program / read latency than 3D NAND-type flash memory, including both SLC memory and QLC memory. Additionally, the ultra-high endurance storage class memory devices 140 can have higher endurance (i.e., can tolerate more program / erase cycles) than the memory devices 130. Some examples of ultra-high endurance storage class memory include hybrid random access memory (HRAM), three-dimensional cross-point (“3D cross-point”) memory, or others.

[0029] Some examples of non-volatile memory devices (e.g., the memory devices 130) include negative-and (NAND) type flash memory and in-place write memory, such as three-dimensional cross-point (“3D cross-point”) memory. Cross-point arrays of non-volatile memory can perform bit storage based on bulk resistance changes in conjunction with a stackable cross-grid format data access array. Further, in contrast to many flash-based memories, cross-point non-volatile memory can perform in-place write operations, where a non-volatile memory cell can be programmed without first erasing the non-volatile memory cell. NAND-type flash memory includes, for example, two-dimensional NAND (2D NAND) and three-dimensional NAND (3D NAND).

[0030] Each of the memory devices 130 can include one or more arrays of memory cells. One type of memory cell, such as a single-level cell (SLC), can store one bit of data per cell. Other types of memory cells, such as a multi-level cell (MLC), a triple-level cell (TLC), a quad-level cell (QLC), or a penta-level cell (PLC), can store multiple bits of data per cell. In some embodiments, each of the memory devices 130 can include one or more arrays of memory cells, such as SLC, MLC, TLC, QLC, PLC, or any combination thereof. In some embodiments, a particular memory device can include SLC portions and MLC portions, TLC portions, QLC portions, or PLC portions of memory cells. The memory cells of the memory devices 130 can be grouped into pages, which can refer to a logical unit of the memory device for storing data. For some types of memory, such as NAND, pages can be grouped to form blocks.

[0031] Although non-volatile memory components such as 3D cross-point arrays of non-volatile memory cells and NAND-type flash memory (e.g., 2D NAND, 3D NAND) are described, the memory devices 130 can be based on any other type of non-volatile memory, such as read-only memory (ROM), phase change memory (PCM), self-selecting memory, other chalcogenide-based memory, ferroelectric transistor random access memory (FeTRAM), ferroelectric random access memory (FeRAM), magnetic random access memory (MRAM), spin-transfer torque (STT)-MRAM, conductive-bridge RAM (CBRAM), resistive random access memory (RRAM), oxide-based RRAM (OxRAM), or non- (NOR) flash memory, electrically erasable programmable read-only memory (EEPROM).

[0032] The memory sub-system controller 115 (or simply the controller 115) can communicate with the memory devices 130 to perform operations such as reading data, writing data, or erasing data at the memory devices 130, and other such operations. The memory sub-system controller 115 can include hardware such as one or more integrated circuits and / or discrete components, a buffer memory, or a combination thereof. The hardware can include digital circuitry with specialized (i.e., hard-coded) logic to perform the operations described herein. The memory sub-system controller 115 can be a microcontroller, special purpose logic circuitry (e.g., a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc.), or other suitable processor.

[0033] The memory sub-system controller 115 can include a processor 117 (e.g., processing device) configured to execute instructions stored in local memory 119. In the illustrated example, the local memory 119 of the memory sub-system controller 115 includes embedded memory configured to store instructions for performing various processes, operations, logic flows, and routines that control operation of the memory sub-system 110, including handling communications between the memory sub-system 110 and the host system 120.

[0034] In some embodiments, the local memory 119 can include memory registers that store memory pointers, fetch data, etc. The local memory 119 can also include read-only memory (ROM) for storing microcode. Although the example memory sub-system 110 has been illustrated as including the memory sub-system controller 115, in another embodiment of the disclosure, the memory sub-system 110 does not include the memory sub-system controller 115, but can instead rely upon external control (e.g., provided by an external host or by a processor or controller separate from the memory sub-system). Figure 1A

[0035] In general, the memory sub-system controller 115 can receive commands or operations from the host system 120 and can convert the commands or operations into instructions or appropriate commands to achieve the desired access to the memory devices 130. The memory sub-system controller 115 can be responsible for other operations such as wear leveling operations, garbage collection operations, error detection and error-correcting code (ECC) operations, encryption operations, caching operations, and address translations between a logical address (e.g., logical block address (LBA), namespace) and a physical address (e.g., physical block address) associated with the memory devices 130. The memory sub-system controller 115 can further include host interface circuitry to communicate with the host system 120 via the physical host interface. The host interface circuitry can convert the commands received from the host system into command instructions to access the memory devices 130, but also convert responses associated with the memory devices 130 into information for the host system 120.

[0036] The memory sub-system 110 can also include additional circuitry or components that are not illustrated. In some embodiments, the memory sub-system 110 can include a cache or buffer (e.g., DRAM) and address circuitry (e.g., row and column decoders) that can receive an address from the memory sub-system controller 115 and decode the address to access the memory devices 130.

[0037] ​In some embodiments, the memory devices 130 include a local media controller 135 that operates in conjunction with the memory sub-system controller 115 to perform operations on one or more memory units of the memory devices 130. An external controller, such as the memory sub-system controller 115, can externally manage the memory devices 130 (e.g., perform media management operations on the memory devices 130). In some embodiments, the memory devices 130 are managed memory devices, which are raw memory devices (e.g., memory arrays 104) with control or processing logic (e.g., local controller 135) for media management within the same memory device package. An example of a managed memory device is a managed NAND (MNAND) device. The memory devices 130 may, for example, each represent a single die on which some control logic (e.g., local media controller 135) is embodied. In some embodiments, one or more components of the memory sub-system 110 can be omitted.

[0038] In one embodiment, the memory sub-system controller 115 includes a certificate generator 113 that can implement a process to generate an authentication certificate associated with the memory sub-system 110 based on authentication information corresponding to one or more active components of the memory sub-system 110. The active components of the memory sub-system 110 can include any component of one or more memory devices 130, 140 of the memory sub-system 110. In an embodiment, the certificate generator 113 generates a unique certificate based at least in part on a set of one or more unique identifiers corresponding to respective active components of one or more memory devices 130, 140 of the memory sub-system 110. According to an embodiment, the certificate generator 113 identifies a set of active component identifiers and performs a certificate generation process or algorithm to produce a corresponding certificate. The certificate generator 113 provides the generated certificate to the host system 120, which in turn uses the certificate to authenticate one or more portions of the memory sub-system 110. In an embodiment, the host system 120 can employ a signing authority to use the generated certificate to authenticate one or more portions of the memory sub-system 110.

[0039] Advantageously, generating a certificate by performing a certificate generation process or algorithm using at least one or more unique identifiers associated with active components (or sub-components) of the memory sub-system 110 provides a robust certificate that uniquely identifies the memory sub-system 110 and reduces the risk associated with post-manufacturing tampering with the memory sub-system 110. For example, the generated certificate can be used to reject authentication of a memory sub-system 110 that has one or more active components (e.g., ASICs, PCBs, NAND, DRAM, etc.) that have been replaced, modified, or otherwise tampered with at some point in the life cycle of the memory sub-system 110. Further details regarding the operation of the certificate generator 113 are described below.

[0040] Figure 1B is a simplified block diagram of a first device in the form of a memory device 130 in communication with a second device in the form of a memory subsystem controller 115 of a memory subsystem (e.g., memory subsystem 110) in accordance with an embodiment. Some examples of electronic systems include personal computers, personal digital assistants (PDAs), digital cameras, digital media players, digital recorders, game consoles, home electronics, vehicles, wireless devices, mobile telephones, and the like. Memory subsystem controller 115 (e.g., a controller external to memory device 130) can be a memory controller or other external host device. In one embodiment, memory subsystem controller 115 includes a certificate generator 113 that can implement word line group based identification of a first portion (i.e., good portion) of a block while skipping programming of a second portion (i.e., bad portion) of the block during a program operation, as described herein. Figure 1A

[0041] Memory device 130 includes an array 150 of memory cells logically arranged in rows and columns. The memory cells of a logical row are typically connected to the same access line (e.g., word line), while the memory cells of a logical column are typically selectively connected to the same data line (e.g., bit line). A single access line can be associated with more than one logical row of memory cells and a single data line can be associated with more than one logical column. The memory cells of at least a portion of array 150 (not shown in FIG. 1) are capable of being programmed to one of at least two target data states. Figure 1B

[0042] Row decode circuitry 108 and column decode circuitry 111 are provided to decode address signals. The address signals are received and decoded to access array 150 of memory cells. Memory device 130 also includes input / output (I / O) control circuitry 160 for managing input of commands, addresses, and data to memory device 130 and output of data and status information from memory device 130. Address register 114 is in communication with I / O control circuitry 160 and row decode circuitry 108 and column decode circuitry 111 to latch the address signals prior to decoding. Command register 124 is in communication with I / O control circuitry 160 and local media controller 135 to latch incoming commands.

[0043] ​​The controller, e.g., a local media controller 135 internal to the memory device 130, controls access to the memory cell array 150 in response to commands and generates status information for the external memory sub-system controller 115, i.e., the local media controller 135 is configured to perform access operations, e.g., read operations, program operations, and / or erase operations, on the memory cell array 150. The local media controller 135 communicates with the row decode circuitry 108 and the column decode circuitry 111 to control the row decode circuitry 108 and the column decode circuitry 111 in response to addresses. In one embodiment, the local media controller 135 includes a program manager 134 that can implement word line group based identification of a first portion of a block, i.e., a good portion, while skipping programming of a second portion of the block, i.e., a bad portion, during a program operation, as described herein.

[0044] The local media controller 135 also communicates with the cache register 118. The cache register 118 latches incoming or outgoing data for temporary storage according to the direction of the local media controller 135 while the memory cell array 150 is busy writing or reading other data, respectively. During a program operation, e.g., a write operation, data can be transferred from the cache register 118 to the data register 170 for transfer to the memory cell array 150; then, new data can be latched from the I / O control circuitry 160 into the cache register 118. During a read operation, data can be transferred from the cache register 118 to the I / O control circuitry 160 for output to the memory sub-system controller 115; then, new data can be transferred from the data register 170 to the cache register 118. The cache register 118 and / or the data register 170 can form a page buffer of the memory device 130, e.g., can form a portion of the page buffer. The page buffer can further include a sense device (not shown in the figure) for sensing a data state of a memory cell in the memory cell array 150, e.g., by sensing a state of a data line connected to the memory cell. Figure 1B The status register 122 can communicate with the I / O control circuitry 160 and the local media controller 135 to latch status information for output to the memory sub-system controller 115.

[0045] Memory device 130 causes local media controller 135 to receive control signals at memory subsystem controller 115 via control link 132. For example, the control signals can include a chip enable signal CE#, a command latch enable signal CLE, an address latch enable signal ALE, a write enable signal WE#, a read enable signal RE#, and a write protect signal WP#. Additional or alternative control signals (not shown) can be received via control link 132 depending on the nature of memory device 130. In one embodiment, memory device 130 receives command signals (which represent commands), address signals (which represent addresses), and data signals (which represent data) from memory subsystem controller 115 via a multiplexed input / output (I / O) bus 133 and outputs data to memory subsystem controller 115 via I / O bus 133.

[0046] For example, commands can be received at I / O control circuitry 160 via I / O pins [7:0] of input / output (I / O) bus 133 and then can be written into command register 124. Addresses can be received at I / O control circuitry 160 via input / output (I / O) pins [7:0] of I / O bus 133 and then can be written into address register 114. Data can be received at I / O control circuitry 160 via input / output (I / O) pins [7:0] for 8-bit devices or input / output (I / O) pins [15:0] for 16-bit devices and then can be written into cache register 118. Data can then be written into data register 170 for programming memory cell array 150.

[0047] In an embodiment, cache register 118 can be omitted and data can be written directly into data register 170. Data can also be output via input / output (I / O) pins [7:0] for 8-bit devices or input / output (I / O) pins [15:0] for 16-bit devices. Although reference can be made to I / O pins, they can include any electrically conductive node, such as a commonly used electrically conductive pad or electrically conductive bump, that provides an electrical connection to memory device 130 by an external device, such as memory subsystem controller 115.

[0048] Those skilled in the art will appreciate that additional circuitry and signals can be provided and that the Figure 1B memory device 130 has been simplified Figure 1B It should be recognized that the functionality of the various block components described Figure 1B is not necessarily segregated to distinct components or component portions of an integrated circuit device. For example, a single component or component portion of an integrated circuit device can be adapted to perform the functionality of more than one block component. Alternatively, one or more components or component portions of an integrated circuit device can be combined to perform the functionality of a block component. Figure 1BThe functionality of a single block component. Additionally, while specific I / O pins have been described according to popular conventions for receiving and outputting various signals, it should be noted that other combinations or numbers of I / O pins (or other I / O node structures) may be used in various embodiments.

[0049] Figure 2 This is an instance host system coupled to a memory subsystem 110, which includes a memory subsystem controller 115 having a certificate generator 134, according to an embodiment of this disclosure. Figure 2 In the example shown, memory subsystem 110 includes a memory device 130 having a set of active components (e.g., active component 1, active component 2… active component N; where N is an integer). In an embodiment, host system 120 may generate a request to generate an authentication certificate associated with one or more portions of memory subsystem 110. For example, the request to generate the certificate may be initiated in response to memory subsystem 110, which includes memory device 130, being coupled to host system 120 (e.g., when memory device 130 of memory subsystem 110 is inserted into host system) or in response to power-on of host system 120 coupled to memory subsystem 110.

[0050] In one embodiment, the memory device 130 includes a set of active components, each of which is associated with a unique identifier (also referred to as an "active component (AC) identifier"). In response to a request, the certificate generator 134 identifies, collects, or aggregates a set of identifiers associated with at least a portion of the group of active components of the memory device 130 (e.g., active component 1, active component 2… active component N). In one embodiment, the AC identifier set may include an individual AC identifier (e.g., AC 1 identifier, AC 2 identifier… and AC N identifier) ​​associated with each active component in the group. In another embodiment, the AC identifier set may include a portion or subset of the AC identifier set (e.g., a subset of odd-numbered active components, a subset of even-numbered active components, a subset of active components having an AC identifier containing one or more specified characters or numbers, etc.).

[0051] exist Figure 2 In the example shown, certificate generator 134 collects a subset of AC identifiers containing all available AC identifiers (e.g., AC 1 identifier, AC 2 identifier, ..., and AC N identifier). In an embodiment, each AC identifier represents an electrical identifier or signature associated with a corresponding active component of memory device 130. According to an embodiment, Figure 2 The active component group of the memory device 130 shown may include one or more of the following: media components (e.g., DRAM, NAND, etc.), controllers (e.g., ASICs), read-only memory (e.g., erasable programmable read-only memory (EPROM)), interfaces (e.g., process management interfaces), etc.

[0052] In embodiments, the certificate generator 134 executes a certificate generation algorithm or process. According to embodiments, any suitable certificate generation algorithm can be executed, including, for example, a hash algorithm, a pseudo-random number generator (e.g., a second-level pseudo-random number generator), a polynomial order of a bit / sequence generator, a Rivest-Shamir-Adleman (RSA) algorithm, an Elliptic Curve Cryptography (ECC) algorithm, etc.

[0053] According to embodiments, the certificate generator 134 establishes an input or seed for the certificate generation algorithm. According to embodiments, the input includes at least a portion of the collected set of AC identifiers. According to embodiments, the input can further include additional information in addition to at least a portion of the collected set of AC identifiers, including, but not limited to, firmware version information, a hardware serial number associated with the memory device 130, a vendor name or identifier associated with the memory device 130, etc. For example, the certificate generator 134 can execute the certificate generation algorithm to generate a pseudo-random sequence of the aggregated set of AC identifiers. In embodiments, the certificate generator 134 employs a certificate generation algorithm that uses an input associated with the memory device 130 such that the same certificate (e.g., the same certificate value) is generated each time the algorithm is executed to enable the host system 120 to authenticate the memory device 130.

[0054] According to embodiments, the communication between the certificate generator 134 and the memory device 130 (e.g., the collection or identification of the set of AC identifiers) can be via an ONFI interface command or a low power double data rate (DDR) command (e.g., using a read mode register assigned a unique identifier). According to embodiments, advantageously, the unique identifier associated with a plurality of different types of active components (e.g., non-volatile memory devices, volatile memory devices, controllers, interfaces, etc.) can be communicated to the certificate generator 134 and used to generate a unique certificate associated with the memory device 130.

[0055] According to embodiments, the certificate generator 134 can collect a set of unique active component identifiers associated with a memory package (e.g., a NAND memory device) including a set of a plurality of memory dies (e.g., NAND die 1, NAND die 2...NAND die 16), where each NAND die is associated with a unique active component identifier.

[0056] According to embodiments, the certificate generator 134 generates an authentication certificate (also referred to as a“device certificate”) associated with the memory device 130 based at least in part on the set of AC identifiers. Advantageously, generating the certificate represents a component-level authentication, whereby the risk associated with modifying (e.g., replacing, tampering, reconfiguring, etc.) one or more of the physical components of the memory device 130 after the memory device 130 is released into the supply chain (i.e., post-manufacture) is reduced.

[0057] As Figure 2 explained in Figure 2 , the certificate generator 134 provides the device certificate to the host system 120. The host system 120 can provide the device certificate to the certification authority 113 to determine whether the device certificate associated with the memory device 130 is valid. In embodiments, the certification authority 113 can be an external (e.g., third party) system communicatively coupled to the host system 120. In embodiments, the certification authority 113 can be local to the host system (e.g., the host system 120 stores a local copy of all valid certificates). According to embodiments, if the host system 120 includes the certification authority 113, the certificate generator 134 can provide the device certificate to the certification authority 113, as indicated by the dashed line in Figure 2 .

[0058] Figure 3 An example certificate generator 113 for generating a device certificate associated with a memory device of a memory sub-system is explained. In embodiments, the certificate generator 113 executes a certificate generation algorithm 335 based on an input or seed value 301. According to embodiments, the seed value 301 includes a set of one or more active component (AC) identifiers (e.g., AC 1 identifier, AC 2 identifier... AC N identifier). According to embodiments, the seed value 301 further includes one or more portions of additional information. In embodiments, the additional information includes a portion of memory device information (e.g., a hardware version identifier associated with the memory device 130), a portion of firmware information (e.g., a firmware version number identifier associated with the memory device 130), or both a portion of memory device information and firmware information.

[0059] As Figure 3 shown in Figure 2 , the certificate generator 113 executes the certificate generation algorithm 335 using the seed value 301 to generate a device certificate 302 associated with the memory device 130. Thus, the device certificate 302 is generated based at least in part on identifiers corresponding to constituent components or components of the memory device 130. This approach enables a more fine-grained verification and validation of the authenticity of the memory components as compared to typical approaches that are based only on hardware version and firmware version information. For example, if the memory device 130 is tampered with at some point after manufacture such that one or more of the active components of the memory device are replaced, the device certificate generated by the certificate generator 113 will not match the information corresponding to a valid digital certificate maintained by the certification authority. Thus, the mismatch is identified and the device certificate is identified as invalid. The invalidity of the device certificate associated with the memory device can be communicated to the host system to enable the host system to take corresponding remedial action (e.g., suspend use of the memory device, communicate the invalidity to the manufacturer of the memory device, etc.).

[0060] Figure 4is a flow diagram of an example method of generating an authentication certificate associated with a memory device of a memory sub-system coupled to a host system, in accordance with one or more embodiments of the present disclosure. The method 400 can be performed by processing logic that can include hardware (e.g., processing device, circuitry, dedicated logic, programmable logic, microcode, hardware of a device, integrated circuit, etc.), software (e.g., instructions run or executed on a processing device), or a combination thereof. In some embodiments, the method 400 is performed by the certificate generator 113 of FIG. 1. Figure 1A , Figure 1B , Figure 2 and Figure 3 The order in which the processes are presented is not intended to be limiting, unless otherwise specified. Accordingly, the illustrated embodiments are to be understood as being examples only and the processes illustrated can be performed in a different order, and some processes can be performed in parallel. Additionally, one or more processes can be omitted in various embodiments. Thus, not all embodiments need to perform all processes. Other process flows are possible.

[0061] At operation 410, processing logic (e.g., the certificate generator 113) receives a request to generate a digital certificate associated with a memory device that includes a set of active components, where each active component in the set of active components is associated with an active component identifier. In embodiments, the request is received by the processing logic from a host system 120 coupled to a memory sub-system that includes the memory device. In embodiments, the memory device includes a set of active components including physical components, such as a controller, a set of volatile memory components (e.g., DRAM components), a set of non-volatile memory components (e.g., NAND components), a PCB, an integrated circuit (e.g., an ASIC), etc. In embodiments, each of the active components of the memory device is associated with a corresponding active component identifier (e.g., identifying information, such as a manufacturer serial number that indicates a source or manufacturer of the component). In embodiments, the request can be initiated in response to a power-up or start-up of the host system and / or the memory device.

[0062] At operation 420, in response to the request, the processing logic identifies a set of one or more active component identifiers corresponding to a set of active components of the memory device. In embodiments, the processing logic communicates with the memory device via ONFI commands to collect active component identifiers (e.g., cell IDs associated with respective active components) corresponding to one or more of the active components of the memory device. In embodiments, the processing logic can transmit one or more sideband commands to the memory device via a sideband channel (e.g., a slower channel) to collect the set of active component identifiers. In embodiments, the set of active component identifiers can include all or a selected portion of the entire set of active components. In embodiments, the processing logic identifies or collects additional information that can be used to generate the digital certificate. For example, the additional information can include memory device information (e.g., a serial number of the memory device), a firmware version associated with the memory device, and the like.

[0063] At operation 430, the processing logic generates a digital certificate associated with the memory device based on at least a portion of the set of active component identifiers. In embodiments, the processing logic can use at least a portion of the set of active component identifiers as at least a portion of a seed value for input to a certificate generation algorithm. In embodiments, the seed value can include a portion of the set of active component identifiers and a portion of additional information (e.g., a serial number of the memory device and firmware version information). In embodiments, the processing logic can select one or more active component identifiers from the set of active component identifiers to use as at least a portion of the seed value for input to the certificate generation algorithm.

[0064] At operation 440, the processing logic provides the digital certificate to the host system, where the digital certificate is used to authenticate the memory device. In embodiments, the host system can employ a certification authority to authenticate the digital certificate. In embodiments, the certification authority can be a third-party system or local to the host system. In embodiments, the certification authority determines the validity of the digital certificate associated with the memory device by comparing the digital certificate to a set of valid digital certificates.

[0065] Figure 5 An example machine, computer system 500, within which a set of instructions, for causing the machine to perform any one or more of the methodologies discussed herein, can be executed, is described in FIG. 5. In some embodiments, the computer system 500 can correspond to a host system (e.g., host system 120 of FIG. 1) that includes, is coupled to, or utilizes a memory sub-system (e.g., memory sub-system 110 of FIG. 1) or can be used to perform operations of a controller (e.g., to execute an operating system to perform operations corresponding to Figure 1A and Figure 2 a host system 120 that includes, is coupled to, or utilizes a memory sub-system (e.g., memory sub-system 110 of FIG. 1) or can be used to perform operations of a controller (e.g., to execute an operating system to perform operations corresponding to Figure 1A , Figure 1A , Figure 1B , Figure 2 and Figure 3The machine can be a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a cellular telephone, a web appliance, a server, a network router, switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while a single machine is illustrated, the term "machine" shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

[0066] The machine can be a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a cellular telephone, a web appliance, a server, a network router, switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while a single machine is illustrated, the term "machine" shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

[0067] The example computer system 500 includes a processing device 502, a main memory 504 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) (such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM), etc.), a static memory 506 (e.g., flash memory, static random access memory (SRAM), etc.), and a data storage system 518, which communicate with each other via a bus 530.

[0068] Processing device 502 represents one or more general-purpose processing devices such as a microprocessor, central processing unit, or the like. More particularly, the processing device can be complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or one processor implementing other instruction sets, or one or more processors implementing a combination of instruction sets. Processing device 502 can also be one or more special-purpose processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), network processor, or the like. The processing device 502 is configured to execute instructions 526 for performing the operations and steps discussed herein. The computer system 500 can further include a network interface device 508 to communicate over the network 520.

[0069] The data storage system 518 can include a machine-readable storage medium 524 (also known as a computer-readable medium) on which is stored one or more sets of instructions 526 or software embodying any one or more of the methodologies or functions described herein. The instructions 526 can also reside, completely or at least partially, within the main memory 504 and / or within the processing device 502 during execution thereof by the computer system 500, the main memory 504 and the processing device 502 also constituting machine-readable storage media. The machine-readable storage medium 524, data storage system 518, and / or main memory 504 can correspond to memory subsystem 110 of FIG. 1. Figure 1A

[0070] In one embodiment, the instructions 526 include instructions to implement functionality corresponding to the certificate generator 113 of FIG. 1. Figure 1A Figure 1B Figure 2 Figure 3 While the machine-readable storage medium 524 is shown in an example embodiment to be a single medium, the term "machine-readable storage medium" should be taken to include a single medium or multiple media that store one or more sets of instructions. The term "machine-readable storage medium" shall also be taken to include any medium that is capable of storing or encoding a set of instructions for execution by the machine and that cause the machine to perform any one or more of the methodologies of the present disclosure. The term "machine-readable storage medium" shall accordingly be taken to include, but not be limited to, solid-state memories, optical media, and magnetic media.

[0071] Some portions of the preceding detailed descriptions have been presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These

[0072] It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. The present disclosure can refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage systems.

[0073] ​​​​The present disclosure also relates to an apparatus for performing the operations herein. This apparatus can be specially constructed for the intended purposes, or it can include a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program can be stored in a computer readable storage medium, such as, but not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, each coupled to a computer system bus.

[0074] The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Various general purpose systems can be used with programs in accordance with the teachings herein, or it can prove convenient to construct a more specialized apparatus to perform the method. The structure for a variety of these systems will appear as set forth in the description below. In addition, the present disclosure is not described with reference to any particular programming language. It will be appreciated that a variety of programming languages can be used to implement the teachings of the disclosure described herein.

[0075] The present disclosure can be provided as a computer program product, or software, that can include a machine-readable medium having stored thereon instructions, which can be used to program a computer (or other electronic devices) to perform a process according to the present disclosure. The machine-readable medium can include any mechanism for storing information in a form accessible by a machine (e.g., computer, etc.). In some embodiments, a machine-readable (e.g., computer-readable) medium includes a machine (e.g., a computer) readable storage medium such as read only memory ("ROM"), volatile memory, such as random access memory ("RAM"), magnetic disk storage media, optical storage media, flash memory components, etc.

[0076] In the foregoing specification, embodiments of the present disclosure have been described with reference to specific embodiments thereof. It will, however, be evident that various modifications and changes can be made thereto without departing from the broader spirit and scope of embodiments of the present disclosure as set forth in the appended claims. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.

Claims

1. A memory sub-system, comprising: a memory device; and a processing device operably coupled to the memory device, the processing device performing operations comprising: receiving a request to generate a digital certificate associated with a memory device comprising a set of active components, wherein each active component of the set of active components is associated with an active component identifier; in response to the request, identifying a set of active component identifiers; generating the digital certificate associated with the memory device based on at least a portion of the set of active component identifiers; and providing the digital certificate to a host system, wherein the digital certificate is used to authenticate the memory device.

2. The memory sub-system of claim 1, wherein the set of active components comprises one or more of a controller circuit, a non-volatile memory component, a volatile memory component, an integrated circuit, or a printed circuit board of the memory device.

3. The memory sub-system of claim 1, wherein a seed value is established using at least a portion of the set of active component identifiers.

4. The memory sub-system of claim 3, wherein generating the digital certificate is performed using the seed value.

5. The memory sub-system of claim 3, wherein the seed value further comprises additional information.

6. The memory sub-system of claim 1, wherein the host system comprises a certificate authority system that stores a set of valid digital certificates.

7. The memory sub-system of claim 6, wherein the digital certificate is compared to the set of valid digital certificates to authenticate the memory device.

8. A method, comprising: receiving a request to generate a digital certificate associated with a memory device comprising a set of active components, wherein each active component of the set of active components is associated with an active component identifier; in response to the request, identifying a set of active component identifiers; generating the digital certificate associated with the memory device based on at least a portion of the set of active component identifiers; and providing the digital certificate to a host system, wherein the digital certificate is used to authenticate the memory device.

9. The method of claim 8, wherein the set of active components comprises one or more of a controller circuit, a non-volatile memory component, a volatile memory component, an integrated circuit, or a printed circuit board of the memory device.

10. The method of claim 8, wherein a seed value is established using at least a portion of the set of active component identifiers.

11. The method of claim 10, wherein generating the digital certificate is performed using the seed value.

12. The method of claim 10, wherein the seed value further comprises additional information.

13. The method of claim 8, wherein the host system comprises a certificate authority system that stores a set of valid digital certificates.

14. The method of claim 13, wherein the digital certificate is compared to the set of valid digital certificates to authenticate the memory device.

15. A non-transitory computer-readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising: receiving a request to generate a digital certificate associated with a memory device that includes a set of active components, wherein each active component in the set of active components is associated with an active component identifier; in response to the request, identifying a set of active component identifiers; generating the digital certificate associated with the memory device based on at least a portion of the set of active component identifiers; and providing the digital certificate to a host system, wherein the digital certificate is used to authenticate the memory device.

16. The non-transitory computer-readable storage medium of claim 15, wherein the set of active components includes one or more of a controller circuit, a non-volatile memory component, a volatile memory component, an integrated circuit, or a printed circuit board of the memory device.

17. The non-transitory computer-readable storage medium of claim 15, wherein a seed value is established using at least a portion of the set of active component identifiers.

18. The non-transitory computer-readable storage medium of claim 17, wherein generating the digital certificate is performed using the seed value.

19. The non-transitory computer-readable storage medium of claim 17, wherein the seed value further includes additional information.

20. The non-transitory computer-readable storage medium of claim 15, wherein the host system includes a certificate authority system that stores a set of valid digital certificates; and wherein the digital certificate is compared to the set of valid digital certificates to authenticate the memory device.

Images