System-on-chip, method for operating the same and device with the system-on-chip

Abstract

Method of operating a system-on-chip (SoC), characterized by: Converting clear data into secret data (S10) by an encryption engine within the SoC using an encryption key; and Transfer of secret data by the encryption engine directly to a non-volatile memory controller within the SoC (S12), wherein the non-volatile memory controller controls an operation of a non-volatile memory, wherein the encryption engine is directly connected to the non-volatile memory controller such that no devices are connected between the encryption engine and the non-volatile memory controller, the method being characterized in that, prior to converting, the SoC reads the clear data from a main memory (300) via a bus (110) under the control of a processor (CPU) (120), and wherein the secret data is not transmitted by the encryption engine to the non-volatile memory controller within the SoC via the bus (110).

Description

BACKGROUND 1. Technical field

[0001] Example embodiments of the inventive concept relate to a system on chip (SoC), a method of operating the SoC, and devices including the SoC. 2. Discussion of the state of the art

[0002] A main memory can receive programs to be executed by a processor (CPU) and data required by the CPU from a separate storage medium, such as a non-volatile memory device. The main memory can transfer data to the separate storage medium, such as the non-volatile memory device, to store the data.

[0003] US 2006 / 090084 A1 discloses the integration of secure operations and components into a conventional processing system running a standard operating system. To perform secure operations, a secure processing environment can be provided in which trusted, secure application code executes. In this environment, the applications and components can access all components in the system, including secure components. An open processing environment is available for performing conventional operations. Conventional application code can execute in the open environment. In the open environment, only open components may be accessed. This means that open applications and components may not be allowed to access the secure components in the system.In this way, a secure processing environment can be provided that allows secure and non-secure applications to run concurrently while protecting sensitive data and operations. For example, encrypted and authenticated secure application code can run securely alongside other non-secure application code on a general-purpose processor. Furthermore, access to components that use or store sensitive information can be restricted to select secure components, such as those executing secure code.

[0004] Data exchanged between main memory and the non-volatile storage device can be encrypted to prevent unauthorized users from accessing the data. The performance of a system that includes main memory and a non-volatile storage device can vary depending on the method used to exchange data between the main memory and the non-volatile storage device. SUMMARY

[0005] According to an exemplary embodiment of the present inventive concept, a method of operating a system on a chip (SoC) comprises: converting clear data into secret data by an encryption engine within the SoC using an encryption key; and transmitting the secret data by the encryption engine directly to a non-volatile memory controller within the SoC that controls an operation of a non-volatile memory, and wherein the encryption engine is directly connected to the non-volatile memory controller such that no devices are connected between the encryption engine and the non-volatile memory controller, and wherein the method is characterized in thatthat prior to converting, the SoC reads the clear data from a main memory via a bus under the control of a processor, and wherein the secret data is transmitted by the encryption engine to the non-volatile memory controller within the SoC, not via the bus. For example, the prior to converting method may include the SoC reading the clear data from the main memory. According to an exemplary embodiment, the clear data may be data output by a direct memory access (DMA) unit. For example, the prior to converting method may include a DMA unit within the SoC outputting the clear data to the encryption / decryption engine.

[0006] The encryption key can be issued from a one-time programmable (OTP) memory. For example, the pre-translation process may involve an OTP within the SoC issuing the key to the encryption / decryption engine. The encryption key can only be entered according to a secure program. For example, the pre-translation process may involve issuing the key to the encryption / decryption engine only while a secure program is executing (e.g., by a CPU within the SoC).

[0007] During conversion, the clear data can be converted into the secret data in units of blocks.

[0008] According to an exemplary embodiment of the present inventive concept, a method of operating a system on a chip (SoC) comprises: receiving, by an engine within the SoC, secret data directly from a memory controller within the SoC without passing the secret data through a bus that controls operation of a non-volatile memory; transmitting the clear data by means of the encryption engine through the bus; and converting the secret data into clear data by the engine using an encryption key, and wherein the encryption engine is directly connected to the non-volatile memory controller such that no devices are connected between the encryption engine and the non-volatile memory controller.

[0009] According to an exemplary embodiment of the present inventive concept, a system on chip (SoC) includes: an encryption / decryption engine that encrypts first clear data into first secret data or decrypts second secret data into second clear data using an encryption key;and a non-volatile memory controller directly connected to the encryption / decryption engine and transmitting the first secret data to a non-volatile memory or receiving second secret data from the non-volatile memory, and a processor controlling the transmission of the first clear data or the second clear data between a device external to the SoC and the encryption / decryption engine, and a memory controller controlling operation of a main memory, and wherein the processor and the memory controller are directly connected to a bus, and wherein the non-volatile memory controller is not directly connected to the bus, and wherein the encryption / decryption engine is directly connected to the non-volatile memory controller such that no devices are connected between the encryption / decryption engine and the non-volatile memory controller.

[0010] The SoC may further include a one-time programmable (OTP) memory that stores the encryption key. The SoC may further include a direct memory access (DMA) unit that transfers the first clear data received from a data source to the encryption / decryption engine or transfers the second clear data received from the encryption / decryption engine to the data source. For example, the DMA unit may receive the first clear data from a device external to the SoC and transfer the first clear data to the engine, or transfer the second clear data received from the engine to the device.

[0011] The DMA unit may be directly connected to the encryption / decryption engine. The SoC may further include a CPU that controls the transfer of the first clear data or the second clear data between a data source and the encryption / decryption engine. For example, the data source may be a device external to the SoC.

[0012] According to an exemplary embodiment of the present inventive concept, a system-in-package includes the SoC and a data source that communicates data with a non-volatile memory under the control of the SoC. The data source may be a device external to the SoC. According to an exemplary embodiment of the present inventive concept, a system-in-package includes the SoC, a non-volatile memory, and a data source that communicates data with the non-volatile memory under the control of the SoC.

[0013] According to an exemplary embodiment of the present inventive concept, a system-on-chip (SoC) includes a non-volatile memory controller configured to control a non-volatile memory, and an encryption / decryption engine directly connected to the non-volatile memory controller and configured to encrypt and decrypt data. The SoC controls the transfer of data between a data source (e.g., a device external to the SoC) and the non-volatile memory. The memory controller and the engine correspond to a first data path for transferring data.The system on a chip (SoC) further comprises a processor that controls the transfer of data between the device external to the SoC and the encryption / decryption engine, and a memory controller that controls operation of a main memory, and wherein the processor and the memory controller are directly connected to a bus, and wherein the non-volatile memory controller is not directly connected to the bus, and wherein the non-volatile memory controller and the encryption / decryption engine correspond to a first data path for transferring data, and wherein the encryption / decryption engine is directly connected to the non-volatile memory controller such that no devices are connected between the encryption / decryption engine and the non-volatile memory controller.

[0014] The invention is defined in the appended independent claims. Further developments of the invention are specified in the dependent claims. BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a block diagram of a system including a system on chip (SoC) according to an exemplary embodiment of the inventive concept; Fig. 2 is a block diagram of the SoC used in Fig. 1, according to an exemplary embodiment of the inventive concept; Fig. Figure 3 is a conceptual diagram describing a secure mode in which an encryption key is sent to an encryption / decryption engine located in Fig. 2 is illustrated; Fig. 4 is a block diagram of the SoC used in Fig. 1, according to an exemplary embodiment of the inventive concept; Fig. 5 is a block diagram of the SoC used in Fig. 1, according to an exemplary embodiment of the inventive concept; Fig. 6 is a block diagram of the SoC used in Fig. 1, according to an exemplary embodiment of the inventive concept; Fig. 7 is a block diagram of the SoC used in Fig. 1, according to an exemplary embodiment of the inventive concept; Fig. Figure 8 is a block diagram of a selection circuit and an encryption / decryption engine used in Fig. 7, according to an exemplary embodiment of the inventive concept; Fig. 9 is a block diagram of the SoC used in Fig. 1, according to an exemplary embodiment of the inventive concept; Fig. 10 is a flowchart of a method of operating an SoC according to an exemplary embodiment of the inventive concept; Fig. 11 is a flowchart of a method of operating an SoC according to an exemplary embodiment of the inventive concept; Fig. 12 is a flowchart of a method of operating an SoC according to an exemplary embodiment of the inventive concept; Fig. 13 is a flowchart of a method of operating an SoC according to an example embodiment of the inventive concept; Fig. 14 is a block diagram of a data processing device that implements the system of Fig. 1, according to an exemplary embodiment of the inventive concept; Fig. 15 is a block diagram of a data processing device that implements the system of Fig. 1, according to an exemplary embodiment of the inventive concept; Fig. 16 is a block diagram of a data processing device that implements the system of Fig. 1, according to an exemplary embodiment of the inventive concept; Fig. 17 is a block diagram of a system-in-package that shows the SoC that is in Fig. 1, according to an exemplary embodiment of the inventive concept and a non-volatile memory device illustrated in Fig. 1 is illustrated; and Fig. 18 is a block diagram of a system-in-package that shows the SoC that is in Fig. 1, according to an exemplary embodiment of the inventive concept. DETAILED DESCRIPTION

[0015] When one device is described herein as transmitting data to another device, the data is transmitted from one device to the other device either directly (e.g., "transmitted directly") or indirectly (e.g., "transmitted indirectly"). In an exemplary embodiment in which one device transmits the data directly, the data is transmitted from one device to the other device without passing through any other device except a wire. In an exemplary embodiment in which one device transmits the data directly, the data is transmitted from one device to the other device via a multiplexer or a demultiplexer without the use of any additional devices.

[0016] When a device is described herein as being connected to another device, these devices may be directly connected to each other (e.g., "directly connected") or indirectly connected to each other (e.g., "indirectly connected"). In an embodiment where the two devices are directly connected, no devices are present between the two devices other than a wire. In an embodiment where the two devices are directly connected, no devices are present between the two devices other than a multiplexer or a demultiplexer.

[0017] It should be understood that devices and methods described herein may be implemented in various forms of hardware, software, firmware, special-purpose processors, or a combination thereof. In particular, part of the present inventive concept may be implemented as an application comprising program instructions tangibly embodied on one or more program storage devices or computer-readable media (e.g., hard disk, magnetic floppy disk, RAM, ROM, CD-ROM, etc.) and executable by any device or machine having a suitable architecture, such as a general-purpose digital computer having a processor, memory, and input and output interfaces.It should further be understood that the connections between the device modules (or the logical flow of various process steps) may differ depending on the manner in which the present inventive concept is programmed, because some of the individual device components and process steps illustrated in the accompanying figures may be implemented in software.

[0018] Fig. 1 is a block diagram of a system 10 including a system-on-chip (SoC) 100 according to an exemplary embodiment of the present inventive concept. Referring to Fig. 1, the system 10 includes the SoC 100, a non-volatile memory device 200, and a main memory 300.

[0019] The system 10 can be implemented using a computer (PC), a data server, or a portable device. For example, the portable device can be implemented using a laptop computer, a mobile phone, a smartphone, a tablet computer, a personal digital assistant (PDA), an enterprise digital assistant (EDA), a digital image camera, a digital video camera, a portable multimedia player (PMP), a personal (or portable) navigation device (PND), a portable game console, or an e-book.

[0020] The SoC 100 can control data transmission and reception between the non-volatile memory device 200 and the main memory 300. A structure and operation of the SoC 100 will be described in detail below with reference to Fig. 2 and 4 to 9 are described.

[0021] The non-volatile memory device 200 can store a variety of programs and data. The non-volatile memory device 200 can be implemented using an electrically erasable programmable read-only memory (EEPROM), a flash memory, a magnetic random access memory (MRAM), a spin-transfer torque MRAM, a conductive bridging RAM (CBRAM), a ferroelectric RAM (FeRAM), a phase-change RAM (PRAM), a resistive RAM (RRAM), a nanotube RRAM, a polymer RAM (PoRAM), a nano-floating gate memory (NFGM), a holographic memory, a molecular electronics memory device, an insulator resistance change memory, or the like.

[0022] Main memory 300 may receive programs to be executed in SoC 100 and data required by SoC 100 from non-volatile storage device 200 via SoC 100. Main memory 300 may transfer data to be stored to non-volatile storage device 200 via SoC 100. Main memory 300 may be implemented using RAM, for example, dynamic RAM (DRAM) or static RAM (SRAM), which is a volatile memory. However, main memory 300 is not limited to RAM, DRAM, or SRAM, as various types of memory may be used.

[0023] Fig. 2 is a block diagram of a SoC 100A illustrating an embodiment of the SoC 100 of Fig. 1. With reference to Fig. 2, the SoC 100A includes a bus 110, a processor (CPU) 120, a memory controller 130, a non-volatile memory controller 140, and an encryption / decryption engine 150.

[0024] CPU 120 may be connected to bus 110 and may control the overall operation of SoC 100A. Memory controller 130 may control an operation of main memory 300, for example, a read or write operation. Memory controller 130 may be connected to bus 110.

[0025] The non-volatile memory controller 140 may control a data access operation of the non-volatile memory device 200, for example, a write operation, a read operation, a program operation, or an erase operation.

[0026] The encryption / decryption engine 150 can convert, i.e., encrypt, plain data received from the main memory 300 via the memory controller 130 and the bus 110 into secret data (e.g., encrypted data). The encryption / decryption engine 150 can transfer the secret data directly, for example, "on the fly," to the non-volatile memory controller 140 without passing through the bus 110.

[0027] In an exemplary embodiment, the encryption / decryption engine 150 receives secret data directly, e.g., "on-the-fly," from the non-volatile memory controller 140 without passing it through the bus 110. The encryption / decryption engine 150 can convert the secret data into clear data (e.g., unencrypted data), e.g., decrypt it.

[0028] An encryption key may be used in the encryption or decryption of the encryption / decryption engine 150. In an exemplary embodiment, the encryption / decryption engine 150 includes a storage medium (not shown) that stores the encryption key. For example, the storage medium could be a register, a latch, a flash memory, etc. According to an exemplary embodiment, the encryption key is entered into the storage medium only in a secure mode. The secure mode is described below with reference to Fig. 3 are described.

[0029] The encryption / decryption engine 150 can encrypt or decrypt data in units of blocks of a predetermined size, for example, 64 bits, 128 bits, or 256 bits.

[0030] When the encryption / decryption engine 150 encrypts or decrypts in units of blocks, an encryption key and an algorithm used in encryption or decryption may be applied to each block. For example, the algorithm may be a Data Encryption Standard (DES) algorithm or an Advanced Encryption Standard (AED) algorithm. However, the algorithm is not limited to these, as other encryption or decryption algorithms may be used.

[0031] The secure mode may determine the method used by the encryption engine 150 to transform data, for example, to encrypt or decrypt data in units of blocks. Examples of secure mode include an electronic code book (ECB) mode, a cipher block chaining (CBC) mode, a propagating cipher block chaining (PCBC) mode, or a cipher feedback (CFB) mode. In ECB, each block is encrypted independently. In CBC, each block of plaintext (e.g., unencrypted data) is logically exclusive-ored with the preceding ciphertext block (e.g., encrypted data) before being encrypted. PCBC is a variant of CBC and is designed to propagate a single-bit error in the ciphertext to allow errors in transmission to be caught and the resulting plaintext to be discarded.With CFB, data can be encrypted in units smaller than the block size. However, the secure mode is not limited to being set to one of the modes described above.

[0032] When data is written to the non-volatile memory device 200, in a write data path WP, clear data (e.g., unencrypted data) output from the main memory 300 is transferred to the CPU 120 via the memory controller 130 and the bus 110, and then transferred from the CPU 120 to the encryption / decryption engine 150 via the bus 110. In other words, the clear data is transferred to the encryption / decryption engine 150 under the control of the CPU 120.

[0033] The encryption / decryption engine 150 can convert the clear data into secret data using an encryption key. The secret data can be transmitted to the non-volatile storage device 200 via the non-volatile memory controller 140. When data is read from the non-volatile storage device 200, secret data output from the non-volatile storage device 200 is transmitted to the encryption / decryption engine 150 via the non-volatile memory controller 140 on a read data path RP.

[0034] The encryption / decryption engine 150 may convert the secret data into clear data using a decryption key. The decryption key may or may not be the same as an encryption key. The clear data may be transmitted to the CPU 120 via the bus 110 and then transmitted from the CPU 120 to the main memory 300 via the bus 110 and the memory controller 130. In other words, the clear data may be transmitted to the main memory 300 via the bus 110 and the memory controller 130 under the control of the CPU 120.

[0035] Fig. 3 is a conceptual diagram for describing a secure mode in which an encryption key or a decryption key is input into the encryption / decryption engine 150 provided in Fig. 2 is illustrated. With reference to Fig. 2 and Fig. 3 can manage a general purpose operating system (OS) hardware and can be installed on the hardware to run an application program.

[0036] A secure OS can also be installed on the hardware to run a secure application program that requires security, independent of a general-purpose operating system (OS). The secure OS can be implemented using a real-time operating system (RTOS). For example, the RTOS can be used to run an application program that must be completed within a predetermined time period, such as a secure application program. The secure OS can be a trusted operating system that has sufficient support for multi-level security and proof of correctness to meet specific sets of government requirements.

[0037] A non-secure mode may refer to an example where the application program is executed by the general OS, and a secure mode may refer to an example where the secure application program is executed by the secure OS.

[0038] In an exemplary embodiment, CPU 120 inputs an encryption key or a decryption key to encryption / decryption engine 150 while the secure application program is executing in secure mode. In an exemplary embodiment, encryption / decryption engine 150 has access to an encryption key or a decryption key stored within itself or external to encryption / decryption engine 150. In an exemplary embodiment, an encryption key or a decryption key may be changed or reset while the secure application program is executing in secure mode. For example, if the key is changed, the next encryption / decryption that occurs uses the updated key.

[0039] Fig. 4 is a block diagram of a SoC 100B illustrating an exemplary embodiment of the SoC 100 of Fig. 1. With reference to Fig. 1 to 4, the SoC 100B includes a bus 110, a CPU 120, a memory controller 130, a non-volatile memory controller 140, an encryption / decryption engine 150, and a one-time programmable (OTP) memory 160. In an exemplary embodiment, the OTP memory 160 stores an encryption key or decryption key used by the encryption / decryption engine 150 during encryption or decryption.

[0040] In an exemplary embodiment, the OTP memory 160 is implemented using a fuse, an anti-fuse, or an e-fuse. In an exemplary embodiment, an anti-fuse is an electrical device that performs the opposite function of a fuse. For example, while a fuse starts with a low resistance and is designed to permanently break an electrically conductive path (e.g., when the current through the path exceeds a specified limit), an anti-fuse starts with a high resistance and is designed to permanently form an electrically conductive path (e.g., when the voltage across an anti-fuse exceeds a certain level). In an exemplary embodiment, an e-fuse enables dynamic reprogramming of computing chips in real time.

[0041] In contrast to the SoC 100A from Fig. 2 can be found in the SoC 100B from Fig. 4, the CPU 120 may be implemented in such a way that it is prevented from accessing an encryption key or a decryption key stored in the OTP memory 160, even when a secure application is running in a secure mode. For example, the CPU 120 may be implemented in such a way that it is prevented from reading, writing, or deleting the stored key. A write data path WP and a read data path RP of the SoC 100B of Fig. 4 are essentially the same as those of the SoC 100A from Fig. 2 except that an encryption key or a decryption key that can be used in encryption and decryption of data is provided from the OTP storage 160 to the encryption / decryption engine 150.

[0042] Fig. 5 is a block diagram of a SoC 100C illustrating an exemplary embodiment of the SoC 100 shown in Fig. 1 is illustrated. With reference to Fig. 1 and Fig. 5, the SoC 100C includes a bus 110, a CPU 120, a memory controller 130, a non-volatile memory controller 140, an encryption / decryption engine 150, an OTP memory 160, and a direct memory access (DMA) unit 170.

[0043] The DMA unit 170 may access the main memory 300 or the non-volatile memory device 200 via a component (e.g., the memory controller 130, the non-volatile memory controller 140, or the encryption / decryption engine 150) without passing data through the CPU 120. In this example, the DMA unit 170 may be connected to the bus 110.

[0044] In a write data path WP, when data is written to the non-volatile memory device 200, clear data output from the main memory 300 is transferred to the DMA unit 170 via the memory controller 130 and the bus 110. The clear data is transferred from the DMA unit 170 to the encryption / decryption engine 150 via the bus 110.

[0045] The encryption / decryption engine 150 converts the clear data into secret data. The secret data output by the encryption / decryption engine 150 can be transmitted directly to the non-volatile memory controller 140 and then to the non-volatile storage device 200. In other words, the encryption / decryption engine 150 can transmit the secret data directly, for example, "on the fly," to the non-volatile memory controller 140.

[0046] When data is read from the non-volatile memory device 200 in a read data path RP, secret data output from the non-volatile memory device 200 is transmitted to the encryption / decryption engine 150 via the non-volatile memory controller 140. In other words, the encryption / decryption engine 150 can receive secret data directly, for example, "on the fly," from the non-volatile memory controller 140.

[0047] The encryption / decryption engine 150 converts the secret data into clear data. The clear data is transferred to the DMA unit 170 via the bus 110. The clear data can be transferred from the DMA unit 170 to the main memory 300 via the bus 110 and the memory controller 130.

[0048] Fig. 6 is a block diagram of a SoC 100D illustrating an exemplary embodiment of the SoC 100 shown in Fig. 1 is illustrated. With reference to Fig. 1 and Fig. 6, the SoC 100D includes a bus 110, a CPU 120, a memory controller 130, a non-volatile memory controller 140, an encryption / decryption engine 150, an OTP memory 160, and a DMA unit 170.

[0049] The DMA unit 170 may be connected between the bus 110 and the encryption / decryption engine 150. Data may be transferred on-the-fly between the DMA unit 170 and the encryption / decryption engine 150.

[0050] When data is written to the non-volatile memory device 200 in a write data path WP, clear data output from the main memory 300 is transferred to the encryption / decryption engine 150 via the memory controller 130, the bus 110, and the DMA unit 170.

[0051] The encryption / decryption engine 150 can convert, e.g., encrypt, clear data into secret data. The secret data can be transferred to the non-volatile storage device 200 via the non-volatile memory controller 140. In this example, the encryption / decryption engine 150 can transfer the secret data directly, e.g., "on the fly," to the non-volatile memory controller 140.

[0052] When data is read from the non-volatile memory device 200 in a read data path RP, secret data output from the non-volatile memory device 200 is transmitted to the encryption / decryption engine 150 via the non-volatile memory controller 140. In this example, the encryption / decryption engine 150 may receive the secret data directly, e.g., "on-the-fly," from the non-volatile memory controller 140.

[0053] The encryption / decryption engine 150 can convert the secret data into clear data, e.g., decrypt it. The clear data can be transferred to the main memory 300 via the DMA unit 170, the bus 110, and the memory controller 130.

[0054] Fig. 7 is a block diagram of a SoC 100E, which is an exemplary embodiment of the SoC 100 shown in Fig. 1. Referring to Fig. 1, Fig. 3 and Fig. 7, the SoC 100E includes a bus 110, a CPU 120, a memory controller 130, a non-volatile memory controller 140, an encryption / decryption engine 150, an OTP memory 160, a DMA unit 170, a register 180, and a selection circuit 190.

[0055] Register 180 may be connected to bus 110. Register 180 may function as a select signal generator that generates a select signal SEL. Register 180 may change the select signal SEL based on whether CPU 120 is executing a secure application program, i.e., based on an indication signal indicating a secure mode. The indication signal may be output by CPU 120. For example, the indication signal may be a high logic level in a secure mode and a low logic level in a non-secure mode.

[0056] The selection circuit 190 may select a data path according to the selection signal SEL output from the register 180. An exemplary structure and operation of the selection circuit 190 will now be described with reference to Fig. 8 will be described.

[0057] Fig. Figure 8 is a block diagram of a selection circuit 190 and the encryption / decryption engine 150 shown in Fig. 7, according to an exemplary embodiment of the inventive concept. Referring to Fig. 3, Fig. 7 and Fig. 8, the selection circuit 190 includes a first selector 192 and a second selector 194. The first selector 192 may be implemented using a demultiplexer, and the second selector 194 may be implemented using a multiplexer.

[0058] For example, when the selection signal SEL is at a high logic level, the selection circuit 190 selects a data path including the encryption / decryption engine 150. When the CPU 120 is executing a secure program application, i.e., in a secure mode, the selection circuit 190 selects the data path with the encryption / decryption engine 150. In an exemplary embodiment, the selection circuit 190 selects a data path without the encryption / decryption engine 150, i.e., a bypass path, when the selection signal SEL is at a low logic level. For example, when the CPU 120 is executing a general application program, i.e., in a non-secure mode, the selection circuit 190 may select the data path without the encryption / decryption engine 150, i.e., the bypass path.

[0059] Fig. 9 is a block diagram of a SoC 100F, which is an exemplary embodiment of the SoC 100 shown in Fig. 1. Referring to Fig. 1, Fig. 8 and Fig. 9, the SoC 100F includes a bus 110, a CPU 120, a memory controller 130, a non-volatile memory controller 140, an encryption / decryption engine 150, an OTP memory 160, a DMA unit 170, a second OTP memory 182, and a selection circuit 190.

[0060] In an exemplary embodiment, the second OTP memory 182 functions as a select signal generator that generates a select signal SEL. In an exemplary embodiment, the OTP memory 182 is programmed to generate a select signal SEL with a logic level, e.g., a high logic level. In this embodiment, the selection circuit 190 only selects the data path with the encryption / decryption engine 150.

[0061] Fig. 10 is a flowchart of a method of operating an SoC according to an exemplary embodiment of the present inventive concept. Referring to Fig. 2, 4 to 7, 9, and 10, the encryption / decryption engine 150 converts plain data into secret data using an encryption key, e.g., encrypts it (S10). The encryption / decryption engine 150 can transmit the secret data directly, e.g., "on the fly," to the non-volatile memory controller 140 (S12). Because the encryption key resides within the SoC 100 and is not output outside the SoC 100, sniffing communications between the SoC and the other storage devices (e.g., 200 and 300) will not detect the key.

[0062] Fig. 11 is a flowchart of a method of operating an SoC according to an exemplary embodiment of the present inventive concept. Referring to Fig. 5 to 7, 9, and 10, the encryption / decryption engine 150 receives clear data from the DMA unit 170 (S20). In an exemplary embodiment, the encryption / decryption engine 150 receives the clear data from the DMA unit 170 directly, for example, "on-the-fly." Then, the engine 150 encrypts similarly to Fig. 10 the plain data into secret data (S10) and transmits the secret data directly to the non-volatile memory controller (S12).

[0063] Fig. 12 is a flowchart of a method of operating an SoC according to an exemplary embodiment of the present inventive concept. Referring to Fig. 2, 4 to 7, 9, and 10, the encryption / decryption engine 150 receives secret data directly, for example, "on-the-fly," from the non-volatile memory controller 140 (S30). The encryption / decryption engine 150 encrypts the secret data into clear data (S32).

[0064] Fig. 13 is a flowchart of a method of operating an SoC according to an exemplary embodiment of the present inventive concept. Similar to Fig. 12, the engine 150 receives secret data directly from the non-volatile memory controller (S30) and encrypts the secret data into plain data (S32). Referring to Fig. 5 to 7, 9, and 13, the encryption / decryption engine 150 transmits the clear data to the DMA unit (S34). In an exemplary embodiment, the encryption / decryption engine 150 transmits clear data directly, for example, "on the fly," to the DMA unit 170.

[0065] Fig. 14 is a block diagram of a data processing device 400 with the system 10 of Fig. 1 according to an exemplary embodiment of the present inventive concept. Referring to Fig. 1 and Fig. 14, the data processing device 400 can be implemented using a computer (PC) or a data server.

[0066] The data processing device 400 includes a processor 100, a storage device 200, a memory 300, a power source 410, input / output (I / O) ports 420, a plug-in card 430, a network device 440, and a display 450. The data processing device 400 may further include a camera module 460. In an exemplary embodiment, one or more of the elements of the processing device 400 may be omitted.

[0067] The processor 100 can be the SoC 100 of Fig. 1. The processor 100 may be a multi-processor. In an exemplary embodiment, the processor 100 comprises the SoC 100 of Fig. 1. The processor 100 can control the operation of at least one of the elements 200, 300, and 410-460.

[0068] The storage device 200 may be the non-volatile storage device 200 of Fig. 1. The storage device 200 may be implemented using a hard disk drive or a solid state storage drive (SSD).

[0069] The memory 300 can be assigned to the main memory 300 of Fig. 1. The memory 300 may be implemented using a volatile memory or a non-volatile memory. In an exemplary embodiment, the memory controller 140 is Fig. 2 is capable of controlling a data access operation, for example, a read operation, a write operation (or a program operation), or an erase operation with respect to the memory 300. The memory 300 may be integrated or embedded in the processor 100.

[0070] Voltage source 410 can provide an operating voltage to at least one of elements 100, 200, 300, and 420-460. I / O ports 420 are capable of transmitting data to storage device 200 or transmitting data output from storage device 200 to an external device. For example, I / O ports 420 can be a port for connecting a pointing device, such as a computer mouse, to data processing device 400, a port for connecting a printer to data processing device 400, or a port for connecting a Universal Serial Bus (USB) drive to data processing device 400.

[0071] The plug-in card 430 can be implemented using a Secure Digital (SD) card or a Multimedia Card (MMC). In an exemplary embodiment, the plug-in card 430 is a Subscriber Identification Module (SIM) card or a Universal Subscriber Identity Module (USIM) card.

[0072] Network device 440 may correspond to a device capable of connecting storage device 200 to a wired or wireless network. Display 450 may display data output from storage device 200, memory 300, I / O ports 420, expansion card 430, or network device 440.

[0073] The camera module 460 may be capable of converting an optical image into an electronic image. Accordingly, an electronic image output by the camera module 460 may be stored in the storage device 200, the memory 300, or the plug-in card 430. The electronic image output by the camera module 460 may be displayed on the display 450.

[0074] Fig. 15 is a block diagram of a data processing device 500 with the system 10 of Fig. 1 according to an exemplary embodiment of the present inventive concept. As an example, the data processing device 500 may be implemented using a laptop computer.

[0075] Similar to the data processing device 400 of Fig. 14, the data processing device 500 of Fig. 15 includes a processor 100, a storage device 200, a memory 300, a power source 510, input / output (I / O) ports 520, a plug-in card 530, a network device 540, and a display 550. The data processing device 500 may further include a camera module 560. In an exemplary embodiment, one or more of the elements of the processing device 500 may be omitted.

[0076] Fig. 16 is a block diagram of a data processing device 600 with the system 10 of Fig. 1 according to an exemplary embodiment of the present inventive concept. Referring to Fig. 1 and Fig. 16, the data processing device 600 may be implemented using a portable device.

[0077] The portable device may be implemented using a mobile phone, a smartphone, a tablet computer, a personal digital assistant (PDA), an enterprise digital assistant (EDA), a digital imaging camera, a digital video camera, a portable multimedia player (PMP), a personal (or portable) navigation device (PND), a portable game console, or an e-book.

[0078] Similar to the data processing device 400 of Fig. 14, the data processing device 600 of Fig. 16 includes a processor 100, a storage device 200, a memory 300, a power source 610, input / output (I / O) ports 620, a plug-in card 630, a network device 640, and a display 650. The data processing device 600 may further include a camera module 660. In an exemplary embodiment, one or more elements of the processing device 600 may be omitted.

[0079] Fig. 17 is a block diagram of a System-in-Package (SiP) 700 with the SoC 100 of Fig. 1 according to an exemplary embodiment of the present inventive concept and the non-volatile memory device 200 of Fig. 1. Fig. 18 is a block diagram of a SiP 700' with the SoC 100 of Fig. 1 according to an embodiment of the present inventive concept. In an exemplary embodiment, a SIP may be referred to as a chip stack MCM (multi-chip module). A SiP may include a number of integrated circuits contained within a single module or package.

[0080] Referring to Fig. 1 and Fig. 17, the SoC 100 and the main memory 300 are packaged into the SiP 700. Consequently, the non-volatile memory 200 is located outside the SiP 700 and can be connected to a pin of the SiP 700. Referring to Fig. 1 and Fig. 18, the SoC 100, the non-volatile storage device 200 and the main memory 300 are all packaged into the SiP 700'.

[0081] An SoC according to an exemplary embodiment of the present inventive concept encrypts data within the SoC, thus preventing snooping on communications between the SoC and other devices from accessing unencrypted data. Furthermore, according to an exemplary embodiment, the SoC stores an encryption key for encryption within itself without exposing the key to the outside, thus preventing the encryption key from being disclosed.

[0082] In an exemplary embodiment of the inventive concept, software of the SoC is unable to access an encryption key used for encryption, which can prevent the encryption key from being compromised as a result of hacking. Because the SoC software does not participate in encryption, the load on the software is reduced. In an exemplary embodiment, the SoC has a directly connected encryption / decryption engine and a memory controller, thereby resulting in a shortened data transmission path within the SoC. Therefore, the SoC can have improved performance.

[0083] Although exemplary embodiments of the present inventive concept have been shown and described, it will be apparent to those skilled in the art that various changes may be made in these embodiments without departing from the spirit and scope of the inventive concept.

Claims

[1] Method of operating a system-on-chip (SoC), characterized by : Converting clear data into secret data (S10) by an encryption engine within the SoC using an encryption key; and Transfer of secret data by the encryption engine directly to a non-volatile memory controller within the SoC (S12), wherein the non-volatile memory controller controls an operation of a non-volatile memory, wherein the encryption engine is directly connected to the non-volatile memory controller such that no devices are connected between the encryption engine and the non-volatile memory controller, whereby the procedure characterized by is that before converting, the SoC reads the clear data from a main memory (300) via a bus (110) under the control of a processor (CPU) (120), and wherein the secret data is not transmitted by the encryption engine to the non-volatile memory controller within the SoC via the bus (110). [2] The method according to claim 1, wherein the method characterized by is that before conversion, a direct memory access (DMA) unit within the SoC outputs the clear data to the encryption engine (S20). [3] The method according to claim 1, wherein the method characterized by is that before conversion, a one-time programmable memory (OTP) within the SoC issues the encryption key to the encryption engine. [4] The method according to claim 1, wherein the method characterized by is that before converting, the encryption key is only issued to the encryption engine while a secure program is running. [5] The method of claim 1, wherein said converting is characterized by converting said clear data into secret data in units of blocks. [6] A method of operating a system-on-chip (SoC), the method being characterized by: Receiving secret data by an encryption engine within the SoC directly from a non-volatile memory controller within the SoC without passing the secret data through a bus, wherein the non-volatile memory controller controls an operation of a non-volatile memory (S30); Transferring the clear data using the encryption engine through the bus; and Converting the secret data into clear data using an encryption key by the encryption engine (S32), and wherein the encryption engine is directly connected to the non-volatile memory controller such that no devices are connected between the encryption engine and the non-volatile memory controller. [7] Single Chip System (SoC) (100, 100A, 100B, 100C, 100D), characterized by : an encryption / decryption engine (150) that encrypts first clear data into first secret data or decrypts second secret data into second clear data using an encryption key; a non-volatile memory controller (140) directly connected to the encryption / decryption engine, the memory controller transmitting the first secret data to a non-volatile memory (200) or receiving the second secret data from the non-volatile memory; a processor (CPU) (120) that controls the transmission of the first clear data or the second clear data between a device external to the SoC and the encryption / decryption engine; and a memory controller (130) that controls operation of a main memory (300), wherein the processor (CPU) (120) and the memory controller (130) are directly connected to a bus (110), wherein the non-volatile memory controller (140) is not directly connected to the bus (110), and wherein the encryption / decryption engine (150) is directly connected to the non-volatile memory controller (140) such that no devices are connected between the encryption / decryption engine (150) and the non-volatile memory controller (140). [8] The SoC of claim 7 (100, 100B, 100C, 100D), further characterized by a one-time programmable (OTP) memory (160) storing the encryption key. [9] SoC according to claim 7 (100, 100C, 100D), further characterized by a direct memory access (DMA) unit (170) that receives first clear data from a device (300) external to the SoC and transmits the first clear data to the encryption / decryption engine (150) or transmits the second clear data received from the encryption / decryption engine (150) to the device. [10] The SoC of claim 9 (100, 100D), wherein the DMA unit is directly connected to the encryption / decryption engine (150). [11] System-in-Package (700), characterized by : the SoC according to claim 7; and a device (300) that communicates data with the non-volatile memory (200) under the control of the SoC. [12] System-in-Package (700'), characterized by : the SoC according to claim 7; the non-volatile memory (200); and a device (300) that communicates data with the non-volatile memory under the control of the SoC. [13] Single Chip System (SoC) (100, 100E, 100F), characterized by : a non-volatile memory controller (140) configured to control a non-volatile memory (200); and an encryption / decryption engine (150) directly connected to the memory controller (140) and configured to encrypt or decrypt data, wherein the SoC controls transmission of data between a device (300) external to the SoC and the non-volatile memory (200), and a processor (CPU) (120) that controls the transmission of data between the device (300) outside the SoC and the encryption / decryption engine (150), and a memory controller (130) that controls operation of a main memory (300), and wherein the processor (CPU) (120) and the memory controller (130) are directly connected to a bus (110), and wherein the non-volatile memory controller (140) is not directly connected to the bus (110), and wherein the non-volatile memory controller (140) and the encryption / decryption engine (150) correspond to a first data path for transmitting data, and wherein the encryption / decryption engine (150) is directly connected to the non-volatile memory controller (140) such that no devices are connected between the encryption / decryption engine (150) and the non-volatile memory controller. [14] The SoC of claim 13, wherein the SoC is characterized by a one-time programmable (OTP) memory (160) storing a key, and the encryption / decryption engine encrypts or decrypts the data using the key stored in the (OTP) memory. [15] The SoC of claim 13, wherein the first data path is further characterized by a direct memory access (DMA) unit (170) that receives data from the device and transmits the data to the encryption / decryption engine or receives data from the encryption / decryption engine and transmits the data to the device. [16] The SoC of claim 15, wherein the DMA unit is directly connected to the encryption / decryption engine. [17] The SoC of claim 16, further characterized by a second data path that carries the data that has not been encrypted. [18] SoC according to claim 17, further characterized by a selection circuit (190) that selects either the first data path or the second data path based on a selection signal. [19] SoC according to claim 18, further characterized by a selection signal generator (180, 182) that generates the selection signal, wherein the selection signal generator is a one-time programmable (OTP) memory (182) or a register (180).

Images