Read-Only Memory (ROM) Security

Abstract

Devices with integrated circuit (IC) chips can provide protection against attacks on read-only memories (118) (ROMs), such as boot ROMs for security circuits. An attacker can gain control of the IC by modifying the contents of the ROM and / or redirecting ROM reads. To counter these attacks, an implementation stores encrypted ROM data (410) in a ROM array (404). A ROM controller (402) is used to cryptographically bind the address (414) of each ROM line to the corresponding encrypted ROM data (412). To access the encrypted ROM data, the encryption circuit decrypts the encrypted ROM data using a key generated based on the corresponding ROM address. As part of the integrity check procedure, a digest (516) can be calculated based on the encrypted ROM data. To further thwart attacks, the ROM address (512) can be adjusted (e.g., scrambled) before the controller reads the encrypted data from the ROM array using the adjusted address (514).

Description

[Background technology]

[0001] background Electronic devices play an essential role in manufacturing, communications, transportation, healthcare, commerce, social interaction, and entertainment. For example, electronic devices power server farms that provide cloud-based distributed computing capabilities for commerce and communications. Electronic devices are also embedded in many types of modern equipment, ranging from medical devices to appliances, and from vehicles to industrial tools. Personal electronic devices allow portable video viewing and convenient access to smart digital assistants. Moreover, smartphones, one of the most versatile electronic devices, have become a virtual necessity within reach. As electronic devices become more prevalent and integral to many aspects of modern life, security of the devices becomes essential.

[0002] Many people are familiar with malware, sometimes collectively referred to as "computer viruses." Some malware is designed to gain unauthorized access to information stored on or to compromise electronic devices. Several strategies can help combat certain types of malware and keep users' devices and information safe from security threats. These strategies include adopting and regularly updating resilient operating systems, practicing safe computing, and installing anti-malware programs. Unfortunately, these strategies cannot make electronic devices invulnerable to all malware attacks.

[0003] Furthermore, electronic devices may be vulnerable to other types of attacks besides those performed by software-based malware. For example, the secure and reliable operation of electronic devices and the security of information stored on such devices may be compromised by physical attacks on the hardware and radio frequency attacks on wireless communications. In other words, some forms of attack may circumvent or undermine the strategies listed above, allowing malicious actors to compromise electronic devices and potentially access accounts used on the devices.

[0004] Electronic devices contain at least one integrated circuit (IC) that provides intelligence to enable a variety of functions. These functions may facilitate commerce, streamline access to healthcare, provide entertainment, support social media interactions, and enable other services identified above. Electronic devices may also store or utilize information that must be protected. To support these functions and promote secure operation, some electronic devices include hardware-based protection in the form of security circuitry that is part of the IC. Unfortunately, existing approaches to security circuitry are inadequate to counter the variety of software, hardware, and wireless attacks that are launched against electronic devices today. Summary of the Invention [Problem to be solved by the invention]

[0005] overview Certain electronic devices, such as server computers and smartphones, are responsible for providing services to users. Users rely on these electronic devices to obtain critical services accessed using one or more accounts, such as financial services, air travel, and official government documents. The link between the electronic device and the account may allow a compromised electronic device to allow unwanted access to services linked to the account or unauthorized access to the account itself. Furthermore, to provide services associated with such accounts, these electronic devices may store account-related information that should be protected, such as financial data, usernames, passwords, and secret keys for encryption. Unfortunately, anti-malware programs cannot block all avenues of attack against electronic devices. For example, anti-malware programs may not provide protection against direct physical attacks that use small probes to detect voltage levels on integrated circuit (IC) chips. It is therefore beneficial to incorporate hardware-based countermeasures into electronic devices that can identify, block, repel, or thwart attacks against the electronic device, including countering physical attacks.

[0006] Thus, electronic devices may include security circuits to counter attacks from malicious actors. In some cases, the security circuits detect inappropriate or suspicious activity and take protective measures. Security circuits can be implemented in a variety of ways. For example, computer engineers can fabricate security circuits as standalone IC chips or as part of another chip, such as a system-on-chip (SoC). In either case, the security circuit may be part of a protected enclave, a trusted chip platform, a hardware-based root of trust (RoT) (e.g., silicon RoT), or a combination thereof. Regardless of how and where the security circuit is incorporated into an electronic device, computer engineers can design security circuits to counter many different types of attacks, as described next.

[0007] Attacks against electronic devices may take the form of programs that observe screen images or monitor repetitive actions to infer information, applications that attempt to read data from protected areas of memory, direct physical probing of the circuitry, and so on. Security circuits perform multiple functions to counter one or more of these attacks. For example, a security circuit may protect encryption keys during use, transportation, or storage. To do so, it may use dedicated memory and private data buses. A security circuit may also generate high-quality pseudorandom numbers or operate a cryptographic engine in an area isolated from applications that may behave as malware. Additionally, a security circuit may ensure that the hardware is booted using a correct, unaltered, bootable basic input / output system (BIOS).

[0008] Thus, a security circuit can be responsible for implementing a diverse suite of functions to counter a wide variety of attacks against an electronic device. However, existing approaches to security circuits employ ad-hoc designed hardware architectures. Different circuit parts of a security circuit can also be designed in isolation relative to one another. As a result, circuit parts designed to counter various security threats may not interoperate as intended, making the hardware less secure. Furthermore, poor communication between components creates new attack vectors for malicious actors. Moreover, this ad-hoc approach makes the design and testing phase of the security circuit more difficult, longer, and more costly. This can lead to some security threats being ignored or inappropriately addressed during the development of the security architecture. Thus, these ad-hoc architectures make it even more difficult to protect electronic devices against a wide variety of security threats. [Means for solving the problem]

[0009] However, this document describes an approach that provides an adaptable and flexible framework or platform that can, in some examples, produce resilient programmable security hardware to counter various forms of attacks on electronic devices. In some implementations of security circuits, different types of circuits, or circuit portions providing different security-related functions, communicate using an extended protocol that nevertheless produces reliable and consistent signaling. This communication protocol allows circuits providing different security-related functions to seamlessly interact according to a specified design framework. The design framework and communication protocol produce compatible components, suitable for consistent deployment with stable and predictable interactions, even for circuit components designed separately from one another. As used herein, "compatible components" includes those components that are designed to conform to a common framework such that the components are suitable for use together. In some cases, the compatibility provides a degree of plug-and-play capability between two or more security-related components of an integrated circuit chip.

[0010] The security circuit may include multiple peripheral devices in addition to the processor and interconnects. Each peripheral device of the multiple peripheral devices may perform some function that contributes to the safety or proper functioning of the security circuit. Thus, each peripheral device may provide security-related core or support functionality. This functionality supports the overall purpose of the security circuit, such as controlling access to data or performing cryptographic operations. Such purposes may include providing functionality that enables secure computations by other circuits and / or ICs of the electronic device. For predictability and interoperability, each peripheral device may be realized as a compatible component.

[0011] Computing and other electronic devices are generally subject to attacks, including physical attacks, that can destroy or steal data. A hardware Root of Trust (RoT) scheme can resist many attacks, including physical attacks. The RoT silicon can be realized in an integrated circuit that provides the security functions. In some cases, silicon RoT chips contain read-only memory (ROM) and are subject to physical attacks by malicious actors attempting to read or modify the lines of the ROM. These physical attacks can generally be performed on ROM entries (e.g., ROM instruction lines), or while ROM data is being read and / or executed.

[0012] However, ROMs can be designed or constructed to resist attacks. Additionally, ROM blocks or modules can be implemented as compatible components (e.g., ROM peripheral devices) of a security chip. To protect ROMs in silicon RoT chips or other security circuits, ROMs can be encrypted. This document further describes using cryptography to link ROM addresses to ROM data. For example, a ROM controller can use the corresponding ROM address to generate a key to decrypt ROM data (e.g., a data item stored in a ROM memory, such as some or all of the data stored at a particular ROM address). By cryptographically linking each ROM address to associated ROM data stored in a ROM array, a fault attack on the ROM's (e.g., relatively narrow) address bus cannot be used to easily redirect reads to other ROM entries. These reads of the ROM array can involve executing code, obtaining data, or performing integrity checks on the ROM entries. This cryptographic linking to the ROM contents and the ROM addresses that access the contents (e.g., the addresses in the ROM memory where the addresses of the corresponding ROM data are stored) allows the ROM to be protected even if the decryption key is known to an adversary.

[0013] To protect ROMs in a silicon Root of Trust environment from unknowing modification, ROM data can be associated with an expected digest (or "digest value") that is derived using a hashing algorithm and stored in the ROM. During boot-up, the ROM can check whether the stored expected digest value matches another digest value calculated simultaneously on the current ROM data. A potential vulnerability of this protection approach is that an attacker could attempt to conceal a fault attack on the address bus by temporarily redirecting the ROM integrity checker to another ROM entry that has the same data bits set.

[0014] First, to protect the integrity of the ROM with the ROM controller and the ROM array, the ROM data stored in the ROM array can be encrypted. As described above, the ROM data can also be encrypted in a manner that ties the respective ROM addresses to the respective ROM data. Additionally, the ROM controller can adjust the addresses (e.g., scramble them, such as by using a substitution and / or permutation algorithm based on a key or cipher) to generate the adjusted addresses used to access the ROM array. This address adjustment can further reduce the risk of a modified ROM going undetected if an attacker attempts to redirect the address bus during a ROM integrity check.

[0015] To at least further reduce the risk of redirection-based attacks, this document describes selecting an encryption algorithm and / or encryption key to reduce the amount of duplicate instances of ROM data stored in the ROM array. By repeatedly changing the encryption algorithm and / or encryption key and checking the resulting ROM entries, duplicate ROM entries may be avoided or eliminated entirely. This may at least limit or eliminate the potential effectiveness of redirection attacks targeting alternate ROM entries during operation of the ROM integrity checker. Thus, the ROM array may store ROM entries that are unique from one another, and the ROM controller may securely apply a hash algorithm to calculate a digest value that accurately reflects the current contents of the ROM.

[0016] Apparatus and techniques for ROM security are described with reference to the following drawings, in which like numbers are used to reference like features and components throughout. [Brief description of the drawings]

[0017] [Figure 1] 1 illustrates an exemplary device with an integrated circuit (IC) that includes security circuitry capable of implementing ROM security. [Diagram 2] 1 illustrates an exemplary security circuit that includes multiple circuit components, including multiple exemplary peripheral devices that may be interchangeably implemented, such as ROM blocks. [Figure 3-1] 1 illustrates an exemplary peripheral device that includes at least one interface to support compatibility with other circuit components. [Figure 3-2] An example approach is presented that analyzes the design of peripheral devices to ensure that compatibility objectives are met. [Figure 3-3] 1 illustrates an example peripheral device including an example register interface and communication signals. [Figure 4]FIG. 2 illustrates an exemplary ROM including a ROM controller and a ROM array with respect to accessing encrypted ROM data in the ROM array. [Diagram 5] 1 illustrates an exemplary ROM including a ROM controller and a ROM array in the context of checking the integrity of encrypted ROM data in the ROM array. [Figure 6] 1 illustrates an example of a ROM that may be implemented as a ROM peripheral device of a security circuit with encrypted ROM data. [Figure 7] 7 illustrates an exemplary timing diagram including various signals for accessing the ROM array of the ROM of FIG. 6. [Figure 8] An example of a methodology that may be followed to implement a resilient ROM integrity checking procedure is given below. [Figure 9] This shows an example of how a device can check the integrity of a ROM upon power-up, reset, etc. [Figure 10] 1 illustrates an exemplary method for following a resilient ROM integrity checking procedure. [Figure 11] 1 illustrates an exemplary method for an apparatus implementing ROM encryption, such as for accessing encrypted ROM data through decryption. [Figure 12] 4 is a flow diagram illustrating an exemplary process for accessing a ROM array containing encrypted ROM data. [Figure 13] 4 is a flow diagram illustrating an exemplary process for checking the integrity of a ROM array containing encrypted ROM data. [Figure 14] 1 illustrates various components of an example electronic device that can implement ROM security in accordance with one or more described aspects. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] Detailed Description overview Electronic devices make important contributions to modern society such as communication, security, and manufacturing. Each electronic device relies on integrated circuits (ICs) with processing power to provide some functionality. Many of these functions are critical in nature, so electronic devices may include ICs with security circuits that provide protection. Security circuits mitigate the possibility that information is inadvertently disclosed or some functionality is used in a harmful or unauthorized way. Security circuits can be realized in various forms, one of which includes the Root of Trust (RoT) paradigm.

[0019] With Silicon RoT, hardware-based mechanisms ensure that computations are secure in terms of preventing inappropriate access to information, preventing unauthorized use of the device, and so on. Silicon RoT principles can help ensure that both the hardware infrastructure and the software running on it are maintained in their intended, trusted state. To that end, Silicon RoT can ensure that critical system components boot securely, using approved, verifiable code. Thus, it can ensure that a server or another electronic device boots with the correct firmware, and that the firmware has not been infected with low-level malware. Silicon RoT can provide additional or alternative security benefits. For example, it can provide a cryptographically unique machine ID. This unique ID allows an operator to verify that an electronic device is genuine. In addition, cryptographic keys and other information can be maintained in tamper-resistant silos, so that even those with physical access to the device cannot obtain the information, or are at least deterred. Hardware-anchored RoT services can also provide trusted, tamper-proof audit trails and other runtime security services.

[0020] Chip designers can incorporate silicon RoT technology into individual IC chips focused on providing security features. Alternatively, the RoT silicon can be integrated with other circuits, including central processing unit (CPU) chips or packages, graphics processing unit (GPU) chips or cards, systems-on-chips (SoCs), and memory storage devices. In general, security circuits can operate in server motherboards, network cards, client devices (e.g., laptops and smartphones), consumer routers, Internet of Things (IoT) devices, and fixed and portable storage devices, to name just a few. Fixing the RoT in silicon enhances the security of computation across the hardware, firmware, and software levels, regardless of the application or electronic device. Silicon RoT also enhances security between various devices that communicate with each other, either directly or over a network. While this document uses silicon or hardware RoT environments to illustrate some of the principles of security and circuit design, this is done merely as an example, as the principles discussed are applicable to security circuits in general.

[0021] Today's computing environment allows malicious actors to attack electronic devices on a myriad of levels using numerous attack vectors. For example, attacks may be conducted using malware transmitted over the Internet to attempt to obtain information stored on a laptop that a user wishes to protect. Attacks may also involve the insertion of malware into firmware used to power electronic devices, such as Wi-Fi routers and IoT devices, while the electronic device is in transit or operating in a secluded location. As another example, a malicious actor may steal an electronic device and have enough time to perform a direct physical attack on the device. Such direct physical attacks may include cutting wires, probing voltages, inserting faults with lasers, repeatedly running code to observe trends or infer information, etc.

[0022] Thus, a security circuit can be responsible for implementing a diverse suite of functions to counter a wide variety of attacks against an electronic device. However, existing approaches to security circuits employ ad-hoc designed hardware architectures. Different circuit parts of a security circuit can also be designed in isolation relative to one another. As a result, circuit parts designed to counter various security threats may not interoperate as intended, making the hardware less secure. Furthermore, poor communication between components creates new attack vectors for malicious actors. Moreover, this ad-hoc approach makes the design and testing phase of the security circuit more difficult, longer, and more costly. This may result in some security threats being ignored or inappropriately addressed during the development of the security architecture. Thus, these ad-hoc architectures make it even more difficult to protect electronic devices against a wide variety of security threats.

[0023] However, this document describes an approach that provides an adaptable and flexible framework or platform that can produce resilient programmable security hardware to counter various forms of attacks on electronic devices. In some implementations of security circuits, different types of circuits, or circuit portions that provide different security-related functions, communicate using an extensible protocol that nevertheless produces reliable and consistent signaling. This communication protocol allows circuits providing different security-related functions to seamlessly interact according to a specified design framework.

[0024] The design framework and communication protocols produce "compatible" components suitable for consistent deployment with stable and predictable interactions, even for circuit components designed separately from one another. For example, communication and other forms of interaction (e.g., sharing of resources such as buses, interfaces, or memory) can be at least partially standardized to provide a measure of predictability and interoperability. As used herein, "compatible components" includes components designed to conform to a common framework such that the components are suitable for use together. In some cases, compatibility provides a degree of plug-and-play capability between two or more security-related components of an integrated circuit chip.

[0025] In some implementations, the security circuit includes multiple peripheral devices in addition to a "centralized" processor and interconnects. Each of the multiple peripheral devices performs some function that contributes to the safety or proper functioning of the security circuit. Thus, each peripheral device can provide a core security-related function or a supporting security-related function that supports the overall purpose of the security circuit, which may include providing functionality to enable secure computations by other circuits and / or ICs of the electronic device, such as controlling access to data or performing cryptographic operations. For predictability and interoperability, each peripheral device may be realized as a compatible component.

[0026] One example of a circuit component that can be implemented as a compatible component and / or as a peripheral device is a ROM block or module. The ROM block includes a ROM array and a ROM controller. The ROM array can include boot-level instructions used to initialize the electronic device from a reboot or power-on scenario. To protect the ROM block, the data in the ROM array can be encrypted and the ROM controller can provide gated access to the ROM.

[0027] Additionally, the ROM block may use encryption to link ROM addresses with associated ROM data. In particular, the ROM block may link ROM addresses with associated ROM data by using the ROM addresses as parameters in an algorithm for encrypting the ROM data. For example, a masked ROM (e.g., a ROM having a grid of word lines and bit lines, where the word lines typically provide address inputs and the ROM memory outputs data on the bit lines) may be scrambled using a cipher such as the PRINCE cipher. Each ROM address may be used to scramble each associated ROM data in one of several ways to link the address and data. For example, each address may be used to decrypt each ROM data. In some implementations, the descrambled ROM addresses are used to generate at least one key, such as a keystream value, which is applied to a version of the corresponding ROM data to generate the decrypted ROM data. A block cipher such as PRINCE may be used, for example, in a "counter (CTR) mode." Each ROM datum, such as a ROM entry or a ROM line, includes bits corresponding to the ROM (e.g., ROM bits that encode user data or program instructions that define a process to be performed by the security circuitry, e.g., ROM bits that define an algorithm) and bits corresponding to an error correcting code (ECC) value for the ROM bits of that data.

[0028] This "encryption" of the ROM can therefore be used to link ROM addresses and ROM data, for example, by using the respective ROM addresses as part of the decryption procedure for the respective ROM data. This address-based encryption approach ensures that fault attacks on the address bus cannot easily be used to redirect reads of the ROM array. By cryptographically linking the ROM address and data, attacks that redirect normal ROM accesses (for example, allowing an attacker to skip fetched instructions in boot code by turning them into no operations (NOPs)) can be thwarted. This protects operations by "external circuitry" (e.g., the main processor) that require the ROM data.

[0029] Scrambling the ROM also makes it more difficult for an attacker to modify the stored ROM code to fake the device. For example, assume that an attacker wants to make a one-bit change to the original unencrypted ROM data. This one-bit change allows the attacker to change the instructions while avoiding the problem that would normally cause the integrity check to fail. On the other hand, in the case of encrypted (e.g., scrambled) ROM data, if an attacker were to modify the scrambled data, such a change to the encrypted ROM data may take the expected 19 bits (e.g., about half of a 39-bit word). Thus, scrambling the mask ROM provides resilience against edits to the mask ROM and makes fault injection attacks at ROM macro boundaries more difficult.

[0030] In an example implementation, the ROM data of the security circuit's ROM block is encrypted. The encryption is used to tie together a ROM address and the associated ROM data. The ROM address and / or the associated ROM data can be scrambled. In some cases, the ROM address is used to unscramble the ROM data. The ROM data can be jointly scrambled using a corresponding security value (e.g., ECC bits). In such cases, a per-ROM line security value can be used and stored together as the ROM line. To unscramble the ROM data using the ROM address, the ROM address is used to generate a key that unscrambles the associated ROM data. The unscrambled ROM address can also be translated into a tailored or scrambled ROM address to read an entry in the ROM to further complicate and frustrate an attacker's efforts to modify the ROM and cause the device to boot with the modified ROM.

[0031] In another implementation, the ROM block includes a ROM array and a ROM controller with a ROM checker circuit to verify the integrity of the ROM data. An attacker may make changes to the ROM array (e.g., a masked ROM) and then attempt to conceal such changes by disrupting or controlling communication between the ROM checker and the ROM array at power-up. For example, an attacker may manipulate the data bus between the ROM checker circuit and the ROM array to conceal changes to the ROM data. Similarly, an attacker may attempt to control the lower bits of the address bus, thereby subverting ROM checking by redirecting ROM accesses to skip over modified words and point to unmodified copies.

[0032] These potential attacks can be at least partially thwarted by scrambling the ROM with a fixed key and performing a hash on the scrambled data for integrity checking. Attacks on the data bus are therefore made more difficult by the spreading nature of the scrambling scheme. For example, to make a single-bit change to the unscrambled data, an attacker would need to change many bits in the ROM array and then control those same bits on the data bus to hide the change. Also, attacks on the address bus can be defeated by the way the scramble incorporates addresses into the data scrambling scheme.

[0033] In an additional implementation, the ROM data is encrypted and the ROM integrity checker operates on the encrypted ROM data. The ROM integrity checker circuit can verify that the ROM data has not been altered at each power-up or reset. The ROM integrity checker circuit can operate on a line-by-line basis. For example, the integrity checker circuit can apply a hash algorithm to each line of the ROM while the ROM data is still encrypted to calculate a digest value. As described below, after the encrypted ROM data is fed to a circuit that performs a hash algorithm, an expected digest value that can be obtained from the ROM can be compared to the calculated digest value. The integrity checker circuit generates an alarm if the digest values ​​do not match.

[0034] A ROM block or module may include a ROM array and a ROM controller. In general, the contents of a ROM array, such as a masked ROM, may be scrambled as part of a suite of security strategies. At power-up, the ROM controller reads from the ROM array and sends the extracted scrambled content to at least one digest check module, such as a digest calculation circuit capable of applying a hash algorithm. The digest calculation circuit calculates a digest of the content using a hash algorithm, such as Secure Hash Algorithm 3 (SHA-3). The digest may also be calculated using a customizable, any message-length version of SHA3, such as cSHAKE, which allows the circuit to prefix the ROM data with a ROM checker-specific function string to make the hash function unique for a particular application. The ROM data lines may not be aligned with the block size of the digest calculation circuit, in which case the lines may be padded (e.g., with zeros) to the block length. The ROM controller may compare the digest obtained from the digest calculation circuit to an expected digest to control access to the ROM array. The ROM array may store the expected digest at one or more ROM address locations. The ROM controller may also provide the calculated digest value to circuitry external to the ROM, such as a host processor. The ROM controller may, for example, expose the calculated digest value via an interface register in the ROM that other components can access, allowing one or more other components to verify that the ROM data has not been tampered with.

[0035] In an example implementation, a fixed scrambling key can be chosen to ensure that at least most, and possibly all, ROM lines are separate or distinct from each other. This means that a fault attack on the address bus cannot hide the change by temporarily redirecting the ROM controller that communicates with the digest calculation circuitry to a different line that stores the same ROM instructions.

[0036] Furthermore, hashing the scrambled data is more fault-tolerant than hashing the unscrambled data. An attacker attempting to make a small change to the unscrambled ROM data would have to make a relatively large change to the scrambled ROM data. Because the hash is calculated over the scrambled data, an attacker would have to cause a fault or control many bits to hide their changes. Thus, the encryption of the ROM data, combined with the selection of the encryption key, greatly reduces the likelihood of a successful attack on the ROM data itself and the address bus.

[0037] In other implementations, in connection with generating at least one digest for multiple lines of the ROM, the process may require selecting an encryption algorithm and / or encryption key that reduces duplicate lines of instructions stored in the ROM. Additionally, an encryption algorithm and / or encryption key may be selected that eliminates duplicate stored lines of instructions. Thus, the scrambling algorithm and / or scrambling key may be selected based on the content of the ROM data to at least increase, if not maximize, the variability of the resulting encrypted bits stored in the ROM array. This variability (e.g., uniqueness) may make it difficult, if not impossible, for an attacker to redirect an integrity checker from one ROM entry that is supposed to be checked against another ROM entry having the same word, since few, if any, entries have the same stored ROM value. Using these techniques, a hash algorithm may be applied to the scrambled data of the ROM. In other words, at least one digest of the stored ROM data may be calculated using the scrambled lines instead of the unscrambled lines of the ROM data to increase the variability of the values ​​on which the hash algorithm operates.

[0038] In these ways, security circuits can be incorporated into silicon RoT chips and / or SoCs. Such security circuits include multiple peripheral devices, including ROM blocks. Although some aspects of ROM security are described in the context of a security circuit environment and / or compatible design, the disclosed ROM security concepts are applicable to other circuit environments and other design paradigms.

[0039] This document first describes an example security environment with reference to Figures 1 and 2. Next, an example peripheral device interface and design code analysis is described with reference to Figures 3-1 through 3-3. Next, this document describes ROM security aspects and implementations with reference to Figures 4 through 13. An example electronic device is described with reference to Figure 14. Each of the environments, aspects, and implementations described herein may be used individually or in any combination.

[0040] Accordingly, example implementations at various levels of detail are described below with reference to associated figures. In the following description, an example operating environment is first presented, followed by a description of example hardware, methods, and techniques. Exemplary methods are then described with reference to flow charts or diagrams. Finally, example computing devices are described.

[0041] ROM Security Operating Environment Example 1 illustrates, generally at 100, an exemplary device 102 having an integrated circuit 104 (IC 104) that includes a security circuit 106. The device 102, the integrated circuit 104, and / or the security circuit 106 may implement ROM security as described herein. In this example, the device 102 is shown as a smartphone. However, the device 102 may be implemented as any suitable computing or electronic device.

[0042] Examples of devices 102 include mobile electronic devices or mobile devices, mobile communication devices, modems, cellular or mobile telephones, mobile stations, gaming devices, navigation devices, media or entertainment devices (e.g., media streamers or game controllers), laptop computers, desktop computers, tablet computers, smart appliances, vehicle-based electronic systems, wearable computing devices (e.g., clothing, watches, or reality altering glasses), Internet of Things (IoT) devices, sensors, inventory control devices, electronic portions of machines or electronic components of equipment (e.g., vehicles or robots), memory storage devices (e.g., solid state drives (SSDs)), server computers or portions thereof (e.g., server blades or racks, or other portions of a data center), etc. Illustrated examples of devices 102 include tablet devices 102-1, smart televisions 102-2, desktop computers 102-3, server computers 102-4, smart watches 102-5, smartphones (or document readers) 102-6, and intelligent glasses 102-7.

[0043] In an example implementation, the device 102 includes at least one integrated circuit 104. The integrated circuit 104 may be mounted on a module, a card, or a printed circuit board (PCB) (not shown). Examples of PCBs include flexible PCBs, rigid PCBs, single or multi-layer PCBs, surface mount or through-hole PCBs, combinations thereof, and the like. Each integrated circuit 104 may be realized as a general-purpose processor, a system-on-chip (SoC), a security-oriented IC (e.g., a RoT IC chip), a memory chip, a communication IC (e.g., a modem or radio frequency IC), a graphics processor, an artificial intelligence (AI) accelerator, combinations thereof, and the like. The integrated circuit 104 may be packaged alone or together with other IC chips.

[0044] As shown, the integrated circuit 104 includes a security circuit 106. The security circuit 106 can include various components including multiple circuit components 108-1...108-C (where C represents a positive integer) and an interconnect 110. Examples of the circuit components 108 include a processor and multiple peripheral devices, in addition to the interconnect 110. These are shown in FIG. 2 and described below. Although not explicitly shown in FIG. 1, the integrated circuit 104 may include other parts other than the security circuit 106. The multiple circuit components 108-1...108-C and the interconnect 110 may be monolithically integrated on a single IC as shown, but alternatively, the components may be distributed across two or more ICs. The security circuit 106 can be realized, for example, as a protected enclave, a trusted chip platform, a hardware-based root of trust (RoT) chip (e.g., a silicon RoT), etc. Regardless of how or where the security circuit 106 is incorporated into the electronic device, the security circuit 106 can resist many different types of attacks.

[0045] In an example operation, an alert 112 or interrupt 114 is generated by some component when an attack, or potential attack, or abnormal occurrence is detected. For example, a circuit component 108 can generate an alert 112 and send the alert 112 to an alert handler, described below. Additionally or alternatively, another circuit component 108 can generate an interrupt 114 for processing by a processor. The alerts 112, interrupts 114, and other signals are communicated between two or more components 108 according to a common framework for interaction between the processors of the security circuit 106 and / or peripheral devices. In the common framework, the interface and signaling of each peripheral device can be specified to promote interoperability and use of consistent communication protocols across multiple peripheral devices. Thus, although some aspects of compatibility are illustrated with respect to security circuits, the compatibility of peripheral devices can be employed for other types of circuits as well. An exemplary framework, as well as exemplary communication interfaces and interface specifications, are described below with reference to Figures 3-1 through 3-3.

[0046] In some implementations, the circuit component 108 is realized as a ROM 118 or a ROM block 118. The ROM 118 can be incorporated into the security circuit 106 as a peripheral device, a compatible component, a combination thereof, or the like. For example, the security circuit 106 can access the ROM 118 as part of a reboot to initialize the security circuit 106 or the IC 104. The ROM 118 can be accessed for other purposes other than or in place of the power-up operation. This ROM access 116 can be gated by the ROM 118 as part of a security paradigm described herein in connection with ROM data integrity checking. The ROM access 116 can also be secured by tying the ROM data to a ROM address used to access the ROM data of the ROM 118. These and other aspects of ROM security are described below with reference to Figures 4 through 13. However, with reference to Figure 2, an example architecture of the security circuit 106 will now be described.

[0047] 2 illustrates an exemplary security circuit 106 including a number of circuit components, including a number of exemplary peripheral devices 250 that may be interchangeably implemented. As illustrated, the security circuit 106 includes a processor 202 coupled to an interconnect 110. The interconnect 110 may be realized using, for example, a bus, a switching fabric, or a bus network that enables communication of the various circuit components. The circuit components 108-1...108-C (of FIG. 1) may include a number of memories and a number of peripheral devices in addition to the interconnect 110 and / or the processor 202. Each of the processor 202, the number of memories, and the number of other peripheral devices 250 are directly or indirectly coupled to the interconnect 110. As described herein, the ROM 118 (e.g., of FIG. 1 and FIG. 4 onward) may correspond to the ROM 206 of FIG. 2.

[0048] In an implementation, the memories may include a read only memory 206 (ROM 206), a static random access memory 208 (SRAM 208), and a flash memory 210. The peripheral devices 250 may include an alert handler 204, an advanced encryption standard (AES) engine 212 (AES engine 212), a hash-based message authentication code (HMAC) engine 214 (HMAC engine 214), a serial peripheral interface (SPI) device 230 (SPI device 230), and a flash controller 216. The peripheral devices 250 may also include a universal asynchronous receiver / transmitter (UART) device 218 (UART device 218), a general purpose input / output (GPIO) interface 220 (GPIO interface 220), a pin multiplexer 222 (pin multiplexer 222), and a pad controller 224. The peripheral devices 250 may further include a random number generator 232 (RNG 232) and a timer 234. Additionally, the peripheral devices 250 may include any memory, as shown in Figure 2. Although particular examples of memory and other peripheral devices 250 are shown in Figure 2 or described herein, a particular implementation of the security circuit 106 may include more, fewer, and / or different instances of processors, controllers, memory, modules, or peripheral devices (including duplicates thereof).

[0049] The illustrated circuit components may operate synchronously based on one or more clock signals. Although not shown in FIG. 2, the security circuit 106 may include at least one clock generator for generating clock signals or may include a reset circuit for resetting one or more individual components independently of one another, multiple components together, or the entire IC chip. Alternatively, the security circuit 106 may receive at least one clock or reset signal from a source external to the security circuit 106, which may or may not be on a separate chip. One or more separate peripheral devices 250 may operate in their own separate clock domains. For example, input / output (I / O) peripheral devices may be synchronized to a clock local to the respective I / O device or channel. Peripheral devices in different clock domains may operate or communicate asynchronously with one another.

[0050] An example implementation of the illustrated components is described below. The processor 202 may be realized as the "main", "central" or "core" processor of the security circuit 106. The processor 202 may be implemented with a 32-bit in-order reduced instruction set computing (RISC) core with a multi-stage pipeline, by way of example only. For example, using the RISC-V instruction set, the processor may implement an M (machine) mode and a U (user) mode. Activating a reset pin (not shown) (e.g., through deassertion of an active low reset pin) causes the processor 202 to exit reset and begin executing code at its reset vector. The reset vector may begin in the ROM 206 and checks for code in the embedded flash (e-flash) before jumping to the embedded flash (e-flash). In other words, the code is expected to have been instantiated in the e-flash before reset is released. In some cases, the reset of the entire security circuit 106 may be an asynchronous active low according to a compatibility specification to support interoperability between various circuit components. A reset may be generated by the alert handler 204 as a security measure, by a watchdog timer, etc. The reset signal may also be sent to other circuit components, such as one of the memories or one of the other peripheral devices 250.

[0051] Coupled to the processor 202 are a debug module 226 (DM 226) and an interrupt controller 228 (ItC 228), either of which may be interchangeable. The debug module 226 provides debug access to the processor 202. By interfacing with specific pins of the IC, logic in the debug module 226 allows the processor 202 to enter a debug mode and provides the ability to inject code into a device (e.g., by emulating instructions) or memory. The interrupt controller 228 may be located close to the processor 202. The interrupt controller 228 may accept a vector of interrupt sources from within the security circuit 106. The interrupt controller 228 may also assign priority and priority to interrupts before forwarding them to the processor 202 for processing.

[0052] The processor 202 may provide any desired level of performance or may include any internal circuit components. For example, the processor 202 may include at least one arithmetic logic unit (ALU) (including, for example, an "extra" ALU to calculate branch targets to eliminate cycles of latency in taken conditional branches) and multiple pipeline stages. With multiple pipeline stages, the pipeline may perform register write-back to reduce cycles of latency due to loads and stores and prevent pipeline stalls where the response to a load or store is available a cycle after the request. The processor 202 may implement a single-cycle multiplier or generate an imprecise exception in error response to a store, which allows the processor to continue execution past the store without waiting for a response. Although not shown, the processor 202 in particular, or the security circuitry 106 in general, may include an instruction cache that provides single-cycle access times for instructions.

[0053] In the illustrated example, the security circuit 106 includes three memory address spaces for instructions and data. The ROM 206 is the target of the processor 202 after release from reset. The ROM 206 includes hard-coded instructions to perform a subset of platform checks before checking the next stage of code. The next stage of code (e.g., a boot loader stored in e-flash memory) may be the first piece of code that is not hard-coded into the silicon of the device. This next stage of code is therefore signature checked for integrity to enhance security. The ROM 206 may perform this signature check by implementing one of a number of algorithms, such as the Rivest-Shamir-Adleman (RSA) check algorithm or the Elliptic Curve Digital Signature Algorithm (ECDSA), on the complete contents of the boot loader.

[0054] The flash memory 210 can be implemented as an embedded flash (e-flash) memory for code storage. The e-flash can contain the boot loader described above as well as the operating system and above layer applications. The SPI device 230 can be used to bulk load the e-flash memory. The debug module 226 can also be used to load code. The SRAM 208 can operate as a scratchpad SRAM available for data storage by the processor 202 (e.g., stack and heap information). The SRAM 208 can also store code.

[0055] The security circuitry 106 may include a suite of "peripherals" or "peripheral devices." These peripheral devices 250 may be subordinate execution units coupled to the processor 202 via the interconnect 110. Each of these peripheral devices 250 may adhere to an interface framework that ensures compatibility with each other and with the processor 202. The compatibility scheme may specify how the processor 202 communicates with a particular peripheral device (e.g., using the interconnect 110), how the peripheral device communicates with chip I / O (e.g., via fixed or multiplexable I / O), how the peripheral device communicates with the processor 202 (e.g., using interrupts), how the peripheral device communicates security events (e.g., using alert indications) to other circuit components such as the alert handler 204, how the peripheral device communicates with other peripheral devices (e.g., synchronously or asynchronously, via at least one register), or combinations thereof. The illustrated peripheral devices 250 may include peripheral devices associated with alert-related functions provided by the alert handler 204, associated with the processor 202, associated with one or more memories, associated with the chip I / O, etc. Thus, memories may also comprise peripheral devices 250 associated with each other or with other illustrated circuit components.

[0056] The circuit or chip I / O peripheral devices include a pin multiplexer 222 and a pad controller 224. The pin multiplexer 222 provides signaling routes between at least some of the peripheral devices 250 and available multiplexable I / O nodes of the security circuit 106 (e.g., pins of the chip on which various components are integrated, or interfaces to other parts of the SoC). The pad controller 224 manages control or pad attributes such as drive strength, technology, pull-up vs. pull-down, etc. of the external I / O of each circuit (e.g., chip). The pin multiplexer 222 and the pad controller 224 are themselves peripheral devices on the interconnect 110. As such, each may have or be associated with at least one collection of registers that provide software configurability.

[0057] The UART device 218 can implement UART functions such as single lane dual UART functions. Its outputs and inputs can be configured to connect to any circuit I / O via pin multiplexer 222. The GPIO interface 220 creates G-bit bidirectional communication to external circuits via pin multiplexer 222, where G is a positive integer such as 16, 32, or 64. With respect to memory I / O, the SPI device 230 can implement a firmware mode. Here, the firmware mode can enable a function that provides the ability for an external driver to send firmware upgrade code to a bank of the flash memory 210 for in-field firmware updates. The firmware mode can include addressing of the memory using SPI transactions. Although not shown, the security circuit 106 can include an inter-integrated circuit (I2C) host to allow command of I2C devices. The command of I2C devices can include standard mode, full mode, and high-speed mode.

[0058] Also shown are several "core security" peripheral devices, including a cryptographic engine and alert handler 204. The AES engine 212 can provide symmetric encryption and decryption using one or more protocols and various key sizes, such as 128b, 192b, or 256b. This component can select to encrypt or decrypt data arriving in 16-byte increments, for example, and can encrypt or decrypt using different block cipher modes of operation. The AES engine 212 can support Electronic Codebook (ECB) mode, Cipher Block Chaining (CBC) mode, Cipher Feedback (CFB) mode, Output Feedback (OFB) mode, Counter (CTR) mode, etc. Data transfers can be made available to the processor. For example, the key and data material can be passed to the cryptographic engine via register writes. Alternatively, a private channel for transferring the key and data material can be included to mitigate exposure to potentially untrusted processor activity.

[0059] The HMAC engine 214 may utilize, for example, the Secure Hash Algorithm (SHA) SHA-256 as the hash algorithm. SHA-256 is a member of the SHA-2 family of hash algorithms, and the digest (or hash output) is 256b in length, regardless of the data size of the input being hashed. Data is sent to the HMAC peripheral device after announcing the start of a hash request. This zeroes the internal state to an initial state (e.g., 32b at a time). Once the data has been sent by the constituent client, the client may indicate completion of the hash request (with any partial word final write). According to an example of a portable interface scheme, the HMAC engine 214 generates a hash result and makes it available for register read by the requesting client. The data transfer may be made available to the processor or may be private to reduce exposure to potentially untrusted processor activity.

[0060] HMAC is a message authentication protocol layered on top of a hash function (e.g., SHA-256), where HMAC mixes in a secret key for encryption purposes. HMAC is a specific application of appending a secret key around a hash of a message (via SHA-256) in a predetermined manner (e.g., twice). To provide this functionality, the 256b key can be programmed into circuitry before the message hashing begins. The timing of authentication completion can vary and may involve longer latency than using native SHA-256. Again, the hash information or secret key can be made available to the processor for convenience or processing efficiency, or can be kept private in some way to increase security.

[0061] The alert handler 204 is responsible for processing and responding to alerts, including alerts provided by other peripheral devices 250. Alerts can be thought of as security-sensitive interrupts that are processed in a timely manner to address a perceived security threat. Unlike "standard" interrupts, alerts are not handled solely by software running on the processor 202. An alert can trigger a first stage request that is handled by the software as a "normal" interrupt. However, if the software is unable to respond to the interrupt triggered by an alert and repair it appropriately, the alert handler 204 triggers a second stage response. A second stage response may include taking security measures such as terminating a process, erasing or otherwise deleting data, draining power from a circuit portion, or resetting an IC chip or part thereof. This ensures that the underlying problem, i.e., the perceived security threat, is addressed whether the processor 202 is busy, jammed, or under attack.

[0062] Thus, the alerts 112 (e.g., FIG. 1) may be implemented as high-level interrupt-type signals or alert indications that the alert handler 204 receives from other peripheral devices and that indicate a potential security threat. In operation, the alert handler 204 may collect alerts from other circuit components 108 of the security circuit 106 and convert them into interrupts that the processor 202 can address. However, if the processor 202 does not clear the interrupt, the alert handler 204 provides a hardware response to address the potential security threat.

[0063] In some inter-device communications, the alert handler 204 receives synchronous or asynchronous alert indications signaled in differential signals from peripheral device sources. The peripheral device 250 can generate alerts based on the capabilities, knowledge, or sensed parameters of the peripheral device 250. For other inter-device communications, the alert handler 204 performs ping tests of the alert sources as a robust heartbeat mechanism. The ping monitor (not explicitly shown) of the alert handler 204 requests periodic alert responses from each alert source to ensure that the communication channel with the alert source is functional.

[0064] The alert handler 204 may also generate locally sourced hardware alerts based on communication failures. A first locally sourced alert is generated if differential signaling or another predefined communication protocol with the alert source or escalation handler fails (e.g., if a signal integrity check fails). The alert handler 204 generates such a second alert if the alert source or escalation handler fails to respond to a ping request. In general, the alert handler 204 may receive incoming alerts from throughout the system, classify the alerts, issue interrupts based on the classified alerts, and escalate the interrupts to a hardware-based response if the processor 202 does not clear the issued interrupt. Thus, if the processor cannot or will not process a security alert, the alert handler 204 may act as a stand-in for a security response, for example.

[0065] In some architectures, security alerts are intended to be rare events, at least compared to "standard" interrupts. Thus, at the design stage, a possible event may be designated as an alert event if it has a potential impact on security to the extent that the event is not expected to occur frequently. Examples of such events include parity errors (which may indicate an attack), unauthorized actions on cryptographic or security-related components, sensed values ​​from physical sensors indicating changes in the environment (such as voltage or temperature), etc. The system routes the alerts through the alert handler 204, which converts the alerts into interrupts for the processor 202 to potentially address. In some implementations, there is an underlying expectation that a secure operating system will have a protocol for handling such interrupts caused by alerts in software. If so, the secure operating system will typically resolve the interrupt and then may clear the interrupt using the alert handler 204. Each peripheral device 250 may present a list of individual alerts, each representing a potential threat to be addressed. The peripheral device may send the alerts to the alert handler 204 as alert indications using a specific encoding mechanism.

[0066] The security circuitry 106 may also include a RNG 232. In general, randomness may contribute to security functions by providing variation in execution so that an attacker cannot predict the right time to launch an attack. For example, random numbers may provide secret material used for identification or encryption purposes. The RNG 232 may be used to seed algorithmic calculations to obscure secret data values. In general, the RNG 232 provides better performance to the extent that its number generation becomes increasingly truly random and can also be hardened against attacks. The RNG 232 may be implemented as a "true" RNG (TRNG), which may include designs with analog portions to utilize some physical event or process that is non-deterministic. Examples of TRNG designs rely on metastability, electronic noise, timing variations, thermal noise, quantum variations, etc. The TRNG filters the resulting variables and then sends them to a pool of entropy that the device can sample at specific times for the current randomization function. In some cases, the interface to the entropy pool may include a read request for available random bits. The TRNG interface indicates the number of bits available, and a requesting peripheral device or software may read from this pool up to the range of bits available. An interrupt or alert may be triggered if an attempt is made to read an entropy bit that is not available.

[0067] Two other peripheral devices 250 include a timer 234 and a flash controller 216, the latter of which is described in the next paragraph. The timer 234 can, for example, support accurate performance by the processor 202. The timer 234 is formed of multiple bits (e.g., 64 bits) and operates as a free-running timer with a frequency guaranteed within a certain percentage. Another timer (not explicitly shown) can function as a watchdog timer that backstops the processor 202 if the processor becomes unresponsive. The unresponsiveness can be due to development code interference, security attacks, etc.

[0068] The flash controller 216 controls the flash memory 210 available for storing code and data. The main primary read path for this data may be in a standard memory address space. However, because flash is not written in a standard way, writes to that address space can be ignored. Instead, to write to the flash memory 210, software interacts with the flash controller 216. Flash functions may include three primary commands: read, erase, and program. Read commands may be standardized and may use the address space of the chip memory. Erase commands are performed at the page level, with the page size parameterizable by the flash controller 216. Upon receiving an erase request, the flash controller 216 wipes the contents of the target page, forcing the data to a "1" state (e.g., 0xFFFFFFFF per word). Software can then program individual words to any value. Because flash bits cannot return to a "1" state without being erased again, future contents are effectively changed by the AND of the current contents and the written value. Erase and program commands are relatively slow. Typical erase times are measured in milliseconds, while program times are in the microsecond range. Security is also a concern since sensitive data may be stored in flash memory 210. Therefore, a degree of memory protection may be provided by the flash controller 216.

[0069] The security circuit 106 is shown in FIG. 2 with a particular set of circuit components. However, a particular security circuit 106 may have more, fewer, or different circuit components. The circuit components may also be interconnected in different ways or operate in other ways than the exemplary manner described above. Furthermore, some circuit components may be omitted while other circuit components may be implemented in multiple instances. For example, the alert handler 204 may be duplicated or distributed, or multiple AES encryption engines 212 may be present in some security circuits 106. Furthermore, for IC chips in which the security circuit 106 forms only one of several dozen cores, the GPIO interface 220 may be omitted from among the peripheral devices 250 of the security circuit 106.

[0070] Methods, techniques and hardware examples of a compatible paradigm for secure ROM peripheral devices The security circuit 106 (e.g., of FIGS. 1 and 2) can include compatible circuit components, including peripheral devices 250, such as ROM 206 or 118. This section describes example approaches for making peripheral devices compatible. Each peripheral device 250 can conform to a compatibility specification of the security circuit 106. By conforming to a compatibility specification that defines at least one interface method or communication protocol, the peripheral device 250 is realized with at least one interface that creates consistent and expected interactions between the peripheral device 250 and other peripheral devices. This increases the predictability and reliability of communications and reduces the time it takes to design and test the security circuit.

[0071] FIG. 3-1 illustrates an exemplary peripheral device 250 at 300-1 that includes at least one interface 302 to support compatibility with other circuit components. More generally, FIG. 3-1 includes an interconnect 110, a processor 202 coupled to the interconnect 110, and multiple peripheral devices coupled to the interconnect 110. Thus, multiple peripheral devices may be coupled to the processor 202 at least via the interconnect 110. However, each peripheral device 250 may also be coupled to the processor 202 directly or in another manner without using the interconnect 110. FIG. 3-1 explicitly illustrates P peripheral devices 250-1, 250-2, ..., 250-P, where P represents a positive integer.

[0072] In an example implementation, each peripheral device 250 includes at least one interface 302 that allows the peripheral device 250 to conform to a communication framework that provides certainty for the interoperation of the peripheral devices. For example, the interface 302, or communication interface 302, can enable the peripheral device 250 to implement at least one communication protocol 320. The interface 302 includes at least one interconnection interface 304, at least one device-to-device interface 306, and at least one other interface 308. These interfaces are described below. As shown, the peripheral device 250 also typically includes at least one register interface 310 and at least one security function module 312. In general, the interface 302 allows the peripheral device 250 to conform to a common framework for interacting with the processor 202 and other peripheral devices of the plurality of peripheral devices 250-1...250-P.

[0073] The register interface 310 includes one or more registers or register entries. Each register entry can be used, for example, for communication to or from the peripheral device 250. For example, the processor 202 or another peripheral device can set or clear a register entry, or load a value into a register entry to communicate with the peripheral device 250. Conversely, the peripheral device 250 can change the value of a register entry to communicate with the processor 202 or another peripheral device. To enable this communication, the peripheral device 250 can expose at least a portion of the register interface 310 to the processor 202 or another peripheral device. For example, the peripheral device 250 can provide processor access to clear an interrupt status indication.

[0074] In general, the register block can be used to communicate with the rest of the peripheral logic, for example to manage configuration and status communication with software. In some cases, the register interface 310 can be implemented using control and status registers (CSRs). The CSRs provide a collection of registers within the peripheral device 250 that are addressable by at least the local host processor 202 via a circuit-wide or chip-wide address map. Standardizing the CSRs increases software uniformity and promotes circuit reuse and documentation consistency. Exemplary aspects of the register interface 310 are described below with reference to FIG. 3-3.

[0075] The security features module 312 implements security related functions for the peripheral device 250. Security related functions include core or primary security functions and supporting or secondary security functions. Core security functions may include, for example, alert handling, cryptographic operations including encryption and decryption, random number generation, secure data storage (e.g., key management) including storage and access of sensitive data, etc. Supporting security functions may include functions that enable or facilitate the performance of the core functions. Examples of supporting security functions include memory storage, memory control, timing, circuit and chip I / O control, environmental sensors, bus hosting, etc.

[0076] In general, the interface 302, or any of the specific exemplary interfaces (e.g., the interconnect interface 304, the device-to-device interface 306, or other interfaces 308), may establish at least one register to the register interface 310 to enable the respective interface communication capabilities or functions. With respect to the interconnect interface 304, the interconnect interface 304 implements a communication interface that couples to the interconnect 110 to enable a connection between, for example, the peripheral device 250 and the processor 202 that conform to a common framework. By having the peripheral device 250 and the processor 202 conform to the same common framework, device-processor communication in both directions may be standardized and predictable. The interconnect interface 304 may operate across the interconnect 110, may use at least one register of the register interface 310, may use a separate bus or independent wires, a combination thereof, and the like. In operation, the peripheral device 250 may engage in at least one interconnect communication 314 using the interconnect interface 304. Additionally or alternatively, the peripheral device 250 may use the interconnect interface 304 to communicate with another peripheral device over the interconnect 110 .

[0077] The device-to-device interface 306 implements a communication interface between the peripheral device 250 and one or more other peripheral devices that conform to a common framework. By having the peripheral device 250 and each of the other peripheral devices conform to the same common framework, bidirectional inter-device communication can be standardized and predictable. The device-to-device interface 306 can use at least one register of the register interface 310, can use a bus dedicated to the peripheral device, can use one or more separate wires extending between the two peripheral devices, some combination thereof, etc.

[0078] During operation, the peripheral device 250 can engage in at least one inter-device communication 316 using the inter-device interface 306. By bypassing the interconnect 110 to communicate with another peripheral device, in some implementations the peripheral device 250 can communicate "directly" with the other peripheral device. Furthermore, establishing and adhering to an inter-device communication scheme promotes consistency and reliability of communication between two or more devices. Thus, designers can focus on achieving the intended security-related functionality of the security function module 312 instead of spending time and resources tracking and double-checking numerous ad-hoc communication regimes.

[0079] The other interface 308 implements a communication interface between the peripheral device 250 and another circuit component that conforms to a common framework. By having the peripheral device 250 and the other circuit component conform to the same common framework, peripheral device signaling in both directions can be standardized and predictable. One example of the other interface 308 is a chip I / O interface for communicating information with the outside world. Another example of the other interface 308 is an interrupt interface where interrupts are not communicated entirely over the interconnect 110. Yet another example of the other interface 308 is a clock interface. In some cases, the security circuit 106 (not shown separately in FIG. 3 ) includes a primary system clock and one or more secondary system clocks. The clock interface can utilize the primary system clock and at least a selected portion of the secondary system clock for communication timing and general functions. The clock interface can operate according to the clocking scheme of the security circuit 106, and the design code of the peripheral device 250 can specify the clocks associated with the peripheral device 250. During operation, the peripheral device 250 may use the other interface 308 to engage in at least one other communication 318 with another circuit component, such as an I / O circuit or a clock tree.

[0080] FIG. 3-2 illustrates an exemplary approach 300-2 for analyzing the design of a peripheral device to ensure compatibility objectives are met. In an example implementation, approach 300-2 uses an interface specification 332 that can include an interconnect scheme 334, an inter-device scheme 336, or other schemes 338 (including each of the schemes). Interface specification 332 corresponds to interface 302 (of FIG. 3-1). Interconnect scheme 334 corresponds to interconnect interface 304, inter-device scheme 336 corresponds to device-to-device interface 306, and other scheme 338 corresponds to other interface 308. These schemes can additionally or alternatively include local or chip-level I / O schemes, interrupt schemes, clock schemes, and the like.

[0081] Thus, the interface specification 332 may establish rules, protocols, attributes, options, functions, etc. of the interface 302. Similarly, each of the interconnection scheme 334, device-to-device scheme 336, and other scheme 338 may also establish rules, protocols, attributes, options, functions, etc. of the interconnection interface 304, device-to-device interface 306, and other interfaces 308, respectively. At design time, a designer develops each peripheral device 250 to conform to each associated scheme of the interface specification 332. For example, the device-to-device scheme 336 may establish a format for defining device-to-device signaling that bypasses the interconnect 110 of the security circuit 106. By doing so, compatible peripheral devices 250 may be manufactured that enhance interoperability and reduce design and development time, as well as testing and debugging efforts. For example, the peripheral device 250 may communicate signals (e.g., device-to-device signals) to another peripheral device using circuitry derived from attributes specified by the peripheral device's design code.

[0082] In an exemplary approach, the compatibility analysis module 340 can perform an analysis 344 of the design code to check for compatibility. A designer creates the peripheral device design code 342 with reference to the interface specification 332. Thus, the peripheral device design code 342 meets the compatibility goal by conforming to the interface specification 332. The peripheral device design code 342 can be at least partially realized using, for example, a configuration file. The peripheral device design code 342 can include one or more instructions for processor device signaling 348 (e.g., defining aspects of the interconnect communication 314 between the peripheral device 250 and the processor 202), one or more instructions for inter-device signaling 350 (e.g., defining aspects of the inter-device communication 316 between the peripheral device 250 and another peripheral device), etc. The one or more instructions for inter-device signaling 350 can relate to signals exchanged between two or more peripheral devices, including, for example, without using the interconnect 110 of the security circuit 106. These instructions can follow rules and guidelines regarding registers, signal naming, data types, timing, etc. of these signals.

[0083] Descriptions in the peripheral device design code 342 result in circuit components in the security circuit 106. For example, for each peripheral device 250 (e.g., of FIG. 3-1 ), based on attributes included in its design code 342, the device-to-device interface 306 can be coupled to at least one wire extending to another peripheral device to enable device-to-device signaling. Specifying device-to-device signaling 350 in the design code 342 increases interoperability and communication certainty. The interface specification 332 or the design code 342 configuration file can indicate required and optional peripheral functions in a particular compatibility framework. Thus, a compliant design code can include required and optional portions depending on the situation. In general, the design code 342 can be formatted according to any IC design or configuration platform. Examples include Verilog, Python, Hjson, etc.

[0084] During operation, the compatibility analysis module 340 accepts peripheral device design code 342. With reference to the interface specification 332, the compatibility analysis module 340 performs an analysis 344 to check whether the peripheral device design code 342 complies with the specified common framework. The compatibility analysis module 340 may compare the peripheral device design code 342 with one or more of the interconnect schemes 334, the inter-device schemes 336, or the other schemes 338 to check whether the code meets the respective specifications. These schemes may include specifications regarding interrupts, register usage, etc. Based on the analysis 344, the compatibility analysis module 340 generates a compatibility report 346.

[0085] The compatibility report 346 indicates whether the peripheral device design code 342 passes the analysis 344 by meeting the criteria of the interface specification 332. If not, the compatibility analysis module 340 can include a list of "violations" in the compatibility report 346. Each violation can include a reference to the portion of the code causing the indication of a failure or a reference to the portion of the interface specification 332 that is violated. Although the interface specification 332, the compatibility analysis module 340, and the peripheral device design code 342 may be described with respect to an exemplary security circuit environment, the interface specification 332, the compatibility analysis module 340, or the peripheral device design code 342 may be implemented in other environments. Thus, the compatibility report 346 can cover the analysis of a general circuit design.

[0086] FIG. 3-3 illustrates an example peripheral device 250 at 300-3 including a register interface 310 and example communication signals. In FIG. 3-3, generally, but by way of example only, required communication channels or signals are shown with solid lines (in this example of the disclosure) and optional communication channels or signals are shown with dashed lines. However, in other cases, different channels or signals may be required or optional. Moreover, solid or dashed lines in other figures do not necessarily indicate a requirement or lack of requirement, respectively, under a given interface specification.

[0087] In an example implementation, various signals may be specified as part of a framework for compatibility that the peripheral device 250 must adhere to. Starting at the top left, bidirectional signaling 362-1 using the interconnect 110 is shown with the peripheral device 250 acting as a device (e.g., acting as a follower) relative to the interconnect 110. Below that, the peripheral device 250 is shown receiving at least one clock signal 364 and at least one development mode signal 365. The development mode signal 365 indicates to the peripheral device 250 in which mode the security circuit 106 or the overall SOC is currently operating. In other words, there may be multiple modes of operation. In the two mode example, the multiple modes may include a development mode and a production mode. The mode indication may determine, for example, how to handle software errors. In other modes, security features may be enabled that communicate the status of the complete life cycle mode to the peripheral device.

[0088] The peripheral device 250 may also generate or output at least one interrupt signal 366 or at least one alert signal 368. Additionally, bidirectional signaling 362-2 using the interconnect 110 is shown with the peripheral device 250 acting as a host (e.g., acting as a reader) for the interconnect 110. The peripheral device 250 may further engage in bidirectional signaling 367 with the GPIO interface 220 or other chip I / O circuitry. With respect to the register interface 310, at least one output signal 369-1 is labeled as a register-to-hardware (Reg2Hw) signal. Meanwhile, at least one input signal 369-2 is labeled as a hardware-to-register (Hw2Reg) signal. Generally, in some implementations, certain features are considered mandatory while other features are considered optional. However, these mandatory and optional categories may vary from implementation to implementation. In a compatible design, these two categories may be assigned per feature so that each peripheral device 250 can properly interoperate with other peripheral devices.

[0089] Having generally described methods, techniques, and hardware for peripheral devices in a compatible paradigm, including an example of a ROM peripheral device that provides ROM security, the description now turns to methods, techniques, and hardware for ROM security.

[0090] Methods, techniques, and hardware examples for ROM security This section describes an exemplary ROM controller that may be included in a ROM block having a ROM array (e.g., storing a masked ROM). The ROM block or module may be connected to a system bus as a peripheral device according to the compatibility principles described above. In an example implementation, as part of the ROM block, the ROM controller interfaces between the system bus and the masked ROM. The ROM contains encrypted content. The encryption may involve relatively light-weight or low-cost encryption, such as scrambling. In some cases, the content may be scrambled using a fixed key that may be derived from a global constant. However, the encryption may be implemented using a more complex or costly encryption scheme. Regardless of the encryption scheme or encryption key used, the ROM controller can decrypt (e.g., unscramble) the content fetched from the ROM array to memory.

[0091] Unlike some SRAM controllers that can perform equivalent decryption or encryption tasks on SRAM, ROM controllers can also include a ROM checker circuit that can coordinate the calculation of a cryptographic hash of the ROM contents immediately after power-up or reset as part of the initialization process to perform an integrity check. Thus, the ROM checker circuit can detect malicious changes made to the masked ROM while the system is shut down.

[0092] The ROM block can provide several functions. For example, the ROM block can include logic for memory and address scrambling and / or descrambling. Secondly, the ROM block can perform post-power-up ROM integrity checks. Additionally, the ROM block can provide or issue control and status register (CSR) alert triggers and / or status information for ROM integrity errors or finite state machine (FSM) glitches. These and other exemplary aspects of the ROM 118 / 206 are described in this section with reference to Figures 4 through 8.

[0093] 4 illustrates an exemplary ROM 118 generally at 400, including a ROM controller 402 and a ROM array 404, with respect to accessing data in the ROM array 404. As illustrated, the ROM controller 402 may include a ROM access interface 406 and an encryption circuit 408. In an example implementation, the ROM array 404 includes encrypted ROM data 410 stored at a number of ROM addresses 418. The ROM controller 402 is coupled to the ROM array 404. In general, the encryption circuit may perform a decryption operation on the encrypted ROM data 410 based on the number of ROM addresses 418.

[0094] The ROM access interface 406 is coupled to the encryption circuit 408 and the ROM array 404. In an exemplary ROM read or data fetch operation, the ROM access interface 406 reads the encrypted ROM data 412 from the ROM array 404 based on a ROM address 414 corresponding to the encrypted ROM data 412 (e.g., the ROM address 414 may be an address of where the encrypted ROM data 412 is stored). The ROM access interface 406 also decrypts the encrypted ROM data 412 using the encryption circuit 408 to generate decrypted ROM data 416. The ROM access interface 406 may also transfer the decrypted ROM data 416 to the interconnect 110.

[0095] In some cases, the ROM access interface 406 decrypts the encrypted ROM data 412 and generates the decrypted ROM data 416 using a ROM address 414 corresponding to the encrypted ROM data 412. Thus, the encryption circuit 408 can perform a decryption operation on each ROM data 412 of the encrypted ROM data 410 based on each ROM address 414 of the plurality of ROM addresses 418. Each ROM address 414 can identify each ROM data 412 in the ROM array 404, for example, by indicating its memory location. As described below, the ROM address 414 may include a scrambled address that points "directly" to the ROM array 404, or an unscrambled address that points "indirectly" to the ROM array 404, such as after the unscrambled address is adjusted to generate the scrambled address.

[0096] The ROM access interface 406 may be implemented with at least one finite state machine (FSM) designed and / or programmed to provide access to the encrypted ROM data 410 as decrypted ROM data (e.g., as multiple instances of decrypted ROM data 416) for the security circuit 106 (e.g., of FIG. 1) or for a boot procedure of the electronic device. The FSM, or other implementation of the ROM access interface 406, may direct the operation of the encryption circuit 408.

[0097] The encryption circuit 408 may include a keystream circuit (not shown in FIG. 4) that may generate one or more keys based on the ROM address 418. The encryption circuit 408 may also include a data combination circuit (not shown in FIG. 4) coupled to the keystream circuit. The data combination circuit generates the decrypted ROM data 416 based on the encrypted ROM data 412 and at least one of the multiple keys. In some cases, the encryption circuit 408 further includes a permutation circuit (not shown in FIG. 4) that permutes the encrypted ROM data 412 to generate permuted encrypted ROM data. The data combination circuit then combines bits of the at least one key and bits of the permuted encrypted ROM data using logical operations to generate the decrypted ROM data 416. An example implementation of the encryption circuit 408 is described below with reference to FIG. 6.

[0098] Each entry of the encrypted ROM data 410 may include, for example, a ROM instruction 420 and a check code 422, such as an error correction code (ECC). In such a case, the encrypted ROM data 412 may include bits corresponding to the ROM instructions 420 and bits corresponding to the check code 422 of the ROM instructions 420. The bits corresponding to the ROM instructions 420 and the bits corresponding to the check code 422 of the ROM instructions 420 are intermingled, mixed, or "smoothed" together such that their respective bit positions are unknown. In contrast, the decrypted ROM data 416 may include the bits corresponding to the ROM instructions 420 and the bits corresponding to the check code 422 of the ROM instructions 420 in a format where the two sets of bits are separated from each other, or at least where their relative bit positions are known.

[0099] In some implementations, the decoded ROM instructions and associated check codes may be passed by the ROM 118 to another component via the interconnect 110. In other embodiments, the ROM controller 402 may include a ROM checker circuit (e.g., the ROM checker circuit 616 of FIG. 6). The ROM checker circuit 616 may be coupled to the output of the encryption circuit 408. In an exemplary operation, the ROM checker circuit 616 calculates another check code based on the ROM instructions 420 of the decoded ROM data 416. The ROM checker circuit 616 also performs a comparison including the check code 422 of the decoded ROM data 416 and the calculated check code. The ROM checker circuit 616 may further generate an error signal based on the comparison. The error signal may be sent as an alert signal and / or an interrupt signal to an alert handler and / or a processor, respectively.

[0100] 8 and 10, each encrypted ROM data 412 of the encrypted ROM data 410 stored at multiple ROM addresses 418 of the ROM array 404 is distinct (in some implementations) from the encrypted ROM data 412' of the encrypted ROM data 410 stored at multiple ROM addresses 418 of the ROM array 404. This distinction (or uniqueness of the encrypted ROM data) is due, at least in part, to the encryption scheme based on the multiple ROM addresses 418. For example, the encryption scheme and / or at least one encryption key used in a particular encryption scheme may be selected such that each original ROM data results in a distinct encrypted ROM data.

[0101] FIG. 5 is now described, illustrating additional and / or alternative aspects of the exemplary ROM 118. It should therefore be understood that the aspects of FIG. 4 can be combined with one or more aspects of FIG. 5, and vice versa. For example, the address adjustment circuit 504 of FIG. 5 can be included in the circuit of FIG. 4. In such a case, the ROM controller 402 can include an address adjustment circuit 504 that adjusts the ROM address to generate an adjusted ROM address. This may require converting the ROM address from unscrambled to scrambled (e.g., from an adjusted logical address to generate a physical address). The ROM access interface 406 uses the address adjustment circuit 504 to adjust the ROM address to read the encrypted ROM data 410 stored in the multiple ROM addresses 418. The address adjustment circuit 504 can, for example, permute two or more bits of each ROM address, permute two or more bits of each ROM address, or permute and permute two or more bits of each ROM address of the ROM addresses 418 to generate an adjusted ROM address. Another implementation showing the aspects of Figs. 4 and 5 combined is shown collectively in Fig. 6 and described below.

[0102] 5 illustrates generally at 500 an exemplary ROM 118 including a ROM controller 402 and a ROM array 404 in conjunction with checking the integrity of encrypted ROM data 410. As illustrated, the ROM controller 402 includes an integrity checker circuit 502, an address adjustment circuit 504, and a gating circuit 506. The ROM controller 402 has access to at least a digest calculation circuit 508. In some cases, the digest calculation circuit 508 is implemented as another peripheral device 250 (of FIG. 2) and / or circuit component 108 (of FIG. 1). In other cases, the digest calculation circuit 508 may be implemented as part of the ROM 118, such as part of the ROM controller 402 or separate from the ROM controller 402.

[0103] In an example implementation, the ROM array 404 includes encrypted ROM data 410 stored at a number of ROM addresses 418. The ROM array 404 may also include at least one expected digest 510 (or "expected digest value 510"). The ROM controller 402 is coupled to the ROM array 404. In an example operation, the ROM controller 402 reads the encrypted ROM data 412 from the ROM array 404 based on the ROM address 512 or 514 corresponding to the encrypted ROM data 412. The ROM controller 402 also obtains at least one digest value 516 using the encrypted ROM data 412. To perform the obtaining, the integrity checker circuit 502 may use the digest calculation circuit 508. The ROM controller 402 further gates access to the ROM array 404 based on the at least one digest value 516 and the expected digest value 510. The consistency checker circuit 502 can control a gating circuit 506 to allow / authorize or block access to the ROM array 404 .

[0104] An address adjustment circuit 504 of the ROM controller 402 may adjust the ROM address 512 to generate an adjusted ROM address 514. The ROM controller 402 uses the address adjustment circuit 504 to adjust the ROM address 512 to read the encrypted ROM data 410 stored at a plurality of ROM addresses 418. The address adjustment circuit 504 may adjust the ROM address 512, for example, by shifting, swapping, or otherwise manipulating two or more bits of the ROM address 512 to generate the adjusted ROM address 514. The ROM address 414 of FIG. 4 may correspond to the ROM address 512 or the adjusted ROM address 514.

[0105] The ROM controller 402 is configured to obtain at least one digest value 516 based on applying at least one hash algorithm to the encrypted ROM data 412. Examples of hash algorithms are described herein. In some cases, the ROM array 404 and the ROM controller 402 include a first peripheral device (e.g., a first peripheral device 250-1, such as the ROM 206 of FIG. 2). A second peripheral device (e.g., a second peripheral device 250-2, such as the HMAC engine 214 of FIG. 2) can implement one or more hash algorithms. The ROM controller 402 can obtain at least one digest value 516 by communicating with the second peripheral device. Thus, in these cases, the second peripheral device can include the digest calculation circuit 508. In other cases, the ROM 118, including its ROM controller 402, can instead include the digest calculation circuit 508.

[0106] 5 for some implementations, the ROM controller 402 can read the expected digest value 510 from the ROM array 404. In contrast to the encrypted ROM data 410, the expected digest value 510 can be stored in the ROM array 404 in an unencrypted form. The expected digest value 510 can be stored at any address and / or location of the ROM array 404, and the expected digest value 510 can span one or more lines and / or addresses of the ROM array 404. For example, the expected digest value 510 can be stored in a predetermined location of the ROM array 404 that corresponds to a determinable ROM address (e.g., the last six ROM entries) (e.g., at least one ROM address 512 identifying the last six ROM entries or at least one adjusted ROM address 514).

[0107] The integrity checker circuit 502 can compare the calculated digest value 516 with the expected digest value 510. In response to at least one digest value 516 matching the expected digest value 510, the ROM controller 402 can use the gating circuit 506 to authorize access to the ROM array 404, for example, to allow a boot procedure to be performed using the encrypted ROM data 410 or to allow general ROM access. On the other hand, in response to at least one digest value 516 not matching the expected digest value 510, the ROM controller 402 can use the gating circuit 506 to block access to the ROM array 404, for example, to prevent a boot procedure from being performed using the untrusted encrypted ROM data 410 or to block general ROM access. The ROM controller 402 can also send at least one alarm 518 (or "alarm indication 518"). At least one alarm 518 may correspond to an alert communicated from the ROM 118 via a register and / or an interrupt sent over the interconnect 110 or a dedicated path.

[0108] The security circuitry may additionally or alternatively provide the calculated digest value 516 to one or more other components outside of the ROM 118. For example, the ROM controller 402, such as its integrity checker circuit 502, may transmit the digest value 516 to another component, such as a main processor. The ROM controller 402 may also, or instead, expose the digest value 516 via at least one register of the ROM 118. Reading the value in the register may allow other components to independently verify the value of the calculated digest value 516. The key derivation mechanism ensures that even if an attacker is able to corrupt the encrypted ROM data 410 and / or the expected digest value 510 (stored in the ROM array 404), the attacker has altered the chip ID in a way that can be detected by other components.

[0109] Each encrypted ROM data 412 of the encrypted ROM data 410 can be established to vary or be heterogeneous, including being unique or different from one another. For example, each respective encrypted ROM data 412 of the encrypted ROM data 410 may be different from each other respective encrypted ROM data 412 of the encrypted ROM data 410 across the ROM array 404. In some cases, an encryption key associated with the encryption or decryption of the encrypted ROM data 410 is selected to ensure that each respective encrypted ROM data 412 is different from each other respective encrypted ROM data 412 of the encrypted ROM data 410 across the ROM array 404. In other cases, an encryption algorithm associated with the generation of each encrypted ROM data 412 is selected to ensure that each respective encrypted ROM data 412 is different from each other respective encrypted ROM data 412 of the encrypted ROM data 410 across the ROM array 404. Techniques for ensuring that most or each encrypted ROM data 412 are unique are further described with reference to FIG. 8.

[0110] FIG. 6 illustrates an example of a ROM block 600, which may be implemented as ROM 118 (e.g., of FIGS. 1, 4, and 5) and / or ROM peripheral device 206 (e.g., of FIG. 2). FIG. 6 illustrates a high-level block diagram of an example ROM module implementation. Some of the blocks illustrated may be realized by instantiation of multi-use primitives that may also be used or replicated elsewhere on the chip or as part of another component of the security circuit. ROM block 600 includes ROM array 404, consistency checker circuit 502, and address adjustment circuit 504 from FIGS. 4 and 5.

[0111] As shown, the ROM block 600 also includes an interface 604, at least one register 606, a ROM checker circuit 616, a zero padder circuit 618, a multiplexer 602, and an example of an encryption circuit 408 (e.g., of FIG. 4). The ROM checker circuit 616 may be implemented with an ECC decoder. The encryption circuit 408 can be implemented, for example, with a key stream circuit 608, a manipulation circuit 612, and a data combination circuit 614. The data combination circuit 614 can be implemented with a circuit that performs a logical operation, such as, for example, an exclusive-or (XOR) operation. The manipulation circuit 612 can spread one or more bits of the ROM data 626 (which may correspond to the encrypted ROM data 412 of FIGS. 4 and 5). The manipulation circuit 612 can be implemented, for example, using a permutation circuit, a permutation circuit, or a combined permutation and permutation circuit (e.g., a permutation-permutation network), as described further below.

[0112] In general, the top half of the diagram shows the path of a ROM read when the system is operating normally. The bottom half of the diagram shows the use of a ROM integrity checker circuit 502. The ROM integrity checker circuit 502 can be triggered by the power manager, for example, early in the chip startup sequence, to check the validity of the ROM image. In some cases, the integrity checker circuit 502 can be configured to run only once to prevent an attacker from running it multiple times to compromise the system. The integrity checker circuit 502 can release the multiplexer 602 when the integrity check procedure finishes with a positive result, granting access to the ROM array as part of the gating circuit 506 (of FIG. 5).

[0113] This document describes an example of a ROM access when the security circuit (e.g., a chip) is operating in a normal boot mode or after an integrity check has been successfully performed. Once the chip boots up, it can request ROM access via an interconnect such as a system bus (e.g., a TL-UL bus). The ROM block 600 can receive these requests via an interface 604 (e.g., a TL-UL adapter) shown in the top left of FIG. 6. In normal operation, the multiplexer 602 grants access to these bus reads (e.g., TL reads). The address 610 of the read request is adjusted in the address adjustment circuit 504. For example, the address adjustment circuit can scramble the address using a permutation and reordering network.

[0114] In parallel with the ROM access, a keystream circuit 608, such as a low latency reduced round PRINCE block cipher (e.g., with 5 rounds at a latency of 1, which may be comparable to a cipher used for SRAM), calculates a 39-bit truncated keystream for the ROM block. The keystream circuit 608 generates at least one key using the address from the request provided to the address adjustment circuit 504 (e.g., before the address is adjusted). In the next cycle, the scrambled data from the ROM array 404 (e.g., bits of ROM data and corresponding ECC bits, the two sets or types of bits are intermixed in the ROM array 404 as ROM data 626) is sent through a manipulation circuit 612, such as another permutation and reordering network. The manipulated (e.g., permuted and / or permuted) ROM data from the manipulation circuit 612 and at least one key or keystream from the keystream circuit 608 are combined by a data combination circuit 614. In the illustrated example, the key and the permuted scrambled ROM data (including the ECC code) are XORed with an XOR operation performed by data combination circuit 614. A block cipher such as PRINCE can be used, for example, in "Counter (CTR) mode." A counter (e.g., ROM data address 610) is encrypted with an N-bit block cipher (e.g., PRINCE) and a particular key (e.g., a netlist constant) to generate an N-bit keystream block 628, which can be XORed against the data (e.g., ROM data 626 corresponding to ROM data address 610).

[0115] The output from the data combiner circuit 614 is the decoded 32-bit data plus 7 ECC bits. If a ROM checker circuit 616 is implemented here, these 39 bits can be passed through the ROM checker circuit 616 back to the interface 604 if the ECC bits verify successfully. An ECC decoding error can cause an error code (e.g., a read error indicator) to be reported via the interface 604 along with an error signal 622 by the ROM access in response to the TL request. The ROM controller can also use or alternatively set at least one of the registers 606 and / or generate a fatal alert based on the ECC decoding error. Although specific bit lengths are shown herein, these are shown by way of example only, and the data, ECC, etc. may have different lengths or be omitted.

[0116] In alternative implementations of the ECC function, the "main" bus or system bus may be enhanced with the ECC checking function. In such cases, the circuitry and its operation may differ from that shown and described with reference to FIG. 6. For example, the ROM access response 624 may include the ROM bits and the ECC bits by passing them "directly" from the descrambling XOR operator of the data combiner circuit 614 to the interface 604. Thus, in these alternative implementations, the ROM checker circuit 616 and its associated CSR may be omitted from the ROM block 600.

[0117] FIG. 7 illustrates an exemplary timing diagram 700 for accessing the ROM array 404 of the ROM block 600 of FIG. 6. The timing diagram 700 illustrates the timing of various signals. These example signals are mapped to the signals shown in the ROM block 600 of FIG. 6. The time from when the request 702 (req 702) output is provided by the interface 604 until the response appears at the response or ROM valid 704 (rvalid 704) input of the interface 604 is one cycle. Two examples are shown: an unscrambled or original address "12" and an unscrambled or original address "34". An example of how to "scramble" the addresses in the diagram is to invert the digits of each address. For the original or unscrambled "12" address example, the word stored in the ROM at scrambled address 21 is denoted as "w21". The keystream value for the unscrambled or original address 12 is denoted as "k12". The descrambled, or decoded, ROM data at original address 12 is designated "d12."

[0118] Referring to FIG. 6, the PRINCE block cipher based implementation of the keystream circuit 608 and the two substitution and permutation (S&P) network implementations of the address adjustment circuit 504 and the manipulation circuit 612 can be parameterized by a "key". In the case of a ROM controller, these keys can be globally randomized netlist constants. Thus, the keys are considered difficult to recover, but are not necessarily confidential data. Although particular bit lengths (e.g., 39 bits and 256 bits) and word sizes (e.g., 32 bits) are shown in the description and / or accompanying drawings herein, these are provided by way of example only. In other implementations, different bit lengths, word sizes, etc. may be used.

[0119] This document describes an example of a boot ROM integrity check. The ROM integrity checker circuit 502 can run after reset, including "immediately after" reset, or at least before a read is made to the ROM. The integrity checker circuit 502 controls the ROM address request (e.g., via multiplexer 602) until the ROM check is completed. The select signal 632 of multiplexer 602 can include redundant coding to protect the select signal from fault injection (FI) attacks. If the select signal 632 has an invalid value, the detection of the invalidity can trigger a fatal alert. Before starting to read data from the ROM array 404 as ROM data 626 (which can correspond, for example, to the encrypted ROM data 412 of Figures 4 and 5), the ROM integrity checker circuit 502 (or power manager module) can initiate an encryption operation on an encryption module (not shown in Figure 6) to prepare for the ROM check (e.g., can initiate a cSHAKE operation in a keyed or Keccak message authentication code (KMAC) engine using signal kmac_cmd_o). An example of a ROM integrity checking process is described below with reference to the flow chart of FIG.

[0120] A possible physical attack on the security circuitry is an attempt to corrupt the masked ROM. The regular structure of masked ROM is convenient because it makes metal fixing relatively easy, but for the same reason, the regular structure can make the ROM a relatively easy target for an attacker. Because the code in the ROM can be executed first, an attacker who modifies the ROM code undetected can completely destroy the chain of trust. The integrity checker circuit 502 can thus provide a measure of confidence in the integrity of the ROM code.

[0121] In an example implementation, after releasing the ROM controller from reset, the power manager waits until the "check_done_o" signal is asserted before starting the host processor. The power manager can also check that the check_good_o signal is "on". If not, the power manager can refuse to start. This provides a safety check, and additional security is provided by the integration of a key manager, described next.

[0122] The KMAC interface can be assumed to be pre-configured such that the KMAC engine runs the cSHAKE algorithm with a prefix specific to the ROM checker circuitry. The ROM checker does not assert the signal "kmac_rom_vld_o" after a hash calculation (or a known number of hash calculations) is finished. However, the KMAC engine may ignore the signal thereafter to allow simple arbitration that still remains robust against fault injection attacks.

[0123] The integration with the key manager is based on forwarding the digest data in "kmac_digest_share0_i" and "kmac_digest_share1_i" as "keymgr_digest_data_o". This 256-bit digest can be incorporated into the "CreatorRootKey". In some cases, the key manager can only allow one transaction (e.g. 256-bit / 32-bit = 8 bits) to pass this information after a reset. In response to future messages, the key manager can raise an alert, which can thwart an attacker who tries to trigger additional transactions before or after the correct one.

[0124] The CreatorRootKey can form the first key in a chain of identity and root keys. An attacker modifying the ROM would disrupt the CreatorRootKey, since circumventing it would result in a pre-image attack on the ROM checksum calculation or the KM_DERIVE function. As a result, the security chip would function, but the chip would hold the "wrong" root key, thus breaking the chain of trust used for authentication.

[0125] Next, an example hardware interface with respect to parameters and signals is described. Example ROM controller signal descriptions are shown in Table 1 below. These signals can be sent from or received by the integrity checker circuit 502. "Check" related signals can communicate with a power manager. "Keymgr" related signals can communicate with a key manager. "KMAC" related signals can communicate with a KMAC engine or other circuitry that performs hashing operations.

[0126] [Table 1]

[0127] Examples of register values ​​for the ROM block registers 606 may include: ALERT_TEST; FATAL_ALERT_CAUSE; DIGEST_0...DIGEST_7 (e.g. with multiple registers); EXP_DIGEST_0…EXP_DIGEST_7 (e.g., with multiple registers); and ROM (e.g. windows into ROM).

[0128] Example fields in the FATAL_ALERT_CAUSE register are shown in Table 2 below.

[0129] [Table 2]

[0130] With regard to programming and ROM blocks, software can interact with the ROM controller by fetching code or loading data from the ROM. From this perspective, the ROM block appears to be a block of memory accessible via the system bus. However, the ROM block may make some of the registers 606 accessible. With the exception of the ALERT_TEST register, the registers may be read-only and writeable. While the FATAL_ALERT_CAUSE register may change value during operation (e.g., when an alert is signaled), the other registers in the ROM block may have fixed values ​​by the time the software is executed.

[0131] The integrity checker circuit 502 can load the digest into register 606 via digest signal 634. To obtain the calculated ROM digest, software can read the DIGEST_0 through DIGEST_7 registers. The ROM array 404 can also contain an expected ROM digest, EXP_DIGEST. Unlike the rest of the contents of the ROM array 404, the contents that store the expected digest may not be scrambled. Therefore, software cannot read the data through a standard ROM interface, which would result in garbage data being "unscrambled" "again" and causing an ECC check to fail. The expected digest can be read in EXP_DIGEST_0 through EXP_DIGEST_7 if software is given access to this value.

[0132] 8 illustrates an example scheme generally at 800 according to which a resilient integrity check may be implemented. The security circuit includes a ROM array 404. The ROM array 404 includes encrypted ROM data 410. The encrypted ROM data 410 may include multiple instances of encrypted ROM data, such as L instances of encrypted ROM data 412-1...encrypted ROM data 412-L, where L represents an integer.

[0133] Each respective encrypted ROM data 412 is generated from a respective "original" ROM line 802-1 using an encryption algorithm 806 having at least one key 804 and / or based on a respective ROM address 414 (e.g., the respective ROM address 414 may be used as part of the at least one key 804). Thus, the first ROM line 802-1 results in the first encrypted ROM data 412-1, the Lth ROM line 802-L results in the Lth encrypted ROM data 412-L, etc. Each ROM line or entry 802 may correspond to, for example, decrypted ROM data 416 after a pair of encryption and decryption operations.

[0134] In some cases, a particular combination of encryption algorithm 806 and key 804 may produce two or more instances of encrypted ROM data 412 that are identical, i.e., indistinguishable from one another. This may provide another potential avenue of attack if another ROM line in the ROM array 404 is modified, by redirecting the ROM integrity checker to another ROM line that has the same value. More specifically, an attacker may attempt to attack the communication between the checker and the ROM array. This may require manipulation of the data bus (e.g., to hide modifications made to the ROM data) or attacking the lower bits of the address bus. For example, an attacker may attempt to modify a word in the ROM, but avoid detection of such modifications by hash calculations by redirecting the ROM checker to another copy of the same word.

[0135] To combat this, if there are one or more duplicates, the encryption algorithm 806 and / or key 804 can be altered or replaced with a different algorithm or key. Using the altered algorithm and / or key, the ROM lines 802-1...802-L are re-encrypted to generate another set of multiple instances of encrypted ROM data 412-1...412-L. This process can be repeated until there are few or no identical instances of encrypted ROM data 412.

[0136] Unlike some scrambling approaches that use ephemeral (and unguessable) keys to make attacks on data at rest more difficult, the key for ROM scrambling is fixed per circuit. Such a fixed key nevertheless provides the spreading and address linking properties described above. The key can be derived from a global constant. When constructing the final design for the security circuit instantiation, an "additional" check can be performed to ensure that the constants have been chosen to generate keys that are distinct for each word in the ROM after scrambling.

[0137] Having generally described the methods, techniques, and hardware for ROM security, the description now turns to an exemplary method.

[0138] Exemplary methods for ROM security An exemplary method is described below with reference to the flow charts of Figures 9 to 13. Figure 9 illustrates in flow chart 900 an exemplary method for a device to check the integrity of a ROM, such as at power-up or reset. Flow chart 900 includes nine blocks 902-918. Referring also to Figure 6, the ROM integrity checker circuit 502 may run after reset, including immediately after reset, or at least before a read to the ROM is made. The ROM checker may control ROM address requests (e.g., through multiplexer 602) until the ROM check is completed. The select signal 632 of multiplexer 602 may include redundant encoding to protect the select signal 632 from fault injection (FI) attacks. If the select signal 632 has an invalid value, the detection of the invalidity may trigger a fatal alert. Before starting to read data from the ROM array 404, the ROM checker (or power manager module) may start an encryption operation in preparation for performing one or more hash operations for the ROM check.

[0139] At 902, the ROM checker can read the ROM contents in unscrambled address order starting at "address 0," resulting in a scattered access pattern on the physical ROM due to the address scrambling. At 904, each ROM read produces 39 bits of data, which is zero-padded (e.g., by the zero padder circuit 618) to 64 bits. This 64-bit length matches the interface expected by the digest calculation circuit 508 of FIG. 5 (e.g., the KMAC engine (not explicitly shown in FIG. 5 or 6)). The address is incremented.

[0140] The ROM consistency checker circuit 502 loops through many of the words in the ROM (e.g., from bottom to top), reading and incrementing the address until it reaches a predetermined address, as described below for block 906. The finite state machine (FSM) of the consistency checker circuit 502 passes each ROM word to the KMAC engine using a ready / valid interface, and sets the "kmac_rom_last_o" bit in response to the last word sent.

[0141] At 906, a determination is made based on the address value. A certain amount of words may be reserved for the expected hash value. For example, the top 8 words in the ROM array 404 (e.g., with the unscrambled address) may be interpreted as a 256-bit "expected hash value." Unlike the rest of the ROM array 404, the data of the words of the expected hash may be stored in an unscrambled state. Thus, the expected hash value may be read directly without decoding. At 908, these top 8 words are read from the ROM array 404 into a buffer or register to obtain the expected digest value. Thus, these words may be taken as the expected hash by the consistency checker circuit 502 (e.g., ignoring the ECC bits). The expected hash may be compared to the digest returned from the KMAC engine or other implementation of the digest calculation circuit 508.

[0142] When the digest is received from the KMAC engine at 910, the integrity checker circuit 502 may forward the digest to a key checker, such as a key manager. The key manager or integrity checker circuit 502 may compare the calculated digest at 912 to an expected digest read from the top eight words of the ROM array 404. If the FSM of the ROM controller 402 performs the comparison, the transfer at block 910 may be omitted. If the two digests do not match, the key manager and / or integrity checker circuit 502 may generate an alarm at 914. The alarm may be signaled as an alert or an interrupt. In response to a match between the expected digest and the calculated digest, the integrity checker circuit 502 may signal a "check_good_o" indication as "on" at 916 and release the multiplexer 602. By doing so, the consistency checker circuit 502 switches access to the multiplexer 602 to allow other components to access the ROM array 404 via the interface 604. Upon completion of the calculation and / or comparison, either with a match or a mismatch, a "check_done_o" indication may be asserted (e.g., driven high). The system may then enter normal operation at 918.

[0143] FIG. 10 illustrates a flow chart or process 1000 of an exemplary method according to integrity checking with resilience. In general, for an encryption key-based implementation, the flow chart 1000 may involve first selecting an encryption key. Second, each line of ROM data is encrypted using the selected encryption key to generate a respective encrypted ROM data 412. Third, multiple instances of the encrypted ROM data 412 are checked to determine whether there are duplicates. If there are no duplicates, the process may end. On the other hand, if at least one duplicate is detected, the process may continue by repeating the steps starting with the selection of another encryption key.

[0144] As shown in FIG. 10, flow diagram 1000 includes five blocks 1002-1010. At block 1002, an encryption key and / or encryption algorithm is applied to each line of the ROM to generate a number of encrypted ROM lines. At block 1004, the presence of a certain number of duplicate encrypted ROM lines is determined. If the number is zero (or meets another threshold), the process may end as indicated by the dashed arrow. On the other hand, if the number of duplicates is not zero, at block 1006, the application of encryption to each line of the ROM is repeated using a new encryption key and / or a new encryption algorithm. At block 1008, a new number of duplicate instances of encrypted ROM lines is determined based on the new key and / or new algorithm. As at block 1010, the process may continue at block 1006 until a certain threshold number (e.g., zero) of encrypted ROM lines are duplicated through application of a particular key and algorithm combination.

[0145] FIG. 11 illustrates in a flow diagram or process 1100 an exemplary method for an apparatus implementing ROM scrambling, such as for accessing scrambled ROM data. Flow diagram 1100 includes four blocks 1102-1108. Operations may be performed by a ROM block, such as a ROM 118 / 206 peripheral device. At block 1102, the ROM may receive a ROM read request, including a ROM address, from a system bus or its interface. At block 1104, a ROM controller of the ROM may access a ROM array using the ROM address to obtain scrambled ROM data, which may include ECC or other protection data in addition to ROM instructions. More generally, the scrambled ROM data may be implemented as encrypted ROM data.

[0146] At block 1106, an encryption circuit of the ROM controller can descramble the scrambled ROM data using the ROM address to generate descrambled ROM data. For example, the encryption circuit can use one or more of a key stream circuit 608, a manipulation circuit 612 (e.g., a permutation and permutation network or other circuitry to spread the bits of the scrambled ROM data), and a data combination circuit 614 that performs logical operations. At block 1108, the ROM controller can transmit the descrambled ROM data to another peripheral device via an interface and / or a system bus.

[0147] 12 is a flow diagram illustrating an example process 1200 for accessing a ROM array containing encrypted ROM data. The flow diagram includes four blocks 1202-1208. At block 1202, a ROM read request is obtained. The ROM read request includes a ROM address associated with a ROM array containing encrypted ROM data stored at a plurality of ROM addresses. For example, ROM controller 402 may obtain a ROM read request including a ROM address 414 associated with a ROM array 404 containing encrypted ROM data 410 stored at a plurality of ROM addresses 418. The ROM read request may be obtained from another component, for example, via interconnect 110 and / or interface 604.

[0148] At block 1204, the encrypted ROM data is read from the ROM array using the ROM address. For example, the ROM controller 402 can read the encrypted ROM data 412 from the ROM array 404 using the ROM address 414. In some cases, the ROM controller 402 can include an address adjustment circuit 504, which can adjust the ROM address 512 to generate an adjusted ROM address 514. In such a case, the ROM controller 402 can retrieve the encrypted ROM data 412 from the ROM array 404 using the ROM address 414 implemented with the adjusted ROM address 514.

[0149] At block 1206, the encrypted ROM data is decrypted to generate decrypted ROM data using the ROM address. For example, the encryption circuit 408 may use the ROM address 414 to decrypt the encrypted ROM data 412 to generate decrypted ROM data 416. To do so, the encryption circuit 408 may use the ROM address 414 to generate a key that is used as part of a decryption algorithm to generate the decrypted ROM data 416.

[0150] At block 1208, the decoded ROM data is transferred to the interconnect. For example, the ROM controller 402 may transfer the decoded ROM data 416 to the interconnect 110, where the decoded ROM data 416 may include check code bits. Additionally or alternatively, the ROM checker circuit 616 may perform an error checking procedure on the ROM as part of or in conjunction with the operation of transferring the decoded ROM data 416.

[0151] FIG. 13 is a flow diagram illustrating an exemplary process 1300 for checking the integrity of a ROM array containing encrypted ROM data. The flow diagram includes three blocks 1302-1306. In block 1302, the encrypted ROM data is read from a ROM array based on a ROM address corresponding to the encrypted ROM data, and the ROM array stores the encrypted ROM data at multiple ROM addresses. For example, the ROM controller 402 can read the encrypted ROM data 412 from the ROM array 404 based on a ROM address 512 or 514 corresponding to the encrypted ROM data 412. Thus, the ROM controller 402 can include an address adjustment circuit 504 that generates an adjusted ROM address 514 from the ROM address 512, such that the adjusted ROM address 514 is used to identify the encrypted ROM data 412 to be retrieved. Here, the ROM array 404 can store the encrypted ROM data 410 at multiple ROM addresses 418. The ROM array 404 can also store an expected digest value 510.

[0152] At block 1304, at least one digest value is obtained using the encrypted ROM data. For example, the ROM controller 402 may obtain at least one digest value 516 using the encrypted ROM data 412. In some cases, the integrity checker circuit 502 of the ROM controller 402 may communicate with a digest calculation circuit 508 external to the ROM 118 to obtain the at least one digest value 516. In other cases, the integrity checker circuit 502 or another portion of the ROM 118 may include circuitry to calculate a hash of the digest value 516. The digest value 516 may correspond to a hash over multiple instances of the encrypted ROM data 412, including up to all instances of the encrypted ROM data 412 in a particular ROM array 404. In such a case, at block 1302, multiple pieces of the encrypted ROM data 412 are read from the ROM array 404 based on multiple ROM addresses corresponding to the multiple pieces of the encrypted ROM data 412. Further, in block 1304 , a hash algorithm is applied to the plurality of pieces of encrypted ROM data 412 read from the ROM array 404 .

[0153] At block 1306, access to the ROM array is gated based on at least one of the digest value and the expected digest value. For example, the ROM controller 402 can gate access to the ROM array 404 based on at least one of the digest value 516 and the expected digest value 510. To do so, the consistency checker circuit 502 can compare the digest value 516 to the expected digest value 510. If there is a mismatch, the gating circuit 506 can block or deny access to the ROM array 404. On the other hand, if the two values ​​510 and 516 match, the gating circuit 506 can allow access to the ROM array 404 to other components, for example to allow initialization to continue or "normal" ROM access to occur.

[0154] Aspects of these methods may be implemented, for example, in hardware (e.g., fixed logic circuitry, or a processor in conjunction with memory), firmware, software, or some combination thereof. The methods may be realized using one or more of the devices or components shown in Figures 1 through 8 and 14. These components may also be further divided or combined. The devices and components in these figures generally represent hardware, firmware, software, or combinations thereof, such as electronic devices, PCBs, packaged modules, IC chips, components, or circuits. Thus, these figures illustrate some of the many possible systems or apparatuses that may implement the described methods.

[0155] With respect to the methods and associated flow diagrams described herein, the order in which operations are shown and / or described is not intended to be construed as a limitation. Instead, any number or combination of the described method operations can be combined in any order to implement a particular method or alternative methods. Operations can also be omitted or operations added to the described methods. Additionally, the described operations can be implemented in full or partial overlap.

[0156] ROM security aspects and implementation examples Several exemplary aspects and implementations are described below.

[0157] Exemplary embodiment 1: An apparatus for a secure read-only memory (ROM), comprising: a ROM array including encrypted ROM data stored at a plurality of ROM addresses; and a ROM controller coupled to the ROM array, the ROM controller including an encryption circuit configured to perform a decryption operation on the encrypted ROM data based on the plurality of ROM addresses; and a ROM access interface coupled to the encryption circuit and to the ROM array, the ROM access interface configured to read the encrypted ROM data from the ROM array based on a ROM address corresponding to the encrypted ROM data, decrypt the encrypted ROM data using the encryption circuit to generate decrypted ROM data, and transfer the decrypted ROM data to an interconnect.

[0158] Exemplary embodiment 2: The apparatus of exemplary embodiment 1, wherein the ROM access interface is configured to generate decrypted ROM data by decrypting the encrypted ROM data using a ROM address corresponding to the encrypted ROM data.

[0159] Exemplary embodiment 3: The apparatus of exemplary embodiment 1 or exemplary embodiment 2, wherein the encryption circuit is configured to perform a decryption operation on each ROM data of the encrypted ROM data based on a respective ROM address of the plurality of ROM addresses, each ROM address being configured to identify each ROM data in the ROM array.

[0160] Exemplary embodiment 4: The apparatus of any one of the preceding exemplary embodiments, wherein the ROM access interface comprises a finite state machine (FSM) configured to provide access to the encrypted ROM data as decrypted ROM data for the boot procedure. The FSM is a system that always assumes a corresponding state of a plurality of predefined states, and the system transitions from one state to another state based on an input to the FSM.

[0161] Exemplary Embodiment 5: The apparatus of any one of the preceding exemplary embodiments, wherein the ROM controller comprises an address adjustment circuit configured to generate an adjusted ROM address by adjusting the ROM address, and the ROM access interface is configured to adjust the ROM address using the address adjustment circuit in order to read the encrypted ROM data stored at the multiple ROM addresses.

[0162] Exemplary embodiment 6: The apparatus of exemplary embodiment 5, wherein the address adjustment circuitry is configured to at least one of permute or permute two or more bits of each of the ROM addresses to generate an adjusted ROM address.

[0163] Exemplary Embodiment 7: The apparatus of any one of the preceding exemplary embodiments, wherein the encryption circuit comprises a keystream circuit configured to generate a key based on a ROM address, and a data combination circuit coupled to the keystream circuit, the data combination circuit configured to generate decrypted ROM data based on at least one of the encrypted ROM data and the key.

[0164] Exemplary embodiment 8: The apparatus of exemplary embodiment 7, wherein the encryption circuit includes a manipulation circuit configured to generate manipulated encrypted ROM data by spreading two or more bits of the encrypted ROM data, and the data combination circuit is configured to generate decrypted ROM data by combining bits of at least one key and bits of the manipulated encrypted ROM data using a logical operation.

[0165] Exemplary embodiment 9: The apparatus of any one of the preceding exemplary embodiments, wherein the encrypted ROM data includes bits corresponding to the ROM instructions and bits corresponding to a check code of the ROM instructions, and the decrypted ROM data includes bits corresponding to the ROM instructions and bits corresponding to the check code of the ROM instructions.

[0166] Exemplary embodiment 10: The apparatus of exemplary embodiment 9, wherein the ROM controller comprises a ROM checker circuit coupled to an output of the encryption circuit, the ROM checker circuit configured to calculate another check code based on a ROM instruction of the decrypted ROM data, perform a comparison including the check code of the decrypted ROM data and the calculated check code, and generate an error signal based on the comparison (e.g., if there is no match between the check code and the calculated check code).

[0167] Exemplary embodiment 11: The apparatus of exemplary embodiment 9, wherein each encrypted ROM data of the encrypted ROM data stored in the multiple ROM addresses of the ROM array is different from each other encrypted ROM data of the encrypted ROM data stored in the multiple ROM addresses of the ROM array by an encryption scheme based on the multiple ROM addresses.

[0168] Exemplary embodiment 12: The apparatus of exemplary embodiment 1, wherein the apparatus includes a mobile device. Exemplary embodiment 13: A method for a secure read-only memory (ROM), comprising: obtaining a ROM read request including a ROM address associated with a ROM array including encrypted ROM data stored at a plurality of ROM addresses; reading the encrypted ROM data from the ROM array using the ROM address; generating decrypted ROM data by decrypting the encrypted ROM data using the ROM address; and transferring the decrypted ROM data to an interconnect.

[0169] Exemplary embodiment 14: The method of exemplary embodiment 13, wherein the decrypting includes generating at least one key based on the ROM address, and generating decrypted ROM data by applying the at least one key to the encrypted ROM data.

[0170] Exemplary embodiment 15: The method of exemplary embodiment 14, wherein the applying includes performing a logical operation involving at least one key and the encrypted ROM data to generate decrypted ROM data.

[0171] Exemplary embodiment 16: The method of exemplary embodiment 15, wherein the decrypting includes generating manipulated ROM data by manipulating bits of the encrypted ROM data before performing the logical operation, and the performing includes performing the logical operation using at least one key and the manipulated ROM data to generate decrypted ROM data.

[0172] Exemplary embodiment 17: An integrated circuit including a security circuit for a secure read-only memory (ROM), the security circuit including a ROM array including ROM data at a plurality of ROM addresses, and a ROM controller coupled to the ROM array, the ROM controller configured to cryptographically bind each ROM address of the plurality of ROM addresses to each ROM data of the ROM data.

[0173] Exemplary embodiment 18: The integrated circuit of exemplary embodiment 17, wherein the ROM controller comprises an encryption circuit configured to decrypt the respective ROM data using the respective ROM addresses.

[0174] Exemplary embodiment 19: The integrated circuit of exemplary embodiment 18, wherein the encryption circuit is configured to generate at least one key based on each ROM address, and to decrypt each ROM data using the at least one key, thereby generating decrypted ROM data.

[0175] Exemplary embodiment 20: The integrated circuit of exemplary embodiment 19, wherein the encryption circuit is configured to generate decrypted ROM data using the at least one key by applying the at least one key to a version of each ROM data, the version corresponding to a manipulated version of each ROM data stored in the ROM array.

[0176] Exemplary embodiment 21: The integrated circuit of any one of exemplary embodiments 17 to 20, wherein the ROM controller is configured to process a combination of ROM bits and error correction code (ECC) bits that together form respective ROM data corresponding to respective ROM addresses.

[0177] Exemplary embodiment 22: An integrated circuit of any one of exemplary embodiments 17 to 21, wherein the ROM controller includes a consistency checker circuit coupled to the ROM array, the consistency checker circuit configured to gate access to the ROM array based on a check procedure applied to the ROM data and an expected digest (e.g., granting access to the ROM array (i.e., a service request to read data from the ROM array) only if the check procedure results in a match).

[0178] Exemplary embodiment 23: The integrated circuit of exemplary embodiment 22, wherein the integrity checker circuit is configured to implement the check procedure by extracting an expected digest from the ROM array, performing a comparison including the extracted expected digest and a digest calculated based on ROM data of the ROM array, and granting or denying access to the ROM array based on the comparison (e.g., granting if there is a match between the extracted expected digest and the digest calculated based on ROM data of the ROM array, but denying otherwise).

[0179] Exemplary embodiment 24: An apparatus for secure read-only memory (ROM), comprising: a ROM array including encrypted ROM data stored at a plurality of ROM addresses; and a ROM controller coupled to the ROM array, the ROM controller configured to read the encrypted ROM data from the ROM array based on a ROM address corresponding to the encrypted ROM data, obtain at least one digest value using the encrypted ROM data, and gate access to the ROM array based on the at least one digest value and the expected digest value (e.g., grant access to the ROM array only if a match is obtained between the at least one digest value and the expected digest, but block or deny access otherwise).

[0180] Exemplary embodiment 25: The apparatus of exemplary embodiment 24, wherein the ROM controller comprises an address adjustment circuit configured to generate an adjusted ROM address by adjusting the ROM address, and the ROM controller is configured to obtain the adjusted ROM address by adjusting the ROM address, and use the adjusted ROM address to read the encrypted ROM data stored at the multiple ROM addresses using the address adjustment circuit.

[0181] Exemplary embodiment 26: The apparatus of exemplary embodiment 24 or exemplary embodiment 25, wherein the ROM controller is configured to obtain at least one digest value based on applying at least one hash algorithm to the encrypted ROM data.

[0182] Exemplary embodiment 27: The apparatus of exemplary embodiment 26, wherein the ROM array and the ROM controller comprise a first peripheral device, the second peripheral device configured to implement one or more hash algorithms, and the ROM controller configured to obtain at least one digest value by communicating with the second peripheral device.

[0183] Exemplary Embodiment 28: The apparatus of any one of exemplary embodiments 24 to 27, wherein the ROM controller is configured to read the expected digest value from the ROM array.

[0184] Exemplary embodiment 29: The apparatus of exemplary embodiment 28, wherein the expected digest value is stored in the ROM array in unencrypted form.

[0185] Exemplary embodiment 30: The apparatus of exemplary embodiment 28, wherein the expected digest value is stored in the ROM array at a predetermined location corresponding to a determinable ROM address.

[0186] Exemplary embodiment 31: The apparatus of any one of exemplary embodiments 24 to 30, wherein in response to at least one digest value matching an expected digest value, the ROM controller is configured to grant access to the ROM array, thereby enabling a boot procedure to be performed using the encrypted ROM data.

[0187] Exemplary embodiment 32: The apparatus of any one of exemplary embodiments 24 to 31, wherein in response to at least one digest value not matching an expected digest value, the ROM controller is configured to block access to the ROM array, thereby preventing a boot procedure from being performed using the encrypted ROM data, and to send an alarm indication.

[0188] Exemplary Embodiment 33: The apparatus of any one of exemplary embodiments 24 to 32, wherein each respective encrypted ROM data of the encrypted ROM data is different from each other respective encrypted ROM data of the encrypted ROM data across the ROM array.

[0189] Exemplary embodiment 34: The apparatus of exemplary embodiment 33, wherein an encryption key associated with generating the encrypted ROM data is selected to ensure that each respective encrypted ROM data is different from each other respective encrypted ROM data of the encrypted ROM data across the ROM array. For example, the one or more encryption keys may be used in an iterative process performed to reduce the number of identical ROM data (e.g., to zero, or at least below a threshold).

[0190] Exemplary embodiment 35: The apparatus of exemplary embodiment 33, wherein an encryption algorithm associated with generating the encrypted ROM data is selected to ensure that each respective encrypted ROM data is different from each other respective encrypted ROM data of the encrypted ROM data across the ROM array. For example, one or more encryption algorithms may be used in an iterative process performed to reduce the number of identical ROM data (e.g., to zero or at least below a threshold).

[0191] Exemplary embodiment 36: A method for secure read-only memory (ROM), comprising reading encrypted ROM data from a ROM array based on a ROM address corresponding to the encrypted ROM data, the ROM array storing the encrypted ROM data at a plurality of ROM addresses, the method further comprising obtaining at least one digest value using the encrypted ROM data, and gating access to the ROM array based on the at least one digest value and an expected digest value.

[0192] Exemplary embodiment 37: The method of exemplary embodiment 36, wherein the reading includes adjusting a ROM address to generate an adjusted ROM address, and reading the encrypted ROM data from the ROM array using the adjusted ROM address.

[0193] Exemplary embodiment 38: The method of exemplary embodiment 36 or exemplary embodiment 37, wherein the gating includes blocking access to the ROM array in response to at least one digest value not matching an expected digest value.

[0194] Exemplary aspect 39: An integrated circuit including a security circuit with a read-only memory (ROM), the security circuit comprising a ROM array including a plurality of encrypted ROM lines, each encrypted ROM line of the plurality of encrypted ROM lines being distinct from each other encrypted ROM line of the plurality of encrypted ROM lines, the security circuit further comprising a ROM controller coupled to the ROM array and configured to control access to the ROM array in response to at least one digest value generated based on the plurality of encrypted ROM lines.

[0195] Exemplary embodiment 40: The integrated circuit of exemplary embodiment 39, further comprising a digest calculation circuit configured to calculate at least one digest value based on the plurality of encrypted ROM lines.

[0196] Exemplary embodiment 41: The integrated circuit of exemplary embodiment 40, wherein the digest calculation circuit is part of a ROM block that includes a ROM array and a ROM controller.

[0197] Exemplary embodiment 42: The integrated circuit of any one of exemplary embodiments 39 to 41, wherein an encryption key is selected to ensure that the multiple encrypted ROM lines do not overlap. For example, at least one encryption key (whether predefined or obtained in some manner) can be used in an iterative process that is performed to reduce the number of overlapping encrypted ROM lines (e.g., to zero, or at least below a threshold value).

[0198] Exemplary embodiment 43: The integrated circuit of any one of exemplary embodiments 39 to 42, wherein the encryption algorithm is selected to ensure that the multiple encrypted ROM lines do not overlap. For example, at least one encryption algorithm (whether predefined or obtained in some manner) can be used in an iterative process performed to reduce the number of overlapping encrypted ROM lines (e.g., to zero, or at least below a threshold).

[0199] Exemplary embodiment 44: A method for integrity checking with resilience of a read-only memory (ROM), comprising: generating a first set of a plurality of encrypted ROM lines by applying an encryption algorithm and an encryption key to a plurality of lines of the ROM; determining a quantity of duplicate encrypted ROM lines among the plurality of encrypted ROM lines; modifying at least one of the encryption algorithm or encryption key based on the quantity; and generating a second set of a plurality of encrypted ROM lines by applying the modified at least one encryption algorithm or encryption key to the plurality of lines of the ROM.

[0200] Exemplary embodiment 45: The method of exemplary embodiment 44, further comprising repeating the modifying, the applying of at least one modified encryption algorithm or encryption key, and the determining until the quantity is zero.

[0201] Exemplary Embodiment 46: The apparatus of any one of exemplary embodiments 24 to 35, wherein the ROM controller is configured to provide the at least one digest value to a component external to the ROM.

[0202] Examples of Electronic Devices for ROM Security 14 illustrates various components of an exemplary electronic device 1400 that can implement ROM security according to one or more described aspects. The electronic device 1400 can be implemented in any form as any one or combination of fixed, mobile, standalone, or embedded devices, consumer, computer, portable, user, server, communication, telephone, navigation, gaming, audio, camera, messaging, media playback, and / or other types of electronic devices 1400 such as smartphones shown in FIG. 1 as device 102. One or more of the illustrated components can be realized as discrete components or as integrated components on at least one integrated circuit of the electronic device 1400.

[0203] The electronic device 1400 may include one or more communications transceivers 1402 that enable wired and / or wireless communication of device data 1404, such as received data, transmitted data, or other information identified above. Exemplary communications transceivers 1402 include near field communications (NFC) transceivers, wireless personal area network (PAN) (WPAN) radios conforming to the various IEEE 802.15 (Bluetooth®) standards, wireless local area network (LAN) (WLAN) radios conforming to any of the various IEEE 802.11 (WiFi®) standards, wireless wide area network (WAN) (WWAN) radios for cellular phones (e.g., those conforming to 3GPP®), wireless metropolitan area network (MAN) (WMAN) radios conforming to the various IEEE 802.16 (WiMAX®) standards, infrared (IR) transceivers conforming to the Infrared Data Association (IrDA) protocol, and wired local area network (LAN) (WLAN) Ethernet transceivers.

[0204] The electronic device 1400 may also include one or more data input ports 1406 capable of receiving any type of data, media content, and / or other input, such as user selectable input, messages, applications, music, television content, recorded video content, and other types of audio, video, and / or image data received from content and / or data sources, including sensors such as microphones and cameras. The data input ports 1406 may include USB ports, coaxial cable ports, fiber optic ports for fiber optic interconnects or cabling, and other serial or parallel connectors (including internal connectors) for flash memory, DVDs, CDs, and the like. These data input ports 1406 may be used to couple the electronic device to components, peripherals, or accessories such as keyboards, microphones, cameras, or other sensors.

[0205] The electronic device 1400 of this example includes at least one processor 1408 (e.g., any one or more of an application processor, microprocessor, digital signal processor (DSP), controller, etc.), which may include a combined processor and memory system (e.g., implemented as part of an SoC) that processes (e.g., executes) computer-executable instructions to control the operation of the device. The processor 1408 may be implemented as an application processor, an embedded controller, a microcontroller, a security processor, an artificial intelligence (AI) accelerator, etc. In general, a processor or processing system may be implemented at least in part in hardware, which may include components of integrated circuits or on-chip systems, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), and other implementations in silicon and / or other materials.

[0206] Alternatively or additionally, the electronic device 1400 may be implemented in any one or combination of electronic circuitry, which may include software, hardware, firmware, or fixed logic circuitry implemented in association with processing and control circuitry, generally shown at 1410 (as electronic circuitry 1410). This electronic circuitry 1410 may implement executable or hardware-based modules (not shown in FIG. 14), such as through processing / computer-executable instructions stored on a computer-readable medium, through logic circuitry and / or hardware (e.g., FPGAs, etc.), etc.

[0207] Although not shown, electronic device 1400 may include a system bus, interconnect, crossbar, data transfer system, or other switch fabric that couples various components within the device. The system bus or interconnect may include any one or combination of different bus structures, such as a memory bus and memory controller, a peripheral bus, a universal serial bus, and / or a processor or local bus utilizing any of a variety of bus architectures.

[0208] The electronic device 1400 also includes one or more memory devices 1412 that allow for data storage, examples of which include random access memory (RAM), non-volatile memory (e.g., read only memory (ROM), flash memory, EPROM, EEPROM), and disk storage devices. Thus, the memory devices 1412 may be distributed across different logical storage levels of the system and in different physical components. The memory devices 1412 provide a data storage mechanism for storing device data 1404, other types of code and / or data, and various device applications 1420 (e.g., software applications or programs). For example, an operating system 1414 may be maintained as software instructions in the memory device 1412 and executed by the processor 1408.

[0209] In some embodiments, the electronic device 1400 also includes an audio and / or video processing system 1416, which processes audio data and / or passes audio and video data to an audio system 1418 and / or a display system 1422 (e.g., a video buffer or screen of a smartphone or camera). The audio system 1418 and / or the display system 1422 may include any device that processes, displays, and / or renders audio, video, display, and / or image data. The display data and audio signals can be communicated to the audio and / or display components via other similar communication links, such as an RF (radio frequency) link, an S-video link, an HDMI (High Definition Multimedia Interface), a composite video link, a component video link, a DVI (digital video interface), an analog audio connection, a video bus, or a media data port 1424. In some implementations, the audio system 1418 and / or the display system 1422 are external or separate components of the electronic device 1400. Alternatively, the display system 1422 may be an integrated component of the exemplary electronic device 1400, such as, for example, part of an integrated touch interface.

[0210] The electronic device 1400 of Figure 14 is an example implementation of the apparatus 102 of Figure 1, an example implementation of a device capable of implementing the analysis 344 of Figure 4, and an example implementation of a device capable of implementing any of the methods of Figures 9-13. Thus, the electronic device 1400 can include a security circuit 106, which can be a separate IC chip or can be included as part of another IC chip or device, such as a processor 1408, an electronic circuit 1410, or a memory device 1412. Thus, one or more of the illustrated components can be integrated on the same IC chip, such as a SoC, or at least on a single PCB.

[0211] As shown, the electronic device 1400 may additionally or alternatively include a compatibility analysis module 340. For example, the memory device 1412 may store the compatibility analysis module 340 and the processor 1408 may execute the compatibility analysis module 340. Thus, the memory device 1412 may store the peripheral device design code 342, the interface specification 332, etc. The electronic device 1400 may also, or instead, implement the iterative process of FIG. 10. Furthermore, the ROM 118 / 206 may include any of the components of FIGS. 4-6, for example, as part of the security circuit 106. Furthermore, the ROM 118 / 206 may be implemented in any of the components of the electronic device 1400 described above, as part of the security circuit 106 or separate from the security circuit 106. Thus, the principles of ROM security described herein may be implemented by or in association with the electronic device 1400 of FIG. 14.

[0212] Unless otherwise indicated by context, the use of the word "or" herein may be considered as "inclusive or" or the use of a term permitting the inclusion or application of one or more items linked by the word "or" (e.g., the phrase "A or B" may be interpreted as permitting only "A", permitting only "B", or permitting both "A" and "B"). Also, as used herein, a phrase referring to "at least one" of a list of items refers to any combination of those items, including single members. For example, "at least one of a, b, or c" includes a, b, c, ab, ac, bc, and abc, as well as multiple combinations of the same elements (e.g., aa, aaa, aab, aac, abb, acc, bb, bbb, bbc, cc, ccc, or other permutations of a, b, and c). Additionally, items depicted in the accompanying figures and terms discussed herein may refer to one or more items or terms, and thus the singular or plural forms of items and terms may be referred to interchangeably herein. Although an implementation of ROM security has been described in language specific to particular features and / or methods, the subject matter of the appended claims is not necessarily limited to the particular features or methods described. Rather, the particular features and methods are disclosed as example implementations of ROM security.

Claims

1. 1. An apparatus for a secure read only memory (ROM), comprising: a ROM array containing encrypted ROM data stored at a plurality of ROM addresses; a ROM controller coupled to the ROM array, the ROM controller comprising: reading the encrypted ROM data from the ROM array based on a ROM address corresponding to the encrypted ROM data; obtaining at least one digest value using the read encrypted ROM data; configured to gate subsequent access to the ROM array based on the at least one digest value and an expected digest value; each respective one of the encrypted ROM data is different from each other respective one of the encrypted ROM data across the ROM array.

2. the ROM controller includes an address adjustment circuit configured to adjust a ROM address to generate an adjusted ROM address; 2. The apparatus of claim 1, wherein the ROM controller is configured to adjust the ROM addresses using the address adjustment circuitry to read the encrypted ROM data stored at the multiple ROM addresses.

3. The apparatus of claim 1 or claim 2, wherein the ROM controller is configured to obtain the at least one digest value based on applying at least one hash algorithm to the encrypted ROM data.

4. the ROM array and the ROM controller comprise a first peripheral device; the second peripheral device is configured to implement one or more hashing algorithms; The apparatus of claim 3 , wherein the ROM controller is configured to obtain the at least one digest value by communicating with the second peripheral device.

5. The apparatus of claim 1 or claim 2, wherein the ROM controller is configured to read the expected digest value from the ROM array.

6. The apparatus of claim 5 , wherein the expected digest values ​​are stored in the ROM array in unencrypted form.

7. The apparatus of claim 1 or claim 2, wherein the ROM controller is configured to provide the at least one digest value to a component external to the ROM.

8. 3. The apparatus of claim 1 or claim 2, wherein in response to the at least one digest value matching the expected digest value, the ROM controller is configured to grant access to the ROM array to enable a boot procedure to be performed using the encrypted ROM data.

9. In response to the at least one digest value not matching the expected digest value, the ROM controller: Send an alarm indication and / or 3. An apparatus as claimed in claim 1 or claim 2, configured to prevent a boot procedure from being performed using the encrypted ROM data by blocking access to the ROM array.

10. 3. The apparatus of claim 1, wherein an encryption key associated with generation of the encrypted ROM data is selected to ensure that each respective encrypted ROM data is different from each other respective encrypted ROM data of the encrypted ROM data across the ROM array.

11. 3. The apparatus of claim 1, wherein an encryption algorithm associated with generating the encrypted ROM data is selected to ensure that each respective encrypted ROM data is different from each other respective encrypted ROM data of the encrypted ROM data across the ROM array.

12. 1. A method for a secure read only memory (ROM), comprising: reading the encrypted ROM data from a ROM array based on a ROM address corresponding to the encrypted ROM data, the ROM array storing the encrypted ROM data at a plurality of ROM addresses, the method further comprising: obtaining at least one digest value using the read encrypted ROM data; gating subsequent access to the ROM array based on the at least one digest value and an expected digest value; wherein each respective one of the encrypted ROM data is different from each other respective one of the encrypted ROM data across the ROM array.

13. The reading comprises: adjusting the ROM address to generate an adjusted ROM address; and reading the encrypted ROM data from the ROM array using the adjusted ROM address.

14. The gating comprises:

14. A method according to claim 12 or claim 13, comprising blocking access to the ROM array in response to the at least one digest value not matching the expected digest value.

Images