Flash-Based OTP Control for Secure Memory Subsystems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional microcontrollers using one-time programmable (OTP) memories for security applications incur high costs and reduce portability, while security modules without OTP memories are susceptible to replay attacks and have limitations in encrypted data verification.
Innovation Solution
A hardware security module with a controller that manages OTP operations, inhibiting shared memory operations during OTP writes, ensuring confidentiality and immutability, and using existing flash controller hardware to emulate OTP memory, reducing costs and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dedicated OTP memory blocks with hardware logic are used, then security functionality is improved, but cost increases and portability decreases
Solution Approach 1:
The patent merges OTP memory functionality with existing flash memory subsystem by using the same memory controller and interface infrastructure. The flash memory is configured to operate in OTP mode through controller management, eliminating the need for separate dedicated OTP hardware blocks and reducing overall system complexity and cost.
Solution Approach 2:
The existing flash memory controller is made multi-functional by enabling it to handle both regular flash operations and OTP write operations. The controller can switch between different operational modes (shared memory access vs. OTP write mode) based on system requirements, allowing a single component to serve multiple purposes.
2Device complexity
If encryption is used to store sensitive data without OTP memory, then cost is reduced, but susceptibility to replay attacks increases
Solution Approach 1:
The patent introduces a controller as an intermediary between the flash memory and other system components. This controller implements security logic that verifies encrypted data and prevents replay attacks by managing access control and verification processes, thereby enhancing security without requiring dedicated OTP hardware.
3Productivity
If OTP write operations are performed simultaneously with shared memory operations, then productivity is improved, but data integrity and security are compromised
Solution Approach 1:
The system dynamically adjusts its operational state based on the type of operation being performed. During OTP write operations, the controller transitions to a restricted mode where shared memory operations are inhibited. This dynamic state change ensures data integrity while allowing maximum productivity during normal operations. The controller manages timing and state transitions to balance security requirements with system productivity.
Data Source
AI summary
An apparatus includes: a hardware security module; a processor; a memory subsystem; and a controller. The memory subsystem includes a write interface and a memory. The memory includes a first region that is a one-time programmable (OTP) region, and a second region that is a shared region. The controller is between the hardware security module, the processor, and the memory subsystem. The controller is configured to: receive an OTP write request from the hardware security module; inhibit the providing of shared memory operations by the processor responsive to the OTP write request and an acknowledgment from the processor; cause OTP data related to the OTP write request to be written to the first region of the memory; clear storage of the write interface after writing the OTP data is complete; and cease to inhibit the providing of shared memory operations after the storage of the write interface is cleared.