Memory Bank Segmentation for Immutable Firmware and Key Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing non-volatile memory technologies lack the ability to define and enforce immutable regions, which are crucial for secure storage of cryptographic keys and firmware integrity during firmware upgrades.
Innovation Solution
Implementing a memory bank with a first portion for immutable configuration and a controller to prevent data writes based on stored configuration information, using a DMA controller to buffer values and a processing circuit to verify operations, ensuring that only authorized changes are allowed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If non-volatile memory is made fully writable for firmware updates, then firmware can be updated, but security and data integrity are compromised
Solution Approach 1:
The memory space is segmented into immutable regions (for cryptographic keys and critical data) and mutable regions (for firmware and updateable data). This segmentation allows simultaneous firmware updates and protection of critical data, resolving the contradiction between adaptability and reliability.
Solution Approach 2:
Different regions of the memory are assigned different qualities: some regions are configured as immutable while others remain writable. This local differentiation enables the system to maintain data integrity in critical regions while allowing firmware updates in other regions, thus resolving the contradiction.
2Reliability
If cryptographic keys are stored in non-volatile memory, then secure storage is achieved, but unauthorized modification risk increases
Solution Approach 1:
Cryptographic keys are stored in a specifically segmented immutable region of non-volatile memory, separated from other data. This ensures that while the memory supports firmware updates, the cryptographic keys remain protected from unauthorized modification, resolving the contradiction between secure storage and modification risk.
Solution Approach 2:
The memory regions are pre-configured with immutability attributes before cryptographic keys are written. This preliminary configuration ensures that once keys are stored, they cannot be modified, thus achieving secure storage while eliminating unauthorized modification risk.
3Reliability
If memory regions are marked as immutable, then data integrity is protected, but manufacturing flexibility decreases
Solution Approach 1:
The immutability configuration is implemented dynamically through software-controlled memory management rather than hardwired constraints. This allows the system to configure immutable regions during manufacturing or initialization, providing both data integrity protection and manufacturing flexibility, thus resolving the contradiction.
Solution Approach 2:
The immutability attribute is implemented as a configurable parameter that can be set during manufacturing or initialization. This parameter-based approach allows flexible configuration of immutable regions while maintaining data integrity, resolving the contradiction between reliability and ease of manufacture.
Data Source
AI summary
Methods, apparatus, systems, and articles of manufacture are described corresponding to immutable configuration of memory devices. An example memory includes a memory bank including a first portion and a second portion, the second portion configured to store configuration information that specifies whether the first portion is immutable; and a controller coupled to the memory bank, the controller configured to determine whether to prevent data from being written to the first portion based on the configuration information.