Memory Controller AES Boot Decryption for Secure Firmware Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firmware in memory systems is vulnerable to unauthorized access and tampering, posing significant security risks as it is often stored in plaintext form, allowing third parties to obtain sensitive information.
Innovation Solution
Implementing a memory controller with an AES engine and processor to encrypt and decrypt configuration information of a trusted computing group (TCG) using cryptographic keys, ensuring that only authorized entities can access the plaintext configuration information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If firmware configuration information is stored in plaintext form in memory, then ease of access and operation is improved, but security and protection against unauthorized access deteriorates
Solution Approach 1:
The patent applies parameter changes by transforming the state of configuration information from plaintext to ciphertext form. The memory controller encrypts firmware configuration information using cryptographic algorithms, changing the representational parameter of the data from readable plaintext to encrypted ciphertext, thereby preventing unauthorized access while maintaining secure accessibility for authorized operations
Solution Approach 2:
The patent introduces an intermediary mechanism - the memory controller with encryption/decryption functionality - that mediates between the stored firmware and accessing entities. This intermediary encrypts configuration information before storage and decrypts it only when properly authenticated, acting as a security gateway that protects against unauthorized access while enabling legitimate access
2Object-affected harmful factors
If firmware configuration information is encrypted and stored in memory, then security and protection against tampering is improved, but device complexity increases
Solution Approach 1:
The patent applies universality by designing the memory controller to perform multiple functions: traditional memory control operations plus encryption and decryption operations. By integrating cryptographic functionality into the existing memory controller architecture, the system avoids adding separate dedicated security hardware, thereby reducing overall device complexity while maintaining comprehensive protection against tampering
Solution Approach 2:
The patent merges the encryption/decryption functions with the memory controller's existing data access pathways. The configuration information encryption and decryption operations are combined with the firmware loading and execution process, so that security operations occur seamlessly within the existing control flow rather than as separate complex subsystems
3Object-affected harmful factors
If firmware is stored in first memory in ciphertext form, then security is improved, but access speed and operation efficiency deteriorates
Solution Approach 1:
The patent applies preliminary action by performing decryption operations in advance during the firmware initialization phase. The memory controller decrypts the configuration information ciphertext before the firmware is fully loaded or executed, so that subsequent access to the configuration data occurs in plaintext form without requiring real-time decryption, thereby maintaining high access speed after initial setup
Data Source
AI summary
The present disclosure provides a method of operating a memory controller, a memory controller, and a memory system, and relates to the technical field of memories. The memory controller includes an Advanced Encryption Standard (AES) engine, a processor, and a first interface, and the memory controller is communicatively connected with a first memory through the first interface. The method includes: in response to the memory controller being powered on, obtaining, by the processor, firmware from the first memory through the first interface, wherein the firmware includes a configuration information ciphertext of a first trusted computing group (TCG); and decrypting, by the AES engine, the configuration information ciphertext of the first TCG based on a first key and a preset decryption algorithm, to obtain a configuration information plaintext of the TCG.