Memory Protection Logic for Non-Volatile Memory Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory protection mechanisms in integrated-circuit devices are vulnerable to malicious attacks, particularly when processors operate in privileged mode, and may not effectively prevent sensitive code from being read or modified, especially in systems lacking traditional operating systems.
Innovation Solution
The implementation of a memory protection logic that controls access to a variable protectable region of non-volatile memory based on protection configuration data, where writing to or erasing the protection configuration region is only allowed when the protectable region is in an erased state, and read/write requests are managed by separate hardware logic independent of the processor, ensuring that sensitive code cannot be read or modified without proper authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory protection mechanisms are implemented using processor privilege modes, then access control to memory regions can be achieved, but the system becomes vulnerable to malicious attacks when the processor operates in privileged mode and cannot effectively protect sensitive code in systems lacking traditional operating systems
Solution Approach 1:
The patent extracts the memory protection function from the processor's privilege mode mechanism and implements it as independent hardware logic. This protection logic operates autonomously to control access to the protection configuration region, preventing malicious code from exploiting processor privilege modes to bypass protection. The extraction separates the protection mechanism from the potentially compromised processor execution modes.
Solution Approach 2:
The patent introduces an intermediary protection logic layer between the processor and the memory system. This intermediary hardware component intercepts and controls all access requests to the protection configuration region, regardless of the processor's privilege mode. It acts as a mediator that enforces protection rules independently, preventing direct access that could bypass processor-level security mechanisms.
2Adaptability or versatility
If the protection configuration region allows flexible writing and erasing, then the system can be easily reconfigured for different protection needs, but the protection mechanism becomes vulnerable to attacks where attackers can modify protection settings without destroying sensitive data
Solution Approach 1:
The patent applies preliminary anti-action by requiring that the protection configuration region be in an erased state before any write operation can occur. This pre-condition check prevents attackers from modifying protection settings while sensitive data remains in memory. The system proactively blocks potential attacks by enforcing that configuration changes can only happen when protected data has been erased, thus preventing the scenario where both data and protection settings coexist in a vulnerable state.
Solution Approach 2:
The patent requires that data in the protectable region be erased before the protection configuration region can be written to or erased. This preliminary action ensures that sensitive information is destroyed before protection mechanisms can be modified. By enforcing this sequence, the system prevents attackers from resetting protection flags after having read or copied sensitive data, thereby maintaining security even though reconfiguration is possible.
3Duration of action of stationary object
If read protection flags are stored in non-volatile memory, then protection settings persist across resets, but attackers can potentially reset the read protection flag to access sensitive executable code
Solution Approach 1:
The patent enforces that data in the protectable region must be erased before the protection configuration region can be modified. This preliminary erasure action ensures that even if attackers manage to reset protection flags, the sensitive data has already been destroyed and cannot be accessed. The persistence of protection settings is maintained through non-volatile storage, but the pre-condition of data erasure prevents unauthorized access scenarios.
Solution Approach 2:
The system applies preliminary anti-action by blocking any write or erase operations to the protection configuration region unless the protectable region is already erased. This pre-emptive measure counteracts potential attacks where adversaries attempt to reset protection flags after exfiltrating data. The anti-action is built into the memory control logic, making it impossible to modify protection settings while sensitive data remains intact in non-volatile memory.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An integrated-circuit device (1) comprises a processor (7), non-volatile memory (13), non-volatile memory control logic (20), and memory protection logic (9). The memory protection logic (9) is arranged to control access to a protectable region of the non-volatile memory (13) in dependence on protection configuration data stored in a protection-configuration region of the non-volatile memory. The non-volatile memory control logic (20) is arranged to prevent writing to any portion of the protection-configuration region unless that portion is in an erased state. The non-volatile memory control logic (20) is further arranged to allow the protection-configuration region to be erased only if the protectable region is in an erased state.