Nonvolatile Memory Boot Code Verification Deferral
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional nonvolatile memory devices used for storing boot code in automotive systems face challenges in achieving fast, secure, and resilient boot operations due to security concerns and performance impacts from code verification processes, particularly when using external NOR flash memory.
Innovation Solution
Implementing a system where the integrity check of externally stored boot code is shifted to an application layer after basic boot functions are complete, allowing the system to boot quickly while maintaining the ability to recover from fault states by using a nonvolatile memory device to control whether normal or recovery code is executed based on its state, and deferring code verification until all boot code has been executed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code verification is performed before MCU execution of boot code, then security is improved, but boot time increases
Solution Approach 1:
The patent implements preliminary authentication of the external nonvolatile memory device before boot code execution. The authentication process verifies the identity and integrity of the memory device storing boot code, establishing trust before the code is loaded and executed. This preliminary security measure allows subsequent boot operations to proceed without repeated verification overhead, thus improving security while minimizing boot time impact.
Solution Approach 2:
The patent segments the security verification process into distinct phases: device authentication, boot code execution, and application-layer integrity verification. By separating these functions and performing them at appropriate times, the system avoids the bottleneck of performing all verification before execution, thereby maintaining security while reducing boot time.
2Reliability
If code verification is performed early in boot process, then security is improved, but system performance deteriorates
Solution Approach 1:
The patent performs preliminary authentication of the external memory device and establishes security credentials before boot code execution. This preliminary action ensures that security checks are completed once during initialization, allowing the system to operate at full performance during normal execution without repeated verification overhead.
Solution Approach 2:
The patent introduces an authentication intermediary layer between the MCU and external memory device. This intermediary verifies device identity and establishes secure communication channels, allowing subsequent data transfers and operations to proceed without continuous security checks, thus maintaining both security and performance.
3Ease of manufacture
If external NOR flash is used for boot code storage, then cost is reduced, but security concerns increase
Solution Approach 1:
The patent implements preliminary device authentication mechanisms that verify the identity and integrity of the external NOR flash device before allowing boot code execution. This authentication process establishes security credentials and trust relationships, enabling cost-effective external storage while maintaining security through cryptographic verification of device identity and code integrity.
Data Source
AI summary
A storage device can include at least one nonvolatile (NV) memory array that includes a first section having a first physical address range, and a second section having a second physical address range. A nonvolatile fault indication can be set to at least a fault state or a no-fault state. A memory watchdog circuit configured to set the fault indication to the fault state in response to an expiration of a predetermined watchdog period, the watchdog period being reset in response to a defer indication. An address mapping circuit can be configured to, in response to the fault indication having the no fault state, mapping input addresses to the first physical addresses range, and in response to the fault indication having the fault state, mapping the same input addresses to the second physical address range. Corresponding methods and systems are also disclosed.