Non-Volatile Memory Controller Security Extension via Dynamic Firmware Loading
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data storage devices face challenges in achieving high security levels, especially when using flash memory with limited DRAM capacity, where the execution of security firmware code is hindered by insufficient storage space for logical-to-physical mapping information and security firmware code, and varying hardware specifications require compatibility across different devices.
Innovation Solution
A data storage device architecture that includes a memory controller operating non-volatile memory by loading an in-system program with base firmware code, security firmware code, and a function pointer structure, allowing the base firmware code to call security functions through an API, enabling operation at a higher security level and compatibility across different projects, even with limited DRAM capacity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security firmware code is executed in data storage devices with limited DRAM capacity, then security level is improved, but storage space for logical-to-physical mapping information and security firmware code becomes insufficient
Solution Approach 1:
The firmware is segmented into base firmware code and security firmware code, which are loaded separately into the data register. This segmentation allows the system to load only the necessary security firmware code when security operations are needed, rather than requiring all firmware to reside in limited DRAM capacity, thus resolving the storage space constraint while maintaining security functionality.
Solution Approach 2:
The system dynamically loads security firmware code from non-volatile memory to the data register when security operations are required, and releases the space afterward. This dynamic loading and releasing mechanism allows the limited DRAM capacity to be flexibly utilized, providing high security level functionality only when needed without permanently consuming storage space.
2Reliability
If security firmware code is loaded into data register, then security operations can be executed, but DRAM space is occupied and needs to be released afterward
Solution Approach 1:
The security firmware code is loaded into the data register periodically or on-demand when security operations are required, rather than being permanently resident. After the security operation completes, the code is released from the data register. This periodic loading and releasing pattern allows the system to maintain security operation capability when needed while preserving DRAM space availability for other operations.
3Adaptability or versatility
If base firmware code calls security functions through function pointer structure, then compatibility across multiple projects is improved, but device complexity increases
Solution Approach 1:
The function pointer structure serves as a universal interface that allows the base firmware code to call security functions without needing to know the specific implementation details. This universal calling mechanism enables the same base firmware to work across multiple projects and hardware configurations, improving compatibility while the underlying complexity is abstracted away through this standardized interface.
Data Source
AI summary
A security extension design for non-volatile memory is shown. There is an in-system program loaded into the non-volatile memory. A memory controller downloads the in-system program to a data register to provide base firmware code, a function pointer structure and security firmware code on the data register. The memory controller executes the base firmware code, and security functions of the security firmware code are called by the base firmware code through information recorded in the function pointer structure and thereby the memory controller is switched to operate the non-volatile memory at a higher security level. The security firmware code uses an application programming interface (API) and is compatible with multiple projects.