Physically Secure Memory Partitioning with Hardware Access Boundaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory devices are vulnerable to physical attacks and hardware faults that can cause unauthorized access to secure data stored alongside plain data, despite logical separation techniques.
Innovation Solution
Implementing hardware measures such as hardwiring address bus lines, maintaining a large Hamming distance between secure and plain partitions, using a dedicated control signal, and incorporating Error Detection Codes (EDC) to prevent unauthorized access to secure partitions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If memory is partitioned into secure and non-secure regions using logical separation techniques, then data storage flexibility is improved, but security against physical attacks deteriorates
Solution Approach 1:
The memory device is segmented into multiple independent access circuits (first access circuit for secure partition, second access circuit for non-secure partition) that are physically separated and cannot cross-access partitions. This segmentation ensures that even if one access circuit is compromised, the other partitions remain protected.
Solution Approach 2:
An intermediary control mechanism is introduced that monitors and controls access circuit operations. The system includes control logic that prevents access circuits from generating addresses outside their authorized partition ranges, acting as a mediator between the access circuits and memory partitions to enforce security boundaries.
2Speed
If access circuits are allowed to generate addresses dynamically for flexible memory access, then access speed is improved, but vulnerability to fault injection attacks increases
Solution Approach 1:
The system applies preliminary anti-action by pre-configuring access circuits with hardwired address range limitations and implementing control logic that proactively prevents address generation outside authorized ranges. This preemptive measure blocks fault injection attacks before they can cause unauthorized access, while still allowing dynamic address generation within safe boundaries.
Solution Approach 2:
The invention changes the parameter of address generation by implementing controlled dynamic addressing where access circuits can generate addresses dynamically within their authorized partition ranges, but the address space parameter is constrained by hardware boundaries. This maintains access speed while preventing attacks that rely on generating addresses in unauthorized regions.
Data Source
Figure 1~2
Figure 3
AI summary
A memory device (20) includes a memory (24), a secure-access circuit (36), a plain-access circuit (40), and protection hardware (42). The memory (24) includes at least a secure-storage partition (28) assigned a first address range and a plain-storage partition (32) assigned a second address range, disjoint from the first address range. The secure-access circuit (36) is configured to access the secure-storage partition (28) by generating addresses in the first address range. The plain-access circuit (40) is configured to access the plain-storage partition (32) by generating addresses in the second address range. The protection hardware (42) is configured to prevent the plain-access circuit (40) from accessing the first address range assigned to the secure-storage partition (28).