SoC Flash Memory Secure Zone Architecture for Multi-Party Code Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack effective protection of code developed by one party from piracy when multiple parties are involved in embedded software development, as traditional security mechanisms do not prevent unauthorized access or copying of intellectual property stored in non-volatile memory.
Innovation Solution
A code security architecture that divides flash memory into multiple secure zones, allowing each party to have dedicated sectors with password-protected access, enabling secure development and execution while preventing direct reading or writing between zones, using a flash controller and code security module to manage access and enforce zone security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security mechanisms (MMU or MPU) are used, then supervisor vs. user mode protection is provided, but code developed by one party cannot be protected from piracy when a second party is also developing code for the system
Solution Approach 1:
The patent divides the flash memory into multiple secure zones (e.g., Zone 0, Zone 1, Zone 2) where each zone can be independently protected with its own password. This segmentation allows different parties to have their code stored in separate zones with individual security controls, enabling multi-party development while preventing piracy of each party's intellectual property
Solution Approach 2:
Each secure zone is configured with specific security attributes including a unique password, read protection, and write protection. This local quality approach allows customization of security parameters for each zone, enabling fine-grained control over code protection for different parties while maintaining overall system security
2Ease of operation
If flash memory is made accessible for development, then code can be written and executed, but unauthorized reading or copying of code becomes possible
Solution Approach 1:
The patent implements password protection and security zone configuration before code is written to flash memory. The secure zones are pre-configured with passwords and protection attributes during system initialization or manufacturing, establishing security controls in advance that prevent unauthorized reading or copying while still allowing authorized development activities
Solution Approach 2:
The patent introduces a security module that acts as an intermediary between the processor and flash memory. This security module intercepts and controls all access requests to flash memory, verifying passwords and enforcing zone-specific protection rules, thereby mediating between development access needs and code protection requirements
Data Source
AI summary
Multiple secure environments are established within a system on a chip (SoC) by defining a first secure region within a non-volatile memory in the SoC with a first set of parameters written into a predefined parameter region of the non-volatile memory. A second secure region within the non-volatile memory may be defined at a later time by a second set of parameters written into another predefined parameter region of the non-volatile memory. A security module is initialized each time the SoC is powered on by transferring the first set of parameters and the second set of parameters from the parameter region to the security module in a manner that does not expose the first set of parameters or the second set of parameters to a program being executed by the processor. The multiple secure regions of the SoC are enforced by the security module according to the parameter data.