External Memory Encryption for XIP and MMIO Modes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Microcontrollers executing code from external memory devices face challenges in protecting the code from theft due to the lack of sufficient internal RAM for storing encrypted code images, which defeats the purpose of execute-in-place (XIP) code execution and does not provide effective protection against code theft.
Innovation Solution
Implementing encryption/decryption techniques that allow for on-the-fly encryption and decryption of code images stored on external memory devices using a strong encryption algorithm for addresses and a fast encryption function for data, ensuring secure access without significant latency or the need for additional RAM, by using a secret key to encrypt and decrypt data blocks during read and write operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code image is kept encrypted on external memory device and decrypted in internal RAM, then code theft protection is improved, but internal RAM size requirement increases significantly
Solution Approach 1:
The patent segments the code image into multiple blocks and processes them sequentially. Instead of loading the entire encrypted code image into internal RAM, the system divides it into manageable chunks (e.g., 512-byte blocks) that are decrypted and executed one at a time from external memory, dramatically reducing the internal RAM requirement while maintaining security.
Solution Approach 2:
The patent applies preliminary encryption to the code image before storing it on external memory. The code is encrypted using a secret key that remains secure within the microcontroller. This preliminary cryptographic protection ensures that even if the external memory is accessed physically, the code remains unintelligible without the key.
2Speed
If code image is copied to internal RAM for decryption, then decryption speed is improved, but internal cache/RAM memory requirement increases
Solution Approach 1:
The patent extracts the decryption function from the traditional RAM-based approach and implements it directly in the execution pipeline. The decryption operation is performed on-demand for each code block as it is fetched from external memory, eliminating the need to hold large amounts of data in internal RAM while maintaining continuous decryption capability.
3Quantity of substance
If external memory device is used for code storage, then memory capacity is improved, but vulnerability to code theft increases
Solution Approach 1:
The patent applies preliminary cryptographic protection (encryption) to the code image before it is stored on the external memory device. This anti-action prevents the harmful effect of code theft by ensuring that the code on external memory is unintelligible without the secret key. The encryption is applied in advance during code deployment, and the key never leaves the microcontroller.
4Reliability
If encryption operation is performed on external memory access, then code security is improved, but processing latency increases
Solution Approach 1:
The patent ensures continuity of useful action by integrating the decryption operation into the existing memory access pipeline. As each code block is fetched from external memory, decryption is performed immediately in the background without stalling the execution flow. This continuous processing minimizes the perceived latency while maintaining strong security.
Data Source
AI summary
Techniques for multiplexing between an execute-in-place (XIP) mode and a memory-mapped input/output (MMIO) mode for access to external memory devices are described herein. In an example embodiment, an IC device comprises a serial interface and a controller that is configured to communicate with external memory devices over the serial interface. The controller comprises a control register and a cryptography block. The control register is configured to indicate an XIP mode or a MMIO mode. The cryptography block is configured to encrypt and decrypt XIP data transfers to and from a first external memory device in the XIP mode, and to encrypt and decrypt MMIO data transfers to and from a second external memory device in the MMIO mode.