Data-locking memory module

Patent metadata

Field	Value
Publication number	US-11030118-B2
Application number	US-201715849507-A
Country	US
Kind code	B2
Filing date	Dec 20, 2017
Priority date	Mar 7, 2017
Publication date	Jun 8, 2021
Grant date	Jun 8, 2021

Abstract

In a memory module, encryption information is received from an external source and stored exclusively within a non-persistent storage element such that the encryption information is expunged from the memory module upon power loss. Write data is received and encrypted using the encryption information stored within the non-persistent storage element to produce encrypted data which is stored, in turn, within a nonvolatile storage of the memory module.

First claim

What is claimed is:

1. A method of operation within a memory module, the method comprising:
receiving encryption information from a source external to the memory module;
storing the encryption information exclusively within a non-persistent storage element of the memory module such that the encryption information is expunged from the memory module upon power loss;
receiving write data via a plurality of data paths and storing the write data within dynamic random access memory (DRAM) components that are (i) coupled respectively to the plurality of data paths such that a respective portion of the write data is stored within each of the DRAM components, and (ii) distinct from the non-persistent storage element; and
after storing the write data within the DRAM components, receiving information indicative of potential security breach with respect to the write data other than a power-loss event, and, in response to receiving the information indicative of potential security breach:
encrypting the write data using the encryption information stored within the non-persistent storage element to produce encrypted data;
storing the encrypted data within the memory module in a nonvolatile storage that is distinct from the DRAM components and the non-persistent storage element; and
after storing the encrypted data in the nonvolatile storage, expunging the encryption information from the non-persistent storage element and expunging the write data from the DRAM components.

2. The method of claim 1 wherein expunging the encryption information from the non-persistent storage element comprises overwriting the encryption information within the non-persistent storage element.

3. The method of claim 1 wherein storing the write data within the memory module comprises receiving a command/address value within a register clock driver component of the memory module and outputting corresponding command/address values from the register clock driver to command/address inputs of the DRAM components to instruct the DRAM components to store the write data.

4. The method of claim 1 wherein receiving the command/address value within the register clock driver component of the memory module comprises receiving the command/address value via a unidirectional command/address signaling path coupled to the register clock driver.

5. The method of claim 1 wherein
encrypting the write data using the encryption information comprises transferring the write data from the DRAM components to a nonvolatile storage controller having encryption circuitry therein; and
each of the DRAM components is a dual-ported component having a primary data interface coupled to a respective one of the data paths and a secondary data interface coupled to the nonvolatile storage controller.

6. The method of claim 1 wherein expunging the write data from the DRAM components comprises disabling operation of the DRAM components in a manner that forces loss of contents stored therein despite persistence of power to the memory module.

7. The method of claim 1 wherein storing the encryption information exclusively within the non-persistent storage element comprises storing the encryption information within a static random access memory (SRAM).

8. The method of claim 1 wherein:
encrypting the write data using the encryption information comprises transferring the write data from the DRAM components to a nonvolatile storage controller having encryption circuitry therein; and
each of the DRAM components is a single-ported component having a data interface switchably coupled to (i) a respective one of the data paths during write data reception and (ii) the nonvolatile storage controller for encryption of the write data.

9. The method of claim 1 further comprising
receiving a memory read command and address corresponding to the encrypted data; and
in response to the memory read command:
retrieving the encrypted data from the nonvolatile storage using the address;
decrypting the encrypted data to produce unencrypted read data; and
outputting the unencrypted read data from the memory module.

10. The method of claim 1 wherein receiving the encryption information comprises receiving information that constitutes or enables derivation of one or more data encryption keys.

11. A memory module comprising:
a first interface to receive encryption information from a source external to the memory module;
a non-persistent storage element and circuitry to store the encryption information exclusively within the non-persistent storage element such that the encryption information is expunged from the memory module upon power loss;
a second interface;
dynamic random access memory (DRAM) components to receive the write data via respective data paths coupled to the second interface and to store respective portions of the write data such that the write data is collectively stored within the DRAM components;
encryption circuitry;
non-volatile storage; and
control circuitry to receive information indicative of potential security breach with respect to the write data, other than a power-loss event, after the write data has been stored within the DRAM components and, in response to receiving the information indicative of potential security breach:
enable the encryption circuitry to produce encrypted data by encrypting the write data using the encryption information stored within the non-persistent storage element;
store the encrypted data within the nonvolatile storage; and
after the encrypted data has been stored within the nonvolatile storage, expunge the encryption information from the non-persistent storage element and expunge the write data from the DRAM components.

12. The memory module of claim 11 wherein the control circuitry to expunge the encryption information from the non-persistent storage element comprises circuitry to overwrite the encryption information within the non-persistent storage element.

13. The memory module of claim 11 further comprising a register clock driver component to receive a command/address value and, in response, output control signals to the DRAM components to instruct the DRAM components to store the write data.

14. The memory module of claim 11 wherein the register clock driver component comprises an unidirectional signaling interface to receive the command/address value via a unidirectional command/address signaling path.

15. The memory module of claim 11 wherein each of the DRAM components is a dual-ported component having a primary data interface coupled to a respective one of the data paths and a secondary data interface coupled to the encryption circuitry.

16. The memory module of claim 11 wherein the control circuitry to expunge the write data from the DRAM components comprises circuitry to disable operation of the DRAM components in a manner that forces loss of contents stored therein-despite persistence of power to the memory module.

17. The memory module of claim 11 wherein the non-persistent storage element comprises static random access memory (SRAM).

18. The memory module of claim 11 wherein each of the DRAM components is a single-ported component having a data interface switchably coupled to (i) a respective one of the data paths during write data reception and (ii) the encryption circuitry to enable transfer of the write data thereto following reception of the information indicative of potential security breach.

19. The memory module of claim 11 wherein the encryption information comprises information that constitutes or enables derivation of on

Assignees

• Rambus Inc

Inventors

• Shallal Aws
• Giddens Larry Grant
• Kochak Sarvagya

Classifications

• G06F21/575

  Secure boot · CPC title

• G06F3/0679

  Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP] · CPC title

• G06F3/0658

  Controller construction arrangements · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title

• G06F3/0623

  in relation to content · CPC title