Securing data logs in memory devices

Patent metadata

Field	Value
Publication number	US-11210238-B2
Application number	US-201916358236-A
Country	US
Kind code	B2
Filing date	Mar 19, 2019
Priority date	Oct 30, 2018
Publication date	Dec 28, 2021
Grant date	Dec 28, 2021

Abstract

An apparatus including non-volatile memory to store a forensic key and data, the data received from a host computing system. A processing device is coupled to the non-volatile memory and is to: allow writing the data, by the host computing system, to a region of the non-volatile memory; in response to a lock signal received from the host computing system, assert a lock on the region of the non-volatile memory, the lock to cause a restriction on access to the region of the non-volatile memory by an external device; and provide unrestricted access, by the external device, to the region of the non-volatile memory in response to verification of the forensic key received from the external device.

First claim

What is claimed is:

1. An apparatus comprising:
non-volatile memory to store a forensic key and data, the data received from a host computing system; and
a processing device coupled to the non-volatile memory, wherein the processing device is to:
allow writing the data, by the host computing system, to a region of the non-volatile memory;
detect a power loss of the non-volatile memory;
in response to the power loss:
detect a lock signal comprising information embedded within an opcode of a serial peripheral interface (SPI) command received from the host computing system, the information specifying a restriction on access to the region of the non-volatile memory;
retrieve the information from the opcode of the SPI command; and
assert, responsive to the information, a lock on the region of the non-volatile memory, the lock to cause the restriction on access to the region of the non-volatile memory by an external device; and

provide unrestricted access, by the external device, to the region of the non-volatile memory in response to verification of the forensic key received from the external device.

2. The apparatus of claim 1 , wherein the restriction on access comprises read-only access to the region of the non-volatile memory.

3. The apparatus of claim 1 , wherein the restriction on access comprises writing to only erased sectors of the region of the non-volatile memory.

4. The apparatus of claim 1 , wherein the restriction on access comprises disallowance of erasure of one or more sectors of the region of the non-volatile memory.

5. The apparatus of claim 1 , wherein the restriction on access comprises full access to some sectors and no access to other sectors of the region of the non-volatile memory.

6. The apparatus of claim 1 , wherein the restriction on access comprises limited access to some sectors and no access to other sectors of the region of the non-volatile memory.

7. The apparatus of claim 1 , wherein the non-volatile memory comprises one of ferroelectric random access memory (FRAM) or magnetoresistive random access memory (MRAM).

8. The apparatus of claim 1 , further comprising a lock pin coupled to the processing device, wherein the lock pin is asserted by the lock signal to assert the lock.

9. The apparatus of claim 1 , wherein the lock comprises a memory location in the region of the non-volatile memory to which a lock command, within the lock signal, is written.

10. A method comprising:
in response to powering up a non-volatile memory device, restricting, by a processing device of the non-volatile memory device, access to a memory region of the non-volatile memory device, wherein the non-volatile memory device stores a cryptographic key;
authenticating, by the processing device using the cryptographic key, secure interaction with a host computing system, wherein the host computing system also stores the cryptographic key;
unrestricting, by the processing device, access to the memory region of the non-volatile memory device in response to successful authentication;
logging, by the processing device, data received from the host computing system within the memory region of the non-volatile memory device;
detecting, by the processing device, a power loss of the non-volatile memory device;
receiving, from the host computing system responsive to the power loss, a lock signal comprising information embedded within an opcode of a serial peripheral interface (SPI) command, the information specifying a restriction on access to the memory region of the non-volatile memory; and
restricting, by the processing device, access to the memory region of the non-volatile memory device with restrictions corresponding to the information.

11. The method of claim 10 , further comprising:
in response to powering up the non-volatile memory device after the power loss, authenticating, by the processing device using one of the cryptographic key or a forensic key, secure interaction with an external device;
unrestricting, by the processing device, access by the external device to the memory region of the non-volatile memory device in response to successful authentication with the external device; and
allowing reading, by the external device, of the data logged in the memory region of the non-volatile memory device.

12. The method of claim 10 , wherein restricting access to the memory region of the non-volatile memory device comprises allowing read-only access.

13. The method of claim 10 , wherein restricting access to the memory region of the non-volatile memory device comprises allowing writing to only erased sectors of the memory region.

14. The method of claim 10 , wherein restricting access to the memory region of the non-volatile memory device comprises disallowance of erasure of one or more sectors of the memory region.

15. The method of claim 10 , wherein restricting access to the memory region of the non-volatile memory device comprises allowing full access to some sectors and no access to other sectors of the memory region.

16. The method of claim 10 , wherein restricting access to the memory region of the non-volatile memory device comprises allowing limited access to some sectors and no access to other sectors of the memory region.

17. A system comprising:
a non-volatile memory (NVM) device, wherein the NVM device comprises a processing device and NVM, wherein the NVM is to store a forensic key and data;
a host computing system coupled to the NVM device, the host computing system comprising a processor to write the data to the NVM until a lock is detected on the NVM device; and
wherein the processing device is to:
detect a power loss of the non-volatile memory;
detect, responsive to the power loss, a lock signal received from the host computing system, the lock signal comprising information embedded within an opcode of a serial peripheral interface (SPI) command, the information specifying a restriction on access to a region of the non-volatile memory;
assert, responsive to the information retrieved from the opcode of the SPI command, the lock on the non-volatile memory, wherein the lock includes the restriction on access;
verify the forensic key received from one of the host computing system or an external computing device coupled to the NVM device; and
provide unrestricted access, by the one of the host computing system or the external computing device, to the NVM of the non-volatile memory device in response to verification of the forensic key.

18. The system of claim 17 , wherein the processor is to transmit the lock signal to the NVM device in response to one of a power loss event or a crash event detected by the processor.

19. The system of claim 17 , wherein the processing device is further to, before receipt of the lock signal:
authenticate secure interaction with the host computing system using a cryptographic key; and
allow logging of the data in the NVM in response to successful authentication.

20. The system of claim 17 , wherein the non-volatile memory device comprises one of ferroelectric random access memory (FRAM) or magnetoresistive random access memory (MRAM).

Assignees

• Cypress Semiconductor Corp

Inventors

• Avanindra Avi
• Rosner Stephan
• Zitlaw Cliff

Classifications

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F2221/2101

  Auditing as a secondary aspect · CPC title

• G06F12/1466 Primary

  Key-lock mechanism · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title