Nonvolatile memory device with regions having separately programmable secure access features and related methods and systems

Patent metadata

Field	Value
Publication number	US-11411747-B2
Application number	US-202017120415-A
Country	US
Kind code	B2
Filing date	Dec 14, 2020
Priority date	Jul 25, 2019
Publication date	Aug 9, 2022
Grant date	Aug 9, 2022

Abstract

A device can include a plurality of regions, each region including a plurality of nonvolatile memory cells; a permission store configured to store a set of permission values, including at least one permission value for each region in a nonvolatile fashion; and access control circuits configured to control access to each region according to the permission value for the region, including one or more of requiring authentication to access the region, encrypting data read from the region, and decrypting data for storage in the region. Related methods and systems are also disclosed.

First claim

What is claimed is:

1. A memory device, comprising:
non-volatile memory (NVM) including a plurality of regions, each region having at least one corresponding access restrictions value;
a region configuration store configured to store access restrictions values of the plurality of regions;
a key store configured to store at least one key value that is exclusive to each region; and
access control circuits configured to control access to each region based on the at least one corresponding access restrictions value and the at least one key value of each region.

2. The memory device of claim 1 , wherein the access control circuits have access to the region configuration store and the key store, and is further configured to:
authenticate data received that is directed to a first region of the plurality of regions using at least one corresponding key value of the first region; and
generate message authentication codes (MACs) with at least one key value of a second region of the plurality of regions for responses to accesses to the second region.

3. The memory device of claim 1 , wherein the access control circuits have access to the region configuration store and the key store, and are further configured to:
decrypt data received that are directed to a first region of the plurality of regions using at least one corresponding key value of the first region; and
encrypt data read from a second region of the plurality of regions with at least one corresponding key value of the second region.

4. The memory device of claim 1 , further comprising:
a command decoder configured to decode commands received from external devices, wherein the command decoder is further configured to determine nature of the commands including at least one of: read, erase, and program.

5. The memory device of claim 1 , further comprising:
an index store configured to store index values for each region of the plurality of regions, each index value being programmable to point to one of the at least one key value of each region.

6. The memory device of claim 1 , wherein the key values stored in the key store are at least one of: one-time keys, limited time use keys, keys to enable generation of ephemeral session keys for transactions between the memory device and external devices.

7. The memory device of claim 1 , further comprising:
a non-volatile monotonic counter (NMC) section including at least one NMC configured to generate an essentially non-repeating count value, wherein the access control circuits include authentication circuits configured to authenticate received data with the count value of the at least one NMC and generate authentication values for transmission with the count value of the at least one NMC.

8. The memory device of claim 1 , wherein the NVM includes NOR flash memory cells.

9. The memory device of claim 1 , further comprising a deprecator module configured to limit repeated usage of the at least one key values of each region.

10. The memory device of claim 1 , further comprising a manufacturer store configured to selectively store an access key for each region of the plurality of regions according to a customer, each access key enabling access to a corresponding region by a device manufacturer.

11. A system, comprising:
a host device including a communication module;
a non-volatile memory (NVM) device including a plurality of regions, each region having at least one corresponding access restrictions value, wherein the NVM device further includes:
a region configuration store configured to store access restrictions values of the plurality of regions;
access control circuits including authentication circuits and encryption circuits, wherein the access control circuits are configured to control access to each region based on the at least one corresponding access restrictions value; and
a non-volatile monotonic counter (NMC) section including at least one NMC configured to generate essentially non-repeating count values, wherein the authentication circuits are configured to use the count values to prevent replay attacks from the host device, and wherein the count values are transmitted to the host device to generate message authentication codes (MAC).

12. The system of claim 11 , wherein the NVM device further comprises:
a key store configured to store a plurality of region keys for each region.

13. The system of claim 12 , wherein the authentication circuits are configured to:
authenticate received data directed to a first region of the plurality of regions with a region key for the first region; and
generate message authentication codes (MACs) with a region key for a second region of the plurality of regions for responses to accesses to the second region.

14. The system of claim 12 , wherein the encryption circuits are configured to:
decrypt received data addressed to a first region of the plurality of regions with a region key for the first region; and
encrypt data read from a second region of the plurality of regions with a region key for the second region.

15. The system of claim 11 , wherein upon receipt an access request from the host device that identifies a first region of the plurality of regions, the access control circuits are further configured to determine, based at least partially on an access restrictions value of the first region, access permission types of the first region including at least one of: unrestricted, read only, write protected, read and write protected, and encrypted.

16. The system of claim 11 , wherein the host device further includes a plurality of processing elements, and a first processing element has access to a region key for a first region of the plurality of regions, and a second processing element has access to a region key for a second region of the plurality of regions and cannot access the first region.

17. The system of claim 12 , wherein the NVM device further comprises an index store configured to store index values for each region of the plurality of regions, each index value being programmable to point to one of the plurality of region keys for each region.

18. The system of claim 11 , wherein the NMC section further includes count configuration store configured to store count configuration values provided to the at least one NMC, wherein the count configuration values are configured to alter features of the at least one NMC including at least one of: count direction, count span, count value size, count value format, starting count value, and operations that trigger activation of a new count value.

19. The system of claim 11 , further comprising a communication bus coupling the host device and the NVM device.

20. The system of claim 11 , wherein the plurality of regions includes at least one NOR flash memory array.

Assignees

• Cypress Semiconductor Corp
• Infineon Technologies LLC

Inventors

• Van Antwerpen Hans
• Zitlaw Clifford
• Rosner Stephan
• Yogev Yoav
• Krishnegowda Sandeep
• Wilson Steven

Classifications

• G06F21/78 Primary

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F3/0644

  Management of space entities, e.g. partitions, extents, pools · CPC title