Secured communication from within non-volatile memory device

Patent metadata

Field	Value
Publication number	US-11722467-B2
Application number	US-202217591824-A
Country	US
Kind code	B2
Filing date	Feb 3, 2022
Priority date	Jun 19, 2018
Publication date	Aug 8, 2023
Grant date	Aug 8, 2023

Abstract

An apparatus includes a non-volatile memory (NVM) device coupled to a host, the NVM device including a processing device to: receive a communication packet from a server via the host computing system that is coupled to the NVM device and communicatively coupled to the server, the communication packet comprising clear text data that requests to initiate secure communications; perform a secure handshake with the server, via communication through the host computing system, using a secure protocol that generates a session key; receive data, via the host computing system, from the server within a secure protocol packet, wherein the data is inaccessible to the host computing system; authenticate the data using secure protocol metadata of the secure protocol packet; optionally decrypt, using the session key, the data to generate plaintext data; and store the plaintext data in NVM storage elements of the NVM device.

First claim

What is claimed is:

1. A non-volatile memory (NVM) device, comprising:
a memory controller;
a crypto buffer coupled to the memory controller, wherein the crypto buffer is inaccessible by a host computing system that is communicatively coupled with the NVM device; and
a processing device, configured to:
receive a communication packet from a server via the host computing system, the communication packet comprising a request to initiate secure communications;
perform a secure handshake with the server, via communication through the host computing system, using a secure protocol;
receive data, via the host computing system, from the server within a secure protocol packet;
store, responsive to detecting a crypto-write command in the secure protocol packet, the secure protocol packet into the crypto buffer;
parse the secure protocol packet stored in the crypto buffer to retrieve the data;
retrieve a secure protocol operation identifier and a secure protocol metadata from a header of the secure protocol packet; and
transfer out and process portions of the secure protocol packet from the crypto buffer according to the secure protocol, to include verification of the secure protocol metadata retrieved from the secure protocol packet.

2. The NVM device of claim 1 , wherein the processing device is further configured to provide access, for the host computing system, of the data stored in the NVM storage elements.

3. The NVM device of claim 1 , wherein the secure protocol comprises one of secure sockets layer (SSL) protocol or transport layer security (TLS) protocol, and wherein the secure handshake includes a series of sequencing operations that lead to a series of cryptographic operations.

4. The NVM device of claim 1 , further comprising a flash memory device.

5. The NVM device of claim 1 , wherein:
the memory controller includes a serial peripheral interface (SPI) slave coupled to an SPI master of the host computing system, wherein the secure handshake is performed via transmission of data within SPI packets exchanged between the SPI slave and the SPI master.

6. The NVM device of claim 1 , further comprising a cryptographic accelerator that is configured to perform cryptographic operations via execution of a cryptographic toolkit that is programmed into the cryptographic accelerator.

7. The NVM device of claim 1 , wherein the processing device is further configured to:
authenticate the data using at least the secure protocol metadata retrieved from the secure protocol packet; and
store the data in NVM storage elements of the NVM device.

8. The NVM device of claim 6 , wherein, to process the portions of the secure protocol packet according to the secure protocol, the processing device is further configured to interact with the cryptographic accelerator to:
authenticate a row of the data according to a cipher suite code;
decrypt the row of the data, if encrypted, which generates a row of plaintext data, using a session key;
store the row of plaintext data in NVM storage elements of the NVM device; and
report back, via the memory controller and the host computing system to the server, that the row of the data has been successfully written to the NVM storage elements.

9. A method of operating a non-volatile memory (NVM) device, comprising:
receiving, by a processing device of the NVM device, a communication packet from a server via a host computing system that is communicatively coupled to the server, the communication packet comprising a request to initiate secure communications;
performing, by the processing device, a secure handshake with the server, via communication through the host computing system, using a secure protocol;
receiving, using the processing device, encrypted data via the host computing system from the server within a secure protocol packet;
storing, by the processing device responsive to detecting a crypto-write command within the secure protocol packet, the secure protocol packet into a crypto buffer of the NVM device;
parsing, by the processing device, the secure protocol packet stored in the crypto buffer to retrieve the encrypted data;
retrieving, by the processing device, a secure protocol operation identifier and secure protocol metadata from a header of the secure protocol packet;
transferring, by the processing device, portions of the secure protocol packet from the crypto buffer; and
processing, by the processing device, the portions of the secure protocol packet transferred out of the crypto buffer according to the secure protocol, to include verification of the secure protocol metadata.

10. The method of claim 9 , wherein performing the secure handshake comprises exchanging secure protocol data within serial peripheral interface (SPI) packets with the host computing system.

11. The method of claim 9 , wherein the secure protocol comprises one of secure sockets layer (SSL) protocol or transport layer security (TLS) protocol, and wherein the secure handshake includes a series of sequencing operations that lead to a series of cryptographic operations.

12. The method of claim 9 , wherein performing the secure handshake with the server comprises generation of a session key of a pair of session keys, the session key being inaccessible to the host computing system, the method further comprising:
decrypting, by the processing device using the session key, the encrypted data to generate plaintext data; and
storing, by the processing device, the plaintext data in NVM storage elements of the NVM device.

13. The method of claim 9 , further comprising authenticating the encrypted data using at least the secure protocol metadata retrieved from the secure protocol packet.

14. The method of claim 12 , further comprising providing access, by the host computing system, to the plaintext data stored in the NVM storage elements.

15. The method of claim 12 , wherein the processing further comprises:
authenticating, by a cryptographic accelerator of the NVM device, a row of the encrypted data of the secure protocol packet according to a cipher suite code;
decrypting, by the cryptographic accelerator using the session key, the row of the encrypted data, generating a row of plaintext data;
storing the row of plaintext data in the NVM storage elements; and
reporting back, via the host computing system to the server, that the row of the encrypted data has been successfully written to the NVM storage elements.

Assignees

• Cypress Semiconductor Corp
• Infineon Technologies LLC

Inventors

• Ostrikov Sergey
• Rosner Stephan
• Zitlaw Clifford

Classifications

• H04L63/0435 Primary

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• G06F13/4269 Primary

  using a handshaking protocol, e.g. Centronics connection · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• H04L63/166

  at the transport layer · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title