Flash recovery mode

Patent metadata

Field	Value
Publication number	US-2019236007-A1
Application number	US-201916377226-A
Country	US
Kind code	A1
Filing date	Apr 7, 2019
Priority date	May 26, 2017
Publication date	Aug 1, 2019
Grant date	—

Abstract

The disclosed technology is generally directed to data security. In one example of the technology, data is stored in a memory. The memory includes a plurality of memory banks including a first memory bank and a second memory bank. At least a portion of the data is interleaved amongst at least two of the plurality of memory banks. Access is caused to be prevented to at least one of the plurality of memory banks while a debug mode or recovery mode is occurring. Also, access is caused to be prevented to the at least one of the plurality of memory banks starting with initial boot until a verification by a security complex is successful. The verification by the security complex includes the security complex verifying a signature.

First claim

We claim:

1 . A device for data security, comprising:
a memory including a plurality of memory banks including a first memory bank and a second memory bank, wherein at least a portion of data is interleaved amongst at least two of the plurality of memory banks; and a security complex that is configured to prevent access to at least one of the plurality of memory banks, while in a debug mode or recovery mode, by hardware enforced prevention of access to the at least one of the plurality of memory banks via an interface to the at least one of the plurality of memory banks.

2 . The apparatus of claim 1 , wherein the hardware enforced prevention of access includes a disabling of a QSPI interface to the at least one of the plurality of memory banks.

3 . The apparatus of claim 1 , wherein each memory bank of the plurality of memory banks is a flash memory bank.

4 . The apparatus of claim 1 , wherein the portion of data is a secure portion of the memory that is interleaved by two between the first memory bank and the second memory bank, and wherein access being preventing to at least one of the memory banks includes preventing access to the second memory bank.

5 . The apparatus of claim 1 , wherein the security complex includes a hardware root of trust for the device.

6 . The apparatus of claim 1 , wherein the signature is a digital signature of a first bootloader.

7 . The apparatus of claim 6 , wherein the security complex includes a read-only memory, and wherein the first bootloader is read from the read-only memory.

8 . The apparatus of claim 6 , wherein the security complex verifies the digital signature with a public key that is stored in the security complex.

9 . A method for data security, comprising:
storing data in a memory, the memory including a plurality of memory banks including a first memory bank and a second memory bank, wherein at least a portion of the data is interleaved between at least two of the plurality of memory banks; and causing access to be prevented to at least one of the plurality of memory banks, while operating in a mode that does not include signature validation, via a hardware enforced prevention of access through an interface to the at least one of the plurality of memory banks.

10 . The method of claim 9 , wherein the mode that does not include signature validation includes at least one of a debug mode or a recovery mode.

11 . The method of claim 9 , wherein the hardware enforced prevention of access included a disabling of a QSPI interface.

12 . The method of claim 9 , wherein each memory bank of the plurality of memory banks is a flash memory bank.

13 . The method of claim 9 , wherein the signature is a digital signature of a first bootloader.

14 . The method of claim 13 , wherein the security complex includes a read-only memory, and wherein the first bootloader is read from the read-only memory.

15 . The method of claim 13 , wherein the security complex verifies the digital signature with a public key that is stored in the security complex.

16 . An apparatus for data security, comprising:
a device, including:
a flash memory including a plurality of flash memory banks including a first flash memory bank and a second flash memory bank, wherein at least a portion of data is interleaved amongst at least two of the plurality of flash memory banks; and
a security complex that is configured to prevent access to at least one of the plurality of flash memory banks, while operating in a mode that does not include signature validation, by employing a hardware enforced blocking of access to an interface for the at least one of the plurality of flash memory banks.

17 . The apparatus of claim 16 , wherein the mode that does not include signature validation includes a debug mode and a recovery mode.

18 . The apparatus of claim 16 , wherein the signature is a digital signature of a first bootloader.

19 . The apparatus of claim 18 , wherein the security complex includes a read-only memory, and wherein the first bootloader is read from the read-only memory.

20 . The apparatus of claim 18 , wherein the security complex verifies the digital signature with a public key that is stored in the security complex.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Letey George Thomas
• Stiles Douglas L
• Nightingale Edmund B

Classifications

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title

• G11C11/4087

  Address decoders, e.g. bit - or word line decoders; Multiple line decoders · CPC title

• G11C8/12

  Group selection circuits, e.g. for memory block selection, chip selection, array selection · CPC title

• G06F21/74

  operating in dual or compartmented mode, i.e. at least one secure mode · CPC title

• G06F12/1433

  for a module or a part of a module · CPC title