Nonvolatile memory modules and authorization systems and operating methods thereof

Patent metadata

Field	Value
Publication number	US-9251099-B2
Application number	US-201314091684-A
Country	US
Kind code	B2
Filing date	Nov 27, 2013
Priority date	Nov 30, 2012
Publication date	Feb 2, 2016
Grant date	Feb 2, 2016

Abstract

Memory modules and authorization systems include a nonvolatile memory, an authentication engine configured to receive an initialization request from a user system, configured to generate a certification value based on device identifiers of devices includes in the user system in response to the initialization request and configured to control access to the nonvolatile memory based on the certification value, and a certification value storage configured to store the certification value.

First claim

What is claimed is:

1. A memory module, comprising:
a nonvolatile memory;
an authentication engine configured to receive an initialization request from a user system, the authentication engine including an encryption engine configured to generate a certification value based on a combination of at least two device identifiers from different devices included in the user system in response to the initialization request and configured to control access to the nonvolatile memory based on the certification value; and
a certification value storage configured to store the certification value,
wherein the authentication engine is configured to generate a certification key based on the at least two device identifiers of the devices included in the user system, when the user system accesses the nonvolatile memory after generation of the certification value at a first time,
the authentication engine is configured to encrypt the certification value according to a selected secure level,
the authentication engine is configured to compare the certification value and the certification key, and
the authentication engine is configured to control access to the nonvolatile memory according to the comparison result.

2. The memory module of claim 1 , wherein the authentication engine is configured to allow access of the user system to the nonvolatile memory when the certification value is equal to the certification key, and to prohibit access of the user system to the nonvolatile memory when the certification value is not equal to the certification key.

3. The memory module of claim 1 , wherein
the encryption engine is configured to encrypt the certification value to generate an encrypted certification value, and
the authentication engine further includes,
a decryption engine configured to decrypt the encrypted certification value to generate a decrypted certification value; and
a comparison engine configured to compare the decrypted certification value and the certification key.

4. The memory module of claim 3 , wherein the authentication engine further includes, a deletion process engine configured to invalidate data stored in the nonvolatile memory when the certification value is not equal to the certification key.

5. The memory module of claim 4 , wherein the deletion process engine is configured to invalidate data stored in the nonvolatile memory through one selected from deleting, overwriting, insertion of a random pattern, and insertion of a same data pattern.

6. The memory module of claim 1 , wherein the nonvolatile memory is a main memory of the user system.

7. An operating method of a memory module including a nonvolatile memory, the operating method comprising:
receiving an initialization request from a user system;
selecting one from a secure mode and a normal mode in response to the initialization request;
receiving at least two device identifiers from different devices included in the user system when the secure mode is selected, the receiving at least two device identifiers of devices included in the user system includes selecting a secure level of the secure mode;
generating a certification value based on a combination of the received device identifiers;
storing the certification value in a certification value storage;
receiving an access certification request from the user system;
determining whether a set mode is the secure mode or the normal mode;
generating a certification key based on the received device identifiers when the set mode is the secure mode, the generating a certification value based on the received device identifiers includes encrypting the certification value according to the selected secure level;
comparing the certification key and the certification value; and
controlling access of the user system to the nonvolatile memory according to the comparison result.

8. The operating method of claim 7 , wherein the receiving at least two device identifiers of devices included in the user system further includes,
receiving a first device identifier and a second device identifier from one of the devices included in the user system according to the selected secure level.

9. The operating method of claim 7 , wherein the controlling access of the user system to the nonvolatile memory according to the comparison result includes allowing access of the user system to the nonvolatile memory when the certification key is equal to the certification value.

10. The operating method of claim 7 , wherein the controlling access of the user system to the nonvolatile memory according to the comparison result includes invalidating data stored at the nonvolatile memory when the certification key is not equal to the certification value.

11. The operating method of claim 7 , wherein the controlling access of the user system to the nonvolatile memory according to the comparison result includes,
receiving user information from the user system when the certification key is not equal to the certification value;
comparing the user information and set user information; and
controlling access of the user system to the nonvolatile memory based on the result of comparison.

12. The operating method of claim 7 , wherein the receiving an access certification request from the user system comprises,
determining whether the set mode is the secure mode or the normal mode; and
allowing access of the user system when the set mode is the normal mode.

13. An authorization system, comprising:
a first user system including at least two first devices;
a memory module accessible by the first user system, wherein the memory module includes,
at least one nonvolatile memory configured to store data,
an authentication engine configured to control access to the at least one nonvolatile memory based on a certification value generated based a combination of device identifiers received from the at least two first devices, the authentication engine being configured to encrypt the certification value according to a selected secure level to generate an encrypted certification value, and
a storage configured to store the certification value; and

a second user system including at least one second device having a device identifier different than the device identifier of the at least one first device,
wherein the memory module is a main memory of the second user system, and
the memory module is configured to generate a certification key based on the device identifier received from the at least one second device, and configured to control access of the second user system to the at least one nonvolatile memory based on a comparison of the certification value and the certification key.

14. The authorization system of claim 13 , wherein the authentication engine is configured to invalidate the data stored in the at least one nonvolatile memory and configured to block access of the second user system to the at least one nonvolatile memory, when the certification value is not equal to the certification key.

15. The authorization system of claim 13 , wherein the authentication engine is configured to decrypt the encrypted certification value to generate a decrypted certification value, and configured to compare the decrypted certification value and the certification key.

16. The authorization system of claim 13 , wherein the first user system includes a plurality of first devices having device identifiers different from each other,
the memory module is configured to receive an initialization request from the first user system to set a secure level of the memory module, and configured to select at least one of t

Assignees

• Kim Kwanghoon
• Hwang Seongsik
• Kong Junjin
• Jun Dongsoo
• Samsung Electronics Co Ltd

Inventors

• Kim Kwanghoon
• Hwang Seongsik
• Kong Junjin
• Jun Dongsoo

Classifications

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F12/1433 Primary

  for a module or a part of a module · CPC title

• G06F2212/202

  Non-volatile memory · CPC title

• G06F21/30 Primary

  Authentication, i.e. establishing the identity or authorisation of security principals · CPC title

• G11C16/22

  Safety or protection circuits preventing unauthorised or accidental access to memory cells · CPC title