Security perimeter

Patent metadata

Field	Value
Publication number	US-9575903-B2
Application number	US-201113136666-A
Country	US
Kind code	B2
Filing date	Aug 4, 2011
Priority date	Aug 4, 2011
Publication date	Feb 21, 2017
Grant date	Feb 21, 2017

Abstract

Embodiments of memory devices, computer systems, security apparatus, data handling systems, and the like, and associated methods facilitate security in a system incorporating the concept of a security perimeter which combines cryptographic and physical security. The memory device can comprise a memory operable to store information communicated with a processor, and a logic operable to create at least one cryptographic security perimeter enclosing at least one selected region of the memory and operable to manage information communication between the processor and the at least one selected region of the memory.

First claim

What is claimed is:

1. A memory device comprising:
a memory integrated circuit including at least:
memory including a plurality of memory regions configured to store information communicated with at least one processor; and
logic-in-memory at least partially integrated with the memory, the logic-in-memory including at least
encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions wherein data inside the at least one cryptographic security perimeter has a different cryptographic state than information outside the at least one cryptographic security perimeter, and at least one of encryption or decryption of data is performed during a direct memory-to-memory transfer across the at least one cryptographic security perimeter wherein the data is at least one of encrypted or decrypted during transfer from a first memory region to a second memory region internal to the memory integrated circuit; and
tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions wherein at least one physical tamper-handling function is performed in association with the at least one selected memory region within the at least one physical tamper handling security perimeter.

2. The memory device according to claim 1 further comprising:
a tamper-handling device coupled to the memory and configured to handle physical intrusion to the memory wherein the tamper-handling device and the encryption logic are configured to create at least one cryptographic security perimeter operable in combination to create a cryptographic and physical tamper-handling security perimeter; and
at least one sensor coupled to the tamper-handling logic configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions, the at least one sensor including at least one of:
at least one electrical characteristic sensor, wherein the tamper-handling device is configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions is further configured to detect intrusion in response to one or more signals from the at least one electrical characteristic sensor and to respond by erasing information stored in the at least one selected region of the memory; or
at least one temperature sensor, wherein the tamper-handling device is configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions is further configured to detect a liquid nitrogen freeze in response to one or more signals from the at least one temperature sensor and to respond by erasing information stored in the at least one selected region of the memory.

3. The memory device according to claim 2 wherein:
the tamper-handling device is configured to perform at least one operation of tamper-proofing, tamper-resistance, and tamper-evidence.

4. The memory device according to claim 2 wherein the tamper-handling device includes:
circuitry configured to erase or destroy data in at least one portion of the memory device coupled to the memory integrated circuit, wherein the tamper-handling device is configured to create at least one physical tamper handling security perimeter internal to the memory integrated circuit enclosing at least one selected memory region of the plurality of memory regions and further configured to detect intrusion in response to one or more signals from the at least one electrical characteristic sensor and to respond by erasing or destroying data in at least one portion of the memory device.

5. The memory device according to claim 1 wherein:
the memory includes a plurality of memory types characterized by a corresponding plurality of operating characteristics; and
the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to create a plurality of cryptographic security perimeters internal to the memory integrated circuit allocated to selected memory types of the plurality of memory types wherein memory with a first memory speed is placed inside the at least one cryptographic security perimeter and memory with a second speed slower than the first speed is placed outside the at least one cryptographic security perimeter.

6. The memory device according to claim 1 wherein:
the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to create a plurality of nested cryptographic security perimeters including an innermost cryptographic security perimeter enclosing memory operating with unencrypted information and an outermost cryptographic security perimeter enclosing memory outside the innermost cryptographic security perimeter operating with information encrypted with a first encryption strength, the memory outside the outermost cryptographic security perimeter enclosing memory operating with information encrypted with a second encryption strength greater than the first encryption strength.

7. The memory device according to claim 1 wherein:
the memory is configured to store data communicated via a communication channel with the at least one processor; and
the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform channel encryption operations on the communication channel that communicates information between the at least one processor and the memory wherein an address A and data D are encrypted into an encrypted value E 1 (A,D) and the at least one processor is configured to read back a different encrypted value E 2 (A,D) as encryption state changes according to a predetermined scheme between the memory and the at least one processor.

8. The memory device according to claim 1 wherein:
the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform channel encryption operations on the communication channel for information that is storage encrypted wherein storage-encrypted information is encrypted by the at least one processor, stored in the memory, accessed from the memory, and decrypted by the at least one processor.

9. The memory device according to claim 1 wherein:
the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform time-varying channel encryption wherein the encryption logic is configured to change addresses at which data is stored in the memory over time independently of direction by the at least one processor.

10. The memory device according to claim 1 wherein:
the memory is configured to store data communicated via a communication channel with the at least one processor; and
the encryption logic configured to create at least one cryptographic security perimeter internal to the memory integrated circuit is configured to perform channel encryption of information communicated on the communication channel wherein an address A and data D are encrypted into an encrypted value E 1 (A,D) and at least one processor is configured to read back

Assignees

• Gerrity Daniel A
• Tegreene Clarence T
• Elwha Llc

Inventors

• Glew Andrew F
• Gerrity Daniel A
• Tegreene Clarence T

Classifications

• G06F21/71

  to assure secure computing or processing of information · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• G06F2221/2149

  Restricted operating environment · CPC title

• G06F21/79

  in semiconductor storage media, e.g. directly-addressable memories · CPC title