METHOD AND APPARATUS TO AUTHENTICATE A MEMORY MODULE

A cryptographic hash based on content of a Sideband Bus Device (SPD) Hub and serial number identifiers for components on a memory module is provided. The cryptographic hash provides the ability to mitigate various supply chain attacks by binding the SPD Hub content to a memory module certificate that is used for authentication. Based on the cryptographic signatures, a certificate is trusted by the platform so the binding of the SPD hub content to the memory module certificate creates a secure way to ensure the components on the memory module have not been tampered with and that the reported attributes of the memory module are correct.

FIELD

This disclosure relates to memory modules and in particular to authentication of memory modules.

BACKGROUND

A memory module is a printed circuit board on which memory integrated circuits (“chips”) are mounted to another printed circuit board, such as a motherboard, via a connector (also referred to as a “socket”). The connector is installed on the motherboard and a memory module is inserted into the connector. The connector enables interconnection between a memory module and a circuit on the motherboard. A dual inline memory module (DIMM) has separate electrical contacts on each side of the memory module.

In addition to memory integrated circuits, the memory module can include a serial presence detect (SPD) integrated circuit (“chip”). The SPD integrated circuit stores information about the memory module including the type of memory integrated chips on the memory module, manufacturer, serial number and timing parameters to be used by a memory controller to access the memory integrated chips. The information stored in the SPD integrated circuit can be read by a Built In Operating System (BIOS) during power up of a system to configure a memory controller to use the memory integrated circuits on the DIMM.

Although the following Detailed Description will proceed with reference being made to illustrative embodiments of the claimed subject matter, many alternatives, modifications, and variations thereof will be apparent to those skilled in the art. Accordingly, it is intended that the claimed subject matter be viewed broadly, and be defined as set forth in the accompanying claims.

DESCRIPTION OF EMBODIMENTS

Memory performance issues could occur if the information stored in the SPD integrated circuit (also referred to as a SPD hub) is modified to misrepresent parameters of the memory chips and/or the memory chips in the DIMM are replaced with memory chips with different parameters. For example, one of the most common issues with a counterfeited DIMM is misrepresentation, where a DIMM's SPD Hub is tampered to represent higher DRAM capacity or frequencies.

Attestation for a DIMM ensures the authenticity and integrity of the DIMM and its components. For DIMM attestation, a host requests evidence in the form of certificates from the DIMM. Certificates are tied to a root-of-trust and cryptographically signed so they can be used to verify the legitimacy of the DIMM. Once verified, the host assesses trustworthiness of the DIMM and its components. This trustworthiness assessment by the host is necessary for confidential computing because secure workloads need to be able to trust the devices that store and manage the data to ensure confidentiality and integrity.

Data stored in the SPD hub (also referred to as SPD hub content) includes information (attributes) about the DIMM including the type of memory integrated chips on the DIMM, manufacturer of the DIMM, serial number identifiers and timing parameters to be used by a memory controller to access the memory integrated chips on the DIMM.

After manufacturing, a cryptographic hash that is created based only on serial number identifiers will be static and will not change if the DIMM is misrepresented or if DRAM chips are swapped through chip recycling black markets. The SPD Hub content is included as part of a cryptographic hash to generate an attribute serial number for the memory module. The cryptographic hash can also include serial number identifiers for components on the DIMM.

A cryptographic hash based on the SPD Hub content and serial number identifiers for components on the DIMM provides the ability to mitigate various supply chain attacks by binding the SPD Hub content to the DIMM certificate that is used for authentication. Based on the cryptographic signatures, a certificate is trusted by the platform so the binding of the SPD hub content to the DIMM certificate creates a secure way to ensure the components on the DIMM have not been tampered with and that the reported attributes of the DIMM are correct.

The Distributed Management Task Force (DMTF) Security Protocol and Data Model (SPDM) Specification defines messages, data objects, and sequences for performing message exchanges between devices over a variety of transport and physical media. The description of message exchanges includes authentication of hardware identities and measurement for firmware identities. The SPDM GET_MEASUREMENTS request and MEASUREMENT response can be used to authenticate and attest the DIMM.

FIG. 1is a block diagram of a memory module100that includes a plurality of Dynamic Random Access Memory (DRAM) chips104-1, . . . ,104-8. A host system communicates with the DRAM chips104-1, . . . ,104-8via a host memory bus, DRAM bus118.

The memory module100communicates with a host system via a sideband bus116. The sideband bus116as described herein may be compatible with the JESD403-1 JEDEC (Joint Electronic Device Engineering Council) Module Sideband Bus standard that is a subset and superset of the MIPI® Alliance I3C Basic℠ serial bus standard.

The memory module100has two temperature sensors (TS), a first temperature sensor TS0112and a second temperature sensor TS1114, to measure the temperature of the DRAM chips104-1, . . . ,104-8on the memory module100. The memory module100includes two Power Management ICs (PMICs)108and110, a Registering Clock Driver (RCD)106, and a Sideband Bus Device Hub (SPD Hub)102that includes a Serial Presence Detect (SPD) device122which acts as the SPD to redrive the sideband bus116to a local bus120for the Power Management IC (PMICs)108,110, a Registering Clock Driver (RCD)106and the first temperature sensor TS0112and the second temperature sensor TS1114.

In another embodiment, memory module100can include a plurality of non-volatile memory integrated circuits or persistent memory integrated circuits, for example, a three dimensional byte accessible non-volatile memory.

FIG. 2is a block diagram of an embodiment of a system200with a memory subsystem including at least one memory module100coupled to a memory controller220. System200includes a processor210and elements of a memory subsystem in a computing device. Processor210represents a processing unit of a computing platform that can execute an operating system (OS) and applications, which can collectively be referred to as the host or user of the memory. The OS and applications execute operations that result in memory accesses. Processor210can include one or more separate processors. Each separate processor can include a single processing unit, a multicore processing unit, or a combination. The processing unit can be a primary processor such as a CPU (central processing unit), a peripheral processor such as a GPU (graphics processing unit), or a combination. Memory accesses may also be initiated by devices such as a network controller or storage controller. Such devices can be integrated with the processor in some systems (for example, in a System-on-Chip (SoC)) or attached to the processer via a bus (e.g., PCI express), or a combination.

Reference to memory devices can apply to different memory types. Memory devices often refers to volatile memory technologies. Volatile memory is memory whose state (and therefore the data stored on it) is indeterminate if power is interrupted to the device. Dynamic volatile memory requires refreshing the data stored in the device to maintain state. Nonvolatile memory refers to memory whose state is determinate even if power is interrupted to the device.

One example of dynamic volatile memory incudes DRAM (Dynamic Random Access Memory), or some variant such as Synchronous DRAM (SDRAM). A memory subsystem as described herein may be compatible with a number of memory technologies, such as DDR3 (Double Data Rate version 3, original release by JEDEC (Joint Electronic Device Engineering Council) on Jun. 27, 2007). DDR4 (DDR version 4, originally published in September 2012 by JEDEC), DDR5 (DDR version 5, originally published in July 2020), LPDDR3 (Low Power DDR version 3, JESD209-3B, August 2013 by JEDEC), LPDDR4 (LPDDR version 4, JESD209-4, originally published by JEDEC in August 2014), LPDDR5 (LPDDR version 5, JESD209-5A, originally published by JEDEC in January 2020), WIP2 (Wide Input/Output version 2, JESD229-2 originally published by JEDEC in August 2014), HBM (High Bandwidth Memory, JESD235, originally published by JEDEC in October 2013), HBM2 (HBM version 2, JESD235C, originally published by JEDEC in January 2020), or HBM3 (HBM version 3 currently in discussion by JEDEC), or others or combinations of memory technologies, and technologies based on derivatives or extensions of such specifications. The JEDEC standards are available at www.jedec.org.

Descriptions herein referring to a “RAM” or “RAM device” can apply to any memory device that allows random access, whether volatile or nonvolatile. Descriptions referring to a “DRAM” or a “DRAM device” can refer to a volatile random access memory device. The memory device or DRAM can refer to the die itself, to a packaged memory product that includes one or more dies, or both. In one embodiment, a system with volatile memory that needs to be refreshed can also include nonvolatile memory.

A non-volatile memory (NVM) device is a type of memory whose state is determinate even if power is interrupted to the device. In one embodiment, the NVM device may include block or byte-addressable, write-in-place memories. Examples may include, but are not limited to, single or multi-level Phase Change Memory (PCM) or phase change memory with a switch (PCMS), non-volatile types of memory that include chalcogenide phase change material (for example, chalcogenide glass), resistive memory including metal oxide base, oxygen vacancy base and Conductive Bridge Random Access Memory (CB-RAM), nanowire memory, ferroelectric random access memory (FeRAM, FRAM), magneto resistive random access memory (MRAM) that incorporates memristor technology, spin transfer torque (STT)-MRAM, a spintronic magnetic junction memory based device, a magnetic tunneling junction (MTJ) based device, a DW (Domain Wall) and SOT (Spin Orbit Transfer) based device, a thyristor based memory device, or a combination of any of the above, or other types of block or byte-addressable, write-in-place memory.

Memory controller220represents one or more memory controller circuits or devices for system200. Memory controller220represents control logic that generates memory access commands in response to the execution of operations by processor210. Memory controller220accesses one or more memory devices104. Memory devices104can be DRAM devices in accordance with any referred to above. Memory controller220includes I/O interface logic222to couple to a memory bus that can be the DRAM bus118. I/O interface logic222(as well as I/O interface logic242of memory device104) can include pins, pads, connectors, signal lines, traces, or wires, or other hardware to connect the devices, or a combination of these. I/O interface logic222can include a hardware interface. As illustrated, I/O interface logic222includes at least drivers/transceivers for signal lines. Commonly, wires within an integrated circuit interface couple with a pad, pin, or connector to interface signal lines or traces or other wires between devices. I/O interface logic222can include drivers, receivers, transceivers, or termination, or other circuitry or combinations of circuitry to exchange signals on the signal lines between the devices.

The exchange of signals includes at least one of transmit or receive. While shown as coupling I/O interface logic222from memory controller220to I/O interface logic242of memory device104, it will be understood that in an implementation of system200where groups of memory devices104are accessed in parallel, multiple memory devices can include I/O interfaces to the same interface of memory controller220. In an implementation of system200including one or more memory modules100, I/O interface logic242can include interface hardware of the memory module in addition to interface hardware on the memory device itself. Other memory controllers220can include separate interfaces to other memory devices104.

The bus between memory controller220and memory devices104can be a double data rate (DDR) high-speed DRAM interface to transfer data that is implemented as multiple signal lines coupling memory controller220to memory devices104. The bus may typically include at least clock (CLK)232, command/address (CMD)234, and data (write data (DQ) and read data (DQ0)236, and zero or more control signal lines238. In one embodiment, a bus or connection between memory controller220and memory can be referred to as a memory bus. The signal lines for CMD can be referred to as a “C/A bus” (or ADD/CMD bus, or some other designation indicating the transfer of commands (C or CMD) and address (A or ADD) information) and the signal lines for data (write DQ and read DQ) can be referred to as a “data bus.” It will be understood that in addition to the lines explicitly shown, a bus can include at least one of strobe signaling lines, alert lines, auxiliary lines, or other signal lines, or a combination. It will also be understood that serial bus technologies can be used for the connection between memory controller220and memory devices104. An example of a serial bus technology is 8B10B encoding and transmission of high-speed data with embedded clock over a single differential pair of signals in each direction.

In one embodiment, one or more of CLK232, CMD234, Data236, or control238can be routed to memory devices104through logic280. Logic280can be or include a register or buffer circuit. Logic280can reduce the loading on the interface to I/O interface222, which allows faster signaling or reduced errors or both. The reduced loading can be because I/O interface222sees only the termination of one or more signals at logic280, instead of termination of the signal lines at every one or memory devices104in parallel. While I/O interface logic242is not specifically illustrated to include drivers or transceivers, it will be understood that I/O interface logic242includes hardware necessary to couple to the signal lines. Additionally, for purposes of simplicity in illustrations, I/O interface logic242does not illustrate all signals corresponding to what is shown with respect to I/O interface222. In one embodiment, all signals of I/O interface222have counterparts at I/O interface logic242. Some or all of the signal lines interfacing I/O interface logic242can be provided from logic280. In one embodiment, certain signals from I/O interface222do not directly couple to I/O interface logic242, but couple through logic280, while one or more other signals may directly couple to I/O interface logic242from I/O interface222via I/O interface272, but without being buffered through logic280. Signals282represent the signals that interface with memory devices104through logic280.

It will be understood that in the example of system200, the bus between memory controller220and memory devices104includes a subsidiary command bus CMD234and a subsidiary data bus236. In one embodiment, the subsidiary data bus236can include bidirectional lines for read data and for write/command data. In another embodiment, the subsidiary data bus236can include unidirectional write signal lines for write and data from the host to memory, and can include unidirectional lines for read data from the memory device104to the host. In accordance with the chosen memory technology and system design, control signals238may accompany a bus or sub bus, such as strobe lines DQS. Based on design of system200, or implementation if a design supports multiple implementations, the data bus can have more or less bandwidth per memory device104. For example, the data bus can support memory devices104that have either a x32 interface, a x16 interface, a x8 interface, or another interface. The convention “xW,” where W is an integer that refers to an interface size or width of the interface of memory device104, which represents a number of signal lines to exchange data with memory controller220. The number is often binary, but is not so limited. The interface size of the memory devices is a controlling factor on how many memory devices can be used concurrently in system200or coupled in parallel to the same signal lines. In one embodiment, high bandwidth memory devices, wide interface devices, or stacked memory configurations, or combinations, can enable wider interfaces, such as a x128 interface, a x256 interface, a x512 interface, a x1024 interface, or other data bus interface width.

Memory devices104represent memory resources for system200. In one embodiment, each memory device104is a separate memory die. Each memory device104includes I/O interface logic242, which has a bandwidth determined by the implementation of the device (e.g., x16 or x8 or some other interface bandwidth). I/O interface logic242enables each memory device104to interface with memory controller220. I/O interface logic242can include a hardware interface, and can be in accordance with I/O interface logic222of memory controller220, but at the memory device end. In one embodiment, multiple memory devices104are connected in parallel to the same command and data buses. In another embodiment, multiple memory devices104are connected in parallel to the same command bus, and are connected to different data buses. For example, system200can be configured with multiple memory devices104coupled in parallel, with each memory device responding to a command, and accessing memory resources260internal to each. For a write operation, an individual memory device104can write a portion of the overall data word, and for a read operation, an individual memory device104can fetch a portion of the overall data word. As non-limiting examples, a specific memory device can provide or receive, respectively, 8 bits of a 128-bit data word for a Read or Write transaction, or 8 bits or 16 bits (depending for a x8 or a x16 device) of a 256-bit data word. The remaining bits of the word are provided or received by other memory devices in parallel.

In one embodiment, memory devices104can be organized into memory modules100. In one embodiment, memory modules100represent dual inline memory modules (DIMMs). Memory modules100can include multiple memory devices104, and the memory modules can include support for multiple separate channels to the included memory devices disposed on them.

Memory devices104each include memory resources260. Memory resources260represent individual arrays of memory locations or storage locations for data. Typically, memory resources260are managed as rows of data, accessed via word line (rows) and bit line (individual bits within a row) control. Memory resources260can be organized as separate banks of memory. Banks may refer to arrays of memory locations within a memory device104. In one embodiment, banks of memory are divided into sub-banks with at least a portion of shared circuitry (e.g., drivers, signal lines, control logic) for the sub-banks.

In one embodiment, memory devices104include one or more registers244. Register244represents one or more storage devices or storage locations that provide configuration or settings for the operation of the memory device. In one embodiment, register244can provide a storage location for memory device104to store data for access by memory controller220as part of a control or management operation. In one embodiment, register244includes one or more Mode Registers. In one embodiment, register244includes one or more multipurpose registers. The configuration of locations within register244can configure memory device104to operate in different “mode,” where command information can trigger different operations within memory device104based on the mode. Additionally, or in the alternative, different modes can also trigger different operation from address information or other signal lines depending on the mode. Settings of register244can indicate configuration for I/O settings (e.g., timing, termination, driver configuration, or other I/O settings).

Memory controller220includes scheduler230, which represents logic or circuitry to generate and order transactions to send to memory device104. From one perspective, the primary function of memory controller220is to schedule memory access and other transactions to memory device104. Such scheduling can include generating the transactions themselves to implement the requests for data by processor210and to maintain integrity of the data (e.g., such as with commands related to refresh).

Transactions can include one or more commands, and result in the transfer of commands or data or both over one or multiple timing cycles such as clock cycles or unit intervals. Transactions can be for access such as read or write or related commands or a combination, and other transactions can include memory management commands for configuration, settings, data integrity, or other commands or a combination.

Memory controller220typically includes logic to allow selection and ordering of transactions to improve performance of system200. Thus, memory controller220can select which of the outstanding transactions should be sent to memory device104in which order, which is typically achieved with logic much more complex than a simple first-in first-out algorithm. Memory controller220manages the transmission of the transactions to memory device104, and manages the timing associated with the transaction. In one embodiment, transactions have deterministic timing, which can be managed by memory controller220and used in determining how to schedule the transactions.

Referring again to memory controller220, memory controller220includes command (CMD) logic224, which represents logic or circuitry to generate commands to send to memory devices104. The generation of the commands can refer to the command prior to scheduling, or the preparation of queued commands ready to be sent. Generally, the signaling in memory subsystems includes address information within or accompanying the command to indicate or select one or more memory locations where the memory devices should execute the command. In response to scheduling of transactions for memory device104, memory controller220can issue commands via I/O222to cause memory device104to execute the commands. Memory controller220can implement compliance with standards or specifications by access scheduling and control.

Referring again to logic280, in one embodiment, logic280buffers certain signal282from the host to memory devices104. In one embodiment, logic280buffers data signal lines236as data286, and buffers command (or command and address) lines of CMD234as CMD284. In one embodiment, data286is buffered, but includes the same number of signal lines as data236. Thus, both are illustrated as having X signal lines. In contrast, CMD234has fewer signal lines than CMD284. Thus, P>N. The N signal lines of CMD234are operated at a data rate that is higher than the P signal lines of CMD284. For example, P can equal 2N, and CMD284can be operated at a data rate of half the data rate of CMD234.

In one embodiment, memory controller220includes refresh logic226. Refresh logic226can be used for memory resources260that are volatile and need to be refreshed to retain a deterministic state. In one embodiment, refresh logic226indicates a location for refresh, and a type of refresh to perform. Refresh logic226can execute external refreshes by sending refresh commands. For example, in one embodiment, system200supports all bank refreshes as well as per bank refreshes. All bank refreshes cause the refreshing of a selected bank292within all memory devices104coupled in parallel. Per bank refreshes cause the refreshing of a specified bank292within a specified memory device104.

System200can include a memory circuit, which can be or include logic280. To the extent that the circuit is considered to be logic280, it can refer to a circuit or component (such as one or more discrete elements, or one or more elements of a logic chip package) that buffers the command bus. To the extent the circuit is considered to include logic280, the circuit can include the pins of packaging of the one or more components, and may include the signal lines. The memory circuit includes an interface to the N signal lines of CMD234, which are to be operated at a first data rate. The N signal lines of CMD234are host-facing with respect to logic280. The memory circuit can also include an interface to the P signal lines of CMD284, which are to be operated at a second data rate lower than the first data rate. The P signal lines of CMD284are memory-facing with respect to logic280. Logic280can either be considered to be the control logic that receives the command signals and provides them to the memory devices, or can include control logic within it (e.g., its processing elements or logic core) that receive the command signals and provide them to the memory devices.

FIG. 3illustrates an example of a certificate chain for a DIMM300. Certificates in a device are used to verify the identity and provenance of the device. A certificate chain can be created to identify different layers (where a layer is a level in the hierarchy (root, intermediate, leaf) in a device that depend on each other, such as a pre-packaged design block, System-on-Chip (SoC), Platform, and firmware. A root certificate in a certificate chain is typically provided by trusted Certificate Authorities (CA) and is cryptographically signed with the Certificate Authority's private key. The public key of the trusted Certificate Authority is known and can be used by the entity verifying the certificate chain.

Each certificate (root, leaf, attribute certificate) in the chain includes a public key to verify the next certificate in the chain and an identifier that identifies the layer that the certificate represents. The identifier is typically generated through measurements (a raw value or cryptographic hash of raw values) of the layer and is dependent on the layer's properties. These measurements provide a unique value that identifies the layer. Examples of a layer's properties include configuration, version, revision, or code that can only be modified during manufacturing or through a manufacturer-controlled process.

The certificate chain for DIMM300includes a root certificate308, an attribute certificate304and a leaf certificate310. The root certificate308, attribute certificate304and leaf certificate310are provisioned during the manufacturing of the DIMM. The root certificate private key312(private key 1) that is used to sign the root certificate308and the attribute certificate private key306(private key 2) are only known to the manufacturer and are not provisioned on the DIMM. Only the leaf certificate Private Key 3314is stored on the DIMM300.

In the DIMM root certificate308, the DIMM configuration serial number322identifies the DIMM revision and configuration and is unique per revision not per device. DIMMs with the same configuration and same revision have the same DIMM configuration serial number in the root certificate. The root certificate308includes Public Key 1316that is associated with Private Key 1312. The root certificate308is signed by a CA private key. The CA private key is not stored on the DIMM300.

The next certificate in the chain is the Attribute certificate304. The Attribute Certificate304includes a MINIM Attribute certificate serial number302(also referred to as a memory module attribute number302) that is unique to the MINIM300. The DIMM attribute serial number302is generated by a cryptographic hash function by creating a hash using selected portions of SPD data and serial numbers assigned to components on the memory module100. The DIMM attribute serial number302can also be referred to as a memory module attribute serial number or a MINIM manufacturer certificate. A private key306used by the cryptographic hash function is provisioned during manufacture of the DIMM300. The attribute certificate304is signed by the attribute key private key 2306. The Attribute Certificate304includes public key 2318that is associated with Private Key 2306. The attribute certificate304is created and signed by Private Key 2306during the manufacture of the DIMM300. Private Key 2306is not stored on DIMM300, it is maintained securely by the manufacturer of the DIMM300.

The last certificate in the chain is the leaf certificate310that includes a DIMM (vendor) serial number. The leaf Certificate310includes Public Key 3320that is associated with Private Key 3314. The leaf certificate310is signed by Private Key 3314. The leaf certificate310is created and signed during the manufacture of DIMM300. Private Key 3314is stored in the DIMM300and is used for the challenge response protocol and to sign the GET_MEASUREMENTS output.

FIG. 4is a block diagram illustrating the organization of SPD data400stored in the SPD hub102. The SPD data400provides critical information about the memory module100and is used by a system's Built In Operating System (BIOS) to initialize and configure channels in the memory module100.

The SPD data400is stored in a 512-byte non-volatile memory that includes four 128-byte blocks (labeled block 0-3). The SPD data400represents memory module attributes. The non-volatile memory to store attributes for the plurality of memory devices on the memory module100and the memory module100. In other embodiments, the non-volatile memory can store more or less than 512 bytes. In an embodiment, the SPD data400is stored in a 512-byte Electronically Erasable Programmable Read Only Memory (EEPROM).

The 128-bytes in block 0 (labeled bytes 0-127) store the base configuration and DRAM parameters. The first 64 bytes (labeled bytes 128-191) in block 1 store standard memory module parameters. The second 64 bytes (labeled bytes 195-255) in block 1 store hybrid memory module parameters. The first 64 bytes (labeled bytes 256-319) in block 1 store hybrid module extended function parameters. The second 64 bytes (labeled bytes 320-383) in block 1 store manufacturing information. The 128-bytes in block 3 (labeled bytes 384-511) store end user programmable information.

FIG. 5is a block diagram illustrating an example of the SPD data stored in the first three bytes of block 0 in SPD data400shown inFIG. 4.

The first byte (labeled byte 0) stores the size of the SPD device122. Bits [3:0] store an indication of the number of bytes used in the SPD device122. In the example shown, 384 bytes are used as shown inFIG. 3. Bits [3:0] store 0111 (binary representation) indicating 384 bytes are used. Bits [6:4] store an indication of the total number of bytes available to store SPD data400in the SPD device122. In the example shown, 512 bytes are available as shown inFIG. 4. Bits [6:4] store 010 (binary representation) indicating 512 bytes are available.

The second byte (labeled byte 1) stores the SPD revision. In the example shown, the SPD revision is 1.0 and is represented by 10 (0x10 (hexadecimal representation), (00010000 (binary representation)).

The third byte (labeled byte 2) stores the DRAM device type. In the example shown, the DRAM device type is a JEDEC DDR5 SDRAM and is represented by 12 (0x12 (hexadecimal representation)), (00010010 (binary representation)).

FIG. 6is a block diagram illustrating an example of the SPD data stored in bytes 320-383 in block 2. The module serial number assigned to the memory module100is stored in bytes 325-328. Certificates are cryptographically signed by manufacturers and used for attestation to verify authenticity and provenance of the devices containing those certificates.

The DIMM attribute serial number302that is unique to the memory module100in the attribute certificate304for the DIMM is generated by a hash algorithm by creating a hash value using selected portions of the SPD data and serial numbers assigned to components on the memory module100. The selected portions of the SPD data are bytes 0-383 in blocks 0, 1 and 2 as shown inFIG. 3omitting any bytes in blocks 0, 1 and 2 that store certificate chains.

The DIMM attribute serial number302is generated by the hash algorithm at the time that the DIMM is manufactured and is stored in the attribute certificate304. In an embodiment, the hash algorithm is Secure Hash Algorithm-384 (SHA-384). SHA-384 is a one-way cryptographic hash function with a digest (hash value) that is 384-bits. In other embodiments, the output of the hash algorithm can be signed or encrypted by the Elliptic Curve Digital Signature Algorithm (EC-DSA) or Rivest-Shamir-Adleman (RSA).

The serial numbers of components in the memory module100are stored in the SPD hub102as part of the certificate. The components in the memory module100for which serial numbers are stored include DRAM devices104-1, . . .104-8, the registering clock driver (RCD)106, the SPD Hub102, Power Management controller (PMIC)108,110, and a data buffer (for example, used on a buffered DIMM).

This creates a binding of all components in the DIMM and a unique identifier for the DIMM (DIMM Attribute Serial Number302). The purpose of this binding is to prevent supply chain attacks where DRAM chips or other components such as sensors are swapped for counterfeited ones and affect the reliability of the DIMM.

The addition of the SPD Hub data as part of the cryptographic hash that derives the DIMM attribute serial number302in the Attribute Certificate304creates a unique per-memory module serial number that binds the DIMM attribute serial number304to the SPD data representing memory module attributes such as memory type, timing parameters, number of DRAM banks, memory module configuration, memory module density and interface voltage level. In addition, to the memory module certificate binding to memory module attributes, the addition of the SPDM protocol binding to the sideband bus116and the DRAM bus118provides a framework to authenticate the memory module100and trust its reported attributes creating a foundation for link protection.

Access to memory module attributes stored in the memory module100via the DRAM bus118allows direct access by a CPU in the system instead of obtaining them indirectly via the SPD hub102. The memory module attributes that can be obtained via the DRAM bus118include data buffers, DRAM devices and the RCD106. Attributes for other components on the memory module100, for example, PMICs108,110are obtained from the SPD hub102via the sideband bus116.

The addition of selected portions of SPD data as part of the cryptographic hash to generate the DIMM Attribute Serial number302ensures a binding between the data stored in the SPD Hub102and serial identifiers for components on the DIMM. This prevents a common counterfeit DIMM scenario when the data in the SPD Hub102is modified after manufacturing to falsely claim higher capacity or different timing parameters. Changes in thermal and voltage values can also be modified to make DIMMs vulnerable to attacks.

Attacks can be related to parameters in the DIMM. For example, memory aliasing in which more is reported than is present in the DIMM resulting in two different system addresses mapping to same location, changing refresh timing or voltage parameters make the DIMM more susceptible to row hammer or make mitigations less effective, data injection/accelerated wear by modifying operating voltage/thermal parameters.

The addition of selected portions of SPD data122as part of the cryptographic hash to generate the DIMM Attribute Serial number302also binds the DIMM parameters to a verifiable serial number. Verifying parameters in a DIMM is vital when implementing protections and mitigations against row hammer or aliasing attacks that are dependent on correctly identifying and verifying DIMM parameters such as frequency, refresh time, and size.

FIG. 7is a block diagram illustrating the SPD hub102, RCD106and sideband bus116in the memory module100shown inFIG. 1. The sideband bus116is coupled to a Baseband Management Controller (BMC)702. The BMC702is a microcontroller embedded on the motherboard of a system that manages the interface between system-management software and platform hardware.

FIG. 8is a flowgraph illustrating a method to generate an Attribute Serial Number302for the memory module100.

At block800, create a hash using selected portions of the SPD data102and serial numbers assigned to each of the components on the memory module100.

At block802, store the created hash as the DEV IM attribute serial number302in the Attribute Certificate304in the SPD data122in the SPD hub102.

FIG. 9is a flowgraph illustrating a method to measure the SPD Hub102and components in the memory module100to authenticate and attest the memory module100.

Measurements for any components in the memory module100provides the ability to verifiably identify each component and its attributes. Measurements of immutable (or mutable only through a manufacturer-controlled process) objects create a unique device identity. These measurements can be obtained as raw values or a cryptographic hash of the raw values, both of these provide a unique value for each component on demand in response to a request sent from the Host BIOS or the BMC702to the memory module100to verify that components on the memory module100are authentic.

Measurements are especially important to verify mutable parts of the memory module100, that is, a component that stores data that can be updated or changed post-manufacturing such as firmware through a firmware update. Updated firmware, for example, cannot typically be verified through certificate chains and cannot be used to generate device identities such as serial identifiers. Firmware needs to be measured on-request and compared against a reference measurement provided by the manufacturer or firmware developer so that the current version of the firmware or current patch or upgrade is verified and integrity protected.

The host can request attributes from DRAM chips and other components on the memory module100directly using the GET_MEASUREMENT request and MEASUREMENT response in the Distributed Management Task Force (DMTF) Security Protocol and Data Model (SPDM) standard. The measurements returned in the MEASUREMENT response can be used by the host to verity integrity or authenticity of a DRAM chip or other component in the memory module100.

The SPD Hub102communicates with the host via the sideband bus116. The host communicates with the plurality of DRAM devices104-1, . . .104-8via the DRAM bus118. Obtaining these measurements via the memory bus118removes the SPD Hub from the trust boundary and adds additional assurance for systems with strict security objectives. The GET_MEASUREMENT request is transmitted over the memory bus118to the DRAM devices104-1, . . .104-8, and the RCD106. Obtaining these measurements via the sideband enables measuring other components in the memory module100and provides integrity to the user programmable portion of the SP Hub (for example, Block 3).

The framework for requesting measurements and measuring all components in the memory module100allows the host system to verify the serial numbers of components on the memory module100and other attributes of the memory module100at any time. The ability to measure components provides integrity protection for memory modules, such as persistent memory DIMMs. that contain mutable components such as firmware or user configurations.

At block900, upon receiving a measurement request, processing continues with block902.

At block902, if the request is received via the sideband bus116, processing continues with block906. If the request is received via the memory bus118, processing continues with block904.

At block904, a SPDM GET_MEASUREMENTS request is sent over the DRAM bus118to enable measuring the SPD Hub102and other components in the memory module100in order to authenticate and attest the memory module100. The GET_MEASURMENTS request message includes a 32-byte random value (referred to as a Nonce) that is chosen by the requester and included by the responder in the MEASUREMENT response. In response, the memory module100sends a MEASUREMENT response message that includes number of measurements (for example, all of the measurement blocks or one of the measurement blocks), length (number of bytes in the measurement blocks), the 32 byte Nonce in the SPDM GET_MEASUREMENTS request, and the measurement blocks The host verifies the Nonce and verifies that the measurements in the measurement blocks match expected values.

At block906, a SPDM GET_MEASUREMENTS request is sent over the sideband bus to enable measuring the SPD Hub and components in the memory module100in order to authenticate and attest the memory module100. The GET_MEASUREMENTS request message includes a Nonce. In response, the SPD hub sends a MEASUREMENT response message that includes number of measurements, length, Nonce, measurement blocks and signature. The host verifies the signature and verifies that the measurements match expected values.

FIG. 10is a block diagram of an embodiment of a computer system1000that includes memory module100. Computer system1000can correspond to a computing device including, but not limited to, a server, a workstation computer, a desktop computer, a laptop computer, and/or a tablet computer.

The computer system1000includes a system on chip (SOC or SoC)1004which combines processor, graphics, memory, and Input/Output (I/O) control logic into one SoC package. The SoC1004includes at least one Central Processing Unit (CPU) module1008, a volatile memory controller1014, and a Graphics Processor Unit (GPU)1010. In other embodiments, the volatile memory controller1014can be external to the SoC1004. The CPU module1008includes at least one processor core1002, and a level 2 (L2) cache1006.

Although not shown, each of the processor core(s)1002can internally include one or more instruction/data caches, execution units, prefetch buffers, instruction queues, branch address calculation units, instruction decoders, floating point units, retirement units, etc. The CPU module1008can correspond to a single core or a multi-core general purpose processor, such as those provided by Intel® Corporation, according to one embodiment.

The Graphics Processor Unit (GPU)1010can include one or more GPU cores and a GPU cache which can store graphics related data for the GPU core. The GPU core can internally include one or more execution units and one or more instruction and data caches. Additionally, the Graphics Processor Unit (GPU)1010can contain other graphics logic units that are not shown inFIG. 10, such as one or more vertex processing units, rasterization units, media processing units, and codecs.

Within the I/O subsystem1012, one or more I/O adapter(s)1016are present to translate a host communication protocol utilized within the processor core(s)1002to a protocol compatible with particular I/O devices. Some of the protocols that adapters can be utilized for translation include Peripheral Component Interconnect (PCI)-Express (PCIe); Universal Serial Bus (USB); Serial Advanced Technology Attachment (SATA) and Institute of Electrical and Electronics Engineers (IEEE) 1594 “Firewire”.

The I/O adapter(s)1016can communicate with external I/O devices1024which can include, for example, user interface device(s) including a display and/or a touch-screen display1040, printer, keypad, keyboard, communication logic, wired and/or wireless, storage device(s) including hard disk drives (“HDD”), solid-state drives (“SSD”), removable storage media, Digital Video Disk (DVD) drive, Compact Disk (CD) drive, Redundant Array of Independent Disks (RAID), tape drive or other storage device. The storage devices can be communicatively and/or physically coupled together through one or more buses using one or more of a variety of protocols including, but not limited to, SAS (Serial Attached SCSI (Small Computer System Interface)), PCIe (Peripheral Component Interconnect Express), NVMe (NVM Express) over PCIe (Peripheral Component Interconnect Express), and SATA (Serial ATA (Advanced Technology Attachment)). The display1040to display data stored in the plurality of memory devices in the memory module100.

Additionally, there can be one or more wireless protocol I/O adapters. Examples of wireless protocols, among others, are used in personal area networks, such as IEEE 802.15 and Bluetooth, 4.0; wireless local area networks, such as IEEE 802.11-based wireless protocols; and cellular protocols.

The ability to mitigate various supply chain attacks is provided by binding the SPD Hub content to the DIMM Certificate (DIMM attribute serial number302) that is used for authentication. Due to cryptographic signatures, the DIMM certificate is trusted by the platform so the binding of DIMM attributes to the DIMM certificate creates a secure way to ensure the DIMM components have not been tampered with and that the reported attributes of the DIMM are true. This enables effective mitigation for common memory attacks such as Address Aliasing and Row hammer that are dependent on DIMM attributes. It also mitigates supply chain attacks where discarded DIMMs are reused and repackaged as new, DRAM integrated circuits are swapped from DIMMs, and a DIMM's SPD Hub content is modified to report incorrect information and attributes about the DIMM. In addition, authentication and attestation of DIMMs is enabled, which is the foundation for link encryption and protection.

Besides what is described herein, various modifications can be made to the disclosed embodiments and implementations of the invention without departing from their scope.

Therefore, the illustrations and examples herein should be construed in an illustrative, and not a restrictive sense. The scope of the invention should be measured solely by reference to the claims that follow.