Configurable security memory region

A memory device comprises a memory array with I/O path and security circuitry coupled to the I/O path of the memory array. The memory device comprises control circuitry, responsive to configuration data, to invoke the security circuitry. The memory device comprises a configuration store, storing the configuration data accessible by the control circuitry to specify location and size of a security memory region in the memory array. Responsive to an external command and the configuration data, the control circuitry can be configured to invoke the security circuitry on an operation specified in the external command in response to accesses into the security memory region, or to not invoke the security circuitry in response to accesses to outside the security memory region.

BACKGROUND

Field

The present invention relates to high density memory devices, and particularly to memory devices including security regions.

Description of Related Art

Memories, including flash memories, can include a security region protected by security measures and a normal region not protected by security measures. A memory including a security region and a normal region may or may not be suitable for applications with varying requirements for the size of a security region and the size of a normal region. In other words, a security region of a memory may not meet the requirements of applications for a larger security region or a larger normal region than how the memory is manufactured.

It is desirable to provide technologies for a memory having a flexible security region and a flexible normal region.

SUMMARY

A memory device comprises a memory array with I/O path and security circuitry coupled to the I/O path of the memory array. The memory device comprises control circuitry, responsive to configuration data, to invoke the security circuitry. The memory device comprises a configuration store, storing the configuration data accessible by the control circuitry to specify location and size of a security memory region in the memory array. Responsive to an external command and the configuration data, the control circuitry can be configured to invoke the security circuitry on an operation specified in the external command in response to accesses into the security memory region, or to not invoke the security circuitry in response to accesses to outside the security memory region.

The security circuitry includes authentication circuitry to authenticate access to the security memory region. The security circuitry is configured to invoke the authentication circuitry before executing a decryption operation or an encryption operation in the security memory region. The security circuitry is configured to invoke the authentication circuitry before executing an erase operation in the security memory region.

The operation specified in the external command can include a program operation, and the security circuitry includes decryption circuitry to execute a decryption operation on data in the I/O path for the program operation to program decrypted data in the security memory region.

The operation specified in the external command can include a read operation, and the security circuitry includes encryption circuitry to execute an encryption operation on data in the I/O path from the security memory region for the read operation to provide encrypted data to a host external to the memory device.

The size of the security memory region specified by the configuration data can indicate a fraction of the memory array configured as the security memory region.

The control circuitry is configured to retrieve the configuration data stored in the configuration store. The external command specifies address information for the operation specified in the external command, and the control circuitry is configured to determine the accesses into the security memory region using the address information and the configuration data.

A method is provided for operating a memory device comprising a memory array with I/O path, and security circuitry coupled to the I/O path of the memory array.

The method comprises, responsive to configuration data, invoking the security circuitry; and storing the configuration data in a configuration store accessible by the control circuitry to specify location and size of a security memory region in the memory array. The method can comprise, responsive to an external command and the configuration data, invoking the security circuitry on an operation specified in the external command in response to accesses into the security memory region, or not invoking the security circuitry in response to accesses to outside the security memory region.

The method comprises authenticating access to the security memory region. The method comprises executing said authenticating access to the security memory region before executing a decryption operation or an encryption operation in the security memory region. The method comprises executing said authenticating access to the security memory region before executing an erase operation in the security memory region.

The operation specified in the external command can include a program operation. The method can comprise executing a decryption operation on data in the I/O path for the program operation, and programming decrypted data in the security memory region. The method can comprise

The operation specified in the external command can include a read operation. The method can comprise executing an encryption operation on data in the I/O path from the security memory region for the read operation, and providing encrypted data to a host external to the memory device.

The size of the security memory region specified by the configuration data can indicate a fraction of the memory array configured as the security memory region.

The method comprises retrieving the configuration data stored in the configuration store. The external command specifies address information for the operation specified in the external command. The method comprises determining the accesses into the security memory region using the address information and the configuration data.

DETAILED DESCRIPTION

The following description will typically be with reference to specific structural embodiments and methods. It is to be understood that there is no intention to limit the technology to the specifically disclosed embodiments and methods but that the technology may be practiced using other features, elements, methods and embodiments. Preferred embodiments are described to illustrate the present technology, not to limit its scope, which is defined by the claims. Those of ordinary skill in the art will recognize a variety of equivalent variations on the description that follows.

FIG. 1is a system diagram illustrating a system including a host and a memory device coupled to the host according to an embodiment of the present technology. As shown inFIG. 1, a system100includes a host110and a memory device200coupled to the host110, via lines that carry an external command112, data and address. The host110can issue an external command112to the memory device200. The external command112can specify an operation, such as a read, program or erase operation. For a program operation, the memory device200can receive encrypted data and an authentication code114from the host110. For a read operation, the memory device200can provide encrypted data and an authentication code to the host110. The host110can provide address116to the memory device200for the corresponding operation.

The host110can include a cipher115, for example, an AES (Advanced Encryption Standard) for encryption or decryption using a first secret key. The host110can encrypt data (i.e., plaintext in cryptography) into encrypted data (i.e., ciphertext in cryptography) using the AES with the first secret key. The AES defines a number of cipher transformations that are to be performed on the plaintext. The cipher transformations are repeated over a number of encryption rounds. The number of rounds is determined by the key length of the first secret key, for example, with 10 rounds for 128-bit keys, 12 rounds for 192-bit keys and 14 rounds for 256-bit keys.

The host110can generate the authentication code on the encrypted data (i.e., ciphertext), and not on the plaintext, using a second secret key different than the first secret key. The host110can send the authentication code to the memory device200.

The memory device200includes security circuitry270, and a memory array260including a security memory region (261,FIG. 2). For an operation in the security memory region261of the memory array260, the security circuitry270first authenticates the access to the security memory region261in the memory device200, using the authentication code received from the host110with the second secret key. If the authentication is passed, the security circuitry270can hence execute a decryption operation for a program operation or an encryption operation for a read operation in the security memory region261, accordingly.

The external command112specifies address information for the operation specified in the external command112. The memory device200includes a configuration store, storing configuration data to specify location and size of the security memory region261. The security circuitry270authenticates the access to the security memory region261using the address information and the configuration data.

For a program operation on the encrypted data from the host110, a decryption operation can be executed on the encrypted data from the host110by security circuitry270. The decrypted data can then be programmed in the security memory region (261,FIG. 2) in the memory array260. For a read operation on the decrypted data stored in the security memory region261in the memory device200, an encryption operation can be executed on the decrypted data by the security circuitry270. The encrypted data can then be provided to the host110external to the memory device200.

FIG. 2is a simplified chip block diagram of an integrated circuit memory device200according to an embodiment of the present technology. A memory device200includes a memory array260with I/O path and security circuitry270coupled to the I/O path of the memory array269via lines265. The memory device200includes control circuitry210, responsive to an external command112and configuration data, to invoke the security circuitry270on an operation specified in the external command112in response to accesses into a security memory region261in the memory array260, or to not invoke the security circuitry270in response to accesses to outside the security memory region262. As shown inFIG. 2, the control circuitry210is coupled to the security circuitry270via lines212.

The external command112is received on input/output lines295. Input data is supplied via the input/output lines295from input/output ports201on the memory device200or from other data sources internal or external to the memory device200, such as a general purpose processor or special purpose application circuitry, or a combination of modules providing system-on-a-chip functionality supported by the memory array260, to the input/output circuits290. Output data is provided to the input/output lines295by the input/output circuits290.

A bus interface280is coupled to the control circuitry210via lines211, coupled to the input/output circuits290via lines285, coupled to the memory array260via lines266, and coupled to the security circuitry270via lines275. The I/O path includes the lines265coupled to the memory array260and to the security circuitry270, and the lines275coupled to the security circuitry270and to the bus interface280.

The memory device200comprises a configuration store220, storing the configuration data accessible by the control circuitry210to specify location and size of the security memory region261. The configuration store220is coupled to the control circuitry210via lines215. The configuration store220can include a register storing the configuration data accessible by the control circuitry210.

The security circuitry270includes authentication circuitry270A to authenticate access to the security memory region261. The security circuitry270is configured to invoke the authentication circuitry270A before executing a decryption operation or an encryption operation in the security memory region261. The security circuitry270is configured to invoke the authentication circuitry270A before executing an erase operation in the security memory region261.

The operation specified in the external command112can include a program operation, and the security circuitry270includes decryption circuitry270D to execute a decryption operation on data in the I/O path for the program operation to program decrypted data in the security memory region261.

The operation specified in the external command112can include a read operation, and the security circuitry270includes encryption circuitry270E to execute an encryption operation on data in the I/O path from the security memory region261for the read operation to provide encrypted data to a host110external to the memory device200.

The location of the security memory region261specified by the configuration data can indicate a boundary of the security memory region261. The size of the security memory region261specified by the configuration data can indicate a fraction of the memory array260configured as the security memory region261, as further described in reference toFIG. 4.

The control circuitry210is configured to retrieve the configuration data stored in the configuration store220. The external command112specifies address information for the operation specified in the external command112, and the control circuitry210is configured to determine the accesses into the security memory region261using the address information and the configuration data.

Addresses are supplied on bus241to an address generator240which can include word line and bit line decoders. The address generator240is coupled to lines245, such as word lines and bit lines, for reading and programming data from the memory cells in the memory array260.

In an embodiment shown inFIG. 2, control circuitry210using a bias arrangement state machine controls the application of biasing arrangement supply voltages230, such as read and program voltages. The control circuitry210can include modes of operation for programming, reading and erasing memory cells. The control circuitry210can be implemented using special-purpose logic circuitry as known in the art. In some alternative embodiments, the control circuitry210comprises a general-purpose processor, which can be implemented on the same integrated circuit, which executes a computer program to control the operations of the device. In other alternative embodiments, a combination of special-purpose logic circuitry and a general-purpose processor can be utilized for implementation of the control circuitry210.

FIG. 3is a simplified flowchart illustrating a flow for operating a memory device200as described in reference toFIG. 2. The memory device200includes a memory array260with I/O path, and security circuitry270coupled to the I/O path of the memory array260.

At Step310, an external command112is received on the memory device200. The external command112includes address information for writing to or reading from the memory device200.

At Step320, the process determines whether the address information indicates accesses into a security region261in the memory device200or accesses to outside the security memory region262in the memory device200. The determination can be made using the address information for the operation specified in the external command112, and the configuration data stored in the configuration store (220,FIG. 2). The configuration data is accessible by the control circuitry210. The control circuitry210can retrieve the configuration data from the configuration store220. The configuration data specifies location and size of the security memory region261in the memory device200.

If the address information indicates accesses to outside the security memory region262in the memory device200, the flow then proceeds to Step330, and executes a program, read or erase operation outside the security memory region (262,FIG. 2) in the memory device200. This operation bypasses the security circuitry270, by sending data between the bus interface (280,FIG. 2) and outside the security memory region262via the lines (266,FIG. 2) coupling the bus interface280and outside the security memory region262. If the address information indicates accesses into the security region261in the memory device200, the flow then proceeds to Step340.

At Step330, the security circuitry270is not invoked, and a read, program or erase operation specified in the external command112can be executed outside the security memory region (262,FIG. 2) in the memory device200.

At Step340, the security circuitry270is invoked on a read, program, or erase operation specified in the external command112. The flow then proceeds to Step350.

At Step350, authentication of the access to the security memory region261is executed, before a decryption operation, an encryption operation or an erase operation is executed in the security memory region261. At Step360, if the authentication is passed, the flow proceeds to Steps370,380, or390to execute a read, program or erase operation, respectively, according to the operation specified in the external command112. If the authentication is not passed, the flow then ends.

At Step370, for a program operation specified in the external command112, a decryption operation is executed on data in the I/O path coupled to the security circuitry270, using the decryption circuitry (270D,FIG. 2) in the security circuitry270. At Step375, the decrypted data is then programmed in the security memory region (261,FIG. 2) in the memory device200, according to the address information specified in the external command112.

At Step380, for a read operation specified in the external command112, an encryption operation is executed on data in the I/O path from the security memory region (261,FIG. 2) in the memory device200, according to the address information specified in the external command112. At Step385, the encrypted data is then provided to a host110external to the memory device200.

At Step390, an erase operation is executed in the security memory region261. For instance, an erase operation can be executed on blocks of 4 kB (kilobytes), 32 kB, and 64 kB.

FIG. 4is a diagram illustrating configuration of the security memory region261according to an embodiment of the present technology. The configuration data stored in the configuration store (220,FIG. 2) can specify location and size of the security memory region261. The size of the security memory region261specified by the configuration data stored in the configuration store (220,FIG. 2) can indicate a fraction of the memory array configured as the security memory region261.

In one embodiment of the present technology, the configuration data can include a set of configuration bits. As shown in the example ofFIG. 4, the set of configuration bits includes 2 configuration bits having four binary values 2′b00, 2′b01, 2′b10, and 2′b11. The four binary values can correspond to respective fractions of the security memory region261over the memory array which includes the security memory region261and outside the security memory region262. For example, the binary values 2′b00, 2′b01, 2′b10, and 2′b11 can correspond to fractions of 0/4, ¼, ¾, and 4/4, respectively.

In this example, the binary value 2′b00 of the configuration bits specifies that the memory array has no security memory region (410). The binary value 2′b01 of the configuration bits specifies that ¼ of the memory array is configured as security memory region (420), or that ¾ of the memory array is configured as outside the security memory region. The binary value 2′b10 of the configuration bits specifies that ¾ of the memory array is configured as security memory region (430), or that ¼ of the memory array is configured as outside the security memory region. The binary value 2′b11 of the configuration bits specifies that all of the memory array is configured as the security memory region (440).

In an alternative embodiment of the present technology, the set of configuration bits can include more than 2 configuration bits, such as 3 or 4 bits, to specify more granularity for the size of the security memory region as a fraction of the memory array. For instance, a set of configuration bits including 3 configuration bits can have eight binary values 3′b000, 3′b001, 3′b010, 3′b011, 3′b100, 3′b101, 3′b110, and 3′b111, correspond to fractions of 0/8, ⅛, 2/8, ⅜, ⅝, 6/8, ⅞, and 8/8 respectively, indicating a fraction of the memory array configured as the security memory region.

The location specified in the configuration data stored in the configuration store can indicate a boundary of the security memory region. For instance, a memory array can have addresses starting at a base address 0. The boundary can indicate the starting address for the security memory region, which can be the base address 0 of the memory array or an address higher than the base address.

In one embodiment, the configuration data stored in the configuration store220can be specified in a test mode at factory, to specify the location and size of the security memory region261. In an alternative embodiment, the configuration data stored in the configuration store220can be specified using a user command in a user mode when the memory device is released in the field, to specify the location and size of the security memory region261. The location and size of the security memory region261specified in the test mode can be overwritten by the location and size of the security memory region261specified in the user mode in the field after factory release.