Abstract:
A secure memory card with encryption capabilities comprises various life cycle states that allow for testing of the hardware and software of the card in certain of the states. The testing mechanisms are disabled in certain other of the states thus closing potential back doors to secure data and cryptographic keys. Controlled availability and generation of the keys required for encryption and decryption of data is such that even if back doors are accessed that previously encrypted data is impossible to decrypt and thus worthless even if a back door is found and maliciously pried open.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS  
       [0001]     This application is related to the following applications, each of which is hereby incorporated by this reference in its entirety: “Memory System With In Stream Data Encryption/Decryption and Error Encryption” to Micky Holtzman et al., Attorney Docket No. SNDK.381US0; “Memory System With In Stream Data Encryption/Decryption” to Micky Holtzman et al., Attorney Docket No. SNDK.381US1; and “Hardware Integrity Check of Controller Firmware” to Micky Holtzman et al., Attorney Docket No. SNDK.408US0. 
     
    
     FIELD OF THE INVENTION  
       [0002]     The invention generally relates to memory cards and encryption, and in particular relates to eliminating the access to secure data and keys through the testing mechanisms in the card.  
       BACKGROUND OF THE INVENTION  
       [0003]     Quite some time ago an intelligent memory card commonly referred to as the Smart Card was developed and gained acceptance in the marketplace as a form of identification and payment. The Smart Card contains a small amount of memory for storing a user&#39;s identification data and for storing transactional related data. The Smart Card is also often referred to as a chip card and is employed in Japan for various things such as the national identity card and in various places as a type of credit or debit card. In order to prevent identity theft and other monetary fraud, various chip designs and encryption schemes have been employed in the cards and the systems that utilize the cards.  
         [0004]     In designing and manufacturing any type of secure memory card, there are two competing interests. One interest is maximizing the security of the card, while the other interest is maximizing the reliability of the card. In order to maximize the reliability of the card, it is important to be able to test the software and the hardware of the card at various manufacturing stages before it ships from the factory, and on some occasions even after it has left the factory in order to perform failure analysis. Testing may involve input and output of signals through test or contact pads on the chip to test both the hardware and software of the card. These test routines and test pads are necessary to ensure quality control but are a potential weak spot or “back door” to the secure data, algorithms, and keys of the card. Thus, there always exists some degree of compromise between (the testing necessary for) maximizing reliability and maximizing security. Different approaches have been put forth to close this “back door” after testing is complete. However, for various reasons prior solutions to date each have commercial and technical shortcomings.  
         [0005]     In one approach, which is believed to be that employed in creation of the aforementioned Smart Card, die of the card is tested before singulation of the memory die from the wafer. The test pads for a particular die are located on an adjacent die of the wafer, and the singulation process severs the test pads from all circuitry of the adjacent die after testing. Therefore, any test pads present on a singulated die are completely isolated and closed as a potential back door to the secure data of the final memory card. However, it is not always practical or desirable to completely remove the test pads. For example, the lack of usable test pads precludes some amount of subsequent hardware based testing of the memory, which, for example, limits the potential methods of failure analysis.  
         [0006]     While this approach may be preferred for a Smart Card, which typically only has a small amount of memory necessary to hold identification and transactional data, it is insufficient to test the comparatively massive amount of memory and complex security routines employed in a mass storage memory card used for storing multiple large files such as photos and music. Some examples of these mass storage memory cards are the Compact Flash card, MMC card, and SD card. The spread of digital content and the associated copyright issues elevate the importance of security, while at the same time the testing and reliability of the card remain paramount. A more comprehensive and flexible system for manufacturing, testing and operating secure mass storage memory cards is needed and is provided by the present invention which will be described below.  
         [0007]     Another important aspect is cost. Several different technologies, such as non-volatile memory, logic, and volatile memory, can be fabricated on a single integrated circuit die (chip). However, mixing different technologies in one die significantly increases the cost of production. In a competitive environment where cost is a major driving force, it is highly desirable to limit the amount of different of technologies provided on one die. However, using multiple die may mean that sensitive information has to pass from one die to another in the final product. This is another potential weakness a hacker can exploit if appropriate precautions are not employed.  
         [0008]     In particular, non volatile memory bits are expensive to mix with logic within the same die. The Smart Card employs non-volatile memory for data storage purposes in the same die as the logic that runs the Smart Card, which is a way of maximizing security. However, nowadays a memory card that benefits from the present invention must store very large music, photo, movie and other user files. Thus, it is cost prohibitive to manufacture a single integrated circuit die memory card that can store massive amounts of information (on the order of several gigabytes in 2005. and increasing), and it is necessary to develop a secure system employing multiple die. In particular, it is highly desirable to create a secure system (employing encryption and decryption) utilizing one or more discrete (cost effective) flash memory die that are separate from the controller die and that can be thoroughly tested before and after assembly, yet is invulnerable to attacks via the test mechanisms.  
       SUMMARY OF INVENTION  
       [0009]     Because it is overly costly and presents problems in scalability to utilize a single chip that has both the controller functionality and the massive amounts of storage required by today&#39;s digital devices, an alternative system has been developed. With a single chip solution security can be achieved with unique chip design that makes it difficult to access testing mechanisms, encryption keys, and encrypted content. However, with a multiple chip design where content passes from a separate memory chip to a controller chip where encryption occurs, special attention must be paid to guarding access to encryption keys and to encrypted content. Furthermore, in a system that (preferably) still has test pads in the final assembly to allow for testing of the assembled system, special attention must be paid to any mechanisms in software and hardware that may serve as a back door for unauthorized access to the encrypted keys and content.  
         [0010]     The present invention has numerous life cycle phases that are entered and passed through during the life of the card. Depending on the phase, logic in the card enables or disables the encryption engine, controls access to hardware (before and after wafer singulation and card assembly) and software testing mechanisms, and controls key generation. These phases not only allow both the hardware and software of the card to be thoroughly tested before and after manufacture (unlike in the Smart Card where the test pads are removed), but also make it virtually impossible to access the encrypted keys and thus the encrypted content when the card is in a secure phase, the operating phase that the card is in when it is shipped to the user. Therefore, the present invention provides for a memory card that can be well tested but is also resistant to unauthorized access to protected data within the card.  
         [0011]     Furthermore, a more comprehensive and flexible system for manufacturing, testing and operating secure mass storage memory cards is needed and is provided by the present invention which will be described below.  
         [0012]     Additional aspects, advantages and features of the present invention are included in the following description of exemplary examples thereof, which description should be taken in conjunction with the accompanying figures, wherein like numerals are used to describe the same feature throughout the figures. All patents, patent applications, articles and other publications referenced herein are hereby incorporated herein by this reference in their entirety for all purposes. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0013]      FIG. 1A  is a schematic diagram of system  10  according to an embodiment of the present invention.  
         [0014]      FIG. 1B  is a schematic diagram of another embodiment of system  10 .  
         [0015]      FIG. 2A  is a flowchart illustrating the various life cycle phases in an embodiment of the present invention.  
         [0016]      FIG. 2B  is a chart of the various life cycle phases.  
         [0017]      FIG. 3  is a flow chart illustrating the boot up process and life cycle phases. 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS  
       [0000]     Memory System Architecture  
         [0018]     An example memory system in which the various aspects of the present invention may be implemented is illustrated by the block diagram of  FIG. 1A . As shown in  FIG. 1A , the memory system  10  includes a central processing unit (CPU) or controller  12 , a buffer management unit (BMU)  14 , a host interface module (HIM)  16 , flash interface module (FIM)  18 , a flash memory  20  and a peripheral access module  22 . Memory system  10  communicates with a host device  24  through a host interface bus  26  and port  26   a . The flash memory  20 , which may be of the NAND type, provides data storage for the host device  24 . The software code for CPU  12  may also be stored in flash memory  20 . FIM  18  connects to the flash memory  20  through a flash interface bus  28  and in some instances a port, which is not shown, if the flash memory  20  is a removable component. HIM  16  is suitable for connection to a host system like a digital camera, personal computer, personal digital assistant (PDA) and MP-3 players, cellular telephone or other digital devices. The peripheral access module  22  selects the appropriate controller module such as FIM, HIM, and BMU for communication with the CPU  12 . In one embodiment, all of the components of system  10  within the dotted line box may be enclosed in a single unit such as in memory card and preferably enclosed in the card.  
         [0019]     The buffer management unit  14  comprises a host direct memory access unit (HDMA)  32 , a flash direct memory access unit (FDMA)  34 , an arbiter  36 , a CPU bus arbiter  35 , registers  33 , buffer random access memory (BRAM)  38 , and a crypto-engine  40  also referred to as encryption engine  40 . The arbiter  36  is a shared bus arbiter so that only one master or initiator (which can be HDMA  32 , FDMA  34  or CPU  12 ) can be active at any time and the slave or target is BRAM  38 . The arbiter is responsible for channeling the appropriate initiator request to BRAM  38 . HDMA  32  and FDMA  34  are responsible for data transported between HIM  16 , FIM  18  and BRAM  38  or the RAM  11 . The CPU bus arbiter  35  allows for direct data transfer from crypto-engine  40  and flash DMA  34  to RAM  11  via system bus  15 , which is used in certain situations such as for example when it is desired to bypass the crypto-engine. The operation of the HDMA  32  and of the FDMA  34  are conventional and need not be described in detail herein. The BRAM  38  is used to store data passed between the host device  24  and flash memory  20 . The HDMA  32  and FDMA  34  are responsible for transferring the data between HIM  16 /FIM  18  and BRAM  38  or the CPU RAM  12 a and for indicating sector completion.  
         [0020]     When data from flash memory  20  is read by the host device  24 , encrypted data in memory  20  is fetched through bus  28 , FIM  18 , FDMA  34 , and crypto-engine  40  where the encrypted data is decrypted and stored in BRAM  38 . The decrypted data is then sent from BRAM  38 , through. HDMA  32 , HIM  16 , bus  26  to the host device  24 . The data fetched from BRAM  38  may again be encrypted by means of crypto-engine  40  before it is passed to HDMA  32  so that the data sent to the host device  24  is again encrypted but by means of a different key and/or algorithm compared to those whereby the data stored in memory  20  is encrypted. Alternatively, rather than storing decrypted data in BRAM  38  in the above-described process, which data may become vulnerable to unauthorized access, the data from memory  20  may be decrypted and encrypted again by crypto-engine  40  before it is sent to BRAM  38 . The encrypted data in BRAM  38  is then sent to host device  24  as before. This illustrates the data stream during a reading process.  
         [0021]     When data is written by host device  24  to memory  20 , the direction of the data stream is reversed. For example if unencrypted data is sent by host device, through bus  26 , HIM  16 , HDMA  32  to crypto-engine  40 , such data may be encrypted by engine  40  before it is stored in BRAM  38 . Alternatively, unencrypted data may be stored in BRAM  38 . The data is then encrypted before it is sent to FDMA  34  on its way to memory  20 .  
         [0000]     Life Cycle Phases  
         [0022]     A security system or secure operating system that is particularly useful when implemented in a memory card, such as the one described above, for example, has different phases or states. These phases are preferably entered sequentially, such that after progressing from one phase to the next, the previous phase cannot be re-entered. Therefore, they can be thought of as life cycle phases.  
         [0023]     Before describing the phases in detail, another system level diagram will be briefly discussed.  FIG. 1B  illustrates another embodiment of system  10 . Only certain of the components of system  10  are illustrated in this figure for simplicity and clarity. Memory system  10  comprises test pads also referred to as hardware test input/output (I/O)  54 . Hardware bus (HW bus)  56  is preferably connected to test pads  54 . These test pads and HW bus  56  are connected to various hardware and circuitry (not shown) of system  10  and are used to test the hardware and circuitry of system  10 . JTAG bus  62  is connected the system bus  15 . (seen in  FIG. 1A ) and can be used to replace the controller firmware and drive hardware blocks from outside system  10 . It is used for hardware testing that requires register read/write operations. Since JTAG bus  62  can access the RAM and ROM it is also used to test the firmware of system  10 . Host bus  26  is utilized to send diagnostic commands to system  10  and is used to test the firmware of the system.  
         [0024]     NVM  50  of encryption engine  40  is also shown. Stored within NVM  50  are (values for) life cycle state  77  and secret key  99 . NVM test port  58  is used to test the NVM within encryption engine  40 .  
         [0025]     The state indicator fuse  66  is used to indicate that the product is in NVM state  110  (described below) rather than relying on the NVM content. The reason is that the reliability of an initial value stored in NVM during fabrication cannot be guaranteed. Therefore another more reliable indicator such as a fuse is used. The system will determine that it is in state  110  if the fuse is set. If the system  10  is reset it will look at the NVM life cycle state  77  to determine the state.  
         [0026]      FIG. 2A  illustrates the various states and the order of transition between the states. Each state defines different behavior and capabilities of the card (or other system in which it is implemented), before and after the card is manufactured, as can be seen in the following table, which is also reproduced as  FIG. 2B .  
                                                       Key   NVM   HW   FW   Crypto-       State   Generation   Test   Test   Test   engine                   110   Regenerated   E   E   E   D           every power up       120   Constant and   D   E   E   E           hard wired       130   Generated   D   E   E   E           once       150   —   D   D   D   E       160   Regenerated   D   E   E   E           every power up       170   —   D   E   E   D                    
         [0027]     The state is preferably stored as a 32 bit value within the non volatile memory of the encryption engine. There are 5 pre-assigned values out of a huge number of possible (≈10 9 ) combinations that are used to represent states  120 ,  130 ,  150 ,  160 , and  170 . All other values are indicative of state  110 . This is so because it cannot be guaranteed that a defined value can be reliably stored during fabrication and retrieved thereafter because various processing operations during fabrication, assembly, testing, and shipping may alter any stored value in memory.  
         [0028]     The key value is also preferably stored as a  128  bit field in the non volatile memory of the encryption engine. The key value is normally generated randomly by a seeded algorithm. Regeneration of the key is highly likely to change the value of the key, but this cannot be guaranteed because a (pseudo) random number generator may in fact generate the same value successively. However, the terminology of changing the key is used interchangeably with that of regenerating the key in this application even though it is well understood the value of the key may not change during regeneration. Needless to say, the value of the key used to encrypt information is critical. The same key value must be used for both encryption and decryption. Thus, if a key value is regenerated at every power up of the system, data that was encrypted before that power up is virtually worthless because it cannot be decrypted with the new key. Although the data is still physically present in the memory of the card, the data is useless without the proper key value to unlock it. Thus, if a hacker manages to somehow force the card back into a state, other than secure state  150 , he will not be able to get any worthwhile information. In states  110  and  160 , a new key will be generated at every power up and the key used to previously store information in state  150  will not be available to decrypt that information. In states  170  and  110  the encryption engine is simply not available, regardless of the key value.  
         [0029]     Another security measure comprises limiting the availability of firmware and hardware test mechanisms. The system comprises logic that will either enable or disable the mechanisms. The previously described host bus is one of the mechanisms used to test the firmware of the card. The host can issue diagnostic commands over the host bus to test the firmware. The hardware may also be tested when these commands are executed. The hardware is also directly tested over the hardware bus as well as the JTAG port, which provides direct access to various memories of the system. Note that in state  150  the NVM test mechanisms, HW test mechanisms, and FW test mechanisms are all disabled.  
         [0030]     The states and the passage between the states as seen in  FIG. 2A  will now be described in further detail.  
         [0031]     State  110  is referred to as the controller non-volatile memory (NVM) test. This state is the initial state after fabrication of the memory die, and is the state that is used to test non volatile memory of the controller die before the die is packaged and installed into the memory card. The testing that occurs in this state may be performed before singulation while the dice are still integral in wafer format, or may alternatively be performed on the individual die after singulation. Once the NVM is tested, its content (using the NVM tester) is initialized to indicate state  120 , and fuse  66  is blown. In this state the encryption engine  40  is disabled. This state is only designed to be entered into once in the life cycle of the card and there is no method within the system for returning to this state. However, as discussed previously, this state is indicated by anything other than the 5 pre-assigned values of the many possible combinations of the 32 bit value used to define the life cycle state. Therefore, each time the card is powered up and is in this state, a new key will be randomly generated, and the previously encrypted data impossible to decrypt. If an illegal value is detected and the fuse is blown (not allowing NVM state  110  to be entered) the crypto-engine will never become ready and the system will not boot, i.e. it will not go beyond step  302  described below with regard to  FIG. 3 . Even though the encryption engine is not enabled in this mode, because the mode is designed to be used to test the controller NVM during fabrication, the key is still regenerated at every power up to protect against a hacker who may in some unforeseen way enter this state and try to probe the secure data of the card via the various test ports and mechanisms. Otherwise, by design, after exiting state  110 , the NVM testing mechanisms are no longer available.  
         [0032]     State  120  is referred to as the constant enabled state. This state is used for controller and memory testing during assembly. In this state the encryption engine  40  is enabled. The key that the encryption engine will use is not generated by the random number generator, and is not stored in memory, but is hard wired to some external source and constant during this phase. The hardware and software testing mechanisms are available in this state. This state is entered by a hardware tester.  
         [0033]     State  130  is referred to as the random enabled state. This state is similar to state  120 , however, the secret key is randomly generated (once) when state  130  is entered instead of being constant and hard wired. This is the state used for final testing, characterization, and qualification of the memory card. Cryptographic operations including encryption and decryption are possible with the firmware using a secret key or a key derived from the secret key. This state is entered by code that is loaded into system  10  by host device  24  and then executed by system  10 .  
         [0034]     State  150  is referred to as the secured state. This is the state in which the card is shipped from the factory. The hardware and software test mechanisms are disabled by the card logic and cannot be accessed. This state is entered at the end of testing and configuration of the product on the manufacturing floor. The key is not regenerated and the value that was stored in memory during the previous state is utilized during state  150 . While derivative keys may be utilized for various operations of the card, the key  99  will always be necessary to derive those keys and to encrypt and decrypt data. This key is meant to be utilized for the life of the secure card (while in the hands of the consumer as a secure card, not after). The firmware in the card cannot use the secret key for any operation. It is the hardware of the encryption engine that is responsible for performing all encryption and decryption within the card. This state is entered by DLE code.  
         [0035]     State  160  is referred to as the returned merchandise authorization or RMA state. This state is designed to allow testing of a card that has been returned by a consumer because it is not working properly. This is the state in which failure analysis of the card can be performed. The software and hardware test mechanisms are again available. It is important to note that this state is only accessible by the factory. Furthermore, after the RMA state is entered, the card can never again be used as a secure card. In other words, it can never again enter state  150  or otherwise be used to decrypt information resident on the card or to save encrypted information to the card. The secret key is regenerated when this mode is entered and during every chip reset performed while the card is in this state. Operation using the secret key for decryption is enabled only at boot time and the firmware cannot use the secret key for any operations. This state is entered by a ROM code that is the result of a host command.  
         [0036]     State  170  is referred to as the disabled state. In the disabled state, the crypto-engine  40  is in bypass mode with all of the cryptographic abilities disabled. Only non-secure algorithms are used within the card. Hardware and software test mechanisms are again enabled because without the encryption engine there is nothing worthy of being hacked or otherwise tampered with. Any encrypted information can no longer be decrypted and is rendered worthless. Also, no additional information may be encrypted and subsequently decrypted. This state may be used to produce a non-secure or “regular” card. In this way, the same system can be used to produce both secure and non-secure memory cards. The difference is that in the non-secure card the security system of the card is in the disabled state, or the card can more generally be said to be in state.  170 . The disabled state can also be used to re-ship a product that has been sent back to the factory for failure analysis, and has therefore been passed into RMA state  160 . As mentioned above, after a card enters into RMA state  160 , it can never return to any of the previous states, and may never be sold again as a secure card. However, a card that is functional or can be made functional again at the factory can be placed into disabled state  170  and re-sold as a non-secure card. In this way, the card can be salvaged and would for all intensive purposes be the same as a new non-secure or “regular” card. Both the salvaged non-secure card and a new non secure card will be running the same firmware in the same state.  
         [0037]     Currently, the vast majority of cards are non-secure cards. While the drive to bring to market secure cards is high due mainly to the demands of content providers, it is unclear what percentage of future memory card sales will be for secure cards vs. non-secure cards. What is clear is that there should likely always be an abundance of non secure content and therefore a demand for non-secure cards. The present invention not only enables testing of all of the hardware and software of a secure card (by only authorized personnel), but also provides the ability to salvage returned secure cards for various non-secure uses. Moreover, the system of the present invention allows for a card that has robust security, but that need not be discarded or have its security system compromised (with accessible “back doors”) in order to perform failure analysis. Given the widespread and increasing proliferation of devices that use memory cards, the ability to salvage what would otherwise be a defective secure card is a great benefit to the consumer and manufacturer alike.  
         [0038]      FIG. 3  illustrates the booting process for a memory card implementing the system described above. For more information on the boot up process please refer to a co-pending application to M. Holtzman et al., attorney docket No. SNDK.408US0, hereby incorporated by reference in its entirety.  
         [0039]     In step  302 , the system checks if the cryptographic hardware, including crypto-engine  40  and other components, is ready. The system will wait to proceed until the hardware is ready. When the hardware is ready the system advances to step  304 . In step  304  the system checks to see if the card is in state  170 , the disabled state. If the card is in state  170 , in step  306  the system will upload the boot loader (“BLR”) which is a minimal amount of startup code, from flash memory  20  to RAM  11 . Next, in step  308  the system checks to see if the BLR was properly uploaded. If so, in step  310  the system will upload the firmware necessary to run in non-secure mode (the standard firmware minus the cryptographic functionality). If the BLR was not properly uploaded in as determined in step  308 , the system will advance to step  324  described below.  
         [0040]     If in step  304  the system determined that the card was not in state  170 , the system will clear the RAM contents in step  312 . After that the system will again check to see what state the card is in step  314 . If the card is in state  120 , or  130 , the BLR will be uploaded in step  316 . In step  318  the system will check to see if the BLR was properly uploaded. Next, in step  320  an integrity check of the BLR code will be performed. This integrity check is a hardware based check performed by calculating message authentication code (MAC) values and comparing them with reference values. The result of the integrity check is a simple flag stored in memory. In step  322  the firmware checks the flag to see if the integrity was verified or not. If the integrity is OK, the system will then in step  342  upload the firmware necessary to run in secure mode, which also of course allows for non secure data to be stored and retrieved. If the integrity is not OK as determined in step  322 , the system will wait for a diagnostic command from the host to download and execute certain instructions from the host (DLE command), as is represented by step  324 . If a DLE command is received, as seen in step  326 , the system will proceed to load the DLE code into RAM in step  328 . In step  330  the DLE code will be executed by the controller.  
         [0041]     If in step  314  it was determined that the card was not in state  120 ,  130 , or  140  the system will check in step  332  to see if the card is in state  150 . If so, the system will then upload the BLR in step  334 . This is done by the ROM code. If the BLR upload was OK, as determined in step  336 , a hardware based integrity check, as described above in step  320 , will be performed in step  338 . After this hardware based integrity check, another integrity check, this time a software based integrity check will be performed in step  340 . If the integrity is OK, the system will then in step  342  upload the firmware necessary to run in secure mode, which also of course allows for non secure data to be stored and retrieved.  
         [0042]     If in step  332  it was determined that the card was not in state  150 , the system will then check the state of card and if the card is in state  160  and if so it will wait for a diagnostic command as represented by step  348 . If, however, in step  344  it is determined that the card was not in state  160 , the system will wait for a command to go into RMA state  160 , as seen in step  346 .  
         [0043]     Although the various aspects of the present invention have been described with respect to exemplary embodiments thereof, it will be understood that the present invention is entitled to protection within the full scope of the appended claims.