Patent Publication Number: US-8539251-B2

Title: Memory for protecting data, memory system including the memory, and method of driving the memory

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This application claims the benefit of Korean Patent Application No. 10-2009-0018425, filed on 4 Mar. 2009, in the Korean Intellectual Property Office, the disclosure of which is herein incorporated by reference in its entirety. 
     BACKGROUND 
     1. Technical Field 
     The inventive concept relates to a memory and a memory system including the memory, and more particularly, to a memory which may prevent encryption keys or data from being exposed outside the memory, a memory system including the memory, and a method of driving the memory. 
     2. Description of Related Art 
     In a memory system including a memory storing personal information or important data, to prevent the data stored in the memory from being monitored by, or exposed to, an external attacker, a method of encoding and decoding the data of the memory is used. 
     In a conventional method of encoding/decoding data of a memory, data input to the memory from the outside is encrypted and stored or encrypted data stored in the memory is decoded and output by using an encryption key having a fixed length, for example, one byte. However, in the data encoding/decoding method, since the same encryption key is used for encoding and decoding data, the data or encryption key may be exposed by external hacking attacks. Also, since a conventional encryption key is stored in a fixed area of a memory, if the area is exposed to the outside, the data or encryption key may become weak to the external hacking attacks. 
     SUMMARY 
     According to an exemplary embodiment of the inventive concept, a memory for protecting data includes a first storage area storing N-number of encryption keys, where N is a natural number, a second storage area receiving the N-number of encryption keys from the first storage area and storing again the received N-number of encryption keys, and a selection unit selecting one of the N-number of encryption keys stored in the second storage area according to a control signal, and encoding data input from the outside using a selected encryption key or decoding the data stored in the first storage area using the selected encryption key. 
     According to another exemplary embodiment of the inventive concept, a memory system for protecting data includes a CPU and a memory communicating data with the CPU. 
     According to another exemplary embodiment of the inventive concept, a method of driving a memory to protect data includes receiving an input of N-number of encryption keys, wherein N is a natural number, storing again the N-number of encryption keys stored in the first storage area in the second storage area, selecting one of the N-number of encryption keys stored in the second storage area according to a control signal, and encoding data input from outside the memory using a selected encryption key or decoding the data stored in the first storage area using the selected encryption key. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       Exemplary embodiments of the inventive concept will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings in which: 
         FIG. 1  is a schematic block diagram of a memory for protecting data according to an exemplary embodiment of the present invention; 
         FIG. 2  is a flowchart for explaining the operation of the memory of  FIG. 1 ; and 
         FIG. 3  is a schematic block diagram of a memory system including the memory of  FIG. 1 . 
     
    
    
     DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS 
     The attached drawings for illustrating exemplary embodiments of the inventive concept are referred to in order to gain a sufficient understanding of the inventive concept and the merits thereof. Hereinafter, the inventive concept will be described in detail by explaining exemplary embodiments of the inventive concept with reference to the attached drawings. Like reference numerals in the drawings denote like elements. 
       FIG. 1  is a schematic block diagram of a memory  100  for protecting data according to an exemplary embodiment of the present invention. Referring to  FIG. 1 , the memory  100  may include a first storage area  110 , a second storage area  120 , and a selection unit  130 . The first storage area  110  includes a plurality of areas. For example, the first storage area  110  may include a plurality of data storage areas DA 1 , DA 2 , . . . , DAn, a user storage area UA, and a reset area Reset. 
     The data storage areas DA 1 , DA 2 , . . . , DAn may store data Data that is provided from outside the memory  100  and encoded. The selection unit  130  may generate encoded data E_Data stored in the data storage areas DA 1 , DA 2 , . . . , DAn. The user storage area UA may store a plurality of encryption keys, for example, N-number of encryption keys Kn, where “N” is a natural number. Each of the encryption keys Kn may be a code of 1 byte, that is, 8 bits. The encryption keys may be input to a user. 
     A reset handler may be stored in the reset area Reset. The reset handler may be driven by a reset signal rst input from outside the memory  100 , for example, one generated when the user resets the memory  100 . The driving of the memory  100  may be initiated from the user storage area UA according to a predetermined command routine. 
     For example, in addition to the N-number of encryption keys Kn, a plurality of driving commands such as a memory enable code to perform the initial driving of the memory  100  may be further stored in the user storage area UA. Also, a set of commands to initiate the driving of the memory  100  from the user storage area UA by jumping to the user storage area UA of the first storage area  110  when the reset signal rst is input from the outside, may be stored in the reset handler of the reset area Reset. 
     Accordingly, when the reset signal rst is input to the memory  100 , the memory  100  jumps to the user storage area UA by the reset handler, and the driving of the memory  100  is initiated by the initial driving commands of the memory  100  stored in the user storage area UA. 
     A plurality of areas may be formed in the second storage area  120 . For example, the second storage area  120  may include a plurality of encryption key storage areas KA 1 , KA 2 , . . . , KAn to respectively store again the N-number of encryption keys Kn and stored in the user storage area UA of the first storage area  110 . That is, after the N-number of encryption keys Kn are stored in the user storage area UA of the first storage area  110 , the N-number of encryption keys Kn are received from the first storage area  110  and respectively stored again in the encryption key storage areas KA 1 , KA 2 , . . . , KAn. This is to prevent deterioration of a logic speed during the encoding/decoding process of the memory  100 . 
     The second storage area  120  may be reset by the reset signal rst that is input from outside the memory  100 . When the driving of the memory  100  is initiated from the user storage area UA of the first storage area  110  by the reset signal rst, the N-number of encryption keys Kn output from the first storage area  110  may be stored again in the encryption key storage areas KA 1 , KA 2 , . . . , KAn. 
     The selection unit  130  may include a selector  131 , a multiplexer (MUX)  133 , and an encoding/decoding unit  135 . The selector  131  may be output a selection signal CS according to a control signal CNT. The control signal CNT may be input be the user The selection signal CS provided to the multiplexer  133  may be used as a selection signal to select an encryption key S_K that is any one of the N-number of encryption keys Kn input to the multiplexer  133  from the second storage area  120 . 
     The control signal CNT may include addresses of the data storage areas DA 1 , DA 2 , . . . , DAn of the first storage area  110 . Thus, the control signal CNT may be used to select a different encryption key for each address of the first storage area  110 . For example, the selector  131  may output the selection signal CS to select different encryption keys from the N-number of encryption keys Kn according to the least significant bit (LSB) of each of the addresses of the data storage areas DA 1 , DA 2 , . . . , DAn, by the control signal CNT. 
     For example, when the first data storage area DA 1  and the second data storage area DA 2  of the data storage areas DA 1 , DA 2 , . . . , DAn are respectively defined as an address 00000 and an address 00001, the control signal CNT may control to use different encryption keys for the first and second data storage areas DA 1  and DA 2  according to each LSB of two different addresses. 
     Accordingly, to encode the data Data input to the first data storage area DA 1  of the memory  100 , or decode the encoded data E_Data stored in the first data storage area DA 1 , according to the control signal CNT, the selector  131  may output the selection signal CS to use a first encryption key k 1  of the N-number of encryption keys Kn of the second storage area  120 . 
     Also, to encode the data Data input to the second data storage area DA 2  of the memory  100 , or decode the encoded data E_Data stored in the second data storage area DA 2 , according to the control signal CNT, the selector  131  may output the selection signal CS to use a second encryption key k 2  of the N-number of encryption keys Kn of the second storage area  120 . 
     Also, the selector  131  may output the selection signal CS to select different encryption keys from the N-number of encryption keys Kn according to the most significant bit (MSB) of each of the addresses of the data storage areas DA 1 , DA 2 , . . . , DAn, according to the control signal CNT. For example, when the first data storage area DA 1  and the second data storage area DA 2  of the data storage areas DA 1 , DA 2 , . . . , DAn are respectively defined as an address 00000 and an address 00001, the control signal CNT may control to use the same encryption key for the first and second data storage areas DA 1  and DA 2  according to each MSB of two identical addresses. 
     Accordingly, to encode the data Data input to the first and second data storage areas DA 1  and DA 2  of the memory  100 , or decode the encoded data E_Data stored in the first and second data storage areas DA 1  and DA 2 , according to the control signal CNT, the selector  131  may output the selection signal CS to use the first encryption key k 1  of the N-number of encryption keys Kn of the second storage area  120 . 
     A new encryption key Km may be input with the control signal CNT to the selector  131  to output the selection signal CS to select the encryption key S_K from the N-number of encryption keys Kn of the second storage area  120 . The new encryption key may also be input by the user. 
     The multiplexer  133  may receive the N-number of encryption keys Kn from the second storage area  120 , and select and output the encryption key S_K that is one of the N-number of encryption keys Kn according to the selection signal CS output from the selector  131 . The encoding/decoding unit  135  may encode the data Data input from the outside, based on the encryption key S_K output from the multiplexer  133 , and output the encoded data E_Data to the data storage areas DA 1 , DA 2 , . . . , DAn of the first storage area  110 . The encoded data E_Data may be stored according to the addresses of the data storage areas DA 1 , DA 2 , . . . , DAn. 
     Also, the encoding/decoding unit  135  may decode the encoded data E_Data stored in the first storage area  110  based on the encryption key S_K output from the multiplexer  133  and output the decoded data to the outside. 
       FIG. 2  is a flowchart for explaining an operation of the memory  100  of  FIG. 1 . Referring to  FIGS. 1 and 2 , in the method of driving the memory  100 , the memory  100  may include two driving processes, for example, a code issuance process A and a code execution process B. 
     In the code issuance process A, the N-number of encryption keys Kn and the encoded data E_Data are input in the first storage area  110  of the memory  100 . The memory  100  may receive the N-number of encryption keys Kn and store the N-number of encryption keys Kn in the user storage area UA of the first storage area  110  of the memory  100  (S 10 ). 
     The user storage area UA may further store a plurality of driving commands in addition to the N-number of encryption keys Kn. After the reset signal rst is input to the reset area Reset and thus the memory  100  is reset, the reset handler jumping to the user storage area UA to start the operation may be stored in the reset area Reset. 
     When the input of the N-number of encryption keys Kn is completed, the memory  100  tests suitability of the N-number of encryption keys Kn that are input (S 20 ). When the suitability test is completed, the N-number of encryption keys Kn stored in the user storage area UA may be moved to the second storage area  120  and stored again in each of the encryption key storage areas KA 1 , KA 2 , . . . , KAn of the second storage area  120  (S 30 ). 
     After the N-number of encryption keys Kn is stored again in the second storage area  120 , the memory  100  may receive an input of the data Data and encode the input data Data by the encryption key S_K output from the selection unit  130  (S 40 ). For example, when the N-number of encryption keys Kn are stored again in the second storage area  120 , the control signal CNT may be input to the selector  131  of the selection unit  130 . The control signal CNT may be a signal for outputting the selection signal CS for the selector  131  to select the encryption key S_K from the N-number of encryption keys Kn stored in the second storage area  120 . The control signal CNT may control to select a different encryption key for each address of the first storage area  110  of the memory  100  to the selector  131 . 
     When any one encryption key S_K is selected according to the control signal CNT, the selection unit  130  may encode the data Data input from the outside the memory by using the encryption key S_K. The encoded data E_Data may be stored in each of the data storage areas DA 1 , DA 2 , . . . , DAn of the first storage area  110 . 
     When the data encryption by the selection unit  130  is completed, the memory  100  tests the suitability of the stored encoded data E_Data (S 50 ). As storage of the N-number of encryption keys Kn and the encoded data E_Data is completed in the first storage area  110  of the memory  100 , the memory  100  including the encoded data E_Data may be completed. 
     In the code execution operation B, the encoded data E_Data input in the first storage area  110  may be decoded and output from the memory  100 . First, when the code issuance process A of the memory  100  is completed, the reset signal rst may be input to the memory  100  from the outside (S 110 ). 
     When the reset signal rst is input, the second storage area  120  of the memory  100  is reset and the reset handler stored in the reset area Reset of the first storage area  110  is operated. The reset handler jumps to the user storage area UA of the first storage area  110  according to a predetermined command routine and initiates driving of the memory  100  from the user storage area UA. 
     The N-number of encryption keys Kn stored in the user storage area UA may be moved to the second storage area  120  and may be stored again in each of the encryption key storage areas KA 1 , KA 2 , . . . , KAn of the second storage area  120  (S 120 ). The selection unit  130  may select any one encryption key S_K from the N-number of encryption keys Kn stored in the second storage area  120  according to the control signal CNT, and decode the encoded data E_Data provided from the first storage area  110  of the memory  100  by using the encryption key S_K and output the decoded data (S 130 ). 
     The control signal CNT may control to select a different encryption key for each address of the first storage area  110  of the memory  100  to the selector  131 . The control signal CNT may be input under the same conditions as those in the code issuance process A of the memory  100 . The data Data output from the memory  100  may be output through a CPU (not shown) or an interface (not shown). 
       FIG. 3  is a schematic block diagram of a memory system  200  including the memory  100  of  FIG. 1 . The memory system  200  according to an exemplary embodiment may be used in a variety of fields, for example, a card system for storing personal information such as a memory card or a smart card, a communications system requiring security, or an RF system. 
     Referring to  FIGS. 1-3 , the memory system  200  of the present exemplary embodiment may include a CPU  210 , an interface I/F  230 , and the memory  100 . Since the memory  100  is the same as that described with reference to  FIGS. 1 and 2 , a detailed description thereof will be omitted herein. The CPU  210  may communicate with the memory  100  via a bus  220  so as to input the data Data to the memory  100  or output the data Data from the memory  100 . 
     The interface  230  may communicate with other external electronic apparatuses, to and provide the data Data input from the outside to the CPU  210  or the memory  100 , or transmit the data Data provided by the memory  100  or the CPU  210  to outside the memory system  200 . The interface  230  may be a wireless or wired interface and operate according to wired or wireless communications protocol. 
     As described above, according to an exemplary embodiment of the inventive concept the memory for protecting data, the memory system including the memory, and the method of driving the memory, in the encoding or decoding operation of the memory, an input of an encryption key is directly received from a user and stored in an area that the user knows and an input is selected by applying a different encryption key for each address or a particular area of the memory. Thus, the data of the memory or the encryption key may be prevented from being exposed to external attacks. Also, the encoding or decoding of memory data may be performed reliably. 
     While the inventive concept has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood that various changes in form and details may be made therein without departing from the spirit and scope of the following claims.