TW202102999A - Rpmc flash emulation - Google Patents

Abstract

A controller includes a host interface and a processor. The host interface is configured for communicating with a host. The processor is configured to receive from the host, via the host interface, instructions for execution in a Non-Volatile Memory (NVM), to identify among the instructions an instruction, which pertains to a secure monotonic counter and is intended for execution in an NVM having a secure monotonic counter embedded therein, and to execute the identified instruction, and respond to the host responsively to the instruction, instead of the NVM.

Description

Controller with flash memory simulation function and its control method

The present invention relates to a secure computing environment, and particularly relates to a method and system for emulating a flash memory with an embedded secure one-way counter.

Personal computer (PC) platforms usually use serial flash memory to store non-volatile data, such as basic input output system (BIOS) code. In some cases, serial flash memory also provides permanent storage to support important functions, such as security and power management.

In order to meet security requirements, the flash memory device may include one or more replay protection monotonic counters (RPMC), which are coupled to a key and appropriate software to protect the flash memory against Unauthorized operations, such as replay attacks.

At present, there are a variety of security technologies using one-way counters known in the art. For example, US Patent No. 9,405,707 describes a system including a flash memory device, which includes a one-way counter and a host device. The device is coupled to the flash memory device and can communicate with each other to generate an authentication certificate, use the authentication certificate and the first signature generated by a device key, and request a value from the one-way counter of the flash memory device , Receive this value from the one-way counter and receive the authentication certificate from the flash memory device, and then send a command and the second signature generated by the device key to increase the value of the one-way counter of the flash memory. The flash memory device can use its own key to verify the above-mentioned requirements and instructions from the one-way counter to increase the one-way counter.

To solve the above problems, the present invention provides a controller, which includes: a host interface for communicating with a host; and a processor for receiving a non-volatile memory from the host through the host interface ( NVM) a plurality of instructions executed, identifying among the plurality of instructions the first instruction related to the safety one-way counter and executed in the NVM embedded with the safety one-way counter, and executing the identified instruction, And instead of the NVM, respond to the recognized command to the host.

According to one embodiment, the controller further includes a memory interface, and the processor communicates with an NVM that does not have an embedded secure one-way counter through the memory interface, and the instructions other than the recognized instruction The instructions are forwarded to the NVM for execution. According to one embodiment, when the processor executes the identified instruction, the processor overrides a chip select (CS) signal, and the host sets the chip select signal to be valid to select the NVM. According to one embodiment, the processor intercepts a chip selection signal to receive an instruction that attempts to access the NVM, and the host sets the chip selection signal to be valid to select the NVM.

According to one embodiment, the processor is used to execute the identified instruction in combination with a trusted platform module (TPM). According to an embodiment, the trust platform module is integrated in the controller. According to one embodiment, the trusted platform module is located outside the controller, and the controller further includes a trusted platform module interface for communicating with the trusted platform module. According to one embodiment, the trusted platform module is located outside the controller and connected to the host, and the processor communicates with the trusted platform module through the host interface.

According to one embodiment, the identified instruction complies with a replay-protected monotonic counter (RPMC) specification, and the processor is used to execute the identified instruction according to the RPMC specification.

The present invention further provides a control method, which includes: in a controller, receiving a plurality of instructions for execution in a non-volatile memory (NVM) from a host; and identifying an AND from the plurality of instructions The safe one-way counter is related to an instruction that is attempting to be executed in an NVM embedded with a safe one-way counter; and the controller replaces the NVM to execute the identified instruction.

The following describes the implementation of the present invention in detail with the drawings and embodiments, so as to fully understand and implement the implementation process of how the present invention uses technical means to solve technical problems and achieve technical effects.

When used here, unless expressly stated otherwise in the text, singular forms such as "one", "the", and "this" are also intended to include plural forms. Similar reference symbols in the drawings represent similar components.

Non-volatile memory (NVM) devices, such as flash memory, can be used to store startup codes or other sensitive information used by the computer system. It is sensitive information and computer hackers will try to hack into it. Traditional NVM provides a very low degree of protection. For example, NVM sections are protected against write. The RPMC specification includes a command to write a 256-bit "root key". The root key is stored in flash memory and cannot be read from the outside. Verified commands and responses are signed with Hash Message Authentication Code (HMAC) keys. You can use HMAC to verify this signature. The HMAC key is stored in the flash memory and cannot be read through the test mode. The verified "HMAC key update command" can be used to derive a 256-bit HMAC key.

An example of a safe one-way counter is a replay protected monotonic counter (RPMC). Intel's 2013 revision 0.7 "Serial Flash harden Product External Architecture Specification (EAS)" specification (document number: 328802-001EN) describes the RPMC specification, which includes the architecture and instruction set. It is incorporated herein by reference as a reference.

The RPMC specification includes a command to write a 256-bit "root key". This root key is stored in flash memory and cannot be read from outside. The root key can only be programmed once during system manufacturing. The 32-bit one-way counter is related to the root key. Regardless of the value of the root key, the 32-bit one-way counter will be initialized to zero when the effective 256-bit write to the root key operation is performed.

The verified commands and responses are the commands and responses signed with the hash message verification code key (HMAC Key). You can use HMAC to verify this signature. The HMAC key is stored in the flash memory and cannot be read through the test mode. A verified "HMAC key update command" can be used to derive a 256-bit HMAC key. The HMAC key is obtained using HMAC-SHA-256 from the root key and the key data supplied during this command. Therefore, this command will perform two HMAC-SHA-256 operations, one of which is used to obtain the HMAC key, and the other is used to verify the signature.

Other verified commands are used to support incrementing and reading RPMC counters. The RPMC specification requires the minimum related resources of the four counters, such as supporting root key register and HMAC key register. There is a list of RPMC instructions in paragraph 2.1 of the above Intel RPMC specification.

Embodiments of the present invention disclose a method and system that use a non-secure flash memory and a controller to emulate a secure NVM with an embedded one-way counter (for example, support RPMC fast Flash memory). The controller is located outside the non-secure flash memory, and can be an embedded controller (EC), a baseboard management controller (BMC), a super input output (super I/O) controller, or any other Suitable for controllers. In one embodiment, the computing system includes a controller that communicates with a host and a non-secure flash memory (for example, a traditional serial flash memory device). The host executes flash memory commands, including commands for accessing data stored in the flash memory, and safety-related commands (such as RPMC commands). The controller cooperates with the non-secure flash memory to operate to emulate a secure flash memory facing the host.

Although the following description mainly refers to RPMC, the technology of the present invention is applicable to any suitable type of secure one-way counter embedded in NVM. Although the following description mainly refers to serial flash memory, the technology of the present invention is applicable to any other suitable type of NVM. The following description of serial flash memory and RPMC is only an example, and is not intended to limit the present invention.

For the sake of convenience, the following content will refer to the flash memory that supports the security function as secure flash memory (Secure-Flash), and the flash memory that does not support the security function as non-secure flash memory (non-Secure-Flash). Furthermore, the following content refers to the security flash memory that supports RPMC as RPMC flash memory (RPMC-Flash), and the flash memory that does not support RPMC as non-RPMC flash memory (non-RPMC- Flash).

In one embodiment, the computing system includes a controller that communicates with the host and non-secure flash memory (for example, non-secure flash memory). The host executes flash memory commands, which include commands for accessing data stored in the flash memory and accessing security-related commands (such as RPMC commands). The controller cooperates with the non-secure flash memory to operate to simulate a host-oriented security flash memory. For example, in a system that includes a non-secure flash memory and a controller, the host can issue an instruction to increase the one-way counter, which is executed by the RPMC-Flash. The controller can intercept this command, and transparently replace the flash memory to execute the command facing the host.

In some embodiments, the controller includes a host interface for communicating with the host; and a processor for receiving a plurality of commands executed in the secure flash memory from the host through the host interface. The processor recognizes safety-related flash memory commands (such as RPMC commands), and executes at least some of these safety-related commands in response to the host. The non-secure flash memory can execute non-secure related commands issued by the host.

According to other embodiments of the present invention, the computing system includes a non-secure flash memory device, and the controller includes a flash memory interface unit coupled to the non-secure flash memory. In this configuration, via The flash memory system in which the controller is connected to the host is called slave-attached-flash (SAF). The processor receives a plurality of flash memory commands from the host through the host interface unit. The processor executes safety-related instructions, and transmits non-security-related instructions to the non-security-related flash memory for execution via the flash memory interface. The processor then responds to the host through the host interface unit.

In some embodiments, the host communicates with the controller through a serial bus, such as a serial peripheral interface (SPI) or an extended enhanced serial peripheral interface (eSPI); the serial bus includes, for example, a bidirectional data line, Clock line and multiple chip select (CS) lines. The CS line corresponding to each device is connected to the serial bus. The CS line, which is set valid by the host to communicate with a secure flash memory, is connected to the controller, and the CS signal is relayed to a non-secure flash memory through the controller. For non-safety-related commands, the controller transfers this CS signal to the flash memory; for safety-related commands (such as RPMC commands), the controller overwrites the CS signal on the non-safety flash memory.

According to other embodiments of the present invention, the non-secure flash memory system is connected to the host through an SPI bus or an eSPI bus, and the CS signal generated by the host to communicate with a secure flash memory is connected to the non-secure flash memory. CS input terminal of security flash memory. However, the non-secure flash memory does not respond to safety-related commands, which means that the non-secure flash memory cannot execute safety-related commands. The controller will intercept the CS signal sent from the host to the flash memory and check the command type. The controller will execute commands that the flash memory cannot execute.

In some embodiments, the operation of executing security-related instructions includes processing security functions, such as security-signing or verification of a security signature. In one embodiment, the host includes a Trusted Platform Module (TPM). The Trusted Platform Module is an international standard (ISO/IEC11889) for secure encryption processing, which is specifically designed for microcontrollers to use integrated encryption keys to protect hardware security. The controller and the trusted platform module can share a confidential data for enabling communication between the controller and the trusted platform module. The controller can process security-related commands issued by the host using the trusted platform module as a secure NV storage unit with secure connections.

In some embodiments of the present invention, the controller includes a trusted platform module, and the communication between the controller and the trusted platform module is inherently secure (or at least more secure than inter-chip (I2C) communication) The way) is completed in the wafer.

In other embodiments, the controller does not include an interface for the trusted platform module (TPM), but communicates with the trusted platform module through the host. In order to access the trusted platform module, the controller sends a request to the host, and the host relays the request to the trusted platform module. When the trusted platform module has a response, the host receives the response and sends it to the controller.

In some embodiments of the present invention, the safety-related instructions executed by the controller instead of the safety flash memory include RPMC instructions, which are defined by or part of the RPMC specification.

The flash memory device that can comply with the above-mentioned RPMC specification is called RPMC flash memory, which includes unique control, status and configuration registers and mechanisms. RPMC flash memory devices respond to multiple dedicated RPMC commands. The controller emulates this RPMC command, and when the RPMC command is detected, the controller can overwrite the CS signal of the non-RPMC flash memory. In addition, the controller can include a flash busy register to cover the flash busy signal of non-secure flash memory, and a flash memory extended state temporary storage The device is used to simulate the extended state register of RPMC and a serial flash discoverable parameter (SFDP) structure.

The controller may also include a part of the flash register required by the RPMC flash memory and some memory caches for extended data (such as mirroring). The memory cache can respond on behalf of the flash memory.

In some embodiments, the flash memory may include some but not all of the RPMC functions defined in the RPMC specification. For example, the flash memory may implement two of the four RPMC counters defined in the specification; the controller may emulate the others. Function.

Therefore, the embodiment of the present invention can include a controller and a trusted platform module; and for a system that does not include a secure flash memory, the embodiment of the present invention can provide a secure flash memory emulation. In some embodiments, the trusted platform module is a separate module; however, in other embodiments, the trusted platform module can be embedded in the controller. In some embodiments, the host is directly coupled to the non-secure flash memory; in other embodiments, for example, in a slave-attached-flash configuration, the non-secure flash memory is The memory system is connected to the host via the controller.

Although the above-mentioned example of the RPMC specification is related to the special specification of RPMC in serial flash memory, it is understood that the embodiments of the present invention are not limited to this specification and can be used for any suitable serial flash memory, Parallel flash memory, or any other type of RPMC specification for NVM.

In some embodiments, for example, when the flash memory supports a subset of the required RPMC architecture, the execution of some commands issued by the central processing unit can be performed jointly by the non-secure flash memory and the controller.

systems mannual

FIG. 1 is a block diagram schematically showing a computing system 100 with an attached additional flash memory (SAF) configuration according to the first embodiment of the present invention. The computing system includes a host 102 for executing software commands. The commands include commands related to the safe access of a secure flash memory device (for example, a flash memory device with a replay protection unidirectional counter (RPCM)) . A trusted platform module 104 for implementing security functions; a non-secure flash memory 106 that does not support some or all commands issued by the host to the flash memory device; and a controller 108 for emulation The flash memory security function issued by the host.

In the embodiment shown in Figure 1, the host communicates with the Trusted Platform Module (TPM) on the SPI bus, and communicates with the controller on the eSPI bus. The controller communicates with the trusted platform module on the I2C bus, and communicates with the flash memory on the SPI bus. It can be understood that other embodiments of the present invention can use any other suitable bus, such as a serial bus or a parallel bus.

In the exemplary embodiment shown in Figure 1, the flash memory system is attached to a controller, and all communications with the flash memory are completed by the controller. This configuration is called a slave attached flash memory (SAF) configuration.

Some commands executed by the host to access the flash memory include flash memory read/write functions and flash memory security functions (such as RPMC commands). In the following description, all instructions related to access to flash memory are called flash memory instructions.

The detailed block diagram of the controller is drawn below the first figure. The controller includes a processor 110; a host interface 112, which is used to communicate with the host 102 and the processor 110, and includes an eSPI port (eSPI port); an I2C port 114, which is used to trust the platform module 104, and The communication between the processors 110; and an SPI port 116, which is used for the communication between the flash memory 106 and the processor 110.

The host executes flash memory commands and non-flash memory commands. In order to execute flash memory commands, the host communicates with the flash memory device on the eSPI bus. In the exemplary SAF configuration in Figure 1, the controller receives and responds to flash memory commands issued by the host.

In the controller 108, the processor 110 receives flash memory commands via the host interface 112. The processor can direct some instructions to the non-secure flash memory 106 for direct execution. The processor executes other instructions, such as instructions that cannot be executed by non-secure flash memory. The execution of other commands may require access to non-secure flash memory and access to the trusted platform module 104 via the I2C port 104.

The processor can end some flash memory commands by returning any required data to the host, and/or returning an instruction to complete the execution of the command.

In summary, according to the exemplary embodiment shown in FIG. 1, the computing system may include an auxiliary flash memory that does not support some security functions, which is connected to the host via the controller. The controller communicates with the flash memory and the trusted platform module, and transparently to the host, executes all flash memory commands directly or in combination with the non-secure flash memory and/or the trusted platform module . Therefore, the computing system of the present invention can implement a secure flash memory function, and its cost is lower than that of a computing system that has a flash memory to implement all flash memory instructions.

FIG. 2 is a block diagram schematically showing a computing system 200 with a host-attached flash memory configuration according to the second embodiment of the present invention. The computing system includes a host 202, which is used to execute software commands including flash memory commands; a trusted platform module (TPM) 204, which is used to implement security functions; and a flash memory (hereinafter referred to as non-secure Flash memory) 206, which does not support some or all commands issued by the host to the flash memory device; a controller 208, which is used to emulate the flash memory security function requested by the host 202.

In the example embodiment in FIG. 2, the host 202 communicates with the trusted platform module 204, the controller 208, and the non-secure flash memory 206 on the SPI bus. It can be understood that other embodiments may use any other suitable bus, such as a serial bus or a parallel bus.

In the example embodiment in FIG. 2, the non-secure flash memory 206 can receive all flash memory communication data; however, the non-secure flash memory 206 only responds to commands that it can support. For example, if the host 202 issues an RPMC command and the non-secure flash memory 206 does not support the RPMC command, the non-secure flash memory 206 will ignore this command.

The detailed block diagram of the controller 208 is shown at the bottom of FIG. 2. The controller 208 includes a processor 210; a host interface 212 for communication between the host 202 and the processor 210; and an I2C port 214 for communication between the trust platform module 204 and the controller 208 .

In order to execute flash memory commands, the host 202 communicates with the security flash memory device on the SPI bus. When communicating with the secure flash memory, the host 202 sets the chip select (CS) line to assert, and the chip select line (indicated by Flash CS in Figure 2) is connected to the non-secure flash The memory 206 and the controller 208. When the host 202 issues a safety-related command that is not supported by the non-secure flash memory 206, the controller 208 reads and executes the safety-related command.

In the controller 208, the host interface 212 is connected to the SPI bus, which includes the aforementioned CS line. The processor 210 receives all flash memory commands from the host 202 via the host interface 212. If the processor 210 recognizes that the non-secure flash memory 206 cannot execute the received instruction, such as the RPMC instruction, the processor 210 will execute the instruction. When instructions that cannot be executed by the non-secure flash memory 206 are executed, the trusted platform module 204 may be accessed through the I2C port 104. For example, if there are some RPMC counters in the trusted platform module 204 and the host 202 issues a read RCM command, the processor 210 will access the trusted platform module 204 via the I2C port 214, and request the trusted platform module 204 to send back the data stored in The value in the RPCM counter. The processor 210 then returns the requested data to the host 202 via the host interface 212.

By returning any requested data and/or returning an instruction to complete the execution of the command, the processor 210 can end some of the multiple flash memory commands.

In summary, according to the exemplary embodiment shown in FIG. 2, the computing system may include a non-secure flash memory, which is connected in parallel with the controller via the serial bus and connected to the host. Non-secure flash memory can execute a subset of flash memory commands, and the controller executes other flash memory commands that are not supported by non-secure flash memory. The cost of the computing system that implements the secure flash memory function can be lower than that of the computing system with secure flash memory.

FIG. 3 is a block diagram schematically showing a computing system 300 with SAF configuration according to the third embodiment of the present invention. The example embodiment shown in FIG. 3 is similar to the example embodiment in FIG. 1, but the difference is that the controller of the example embodiment in FIG. 3 is not directly coupled to the trust platform module.

The computing system 300 includes a host 302 for executing software commands including flash memory commands, including secure commands and non-secure commands. A trusted platform module 304 for implementing security functions; a non-secure flash memory 306 that does not support some or all of the multiple commands issued by the host to the flash memory device; and, a controller 308 , Used to simulate the flash memory security function issued by the host 302.

In the example embodiment in Figure 3, the host 302 communicates with the trusted platform module 304 on the SPI bus, and communicates with the controller 308 on the eSPI bus; the controller 308 communicates with the flash memory on the SPI bus The body 306 communicates. It can be understood that other embodiments may use any other suitable bus, such as a serial bus or a parallel bus. In the example embodiment in Figure 3, in the SAF configuration, the flash memory system is attached to the controller.

The host 302 executes flash memory commands, which include commands executable by the non-secure flash memory 306 and commands that the non-secure flash memory 306 does not support but will be executed by the controller 308.

The detailed block diagram of the controller 308 is shown at the bottom of FIG. 3. The controller 308 includes a processor 310; a host interface 312 for communication between the host 302 and the processor, and includes an eSPI port; an SPI port 316, which is used for the flash memory 306 and the processor 310 Inter-communication.

The host 308 communicates with the flash memory device on the eSPI bus. In the SAF configuration example in FIG. 3, the controller 308 receives and responds to the flash memory command issued by the host 302.

In the controller 308, the processor 310 receives flash memory commands via the host interface 312. The processor 310 can direct some instructions to the non-secure flash memory 306 for direct execution. Alternatively, the processor 310 will execute other instructions, for example, instructions that the non-secure flash memory 306 cannot execute. When other commands are executed, it may be necessary to access the trusted platform module 304 and the non-secure flash memory 306 through the host 302. This will be described in detail below.

The processor 310 can return any required data to the host, and/or return an instruction indicating that the command has been executed, so as to end some flash memory commands.

Hereinafter, an example of the software driver according to the embodiment of the present invention will be briefly described in conjunction with FIG. 3. In the exemplary embodiment shown in FIG. 3, at least two drivers in the host 302 are active at the same time, that is, the flash memory application driver 318 and the security service driver 320.

The flash memory application driver 318 provides a software interface to the flash memory device. In the example embodiment shown in FIG. 3, the flash memory application driver 318 communicates with the controller 308. However, the driver can be similar to (or the same as) the driver used by the host in a computing system that includes a secure flash memory. The flash memory driver 318 can also be used as shown in Figures 1 and 2. Illustrated example embodiment.

The security service driver 320 provides an interface between the security service client and the trust platform module 304. In the exemplary embodiment shown in FIG. 3, the processor 310 can request a trusted platform module service (TPM service) from the security service driver 320 via the host interface 312. The security service driver can access the trusted platform module 304 to execute the service, and reply to the processor 310 via the host interface 312 of the controller 308.

In some embodiments, in the early pre-boot phase (similar to the ME booting of a computer), the trusted platform module (TPM) driver has not been activated, so the trusted platform module cannot be used for some security functions, such as the one-way counter function. At this time, the controller 308 can support the retro-active RPMC function during power-on by reporting the one-way value stored in the non-secure flash memory, and wait for the verified data from the trusted platform module The reading of the one-way counter. The reading of the one-way counter is stored in a buffer. If the reading of the one-way counter fails to pass the verification within a predefined period, the controller 308 can reset or interrupt the host 302 and issue a safety failure warning.

In summary, according to the exemplary embodiment shown in FIG. 3, the computing system may include a slave-attached flash memory (Slave-Attached-Flash) that does not support some security functions, which is connected to the host via the controller. The controller does not include an interface to the trusted platform module. Instead, the controller accesses the trusted platform module (TPM) through a service driver running on the host. The cost of the operating system to implement this secure flash memory function is lower than that of an operating system with flash memory that can implement all flash memory instructions.

FIG. 4 is a block diagram schematically showing a computing system 400 with a host attached flash memory according to the fourth embodiment of the present invention. In this embodiment, the controller includes a trusted platform module.

The computing system 400 includes a host 402 for executing software commands including flash memory commands; a non-secure flash memory 406; and a controller 408 for simulating the flash memory requested by the host 402 Physical safety features.

In the example embodiment of FIG. 4, the host 402 communicates with the controller 408 and the non-secure flash memory 406 on an SPI bus. It is understood that other embodiments may use any other suitable bus, such as serial or parallel bus.

In the example embodiment of FIG. 4, the non-secure flash memory 406 receives all the communication data of the flash memory; however, the flash memory 406 only responds to commands that it supports. For example, if the host 402 issues an RPMC command and the non-secure flash memory 406 does not support the RPMC command, the non-secure flash memory 406 will ignore the RPMC command.

The detailed block diagram of the controller 408 is shown at the bottom of FIG. 4. The controller 408 includes a processor 410; a host interface 412 for communication between the host 202 and the processor 410; and an embedded trusted platform module (embedded TPM) 414 for implementing security functions.

In order to execute flash memory commands, the host 402 communicates with a security flash memory device on the SPI bus. When the host 402 wants to communicate with the secure flash memory, the host 402 will set the chip select (CS) line to be valid, and the CS line is connected to the non-secure flash memory 406 and the controller 408. When the host 402 issues a safety-related command and the non-security flash memory 406 does not support the safety-related command, the controller 408 will read and execute the safety-related command.

In the controller 408, the host interface 412 is connected to the SPI bus, which includes the aforementioned CS line. The processor 410 receives all flash memory commands from the host 402 via the host interface 412. If the processor 410 recognizes that the received instruction (such as the RPMC instruction) cannot be executed by the non-secure flash memory 406, the processor 410 will execute the instruction. Commands that cannot be executed by the non-secure flash memory 406 may require access to the embedded trusted platform module 414 during execution. For example, if there are some RPMC counters in the embedded trust platform module 414 and the host 402 issues a read RCM command, the processor 410 will access the embedded trust platform module 414 and request the embedded trust platform module 414 to send back The value stored in RCM. The processor 410 then returns the requested data to the host 402 via the host interface 412.

The processor 410 can end some flash memory commands by returning any required data to the host 402 and/or returning an instruction to complete the command execution.

In summary, according to the exemplary embodiment shown in FIG. 4, the computing system may include non-secure flash memory, which is connected to the host via a serial bus and is connected in parallel with the controller. Non-secure flash memory executes a sub-set of flash memory commands, and the controller executes flash memory commands that are not supported by non-secure flash memory. The cost of the above-mentioned computing system that can implement the secure flash memory function is lower than that of the computing system with secure flash memory.

FIG. 5 is a block diagram schematically showing a computing system 500 with SAF configuration according to the fifth embodiment of the present invention. In this embodiment, the controller 508 includes a trusted platform module 514, and the configuration used for the non-secure flash memory is a supplementary flash memory (SAF) configuration.

The computing system 500 includes a host 502 for executing a plurality of software commands, including flash memory commands. Non-secure flash memory 506; and a controller 508 for simulating the security function of the flash memory requested by the host 502.

In the example embodiment of FIG. 5, the host 502 transmits a plurality of flash memory commands including security commands to the controller 508. The non-secure flash memory 506 is connected to the controller 508. The controller 508 includes a processor 510, a host interface 512, an embedded trust platform module 514, and an SPI port 516.

In the controller 508, the processor 510 receives flash memory commands via the host interface 512. The processor 510 can direct some of these instructions to the non-secure flash memory 506 for direct execution. The processor 510 can execute other instructions, for example, instructions that the non-secure flash memory 506 cannot execute. The execution of these commands may require access to the embedded trusted platform module 514 and access to the non-secure flash memory 506.

The processor 510 can end a part of these flash memory commands by returning any required data to the host 502 and/or returning an instruction to complete the command execution.

In summary, according to the exemplary embodiment shown in FIG. 5, in the SAF configuration, the computing system may include non-secure flash memory, which is connected to the host via the controller. The controller executes all flash memory commands (including safety-related commands and non-safety-related commands), and accesses additional non-secure flash memory and internal embedded trust platform modules. The cost of the above-mentioned computing system that can realize the security flash memory function can be lower than that of the computing system with the security flash memory.

It can be understood that the embodiments of the computing system shown in FIGS. 1 to 5 are only examples, and are not intended to limit the present invention. The computing system of the present invention is not limited to the above exemplary embodiment. For example, in other embodiments, other types of non-volatile memory may be used, and the bus bar connecting various components of the system may be different from the bus bar of the above-mentioned embodiment. In some embodiments, it may include a plurality of hosts, a plurality of security flash memory devices, and/or a plurality of controllers. In one embodiment, a single controller can be coupled to a plurality of flash memory devices and/or a plurality of trusted platform modules (TPM).

In some embodiments, the host can issue instructions to atomically read the flash memory and increase the RPMC. The processor adds the corresponding RPMC by accessing the data of the non-secure flash memory and accessing the trusted platform module to simulate this command.

In some embodiments, a single trusted platform module can be used as a general-purpose secure NV storage device for other components on the circuit board in addition to serving as the host of the trusted platform module. In one embodiment, the functions of the above-mentioned controller can be implemented in the trusted platform module without using the controller.

In some non-SAF embodiments, the CS line used by the host for the flash memory is connected to the controller instead of the flash memory, and the CS line received by the flash memory is connected to the controller instead of the host; When the controller receives the CS line from the host, the controller generates a CS signal; and in response to other flash memory access cycles, the controller activates to perform the security flash memory function.

In some embodiments of the present invention, the controller may include a cache memory for frequent access to secure data, such as keys.

The controllers 108, 208, 308, 408, and 508, or their components, can be implemented by any suitable hardware, such as an application-specific integrated circuit (ASIC) or a field programmable logic gate array (FPGA). In some embodiments, some or all of the components of the controller can be implemented using software, hardware, or a combination of hardware and software components.

Generally, the hosts 102, 202, 302, 402, and 502 include a general-purpose processor, which can be programmed with software to perform the functions described above. This software can be downloaded from a network to the processor in the form of electronic signals, or can be provided and/or stored on non-transitory tangible media, such as magnetic memory, optical memory, or electronic memory.

Although the present invention is disclosed in the foregoing embodiments as above, it is not intended to limit the present invention. Anyone familiar with similar art can make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, the present invention The scope of patent protection shall be determined by the scope of the patent application attached to this specification.

100, 200, 300, 400, 500: computing system 102, 202, 302, 402, 502: host 104, 204, 304, 414, 514: TPM 106, 206, 306, 406, 506: flash memory 108, 208, 308, 408, 508: Controller 110, 210, 310, 410, 510: processor 112, 212, 312, 412, 512: host interface 114, 214, 414, 514: I2C port 116, 316, 516: SPI port 318: Flash memory application driver 320: service driver

Figure 1 is a block diagram of a computing system with a Slave-Attached-Flash (Slave-Attached-Flash, SAF) configuration according to an embodiment of the present invention. The SAF configuration executes the replay protection list. The directional counter (RPMC) flash memory emulation.

Figure 2 is a block diagram of a computing system with a host-attached Flash configuration according to another embodiment of the present invention. The host-attached Flash configuration is executed RPMC flash memory emulation.

FIG. 3 is a block diagram schematically showing a computing system with a SAF configuration according to another embodiment of the present invention, and the SAF configuration executes RPMC flash memory simulation.

FIG. 4 is a block diagram schematically showing a computing system with a host-attached flash memory configuration according to another embodiment of the present invention, and the host-attached flash memory configuration executes RPMC flash memory emulation.

FIG. 5 is a block diagram schematically showing a computing system with SAF configuration according to the fifth embodiment of the present invention, and the SAF configuration executes RPMC flash memory simulation.

100: computing system

102: host

104: TPM

106: flash memory

108: Controller

110: processor

112: Host Interface

114: I2C port

116: SPI port

Claims (18)

A controller that contains: A host interface for communicating with a host; and A processor for: Receive a plurality of commands executed by a non-volatile memory (NVM) from the host through the host interface; Identifying among the plurality of instructions is an instruction related to a safe one-way counter and executed in a non-volatile memory in which the safe one-way counter is embedded; and Execute the recognized command, and replace the non-volatile memory to respond to the host with the recognized command. For example, the controller described in claim 1 further includes a memory interface through which the processor communicates with a non-volatile memory that does not have an embedded secure one-way counter. And the instructions other than the identified instructions are transferred to the non-volatile memory which does not have an embedded secure one-way counter for execution. For example, the controller described in item 1 of the scope of patent application, wherein when the processor executes the recognized instruction, the processor covers a chip select (CS) signal, and the host sets the chip select signal to be valid to Select the non-volatile memory. For example, the controller described in item 1 of the scope of patent application, wherein the processor receives an instruction to access the non-volatile memory by intercepting a chip selection signal, and the host sets the chip selection signal to be valid (assert ) To select the non-volatile memory. As for the controller described in item 1 of the scope of patent application, the processor is used to execute the identified command in combination with a trusted platform module (TPM). In the controller described in item 5 of the scope of patent application, the trust platform module is integrated in the controller. For example, in the controller described in item 5 of the scope of patent application, the trusted platform module is located outside the controller, and the controller further includes a trusted platform module interface for communicating with the trusted platform module. For the controller described in item 5 of the scope of patent application, the trusted platform module is located outside the controller and connected to the host, and the processor communicates with the trusted platform module through the host interface. For the controller described in item 1 of the scope of patent application, the recognized instruction complies with a replay-protected monotonic counter (RPMC) specification, and the processor is used according to the RPMC specification Execute the recognized command. A control method including: In a controller, receiving a plurality of commands for execution in a non-volatile memory (NVM) from a host; Identifying from the plurality of instructions an instruction related to a safe one-way counter and trying to be executed in a non-volatile memory embedded with a safe one-way counter; and The controller replaces the non-volatile memory to execute the recognized command. For example, the control method described in item 10 of the scope of the patent application further includes communicating with a non-volatile memory that does not have an embedded secure one-way counter, and forwarding the command other than the recognized command to the non-volatile memory. Non-volatile memory with embedded security one-way counter for execution. For the control method described in item 10 of the scope of patent application, the step of executing the identified command includes: covering a chip selection (CS) signal, wherein the host sets the chip selection signal to be valid to select the non-volatile memory body. For example, in the control method described in claim 10, the step of receiving the command attempting to access the non-volatile memory includes: intercepting a chip selection signal, wherein the host sets the chip selection signal to be valid (assert ) To select the non-volatile memory. According to the control method described in item 10 of the scope of patent application, the step of executing the identified command includes: combining a trusted platform module (TPM) to execute the identified command. For the control method described in item 14 of the scope of patent application, the trust platform module is integrated in the controller. For example, in the control method described in item 14 of the scope of patent application, the trusted platform module is located outside the controller, and the controller further includes a trusted platform module interface for communicating with the trusted platform module. For the control method described in item 14 of the scope of patent application, the trust platform module is located outside the controller and connected to the host, and the step of executing the identified command includes: communicating with the trust through a host interface The platform module communicates. For example, the control method described in item 10 of the scope of patent application, wherein the recognized instruction complies with a replay protection unidirectional counter (RPMC) specification, and the processor is used according to the replay protection unidirectional counter specification Execute the recognized command.

Images