TWI640895B - Nonvalatile memory device having authentication, and methods of operation and manufacture thereof - Google Patents

Abstract

The memory component package encloses two separate wafers, one is a standard non-volatile memory volume circuit ("IC") wafer, and the other is a suitable certified IC die. Either wafer can be stacked on another wafer, or the wafers can be placed side by side. The external contacts correspond to the power and signal requirements of a standard non-volatile memory IC chip, so that the output-pin of the memory device package can be represented as a standard output pin. The power and signal requirements of the certified IC chip can be used for some or all of the pins of the non-volatile memory bulk circuit chip, or for other unused pins of the component package. One or more additional external contacts may be specifically added to the certified integrated circuit die. One or more signals may be specific to a standard non-volatile memory IC chip and an authentication IC chip.

Description

Certified non-volatile memory component and its operation and manufacturing method

The present invention relates to a digital memory component, and more particularly to an identifiable non-volatile memory component, method of operation thereof, and method of manufacture.

In general, non-volatile memory (and in particular all types of flash memory including NOR and NAND types) has become increasingly popular due to its significant cost advantages. Today, different interfaces of flash memory can be obtained, ranging from traditional NAND interfaces to low pin count serial NAND interfaces, as well as serials including single SPI, dual SPI and quad SPI. Serial Peripheral Interface ("SPI"), and Quad Peripheral Interface ("QPI"). SPIFLASH (RTM), purchased from Winbond Electronics Co., San Jose, Calif., USA, product number W25Q128FV (see Winbond Electronics, Inc., Data Sheet: SpiFlash 3V 128M-Bit Serial Flash Memory with Dual/Quad SPI & QPI, Rev. D, October 1, 2012) is an example of a successful tandem flash memory component.

Non-volatile memory is widely used in today's digital electronic devices including personal computer systems and workstations; mobile communication components including mobile phones, smart phones, phonables and tablets; for example, MP3 playback Entertainment system for devices and video game components; medical component controllers; and cloud systems. The security of information stored on such non-volatile memory is always important to the computer industry. The security vulnerabilities that address such digital electronic devices are an integral part of maintaining industry operations.

Many non-volatile memories used in the above-mentioned digital electronic devices and processors (microprocessors or controllers) for running computer code stored in non-volatile memory and accessing digital data are separately packaged. Such separate packages can exhibit security weaknesses. Referring to FIG. 1, the above computer code and/or access digital data may be maliciously accessed and/or modified in various ways, such as, for example, by tapping into one or more systems, for example. A data input (data in, "DI") and a data out ("DO") line 14 between the controller 10 and the non-volatile memory component 12, and the probe is directly connected to the packaged non-package An extension of one or more pins of the volatile memory component 12; forcibly reading and/or modifying the encapsulated non-volatile when the packaged non-volatile memory component 12 is mounted in a digital electronic device The contents of the memory element 12; and physical removal of the non-volatile memory element 12 from the digital electronic device to read and/or modify the content.

Non-volatile memory components are typically used to store executable code for various types of applications, including set top boxes, cell phones, personal computers, data machines, and the like, as well as a variety of different applications. A type of code that is typically stored on non-volatile memory components (and, in particular, flash memory components for personal computers), is generally known as a basic input/output system (Basic) Input/Output system, "BIOS") code. The BIOS code facilitates initialization processing of the hardware and transition control of the operating system. Based on the unique and special rights of the BIOS in the system architecture, unauthorized modification of the BIOS by malicious means poses a serious threat to the system. BIOS security was published by David Cooper et al. in the April 2011 issue of the National Institute of Standards and Technology ("NIST") in the BIOS Protection Guidelines: Special Publication 800-147.

2 illustrates an example of a subsystem 20 for preventing unauthorized modification of a BIOS code embedded in a modifiable non-volatile memory component (eg, flash memory), which is disclosed U.S. Patent No. 5,844,986 to Davis, issued Dec. 1, 1998. The host processor 21 and the system memory 23 are disposed on the system bus 24 via a chipset (as interface) 22 and a cryptographic coprocessor. The password coprocessor 25 includes a bus interface interface 26, a processing unit 27, and a BIOS. The non-volatile memory 28 of the code 29 is used to perform authentication and validation based on a BIOS upgrade of a public/private key protocol. Authentication is performed by verifying the digital signature embedded in the BIOS upgrade. Although the host processor 21 is separate from the cryptographic coprocessor 25, the cryptographic coprocessor 25 can be part of the host processor 21. In this case, host processor 21 directly accesses BIOS code 29 without going through system bus 24.

Although the security engine that performs cryptographic processing and the non-volatile memory of the stored code and/or data to be defended can be separate and separate components, non-volatile memory (eg, tandem flash memory) Body and security engine It can also be a single integrated circuit on a substrate.

An embodiment of the present invention is a memory device, comprising: a package body; a non-volatile memory bulk circuit chip, included in a package body and including a first interface, coupled to the first interface Logic, and a non-volatile memory array coupled to the control logic and the first interface; the certified integrated circuit chip is included in the package body and includes a second interface, an authentication engine coupled to the second interface, coupled to a volatile memory register of the authentication engine, and a non-volatile memory array coupled to the authentication engine and the second interface; and a contact extending from the package body or disposed on the package body, and the contacts are electrically coupled Connected to the first interface and the second interface.

Another embodiment of the present invention is a method for authenticating a non-volatile memory bulk circuit chip, the non-volatile memory bulk circuit chip being included in a package body and having a plurality of extending from the package body or disposed on the package body a non-volatile memory volume circuit chip having a first interface electrically coupled to at least some of the contacts, the authentication method comprising: a non-accurate integrated circuit chip included in the package body The original memory key is stored in the volatile memory array, the authentication integrated circuit chip further includes a second interface and an authentication engine coupled to the second interface, the non-volatile memory array coupled to the authentication engine and the second Interface; maintaining a monotonic count within the non-volatile memory array of the certified integrated circuit die; encrypting the monotonic count within the authentication engine to generate an encrypted count; and passing the encrypted count from the second interface The authentication engine supplies one of the contacts, the second interface being electrically coupled to at least some of the contacts.

Another embodiment of the present invention is a method for authenticating a non-volatile memory bulk circuit chip, the non-volatile memory bulk circuit chip being included in a package body and having a plurality of extending from the package body or disposed on the package body a non-volatile memory volume circuit chip having a first interface electrically coupled to at least some of the contacts, the authentication method comprising: a non-accurate integrated circuit chip included in the package body The original memory key is stored in the volatile memory array, and the authentication integrated circuit chip further includes a second interface, an authentication engine coupled to the second interface, and a volatile memory register coupled to the authentication engine. The non-volatile memory array is coupled to the authentication engine and the second interface; maintaining a monotonic count in the non-volatile memory array of the certified integrated circuit chip; authenticating the integrated circuit chip receiving and the key for providing the monotonic count Request for a keyed-hash message authentication code (key HMAC); directing the monotonic count from the authentication via the second interface Supplying one of the contacts, the second interface is electrically coupled to at least some of the contacts; the authentication integrated circuit chip receives a request related to a key HMAC for increasing the monotonic count; and the authentication integrated circuit A monotonic count is added to the wafer.

Another embodiment of the present invention is a method of fabricating a memory device, comprising: stacking a standard non-volatile memory bulk circuit chip and an authentication integrated circuit wafer together to form a wafer on a die (die-on-die) Stacking, the standard non-volatile memory volume circuit chip includes a first interface, control logic coupled to the first interface, and a non-volatile memory array coupled to the control logic and the first interface, and The certified integrated circuit chip includes a second interface, an authentication engine coupled to the second interface, a volatile memory register coupled to the authentication engine, and a non-volatile memory coupled to the authentication engine and the second interface Body array; many contacts are electrically Coupling to the first interface and the second interface; and encapsulating the wafer on the wafer in a package body, the contacts extending from the package body or disposed on the package body.

The above described features and advantages of the invention will be apparent from the following description.

10‧‧‧System Controller

12‧‧‧ Non-volatile memory components

14‧‧‧ lines

20‧‧‧ subsystem

21‧‧‧Host processor

22‧‧‧ Chipset

23‧‧‧System Memory

24‧‧‧System Bus

25‧‧‧Clock coprocessor

26‧‧‧ bus interface

27‧‧‧Processing unit

28‧‧‧ Non-volatile memory

29‧‧‧BIOS code

30‧‧‧ Controller

31, 35, 1030, 1130, 1230, 1330‧‧ interface

32‧‧‧Memory component package

33, 50, 62, 80, 81, 83, 91, 1010, 1110, 1210, 1310‧‧ Certified integrated circuit chip

34‧‧‧Standard non-volatile memory bulk circuit chip

36‧‧‧Reliable Platform Module/TPM

40‧‧‧Flash memory volume circuit chip

41‧‧‧SPI/QPII/O Control

42‧‧‧Control logic

43, 53‧‧‧Communication decoder

44, 54‧‧‧ state register

45, 55‧‧‧ address sequencer

46, 56‧‧‧ high voltage generator

47‧‧‧Displacement register

48, 58‧‧‧Sense Amplifier

51‧‧‧I/O Control

52‧‧‧Certification Engine and Control Logic

57‧‧‧SRAM

59‧‧‧ volatile memory

60, 63‧‧‧ memory volume circuit chip

61, 65, 67, 82, 84, 85, 86, 87, 89‧‧ ‧ pads

1240, 1340‧‧‧Internal connection

64‧‧‧ lead frame wafer pad

66,68‧‧‧Binder

69‧‧‧Gate control circuit

70‧‧‧Package body for plastic materials

71~78, 98, 99‧‧‧ pins

90‧‧‧Package body

92, 94‧‧‧Binder

93, 1020, 1120, 1220, 1320‧‧‧ Non-volatile memory volume circuit chip

95‧‧‧ lead frame wafer pad

96, 97‧‧‧ wiring arrangement

140‧‧‧Flash memory cell array

141, 151‧‧‧ column decoder

142, 152‧‧ ‧ row decoder

150‧‧‧Non-volatile memory cell array

154‧‧‧ User memory

156‧‧‧Key Memory

158‧‧‧ counter

1000, 1100, 1200, 1300‧‧‧ memory components

1040, 1140‧‧‧Internal connection

1400‧‧‧Pre-launch authentication processing

1500‧‧‧ Monotonic counter reading processing

1600‧‧‧Processing for authentication BIOS code upgrade

1900‧‧‧Processing for memory component authentication

1410~1490, 1510~1560, 1610~1690, 1910~1980‧‧‧

Figure 1 is a block diagram of an untrustworthy memory subsystem.

2 is a block diagram of a trusted non-volatile memory subsystem for a BIOS of a computer.

3 is a block diagram of a trusted non-volatile memory component and controller.

4 is a block diagram of a flash memory bulk circuit chip suitable for use with the non-volatile memory component of FIG.

5 is a block diagram of an authentication integrated circuit chip suitable for use with the non-volatile memory component of FIG.

6 is a top view of bonding of a flash memory component including one of the certified integrated circuit wafers mounted on the tandem flash memory chip and bonded to the external contacts.

Figure 7 is a side elevational view of the packaged flash memory component of Figure 6.

Figure 8 is a line view of another flash memory component including an authentication integrated circuit chip mounted on a tandem flash memory chip and bonded to an external contact.

Figure 9 is a side elevational view of a packaged flash memory component showing different types of connections.

Figure 10 is an illustrative set of interconnections between the certified integrated circuit wafer and the non-volatile memory bulk circuit chip of the memory component and to the external pins of the component.

Figure 11 is a diagram showing another illustrative interconnect set between the certified integrated circuit die and the non-volatile memory bulk circuit chip of the memory component and to the external pins of the component.

Figure 12 is a diagram showing another illustrative interconnect set between the certified integrated circuit die and the non-volatile memory bulk circuit chip of the memory component and to the external pins of the component.

Figure 13 is a diagram showing another illustrative interconnect set between the certified integrated circuit die and the non-volatile memory bulk circuit chip of the memory component and to the external pins of the component.

Figure 14 is a line view of another flash memory component including an authentication integrated circuit chip mounted on a tandem flash memory chip, and another flash memory component included for external connection Point and wire bonds of internal die-to-die contacts.

Figure 15 is a line view of another flash memory component including a certified integrated circuit chip, wherein the certified integrated circuit chip is mounted on a tandem flash memory chip and another flash memory component is included for external use Bonding of the contacts and the internal wafer to the wafer contacts.

Figure 16 is a flow chart of a pre-boot authentication process.

Figure 17 is a flow chart of a monotonic counter reading process.

18 is a flow chart of a BIOS code upgrade process.

Fig. 19 is a flow chart showing a memory component authentication process.

Although the security engine that performs cryptographic processing and the non-volatile memory that is to be protected for storing code and/or data can be implemented on a single integrated circuit on a single substrate, this approach can result in significant cost. The waste, especially in tandem flash memory, where cost considerations are important factors. Often, different tandem flash memories offer many different densities. The technical features that provide security for different density tandem flash memories require safe functionality to be designed into each density of tandem flash memory. Furthermore, if the security engine or memory becomes obsolete or is found to be defective, the entire inventory of memory volume circuit chips and their reticle needs to be discarded and a new memory volume circuit design will be required.

3 illustrates a manner in which memory component package 32 encloses two separate wafers, one being a standard non-volatile memory volume circuit 34 and the other being a suitable certified integrated circuit die 33. Any of the wafers 33 or 34 can be stacked on another wafer. Alternatively, wafers 33 and 34 may be placed side-by-side, which may reduce the height of memory component package 32 but may increase the footprint. The external contacts (not shown) of the component package 32 can correspond to the power and signal requirements of the standard non-volatile memory volume circuit chip 34, so that the pin-out of the memory component package 32 can be configured as a common The standard output pin of the memory product type of the standard non-volatile memory volume circuit chip 34. The power and signals of the certified integrated circuit die 33 may be provided by some or all of the pins of the non-volatile memory bulk circuit die 34, or by other unused components of the memory component package 32. The pin is provided. One or more additional external contacts may be exclusively added to the certified integrated circuit wafer 33, but wherein the number of contacts required to authenticate the integrated circuit die 33 is less than or equal to the standard non-volatile memory volume circuit 34 The number of contacts required is met by the use of signals and power lines for the standard non-volatile memory volume circuit 34 to meet the requirements of the certified integrated circuit die 33 to allow external output pins to be standard. To enhance compatibility. In some implementations, one or more signals may be dedicated between the standard non-volatile memory volume circuit 34 and the certified integrated circuit chip 33, but these inter-die signals are not connected. To any external contact.

The standard non-volatile memory volume circuit chip 34 can be any type of non-volatile memory such as, for example, NOR flash, NAND flash, EEPROM, PCRAM, FRAM, RRAM, MRAM, etc., said non-volatile The memory has any type of suitable interface, including a side-by-side interface, such as a side-by-side flash bus interface and a NAND bus interface; a tandem interface, such as a tandem peripheral interface ("SPI") and a four-peripheral interface ( "QPI") and so on. The certified integrated circuit die 33 can store the key using its volatile memory and non-volatile memory, and can include any circuitry required and programmatically act on any desired security algorithm. The above actions are either symmetric-key or public-key cryptography, including, for example, the RSA algorithm, the Advanced Encryption Standard ("AES") specification, Security Hash Algorithm ("SHA"), Message Authentication Codes ("MAC"), Data Encryption Standard ("DES") specifications, random number generation, random number generation, A monotonic counter, or any other encryption algorithm, is implemented to implement the authentication procedure via controller 30 on interface 31. A trusted platform module ("TPM") 36 can be set up as needed, which can have a suitable interface 35 (eg, low pin count ("LPC") interface, I ² C interface, or SPI interface) Communicating with the controller 30. In some embodiments, sufficient security can be provided by authenticating the integrated circuit die 33 so that the TPM 36 and interface 35 are not required and one or more of the original keys can be manufactured or otherwise The equipment manufacturer ("OEM") is built into the certified integrated circuit chip 33 in a single program. Eliminating the TPM 36 and interface 35 simplifies the interface signal and provides significant cost savings. In some embodiments. Multiple non-volatile original keys and non-volatile monotonic counters are available for multiple authentication procedures.

The memory component package 32 can be any desired type of integrated circuit package, including, for example, a Small Outline Integrated Circuit ("SOIC"), a Very Small-Outline Package ("Very Small-Outline Package," VSOP"), Plastic Dual In-Line package ("PDIP"), Thin Small Outline No Lead ("WSON"), and thermally enhanced ball grid array (Thermally Enhanced Ball Grid Array, "TFBGA"). Suitable package types can also include 150mil 8-pin SOIC packages for low-density parts, 208mil 8-pin SOIC packages for medium and high-density parts, and low profile 6mm x 5mm 8-pad WSON packages. Any type of interface that can be interfaced with a standard non-volatile memory volume circuit chip 34, including single and multi-bit SPI, QPI, conventional NAND flash memory device interface, and tandem NAND Flash memory interface. The instructions applied to the interface 31 can be received by both the certified integrated circuit wafer 33 and the standard non-volatile memory volume circuit wafer 34. Although some instructions are on the crystal Both sheets 33 and 34 are common, and the certified integrated circuit wafer 33 can ignore specific instructions for the standard non-volatile memory volume circuit chip 34, while the standard non-volatile memory volume circuit wafer 34 can be ignored for authentication. The specific instructions of the integrated circuit chip 33.

Since the embodiment of FIG. 3 only needs to design a single certified integrated circuit, it can provide a time-to-market and cost savings. In contrast, in the past when faced with different densities of memory, suppliers of single-integrated circuit solutions had to spend the effort and time to design memory of different densities and the safety of new wafers for each density of memory. Square. However, for the embodiment of Figure 3, the single-certified integrated circuit can be designed to be used with standard non-volatile memory of any density, and only a suitable mask and a process can be used to The certified integrated circuit is repeatedly replicated into individual wafers, and each wafer can be packaged with any standard non-volatile memory bulk circuit chip to provide a variety of secure memory solutions of varying densities. In addition, a variety of different certified integrated circuits can be designed to be used with standard non-volatile memory of any density to provide a variety of packaged memory components of different densities and different security algorithms. In addition, multi-certified integrated circuit chips that implement different cryptographic algorithms can be packaged with a particular standard memory volume circuit chip to provide a single, completed package of memory that can be used to give multiple security solutions. In addition, any customized security engine can be designed to be used with any standard non-volatile memory at any time without the need to modify standard non-volatile memory. In each case, standard non-volatile memory volume circuit chips can be used directly without modification, so there is no additional cost of modifying the memory design and remanufacturing the fixture. In addition, users benefit from having a safe non-volatile memory component. The secure non-volatile memory component is located in a convenient and familiar package with convenient and familiar output pins.

4 illustrates an illustrative in-line flash memory bulk circuit wafer 40 that is one of the implementations of the embodiment of FIG. The flash memory volume circuit chip 40 includes any constructed flash memory array 140, as well as various other circuits for supporting memory programming, erasing and reading, such as column decoder 141, row decoder 142, Control logic 42, communication decoder 43, status register 44, address sequencer 45, high voltage generator 46, shift register 47, and sense amplifier (sense) Amplifier)48.

While any desired communication interface can be used, a particularly suitable interface is the SPI/QPI interface that provides unit, dual, and four-bit SPI and four peripheral interfaces ("QPI"). Additional details on the SPI and QPI interface and the circuit for the memory array can be found in U.S. Patent No. 7,558,900, which is published by Winbond Electronics Co., Ltd. and awarded to Jigour et al. on July 7, 2009, data sheet: SPIFLASH (RTM) W25Q128FV 3V 128M-Bit Serial Flash Memory with Dual/Quad SPI & QPI, Rev. D, October 1, 2012, the entire contents of which is incorporated herein by reference. The illustrative SPI/QPI I/O control 41 implements the SPI/QPI interface, which uses the signal CLK as the clock signal; uses the signal /CS as the chip select complement signal; uses the signal DI or IO0 as serial data-input (unit SPI) and bit 0 serial data-input/output (multi-bit SPI and QPI); use signal DO or IO1 as serial data-output (unit SPI) And bit 1 serial data - input / output (multi-bit SPI and QPI); use signal / WP or IO2 as write protection reverse signal (write Protect complement signal) (bit unit SPI) and bit 2 serial data - input / output (multi-bit SPI and QPI); use signal / HOLD or IO3 as hold complement signal (unit SPI) And bit 3 serial data - input / output (multi-bit SPI and QPI); power supply VDD; and power VSS. The command set used by controller 30 for untrusted memory functions can be a standard set of instructions specific to the standard non-volatile memory volume circuit chip 34.

5 illustrates an illustrative certified integrated circuit chip 50 that includes a non-volatile memory cell array 150 and various other circuits that support memory staging, erasing, and reading, such as column decoder 151, row decoder 152. Authentication engine and control logic 52, communication decoder 53, status register 54, address sequencer 55, high voltage generator 56, SRAM 57, sense amplifier 58, and volatile memory 59. The non-volatile memory cell array 150 provides sensitive information (such as raw security keys and monotonic counter values) to trusted non-volatile storage. Part of the non-volatile memory 150 is designed to be one-time programmable or read-only (for example, read-only memory or "ROM") to store the original security key. Volatile memory 59 provides temporary storage of keys derived from the original key. The I/O control 51 interfaces with the SPI/QPI signal and the power line. Illustratively, the certified integrated circuit die 50 can operate in any SPI mode or QPI mode, and thus uses CLK, /CS, DI/IO0, DO/IO1, IO2, and IO3 signal lines and VDD and VSS power lines. Signals /WP and /HOLD are not used. For example, an authentication integrated circuit chip (not shown) can operate only in the unit cell SPI mode, and thus uses CLK, /CS, DI, and DO, and VDD and VSS power lines. In addition, the signals /WP and /HOLD are not required, so only six pins can be used.

The set of instructions used by the controller 30 for authentication and for trusted memory functions may be instructions specifically for authenticating the integrated circuit chip 33, except that some instructions may be used for both authentication and trusted memory functions and untrustworthy. Memory function.

6 and 7 illustrate various wiring diagrams of illustrative non-volatile memory components. For the sake of clarity, Figure 6 shows a top view of the encasing plastic not shown therein, and Figure 7 shows a side view along a pair of opposing pins 74 and 75, the pins are only commonly used in integrated circuits. One type of external contact in the package. Illustratively, the package type is an 8-pin SOIC type package. The memory bulk circuit wafer 60 is bonded to the lead frame die pad 64 using any suitable bonding agent 68 (e.g., gold-tin or gold-bismuth solder or epoxy adhesive). Or other types of support structures. The smaller certified integrated circuit wafer 62 is bonded to the top of the memory volume circuit wafer 60 using any suitable adhesive 66 (illustratively, gold-tin or gold-bismuth solder or epoxy adhesive). Such an arrangement may also be referred to as a chip-on-chip technique. Although the memory cell circuit 60 is larger than the certified integrated circuit chip 62, the relative size may be reversed, so that the memory bulk circuit chip can be mounted on a relatively large certified integrated circuit chip (not shown). . Illustratively, the memory volume circuit chip 60 has an SPI/QPI flash memory interface such that pins 71-78 of the packaged non-volatile memory elements are designated /CS, DO or IO1, /WP or IO2, respectively. VSS, DI or IO0, CLK, /HOLD or IO3, and VDD, and wires connect the eight pads on the memory bulk circuit wafer 60 to these pins, respectively. Similarly, the bonding wires respectively connect the eight pads of the certified integrated circuit wafer 62 to these pins. Alternatively, the eight pads on the memory bulk circuit wafer 60 and the eight pads on the certified integrated circuit wafer 62 can be individually connected by wire bonding, and can be used. He wired to connect individual bonding pad pairs to the pins (see, for example, wiring arrangement 96 in Figure 9). The package body 70 of plastic material is injection molded to seal the memory bulk circuit wafer 60, the certified integrated circuit wafer 62, the lead wires, and a portion of the leads (such as 74 and 75 shown in FIG. 7). To protect and stabilize these parts.

If more pins are needed, a larger package type can be used. For example, if it is desired to include a RESET signal for both the memory bulk circuit wafer 60 and the certified integrated circuit wafer 62, a 16-pin SOIC type package can be used in this case. For example, other unused pins in the output pin can be standard output pins for SPI/QPI serial memory, except for one of the other unused pins. The RESET signal is transmitted.

The example of the packaging technology shown in FIG. 6 and FIG. 7 can be used, and other system-in-package or three-dimensional integrated circuits and multi-chip packaging can be used if necessary. "MCP" technology. For very thin package bodies, the memory volume circuit wafer 60 and the certified integrated circuit wafer 62 arranged side by side on the lead frame wafer pads may be more suitable. In this type of implementation, it is desirable to fabricate certified integrated circuit wafers 62 with additional traces and bonding pads so that the distance of the various wire bonds can be kept to a minimum. Moreover, while it may be quite effective to use a suitable adhesive to stack the memory bulk circuit wafer 60 and the certified integrated circuit wafer 62, other stacking techniques may be used, such as, for example, attaching individual wafers to the substrate. Top and bottom. Similarly, a substrate can be used to support wafers arranged side by side. A number of other techniques can be used to interconnect the pads or other contacts on the memory bulk circuit wafer 60 and the certified integrated circuit wafer 62, as well as the memory bulk circuit wafer 60 and the certified integrated circuit wafer. Pads or other contacts on the 62 are connected to pins or contacts on the outside of the package (including solder bumps).

The package configuration shown in FIG. 8 is similar to the package configuration shown in FIG. 6, except that the authentication integrated circuit wafer 80 is designed to operate only in the unit cell SPI mode such that the signal lines IO2 and IO3 are not used. Since /WP and /HOLD are not used, the pads and wirings for connecting to IO2 and IO3 in Figure 6 can be eliminated. Figure 8 also shows an example of an internal wafer-to-wafer connection using the wiring between the pads 82 on the memory bulk circuit wafer 60 and the pads 84 on the certified integrated circuit wafer 80. . An example of such an internal wafer to wafer layout is shown as a wiring arrangement 97 in FIG.

10 to 13 illustrate various arrangements of external signals and power connections and internal signal connections. 10 shows a memory component 1000 having an authenticated integrated circuit wafer 1010 and a memory bulk circuit wafer 1020 (which share a common interface 1030). One or more internal connections 1040 may be provided if required.

11 illustrates a memory component 1100 in which a certified integrated circuit die 1110 shares a subset of signals and/or power lines of a memory volume circuit die 1120 having unshared external signals and/or power connections (interface 1130). ). One or more internal connections 1140 may be provided if required.

12 illustrates a memory component 1200 in which a memory volume circuit wafer 1220 shares a subset of signals and/or power lines of an authentication integrated circuit wafer 1210 having unshared external signals and/or power connections (interface 1230). ). One or more internal connections 1240 may be provided if required.

FIG. 13 illustrates a memory component 1300 in which an integrated circuit chip is authenticated The 1310 shares a subset of the signals and/or power lines of the memory volume circuit chip 1320. Both the certified integrated circuit chip 1310 and the memory volume circuit die 1320 have unshared external signals and/or power connections (interface 1330). One or more internal connections 1340 may be provided if required.

14 and 15 illustrate an alternative example of an internal wafer-to-wafer connection that controls the execution of CS/memory volume body circuit wafers based on the authentication results.

The package configuration shown in FIG. 14 is similar to the package configuration shown in FIG. 6, except that the authentication integrated circuit wafer 81 is designed to control the application of the /CS signal to the memory bulk circuit wafer 60 to save memory. The wiring between the pin 71 of the bulk circuit wafer 60 and the pad 61, and the internal wafer to the wafer are fabricated between the pad 85 on the certified integrated circuit wafer 81 and the pad 61 on the memory bulk circuit wafer 60. Connected. The /CS signal is supplied from the pin 71 to the pad 86 to the authentication integrated circuit chip 81. When the authentication event passes, the /CS signal is transmitted to the pad 61, and when the authentication event fails, the /CS signal is not transmitted to the pad 61.

The package configuration shown in FIG. 15 is similar to the package configuration shown in FIG. 6, except that the certified integrated circuit die 83 is designed to generate an internal authentication pass/fail signal to control the transfer to the memory volume circuit chip 63. For the application of the /CS signal, the memory volume circuit chip 63 is designed to include a gating circuit 69 (for example, a NOR gate), and the pad 89 and the memory bulk circuit chip on the certified integrated circuit wafer 83. An internal wafer to wafer connection is made between pads 67 on 63 to apply an internal pass or fail signal. The /CS signal is supplied from the pin 71 to both the pad 87 on the authentication integrated circuit wafer 83 and the pad 65 on the memory bulk circuit chip 63. When the authentication event passes, the internal authentication pass/fail signal changes. "Low" causes the gate control circuit 69 to pass the /CS signal. If the authentication event fails, the internal authentication pass/fail signal becomes "high", so that the gate control circuit 69 does not pass the /CS signal.

The package configuration of Figure 15 is advantageous in that the timing of the /CS signal is in an important path because the /CS signal is placed in the package configuration of Figure 14, thus the /CS signal to the memory volume circuit chip There is no delay in implementation. Although the memory volume circuit chip 63 is designed to include the gate circuit 69, the memory volume circuit chip 63 can still be regarded as a standard memory volume circuit wafer because the memory volume circuit chip 63 may or may not be associated with the certified integrated circuit. The wafers are used together. When the memory volume circuit chip 63 is not used with the certified integrated circuit chip (not shown), the pad 67 can be routed to the VSS pin 74 or can be routed to any pad that is routed to the pin 74, such that The gate control circuit 69 passes the /CS signal.

Implementation example

16 through 19 illustrate an example of an authentication process that can be performed by authenticating the integrated circuit chip 50 (FIG. 5) and having the flash memory volume circuit chip 40 when used for BIOS storage. The communication decoder can respond to specialized authentication-specific instructions, such as counter read instructions for reading monotonic counter values (Figure 17), and can also respond to some standard memory instructions, such as for adding memory-modifying monotonic A erase/modified command of a memory-modified monotonic counter to detect replay attacks (Figure 16). The non-volatile memory 150 can include a plurality of distinct regions, such as, for example, user memory 154, information regions (not shown), configuraiton memory (not shown), gold. Key memory 156, and counter 158. User memory 154 can have a number of blocks that can be configured to provide a variety of different access restrictions (ranging from open access to full limit). (full restrictions), the access restriction as a security key precludes the read/write operation and allows only internal, authentication use of such material. The information area maintains read-only information such as chip identification information. The configuration memory provides a personalization of resources for authenticating the integrated circuit chip, including, for example, counter and key usage, and configuring the memory includes locking the memory to make the configuration permanent (permanent) Ability. The key memory area 156 is a one-time stylized ("OTP") area that stores one or more non-user accessible secret keys (eg, original keys). Counter area 158 stores the value of the nonreversible monotonic counter. The authentication techniques described herein are merely illustrative, and a number of authentication techniques known in the art are suitable for authenticating implementations in integrated circuit wafers.

The configuration of the non-volatile memory 150 described herein is merely illustrative. Some authentication and encryption implementations may use only one original key and multiple monotonic counters, in which case the non-volatile memory 150 may be configured to have only one key memory and multiple monotonic counter memories.

A memory element including a certified integrated circuit chip and a non-volatile memory bulk circuit chip can be fabricated to verify that the integrated circuit wafer is not initialized in a default state. The manufacturer can initialize the certified integrated circuit chip, or the manufacturer can send the certified integrated circuit chip to the initial state, so that the recipient (usually the original equipment manufacturer ("OEM") can initialize the certified integrated body. Circuit chip. Initialization is a one-time stylization process in which the original key K _RT is written to the key memory area 156 and the monotonic counter is initialized. After initialization, if the original key K _{RT is} used as a private key, the public key K _PUB can be generated and stored in the user memory 154. At this point, the memory component has been ready to be used.

FIG. 16 illustrates a pre-boot authentication process 1400. It is assumed that the memory controller or other processor knows the authentication monotonic counter value CNT from the immediately-prior session and knows the public key K _PUB corresponding to the original key K _RT of the memory component ( Block 1410). The public key K _PUB can be read from a memory element, obtained from a certification agency, or obtained in any other suitable manner. Next, for example, the controller generates the dialog key K _SES in any suitable manner by using a random number generator (block 1420); the controller generates the counter CNT encryption and the dialog key K _SES via the public key K _PUB Encrypted authentication challenge (block 1430); and the controller sends an authentication challenge to the memory element (block 1440). The authentication integrated circuit chip in the memory component decrypts the authentication challenge by private key K _RT to recover the counter CNT and the session key K _SES (block 1450). The certified integrated circuit wafer then compares the values of the corresponding monotonic counters in the CNT and counter 156 (Fig. 5) (block 1460). If the counters do not match, the following may occur: an unauthorized erase/program of the non-volatile memory volume circuit chip causes an increase in the monotonic counter outside of the authorized program, and the authentication fails (block 1490). If the counters match, the dialog key K _SES can be stored in volatile memory 59 (FIG. 5) (block 1470) for use in subsequent conversations, and authentication passes (block 1480).

During the authentication session, by the authorization program, the controller can increment the counter CNT to continuously track all authorized erase/programmatic accesses to the memory elements. In this manner, at the end of the dialog, the counter CNT maintained by the controller should match the monotonic counter in the certified integrated circuit die unless an unauthorized program has been tampered with the memory volume circuit chip. By the following The mode reads the monotonic counter, and the controller can complete the comparison of the two counters.

Figure 17 illustrates a monotonic counter read process 1500 using a dialog key for symmetric encryption. The controller sends a monotonic counter read command to the memory component (block 1510). Upon receiving the instruction (block 1520), the authentication integrated circuit wafer generates a response including the counter value encrypted by the session key K _SES (block 1530). The memory component sends a response to the controller (block 1540), which decrypts the response via the symmetric dialog key K _SES to recover the monotonic counter value (block 1550). The controller can use the monotonic counter value in any desired manner (block 1560), such as, for example, comparing the two counters to determine if the memory volume circuit chip has been tampered with.

Figure 18 shows a procedure 1600 for authenticating a BIOS code upgrade. A BIOS upgrade is received from the sender (block 1610), and a BIOS hash signed by the sender (block 1620). If not stored in the user memory area of the certified integrated circuit chip, the public key of the transmitter is obtained in any suitable manner, such as, for example, from a certificate authority, and the public key is stored in the authentication complex. The user of the circuit chip is in the memory area (block 1630). Next, the certified integrated circuit die can decrypt the signed hash (block 1640), generate a BIOS upgrade hash (block 1650), and compare the decrypted hash with the generated hash (block 1660). If a match occurs (block 1670, yes), the BIOS upgrade can be authorized (block 1680). If the match does not occur (block 1670, no), the BIOS upgrade is terminated (block 1690).

Figure 19 shows a process 1900 for memory component authentication based on secure communication between a system controller in a memory component and an authentication integrated circuit chip. The process of Figure 19 uses a keyed hash massage authentication code ("keyed-HMAC"). In process 1900, system control Some requests from the device to the certified integrated circuit chip are generated by the key HMAC. The key HMAC uses a derived key based on the original key and the dialog material, wherein the dialog data is generated by the system controller, and the original key is stored on the authentication integrated circuit chip. Illustratively, the dialog material can be a dialog key. A further description of the key HMAC can be found below: National Institute of Standards and Technology (NIST), Key Hash Message Authentication Code (HMAC), FIPS Publication 198-1, July 2008, all of which is incorporated herein by reference. reference. As mentioned in the aforementioned document in NIST, the MAC based on the cryptographic hash function is known as HMAC. The MAC is used to authenticate the source of the message and the integrity of the message, and the HMAC has two functionally different parameters: a message input and a secret key, which is only the message originator and the intended receiver. (Intended receiver(s). The sender uses the HMAC function to generate a value (MAC) from the secret key and to generate a message input. Send the MAC and message to the message receiver, which uses a transmitter such as a transmitter. The same key and HMAC function is used to calculate the MAC on the received message, and the calculated result is compared with the received MAC. If the two values match, the source of the message and the integrity of the message are verified.

In process 1900, the authentication integrated circuit wafer receives the dialog material and HMAC from the system controller, which generates the dialog material and calculates the HMAC (block 1910). Because the system controller generates unique dialog material for each power cycle, additional security is provided due to the dynamic nature of the conversational material. The authentication integrated circuit wafer calculates a derivation key that is based on the original key stored in the key memory of the certified integrated circuit chip and the dialog material (block 1910). The derived key calculated in the certified integrated circuit chip is the same as the derived key calculated in the system controller. Next, the certified integrated circuit crystal The slice may receive a request to provide a value for the non-volatile monotonic counter maintained in the certified integrated circuit die (block 1920), the request being sent from the system controller by using the HMAC of the derived key. The system controller receives the counter value from the certified integrated circuit die and compares the counter value to a counter value maintained in the system controller (block 1930). When there is no match, the authentication fails (block 1970) and the operation is then ended (block 1980). In the case of a match, the authentication passes (block 1940). Then, the system controller can send a request to the authentication integrated circuit chip through the key HMAC to increase the non-volatile monotonic counter to the next state/count, which is duly received, authenticated and authenticated by the certified integrated circuit chip. Implemented (block 1950). The process is then completed (block 1960).

The description of the present invention, including the application and advantages thereof, is intended to be illustrative, and is not intended to limit the scope of the invention. Variations and modifications of the embodiments disclosed herein are possible, and the actual alternatives and equivalents of the various components of the described embodiments can be understood by those of ordinary skill in the art. Illustratively, the particular values given herein may be varied, the order of steps may be varied, some steps may be repeated, and some steps may be omitted. These and other embodiments, including alternatives and equivalents of the various components of the embodiments, may be carried out without departing from the scope and spirit of the invention, including the scope of the appended claims. Other changes and modifications.

Claims (20)

A memory component, comprising: a package body; a non-volatile memory volume circuit chip, included in the package body and including a first interface, control logic coupled to the first interface, and coupled to the Controlling the non-volatile memory array of the first interface; the authentication integrated circuit chip is included in the package body and includes a second interface, an authentication engine coupled to the second interface, coupled to a volatile memory register of the authentication engine, and a non-volatile memory array coupled to the authentication engine and the second interface, wherein some of the non-volatile memory is designed to be one-time programmable Or read-only to store the original key; and a contact extending from the package body or disposed on the package body, and the contact is electrically coupled to the first interface and the second An interface, wherein the first interface and the second interface share a common set of the contacts, and the contacts are compatible with the first interface, wherein the first interface is a serial Interface, and The second interface is the identity element interface SPI. The memory component of claim 1, wherein the common set is all of the contacts. The memory component of claim 1, wherein the common set is less than all of the contacts. The memory component of claim 1, wherein the first interface is an SPI interface. The memory component of claim 1, wherein the first interface is an SPI/QPI interface. The memory component of claim 1, wherein the first interface is a NAND interface. The memory device of claim 1, wherein the standard non-volatile memory bulk circuit chip and the certified integrated circuit wafer are in a stacked form. The memory component of claim 1, wherein the non-volatile memory array of the certified integrated circuit chip comprises a disposable programmable section. The memory component of claim 1, wherein the non-volatile memory array of the certified integrated circuit chip comprises a key memory and a monotonic counter memory. The memory component of claim 9, wherein the key memory is configured to store a plurality of the original keys, and the monotonic memory is used to store a plurality of count values. (count value), the count value corresponds to the original key and the count value is dynamic and monotonously changed. The memory device of claim 1, wherein the certified integrated circuit chip is smaller than the non-volatile memory bulk circuit chip and mounted on the non-volatile memory bulk circuit chip. The memory device of claim 1, wherein the non-volatile memory volume circuit chip is smaller than the certified integrated circuit chip and mounted on the certified integrated circuit chip. A method for authenticating a non-volatile memory bulk circuit chip, the non-volatile memory bulk circuit chip being included in a package body and having a plurality of contacts extending from the package body or disposed on the package body, The non-volatile memory volume circuit chip has a first interface electrically coupled to at least some of the contacts, the authentication method comprising: non-volatile of an authentication integrated circuit chip included in the package body The original memory key is stored in the memory array, the authentication integrated circuit chip further includes a second interface and an authentication engine coupled to the second interface, the non-volatile memory array coupled to the authentication engine And the second interface, wherein the portion of the non-volatile memory is designed to be one-time programmable or read-only to store the original key, wherein the first interface and the second interface share the a common set of contacts, and the contacts are compatible with the first interface, wherein the first interface is a tandem interface and the second interface is a unit cell SPI interface; Maintaining a monotonic count within the non-volatile memory array of the syndrome circuit die; encrypting a monotonic counter value within the authentication engine; and passing the encrypted monotonic counter value via the second interface One of the contacts is furnished from the authentication engine, the second interface being electrically coupled to at least a portion of the contacts. The method for authenticating a non-volatile memory bulk circuit chip according to claim 13, wherein the certified integrated circuit chip includes a volatile memory register coupled to the authentication engine, the authentication The method further includes storing the dialog key in the volatile memory scratchpad of the authentication integrated circuit chip, and wherein the encrypting step includes encrypting the monotonic counter value via the dialog key. A method for authenticating a non-volatile memory bulk circuit chip, the non-volatile memory bulk circuit chip being included in a package body and having a plurality of contacts extending from the package body or disposed on the package body, The non-volatile memory volume circuit chip has a first interface electrically coupled to at least a portion of the contacts, the authentication method comprising: an authentication integrated circuit chip included in the package body The original key is stored in the non-volatile memory array, and the authentication integrated circuit chip further includes a second interface, an authentication engine coupled to the second interface, and a volatile memory coupled to the authentication engine a non-volatile memory array coupled to the authentication engine and the second interface, wherein a portion of the non-volatile memory is designed to be one-time programmable or read-only to store the An original key, wherein the first interface and the second interface share a common set of the contacts, and the contacts are compatible with the first interface, wherein the first interface is a tandem And the second interface is a unit cell SPI interface; maintaining a monotonic count in the non-volatile memory array of the certified integrated circuit chip; the authentication integrated circuit wafer receiving and providing a keyed-hash message authentication code (key HMAC) related request; supplying the monotonic count from the authentication engine to one of the contacts via the second interface, The second interface is electrically coupled to at least some of the contacts; the authentication integrated circuit die receives a request related to the key HMAC for increasing the monotonic count; and the authentication integration The monotonic count is added to the circuit die. The method for authenticating a non-volatile memory volume circuit chip according to claim 15, further comprising: calculating a derived key based on the session data and the original key; and storing the location Deriving a key in the volatile memory register; wherein the key HMAC is an HMAC based on the derived key. A method of fabricating a memory device, comprising: stacking standard non-volatile memory bulk circuit chips and certified integrated circuit wafers together to form a die-on-die stack of said standard The non-volatile memory volume circuit chip includes a first interface, control logic coupled to the first interface, and a non-volatile memory array coupled to the control logic and the first interface, and The certified integrated circuit chip includes a second interface, an authentication engine coupled to the second interface, a volatile memory register coupled to the authentication engine, and coupled to the authentication engine and the a two-interface non-volatile memory array, wherein some of the non-volatile memory is designed to be one-time programmable or read-only to store an original key; a plurality of contacts are electrically coupled to the first An interface and the second interface; and encapsulating the wafer on a wafer in a package body, the contact extending from the package body or disposed on the package body, wherein the One And the second interface shares a common set of the contacts, and the contacts are compatible with the first interface, wherein the first interface is a tandem interface and the second interface is a unit Meta SPI interface. The method of manufacturing a memory device according to claim 17, wherein the electrically coupling step comprises electrically coupling the first interface and the second interface to each other, and the second interface is a subset of the first interface, and the contacts are compatible with the first interface. The method of manufacturing a memory device according to claim 17, wherein the authentication integrated circuit wafer is smaller than the non-volatile memory bulk circuit wafer, and the stacking step includes the authenticating integrated circuit A wafer is stacked on the non-volatile memory volume circuit wafer. The method of fabricating a memory device according to claim 17, wherein the non-volatile memory volume circuit chip is smaller than the authentication integrated circuit chip, and the stacking step comprises the non-volatile memory A bulk body circuit wafer is stacked on the certified integrated circuit wafer.