Read-only memory (ROM) security
An apparatus with an integrated circuit (IC) chip can provide protection against attacks on a read-only memory (ROM), such as a boot ROM for security circuitry. An attacker can gain control of an IC by modifying ROM contents and/or redirecting ROM reads. To combat these attacks, example implementations store encrypted ROM data in the ROM array. A ROM controller is used to cryptographically tie the address of each ROM line to the corresponding encrypted ROM datum. To access the encrypted ROM datum, cryptographic circuitry decrypts the encrypted ROM datum using a key that is generated based on the corresponding ROM address. As part of an integrity checking procedure, a digest can be computed based on the encrypted ROM data. To further thwart would-be attacks, the ROM address can be adjusted (e.g., scrambled) before the controller uses the adjusted address to read encrypted data from the ROM array.
1 . An apparatus for secure read-only memory (ROM), the apparatus comprising:
a ROM array including encrypted ROM data stored at multiple ROM addresses; and
a ROM controller coupled to the ROM array, the ROM controller including:
cryptographic circuitry configured to perform a decryption operation on the encrypted ROM data based on the multiple ROM addresses at which the encrypted ROM data is stored; and
a ROM access interface coupled to the cryptographic circuitry and the ROM array, the ROM access interface configured to:
read an encrypted ROM datum from the ROM array based on a ROM address corresponding to the encrypted ROM datum;
after reading the encrypted ROM datum, decrypt the encrypted ROM datum to produce a decrypted ROM datum using the cryptographic circuitry that performs the decryption operation based on the ROM address corresponding to the encrypted ROM datum; and
forward the decrypted ROM datum to an interconnect, the cryptographic circuitry comprising:
keystream circuitry configured to produce multiple keys respectively based on the multiple ROM addresses, the multiple keys including at least one key that is produced based on the ROM address corresponding to the encrypted ROM datum; and
data combination circuitry coupled to the keystream circuitry, the data combination circuitry configured to produce the decrypted ROM datum based on the encrypted ROM datum and the at least one key.
2 . The apparatus of claim 1 , wherein the ROM access interface is configured to use the cryptographic circuitry to cryptographically tie the ROM address to the decrypted ROM datum.
3 . The apparatus of claim 1 , wherein the cryptographic circuitry is configured to perform the decryption operation on a respective ROM datum of the encrypted ROM data based on a respective ROM address of the multiple ROM addresses, the respective ROM address configured to identify the respective ROM datum in the ROM array.
4 . The apparatus of claim 1 , wherein the ROM access interface comprises a finite state machine (FSM) configured to provide access to the encrypted ROM data as decrypted ROM data for a bootup procedure.
5 . The apparatus of claim 1 , wherein:
the ROM controller comprises an address adjustment circuit configured to adjust ROM addresses to produce adjusted ROM addresses; and
the ROM access interface is configured to adjust the ROM addresses to read the encrypted ROM data stored at the multiple ROM addresses using the address adjustment circuit.
6 . The apparatus of claim 5 , wherein the address adjustment circuit is configured to at least one of permute or substitute two or more bits of each ROM address of the ROM addresses to produce the adjusted ROM addresses.
7 . The apparatus of claim 1 , wherein:
the cryptographic circuitry comprises a manipulation circuit configured to manipulate at least one bit of the encrypted ROM datum to produce a manipulated encrypted ROM datum; and
the data combination circuitry is configured to produce the decrypted ROM datum based on the manipulated encrypted ROM datum and at least one key of the multiple keys.
8 . The apparatus of claim 7 , wherein:
the manipulation circuit is configured to diffuse two or more bits of the encrypted ROM datum to produce the manipulated encrypted ROM datum; and
the data combination circuitry is configured to combine bits of the at least one key and bits of the manipulated encrypted ROM datum using at least one logical operation to produce the decrypted ROM datum.
9 . The apparatus of claim 1 , wherein:
the encrypted ROM datum includes bits corresponding to a ROM instruction and bits corresponding to a check code for the ROM instruction; and
the decrypted ROM datum includes bits corresponding to the ROM instruction and bits corresponding to the check code for the ROM instruction.
10 . The apparatus of claim 9 , wherein the ROM controller comprises:
a ROM checker circuit coupled to an output of the cryptographic circuitry, the ROM checker circuit configured to:
compute another check code based on the ROM instruction of the decrypted ROM datum;
perform a comparison including the check code of the decrypted ROM datum and the computed other check code; and
generate an error signal based on the comparison.
11 . The apparatus of claim 9 , wherein each encrypted ROM datum of the encrypted ROM data stored at the multiple ROM addresses of the ROM array is distinct from each other encrypted ROM datum of the encrypted ROM data stored at the multiple ROM addresses of the ROM array due to an encryption scheme that is based on the multiple ROM addresses.
12 . The apparatus of claim 1 , wherein the apparatus comprises a mobile device.
13 . A method for secure read-only memory (ROM), the method comprising:
obtaining a ROM read request including a ROM address relating to a ROM array that includes encrypted ROM data stored at multiple ROM addresses;
generating at least one key based on the ROM address;
reading an encrypted ROM datum from the ROM array using the ROM address corresponding to the encrypted ROM datum;
after the reading of the encrypted ROM datum, decrypting the encrypted ROM datum to produce a decrypted ROM datum using the encrypted ROM datum and the at least one key; and
forwarding the decrypted ROM datum to an interconnect, wherein:
the decrypting comprises performing at least one logical operation that includes the at least one key and the encrypted ROM datum to produce the decrypted ROM datum;
the decrypting comprises manipulating, prior to the performing of the at least one logical operation, bits of the encrypted ROM datum to produce a manipulated encrypted ROM datum;
the performing includes performing the at least one logical operation using the at least one key and the manipulated encrypted ROM datum to produce the decrypted ROM datum;
the manipulating comprises diffusing two or more bits of the encrypted ROM datum to produce the manipulated encrypted ROM datum; and
the performing comprises combining bits of the at least one key and bits of the manipulated encrypted ROM datum using the at least one logical operation to produce the decrypted ROM datum.