Authenticated nonvolatile memory signing operations
View Patent ↗A wireless device includes a nonvolatile memory that handles the task of securely performing integrity checks that do not expose the authentication private key externally. The system security architecture installs and associates private keys with the nonvolatile memory to create a secure execution environment resistant to virus attack. The nonvolatile memory provides integrity checks of nonvolatile memory data and generates signatures for data provided by the memory.
1. A nonvolatile memory device, comprising:
an authentication engine in a nonvolatile memory;
a filesystem to use a private key not accessible to a host processor external to the nonvolatile memory, the private key stored in the internal storage of the nonvolatile memory and used to authorize a memory command to access data stored within the nonvolatile memory; and
a flash range in a nonvolatile memory array to store the data, wherein use of the private key also allows the nonvolatile memory to internally generate signatures for the data stored in the flash range to internally authenticate the data accessed by the authorized memory command, the internally authenticated data stored in the flash range and the signatures used to authenticate the data stored in the flash range capable of being passed from the nonvolatile memory to the host processor and to an external application.
2. The nonvolatile memory device of claim 1 further including:
a cryptographic block to provide cryptographic protocols or encryption protocols to perform security related functions.
3. A method comprising:
invoking a command by an external processor to a nonvolatile memory for the nonvolatile memory to internally sign data stored in a specific range of a nonvolatile memory array included in the nonvolatile memory;
reading a protected internal private key in the nonvolatile memory that is not accessible to the external processor;
signing the data using the protected internal private key stored in the specific range to authorize the command;
authenticating the data stored in the specific range of the nonvolatile memory array using the protected internal private key, the internal protected key to allow the nonvolatile memory to internally generate signatures for the data stored within the specific range of the nonvolatile memory array, the internally generated signatures capable of being transferred to or synchronized with external applications or the external processor: and
passing the authenticated data stored in the specific range of the nonvolatile memory array from the nonvolatile memory to the external processor and to an external application.
4. The method of claim 3 further comprising:
reading the authenticated data stored in the specific range of the nonvolatile memory array.
5. A method comprising:
invoking a command by an external processor to a nonvolatile memory for the nonvolatile memory to internally sign data stored within a range of a nonvolatile memory array, wherein a private key stored by the nonvolatile memory and not accessible to the external processor is used by the nonvolatile memory to internally sign the data stored within the range of the nonvolatile memory array and authorize the command; and
receiving the signed data and the signature used to sign the data from the nonvolatile memory; and
routing the signature and the signed data from the external processor to an external application;
passing the authenticated data stored in the specific range of the nonvolatile memory array from the nonvolatile memory to the external processor and to an external application.
6. A method of signing data by a nonvolatile memory, comprising:
receiving a command by the nonvolatile memory to internally sign data stored in a range of a nonvolatile memory array;
reading a protected private key stored in the nonvolatile memory that is not accessible to a processor external to the nonvolatile memory ;
using the protected private key to authorize the command;
signing the data stored in the range of the nonvolatile memory array using the protected private key to authenticate the data stored in the range of the nonvolatile memory array;
reading authenticated data from the range of the nonvolatile memory array;
passing the authenticated data read from the range of the nonvolatile memory array and the signature used to authenticate the data to the processor external to the nonvolatile memory; and
passing the authenticated data read from the range of the nonvolatile memory array and the signature used to authenticate the data to an external application.