Enabling a secure boot from non-volatile memory
View Patent ↗A system may include a host that may include a processor coupled to a non-volatile memory over a secure communication protocol. As a result, prior to release for manufacturing, a binding code may be established between the host and the non-volatile memory. In some embodiments, this binding code may be stored on the non-volatile memory and not on the host. Then during a boot up of the system, the boot up process may be initiated by the host using code associated with the host, followed by secure booting using the secure protocol using code stored on the non-volatile memory.
1. A method comprising: generating, using a controller of a hose, a bind command and one or more parameters indicative of a key type and including an identification tag; providing the bind command and the one or more parameters to a non-volatile memory, the non-volatile memory comprising an execute-in-place memory; receiving, at the controller of the host, a response associated with the bind command from a controller of the non-volatile memory; enabling secure communications between the host and the non-volatile memory based, at least in part, on the response; configuring, using the controller of the host, binding code to enable encrypted communications between the host and the non-volatile memory including encrypting the binding code with the host, wherein the binding code is configured to be executed by the host; and storing the encrypted binding code in binding code storage of the non-volatile memory, the binding code storage dedicated to storing the binding code.
2. The method of claim 1 , wherein the one or more parameters correspond to a Diffie-Hellman key exchange algorithm.
3. The method of claim 1 , further including storing a boot code on the non-volatile memory.
4. The method of claim 3 , wherein the boot code is a first boot code, the method further including enabling a second boot code on the host to initiate a boot and transferring the booting process to the first boot code stored on the non-volatile memory.
5. The method of claim 4 , further including executing the binding code to facilitate transfer of the first boot code from the non-volatile memory to the host.
6. A non-volatile memory, comprising: a binding code storage configured to store binding code; a boot code storage separate from the binding code storage and configured to store boot code; a controller coupled to each of the binding code storage and the boot code storage and configured to provide the binding code; wherein the binding code comprises code executable by a host to establish a encrypted communication protocol with the non-volatile memory and wherein the controller is further configured to provide the boot code in accordance with the secure communication protocol.
7. The non-volatile memory of claim 6 , wherein the non-volatile memory comprises an execute-in-place memory.
8. The non-volatile memory of claim 6 , wherein the non-volatile, memory comprises flash memory.
9. The non-volatile memory of claim 6 , further comprising a boot code storage configured to store boot code for booting, at least in part, a host.
10. The non-volatile memory of claim 9 , wherein the controller is further configured to enable the boot code to be executed in place within the memory using the secure communication protocol.
11. The non-volatile memory of claim 6 , wherein the binding code comprises a Diffie-Hellman key exchange algorithm.
12. A system comprising: a host configured to generate a bind command; a non-volatile memory coupled to the host and including a controller, the controller configured to receive the bind command and one or more parameters indicative of a key type and including an identification tag and generate a response to the bind command including a parameter for enabling an encrypted communication protocol, the controller further configured to provide the response to the host, wherein the host is further configured to configure binding code based, at least in part, on the response and provide the binding code to binding code storage of the non-volatile memory dedicated to storing the binding code and wherein the binding code includes code for establishing the encrypted communication protocol between the non-volatile memory and the host, wherein the binding code is configured to be executed by the host, and wherein the non-volatile memory is configured to operate as an execute-in-place memory.
13. The system of claim 12 , wherein the non-volatile memory comprises flash memory.
14. The system of claim 12 , wherein the non-volatile memory is further configured to store boot code for the host, the host further configured to execute the boot code responsive, at least in part, to a secure communication protocol being established between the non-volatile memory and the host.
15. The system of claim 14 , wherein the memory enables the boot code to be executed in place within the memory by the host over the secure communication protocol.
16. The system of claim 12 , wherein the host is further configured to generate the bind command responsive to executing boot code.
17. The system of claim 12 , wherein the response comprises a key corresponding to a Diffie-Hellman key exchange algorithm.
18. The system of claim 17 , wherein the host is further configured to encrypt the key.