Enabling a secure boot from non-volatile memory
A system may include a host that may include a processor coupled to a non-volatile memory over a secure communication protocol. As a result, prior to release for manufacturing, a binding code may be established between the host and the non-volatile memory. In some embodiments, this binding code may be stored on the non-volatile memory and not on the host. Then during a boot up of the system, the boot up process may be initiated by the host using code associated with the host, followed by secure booting using the secure protocol using code stored on the non-volatile memory.
1. A method comprising:
transmitting, via a host, a bind command to a non-volatile memory;
accessing, via the host, a response from the non-volatile memory to the bind command and extracting a secret key;
configuring, with a controller of the host, binding code to enable encrypted communications between the host and a non-volatile memory including encrypting the binding code with the host using the secret key, wherein the binding code is configured to be executed by the host; and
storing the encrypted binding code in binding code storage of the non-volatile memory, the binding code storage configured to store the binding code.
2. The method of claim 1 , wherein transmitting, via the host, the bind command to the non-volatile memory includes transmitting one or more parameters indicative of a key type.
3. The method of claim 2 , wherein the one or more parameters include at least one of X, g, or n in a Diffie-Hellman key exchange algorithm.
4. The method of claim 1 , further comprising:
storing a first boot code on the non-volatile memory;
enabling a second boot code on the host to initiate a booting process and transferring the booting process to the first boot code stored on the non-volatile memory.
5. The method of claim 4 , further comprising executing the binding code to facilitate transfer of the first boot code from the non-volatile memory to the host.
6. The method of claim 4 , further comprising:
reading the binding code stored in the non-volatile memory with the second boot code;
decrypting the binding code with the host; and
storing the binding code on the host.
7. An apparatus comprising:
a host having a volatile memory configured to store a secret key, the secret key extracted from a response to a bind command;
a binding code storage configured to store binding code, wherein the binding code includes code executable by the host to establish encrypted communication with a non-volatile memory, wherein the encrypted communication is established using the secret key to encrypt the binding code at the host;
a boot code storage configured to store boot code; and
a controller coupled to the boot code storage and binding code storage, the controller configured to provide the boot code to the host via the encrypted communications and to provide the binding code to the host.
8. The apparatus of claim 7 , wherein the non-volatile memory comprises an execute-in-place memory.
9. The apparatus of claim 7 , wherein the host is configured to establish the encrypted communication via a Diffie-Hellman key exchange algorithm.
10. The apparatus of claim 7 , wherein the controller is further configured to provide the binding code to the host responsive, at least in part, to a request for the binding code from the host.
11. The apparatus of claim 10 , wherein the request for the binding code from the host is initiated by a second boot code executed on the host.
12. The apparatus of claim 7 , wherein the boot code is configured to boot the host.
13. The apparatus of claim 7 , wherein the non-volatile memory comprises flash memory.
14. A system comprising:
a host configured to generate a bind command; and
a non-volatile memory coupled to the host and including a controller, the controller configured to receive the bind command and generate a response to the bind command and provide the response to the host, the host configured to extract a secret key from the response to the bind command,
wherein the host is further configured to configure binding code based, at least in part, on the response and provide the binding code to binding code storage of the non-volatile memory wherein the binding code establishes encrypted communication between the non-volatile memory and the host when the binding code is executed by the host using the secret key.
15. The system of claim 14 , wherein the host is further configured to generate one or more parameters indicative of a key type.
16. The system of claim 14 , wherein the host is further configured to generate an identification tag for the host to identify a key in the future.
17. The system of claim 14 , wherein the host is further configured to generate the bind command responsive to executing a first boot code on the host.
18. The system of claim 17 , wherein the non-volatile memory is further configured to store a second boot code for the host, and the host is further configured to execute the second boot code responsive, at least in part, to establishment of the encrypted communication between the non-volatile memory and the host.