IP Library Granted Patent US 10,956,576
Granted Patent B2
US 10,956,576 · App. 16/123,084 · Granted Mar 23, 2021

Secure boot via system and power management microcontroller

Inventors: Robert W. Strong (Folsom, CA); Dustin J. Carter (Placerville, CA); Neil Levine (Davis, CA)
Assignee: Micron Technology, Inc.
G06F21/575G06F1/26G06F8/60G06F9/30003G06F9/441H04L9/3249
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,956,576
App. No.
16/123,084
Granted
Mar 23, 2021
Kind
B2
Abstract

A variety of applications can include apparatus and/or methods of controlling a secure boot mode for a memory system. In an embodiment, a system includes a memory component and a processing device, where the processing device is configured to control a boot process for the system to operate the memory component and perform a cryptographic verification with a host to conduct an authentication of the host. The processing device can interact with the host, in response to the authentication, to receive a setting to control the boot process in a secure boot mode. The processing can interact with another processing device of the system to store the setting and to receive a secure boot signal from the other processing device, where the secure boot signal is a signal to assert or de-assert the secure boot mode depending on a value of the setting. Additional apparatus, systems, and methods are disclosed.

Claims (44)

1. A memory system comprising:

a memory component; and

a memory controller that comprises a first processing device, the first processing device coupled to the memory component and configured to perform operations comprising:

performing a cryptographic verification with a host to conduct an authentication of the host; and

after the authentication is successful:

interacting with the host to receive a setting to control a boot process for the memory system in a secure boot mode, the interacting with the host to receive the setting comprising receiving, from the host, a one or more specific commands, the one or more specific commands comprising a first command to get a state of the secure boot mode and a second command to set the state of the secure boot mode;

in response to receiving at least one specific command from the one or more specific commands, interacting with a second processing device of a microcontroller to store the setting, the microcontroller comprising firmware having instructions that causes the second processing device to interact with the host through the memory controller in response to transitioning to a secure boot enabled state; and

receiving, from the second processing device, a secure boot signal to at least one of assert or de-assert the secure boot mode, the second processing device generating the secure boot signal based on a value of the setting.

2. The memory system of claim 1 , wherein the cryptographic verification comprises a Rivest-Shamir-Adleman signature verification.

3. The memory system of claim 1 , wherein the first processing device, in response to receiving the secure boot signal to de-assert the secure boot mode, interacts with the host to allow download of firmware to execute instructions as a secondary boot loader.

4. The memory system of claim 1 , wherein power to the first processing device is controlled by the second processing device.

5. The memory system of claim 1 , wherein the cryptographic verification comprising a cryptographically secure authentication protocol that uses of a digital signature.

6. The memory system of claim 1 , wherein the setting is stored in a non-volatile memory in the microcontroller.

7. The memory system of claim 1 , wherein the microcontroller comprises an output pin to send the secure boot signal to the memory controller and the memory controller comprises an input pin to receive the secure boot signal.

8. A memory system comprising;

a memory component;

a memory controller, coupled to the memory component, configured to control a boot process for the memory system to operate the memory component;

a microcontroller coupled to the memory controller, the microcontroller comprising firmware having instructions to interact with a host through the memory controller in response to transitioning to a secure boot enabled state;

a non-volatile memory storing a secondary boot loader, the secondary boot loader operated following operation of a primary boot loader in the boot process; and

memory controller firmware having stored instructions, executable by the memory controller, to cause the memory controller to perform operations comprising:

performing a cryptographic verification with the host to conduct an authentication of the host; and

after the authentication is successful:

interacting with the host to receive a setting to control the boot process in a secure boot mode, the interacting with the host to receive the setting comprising receiving, from the host, a one or more specific commands, the one or more specific commands comprising a first command to get a state of the secure boot mode and a second command to set the state of the secure boot mode;

in response to receiving one or more specific command from the one or more specific commands, interacting with the microcontroller to store the setting in the microcontroller; and

receiving, from the microcontroller, a secure boot signal to at least one of assert or de-assert the secure boot mode, the microcontroller generating the secure boot signal based on a value of the setting.

9. The memory system of claim 8 , wherein the setting for the secure boot mode is stored in the non-volatile memory in the microcontroller.

10. The memory system of claim 9 , wherein the non-volatile memory is a ferroelectric random access memory.

11. The memory system of claim 8 , wherein the microcontroller comprises an output pin to send the secure boot signal to the memory controller and the memory controller comprises an input pin to receive the secure boot signal.

12. The memory system of claim 8 , further comprising a bus coupling the microcontroller and the memory controller, and enabling interactions between the microcontroller and the memory controller.

13. The memory system of claim 8 , wherein the cryptographic verification comprising a cryptographically secure authentication protocol that uses of a digital signature.

14. The memory system of claim 9 , wherein the microcontroller controls power to the memory component, the memory controller, and the non-volatile memory.

15. A method comprising:

performing, in a memory controller of a memory system, a cryptographic verification between the memory controller and a host to conduct an authentication of the host; and

after the authentication is successful:

the memory controller interacting with the host to receive a setting to control a boot process in a secure boot mode, the interacting with the host to receive the setting comprising receiving, from the host, a one or more specific commands, the one or more specific commands comprising a first command to get a state of the secure boot mode and a second command to set the state of the secure boot mode;

in response to receiving one or more specific command from the one or more specific commands, the memory controller storing the setting in a microcontroller of the memory system, the microcontroller comprising firmware having instructions to interact with the host through the memory controller in response to transitioning to a secure boot enabled state, the setting being a setting for a secure boot mode for the memory controller to control the boot process; and

receiving, in the memory controller, a secure boot signal from the microcontroller, the secure boot signal to at least one of assert or de-assert the secure boot mode, the microcontroller generating the secure boot signal based on a value of the setting.

16. The method of claim 15 , further comprising de-asserting the secure boot mode, in response to a successful cryptographic verification with a host, to allow download of firmware to execute instructions as a secondary boot loader.

17. The method of claim 15 , further comprising, in response to transitioning to a secure deployed state, provisioning the microcontroller with an enabled secure boot mode setting via the one or more specific commands.

18. The method of claim 15 , wherein the cryptographic verification comprising a cryptographically secure authentication protocol that uses a digital signature.

19. The method of claim 15 , further comprising:

directly loading a firmware image, via the host, into a random access memory coupled to the memory controller, in response to satisfaction of an authentication protocol performed between the memory controller and the host; and

executing instructions of the firmware image with the memory controller in the secure boot mode.

20. The method of claim 15 , wherein performing the cryptographic verification comprises using a Rivest-Shamir-Adleman signature verification.

Assignments (5)
RELEASE OF SECURITY INTEREST Recorded Nov 14, 2019
From: JPMORGAN CHASE BANK, N.A., AS COLLATERAL AGENT
To: MICRON TECHNOLOGY, INC.
Reel/Frame 051028/0835 →
RELEASE OF SECURITY INTEREST Recorded Oct 14, 2019
From: MORGAN STANLEY SENIOR FUNDING, INC., AS COLLATERAL AGENT
To: MICRON TECHNOLOGY, INC.
Reel/Frame 050719/0550 →
SUPPLEMENT NO. 1 TO PATENT SECURITY AGREEMENT Recorded Nov 13, 2018
From: MICRON TECHNOLOGY, INC.
To: JPMORGAN CHASE BANK, N.A.., AS COLLATERAL AGENT
Reel/Frame 047630/0756 →
SUPPLEMENT NO. 10 TO PATENT SECURITY AGREEMENT Recorded Nov 13, 2018
From: MICRON TECHNOLOGY, INC.
To: MORGAN STANLEY SENIOR FUNDING, INC., AS COLLATERAL AGENT
Reel/Frame 048102/0420 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Sep 6, 2018
From: STRONG, ROBERT W.; CARTER, DUSTIN J.; LEVINE, NEIL
To: MICRON TECHNOLOGY, INC.
Reel/Frame 046799/0963 →