Transparently attached flash memory security
An apparatus includes an interface circuit and a monitor circuit communicatively coupled to the interface circuit. The monitor circuit is configured to identify a command issued to a memory communicatively coupled to the monitor circuit through the interface circuit, determine whether the command is authorized, and, based on a determination that the command is not authorized, cancel the command.
1. A method, comprising:
identifying a command issued to a memory communicatively coupled to the monitor circuit through the interface circuit;
determine whether the command is authorized; and
based on a determination that the command is not authorized, cancel the command;
wherein cancelling the command includes:
modifying a received chip select signal to yield a modified chip select signal; and
sending the modified chip select signal to the memory.
2. The method of claim 1 , wherein cancelling the command includes adding a clock pulse to a clock bus used by the memory before completion of the modified chip select signal.
3. The method of claim 2 , wherein cancelling the command further includes resetting a source of the command before the clock pulse is added to the clock bus used by the memory.
4. The method of claim 1 , wherein cancelling the command includes resetting a source of the command before completion of the modified chip select signal.
5. The method of claim 1 , wherein cancelling the command includes completing the modified chip select signal after completion of the received chip select signal.
6. The method of claim 1 , wherein cancelling the command includes completing the modified chip select signal in response to a determination that the command is a write command or an erase command.
7. The method of claim 1 , wherein cancelling the command includes completing the modified chip select signal before a later chip select signal from a source of the command is received.
8. The method of claim 1 , wherein cancelling the command includes completing the modified chip select signal before receiving a later chip select signal from the source of the command based on a determination that the command is a read command.
9. The method of claim 1 , wherein the monitor circuit is further configured to:
identify a read command issued to a memory communicatively coupled to the monitor circuit;
compare content from the memory with a trusted copy to determine whether the content from the memory and the trusted copy are identical; and
based on a determination that the content from the memory is not the same as the trusted copy, take corrective action.
10. An apparatus, comprising:
an interface circuit; and
a monitor circuit communicatively coupled to the interface circuit, the monitor circuit configured to:
identify a command issued to a memory communicatively coupled to the monitor circuit through the interface circuit;
determine whether the command is authorized;
based on a determination that the command is not authorized, cancel the command;
in order to cancel the command:
cause the monitor circuit to modify a received chip select signal to yield a modified chip select signal; and
send the modified chip select signal to the memory.
11. The apparatus of claim 10 , wherein the monitor circuit is further configured to, in order to cancel the command, add a clock pulse to a clock bus used by the memory before completion of the modified chip select signal.
12. The apparatus of claim 11 , wherein the monitor circuit is further configured to, in order to cancel the command, reset a source of the command before the clock pulse is added to the clock bus used by the memory.
13. The apparatus of claim 10 , wherein the monitor circuit is further configured to, in order to cancel the command, reset a source of the command before completion of the modified chip select signal.
14. The apparatus of claim 10 , wherein the monitor circuit is further configured to, in order to cancel the command, complete the modified chip select signal after completion of the received chip select signal.
15. The apparatus of claim 10 , wherein the monitor circuit is further configured to, in order to cancel the command, complete the modified chip select signal in response to a determination that the command is a write command or an erase command.
16. The apparatus of claim 10 , wherein the monitor circuit is further configured to, in order to cancel the command, complete the modified chip select signal before a later chip select signal from a source of the command is received.
17. The apparatus of claim 10 , wherein the monitor circuit is further configured to, in order to cancel the command, complete the modified chip select signal before receiving a later chip select signal from the source of the command based on a determination that the command is a read command.
18. The apparatus of claim 10 , wherein the monitor circuit is further configured to:
identify a read command issued to a memory communicatively coupled to the monitor circuit;
compare content from the memory with a trusted copy to determine whether the content from the memory and the trusted copy are identical; and
based on a determination that the content from the memory is not the same as the trusted copy, take corrective action.
19. The apparatus of claim 10 , wherein the monitor circuit includes:
a processor; and
a non-transitory, machine-readable medium, the medium including instructions, the instructions, when loaded and executed by the processor, cause the monitor circuit to identify the command issued to a memory communicatively coupled to the monitor circuit, determine whether the command is authorized, and cancel the command.