Switch to control communication between a memory and a secret generator in a memory device
A device to secure data storage may include circuitry that switches a communication circuit to a memory from a derived secret generator based on an access command.
1. A switch comprising:
a first terminal to first access lines to a memory included in a memory device, the memory configured to hold a device secret for the memory device;
a second terminal to second access lines to a derived secret generator that is part of the memory device, the derived secret generator configured to create a derived secret using the device secret and other data stored in the memory device as input, wherein the memory, the switch, and the derived secret generator are on a single die that further includes a portion of a storage area of the memory device, the storage area configured to hold user data; and
switch circuitry configured to:
close a circuit, based on an access command, to connect the first access lines to the second access lines to enable only the derived secret generator to directly access the memory and get the device secret stored on the memory, the access command putting the memory device into an exclusive mode enabling only a single operation to run on the memory device, wherein the memory device includes a bus to communicate the derived secret from the derived secret generator to an entity external to the memory device; and
open the circuit to disconnect the first access lines from the second access lines based on another command to disallow access to the device secret by the derived secret generator.
2. The switch of claim 1 , wherein the memory device includes a data storage area, wherein at least a part of the data storage area is implemented with NOR flash devices.
3. The switch of claim 2 , wherein a second part of the data storage area is implemented with NAND flash devices.
4. The switch of claim 2 , wherein a second part of the data storage area is implemented with dynamic random access memory (DRAM) devices.
5. The switch of claim 2 , wherein a second part of the data storage area is implemented with at least one of ferroelectric random access memory (FeRAM), magnetoresistive RAM (MRMAM), or phase-change RAM (PCRAM).
6. The switch of claim 2 , wherein the bus is a memory bus used by the memory device to communicate data from the data storage area in response to requests by the entity external to the memory device.
7. The switch of claim 1 , wherein the device secret is unchangeable.
8. The switch of claim 7 , wherein the memory is a read-only-memory (ROM).
9. The switch of claim 7 , wherein the memory is a set of fuses or antifuses.
10. The switch of claim 1 , wherein the single operation is to create the derived secret by the derived secret generator.
11. The switch of claim 10 , wherein the memory device is configured to create the derived secret by the derived secret generator upon startup.
12. The switch of claim 1 , wherein the derived secret generator is configured to perform a hash on the device secret and data in the storage area of the memory device to create the derived secret.
13. The switch of claim 12 , wherein the derived secret is used to verify that the data is unchanged.
14. The switch of claim 12 , wherein the hash is a hash message authentication code (HMAC).
15. The switch of claim 14 , wherein the HMAC is a SHA-256 digest.
16. The switch of claim 12 , wherein the data in the storage area is boot code for the memory device.
17. The switch of claim 16 , wherein the derived secret is used to verify that the boot code is authorized.