Unchangeable physical unclonable function in non-volatile memory
A device which can be implemented on a single packaged integrated circuit or a multichip module comprises a plurality of non-volatile memory cells, and logic to use a physical unclonable function to produce a key and to store the key in a set of non-volatile memory cells in the plurality of non-volatile memory cells. The physical unclonable function can use entropy derived from non-volatile memory cells in the plurality of non-volatile memory cells to produce a key. Logic is described to disable changes to data in the set of non-volatile memory cells, and thereby freeze the key after it is stored in the set.
1. A circuit comprising:
a plurality of non-volatile memory cells;
logic configured to use a physical unclonable function to produce a key, to store the key in a set of non-volatile memory cells in the plurality of non-volatile memory cells, and to use the physical unclonable function to update the key when a key update protocol signals that the key needs to be updated;
logic configured to disable changes to data in the set of non-volatile memory cells after the key is stored in the set, wherein the logic configured to disable changes to data in the set of non-volatile memory cells after the key is stored in the set is configured to disable use of the physical unclonable function; and
authentication logic requiring a successful authentication protocol to enable the physical unclonable function to produce the key, wherein:
the physical unclonable function is configured to utilize entropy generated using non-volatile memory cells in the plurality of non-volatile memory cells to produce the key; or
the physical unclonable function is configured to use the set of non-volatile memory cells to produce the key.
2. The circuit of claim 1 , wherein:
the plurality of non-volatile memory cells includes an array of memory cells with peripheral circuits for access to the array, and a block of non-volatile memory cells having separate peripheral circuits allowing read-only access to the block, the block including the set of non-volatile memory cells;
the physical unclonable function is configured to utilize entropy generated using non-volatile memory cells in the block of non-volatile memory cells to produce the key; and
the logic configured to disable changes to data in the set of non-volatile memory cells is configured to disable the physical unclonable function.
3. The circuit of claim 1 , wherein:
the plurality of non-volatile memory cells includes an array of memory cells with peripheral circuits for access to the array;
the peripheral circuits have a first state in which access to the set of non-volatile memory cells to write the key is enabled, and a second state in which access to the set of non-volatile memory cells to write is disabled while access to other non-volatile memory cells in the array to write is enabled; and
the logic configured to disable changes to data in the set of non-volatile memory cells includes an indicator to set the first state or the second state.
4. The circuit of claim 1 , wherein the logic configured to disable changes to data in the set of non-volatile memory cells includes logic configured to compare data stored in the set of non-volatile memory cells with a predetermined data pattern, and to disable the physical unclonable function when the data stored does not match the predetermined data pattern.
5. The circuit of claim 1 , including:
a port for external communication of data from the plurality of non-volatile memory cells; and
security logic coupled to the plurality of non-volatile memory cells, which is configured to utilize the key in a protocol to enable access to data stored in the plurality of non-volatile memory cells.
6. The circuit of claim 5 , wherein the protocol includes a challenge/response protocol including exchange of data via the port.
7. The circuit of claim 5 , wherein the plurality of non-volatile memory cells, the port, the security logic and the logic configured to disable changes to data in the set of non-volatile memory cells are disposed on a single integrated circuit.
8. The circuit of claim 1 , wherein the plurality of non-volatile memory cells comprises a memory array having a plurality of blocks of memory cells, a particular block including the set of non-volatile memory cells, and including access control circuits including block lock bits, which are configured to enable and disable access to write data to corresponding blocks in the plurality of blocks, and the logic configured to disable changes to data in the set of non-volatile memory cells is configured to set a block lock bit for the particular block.
9. The circuit of claim 1 , wherein the logic configured to disable changes is configured to be responsive to a command from an external circuit.
10. A method for operating a circuit including a plurality of non-volatile memory cells, comprising:
executing a physical unclonable function to generate a key;
storing the key in a set of non-volatile memory cells;
using the physical unclonable function to update the key when a key update protocol signals that the key needs to be updated;
after storing the key, disabling changes to data stored in the set of non-volatile memory cells, wherein disabling changes to data stored in the set of non-volatile memory cells disables use of the physical unclonable function; and
requiring a successful authentication protocol to enable the physical unclonable function to produce the key, wherein:
the physical unclonable function utilizes entropy generated using non-volatile memory cells in the plurality of non-volatile memory cells to produce the key; or
the physical unclonable function uses the set of non-volatile memory cells to produce the key.
11. The method of claim 10 , wherein disabling changes to data stored in the set of non-volatile memory cells includes comparing data stored in the set of non-volatile memory cells with a predetermined data pattern, and disabling the physical unclonable function when the data stored does not match the predetermined data pattern.
12. The method of claim 10 , wherein:
the plurality of non-volatile memory cells includes an array of non-volatile memory cells with peripheral circuits for access to the array, and a block of non-volatile memory cells having separate peripheral circuits allowing read-only access to the block, the block including the set of non-volatile memory cells;
the physical unclonable function utilizes entropy generated using non-volatile memory cells in the block of non-volatile memory cells to produce the key; and
disabling changes to data stored in the set of non-volatile memory cells disables the physical unclonable function.
13. The method of claim 10 , wherein:
the plurality of non-volatile memory cells includes an array of non-volatile memory cells with peripheral circuits for access to the array;
the peripheral circuits have a first state in which access to the set of non-volatile memory cells to write the key is enabled, and a second state in which access to the set of non-volatile memory cells to write is disabled while access to other non-volatile memory cells in the array to write is enabled; and
disabling changes to data stored in the set of non-volatile memory cells includes storing an indicator to set the first state or the second state.
14. The method of claim 10 , including at least one of utilizing the key in a protocol to enable access to data other than the key, stored in the plurality of non-volatile memory cells; and after generating the key and before disabling changes, testing the key to verify that it is usable for its intended purpose.