Nonvolatile memory data security
Keys are generated at a memory device with a period of time elapsing between generation of each key. A request is received from a memory controller for the most recently generated key. The memory device communicates the first key to the memory controller. Access to nonvolatile memory on the memory device is locked. An unlock command with a second key is received from the memory controller. The memory device determines that the second key matches the first key and unlocks access to the nonvolatile memory in response.
1. A method for securing nonvolatile memory data on a memory device, the method comprising:
generating, by the memory device, a plurality of keys, a period of time elapsing between generation of each key;
receiving, by the memory device while access to the nonvolatile memory is unlocked, a request from a memory controller for a first key, the first key is a most recently generated key from the plurality of keys;
communicating, by the memory device and in response to receiving the request while access to the nonvolatile memory is unlocked, the first key to the memory controller;
locking, by the memory device and after the communicating the first key to the memory controller, access to nonvolatile memory on the memory device;
receiving, at the memory device, an unlock command with a second key from the memory controller;
determining, by the memory device, the second key matches the first key; and
unlocking, by the memory device, access to the nonvolatile memory in response to the determining the second key matches the first key.
2. The method of claim 1 , wherein the locking access to the nonvolatile memory occurs in response to the memory device being powered on from a powered off state.
3. The method of claim 1 , further comprising:
requesting, by the memory device, revalidation of the memory controller;
locking, by the memory device, access to the nonvolatile memory in response to the requesting revalidation;
receiving, by the memory device, a third key from the memory controller in response to the requesting revalidation of the memory controller;
determining, by the memory device, the third key matches the first key; and
unlocking, by the memory device, access to the nonvolatile memory in response to the determining the third key matches the first key.
4. The method of claim 1 , wherein the keys are generated using a pseudo-random binary sequence polynomial.
5. The method of claim 1 , further comprising:
initiating, by the memory device, a timer, wherein the timer triggers the generating the plurality of keys.
6. The method of claim 5 , further comprising:
receiving, by the memory device, a key update enable command, wherein the initiating the timer occurs in response to the receiving the key update enable command.
7. The method of claim 1 , further comprising
generating, by the memory device and after the unlocking access to the nonvolatile memory in response to the determining the second key matches the first key, a second plurality of keys, a third key is a most recent generated key from the second plurality of keys;
storing, by the memory device, the first key in an old key storage;
locking, by the memory device, access to the nonvolatile memory after the generating the second plurality of keys;
receiving, by the memory device, a second unlock command with the second key;
determining, by the memory device, the second key does not match the third key;
determining, by the memory device, the second key matches the first key in the old key storage; and
unlocking, by the memory device, access to the nonvolatile memory in response to the determining the second key matches the first key in the old key storage.
8. The method of claim 7 , further comprising:
communicating, by the memory device an alert, the alert indicating the nonvolatile memory was unlocked using an old key.
9. The method of claim 1 , further comprising:
generating, by the memory device, after the unlocking access to the nonvolatile memory in response to the determining the second key matches the first key, a second plurality of keys at the memory device, a third key is a most recent generated key from the second plurality of keys;
storing, by the memory device, the first key in an old key storage;
locking, by the memory device, access to the nonvolatile memory after the generating the second plurality of keys;
receiving, by the memory device, a second unlock command with a fourth key;
determining, by the memory device, the fourth key does not match the third key;
increasing, by the memory device, a fail counter in response to the determining the fourth key does not match the third key;
determining, by the memory device, the fail counter has reached a threshold value; and
permanently locking, by the memory device, access to the nonvolatile memory in response to the determining the fail counter has reached a threshold value.
10. The method of claim 1 , wherein the second key is not encrypted when received from the memory controller.
11. The method of claim 1 , wherein locking access to the nonvolatile memory comprises configuring a gate to block read and write commands from being communicated to the nonvolatile memory.
12. The method of claim 6 , further comprising:
receiving a key update disable command from the memory controller; and
stopping the generation of new keys in response to receiving the key update disable command.