Secure boot via system and power management microcontroller
A variety of applications can include apparatus and/or methods of controlling a secure boot mode for a memory system. In an embodiment, a system includes a memory component and a processing device, where the processing device is configured to control a boot process for the system to operate the memory component and perform a cryptographic verification with a host to conduct an authentication of the host. The processing device can interact with the host, in response to the authentication, to receive a setting to control the boot process in a secure boot mode. The processing can interact with another processing device of the system to store the setting and to receive a secure boot signal from the other processing device, where the secure boot signal is a signal to assert or de-assert the secure boot mode depending on a value of the setting. Additional apparatus, systems, and methods are disclosed.
1. A memory sub-system comprising:
a memory component; and
a memory sub-system controller coupled to the memory component and configured to perform operations comprising:
after successful authentication of a host system:
receiving, from the host system, a command to set a state of a secure boot mode of the memory sub-system;
in response to the command, interacting with a microcontroller to store a setting on the microcontroller, the microcontroller being configured to at least one of assert or de-assert a secure boot signal to the memory sub-system controller based on a value of the stored setting;
in response to the secure boot signal being asserted by the microcontroller, causing the memory sub-system to transition to the secure boot mode; and
in response to the secure boot signal being de-asserted by the microcontroller, interacting with the host system to allow the memory sub-system controller to download firmware from the host system, the firmware being configured to execute instructions as a secondary boot loader on the memory sub-system controller.
2. The memory sub-system of claim 1 , wherein the microcontroller controls power to the memory sub-system controller.
3. The memory sub-system of claim 1 , wherein the stored setting is stored in a non-volatile memory of the microcontroller.
4. The memory sub-system of claim 1 , wherein the microcontroller comprises an output pin to send the secure boot signal to the memory sub-system controller and the memory sub-system controller comprises an input pin to receive the secure boot signal.
5. The memory sub-system of claim 1 , wherein the successful authentication comprises performing cryptographic verification of the host system, the cryptographic verification comprising a Rivest-Shamir-Adleman signature verification.
6. The memory sub-system of claim 1 , wherein the successful authentication comprises performing cryptographic verification of the host system, the cryptographic verification comprising a cryptographically secure authentication protocol that uses of a digital signature.
7. The memory sub-system of claim 1 , wherein interacting with the host system to allow the memory sub-system controller to download the firmware from the host system comprises:
loading a firmware image, by the memory sub-system controller via the host system, into a random access memory coupled to the memory sub-system controller; and
executing instructions of the firmware image by the memory sub-system controller.
8. The memory sub-system of claim 1 , wherein the microcontroller controls power to the memory sub-system controller.
9. A memory sub-system comprising;
a memory component;
a memory sub-system controller coupled to the memory component;
a microcontroller coupled to the memory sub-system controller, the memory sub-system controller being configured to perform operations comprising:
after successful authentication of a host system:
receiving, from the host system, a command to set a state of a secure boot mode of the memory sub-system;
in response to the command, interacting with the microcontroller to store a setting on the microcontroller, the microcontroller being configured to assert or de-assert a secure boot signal to the memory sub-system controller, the secure boot signal being asserted or de-asserted based on a value of the stored setting;
in response to the secure boot signal being asserted by the microcontroller, causing the memory sub-system to transition to the secure boot mode; and
in response to the secure boot signal being de-asserted by the microcontroller, interacting with the host system to allow the memory sub-system controller to download firmware from the host system, the firmware being configured to execute instructions as a secondary boot loader on the memory sub-system controller.
10. The memory sub-system of claim 9 , wherein the stored setting for the secure boot mode is stored in non-volatile memory of the microcontroller.
11. The memory sub-system of claim 10 , wherein the non-volatile memory is a ferroelectric random access memory.
12. The memory sub-system of claim 9 , wherein the microcontroller comprises an output pin to send the secure boot signal to the memory sub-system controller and the memory sub-system controller comprises an input pin to receive the secure boot signal.
13. The memory sub-system of claim 9 , further comprising a bus coupling the microcontroller and the memory sub-system controller, the bus enabling interactions between the microcontroller and the memory sub-system controller.
14. The memory sub-system of claim 9 , wherein the microcontroller controls power to the memory sub-system controller.
15. A method comprising:
after successful authentication of a host system by a memory sub-system controller of a memory sub-system:
receiving, at the memory sub-system controller from the host system, a command to set a state of a secure boot mode of the memory sub-system;
in response to the command, interacting with a microcontroller to store a setting on the microcontroller, the microcontroller being configured to cause the microcontroller to assert or de-assert a secure boot signal to the memory sub-system controller, the secure boot signal being asserted or de-asserted based on a value of the stored setting; and
in response to the secure boot signal being de-asserted by the microcontroller, interacting, by the memory sub-system controller, with the host system to allow the memory sub-system controller to download firmware from the host system, the firmware being configured to execute instructions as a secondary boot loader on the memory sub-system controller.
16. The method of claim 15 , further comprising:
in response to the secure boot signal being asserted by the microcontroller, causing, by the memory sub-system controller, the memory sub-system to transition to the secure boot mode.
17. The method of claim 15 , wherein interacting with the host system to allow the memory sub-system controller to download the firmware from the host system comprises:
loading a firmware image, by the memory sub-system controller via the host system, into a random access memory coupled to the memory sub-system controller; and
executing instructions of the firmware image by the memory sub-system controller.
18. The method of claim 15 , wherein the successful authentication comprises performing cryptographic verification of the host system, the cryptographic verification comprising a Rivest-Shamir-Adleman signature verification.
19. The method of claim 15 , wherein the successful authentication comprises performing cryptographic verification of the host system, the cryptographic verification comprising a cryptographically secure authentication protocol that uses of a digital signature.
20. The method of claim 15 , wherein the microcontroller controls power to the memory sub-system controller.