Memory device with cryptographic kill switch
Devices and methods for preventing unauthorized access to memory devices are disclosed. A one-time programmable (OTP) memory is included in both a memory device and a processing device. The OTP memories store encryption keys and the encryption and decryption of messages between the two devices are used as a heartbeat to determine that the memory device has not been separated from the processing device and, in some instances, connected to a malicious processing device.
1. A method comprising:
transmitting, by a memory device, an encrypted command to a processing device, the encrypted command comprising a proof-of-work requirement;
receiving, by the memory device, a response from the processing device, the response including an encrypted result of executing the encrypted command;
decrypting, by the memory device, the response to obtain a decrypted result;
detecting, by the memory device, that the decrypting failed if the decrypted result is not equal to an expected result of the encrypted command;
disabling, by the memory device, an interface in response to detecting that the decrypting failed by raising a signal causing the memory device to drive lines of the interface to zero;
detecting, by the memory device, that a second decrypting of a second response is successful;
scrubbing, by the memory device, one or more memory banks; and
lowering, by the memory device, the signal to enable access to the lines of the interface.
2. The method of claim 1 , further comprising generating the encrypted command by encrypting a plaintext command using a shared private key.
3. The method of claim 2 , the decrypting the response comprising decrypting the response using the shared private key.
4. The method of claim 1 , further comprising generating the encrypted command by encrypting a plaintext command using a public key.
5. The method of claim 4 , the decrypting the response comprising decrypting the response using a private key corresponding to the public key.
6. The method of claim 1 , the disabling the interface causing the memory device to ignore any instructions transmitted over the interface.
7. The method of claim 1 , the detecting that the decrypting failed further comprising determining whether the response is valid or invalid.
8. A device comprising:
a memory array;
control logic communicatively coupled to the memory array;
a one-time programmable (OTP) memory bank, the OTP storing at least one key; and
authentication logic the authentication logic configured to:
transmit an encrypted command to a processing device, the encrypted command comprising a proof-of-work requirement,
receive a response from the processing device, the response including an encrypted result of executing the encrypted command,
decrypt the response to obtain a decrypted result,
detect that the decrypting failed,
disable an interface of the control logic in response to detecting that the decrypting failed by raising a signal causing the memory device to drive lines of the interface to zero;
detect that a second decrypting of a second response is successful,
scrub one or more memory banks, and
lower the signal to enable access to the lines of the interface.
9. The device of claim 8 , the memory array comprising a dynamic random-access memory (DRAM) array.
10. The device of claim 8 , the interface comprising a serial interface.
11. The device of claim 8 , the at least one key comprising a shared symmetric key.
12. The device of claim 8 , the at least one key comprising a private key unique to the device, and a public key of the processing device, the private key used to decrypt the response and the public key used to encrypt the command.
13. A non-transitory computer readable storage medium for tangibly storing computer program instructions capable of being executed by a processor, the computer program instructions defining steps of:
transmitting an encrypted command to a processing device, the encrypted command comprising a proof-of-work requirement;
receiving a response from the processing device, the response including an encrypted result of executing the encrypted command;
decrypting the response to obtain a decrypted result;
detecting that the decrypting failed if the decrypted result is not equal to an expected result of the encrypted command;
disabling an interface in response to detecting that the decrypting failed by raising a signal driving lines of the interface to zero;
detecting that a second decrypting of a second response is successful;
scrubbing one or more memory banks; and
lowering the signal to enable access to the lines of the interface.
14. The non-transitory computer readable storage medium of claim 13 , the instructions further defining the step of generating the encrypted command by encrypting a plaintext command using a shared private key, wherein the decrypting the response comprising decrypting the response using the shared private key.
15. The non-transitory computer readable storage medium of claim 13 , the instructions further defining the step of generating the encrypted command by encrypting a plaintext command using a public key, wherein the decrypting the response comprising decrypting the response using a private key corresponding to the public key.
16. The non-transitory computer readable storage medium of claim 13 , the disabling the interface comprising ignoring any instructions transmitted over the interface.
17. The non-transitory computer readable storage medium of claim 13 , the detecting that the decrypting failed further comprising determining whether the response is valid or invalid.