Static information storage and retrieval – Floating gate – Data security
Reexamination Certificate
2002-03-07
2004-05-04
Nguyen, Viet Q. (Department: 2818)
Static information storage and retrieval
Floating gate
Data security
C365S185290, C365S189011, C365S218000
Reexamination Certificate
active
06731536
ABSTRACT:
FIELD OF THE INVENTION
This invention relates to a method and means for protecting Flash memory data.
BACKGROUND OF THE INVENTION
As virtually every sector of technology moves toward microprocessor controlled functionality, the need for effective protection of code controlling the microprocessor becomes increasingly important. Flash memory devices are common prey for hackers wishing to circumvent or control the code by making changes thereto or by replacing the Flash memory. Protection systems, therefore, have been devised to prevent the code from being erased or altered. Flash memory is also susceptible to damage caused by unintentional and intentional signals received by the memory. Some methods of protecting data stored in Flash memories are designed to prevent unintended changes due to electrical noise, or software program errors. These methods rely on electrical noise filters or complex sequences of software commands, that are an unlikely result of random or unintended electrical or software activity. Some protection methods even prevent intentional software controlled changes such as an attack by a virus program intended to damage stored data.
One commonly used method to prevent changes to the code on the Flash is to require a high voltage signal, e.g., 12 V to be applied to a pin on the Flash memory. Such a method assumes a lack of physical access to the flash device that would allow changing the electrical signals connected to the Flash memory. One or more signal inputs of the Flash are required to be at certain voltage levels in order to enable changes to the Flash data Without a physical change to the signal connections, the required voltage is not available. However, if physical access is possible, the appropriate voltage can be applied and any protection overridden. Furthermore, such hardware controlled methods of preventing unauthorized changes of information stored in a Flash memory have the drawback that there is no way to control, by means of software, the signal inputs of the Flash which enable changes to the data protection circuit. Furthermore, while this protection method provides protection against hackers who have no physical access to the chip, it does not help in situations where the unauthorized person has physical access to the chips. For example, in the automotive industry the motor vehicle speed regulator chips are physically available to the owner. Thus, performance control parameters can readily be altered, thereby exposing the vehicle, the vehicle engine, and the driver to speeds and forces not contemplated or intended by the motor vehicle manufacturer. Illegal car tuning is something that is a serious concern in the automotive industry. Tuners typically charge in the vicinity of $1,000 for modifications that cost them no more than $5.00 to implement. The damage that is caused by these illegal changes is, however, very high, resulting in anything from blown engines, destroyed gear boxes, to killed people.
The prior art approach has further drawbacks insofar as 12 V signals are often not available in a system. It, therefore, makes it difficult to perform authorized changes to the chip.
Another traditional method of indicating which portions or sectors of data within the Flash memory are to be protected, makes use of non-volatile memory bits. These may only be programmed and erased a limited number of times, typically 100 to a few hundred cycles. Thus, the protection state of sectors must remain fairly static, software cannot simply turn protection on and off on a frequent basis during system operation in order to have residual benefit of added protection from unintended changes along with ease of access when changes are needed.
Another traditional protection method is to use boot code that verifies an expected check sum of the data in the Flash in order to detect any illegal alterations of parameters. This software managed protection may require one or more password codes to be presented in order to change the Flash. However, since this protection is all implemented in software, and the algorithm is placed in the Flash, the code can be read. Thus, the algorithm and the passwords can be determined.
The present invention seeks to address some of the drawbacks in the prior art solutions.
SUMMARY OF THE INVENTION
The invention provides two levels of protection for each sector of data, a persistent level, and a dynamic level. The persistent level of protection uses traditional non-volatile control memory bits in conjunction with the optional requirement for a password in order to change the state of the persistent protection bits. The dynamic level, on the other hand, is implemented with logic flip-flops that define register bits, which can be changed an unlimited number of times. This allows the software to turn on and off data protection as frequently as desired for those sectors that do not require persistent non-volatile protection.
According to the invention, there is provided a method of protecting Flash memory against alterations, comprising providing different degrees of protection including persistently locking a sector for preventing modification of the sector, and dynamically locking a sector which prevents modification of the sector without first resetting a protection bit.
A sector may also be left in an unlocked state, which allows the contents to be changed at will.
In order to persistently lock a sector, a persistent protection bit (PPB) is assigned in non-volatile.
In order to dynamically lock a sector, a dynamic protection bit (DPB) is assigned in a volatile memory. This volatile memory may take the form of flip-flops. Thus, the DPBs are individually modifiable through a write command. Also, after a power-up or a hardware reset all DPBs arc reset.
A further level of protection can be applied to the persistent locking of the sectors, by making use of a PPB lock bit in volatile memory, which, when set, prevents the states of the PPBs being changed. Thus, changing the PPBs can only be achieved once the PPB lock bit is cleared.
Another level of protection can be achieved by holding a write protect pin low. This prevents certain sectors, e.g., the two outermost 8 kbyte sectors being changed. Thus, by maintaining boot code in these outermost sectors and holding the write protect (WP) pin low, boot code cannot be modified to interfere with the persistent sector protection settings defined at system initialization.
Yet a further level of protection is provided by including a password mode, requiring that a password, e.g., a 64-bit password, be entered in order to clear the PPB lock bit. The password may be fixed or may change from time to time. For example, a cyclic redundancy check (CRC), pseudo random number generator, or hamming code could be adopted to define a dynamic password algorithm to produce the next valid password. When password mode is selected, the PPB lock bit is preferably in the active state when the device is first powered on or comes out of a reset cycle so that the persistent protection bits may only be changed after a valid password is provided. If the password is fixed, it is stored in a one time programmable or permanently lockable region of the Flash memory.
In order to select password mode, a password mode locking bit is assigned which permanently sets the Flash memory in password mode. Similarly a non-password mode locking bit is assigned which, once set, permanently prevents password mode being entered. Typically, both mode locking bits are in a cleared state, ready for setting by the OEM or end-user when the device is shipped from the manufacturer.
Once the password mode is locked the ability to change or read the password is disabled. In order to obstruct attempts at deriving the password by writing a program to sequentially try every permutation of the password, a time delay may be introduced, e.g., 2 microseconds between each attempt to clear the PPB lock bit. Instead, only a limited number of successive PPB lock bit clear commands may be permitted. Yet another alternative is to require a new power cycle betwee
McClain Mark Alan
Muenster Ralf
Tanaka Michael Garrett
Advanced Micro Devices , Inc.
Nguyen Viet Q.
LandOfFree
Password and dynamic protection of flash memory data does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Password and dynamic protection of flash memory data, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Password and dynamic protection of flash memory data will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3229302