Accelerating integrity checks of code and data stored in non-volatile memory

• US 20080005587A1
• Filed: 06/30/2006
• Published: 01/03/2008
• Est. Priority Date: 06/30/2006
• Status: Active Grant

• Current Assignee: Intel NDTM US LLC (Intel Corporation)
• Original Assignee: Intel Corporation
• Inventors: Ahlquist, Brent M.
• Granted Patent: US 7,743,239 B2
• Time in Patent Office: Days
• US Class Current: 713/190
• CPC Class Codes: G06F 12/1441 for a range
• CPC Class Codes: G06F 2212/2022 Flash memory

Abstract

In some embodiments, a command may be used by a host processor to access certain information from a non-volatile memory, together with a message authentication code. That information may be utilized to generate a message authentication code on the processor. Then, in any future accesses, the message authentication code generated by the host processor may be compared to the message authentication code from the non-volatile memory to determine the integrity of data or code that is received from the non-volatile memory.

Claims

1. A method comprising:

receiving in a host a list of protected and unprotected ranges of non-volatile memory; and

reducing the processing to determine authenticity when accessing a protected memory range of the non-volatile memory compared to when accessing an unprotected range of said memory.

2. The method of claim 1 further comprising:

authenticating data from the non-volatile memory using a host that receives information from the non-volatile memory together with a message authentication code;

calculating a message authentication code on the host; and

comparing the host generated message authentication code to the non-volatile memory generated authentication code.

3. The method of claim 1 including using a measurement done for data in the past to authenticate different data thereafter.

4. The method of claim 1 including generating access control information including information about whether particular ranges of the memory are write protected.

5. The method of claim 4 including maintaining a table of the write protection status of different memory ranges.

6. The method of claim 5 including initially providing write protection status information to a host processor.

7. The method of claim 6 including providing write protection status information only once and reusing the information thereafter.

8. The method of claim 7 including providing the access control information in response to a special command received from a host.

9. The method of claim 8 including maintaining the access control information in a limited access region within the non-volatile memory.

10. The method of claim 1 including maintaining a non-volatile memory having some regions which are write protected and other regions which are not write protected and keeping the write protection status of said regions within access control information.

11. A computer readable medium storing instructions that, when executed, enable a host processor-based system to:

receive a list of protected and unprotected ranges of non-volatile memory; and

reduce the processing to determine authenticity when accessing a protected memory range of the non-volatile memory compared to when accessing an unprotected range of said memory.

12. The medium of claim 11 further storing instructions to:

authenticate data from the non-volatile memory using information from the non-volatile memory together with a message authentication code;

calculate a message authentication code; and

compare the host generated message authentication code to the non-volatile memory generated authentication code.

13. The medium of claim 11 further storing instructions to use a previous measurement done for data in the past to authenticate different data thereafter.

14. The medium of claim 11 further storing instructions to generate access control information including information about whether particular ranges of the memory are write protected.

15. The medium of claim 14 further storing instructions to maintain a table of the write protection status of different memory ranges.

16. The medium of claim 15 further storing instructions to reuse previously provided write protection status information.

17. The medium of claim 16 further storing instructions to obtain the access control information by sending a special command to the non-volatile memory.

18. A system comprising:

a host processor;

a non-volatile memory;

a memory bus coupled between the host processor and the non-volatile memory; and

the non-volatile memory to store a list of protected and unprotected ranges within said memory, said protected ranges being protected against writes and said unprotected ranges being unprotected against writes.

19. The system of claim 18 wherein said host processor to authenticate data from the non-volatile memory using information from the non-volatile memory together with a message authentication code, calculate a method of authentication code, and compare a host generated message authentication code to a non-volatile memory generated at the authentication code.

20. The system of claim 18 wherein said non-volatile memory to store access control information including information about whether a particular range of memory is write protected.

21. The system of claim 20 wherein said access control information is maintained as a table that indicates the write protection status of different non-volatile memory ranges.

22. The system of claim 21 wherein said access control information is accessible only in response to a special command received from said host processor.

23. A non-volatile memory comprising:

a plurality of memory ranges, some of said ranges being write protected and others of said ranges not being write protected; and

access control information stored in said memory to indicate which ranges are protected and which ranges are not protected.

24. The memory of claim 23 including a control, said control storing said access control information.

25. The memory of claim 24 wherein said control is accessible by an external processor by a special command.

26. The memory of claim 23 wherein said memory is a flash memory.