Instant hardware erase for content reset and pseudo-random number generation

• US 8,370,644 B2
• Filed: 05/30/2008
• Issued: 02/05/2013
• Est. Priority Date: 05/30/2008
• Status: Active Grant

• Current Assignee: Monterey Research, LLC (Vector Capital Corporation)
• Original Assignee: Spansion LLC (Infineon Technologies AG)
• Inventors: Handschuh, Helena, Boscher, Arnaud, Trichina, Elena, Prawitz, Nicolas, Cherpantier, Frederic, Lau, Jimmy, Le Bihan, Jol
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): BAYOU, YONAS A
• Application Number:
  US12/129,737
• Publication Number:
  US 20090300312A1
• Time in Patent Office: 1,712 Days
• Field of Search: 713/193
• US Class Current: 713/193
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: Y02D 10/00 Energy efficient computing, e.g. low power processors, power management or thermal management

Abstract

Systems and methods that facilitate securing data associated with a memory from security breaches are presented. A memory component includes nonvolatile memory, and a secure memory component (e.g., volatile memory) used to store information such as secret information related to secret processes or functions (e.g., cryptographic functions). A security component detects security-related events, such as security breaches or completion of security processes or functions, associated with the memory component and in response to a security-related event, the security component can transmit a reset signal to the secure memory component to facilitate efficiently erasing or resetting desired storage locations in the secure memory component in parallel and in a single clock cycle to facilitate data security. A random number generator component can facilitate generating random numbers after a reset based on a change in scrambler keys used by a scrambler component to descramble data read from the reset storage locations.

Claims

1. A system that facilitates securing data associated with a memory component, comprising:

at least one memory that stores computer executable components; and

at least one processor that executes the following computer executable components stored in the at least one memory;

a secure memory component comprising a plurality of storage locations in which data is stored, the secure memory component is associated with the memory component;

a security component configured to transmit a reset signal to facilitate erase or reset of a subset of the plurality of storage locations to store a defined data value and change a first scrambler key to a disparate scrambler key, in response to detecting a security-related event based in part on predetermined reset criteria, wherein the first scrambler key is changed to the disparate scrambler key after the erase or reset of the subset of the plurality of storage locations, and the subset of storage locations comprises a first storage location associated with a first memory address value and a second storage location associated with a second memory address value;

a scrambler component configured to;

receive the defined data value and the first memory address value associated with the first storage location, and the defined value and the second memory address value associated with the second storage location, and

descramble a combination of the defined data value and the first memory address value associated with the first storage location, and descramble a combination of the defined data value and the second memory address value associated with the second storage location, respectively, as a function of the disparate scrambler key, to generate a first set of descrambled data and a second set of descrambled data, respectively, to facilitate generation of a first random number and a second random number; and

a random number generation component configured to receive the first set of descrambled data and the second set of descrambled data, and generate the first random number and the second random number based in part on the first set of descrambled data, the second set of descrambled data, and predetermined random-number criteria.

2. The system of claim 1, wherein the secure memory component is further configured to receive the reset signal and propagate the reset signal to each of the subset of the plurality of storage locations at a same time or substantially the same time and the subset of the plurality of storage locations are erased or reset in a single clock cycle to remove content stored therein.

3. The system of claim 1, wherein the security-related event is at least one of a security breach or completion of at least one of a security process, a security function, or a security computation.

4. The system of claim 3, wherein the at least one of the security process, the security function, or the security computation relates to at least one of cryptography, authentication, or random number generation.

5. The system of claim 3, wherein the security breach relates to at least one of temperature level, voltage level, a voltage glitch, authentication of an entity, an attack using ultraviolet (UV) light, an attack using a laser, an attack using a white light, an attack using pressure variations, an attack using heavy ions, an attack using radio frequency (RF) energy, an attack using clock transients, an attack using power transients, variance in a resistance level of a shield, or integrity of a casing, associated with the memory component.

6. The system of claim 1, wherein the predetermined reset criteria relates to at least one of type of memory;

expected value or range of values of a security-related attribute;

type of security breach;

level of severity of the security breach;

or performance or completion of a secure process, a secure function, or a secure computation.

7. The system of claim 1, further comprising:

a sensor component configured to monitor and evaluate activity associated with the memory component to determine whether a security-related event is detected, and in response to detecting the security-related event, the sensor component is configured to automatically transmit the reset signal to the secure memory component to facilitate automatic erase or reset of the subset of the plurality of storage locations, wherein the security-related event comprises a security breach.

8. The system of claim 1, further comprising a cryptographic component configured to change the first scrambler key to the disparate scrambler key in response to detecting the security-related event.

9. The system of claim 1, wherein the security component is further configured to perform a secure computation on data to generate secure computation results data as part of a secure process and store the secure computation results data in at least one storage location of the plurality of storage locations, and, in response to a determination that the secure process is completed, transmit the reset signal to facilitate erase of the secure computation results data from the at least one storage location and to store the defined data value in the at least one storage location.

10. The system of claim 1, further comprising:

an intelligent component configured to infer an automated function to automatically perform to facilitate securing data associated with the secure memory component, wherein the automated function relates to at least one of cryptography, authentication of an entity, or random number generation, associated with the secure memory component.

11. The system of claim 1, wherein the secure memory component comprises a plurality of blocks that each contain a specified number of storage locations, and each block is associated with a block reset component and each storage location is associated with a storage reset component, wherein the secure memory component is further configured to receive the reset signal and the reset signal is propagated to at least one selected block reset component, which propagates the reset signal to each storage reset component within the at least one selected block reset component, to facilitate the erase or reset of storage locations associated with the at least one selected block reset component in a single clock cycle to remove content stored therein.

12. An electronic device comprising the system of claim 1.

13. The electronic device of claim 12, wherein the electronic device comprises at least one of a computer, a laptop computer, network equipment, a media player, a media recorder, a television, a smart card, a phone, a cellular phone, a smart phone, an electronic organizer, a personal digital assistant, a portable email reader, a digital camera, an electronic game, an electronic device associated with digital rights management, a Personal Computer Memory Card International Association (PCMCIA) card, a trusted platform module (TPM), a Hardware Security Module (HSM), a set-top box, a digital video recorder, a gaming console, a navigation device, a secure memory device with computational capabilities, a device with at least one tamper-resistant chip, an electronic device associated with an industrial control system, or an embedded computer in a machine, wherein the machine comprises one of an airplane, a copier, a motor vehicle, or a microwave oven.

14. A method that facilitates securing data associated with a memory, comprising:

employing at least one processor to facilitate execution of code instructions retained in at least one memory device, the at least one processor, in response to execution of the code instructions, performs operations comprising;

detecting a security-related event associated with the memory;

at least one of erasing or resetting a subset of storage locations in a secure memory component in response to detecting the security-related event based in part on predetermined reset criteria, wherein the subset of storage locations store sets of data of predefined values in response to the at least one of erasing or resetting the subset of storage locations, and the subset of storage locations comprises a first storage location associated with a first memory address value and storing a first set of data of predefined value, and a second storage location associated with a second memory address value and storing a second set of data of predefined value;

changing a first scrambler key to a second scrambler key, in response to detecting the security-related event;

descrambling a combination of the first memory address value and the first set of data, and a combination of the second memory address value and the second set of data, respectively, as a function of the second scrambler key, to respectively generate a first set of descrambled data and a second set of descrambled data to facilitate generating a first random number and a second random number; and

generating the first random number and the second random number based in part on the first set of descrambled data, the second set of descrambled data, and predetermined random-number criteria.

15. The method of claim 14, further comprising:

monitoring activity associated with the memory;

detecting a security breach associated with the memory;

automatically transmitting a reset signal to the subset of storage locations in the secure memory component in response to detecting the security breach; and

at least one of erasing or resetting the subset of storage locations to the predefined values in a single clock cycle.

16. The method of claim 14, further comprising:

monitoring activity associated with the memory;

determining whether a security breach is detected;

determining whether to perform the reset or erase based in part on the predetermined reset criteria;

transmitting a reset signal to the subset of storage locations in the secure memory component in response to detecting the security breach and determining the reset or erase is to be performed; and

at least one of erasing or resetting to the subset of storage locations to the predefined values in a single clock cycle.

17. The method of claim 14, further comprising:

performing at least one of a secure process, a secure function, or a secure computation using the subset of storage locations to store secure data relating to the at least one of the secure process, the secure function, or the secure computation;

determining whether the at least one of the secure process, the secure function, or the secure computation is complete;

transmitting a reset signal to the subset of storage locations in the secure memory component in response to determining that the at least one of the secure process, the secure function, or the secure computation is complete; and

at least one of erasing or resetting to the subset of storage locations to the predefined values in a single clock cycle in response to the reset signal.

18. The method of claim 14, further comprising:

scrambling one or more sets of data based in part on the first scrambler key;

storing the one or more sets of scrambled data in respective storage locations;

changing the first scrambler key to a different scrambler key;

reading the one or more sets of scrambled data from the respective storage locations;

descrambling the one or more sets of scrambled data, based in part on the different scrambler key, to generate one or more sets of descrambled data; and

generating at least one random number based in part on the one or more sets of descrambled data and the predetermined random-number criteria.

19. The method of claim 18, further comprising:

generating a distinct random number for each set of the one or more sets of descrambled data based in part on respective memory addresses respectively associated with respective storage locations in which the one or more sets of descrambled data were stored.

20. The method of claim 14, wherein the predetermined reset criteria is associated with at least one of type of memory;

expected value or range of values of a security-related attribute;

type of security breach;

level of severity of the security breach;

or performance or completion of a secure process, a secure function, or a secure computation.