Winbond Electronics Corporation

Itay Admon

Nir Tasher

Uri Kaluzhny

Mark Luko

An apparatus includes a memory, a Memory Section Attribute Storage (MSAS) and a memory access circuit (MAC). The memory includes a plurality of memory sections. The MSAS includes one or more entries, wherein at least some of the entries specify, for respective sections of the memory, respective section security policies, respective section base addresses and respective section sizes. The MAC is configured to receive, from a host, a memory access request that specifies an address to be accessed in the memory, to identify a target memory section that corresponds to the address, responsively to the section base addresses and to the section sizes specified in the MSAS, to receive, from the MSAS, a security policy that corresponds to the target memory section, and to apply the security policy to the memory access request.

Memory segmentation with substitution

A memory device includes a memory, a secure-access circuit, a plain-access circuit, and protection hardware. The memory includes at least a secure-storage partition assigned a first address range and a plain-storage partition assigned a second address range, disjoint from the first address range. The secure-access circuit is configured to access the secure-storage partition by generating addresses in the first address range. The plain-access circuit is configured to access the plain-storage partition by generating addresses in the second address range. The protection hardware is configured to prevent the plain-access circuit from accessing the first address range assigned to the secure-storage partition.

Physically secure memory partitioning

A method for Serial Peripheral Interface (SPI) operating-mode synchronization between an SPI host and an SPI device, which communicate over an SPI bus, includes predefining, in the SPI device, one or more values on the SPI bus as indicative of lack of synchronization of an SPI operating mode between the SPI host and the SPI device. Re-synchronization of the SPI operating mode is initiated in response to receiving any of the predefined values in the SPI device.

SPI bus synchronization

A memory device includes a non-volatile memory (NVM) and circuitry. The circuitry is configured to initialize and prepare the NVM for executing memory-access operations for a processor, and to ascertain that no memory-access operations are received from the processor before the NVM is ready, by preventing the processor from bootstrapping during at least part of initialization and preparation of the NVM.

Delayed reset for code execution from memory device

A secured storage system includes a non-volatile memory and a controller. The non-volatile memory is configured to store a first data item and a respective first version identifier assigned to the first data item. The controller is configured to receive a second data item accompanied by a second version identifier and a signature, for replacing the first data item in the non-volatile memory, to authenticate at least the second version identifier using the signature, to make a comparison between the stored first version identifier and the second version identifier, and to replace the first data item with the second data item only in response to verifying that (i) the second version identifier is authenticated successfully, and (ii) the second data item is more recent than the first data item, as indicated by the comparison between the stored first version identifier and the authenticated second version identifier.

Anti-rollback version upgrade in secured memory chip

A memory system includes an interface, a non-volatile memory and a controller. The interface is configured to communicate over an unsecured communication link with an external host. The non-volatile memory is pre-programmed with a device identifier and a corresponding initialization key that are additionally stored in a database that resides externally to the memory system, and is securely accessible by the host. The controller is configured to send the device identifier to the host, to receive from the host, via the interface, binding information that was generated in the host, to generate, using at least the received binding information and the pre-programmed initialization key, a first binding key that matches a second binding key that is generated in the host based on an initialization key securely obtained by the host from the database, and to securely communicate with the host over the communication link using the first binding key.

Growing community of inventors

Tel Aviv, Israel

Itay Admon