Non-volatile memory read/write security protection feature selection through non-volatile memory bits

[0002] The present invention relates to security for programmable non-volatile memories (PNVM) and, in particular, to such a memory and associated circuitry equipped to handle and act upon, in a secure manner, a security status data stored within the memory itself.

[0003] Programmable non-volatile memories (e.g. electrically erasable programmable read-only memory and flash memory circuits) are well-known. In some applications, such as in control of safety functions in automobiles, security circuitry for read/write protection of the contents of PNVM circuits is commonly used. In this way, end-consumers are prevented from altering the contents of these memories and causing potentially life-threatening conditions. For example, security circuitry would commonly be used to protect the contents of an PNVM containing a program to control a vehicle's anti-lock brake system.

[0004] Conventionally, such security circuitry includes non-volatile security register circuitry, separate from the PNVM memory array itself, and the contents of which determine the security status of the PNVM contents. A major disadvantage of using non-volatile register circuitry for security functions is that it uses a large amount of chip area, and also that it requires special complex circuitry apart from the memory circuitry itself.

[0005] A memory system in accordance with the invention includes a non-volatile memory to contain a security indication and program instructions. A volatile register is also provided.

[0006] Memory interface logic circuitry operates responsive to the contents of the volatile register, to selectively allow access to the memory. Security indication copying circuitry receives a reset signal for the memory system. In response to the reset signal, the copying circuitry causes the security indication to be copied into the volatile register as the contents thereof.

[0007] FIG. 1 illustrates an embodiment of the invention in block form.

[0008] FIG. 2 is a timing diagram that illustrates the operation of the FIG. 1 system.

[0009] In accordance with the invention, a memory is provided having a plurality of addressable memory locations, one of which addressable for holding security data for the memory. The security of the memory depends on the security data. In particular, associated interface circuitry controls access to the memory based upon the security data.

[0010] A particular embodiment in accordance with the invention is disclosed in FIG. 1. As shown in FIG. 1, a flash memory array 102 includes a security “word” location 104. (As used herein, “word” is not meant to imply any particular bit-length of the security data or of the location in which it is stored.) As will be seen in greater detail later with reference to the timing diagram of FIG. 2, upon reset but before any other memory fetch is allowed, the contents of the security word location 104 is provided from the memory 102 into a volatile register 106 external to the memory array 102. Because the register 102 is volatile, it does not require the complex circuitry of the conventional non-volatile security register circuitry. Based on the security word in the volatile register, “write enable” 107aand “read enable” 107bsignals are generated.

[0011] Flash memory array interface logic 108 includes within it combining circuitry (e.g., AND logic) to combine the “write enable” 107aand “read enable” 107bsignals with memory write request 109aand read request 109bsignals, respectively, to generate appropriate memory control signals 111 for accessing the flash memory array 110. While the FIG. 1 embodiment shows the memory system having a flash memory array 102 that includes the security word 104 and another flash memory array 110 that includes program instructions, it is within the scope of the invention for the security word and the memory to be secured to be within a single memory array.

[0012] The security word location 104 itself is protected from being erased if any of the security features are enabled, as indicated by the content of the security word in the security word location 104. That is, as discussed above, the contents of the security word location 104 are latched into the volatile register 106 upon reset and before any other memory fetch is allowed. As shown schematically in FIG. 1, AND circuitry combines the write enable 107aand read enable 107bsignals together to generate a security word erase enable signal 114. Thus, it can be seen that only if the security word in the volatile register 106 indicates both write enable and read enable can the security word in the security word location 104 of the flash memory array 102 be erased.

[0013] The operation of the FIG. 1 circuit is now explained in greater detail with reference to the FIG. 2 timing diagram. In FIG. 2, the reset_z signal 202 is the active low external reset input. The g_reset signal is the active high internal reset input going to all blocks. The gadp[20:0] signal 206 is the instruction fetch address. The fldmls_se signal 208, when active, enables the sense amplifier of the memory array containing the security bits to transfer the security bits to the volatile register 106.

[0014] Now, turning to FIG. 2, at point 252 the external reset signal goes inactive, signalling that the circuit is to go out of reset. At point 254, some time later, the g_reset signal 204 goes inactive, bringing the blocks of the circuit 100 out of reset. What happens between point 252 and point 254 is significant.

[0015] In particular, the gadp[20:0] signal is the instruction fetch address. At point 256, the first address is ready for the instruction to be fetched. Notably, point 256 is after point 254. That is, in the interim between points 252 and 254, the security bits are being read from the security word 104 of the memory 102 into the volatile register 106. The fldmls_se signal 208 enables the sense amplifier of the memory 102 holding the security word 104. The high period (between 258 and 260) is the period during which the security word 104 is being read out of the memory 102.

[0016] There are some test modes available on the chip to test its functionality. One is to supply instructions from an external source rather than executing instructions stored in the program memory array so that any instruction sequence can be executed, not limited to what is in the memory array. Another is to allow direct access to the non-volatile memory array (i.e. provide address inputs, read/write control signals and data I/O port on various device pins) to treat it like a standard memory. This allows one to isolate and interface directly to the memory array and make memory testing much easier and faster, as the memory array does not have to be accessed through read/write operations by the CPU. Test mode is usually entered through a set of input pins being in a certain state.

[0017] The problem is that if this test mode is entered this way, and the memory test mode allows direct access to the memory, the security feature would be bypassed as the memory is controlled from external pins, and therefore the internal logic is not able to load the security word into the volatile register. Therefore, the test mode logic is made so that this memory test mode is not entered until after reset, i.e. after the security word has been loaded into the volatile latch); thereafter, the security feature has been set up properly and then all accesses to the memory in this test mode are made subject to the security status.

[0018] It should be noted that, in general, the memory being protected includes program instructions. However, the memory could also include constant data, such as a look-up table. In one embodiment, the write protection prevents any further write to the memory. As for read protection, in one embodiment, the read protection only prevents reading of the memory in certain modes like test mode, but it does not prevent the CPU from reading the memory and executing the instructions (as it would not be particularly meaningful or useful to prevent the CPU from reading the memory to execute instructions).

[0019] It should also be noted that, also for security reasons, even though reading a piece of data out of the memory array, including the security word, requires only one cycle, the (security word read) is made to be multiple cycles long (longer than the number of cycles for a normal read access) to ensure the security word is read out properly. In one embodiment, 32 cycles was used, but only because that signal already existed in the chip for another purpose. This prevents someone from defeating the read by reading the security word out with a clock that is out of specification (e.g., with a faster than expected clock).