This application is related to commonly-owned patent application Ser. No. 12/347,077, entitled “System and Method for Funds Recovery from an Integrated Postal Security Device” and filed contemporaneously herewith by Robert J. Tolmie, Jr., Douglas A. Clark and Mark A. Scribe, which related application is incorporated herein by reference in its entirety.
The illustrative embodiments described in the present application relate generally to memory access circuitry in application specific integrated circuits, and more particularly to systems and methods for recovering data from non-volatile memory registers in a partially disabled application specific integrated circuit.
Modern electronic systems that are produced in relatively high volume often include application specific integrated circuits (ASICs) in order to reduce chip count, package size, cost and power requirements. ASICs often include entire 32-bit CPU core processors, memory blocks including ROM, RAM, EEPROM, Flash and other large custom logic building blocks that previously would have been separate discrete chips. Such an ASIC is often referred to as a System-on-a-chip (SoC) because of the high level of integration provided.
Several companies provide various ASIC design and production services including Samsung, IBM, Texas Instruments and Toshiba. There are several types of ASICs available that offer certain libraries and standard processes to speed development including standard cell design and gate array design. Additionally, full custom design chips may be designed and procured.
In traditional multi-chip electronic systems, multiple integrated circuits including a processor, memory, non-volatile memory, logic, power distribution, clock or other subsystem are mounted and interconnected on a printed wiring board. In such a device, one or more of the non-memory components may fail when the non-volatile memory circuit is still functioning. In such a case, memory records may be retrieved from the functioning non-volatile memory device such as by removing it from the printed wiring board and for example placing it in a second working printed wiring board.
However, if the electronic component includes a SoC ASIC, then the failure of a portion of the circuit not damaging the non-volatile memory may still render the non-volatile memory record inaccessible. Accordingly, there is a need o provide for recovery of non-volatile memory records in a partially disables application specific integrated circuit.
The present application describes illustrative embodiments of systems and methods for memory access circuitry in application specific integrated circuits, and more particularly to systems and methods for recovering data from non-volatile memory registers in a partially disabled application specific integrated circuit.
In one configuration, a system on a chip application specific integrated circuit includes a virtual partial dual-port non-volatile memory having a secondary partial read only port that is configured to share the main memory bus and limit access by an address range register. Secondary power, clock and control signals are provided and a state machine performs a serial output of memory data from a range of memory registers.
In another configuration, a system on a chip application specific integrated circuit includes a physical partial dual-port non-volatile memory having a secondary partial read only port configured with a separate partial read only bus that does not include bus contention busy circuitry. Secondary power and clock signals are exclusively provided to a state machine that performs a serial output of memory data from a range of memory registers. Additionally, memory disable and CPU reset circuitry is controlled by the presence of the secondary power signal. In yet another alternative configuration, the physical second port of the non-volatile memory includes a JTAG circuit. Several additional alternative configurations are also described below.
The accompanying drawings illustrate presently preferred embodiments of the invention, and together with the general description given above and the detailed description given below, serve to explain the principles of the invention. As shown throughout the drawings, like reference numerals designate like or corresponding parts.
The illustrative embodiments of the present application describe systems and methods for secure memory read access circuitry in application specific integrated circuits, and more particularly to systems and methods for securely recovering data from non-volatile memory registers in a partially disabled application specific integrated circuit.
In the case of a highly integrated electronic system such as a system on a chip (SoC) application specific integrated circuit (ASIC), embedded non-volatile memory (NVM) may be used for storing valuable data. Access to the relevant NVM would be controlled by circuitry resident in the single integrated circuit. Accordingly, access to the valuable data may not be possible if the integrated ASIC fails in such a way as to prevent normal memory access such as through a processor read of the memory device. Moreover, a highly integrated ASIC with multiple functions is more complex and includes more functionality and logic gates. Accordingly, such an ASIC is more likely to fail due to a problem with an unrelated part of the ASIC than would be likely with a multi-chip module. It has been found that a relatively small number of logic gates may be added to such an ASIC to greatly enhance the likelihood that relevant data might be retrieved from a partially failed ASIC using the systems and methods described herein.
In one illustrative configuration, a system on a chip application specific integrated circuit includes a virtual partial dual-port non-volatile memory having a secondary partial read only port that is configured to share the main memory bus and limit access by an address range register. Secondary power, clock and control signals are provided and a state machine performs a serial output of memory data from a range of memory registers. The illustrative embodiments described herein are implemented in a system on a chip application integrated circuit, but alternatively could be implemented using a similar configurable technology such as Field-programmable gate arrays (FPGAs).
Referring to
A partial failure of the ASIC may involve the CPU core 120 (such as an ARM 7 core) or support circuitry and therefore, normal access to the NVM memory 132 using BUS1122 would not be possible. The NVM 132 is implemented using FLASH EEPROM, but a virtual second read only port BUS, BUS MUX 156 is provided by the state machine 150 with multiplexing bus access to provide read only access to the relevant registers. The ASIC 101 is mounted on a representative printed wiring board (PWB) 110 that includes a battery 114 providing power plane P3, a power supply connection providing main power P1, a crystal 112 used to produce a main clock CLK1 and access to the ASIC pins such as through port 116 and header port 118. The header port 118 is an emergency read access port that is not used during normal circuit operation. Similarly, the JTAG port 170 may be externally connected to the state machine 150 or to pins in another area of the ASIC.
The SoC ASIC 101 includes an embedded processor core 120 such as an ARM7 processor core with associated circuitry. Representative BUS 122 (data and address lines) connect the CPU core 120 to a memory map 130 (not to scale) that includes multiple types of integrated memory devices with association bus and signal control circuitry to provide SRAM, Dynamic RAM (DRAM) and/or NVM including EEPROM, Flash 132 (including emergency read address registers 131) or BSRAM devices 132. The ASIC 101 includes relevant support circuitry such as power conditioning and distribution, clock dividers and drivers, test access, main bus control and other relevant devices (not shown). The memory bus 122 is representative and allows multiple access to at least relevant portions of the address and data busses required such as through a second virtual bus and bus arbitrator along line 156 from the bus circuitry of state machine 150.
Here, the ASIC 101 has a separate power plane P2 that has separate power and ground pins on the emergency port 118. This power plane P2 powers only the required FLASH bus and state machine gates required to perform the emergency read functions described herein. However, the state machine 150 and related circuits may also be powered during normal operation by P1. The emergency read port 118 provides certain of the emergency read signals to the PWB 110 header 118. Here, state machine 150 has backup power P2, backup clock CLK2 and a serial bus connected. It provides control write enable WE, read enable and clock CLK2 to the memory over 354. The WE line in 154 is used to disable write functions in the memory. When powered by P2, the state machine 150 obtains the emergency read register address range from hard-coded register location 131. The state machine 150 performs and pre-emergency read functions and then reads and serially outputs the valuable data from the selected range of NVM Registers 132.
Optionally, ASIC 101 is configured to have an automatic write enable disable feature 170 whereby presence of emergency read backup power supply P2152 drives a gate to disable the write enable on at least the section of memory that holds the valuable data and also drives the reset line of the CPU Core to ensure that the CPU core does not attempt to access the BUS 122. Instead of a state machine 150, the ASIC 101 may alternatively use a small programmed general purpose processor such as an 8 bit 8051 compatible core or other secondary virtual memory access channel device.
In another illustrative configuration, a system on a chip application specific integrated circuit includes a physical partial dual-port non-volatile memory having a secondary partial read only port configured with a separate partial read only bus that does not include bus contention busy circuitry. Secondary power and clock signals are exclusively provided to a state machine that performs a serial output of memory data from a range of memory registers. Additionally, memory disable and CPU reset circuitry is controlled by the presence of the secondary power signal. In yet another alternative configuration, the physical second port of the non-volatile memory includes a JTAG circuit. Several additional alternative configurations are also described below.
Referring to
A separate physical Bus BUS2/MUX 256 includes address and data lines required to access at least a part of the memory 130, specifically NVM 131, 132. Because the memory is physically dual ported, we make sure that CPU core 120 or DMA access (not shown) cannot write to the device and then ASIC 201 does not require the additional circuitry to provide busy state signals that are often implemented in dual port memory. When powered by P2, the state machine 150 obtains the emergency read register address range from hard-coded register location 131. The state machine 150 performs and pre-emergency read functions and then reads and serially outputs the valuable data from the selected range of NVM Registers 132.
Here, ASIC 201 is configured to have an automatic disable feature 270 whereby presence of emergency read backup power supply P2152 drives a gate to disable the write enable WE 274 on at least the section of memory that holds the valuable data and also drives the reset line RST 273 of the CPU Core 120 to ensure that the CPU core does not attempt to access the BUS 122. Furthermore the disable feature 270 will erase a security related battery backed portion of the memory map 134 having battery power P3 and an emergency capacitor reserve P4 to facilitate execution of the erase command E 275.
For example, P4 comprises a storage capacitor for powering the erase circuitry of battery backed memory section 134 in response to erase (E) signal 275. Additionally, commonly-owned, co-pending U.S. patent application Ser. No. 12/257,728, filed Oct. 24, 2008 by Sungwon Moh, et al. entitled Cryptographic Device Having Active Clearing of Memory Regardless of State of External Power is incorporated herein by reference in its entirety and described such memory clear systems that may alternatively be used in the embodiments herein.
As a security feature, circuit 170 will also disable the charge pump clock 272 required for memory write functions. As yet another security feature, fuse 271 will blow when P2 is introduced to the ASIC 201. Before connecting the emergency read test cable to header 118, the user may probe test point 1 TP1 with a low voltage, low current continuity meter to ensure that fuse 1 has not blown. In this embodiment, only P2 powers the state machine components that are not needed to be powered to avoid interfering with normal operation of the ASIC. However, the main power could alternatively power the whole device and P2 may be injected as a backup power source for the limited gates and devices needed to accomplish the emergency read function.
In yet another alternative configuration, the physical second port of the non-volatile memory includes a JTAG circuit JTAG2270. The ASIC 201 includes a traditional JTAG port JTAG 1272, that may be disabled after manufacturing test is completed. However, the ASIC also includes JTAG port JTAG 2270 that is not disabled after manufacturing test. JTAG2 is only powered by P2. Accordingly, a commercially available JTAG test device can be programmed to perform the emergency memory read functions described herein.
Referring to
Once the state machine completes the pre-read tasks of state 320, the state machine follows path 325 to state 330. In state 330, the state machine obtains the emergency read address range from hard-coded memory registers. Here, the provision of an address range allows the emergency memory read range to be dynamically configurable at least within a sub-range of memory map 130. The state machine then follows path 335 to state 340. In state 340, the state machine performs the emergency read. Here, the necessary bus control is asserted to control the memory bus and the registers are read and serially output over the I2C serial port provided for emergency read functions. For example, the state machine includes at least the start address of the register range and can serially increment the address to process the known or obtained range of registers. The state machine provides the bus control and address information required to read the relevant registers. The state machine optionally includes a buffer to hold the relevant register data while it is serially outputting that data on the I2C channel. Optionally, the registers are actual physical dual port devices and the state machine controls the second read only port to process the emergency read request. The state machine then terminates by staying in state 340 on path 345. Optionally, state 340 continuously outputs the register data until power P2 is removed.
Referring to
In step 430, if the emergency read port is connected, the process performs any pre-emergency read requirements such as erasing any security data including any cryptographic keys, disabling the main CPU core and disabling the memory write capability for at least the memory locations that are to be read. In step 440, the process obtains the emergency read register range. In step 450, the process performs the emergency read of the registers. In step 460, the process outputs the selected register data and may output the data on a serial or parallel bus. In the illustrative embodiments, a standard I2C serial port is used by the emergency read state machine to output the register contents.
Referring to
When system power is removed from a device using typical random access memory (RAM), the data stored in the RAM is lost. There are several types of non-volatile memory (NVM) available that maintain the stored data after system power is removed including battery-backed RAM, Traditional small block or byte writable Electrically Erasable Programmable Read Only Memory (EEPROM) is distinguished from the more modern FLASH NVM. Dual port memory however, has typically been used in video display applications such as in dual port Video Ram (VRAM). In an alternative applicable to any of the relevant embodiments herein, the EEPROM memory comprises dual port NVM memory such as dual port EEPROM memory having a primary channel through the system bus and then a secondary read-only channel accessible through the state machine 150 using a second bus.
The processes described herein are programmed in the appropriate assembler language for the CPU processor used such as the embedded ARM 7 series processors. Alternatively, the C or C++ programming language or other appropriate higher level language may be utilized to create the programs resident in memory 130. The emergency read channel includes an I2C serial port with clock and data pins optionally on the 12 line port 116 or on a header used for the invasive emergency read process. The processors run on real-time or other operating systems such as QNX, embedded LINUX or WINDOWS CE stored in memory. In another alternative embodiment applicable to any of the relevant embodiments herein, instead of an ASIC, any other programmable or otherwise customizable integrated circuit such as Field-programmable gate array (FPGA) may be used.
In yet another alternative applicable to any of the relevant embodiments herein, P2 comprises a voltage level that is lower than the primary power voltage level such as ½ core voltage, but sufficient to power the NVM and state machine in a read only process. Similarly, the clocking circuit to the NVM 132 may be multiplexed such that the presence of P2 selects CLK2 for the memory device 132. Accordingly, as another security measure, CLK2 may alternatively be slower than CLK1 such as ½ speed but sufficient to clock FLASH 132 and state machine 150 in a read only mode. The ASIC core may typically run at anywhere from 10-300 Mhz as appropriate and at 1.8 V with 3.3v and 5v power available for other circuits.
Commonly-owned, co-pending patent application Ser. No. 12/347,077, entitled “System and Method for Funds Recovery from an Integrated Postal Security Device” and filed contemporaneously herewith by Robert J. Tolmie, Jr., Douglas A. Clark and Mark A. Scribe is incorporated herein by reference in its entirety. Any of the embodiments therein or portions thereof may be combined with the embodiments herein as would be known by one of skill in the art practicing the teachings herein.
A number of embodiments of the present invention and relevant alternatives have been described. Nevertheless, it will be understood that various modifications may be made without departing from the spirit and scope of the invention. Other variations relating to implementation of the functions described herein can also be implemented. Accordingly, other embodiments are within the scope of the following claims.
Number | Name | Date | Kind |
---|---|---|---|
4253158 | McFiggans | Feb 1981 | A |
4310755 | Miller | Jan 1982 | A |
4376299 | Rivest | Mar 1983 | A |
4649266 | Eckert | Mar 1987 | A |
4908502 | Jackson | Mar 1990 | A |
5111030 | Brasington et al. | May 1992 | A |
5260979 | Parker et al. | Nov 1993 | A |
5400345 | Ryan, Jr. | Mar 1995 | A |
5715431 | Everett et al. | Feb 1998 | A |
5731980 | Dolan et al. | Mar 1998 | A |
5749078 | Gargiulo et al. | May 1998 | A |
5774399 | Kwon | Jun 1998 | A |
5793867 | Cordery et al. | Aug 1998 | A |
5812990 | Ryan, Jr. et al. | Sep 1998 | A |
5841269 | Schoonmaker et al. | Nov 1998 | A |
5938779 | Preston | Aug 1999 | A |
5963928 | Lee | Oct 1999 | A |
5978275 | Song et al. | Nov 1999 | A |
5999921 | Arsenault et al. | Dec 1999 | A |
6000774 | Nambudiri | Dec 1999 | A |
6050486 | French et al. | Apr 2000 | A |
6061670 | Brand | May 2000 | A |
6067262 | Irrinki et al. | May 2000 | A |
6085180 | Beer et al. | Jul 2000 | A |
6125162 | English et al. | Sep 2000 | A |
6141654 | Heiden et al. | Oct 2000 | A |
6144950 | Davies et al. | Nov 2000 | A |
6169804 | Ryan, Jr. et al. | Jan 2001 | B1 |
6175826 | Malandra, Jr. et al. | Jan 2001 | B1 |
6202057 | Pierce | Mar 2001 | B1 |
6260144 | Pitchenik et al. | Jul 2001 | B1 |
6295359 | Cordery et al. | Sep 2001 | B1 |
6388930 | Obremski | May 2002 | B1 |
6397328 | Pitchenik et al. | May 2002 | B1 |
6585433 | Davies et al. | Jul 2003 | B2 |
6591327 | Briner et al. | Jul 2003 | B1 |
6592027 | Kovlakas | Jul 2003 | B2 |
6629268 | Arimilli et al. | Sep 2003 | B1 |
6839695 | Igval | Jan 2005 | B2 |
6868407 | Pierce | Mar 2005 | B1 |
6928027 | Li | Aug 2005 | B2 |
6941284 | DeFilippo et al. | Sep 2005 | B2 |
7143068 | Kissner et al. | Nov 2006 | B2 |
7194443 | Post et al. | Mar 2007 | B1 |
7233930 | Ryan, Jr. | Jun 2007 | B1 |
7237149 | Moyer et al. | Jun 2007 | B2 |
7247791 | Kulpa | Jul 2007 | B2 |
7272581 | Athens et al. | Sep 2007 | B2 |
7293197 | Jadon et al. | Nov 2007 | B2 |
7337366 | Taniguchi | Feb 2008 | B2 |
7360068 | Borgatti et al. | Apr 2008 | B2 |
7366306 | Trimberger | Apr 2008 | B1 |
7444546 | Kimelman et al. | Oct 2008 | B2 |
7487316 | Hall et al. | Feb 2009 | B1 |
7609087 | Theron | Oct 2009 | B1 |
20020008428 | Smola et al. | Jan 2002 | A1 |
20020029348 | Du et al. | Mar 2002 | A1 |
20020199076 | Fujii | Dec 2002 | A1 |
20030172320 | Mehta et al. | Sep 2003 | A1 |
20040230735 | Moll | Nov 2004 | A1 |
20050138481 | Taniguchi | Jun 2005 | A1 |
20050160316 | Shipton | Jul 2005 | A1 |
20050278499 | Durham et al. | Dec 2005 | A1 |
20060013044 | Cheung | Jan 2006 | A1 |
20060075282 | Borkenhagen et al. | Apr 2006 | A1 |
20060232295 | Agrawal et al. | Oct 2006 | A1 |
20070069012 | Tagawa | Mar 2007 | A1 |
20070165457 | Kim | Jul 2007 | A1 |
20070168695 | Chen et al. | Jul 2007 | A1 |
20070192250 | Nakamoto et al. | Aug 2007 | A1 |
20080028234 | Ducharme | Jan 2008 | A1 |
20080043558 | Dixon et al. | Feb 2008 | A1 |
20080054960 | Becke et al. | Mar 2008 | A1 |
20080122484 | Zhu et al. | May 2008 | A1 |
20080232174 | Cornwell | Sep 2008 | A1 |
20080253182 | Kim et al. | Oct 2008 | A1 |
20080263392 | Fujiwara et al. | Oct 2008 | A1 |
20080298128 | Kang et al. | Dec 2008 | A1 |
20080307251 | Rahman et al. | Dec 2008 | A1 |
20090058462 | Mason et al. | Mar 2009 | A1 |
20090094700 | Goto et al. | Apr 2009 | A1 |
20090205050 | Giordano et al. | Aug 2009 | A1 |
20090210637 | Yung et al. | Aug 2009 | A1 |
20090249136 | Halstvedt et al. | Oct 2009 | A1 |
20100148856 | Lui et al. | Jun 2010 | A1 |
20100169240 | Tolmie, Jr. et al. | Jul 2010 | A1 |
Number | Date | Country |
---|---|---|
0302453 | Aug 1988 | EP |
0328062 | Aug 1989 | EP |
0328062 | Apr 1994 | EP |
WO9706599 | Feb 1997 | WO |
Number | Date | Country | |
---|---|---|---|
20100165734 A1 | Jul 2010 | US |