Memory, an important element in electronic and computer applications, may include volatile and nonvolatile memory. Whereas volatile memory loses data stored in it with a loss of power, nonvolatile memory can preserve the data even after power cycling. Due to its widespread application, nonvolatile memory has become a target of counterfeiters and these counterfeit memory chips enter the market masquerading as new chips. Thus many memory chips have been found to be unreliable in their promised lifespan and efficiency. Counterfeit memory chips may result in failures of end-user applications, ranging from a loss of data and premature end-of-life to more serious catastrophic events.
NAND flash memory is generally a very popular commercial nonvolatile memory (NVM) option due to its high density (greater than 1 terabyte (TB)/square inch) along with its relatively low cost (less than $1/gigabyte (GB)), lightweight and low power consumption, making it very attractive for a variety of electronic systems. However, NAND flash memory systems have a finite number of write cycles, after which they may become erratic and hence unreliable. Since a NAND flash memory can only go through a limited number of erase operations in its lifetime, identifying counterfeit NAND flash memory essentially means identifying the number of erase cycles that a given system has already gone through. Thus if a NAND flash memory that has gone through several erase cycles is sold as new, it may be not reliable for applications in mission-critical systems, medical systems or even consumer-level products which may require longer and robust lifecycles.
Some recently proposed techniques for counterfeit memory chip detection rely on physical and electrical inspections using high-tech imaging, parametric functionality tests, using ECIDs (Electronic Chip Identifiers), or Physical Unclonable Functions (PUFs). However, these methods have fallen short of widespread use due to high cost, requirement of large databases or reliance on experts, making authentication of memory chips a cumbersome and ineffective process. It is desirable and would be useful to provide a methodology for authenticating flash memory chips and other types of memory in an efficient, easy-to-use, cost-effective manner without the requirement of experts, so that it can be widely used in order to phase out the counterfeiting of memory chips.
The disclosure can be better understood with reference to the following drawings. The elements of the drawings are not necessarily to scale relative to each other, emphasis instead being placed upon clearly illustrating the principles of the disclosure. Furthermore, like reference numerals designate corresponding parts throughout the several views.
The present disclosure generally pertains to systems and methods for determining authenticity of memory. Counterfeit memory chips in the electronics supply chain of the market may be missed by existing methods for determining authenticity. For example, flash memory chips remain functional even after the end of the lifecycle of the product that housed the flash memory chips, providing opportunities for counterfeiters to retrieve the used flash memory chips and sell them as new. Although there exist many approaches for tracing the origins of flash memory chips, they can be easily circumvented by motivated counterfeiters. For example, the counterfeiters can emulate the exact features of the chip by erasing and re-programing the identity information of the manufacturer in a dedicated memory block of the chip.
In order to overcome this and several other shortcomings of the present approaches, some embodiments of the present disclosure employ techniques for detecting counterfeit memory by exploiting systematic variations in the properties of memory arrays that are fundamentally related to the specific manufacturing process. The systematic variations within the array are usually unique for a given family of memory chips as these variations originate from the unique nature of the underlying fabrication process (specifically, the foundry). In some embodiments, partial erase operations may be used to help in extracting variations in the physical properties among pages of a memory block, and these variations create a distinctive characterization that is unique for a given family of chips and differs significantly from erase characterizations observed in chips from other manufacturers.
In some embodiments of the present disclosure, a memory authentication system programs a plurality of cells (e.g., a memory block) in order to fill each of the cells with charge. A partial erase operation is then performed in order to drain charge from the cells. Such partial erase operation may be performed by initiating an erase operation and then terminating the erase operation before completion such that at least some charge remains in the cells. Due to process variations during manufacturing, charge should drain from the cells at different rates such that some of the cells may flip to an erase state (e.g., transition from “0” to “1”) in response to the partial erase operation while other cells remain in a program state (e.g., “0”) depending on the duration of the partial program operation (i.e., the amount of time from initiation of the erase operation to its termination). The pattern of bit flips defines a unique signature that may be used to identify the chip's source (e.g., the foundry at which the chip was manufactured). The system is configured to determine at least one parameter indicative of the signature and to provide information that may be used to authenticate the memory.
Note that the control logic 111, when implemented in software, can be stored and transported on any computer-readable medium for use by or in connection with an instruction execution apparatus that can fetch and execute instructions. In the context of this document, a “computer-readable medium” can be any means that can contain or store a computer program for use by or in connection with an instruction execution apparatus.
The exemplary device 100 depicted by
It should be noted that different configurations of the device 100 are possible in other embodiments. As an example, it is possible for the control logic 111 to reside in the memory system 110 or at other locations. Using the embodiment shown by
Memory cells 130 can be located on one or more memory chips 140. Within some classes of memory chips 140, memory cells 130 are setup in blocks 410 (
As shown by
As known in the art, memory operations may be performed by applying specific voltages on connections or “lines,” such as word lines and bit lines, connected to one or more memory cells 130 as appropriate for performing the desired operation. In some embodiments, memory cells 130 may be located on one or more memory chips 140 (an integrated circuit (IC) chip with memory), and the memory controller 120 may be on a separate IC chip that is electrically coupled to the memory chip 140. The memory controller 120 may transmit to a memory chip 140 a command to perform a memory operation, and the memory chip 140 may perform the commanded operation by applying voltages as appropriate to the memory cells 130 of the memory chip 140.
The erase operation in NAND flash typically involves setting a high voltage on the substrate 32 and a low voltage on all the control gates 49 of the block 410 causing electron tunneling (removal of electrons) from the floating gate 52. An erase operation often forces the bit value in a memory cell 130 to a logical high value (a “1”). Performance of the erase operation typically erases each memory cell 130 of the block 410 being erased.
In a NAND flash memory system 110, an entire block 410 is typically erased before new data is written to any cell 130 within the block 410, noting that an individual flash cell cannot typically be erased or changed from a “0” to a “1” without so changing the other cells in the same block. In order to erase the block 410, a negative voltage is required to force electrons from the floating gate 52 as shown in
Since the erase operation and the program operation are closely related, the endurance of a NAND flash memory system may according to the maximum tolerated number of program/erase cycles. With each program/erase cycle, more and more electrons are trapped in the blocking oxide layer 45. That is to say the operating window of threshold voltage (VTH) gradually shrinks with each program/erase operation of a cell. The limit concerning the number of program/erase cycles is directly tied to the maker of the NAND flash memory system or model used (such as 100,000 cycles for an SLC, 10,000 for a two-level MLC and 5,000 for a TLC, etc.).
In
Some process variations at a foundry for manufacturing memory chips similarly affect all of the chips manufactured by the same foundry. These process variations result in performance variations across the surface of the chip according to a pattern that is similar for all chips manufactured by the same foundry. Thus, cells at the same chip location for different chips manufactured by the same foundry may exhibit similar performance, such as rates that charge is forced into or out of the cell by program or erase operations. That is, each chip from the same foundry exhibits a recognizable pattern in performance that can be exploited to identify the chip's manufacturing source (e.g., manufacturer or manufacturing foundry).
In some embodiments, the control logic 111 is configured to initiate various memory operations on a memory chip 140 and then assess the performance of the memory chip in performing such operations in an attempt to identify a signature in the chip's performance that can be used to identify the chip's source. This information may then be used to authenticate the chip 140 (e.g., determine whether the chip 140 is counterfeit).
There are various types of operations and techniques for assessing performance that can be used in an effort to identify a signature in the chip's performance. As will be described in more detail herein, a partial erase operation is used in some embodiments for this purpose. Such partial erase operation is advantageous to assess the chip's performance for several reasons, including the fact that according to existing architecture for many conventional memory chips, an erase operation can be uniformly performed across a large number of cells (e.g., a block) to facilitate identification of performance patterns across the cells. However, it should be emphasized that other types of memory operations may be used in other embodiments.
Initially, the control logic 111 is configured to select a range of memory in a memory chip 140 under test, including at least one memory block 410, for use in authenticating the chip 140, and instruct the memory controller 120 to perform an authentication test on the selected memory. As shown by block 510 of
In this regard,
After forcing all of the cells 130 of the block 410 to a program state in block 510, the memory controller 120 is configured to perform a partial erase operation, as shown by block 515 of
However, in the instant embodiment, rather than performing a normal erase operation, the memory controller 120 instead performs a partial erase operation so that the erase operation is terminated prematurely (i.e., before the erase operation is fully completed). In this regard, after transmitting the erase command in block 515 to initiate an erase operation, the memory controller 120 waits for a specified amount of time (which is shorter than the time required to perform a normal erase operation) and then transmits to the memory chip 140 a command (e.g., an interrupt signal) that causes the memory chip 140 to terminate the erase operation being performed.
After termination of the erase operation, some charge has been forced out of the memory cells 130 of the block 410, but some charge also remains in each cell 130, as shown by
After the partial erase has been performed, the memory controller 120 is configured to read the entire block 410, as shown by block 522 of
In some embodiments, to facilitate comparison with the signature data 152, the control logic 111 is configured to calculate certain parameters that may be compared to parameters indicated by the signature data 152. As an example, for each page 420, the memory controller 120 may be configured to determine a value, referred to herein as “erase efficiency” of the page 420. The erase efficiency generally refers to the percentage of cells 130 that have transitioned to the erase state. It may be calculated by counting the number of cells storing a value associated with the erase state (e.g., a “1”) and dividing that number by the total number of cells 130 of the page 420. In other embodiments, it is possible to calculate other types of values that indicate the erase efficiency. In general, for the same duration of partial program operation, it is expected that the same page in multiple chips manufactured by the same foundry should have about the same erase efficiency. Thus, in some embodiments, the values read in block 525 may be deemed to match a particular signature when the pattern of erase efficiencies across the pages 420 under test sufficiently match the pattern of erase efficiencies associated with the particular signature.
Referring to block 535 of
Note that the techniques described above may be performed on any number of blocks 410 within the chip 140 under test. In general, performing tests on a larger number of blocks 410 increases the amount of data that may be compared to the signature data 152 thereby facilitating identification of a matching signature.
This application is a continuation-in-part of and claims priority to U.S. application Ser. No. 17/752,489, entitled “Systems and Methods for Identifying Counterfeit Memory” and filed on May 24, 2022, which is incorporated herein by reference. U.S. application Ser. No. 17/752,489 claims priority to U.S. Provisional Application No. 63/192,412, entitled “Flash-DNA: Identifying NAND Flash Memory Origins using Intrinsic Array Properties” and filed on May 27, 2021, which is incorporated herein by reference.
Number | Name | Date | Kind |
---|---|---|---|
5321241 | Craine | Jun 1994 | A |
5652803 | Tachikawa et al. | Jul 1997 | A |
6442644 | Gustavson et al. | Aug 2002 | B1 |
6659353 | Okamoto et al. | Dec 2003 | B1 |
7415732 | Montecalvo et al. | Aug 2008 | B2 |
7491948 | Gordon et al. | Feb 2009 | B2 |
8179720 | Fukuda et al. | May 2012 | B2 |
8572440 | Nunally | Oct 2013 | B1 |
9530512 | Ray et al. | Dec 2016 | B2 |
9543028 | Ray et al. | Jan 2017 | B2 |
9575125 | Andre et al. | Feb 2017 | B1 |
10078462 | Wang | Sep 2018 | B2 |
10204008 | Trezise et al. | Feb 2019 | B2 |
10223199 | Hahn et al. | Mar 2019 | B2 |
10509132 | Ray et al. | Dec 2019 | B1 |
10878922 | Ray | Dec 2020 | B1 |
10956557 | Plusquellic | Mar 2021 | B2 |
11114179 | Ray et al. | Sep 2021 | B1 |
11728000 | Ray et al. | Aug 2023 | B1 |
20040041197 | Jong et al. | Mar 2004 | A1 |
20040191989 | Ngo et al. | Sep 2004 | A1 |
20070043667 | Qawami et al. | Feb 2007 | A1 |
20070079387 | Ray et al. | Apr 2007 | A1 |
20080082872 | Nagasaka et al. | Apr 2008 | A1 |
20090165086 | Trichina et al. | Jun 2009 | A1 |
20100125765 | Orbach et al. | May 2010 | A1 |
20100140488 | Visconti et al. | Jun 2010 | A1 |
20110234241 | Lewis et al. | Sep 2011 | A1 |
20120166814 | Hayashi et al. | Jun 2012 | A1 |
20120233384 | Charles | Sep 2012 | A1 |
20130019132 | Amirkhanyan et al. | Jan 2013 | A1 |
20130127442 | Satoh et al. | May 2013 | A1 |
20130176772 | Deng et al. | Jul 2013 | A1 |
20130276151 | Lewis et al. | Oct 2013 | A1 |
20140037086 | Seol et al. | Feb 2014 | A1 |
20140075051 | Zadesky et al. | Mar 2014 | A1 |
20140101063 | Paul et al. | Apr 2014 | A1 |
20140143619 | Gorman | May 2014 | A1 |
20140146607 | Nagai et al. | May 2014 | A1 |
20150095550 | Khan et al. | Apr 2015 | A1 |
20150169247 | Wang et al. | Jun 2015 | A1 |
20150193204 | Lin et al. | Jul 2015 | A1 |
20150268934 | Anderson et al. | Sep 2015 | A1 |
20160034217 | Kim et al. | Feb 2016 | A1 |
20160283629 | Weckx et al. | Sep 2016 | A1 |
20170032843 | Ilani et al. | Feb 2017 | A1 |
20170046129 | Cambou | Feb 2017 | A1 |
20170090873 | Clark et al. | Mar 2017 | A1 |
20170126229 | Tan et al. | May 2017 | A1 |
20170269992 | Bandic et al. | Sep 2017 | A1 |
20170323439 | Sandberg | Nov 2017 | A1 |
20180039484 | La Fratta et al. | Feb 2018 | A1 |
20180122489 | Ray | May 2018 | A1 |
20180129445 | Shin | May 2018 | A1 |
20180158493 | Ryu | Jun 2018 | A1 |
20180287793 | Khatib Zadeh et al. | Oct 2018 | A1 |
20190096504 | Revankar et al. | Mar 2019 | A1 |
20190294500 | Hara et al. | Sep 2019 | A1 |
20190295963 | Dekker | Sep 2019 | A1 |
20200081689 | Huang et al. | Mar 2020 | A1 |
20200135283 | Park | Apr 2020 | A1 |
20200204367 | Miller et al. | Jun 2020 | A1 |
20200210098 | Simionescu | Jul 2020 | A1 |
20200372967 | Rahman | Nov 2020 | A1 |
20210407602 | Markov et al. | Dec 2021 | A1 |
20220050594 | Kim | Feb 2022 | A1 |
Entry |
---|
Clark, L. T. et al. Reliable techniques for integrated circuit identification and true random number generation using 1.5-transistor flash memory, Integration, vol. 65, 2019, pp. 263-272, https://doi.org/10.1016/j.vlsi.2017.10.001. (Year: 2019). |
Prabhu, P. et al. (2011). Extracting Device Fingerprints from Flash Memory by Exploiting Physical Variations. In: McCune, J.M., Balacheff, B., Perrig, A., Sadeghi, AR., Sasse, A., Beres, Y. (eds) Trust and Trustworthy Computing. Trust 2011. Lecture Notes in Computer Science, vol. 6740. Springer (Year: 2011). |
Jia, S., Xia, L., Wang, Z., Lin, J., Zhang, G., Ji, Y. (2015). Extracting Robust Keys from NAND Flash Physical Unclonable Functions. In: Lopez, J., Mitchell, C. (eds) Information Security. ISC 2015. Lecture Notes in Computer Science( ), vol. 9290. Springer, Cham. (Year: 2015). |
Prawar Poudel, Biswajit Ray, and Aleksandar Milenkovic. 2021. Microcontroller Fingerprinting Using Partially Erased NOR Flash Memory Cells. ACM Trans. Embed. Comput. Syst. 20, 3, Article 26 (May 2021), 23 pages. https://doi.org/10.1145/3448271 (Year: 2021). |
Y. Wang, W. -k. Yu, S. Wu, G. Malysa, G. E. Suh and E. C. Kan, “Flash Memory for Ubiquitous Hardware Security Functions: True Random Number Generation and Device Fingerprints,” 2012 IEEE Symposium on Security and Privacy, San Francisco, CA, USA, 2012, pp. 33-47, doi: 10.1109/SP.2012.12. (Year: 2012). |
Zimu Guo, Xiaolin Xu, Mark M. Tehranipoor, and Domenic Forte. 2017. FFD: A Framework for Fake Flash Detection. In Proceedings of the 54th Annual Design Automation Conference 2017 (DAC '17). Association for Computing Machinery, New York, NY, USA, Article 8, 1-6 (Year: 2017). |
Sakib, Sadman, Preeti Kumari, B. M. S. Bahar Talukder, Md Tauhidur Rahman, and Biswajit Ray. 2018. “Non-Invasive Detection Method for Recycled Flash Memory Using Timing Characteristics †” Cryptography 2, No. 3: 17. https://doi.org/10.3390/cryptography2030017 (Year: 2018). |
B. M. S. Bahar Talukder, V. Menon, B. Ray, T. Neal and M. T. Rahman, “Towards the Avoidance of Counterfeit Memory: Identifying the DRAM Origin,” 2020 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), San Jose, CA, USA, 2020, pp. 111-121, doi: 10.1109/HOST45689.2020.9300125. (Year: 2020). |
Guin, et al., “Counterfeit Integrated Circuits: A Rising Threat in the Global Semiconductor Supply Chain,” Proceedings of the IEEE, Aug. 2014, pp. 1207-1228, vol. 102, No. 8. |
Guin, et al., “Counterfeit IC Detection and Challenges Ahead,” Acm Sigda Newsletter, Jan. 2013, pp. 1-6. |
Kumari, et al., Independent Detection of Recycled Flash Memory: Challenges and Solutions, IEEE, 2018, pp. 89-95. |
Wang, et al., “Flash Memory for Ubiquitous Hardware Security Functions: True Random No. Generation and Device Fingerprints,” 2012 IEEE Symposium on Security and Privacy, San Francisco, CA, 2012, pp. 33-47. |
Number | Date | Country | |
---|---|---|---|
63192412 | May 2021 | US |
Number | Date | Country | |
---|---|---|---|
Parent | 17752489 | May 2022 | US |
Child | 17877023 | US |