US20080189557A1

US20080189557A1 - Method and architecture for restricting access to a memory device

Info

Publication number: US20080189557A1
Application number: US11/336,411
Authority: US
Inventors: Francesco Pipitone; Francesco Tomaiuolo; Marco Messina; Alessandro Raimondo; Vijay Malhi; Salvatore Giove
Original assignee: STMicroelectronics Research and Development Ltd; STMicroelectronics SRL
Current assignee: STMicroelectronics Research and Development Ltd; STMicroelectronics SRL
Priority date: 2005-01-19
Filing date: 2006-01-19
Publication date: 2008-08-07
Also published as: US20130014215A1; US20070192828A1; US8776174B2; US8276185B2

Abstract

A memory device including at least one storage area for storing data and a protection control structure adapted to selectively allow an external device access to the at least one storage area of the memory, the storage area being not freely accessible by the external device if protected. The memory device further includes a control logic adapted to identify an access request by the external device to the at least one storage area and cooperating with the protection control structure for managing an unlock procedure for selectively granting the external device at least temporary access rights to the storage area if protected. The memory device further includes means for providing a first code to the external device in said unlock procedure, means for receiving a second code from the external device in response to said first code, and means for verifying validity of the received second code, wherein said means for verifying validity are adapted to ascertain a correspondence of the second code with the first code based on a predetermined relationship. Said control logic instructs the protection control structure to grant access to the storage area if the validity of the received second code has been verified.

Description

PRIORITY CLAIM

This application claims priority from European patent application Nos. EP05100310.1 and EP05100308.5, both filed Jan. 19, 2005, which are incorporated herein by reference.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is related to U.S. patent application Ser. No. ______ entitled ENHANCED SECURITY MEMORY ACCESS METHOD AND ARCHITECTURE (Attorney Docket No. 2110-179-03), which has a common filing date and owner and which is incorporated by reference.

TECHNICAL FIELD

The present invention relates generally to the field of integrated circuits, and more specifically to semiconductor memories.

BACKGROUND

In the field of semiconductor memories, flash memories have become rather popular, because they combine the capability of storing relatively large amounts of data with the possibility of modifying their content directly in the field.
Flash memories are, for example, used to store the code to be executed by data processing units (e.g., microcontrollers, microprocessors, coprocessors, digital signal processors and the like) in a variety of electronic apparatuses, such as personal computers, mobile phones, digital cameras, set-top boxes for cable or satellite or digital terrestrial television, just to mention a few.
In particular, using flash memories it is possible to modify the stored code without having to remove the memory component from the respective socket. It has thus become possible to, e.g., change the code, fix code bugs, update the code version directly at the premises of the users; the new code can be for example downloaded over the internet, or received directly by the mobile phone from the service provider company.
There are applications in which these possibilities offered by flash memories raise problems of security. Electronic piracy acts may for example cause the code stored in the memory to be read without authorization or to be corrupted.
Referring to a conventional flash memory, the modification of the data stored in the memory is related to the erase and program operations. Stored data can be shielded from undesired read, erase and program operations by means of particular protection arrangements, that allow to selectively protect/unprotect distinct sectors of the memory. For example, U.S. Pat. No. 5,974,500 describes a non-volatile memory device comprising a set of first access control bits to control the access authorization (to perform the operations of erasing, programming and reading) to the memory array, and a set of second control bits to control write access to the first access control bits, in such a way to consent to the changing of the memory access authorization. Every time the external devices request an access operation to the memory, they must provide their access authorizations thereto. In fact, according to this solution, to access a protected memory zone, it is necessary to change the memory access authorization; however, this change is performed without any particular security protocol, simply by issuing, on the part of the external device, a request to modify the access authorization; there is no control on which device is requesting to change the access authorization scheme.
Therefore, in view of the state of the art outlined in the foregoing, a need has arisen for a technique to implement security in a semiconductor memory, and particularly in respect of aspects relating to the grant of access authorization to external devices in an efficient way, assuring a high level of security.

SUMMARY

According to an embodiment of the present invention, a memory device includes at least one storage area for storing data, and a protection control structure adapted to selectively allow an external device access to the at least one storage area of the memory. Said storage area is not freely accessible by the external device if protected. The memory device further includes a control logic adapted to identify an access request by the external device to the at least one storage area and cooperating with the protection control structure for managing an unlock procedure for selectively granting the external device at least temporary access rights to the storage area if protected. The memory device further includes means for providing a first code to the external device in said unlock procedure, means for receiving a second code from the external device in response to said first code, and means for verifying validity of the received second code. Said means for verifying validity are adapted to ascertain a correspondence of the second code with the first code based on a predetermined relationship. Said control logic instructs the protection control structure to grant access to the storage area if the validity of the received second code has been verified.
According to another embodiment of the present invention, an access protocol to allow access to a memory device by an external device includes receiving at the memory device an access request to a selected storage area by the external device. The access protocol further includes, in case the selected storage area is not a freely accessible area, performing an unlock procedure. Said unlock procedure includes the memory issuing to the external device a first code, at the external device, receiving the first code and, responsive thereto, sending to the memory device a second code depending on the first code. The unlock procedure further includes, at the memory device, at least temporarily unlocking the selected storage area to allow access thereto by the external device based on the received second code.
Other embodiments of the present invention regard an electronic device adapted to interact with a memory device of the previous embodiment, and an electronic system including such a memory device and electronic device.

BRIEF DESCRIPTION OF THE DRAWINGS

Further features and advantages of the present invention will be made clear by the following detailed description of a preferred embodiment thereof, provided purely by way of a non-limitative example, with reference to the attached drawings.

FIG. 1 is a diagram illustrating a dialoguing sequence between a memory device and an external device, e.g. a microprocessor, according to an embodiment of the present invention;

FIG. 2 is a schematic diagram illustrating the functional blocks of the memory device of FIG. 1 which are involved during a reading operation, according to an embodiment of the present invention;

FIG. 3 is a simplified circuital schematic of a data output block of the memory device illustrated in FIG. 2, according to an embodiment of the present invention;

FIG. 4 is a schematic diagram illustrating the functional blocks of the memory device of FIG. 1 which are involved during a modify operation, according to an embodiment of the present invention; and

FIG. 5 schematically shows an exemplary application of an embodiment of the present invention.

DETAILED DESCRIPTION

With reference to the drawings, FIG. 1 is a diagram that illustrates a simplified dialoguing sequence 100 between a memory device 102 implementing an access protocol scheme according to an embodiment of the present invention, and a device, in the example a microprocessor 104 external to the memory device. The memory device 102 includes a memory matrix 106 of memory cells (forming the storage area of the memory) and several devices that contribute to its functioning that are not shown in FIG. 1, being either known per se or described later on in connection with FIG. 2. The memory matrix 106 is divided in a plurality of n memory zones 108, each one including a corresponding plurality of memory cells. The external microprocessor 104 represents any electronic system intended and adapted to interact with the memory device. The external microprocessor 104 may, for example, control the memory device 102 in such a way to require the reading of particular data stored in selected groups of memory cells thereof. More particularly, the dialoguing sequence 100 illustrated in the figure relates to a case wherein an address of the memory cells that are to be accessed by the external microprocessor 104 for reading the stored content corresponds, i.e. falls in a range of addresses corresponding to a “protected” memory zone 108 of the memory matrix 106. By protected memory zone there is intended a zone of the storage area of the memory device 102 that is not freely accessible by, e.g., external devices; in particular, the dialoguing sequence 100 includes a sequence of operations adapted to “unlock” the (protected zone of the) memory device, said unlock-operations sequence enabling the external microprocessor 104 to obtain the right of accessing in reading the addressed memory cells belonging to the protected memory zone 108.
Quite schematically, the external microprocessor 104 executes a read(add) operation on the memory device 102 for requesting the memory device 102 to read the content of the memory cells of the memory matrix 106 corresponding to the address add.
Let it be assumed that the address add provided by the external microprocessor 104 corresponds to a protected memory zone 108 of the memory matrix 106, i.e., according to the definition given above, a memory zone that is not freely accessible. The memory device 102 denies the reading access to the external microprocessor 104, and wrong data are for example provided (the microprocessor can recognize that the data are wrong by checking the data validity in, e.g., a status register of the memory).
The external microprocessor 104 triggers an unlocking sequence, directed to be granted access right to the protected memory zone and to obtain the reading of the data stored in the memory matrix 106 in the location(s) corresponding to the specified address add. In particular, the unlocking sequence is started by the external microprocessor 104 requesting the memory device 102 provide a code, which the microprocessor will use to generate an unlocking password. The memory device, for example, generates a random number RND (e.g. 64-bit long) and makes it available to the microprocessor 104.
The external microprocessor 104 encrypts the received code RND by means of a predetermined encryption algorithm, e.g. a DES (Data Encryption Standard) algorithm, using a predetermined encryption key, obtaining as a result an encrypted code des_data_crypt, for example of 64 bits, which is an encrypted version of the code RND issued by and received from the memory device 102; the encrypted code des_data_crypt will be exploited as an unlock password that the microprocessor 104 provides to the memory device 102 for being granted the access authorization. From now on, for the purposes of the present description, by “encryption process” there is intended in general a process of encrypting and/or decrypting data. Once the encryption of the code RND has been completed, the external microprocessor 104 communicates to the memory device 102 that it is ready to convey the unlock password by means of an unlock_pwd_cmd command. Subsequently, the external microprocessor 104 sends to the memory device 102 the unlock password des_data_crypt.
The memory device 102 decrypts the received password des_data_crypt using a suitable decryption algorithm, e.g. the DES algorithm, and a decryption key, which may be stored therein, for example in the memory matrix 106 (preferably in a protected, non-externally accessible area thereof), or in a separate storage area non-accessible to the external user. The decryption of the received password des_data_crypt produces a code, e.g. 64-bit long, which is used by the memory for establishing whether or not the external microprocessor 104 is authorized to access the protected memory zone 108. The external microprocessor 104 is granted access right and allowed to read the data stored in the addressed location(s) of the protected memory zone 108 of the memory matrix 106 if the code obtained by decrypting the password des_data_crypt is equal or, generally, corresponds to the previously generated code RND; in this case, the memory device 102 unlocks the protected memory zone. This in fact means that the encryption algorithm and encryption key used by the external microprocessor 104 to encrypt the random number RND are the same as, or corresponds to those used by the memory device 102 to decrypt the password des_data_crypt, and thus the memory device 102 recognizes that the external microprocessor 104 is authorized to read the data stored in the protected memory zone 108 of the memory matrix 106.
After unlocking the protected memory zone 108, the memory device 102 reads the addressed memory cells and makes the requested data available to the external microprocessor 104.
The dialoguing sequence described above provides a significant security, because a protected memory zone is not unlockable by any external device (i.e., it cannot be rendered freely accessible), but only by authorized ones, having been provisioned of the necessary right, in particular in term of tools (algorithm, key) for encrypting codes sent by the memory.
A protected memory zone 108 may be also considered as not freely accessible for modifying the content thereof (writing and/or erasing the memory zone). According to an embodiment of the present invention, each memory zone 108 may be individually and independently protected against modify and/or reading of the content thereof. In particular, according to an embodiment of the present invention, a similar dialoguing sequence as that described above in connection with a read access may be executed between the memory device 102 and the external microprocessor 104 in order to grant to the microprocessor access right for modifying data stored in the memory. For example, considering the case of a write access for writing data, the external microprocessor 104 may execute a write(add) operation on the memory device 102 for requesting the memory device 102 to write data into selected memory cells of the memory matrix 106, identified by the address add. If the address add corresponds to a memory zone 108 protected against modify, particularly writing, the memory device 102 notifies the external microprocessor 104, which triggers in turn an unlocking sequence analogous to that previously described. After the protected memory zone 108 has been unlocked, the memory device 102 writes the data provided by the microprocessor 104 into the addressed memory cells.
Further protection modes may be implemented as an alternative to or in combination with those previously cited.
For example, as far as the protection in reading is concerned, according to an embodiment of the present invention, the unlocking operations sequence described above may be adapted to grant to the external microprocessor 104 only a temporary (i.e., limited in time) authorization to read the locations belonging to the protected memory zone which has been unlocked, in such a way to increase security. After a predetermined time interval, for example of the order of some milliseconds (e.g., 5 ms), the protected memory zone 108 that has been unlocked returns to a protected status, and the unlocking operations sequence has to be repeated in order to access memory locations thereof.
Concerning the protection in modify, according to a further embodiment of the present invention, the external microprocessor 104 may have to provide a password to the memory device 102 for being granted the authorization to modify the content of the locations of a protected memory zone, wherein said password is established once and for all, for example by the user of the memory device 102 when the memory device is turned on for the first time, and may be stored into dedicated registers not freely accessible from the outside.
To provide additional security to the memory device 102, the protection against modify, e.g. writing, may be made dependent also from the protection against reading; in other words, in order for the external microprocessor 104 to be granted the authorization to modify, e.g. write, the locations belonging to a protected memory zone 108, it may be required that the external microprocessor 104 has also obtained the authorization to read said protected locations, as will be described in greater detail later.
Referring now to FIG. 2, a simplified functional blocks diagram of the memory device 102 according to an embodiment of the present invention is illustrated. It is pointed out that only the functional blocks involved in a reading operation on the memory device are shown, and, for simplicity of the drawing, signals and corresponding physical lines carrying them are denoted with the same reference numerals.
The memory device 102 interacts with the external environment by means of a plurality of data input/output (I/O) pads 202, for receiving/outputting data (and command codes), and of address pads 203, for receiving address codes adapted to select a location, i.e., memory cells, in the memory matrix 106. The pads 202 and 203 are connected to an input block 204, including input buffers for the addresses and the data. The input block 204 is connected, by means of a bus of lines identified as command in the drawing, to a Command User Interface (CUI) 205; over such bus, a generic command received by the memory (for example, from the external microprocessor 104) is conveyed to the CUI 205, which decodes the command so as to determine a proper operations sequence; among other commands, the CUI receives and decodes the command unlock_pwd_cmd sent by the external microprocessor 104 when it is ready to send the password des_data_crypt to the memory device 102. The memory device may include further pads, particularly an OEN (output enable) pad (in the drawing indicated as part of the pads 203), for receiving an output enable command from an external memory controller, such as the external microprocessor 104; also the pad OEN is connected to the input block 204, which regenerates the output enable signal and provides an internal output enable signal oe_n.
The memory matrix 106 includes a plurality of memory cells (not shown in the drawing) arranged in rows and columns, controlled by bit lines and word lines, respectively. A decoder and selector block 210 receives from the input block 204 the address add corresponding to the memory cells that are to be read, and selects them by means of wordline selection signals wl and bitline selection signals bl. The selected bitlines (normally, a packet of, e.g., eight or sixteen or more bit lines is selected at a time, depending on the degree of parallelism of the memory) are connected to a sense amplifier block 212. The sense amplifier block 212 receives memory cell current values corresponding to the states of the selected memory cells, and provides an amplified full-logic version thereof to a data output block 214, which is connected to the outside by means of the input/output pads 202.
Typically, the memory device 102 and the external microprocessor 104 exchange data through a bus, e.g. of 16 lines. Consequently, codes made up of more than 16 bits, e.g. the 64-bit code RND and the 64-bit unlock password des_data_crypt, are for example received in four steps, i.e. in chunks of 16 bits per step.
The memory device 102 includes a code generator, particularly a random number generator block 245, for generating the code, e.g. the 64-bit random number RND used during the dialoguing sequence 100 between the memory device 102 and the external microprocessor 104, and a 64-bit latches block 248, connected to the random number generator block 245, whose purpose is to temporarily store the random number RND.
The memory device 102 further includes a lock/unlock block 234, adapted to manage the protection of the memory zones 108 and to allow/inhibit access thereto according to their protection status. In particular, the lock/unlock block 234 is adapted to check if a received address add corresponds (i.e., falls in a range of addresses corresponding) to a protected memory zone 108, and in the affirmative case to inhibit the access to the data stored in the addressed memory cells, for example by controlling the output block 214 so as to selectively enable/disable the transfer of the read data from the sense amplifier 212 to the input/output pads 202.
As already pointed out, when the external microprocessor 104 sends the unlock_pwd_cmd command, the CUI 205 decodes it, and asserts a signal load_data_crypt to a 64-bit latches block 220, connected to the input block 204 through a bus of, e.g., 16 lines, whose purpose is to reconstruct and temporarily store the password des_data_crypt received from the external microprocessor 104 in chunks of, e.g., 16 bits. Particularly, the signal load_data_crypt allows the sequential storing into the 64-bit latches block 220 the four 16-bit words forming the 64-bit password des_data_crypt by exploiting two address bits add<1:0>, e.g. the least significant bits, provided by the input block 204. In this way, after four steps, the entire 64-bit password des_data_crypt is stored and available in the 64-bit latches block 220.
During the storage of the last 16-bit word of the password des_data_crypt, the CUI sends a signal run_mcr to an oscillator block 222, adapted to generate a clock signal clk, and to an internal microcontroller 228, responsible of the management of operations necessary to the functioning of the memory device 102. The signal run_mcr causes the internal microcontroller 228 and the oscillator block 222 to start. The clock signal clk is the time base for the operations of the internal microcontroller 228, and of a DES block 229 including an ensemble of circuital elements (and, possibly, program instructions) adapted to implement the encryption/decryption operations of a DES algorithm.
The internal microcontroller 228 includes a ROM 230, wherein all the instructions necessary to its operation are stored.
After having been started, the internal microcontroller 228 first resets a counter block 232, by means of a signal res_addcnt. The counter block 232 generates address codes key add for addressing the locations of the memory matrix 106 wherein the decryption key necessary to decrypt the password des_data_crypt is stored. When the counter block 232 is reset, the decoder block 210 is driven in such a way to cause selection of the first location of the memory matrix 106 wherein the decryption key is memorized; the counter block 232 increments the count to select the successive locations containing the decryption key.
Subsequently, the internal microcontroller 228 asserts a signal dis_read_out (e.g., to the high logic level) provided to the lock/unlock block 234. By asserting the signal dis_read_out, the decryption key, read out from the memory matrix 106, is prevented from being made available at the memory device's output pads, and the key is thus rendered invisible from the outside, protecting it from undesired electronic piracy acts. There is no way or path to drive the decryption key out of the memory device, because it is readable only by the internal microcontroller 228 thereof.
At this point, the internal microcontroller 228 asserts a signal read_key (e.g., active high) to the decoder block 210, thereby activating it, to start the reading of the decryption key. A latches block 236 is provided for storing the decryption key read out from the memory matrix 106. The latches block 236 is activated by a signal load_key, generated by the internal microcontroller 228. As in the case of the password des_data_crypt received from the outside, the decryption key (e.g., 64 bits long) may be read out and stored in the latches block 236 in more than one step. Particularly, the counter block 232 is sequentially incremented by means of a signal in_cnt, provided by the internal microcontroller 228, in such a way to cause the decoder block 210 to select in succession the locations of the memory matrix 106 wherein the different portions of the key are stored. Each portion of the key is sequentially conveyed to the latches block 236 through a bus of lines data_key, e.g. of 16 lines, connecting the sense amplifier block 214 to the latches block 236. As in the case of the password des_data_crypt, the latches block 236 operates by means of values taken by a code add_int<1:0> (e.g., of 2 bits) provided by the counter block 232, and corresponding for example to the least significant bits of the address of the locations storing the key. When the last portion of the decryption key stored in the memory matrix 106 has been read out and loaded into the latches block 236, the counter block 232 signals those to the internal microcontroller 228, by asserting a signal last_add.
Responsive to the signal last_add, the internal microcontroller 228 activates the DES block 229, asserting a signal rst_global_n (e.g., to the high logic value).
Under the control of the internal microcontroller 228, the DES block 229 loads the decryption key and the password des_data_crypt. In particular, the internal microcontroller 228 then asserts a signal key_req to cause the DES block 229 to load the decryption key stored in the latches block 236, and asserts a signal des_req to cause the DES block 229 load the password des_data_crypt stored in the latches block 220.
Once the decryption key and the password des_data_crypt have been loaded, the DES block 229 starts a decryption process, during which the internal microcontroller 228 and a comparator block 240 are set in a “waiting” state. The decryption process produces a (e.g., 64-bit) code des_data_decrypt representing a decrypted version of the unlock password; in particular, in the exemplary embodiment of the invention herein described, such a decryption process includes decrypting the received encrypted password des_data_crypt using the decryption key according to a sequence of mathematical operations implementing the DES algorithm. When the decryption process ends, the DES block 229 notifies the internal microcontroller 228 and the comparator block 240 by asserting a signal des_status (e.g., at the high logic value). The decrypted password des_data_decrypt, generated by the decryption process, is subsequently fed to the (e.g., 64-bit) comparator block 240. Then, the internal microcontroller 228 resets the DES block 229, by deasserting a signal rst_global (e.g., to the low logic value).
The comparator block 240 also receives the random number RND stored in the latches block 248.
The comparator block 240 compares the decrypted password des_data_decrypt and the random number RND. If the decrypted password des_data_decrypt coincides with the random number RND, the comparator block 240 asserts (to the high logic value) a signal data_decrypt_eq_md to inform the internal microcontroller 228 of the successful outcome of the comparison. The memory device has in this way ascertained that the external microprocessor 104 possesses the correct encryption key, equal or corresponding to the key used by the DES block 229 included in the memory device 102. In this case, the internal microcontroller 228 asserts, e.g. to the low logic value, a signal pwd_unlock_read, that is normally kept deasserted, thus instructing the lock/unlock block 234 to drive the output block 214 so as to enable the data transfer from the sense amplifier block 212 to the input/output pads 202. The external microprocessor 104 is thus authorized to read the data stored in the protected memory zone 108, in particular data stored in the location(s) corresponding to the address add.
If instead the signal data_decrypt_eq_rnd is set to the low logic value, meaning that the number des_data_decrypt and the random number RND are not equal, the memory device 102 preferably signals to the external microprocessor 104 that the unlock request has not been successful, for example by issuing a fail code (not shown in the figures) sent to the external microprocessor 104. In this case the signal pwd_unlock_read is kept deasserted, so the lock/unlock block 234 continues to inhibit the data transfer by the output block 214 from the sense amplifier block 212 to the input/output pads 202. This situation may typically arise in case the external microprocessor 104 does not have the authorization to obtain the reading of the data stored in the memory matrix 106 corresponding to the address add, not possessing the correct encryption key. Another situation in which this may occur is a possible corruption of the exchanged data (code RND, unlock password) between the memory device and the external microprocessor, for example due to disturbs. The external microprocessor 104 may retry (e.g., for a limited number of times) to be granted the read access authorization to the memory matrix 106, repeating the unlocking process (for example, requesting a new code RND from the memory device 102).
The output block 214 and the lock/unlock block 234 will be now described in greater detail referring to FIG. 3 according to an embodiment of the present invention.
The output block 214 is connected to the sense amplifier block 212 and to the input/output pads 202. The output block 214 also receives three further logic signals from the lock/unlock block 234: a signal salatch_int, a signal data_freeze, and a signal oen_int. The lock/unlock block 234 interacts with the output block 214 by means of these three signals, in such a way to selectively enable the data transfer to the input/output pads 202.
The output block 214 includes three sub-blocks 302, 304, 306 receiving the signal salatch_int, the signal data_freeze, and the signal oen_int, respectively.
It is noted that the bus connecting the sense amplifier block 212 to the input/output pads 202, is typically composed by a plurality (e.g., 16) of signal lines, each one conveying a single bit of a read data word. Consequently, each one of the three sub-blocks 302, 304, 306 is to be intended as replicated a proper number of times, e.g. 16 times.
The sub-block 302 includes a transmission gate 310, having an input terminal connected to the sense amplifier block 212 and an output terminal connected to the input of a latch 312, for example formed by two logic NOT gates 314, 316. According to the shown example, the transmission gate 310 is of a complementary driving type (adapted to efficiently transfer both high and low logic values). An active-low control terminal receives the signal salatch_int, while an active-high control terminal receives the logic complement of the signal salatch_int, provided by a further logic NOT gate (a logic inverter) 318 receiving the signal salatch_int.
Similarly to the sub-block 302, the sub-block 304 includes a transmission gate 320, having an input terminal connected to the output of the latch 312 and an output terminal connected to the input of a further latch 322 (constituted by two logic NOT gates 324, 326). The active-low control terminal of the transmission gate 320 receives the signal data_freeze, while the active-high control terminal receives the logic negation of the signal data_freeze, provided by a further logic NOT gate 328 receiving the signal data_freeze.
The sub-block 306 includes a tri-state output buffer or driver 330, whose output terminal (that is, the terminal connected to the respective input/output pads 202) can be switched to high-impedance. Particularly, the output buffer 330 has an enable/disable terminal (active low) receiving the signal oen_int. Consequently, when the signal oen_int takes a high logic value, the output terminal connected to the input/output pads 202 is set to high impedance. On the contrary, the data can be conveyed to the input/output pads 202 when the signal oen_int takes a low logic value.
When the signal salatch_int assumes a high logic value, the transmission gate 310 blocks the transfer of data from the sense amplifier block 212 to the output buffer 330. In this case, the data which is provided to the input of the sub-block 304 is the one previously stored in the latch 312. On the contrary, when the signal salatch_int takes a low logic value, the transmission gate 310 is made conductive, and the data coming from the sense amplifier block 212 are latched into the latch 312, and can reach the sub-block 304.
In the same way, when the signal data_freeze assumes a high logic value, the transmission gate 320 is not conductive, blocking the transfer of data from the sub-block 302 to the output buffer 330. In this case, the data which is provided to the input of the output buffer 330 is the one previously stored in the latch 322. On the contrary, when the signal data_freeze takes a low logic value, the transmission gate 320 is made conductive, and the data coming from the sub-block 302 are latched into the latch 322, and can reach the input of the output buffer 330.
The lock/unlock block 234 includes a protection indicator structure 350, adapted to store indications of protection of the different memory zones 108 of the memory matrix 106. The protection indicator structure 350 includes a non-volatile register 352 comprising a first plurality of non-volatile memory elements 354 (for example, flash cells), and a volatile register 355 comprising a second plurality of volatile memory elements 356 (for example, latches); the number of volatile memory elements 356 in the second plurality corresponds, and may be equal, to the number of non-volatile memory elements 354 in the first plurality. Each non-volatile memory element 354 belonging to the non-volatile register 352 is coupled to a corresponding volatile memory element 356 belonging to the volatile register 355; the volatile register 355 is adapted to load a status stored in the non-volatile memory elements 354 in response to a signal p_on generated at each power-on of the memory device (for example, by a power-on reset circuitry) and each time the state of even a single one of the non-volatile memory elements 354 is modified. The protection indicator structure 350 further includes a multiplexer block 358 having a plurality of input lines, each one connected to a corresponding volatile memory element 356, and receives from the input block 204 an address portion ms_por, including part of the bits of the address add, in particular including the most significant bits, identifying the different memory zones. The multiplexer block 358 has an output line providing a logic signal add_int_prot to an input terminal of a two-inputs logic AND gate 360.
The logic AND gate 360 has another input terminal receiving the signal pwd_unlock_read, provided by the internal microcontroller 228. The logic AND gate 360 has an output terminal providing a signal disable to an input terminal of three logic OR gate 362, 364, 366.
The two-input logic OR gate 362 has another input terminal receiving a signal salatch, generated by an internal readpath control logic indicated as 270 in FIG. 2 and responsible of managing the timing of the read operations, particularly the sense amplifier block 212 and the output block 214, and an output terminal providing the signal salatch_int to control the transmission gate 310.
The two-inputs logic OR gate 364 has another input terminal receiving a signal on_n provided by internal readpath control logic 270, and an output terminal providing the signal data_freeze to control the transmission gate 320.
The three-inputs logic OR gate 366 has an input terminal receiving the signal dis_read_out from the internal microcontroller 228, a further input terminal receiving the signal oe_n from input buffer connected to pad OEN, and an output terminal providing the signal oen_int to the output buffer 330.
The signal salatch is asserted low in order to load into the latch 312 data coming from the output terminal of the sense amplifier block 212, for the subsequent transfer to the output buffer 330.
The signal on_n is asserted low in order to load into the latch 322 the data previously latched in the latch 312; this makes it possible to load into the latch 312 a new, successive data ready at the output terminal of the sense amplifier block 212.
The signal oe_n is asserted low in order to allow transferring the data previously latched in the latch 322 to the input/output pads 202; this makes it possible to load into the latch 322 the data previously latched in the latch 312.
Turning to the protection indicator structure 350, the number of non-volatile memory elements 354 and of volatile memory elements 356 is equal to the number n of memory zones 108 in which the memory matrix 106 is divided. Each such zone 108 is formed by a respective plurality of memory cells (the different memory zones 108 may have equal or different sizes, and thus they may include same or different numbers of memory cells), and can be either a protected zone, whereby if the external microprocessor 104 request a reading, the memory zone needs to be preliminary unlocked (as described in the dialoguing sequence 100), or it can be an unprotected zone, freely accessible at least in reading. In particular, information stored in one of the non-volatile elements 354 determines if the corresponding memory zone 108 is protected or not. Each non-volatile memory element 354 stores a single information bit: e.g., if the bit value is “1” (high logic value), the corresponding zone 108 of the memory matrix 106 is protected and access thereto (at least in reading) necessitates unlocking operations, otherwise (bit value equal to “0”, low logic voltage) the memory zone is unprotected.
At the memory device power on (and each time the state of even a single one of the non-volatile memory elements 354 is changed, the signal p_on is asserted to load the information stored in the non-volatile memory elements 354 into the corresponding volatile memory elements 356. In this way, the protection information bit is readily available for subsequent accesses.
The multiplexer block 358 selects one input line among the others n according to the portion ms_por of the address add received by e.g. the external microprocessor 104, and provides to the AND logic gate 360 the logic value stored in the corresponding volatile memory element 356 by means of the signal add_in_prot. The address add of each memory cell belonging to a same zone 108 has the same address portion ms_por value. Consequently, different memory zones 108 are identified by different values of the address portion ms_por.
Referring again to the dialoguing sequence 100, when the external microprocessor 104 executes the read(add) operation, the multiplexer 358 receives the address portion ms_por of the address add, and consequently the signal add_int_prot takes a high value (protected zone 108) if the bit stored in the corresponding volatile memory element 356 is “1”, or a low value (unprotected zone 108) if the bit stored in the corresponding volatile memory element 356 is “0”.
When the signal add_int_prot takes the low logic value, the signal disable is low. Consequently, the signal salatch_int assumes the same logic value as the signal salatch, the signal data_freeze takes the same logic value as the signal on_n; the signal oen_int assumes a logic value given by the logic OR operation between the two signals oe_n and dis_read_out.
When the signal add_int_prot takes the high logic value, the logic value assumed by the signal disable depends on the logic value assumed by the signal pwd_unlock_read. Particularly, if the logic value assumed by the signal pwd_unlock_read is high, the signal disable is high as well. Consequently, the signals salatch_int, data_freeze and oen_int assume the high logic value, irrespective of the logic values assumed by the signals salatch, on_n and oe_n; the data are not available at the input/output pads 202, thus the external microprocessor 104 can not read the data stored in the addressed memory cells. If the internal microcontroller 228 sets the signal pwd_unlock_read to the low logic value as a result of an unlocking operation, the signal disable assumes the low logic value, and the availability of the data stored in the addressed memory cells at the input/output pads 202 depends on the logic values assumed by the signals salatch, on_n and oe_n, as in the case an unprotected zone 108 is accessed. The signals salatch, on_n are driven by internal readpath control logic 270 according to a predetermined timing taking into account the evolution of the read operations.
Similar considerations apply if the output block 214 or the lock/unlock block 234 are implemented in different ways. In particular, the above-described concepts are also applicable when the output block 214 includes only one or two sub-blocks between the 302, 304, 306 ones, or the lock/unlock block 234 includes different logic gates absolving the same purposes.
It is pointed out that several alternatives to the embodiment described are possible. For example, the memory device may generate the code, e.g. the random number, and encrypt it, and then send the encrypted code to the external microprocessor; the external microprocessor has then to decrypt the received encrypted code and send back the decrypted code to the memory, which then performs a comparison between the generated code and the received code. Stated more generally, at least two encryption processes are performed on a code, e.g. on the random number generated by the memory device, one process at the memory device and another process at the external device wishing to be granted access thereto.
Referring now to FIG. 4, a simplified functional block diagram of the memory device 102 according to an embodiment of the present invention is illustrated, in which the functional blocks involved in a modify operation on the memory device are shown. The elements corresponding to those shown in the FIG. 2 are denoted with the same reference numerals, and their explanation is omitted for the sake of brevity.
The memory device 102 includes a modify protection indicator structure 405, similar to the protection indicator structure 350 used for indicating the protection status of the memory zones against read access, but adapted to store indications of protection against modify of the different memory zones 108 of the memory matrix 106. The modify protection indicator structure 405 includes a non-volatile register 408 comprising a first plurality of non-volatile memory elements 410 (for example, flash cells), and a volatile register 412 comprising a second plurality of volatile memory elements 414 (for example, latches); the number of volatile memory elements 414 in the second plurality corresponds, e.g., is equal, to the number of non-volatile memory elements 412 in the first plurality. Each non-volatile memory element 410 belonging to the non-volatile register 408 is coupled to a corresponding volatile memory element 414 belonging to the volatile register 412; the volatile register 412 is adapted to load a status stored in the non-volatile memory elements 410 in response to the signal p_on (that is generated at each power-on of the memory device and each time the state of even a single one of the non-volatile memory elements 410 is modified). The modify protection indicator structure 405 further includes a multiplexer block 416 having a plurality of input lines, each one connected to a corresponding volatile memory element 414, and receives the address portion ms_por (the same provided to the protection indicator structure 350), identifying the different memory zones. The multiplexer block 416 selects one among the non-volatile memory elements 410 according to the address portion ms_por, generates a corresponding logic signal add_int_prot_wr, providing it to the CUI 205, whose logic state defines whether the associated memory zone is protected or not against modification. Even in this case, the number of non-volatile memory elements 410 and of volatile memory elements 414 is equal to the number n of memory zones 108 in which the memory matrix 106 is divided. Each such zone 108 can be either a protected zone, whereby if the external microprocessor 104 request a modify operation, the memory zone needs to be preliminarily unlocked (upon the provision of a correct password, or by means of an unlocking sequence analogous to that exploited for the reading), or it can be an unprotected zone, freely accessible in modify. In particular, information stored in one of the non-volatile elements 410 determines if the corresponding memory zone 108 is protected or not. Each non-volatile memory element 410 stores a single information bit: if the bit value is “1” (high logic value), the corresponding zone 108 is protected against modify, otherwise (bit value equal to “0”, low logic voltage) the memory zone is unprotected against modify.
In an embodiment of the present invention, the memory device 102 may implement several different types of protection for the memory locations; a configuration register 420 may be provided, adapted to store information regarding the way in which the memory zones 108 may be protected and/or unprotected (both in reading and in modify, e.g. in writing). As illustrated in FIG. 4, the configuration register 420 may include a plurality (in this example, four) One Time Programmable (OTP) flash cells 422, 424, 426, 428. The logic content of the OTP flash cells 422, 424, 426, 428 is made available by means of corresponding signals carried by signal lines, respectively a signal STD_PR_MODE_BIT, a signal PWD_PR_MODE_BIT, a signal READ_PR_EV_TIME and a signal READ_PR_EV_TIMEOUT. Each OTP flash cell corresponds to a particular protection type that can be chosen for protecting the memory zones; more particularly, the OTP flash cells 422 and 424 are dedicated to specifying the protection in modify, and the OTP flash cells 426 and 428 are dedicated to specifying the protection in reading. Either one or the other of the two modify protection mode may be selected, and the same occurs for the two read protection modes; thus, only one between the two OTP cells 422 and 424 and only one between the two OTP cells 426 and 428 may be set to the high logic value at a time.
If the OTP cell 422 (and thus, the signal STD_PR_MODE_BIT) is set to the high logic value, the memory zones 108 may be protected against modify by means of a “standard” protection mode, according to which a protected memory zone 108 may be unprotected, or an unprotected memory zone 108 may be protected, without the necessity of providing any password. Protecting/unprotecting a certain memory zone can be for example achieved by modifying the content of the respective volatile memory element 414.
An alternative, more secure protection type against modify, activated by setting the OTP cell 424 (and thus, the signal PWD_PR_MODE_BIT) to the high logic value is a “password” protection mode. In order for the external microprocessor to be granted the authorization of protecting/unprotecting against modify an unprotected/protected memory zone 108 it is necessary that the external microprocessor 104 provide a correct password. The password may be a static password, established once and for all, or a dynamic password, and the provision thereof to the memory device may follow a dialoging sequence similar to that described in FIG. 1.
Concerning the protection in reading, in an embodiment of the present invention two different protection types exist, one defining a temporary read access right, and the other defining an access right not limited in time. In particular, the two read protection types are associated with a respective one of the two OTP cells 426 and 428. If the OTP cell 426 is set (e.g. to the high logic value), once a memory zone protected in reading has been unprotected (by means of the unlocking sequence previously described in detail), it remains unprotected in reading as long as the memory device 102 is kept powered. If instead the OTP cell 428 is set, the unlocking operations sequence for unprotecting a memory zone provides only a temporary authorization (e.g., lasting a few milliseconds) to read the locations belonging to the protected memory zone which has been unprotected.
The memory device 102 further includes a protection/unprotection structure 430 adapted to manage the operations for forbidding/allowing the protection/unprotection status of the memory zones 108 against modify. The protection/unprotection structure 430 includes a first logic block 432 and a second logic block 434. The logic block 432 receives the pair of signals READ_PR_EV_TIMEOUT and READ_PR_EV_TIME from the configuration register 420 and the signal pwd_unlock_read from the internal microcontroller 228, and generates a signal disable_pr_sp_fm_read, that is fed to the logic block 434. The logic block 434 further receives the signal PWD_PR_MODE_BIT from the configuration register 420 and a signal pwd_unlock_mod provided by the internal microcontroller 228, and provides to the CUI 205 a signal disable_pr_sp_mod. The CUI 205 further receives the signal STD_PR_MODE_BIT from the configuration register 420.
When the external microprocessor 104 wishes to modify the content of a memory location belonging to a protected memory zone 108, for example for writing data thereinto, the modify protection indicator structure 405 sets the signal add_int_prot_wr to a (high) logic value identifying the protection status of the accessed location, and the memory device 102 denies the access thereto; the external microprocessor 104 sends a command pr_sp_com to the CUI 205 for triggering the operations needed for unprotecting the memory zone 108 to which the addressed memory cell belongs (the same command pr_sp_com or a similar command may be exploited by the external microprocessor 104 for instructing the memory device 102 to protect an addressed memory zone 108 that is unprotected).
If the signal STD_PR_MODE_BIT is asserted, i.e., if the memory device 102 is in the standard protection mode, the CUI 205 accepts the command pr_p_com without the need of any password from the external microprocessor, and gives to the internal microprocessor instructions for unprotecting (or protecting) the memory zone. More particularly, if the accessed memory zone 108 is protected, the CUI sends a command un_com to the internal microcontroller 228, instructing the latter to unprotect (in modify) the addressed memory zone 108; for example, the internal microprocessor may modify the value of the volatile element 414 in the protection indication structure. The external microprocessor 104 is thus authorized to modify the data stored into the addressed memory location.
Similarly, if the external microprocessor 104 wants to protect a memory zone 108, and sends to the memory a command to this end, the CUI sends a command pr_com to the internal microcontroller 228, instructing the latter in such a way to protect in modify the addressed memory zone 108; this may for example involve changing the state of the volatile element 414 associated with the selected memory zone.
If the signal STD_PR_MODE_BIT is not asserted, i.e., if the memory device 102 is not in the standard protection mode, the CUI 205 accepts the command pr_sp_com conditioned by the value taken by the signal disable_pr_sp_mod generated by the protection/unprotection structure 430. If the signal disable_pr_sp_mod is at the high logic value, the CUI 205 denies any command pr_sp_com received from the external microprocessor 104 when the signal add_int_prot_wr is at the high logic value. If the signal PWD_PR_MODE_BIT is at the high logic value, i.e., if the memory device 102 is in the password protection mode, the signal disable_pr_sp_mod is asserted to the high logic value by the logic block 434, and persists on the high logic value until the memory device 102 has granted to the external microprocessor 104 the access authorization. For this purpose, the memory device 102 is capable of verifying the correctness of a password sent by the external microprocessor 104 (either a static password, established once and for all, or a dynamic password, exchanged according to the protocol depicted in FIG. 1). When the correct password has been received, the internal microcontroller 228 asserts to the high logic value the signal pwd_unlock_mod, providing it to the logic block 434. In this way, the signal disable_pr_sp_mod is forced to the low logic value by the logic block 434, and the command pr_sp_com is accepted by the CUI 205. The internal microcontroller 228 thus can unprotect the selected memory zone, so that the external microprocessor 104 can modify the data stored into the addressed memory location (or, alternatively, the internal microcontroller 228 may protected the selected memory zone).
As previously mentioned, according to an embodiment of the present invention, an increased security against unauthorized attempts of modifying the modify protection status of the memory zones 108 is implemented by making the protection in modify dependent from that in reading. In greater detail, in order to modify the modify protection status of an addressed memory zone 108 it is not sufficient to verify the correctness of a password provided by the external microprocessor 104 (pwd_unlock_mod to the high logic value), but it is additionally required that the external microprocessor 104 has also obtained in advance the authorization to access in reading the same protected memory zone 108. For this purpose, the logic block 432 asserts the signal disable_pr_sp_fm_read to the high logic value when at least one of the two signals READ_PR_EV_TIMEOUT or READ_PR_EV_TIME is at the high logic value; as long as both the signal disable_pr_sp_fm_read and the signal PWD_PR_MODE_BIT are at the high logic value, the logic block 434 maintains the signal disable_pr_sp_mod asserted to the high logic value too, denying any command pr_sp_com. In these conditions, the logic block 432 sets the signal disable_pr_sp_fm_read to the low logic value only if the signal pwd_unlock_read is set to the low logic value too, i.e., if an unlocking sequence (FIG. 1) directed to grant the external microprocessor 104 access rights to read the locations of the addressed memory zone has been successfully executed.
Additionally, other protection modes may be implemented in alternative to or in combination with those previously cited, each one selectable by setting corresponding additional OTP cells of the configuration register.
For example, the access, both in reading and in modify, to the selected memory zones may require the use of particular voltage levels (different from those normally adopted for representing the high and low logic values) to be applied to pre-established device terminals.
Moreover, an additional protection mode may be implemented, according to which it may be possible to add new protected memory zones (freely or upon the verify of a password), but it is not possible to unprotect in modify the memory zones already protected.
Referring to FIG. 5, an exemplary application of one or more embodiments of the present invention is illustrated. In particular, FIG. 5 shows a simplified block diagram of an electronic system, for example a set-top box apparatus adapted to cable or satellite or digital terrestrial television, or a DVD player/recorder, or a mobile communications terminal.
The memory device 102 interacts with the external microprocessor 104 by means of a bus of lines 505. The external microprocessor 104 includes an input terminal for receiving, for example, a TV signal IN provided by an antenna or a TV-cable 508, and an output terminal for providing, for example, a TV signal OUT to a TV set 510. The external microprocessor 104 is also connected to a plurality of communication ports, for example a serial port RS232 514, a modem device 515, and a smartcard reader 516. The system may include other peripherals, such as one or more RAM modules, human interface devices (e.g. a keyboard, a display device, a loudspeaker, remote-control input port).
According to a proposed access protocol according to an embodiment of the invention, it is possible to protect reserved code/data stored in the memory device 102 from unauthorized reading. Referring for example to a DVD classic consumer system, the memory device 102 may store in a protected zone thereof the instructions of a new and efficient algorithm of compression which could give advantages in speed or cost of the system. Given that the same memory device 102 may be used in different DVD systems, it may be necessary to shield the data stored therein in an effective way. In the application of set-top box, the security features provided by one or more embodiments of the present invention give the advantage to protect reserved information made available in the system by a service provider. In this case, the additional security provided makes more difficult an unauthorized copying of firmware, thus protecting the interests of the service provider itself.
In summary, the methods and architectures described in the above embodiments allow restricting the access, both in reading and modify, to selected memory zones of the memory device. For obtaining the reading access, the architecture exploits a control logic, e.g. a microcontroller embedded in the memory device, in order to manage an unlock protocol based on the exchange of a dynamic password based on a time-varying code, particularly a random number, which is then properly encoded. The architecture calls for using a random number generator, an encryption/decryption system, and a system adapted to inhibit the transfer of data stored in the memory to the outside in the case access to protected memory locations is attempted without having the necessary access rights. For obtaining the access in modify, or for changing the status of protection in modify of a selected memory zone, according to a first embodiment, the architecture is capable of managing an unlock protocol similar to that employed for obtaining the reading access. Otherwise, according to a second embodiment, for an increased security, any modification in the status of modify protection of a selected memory zone may be conditioned to the result of unlock operations directed to obtain the reading access to the locations of the selected memory zone.
Naturally, in order to satisfy local and specific requirements, a person skilled in the art may apply to the solution described above many modifications and alterations all of which, however, are included within the spirit and scope of the invention.

Claims

1. A memory device including:

at least one storage area for storing data;

a protection control structure adapted to selectively allow an external device access to the at least one storage area of the memory, the storage area being not freely accessible by the external device if protected;

a control logic adapted to identify an access request by the external device to the at least one storage area and cooperating with the protection control structure for managing an unlock procedure for selectively granting the external device at least temporary access rights to the storage area if protected;

means for providing a first code to the external device in said unlock procedure;

means for receiving a second code from the external device in response to said first code;

means for verifying validity of the received second code, wherein said means for verifying validity are adapted to ascertain a correspondence of the second code with the first code based on a predetermined relationship;

said control logic instructing the protection control structure to grant access to the storage area if the validity of the received second code has been verified.

2. The memory device of claim 1, further including:

encryption means adapted to perform at least one encryption process on at least one among said second code, to obtain a third code, or a fourth code, to obtain the first code.

3. The memory device according to claim 2, in which said means for verifying includes means for comparing the third code with the first code, or the second code with the fourth code, and for providing a comparison result,

said control logic instructing the protection control structure to grant access to the storage area based on said comparison result.

4. The memory device according to claim 2, in which said encryption means includes an encryption block for performing the encryption process exploiting the second code and a predetermined encryption key.

5. The memory device of claim 4, in which said encryption key is stored in the memory device, particularly in the at least one storage area thereof.

6. The memory device of claim 1, in which said means for providing the first code includes a code generator, particularly a random number generator adapted to generate a random number.

7. The memory device claim 1, in which said protection control structure includes a protection indication storage structure comprising a non-volatile part, for storing in non-volatile way protection indications in respect of the at least one storage area.

8. The memory device of claim 7, in which the protection indication storage structure comprises a volatile part, associated with the non-volatile part and adapted to be loaded with the protection indications stored in the non-volatile part.

9. The memory device according to claim 1, in which said at least one storage area includes at least two storage areas, said protection control structure being adapted to control the access to each storage area individually.

10. The memory device of claim 1, further including:

output terminals for transferring data to the external device; and

an output block, controlled by the protection control structure, for selectively making the data stored in the at least one storage area available at the output terminals according to said comparison result.

11. The memory device of claim 10, wherein the protection control structure controls the output block to make the data stored in the at least one storage area available at the output terminals if the validity of the second code is ascertained.

12. An access protocol to allow access to a memory device by an external device, the access protocol including:

receiving at the memory device an access request to a selected storage area by the external device;

in case the selected storage area is not a freely accessible area, performing an unlock procedure including:

having the memory issuing to the external device a first code;

at the external device, receiving the first code and, responsive thereto, sending to the memory device a second code depending on the first code;

at the memory device, at least temporarily unlocking the selected storage area to allow access thereto by the external device based on the received second code.

13. The access protocol of claim 12 further including:

at the external device, performing a first encryption process on the first code to obtain the second code,

wherein said at least temporarily unlocking includes performing at least one second encryption process on at least one among said second code, to obtain a third code, or a fourth code, to obtain the first code.

14. The access protocol of claim 13, in which said performing at least one second encryption process includes:

performing the at least one second encryption process on the received second code to obtain a third code, and temporarily unlocking conditioned by a comparison of the third code to the first code.

15. The access protocol of claim 14, wherein said allowing the external device accessing the selected storage area includes establishing an identity of the third code to the first code.

16. The memory device of claim 13, in which said temporarily unlocking is conditioned by a comparison of the received second code with a fourth code, said fourth code being used by the memory device for generating the first code by performing the at least one second encryption process.

17. The access protocol according to claim 13, in which said performing the first encryption process includes exploiting a predetermined first encryption key.

18. The access protocol according to claim 17, in which said performing the at least second encryption process exploiting a predetermined second encryption key.

19. The access protocol according to claim 18, in which said second encryption key is stored in the memory device.

20. The access protocol according to claim 12, in which said issuing to the external device a first code includes generating a random number code.

21. The access protocol of claim 12, wherein said at least temporarily unlocking the selected storage area to allow access thereto includes allowing the external device read a content of the selected storage area.

22. An electronic device adapted to interact with a memory device according to claim 1, including:

means for issuing an access request to the memory device;

means for receiving the first code from the memory device;

means for generating the second code based on the received first code; and

means for sending the second code to the memory device.

23. An electronic system including:

a memory device adapted to store data, and at least one external device interacting with the memory device;

wherein the memory device includes:

at least one storage area for storing data;

said control logic instructing the protection control structure to grant access to the storage area if the validity of the received second code has been verified;

and wherein the external device includes:

means for issuing an access request to the memory device;

means for receiving the first code from the memory device;

means for generating the second code based on the received first code; and

means for sending the second code to the memory device.

24. A memory device including:

at least one storage area for storing data;

a read protection control structure adapted to selectively allow an external device external to the memory read access to the at least one storage area of the memory for reading an information content thereof, the storage area, if protected against reading, being not freely accessible in reading by the external device;

a modify protection control structure adapted to selectively allow the external device modify access to the at least one storage area of the memory for modifying the information content thereof, the storage area, if protected against modify, being not freely accessible in modify by the external device;

a control logic adapted to identify a read access request, respectively a modify access request from the external device to the at least one storage area, and adapted to cooperate with the read protection control structure and with the modify protection control structure for managing a procedure for selectively granting the external device at least temporary read access rights and, respectively, a procedure for selectively granting the external device at least temporary modify access rights to the storage area;

wherein said control logic, in said procedure for selectively granting the external device modify access rights, is adapted to condition the granting of said modify access rights to the granting of the read access rights to the storage area.

25. The memory device according to claim 24, in which the control logic further includes:

a stored first code;

means for receiving a second code from the external device in response to said read access request;

means for verifying a validity of the received second code by ascertaining a correspondence of the second code with the first code based on a predetermined relationship, the control logic being adapted to instruct the read protection control structure to grant the external device read access rights to the storage area if the validity of the received second code has been verified.

26. The memory device according to claim 25, in which said first code and said second code are a predefined password.

27. The memory device according to claim 25, further including:

means for generating the first code; and

means for providing the first code to the external device, the second code being generated by the external device in response to said first code.

28. The memory device according to claim 25, in which the control logic further includes:

a stored third code;

means for receiving a fourth code from the external device in response to said modify access request;

means for verifying a validity of the received fourth code by ascertaining a correspondence of the fourth code with the third code based on a predetermined relationship, the control logic instructing the modify protection control structure to grant the external device modify access rights to the storage area if the validity of the received fourth code has been verified.

29. The memory device according to claim 28, in which said third code and said fourth code are a predefined password.

30. The memory device according to claim 28, further including:

means for generating the third code; and

means for providing the third code to the external device, the fourth code being generated by the external device in response to said third code.

31. The memory device according to claim 28, wherein the control logic includes means for instructing the modify protection control structure to grant the external device modify access rights to the storage area if the validities of the received second code and of the received fourth code have been both verified.

32. An integrated circuit, comprising:

a memory location operable to store data; and

a control circuit operable to,

send a first code value to a requestor external to the integrated circuit in response to a request from the requestor to access the memory location,

receive a second code value from the requester after sending the first code value,

compare the second code value to a predetermined code value, and

allow the requestor to access the memory location if the second code value has a predetermined relationship to the predetermined code value.

33. The integrated circuit of claim 32, further comprising:

a random-number generator coupled to the control circuit; and

wherein the control circuit is further operable to

cause the generator to generate a random number, and

send to the requestor the random number as the first code value.

34. The integrated circuit of claim 32, further comprising:

a random-number generator coupled to the control circuit;

a data-encryption circuit coupled to the random-number generator and to the control circuit; and

wherein the control circuit is further operable to

cause the generator to generate a random number,

cause the data-encryption circuit to encrypt the random number using a predetermined encryption key, and

send to the requestor the encrypted random number as the first code value.

35. The integrated circuit of claim 32, further comprising:

a data-encryption circuit coupled to the control circuit; and

wherein the control circuit is further operable to

cause the data-encryption circuit to encrypt a value using a predetermined encryption key, and

send to the requestor the encrypted value as the first code value.

36. The integrated circuit of claim 32, further comprising:

a data-decryption circuit coupled to the control circuit; and

wherein the control circuit is operable to compare the second code value to the predetermined code value by

causing the data-decryption circuit to decrypt the second code value received from the requestor using a predetermined decryption key, and

comparing the decrypted second code value to the predetermined code value.

37. The integrated circuit of claim 32 wherein the predetermined code value equals the first code value.

38. The integrated circuit of claim 32 wherein the control circuit is further operable to prohibit the requestor from accessing the memory location if the second code value does not have the predetermined relationship to the second code value.

39. An integrated circuit, comprising:

protected memory locations operable to store data; and

a control circuit operable to,

receive from a requestor external to the integrated circuit a first request for a first type of access to a first one of the memory locations, and

in response to the first request, enable the first memory location for the first type of access by the requestor if one of the memory locations is enabled for a second type of access by the requester.

40. The integrated circuit of claim 39 wherein:

the first type of access to the first memory location comprises a read of the data from the first memory location; and

the second type of access to the one of memory locations comprises a write of the data to the one of the memory locations.

41. The integrated circuit of claim 39 wherein the control circuit is operable to enable the one of the memory locations for the second type of access by:

sending a first code value to the requestor in response to a request from the requestor for the second type of access to the one memory location,

receiving from the requestor a second code value after sending the first code value,

comparing the second code value to a predetermined code value, and

enabling the one memory location for the second type of access by the requestor if the second code value has a predetermined relationship to the predetermined code value.

42. The integrated circuit of claim 39 wherein the control circuit is further operable in response to the first request to disable the first memory location for the first type of access by the requester if none of the memory locations is enabled for the second type of access by the requester.

43. The integrated circuit of claim 39 wherein the control circuit is operable to enable the first memory location for the first type of access by the requestor only if the first memory location is enabled for the second type of access by the requester.

44. An integrated circuit, comprising:

a code-value generator; and

a control circuit coupled to the code-value generator and operable to

send an address to a destination external to the integrated circuit,

request a first code value from the destination,

cause the generator to generate a second code value from the first code value,

send the second code value to the destination, and

access a data-storage location of the destination corresponding to the address after sending the second code value.

45. The integrated circuit of claim 44 wherein the control circuit is operable to cause the generator to generate the second code value by causing the generator to encrypt the first code value using a predetermined encryption key.

46. The integrated circuit of claim 44 wherein the control circuit is operable to cause the generator to generate the second code value by causing the generator to decrypt the first code value using a predetermined decryption key.

47. The integrated circuit of claim 44 wherein the control circuit is operable to access the data-storage location of the destination by writing data to the data-storage location.

48. The integrated circuit of claim 44 wherein the control circuit is operable to access the data-storage location of the destination by reading data from the data-storage location.

49. An integrated circuit, comprising:

a control circuit operable to access in a first manner a first one of a plurality of memory locations that are external to the integrated circuit by

obtaining first authorization to access one of the memory locations in a second manner,

obtaining second authorization to access the first one of the memory locations in the first manner, and

accessing the first one of the memory locations in the first manner after obtaining the first and second authorizations.

50. The integrated circuit of claim 49 wherein the control circuit is operable to obtain the first authorization to access the first one of the memory locations in the second manner.

51. The integrated circuit of claim 49 wherein:

obtaining the second authorization comprises obtaining the second authorization to write data to the first memory location; and

obtaining the first authorization comprises obtaining the first authorization to read data from the one memory location.

52. An electronic system, comprising:

a first integrated circuit; and

a second integrated circuit coupled to the first integrated circuit and including

a memory location operable to store data, and

a control circuit operable to,

send a first code value to the first integrated circuit in response to a request from the first integrated circuit to access the memory location,

receive a second code value from the first integrated circuit after sending the first code value,

compare the second code value to a predetermined code value, and

allow the first integrated circuit to access the memory location if the second code value has a predetermined relationship to the predetermined code value.

53. An electronic system, comprising:

a first integrated circuit; and

memory locations operable to store data, and

a control circuit operable to,

receive from the first integrated circuit a first request for a first type of access to a first one of the memory locations, and

in response to the first request, enable the first memory location for the first type of access by the first integrated circuit if one of the memory locations is enabled for a second type of access by the first integrated circuit.

54. An electronic system, comprising:

a first integrated circuit having a data-storage location; and

a code-value generator, and

a control circuit coupled to the code-value generator and operable to

send an address of the data-storage location to the first integrated circuit,

request a first code value from the first integrated circuit,

cause the generator to generate a second code value from the first code value,

send the second code value to the first integrated circuit, and

access the data-storage location after sending the second code value.

55. An electronic system, comprising:

a first integrated circuit having memory locations; and

a control circuit operable to access in a first manner a first one of the memory locations by

56. A method, comprising:

sending a first code value to a first integrated circuit in response to a request for access by the first integrated circuit to a memory location of a second integrated circuit;

comparing a predetermined code value to a second code value generated by the first integrated circuit in response to the first code value; and

allowing the first integrated circuit to access the memory location of the second integrated circuit if the second code value has a predetermined relationship to the predetermined code value.

57. The method of claim 56 wherein sending the first code value comprises sending the first code value from the second integrated circuit to the first integrated circuit.

58. The method of claim 56 wherein comparing the predetermined code value to the second code value comprises:

retrieving the predetermined code value from a memory location of the second integrated circuit; and

comparing the predetermined code value to the second code value using a circuit disposed on the second integrated circuit.

59. The method of claim 56, further comprising generating the first code value as a random number.

60. The method of claim 56, further comprising:

encrypting a value using a predetermined encryption key; and

generating the first code value equal to the encrypted value.

61. The method of claim 56 wherein comparing the predetermined code value comprises:

decrypting the second code value using a predetermined decryption key; and

comparing the decrypted second code value to the predetermined code value.

62. The method of claim 56, further comprising prohibiting the first integrated circuit from accessing the memory location of the second integrated circuit if the second code value does not have the predetermined relationship to the predetermined code value.

63. A method, comprising:

receiving from a first integrated circuit a first request for a first type of access to a first protected memory location of a second integrated circuit, and

in response to the first request, enabling the first memory location for the first type of access by the first integrated circuit if a protected memory location of the second integrated circuit is enabled for a second type of access by the first integrated circuit.

64. The method of claim 63, further comprising disabling the first memory location for the first type of access by the first integrated circuit if no protected memory locations of the second integrated circuit are enabled for the second type of access by the first integrated circuit.

65. The method of claim 63 wherein enabling the first memory location for the first type of access comprises enabling the first memory location for the first type of access by the first integrated circuit only if the first memory location is enabled for the second type of access by the requestor.

66. A method, comprising:

sending an address to a first integrated circuit;

requesting a first code value from the first integrated circuit;

generating a second code value from the first code value;

sending the second code value to the first integrated circuit; and

accessing a data-storage location of the first integrated circuit corresponding to the address after sending the second code value.

67. The method of claim 66 wherein a second integrated circuit sends the address, requests the first code value, generates the second code value, sends the second code value, and accesses the data-storage location.

68. A method, comprising:

obtaining a first authorization to access one of a plurality of protected memory locations in a first manner;

obtaining a second authorization to access a first one of the memory locations in a second manner; and

accessing the first one of the memory locations in the second manner after obtaining the first and second authorizations.

69. The method of claim 68 wherein obtaining the first authorization comprises obtaining the first authorization to access the first one of the memory locations in the first manner.