Introduction:

SD memory cards have occasionally been used as a replacement for embedded memory since they offer easier maintenance and serviceability in the field. Typically, these cards serve as memory expansion to complement a relatively small embedded memory.
The Part 1 of the Physical Layer Specification V9.0 (SD9.0) introduces new optional features for embedded to allow SD memory cards to replace any need for embedded memory:

  • Boot – Fast Boot and Secure Boot features give cards the ability to serve as a device’s boot code memory by using a simple and easy fast boot code uploading process, along with secured methods of providing boot code updates
  • RPMB – Replay Protected Memory Block offers a secured hidden memory accessible only through a secured authentication process and provides replay protection security mechanism: especially for a secured write-protect mechanism and secured boot code update
  • TCG Storage – A secured storage method defined by the Trusted Computing Group adding a self-encrypted drive capability

Two new multi-block transfer SD commands are defined to control RPMB and TGC

  • SECURE_RECEIVE (ACMD53)
  • SECURE_SEND (ACMD54)

New Regions in SD Memory Card Memory Map

  • There are two new boot partitions for supporting the Boot function
  • RPMB Target as a hidden memory area is accessible in a secured manner by using RPMB Unit authentication
Newly added memory structure for Boot and RPMB

White Paper:

Fast Boot Loading and Boot Code Update

  • The Fast Boot enables loading codes by utilizing UHS-I bus mode (SDR104)
  • Boot code in the boot partition can be updated in the secured manner
  • Host system is supposed to implement secure boot for loading operating system by checking trusted codes of from the specific SD memory card

RPMB Enabled Card (with Enhanced Write Protection)

  • Write Protect Until Power Cycle is defined in the CSD register
  • RPMB Enabled Card requires secured procedure to transit either of the write protection states:
    • Permanent Write Protect
    • Write Protect Until Power Cycle
  • The secured procedure consist of three steps:
    1. Execute RPMB authentication to access RPMB target
    2. By enabling write protection control in RPMB target, the two write protection bits in CSD can be set
    3. Setting either write protection bit in CSD makes the transition to one of the write protection states
Possible transitions between Write Protect modes

TCG(Trusted Computing Group)Security

The Trusted Computing Group (TCG) provides open standards for secure computing. TCG was adopted into storage devices mainly for self-encrypted drive (SED) applications. The TCG Storage protocol was already defined and proven.
MBR Shadowing provides higher security level

  • User area cannot be seen just after power up
  • User area becomes accessible after completion of pre-boot authentication

TCG storage performs two major functions

  • SED user data encryption/decryption by Advanced Encryption Standard (AES) automatically
  • User area access is controlled by Lock/Unlock

TCG Configuration for SD Memory Cards

  • Defined by the SD Extended Security Addendum Ver1.00
    • Reduced version of OPAL 2.01 to support a single admin
    • TCG security protocol over SD interface is realized via ACMD53 and ACMD54
    • TCG is not supported in UHS-II mode