Replay Protected Memory Block (RPMB)
RPMB is introduced to store data in an authenticated memory area for the purpose of protecting data from a replay attack or avoiding unexpected data updates.
SD Specification Part 1 v9.0 defines how RPMB may be used on SD memory cards, either through the SD protocol over the SD interface or through the NVMe protocol over the PCIe interface on SD Express cards.
The use of RPMB through the NVMe interface in SD Express cards is the same as defined in NVMe standards.
RPMB function is using a shared secret key between hosts and card therefore it is expected to be used mainly for OEM products using specific cards with specific hosts.
A special allocated memory area is set in the SD card for the RPMB data – named RPMB Unit/Target. Access to this area is allowed only after authenticating the card using the RPMB protocol and secret keys.
RPMB feature allows cards to have:
- Secured Write Protect capability. RPMB restricts the use of the Write Protect features, Permanent Write Protect and Write Protect Until Power Cycle, to occur after performing RPMB authentication.
- Secured access to the boot partitions for updating or erasing the boot code saved in either of the two boot partitions.
Two popular usages for RPMB are:
- Software Version Authentication to Prevent a Downgrade Attack Software using RPMB
- Secure Boot Prevention of undesired, or hacked, code from running on a device
Newly added memory structure for Boot and RPMB
