A security extension design for non-volatile memory is shown. There is an in-system program loaded into the non-volatile memory. A memory controller downloads the in-system program to a data register to provide base firmware code, a function pointer structure and security firmware code on the data register. The memory controller executes the base firmware code, and security functions of the security firmware code are called by the base firmware code through information recorded in the function pointer structure and thereby the memory controller is switched to operate the non-volatile memory at a higher security level. The security firmware code uses an application programming interface (API) and is compatible with multiple projects.