Micron Technology Incorporated

Intel Corporation

Lodestar Licensing Group LLC

Lance W Dover

Olivier Duval

Jeffrey Charles Shiner

Aaron Preston Boehm

Steffen Buch

Zhan Liu

Giuseppe Ferrari

Giuseppe Vito Portacci

Peter Sean Feeley

Tommaso Vali

David Aaron Palmer

Steven E Wells

Yoav Weinberg

Robert N Hasbun

Nadav Grosz

John Rudelic

Jeremy Binfet

Paul D Ruby

Walter Di Francesco

V Niles Kynett

Travis Duane Nelson

Jim Cooke

William T Reaves

Antonino Mondello

Shekoufeh Qawami

Sanjay S Talreja

Robert E Larsen

Andrew H Gafken

Brent Ahlquist

Ramkarthik Ganesan

Michael Tex Burk

Chaitanya S Rajguru

Fabio Indelicato

Peter T Larsen

Ramadurai Rajagopal

Methods, systems, and devices for memory recovery partitions are described. A memory system may include a memory array configured with one or more logical partitions. In some examples, a primary boot image may be stored to a first logical partition and a recovery boot image may be stored to a second logical partition. During a boot operation, the memory system may determine whether the primary boot image includes one or more errors. If the primary boot image includes relatively few (or no) errors, the memory system may boot using the primary boot image. If the primary boot image includes a relatively high quantity of errors (e.g., higher than a threshold quantity of errors), the memory system may autonomously load a recovery boot image stored to the second logical partition.

Memory recovery partitions

A storage device includes a memory storage region and a controller having a processor. The processor retrieves user data from the memory storage region using a physical block address corresponding to a logical block address (LBA), in response to a read command. The retrieved user data includes a first hash received through a host interface in a prior host data transmission. The processor further performs error correction on the user data to generate error-corrected user data. The processor further causes a cryptographic engine to produce a second hash of the error-corrected user data. The first hash is compared to the second hash associated with the error-corrected user data to determine a match result. A notification is generated in response to the match result.

Cryptographic data integrity protection

A security server to manage integrity of packages stored in an endpoint based on identity authentication implemented using security features of a memory device configured in the endpoint. For example, the security server validates identity data generated by the memory device based at least in part on a secret of the memory device. The server can extract, from the identity data, health information of a package stored in the endpoint and determined, based at least in part on the health information, whether or not to update or repair the package currently stored in the endpoint.

Monitor integrity of endpoints having secure memory devices for identity authentication

Methods, systems, and devices for partitioned cryptographic protection for a memory system are described. The method may include a host system generating a command to update a protection attribute of a first set of memory cells of the memory system, where the memory system includes multiple sets of memory cells, each set associated with a respective set of one or more first keys. The method may further include encrypting the command based on a second key corresponding to a first key within the respective set of one or more first keys, and transmitting, after encrypting the command, the command to the memory system to update the protection attribute of the first set of memory cells.

Partitioned cryptographic protection for a memory system

The application relates to a secure memory device. The secure memory device includes a controller configured to decode and execute commands issued by a host device; a cryptographic engine, the cryptographic engine configured to authenticate a subset of the commands, the subset of the commands each including a digital signature; and a first monotonic counter, the first monotonic counter being incremented after executing at least some of the subset of the commands, wherein a value of the first monotonic counter is used to generate the digital signature.

Secure serial peripheral interface (SPI) flash

Methods, systems, and devices for authenticated reading of memory system data are described. In some examples, a host system and a memory system may exchange keys used to grant the host system access to one or more protected regions of the memory system. The keys may be symmetric or asymmetric. In some cases, the host system may transmit a read command to access data stored at a protected region of the memory system, along with a signature generated using the key associated with the protected region. The memory system may verify the signature to determine whether the host is authorized to access the protected region, and may transmit the requested data to the host system. In some examples, the memory system may sign the returned data, so that the host system may verify the source of the data.

Authenticated reading of memory system data

Methods, systems, and devices for authenticated modification of memory system data are described. A host system may transmit a command to program data to a protection region of a memory system, and the host system may sign the command using a key associated with the protection region. In some examples, the host system may transmit the data associated with the command, or the command may include instructions to move the data from another region of the memory system. Upon receiving the command, the memory system may verify the signature to determine whether the host is authorized to modify the protection region, and may program the data as requested by the host system. In some cases, the protection regions of the memory system may be updated, for example by adjusting the size or address range of the protection regions, in response to a command from the host system.

Authenticated modification of memory system data

In some implementations, a memory device may resolve a set of latches of a NAND page buffer to a set of initialized values. The memory device may obtain a NAND page buffer initialized data set from the set of initialized values of the set of latches. The memory device may generate a security key using the NAND page buffer initialized data set.

NAND page buffer based security operations

The disclosed embodiments are related to securely updating a semiconductor device and in particular to a key management system. In one embodiment, a method is disclosed comprising receiving a request for an activation code database from a remote computing device, the request including at least one parameter; retrieving at least one pair based on the at least one parameter, the pair including a unique ID (UID) and secret key; generating an activation code for the UID; and returning the activation code to the remote computing device.

Cloud-based creation of a customer-specific symmetric key activation database

Methods, systems, and devices for techniques for generating a shared secret for an electronic system are described. A memory system may identify an initial key pair and exchange a public key of the key pair with a public key associated with a server. The memory system and the server may each generate a shared secret. In some cases, the memory system and the server may use the shared secret to generate a device identifier for the memory system, for example by incorporating the device identifier into a cryptographic representation of a software layer of the memory system. The memory system and the server may use the device identifier to generate one or more asymmetric key pairs, which may be used by the server to authenticate the memory system.

Generating a shared secret for an electronic system

Methods, systems, and devices for host verification for a memory device are described. A memory device may receive a first value from a host device that is associated with an identification of the host device after an event. The memory device may transmit a second value to the host device that is based on the first value and comprises a random set of bits. The memory device may receive from the host device data or a command that comprises an encrypted third value that is based at least in part on the second value and a secret shared between the host device and the memory device. The memory device may also enable a functionality of the memory device based on the encrypted third value.

Host verification for a memory device

A security server to provide security services over a computer network based on security features of memory devices connected to host systems. For example, the security features of a memory device can include a unique device secret, a cryptographic engine, and an access controller to implement access privileges represented by cryptographic keys. After receiving identity data that is generated by the memory device and represented by a cryptographic key, the security server can determine authenticity of the memory device based on its copy of the unique device secret of the memory device. The security server can generate a verification code for a command and cause the command and the verification code to be communicated to the memory device, where the access controller of the memory device validates the verification code in determining whether to block execution of the command in the memory device.

Online security services based on security features implemented in memory devices

A system, method and apparatus to control memory devices over computer networks. For example, a server system establishes a secure authenticated connection with a client computer system. Over the connection, the server receives from the client computer system a request identifying a memory device and determine, based on data stored in the server system, that the client computer system is eligible to control the memory device. In response to a request from the client computer system, the server system generates a digital signature for a command using at least a cryptographic key stored in the server system in association with the memory device. The client computer system receives the digital signature from the server system and submits the command with the digital signature to the memory device. The memory device validates the digital signature prior to execution of the command.

Control of memory devices over computer networks using digital signatures generated by a server system for commands to be executed in the memory devices

Methods, systems, and devices for multi-factor authentication for memory systems based on internal asymmetric keys are described. In some examples, host systems and memory systems may be configured to implement techniques for the generation and distribution of asymmetric keys, certificates, or both, which may support evaluating the authenticity of interfacing systems (e.g., by signing and verifying exchanged signaling based on system identities) or protecting the integrity of exchanged signaling (e.g., by encrypting exchanged signaling), or both. Such techniques may include implementing asymmetric cryptographic security functionality directly in a memory system, including techniques where the memory system is configured to generate asymmetric key pairs, certificates, or both based on a combination of unique device secret and content stored at the memory system.

Multi-factor authentication for a memory system based on internal asymmetric keys

Data associated with a memory device may be authenticated before an associated operation is executed. The data may be authenticated before it is executed at a volatile memory. The data may be associated with a hash (e.g., a first hash) and may be communicated from the memory device to a host device. At the host device, the data and the first hash may be written (e.g., stored) to temporary storage, such as a cache. Once stored to the cache, the host device may generate an additional hash (e.g., a second hash) related to the data using a key inaccessible to the memory device. If the first hash and second hash match, the data may be authenticated and one or more operations may be executed.

Growing community of inventors

Fair Oaks, CA, United States of America

Lance W Dover