Micron Technology Incorporated

Corning Optical Communications LLC

Olivier Duval

Lance W Dover

Jeffrey Charles Shiner

Christopher Joseph Bueb

Tsung-Yi Chen

Hithesh Nama

Luca Porzio

Dionisio Minopoli

Paresh Bhaya

Ruibin Song

A security server to manage integrity of packages stored in an endpoint based on identity authentication implemented using security features of a memory device configured in the endpoint. For example, the security server validates identity data generated by the memory device based at least in part on a secret of the memory device. The server can extract, from the identity data, health information of a package stored in the endpoint and determined, based at least in part on the health information, whether or not to update or repair the package currently stored in the endpoint.

Monitor integrity of endpoints having secure memory devices for identity authentication

Apparatuses and methods related to concurrently measuring and executing images. An apparatus for concurrently measuring and executing images can include a memory device, a first processing resource and a second processing resource. The first processing resource can execute instructions stored in the memory device to execute a first portion of an image responsive to measuring the first portion of the image and execute a second portion of the image responsive to measuring the second portion of the image. The second processing resource can execute instructions stored in the memory device to measure the first portion of the image and measure the second portion of the image concurrently with an execution of the first portion of the image by the first processing resource.

Concurrent image measurement and execution

Methods, systems, and devices for command prioritization techniques for reducing latency in a memory system are described. In some examples, a host system may receive a set of commands from one or more virtual machines to access a common memory system. The host system may store the set of command in a command queue associated with the memory system and arrange the set of command according to order that is based on one or more identified pattern of accessing sequential addresses in the set of commands. The host system may transmit the set of command to the memory system based on the order and the memory system may execute the commands according to the order.

Command prioritization techniques for reducing latency in a memory system

Methods, systems, and devices for authenticating software images are described. Software images may include different portions (e.g., different versions, different users) that may be authenticated using hashes associated with an underlying data structure of the portion of the software image. In some examples, hashes (e.g., first hashes) associated with the software image may be generated and stored using a tree structure, such that a previous hash may be used when calculating a hash associated with a new portion of the software image. To authenticate a portion of the software image, a command may be issued, and a second hash may be calculated using the current data structure of the software image. The second hash may be compared to the associated first hash, and the software image may be authenticated based on the hashes matching.

Authenticating software images

A security server to provide security services over a computer network based on security features of memory devices connected to host systems. For example, the security features of a memory device can include a unique device secret, a cryptographic engine, and an access controller to implement access privileges represented by cryptographic keys. After receiving identity data that is generated by the memory device and represented by a cryptographic key, the security server can determine authenticity of the memory device based on its copy of the unique device secret of the memory device. The security server can generate a verification code for a command and cause the command and the verification code to be communicated to the memory device, where the access controller of the memory device validates the verification code in determining whether to block execution of the command in the memory device.

Online security services based on security features implemented in memory devices

Systems, methods and apparatuses to configure a computing device for identification and authentication are described. For example, a key management server (KMS) has a certificate generator and is coupled to a registration portal. A copy of secret implemented into a secure component during its manufacture in a factory is stored in the KMS. After leaving the factory, the component can be assembled into the device. The portal receives registration of the component and a hash of software of the device. The certificate generator generates, independent of the device, public keys of the device, using the copy of the secret stored in the KMS and hashes of the software received via the registration portal, and then sign a digital certificate of the public key of the device. Authentication of the device can then be performed via the private key of the device and the certified public key.

Onboarding software on secure devices to generate device identities for authentication with remote servers

Methods, systems, and devices for techniques for temperature-based access operations are described. A memory system may be configured to write temperature information to metadata during a write operation. The temperature information may indicate a temperature range within which the memory system may be during the write operation. The memory system may perform a corresponding read operation based on the temperature information written to the metadata and a temperature of the memory system during the read operation. A server may determine and indicate parameters associated with writing the temperature information to the metadata. Additionally, or alternatively, the server may indicate trim parameters for use in performing read operations based on temperature information received from the memory system. In some examples, the memory system may perform targeted refresh operations at locations based on temperature information stored associated with the locations.

Techniques for temperature-based access operations

Methods, systems, and devices for memory-aligned access operations are described. A target packet size based on a quantity of physical pages addressable by individual first-level pages of a first-level page table for mapping logical address to respective physical pages may be indicated to a host system. A buffer may be configured based on the target packet size and data for an application at the host system and associated with the target packet size may be stored in the buffer. Based on a utilization threshold of the buffer being reached, a set of data stored in the buffer and having the target packet size may be written to a memory device, where a set of physical addresses for storing the set of data may be identified based on a second-level entry of a second-level page.

Memory-aligned access operations

Methods, systems, and devices for modes to extend life of memory systems are described. In some examples a host system and a memory system may support one or more vendor commands to configure one or more logical units of the memory system to be accessible in a read-only mode. For example, the host system may periodically transmit a command to retrieve health information of the memory system. The host system may compare the health information to one or more thresholds associated with one or more host entities. If the health information satisfies a threshold for a host entity, the host system may transmit a command to the memory system to initiate a read-only mode for the logical units associated with the host entity. Additionally or alternatively, the memory system may track the health information and compare the health information to the one or more thresholds.

Modes to extend life of memory systems

A server system stores data associating a secret of the memory device configured in an endpoint, a first identification, and device information of the endpoint. After receiving a request to bind a second identification to the endpoint, the server system can tie identity data of the endpoint to the second identification. For example, after receiving a validation request containing identity data generated by the memory device, the server system can verify a verification code in the identity data based at least in part on the secret of the memory device. The verification code is generated from a message presented in the identity data and a cryptographic key derived at least in part from the secret. Based on validating the identity data, the server system can provide a validation response to indicate that the identity data is generated by the endpoint having the second identification.

Management of identifications of an endpoint having a memory device secured for reliable identity validation

A processing device writes file system data to a first area of a memory zone of a zoned block memory device based on a current position of a write pointer within the memory zone. The file system data comprises data files contained within a file system and file structure metadata describing a file structure of the file system. The processing device detects a write event based on the write pointer advancing past a predetermined memory address within the memory zone that corresponds to a checkpoint. The checkpoint is a second area within the memory zone that is designated for storing write event data. Based on detecting the write event, the processing device writes write event data to the checkpoint, the first write event data indicating a most recent memory address of a root node of the file structure within the memory zone.

Log-structured file system for a zoned block memory device

A system, method and apparatus to authenticate an endpoint having a secure memory device. For example, a card profile can be selected, configured, and/or stored into the secure memory device based on endpoint identity data representative of a component configuration of the endpoint, including the device identity representative of the memory device and other components. The card profile can be used by the endpoint to emulate a physical smart card and can be viewed a virtual smart card, such as a virtual subscriber identification module (SIM) card for accessing a cellular connection.

Virtual subscriber identification module and virtual smart card

A server system to onboard an endpoint having a host system connected to a host interface of a memory device for a cloud service without prior customization of the endpoint to identify an account for accessing the cloud service. For example, after receiving a request associated with the service and containing identity data generated by the memory device, the server system determines authenticity of the memory device and the endpoint based on a secret of the memory device and the identity data. In response to the request, the server system further identifies, based on the identity data, a subscriber among a plurality of subscribers based on ownership data of the endpoint. As a result of the identifying of the subscriber based on the identity data, the server system determines an account of the subscriber to provide the service to the endpoint based on the account.

Cloud-service on-boarding without prior customization of endpoints

Methods, systems, and devices for techniques for storing journaling information are described. A memory device may receive a first command to configure a circular buffer using memory cells of a nonvolatile memory device. The first command may include one or more labels associated with the circular buffer. The memory device may configure the circular buffer based at least in part on receiving the first command. The memory device may receive a second command to write journaling data to the nonvolatile memory device based at least in part on configuring the circular buffer. The second command may specify a label of the one or more labels. The memory device may generate an entry at a physical address indicated by a pointer of the circular buffer available to store the journaling data in the circular buffer based at least in part on the label specified by the second command.

Techniques for storing journaling information

A server system to customize firmware of an endpoint via an online firmware store in connection with validating authenticity of the endpoint. For example, a customized version of firmware can be ordered for the endpoint prior to the use of the endpoint. After receiving a request having identity data generated by a memory device configured in the endpoint, the server system can determine, based on a secret of the memory device, the authenticity of the endpoint having the current firmware. An update to firmware stored in the memory device and executed in the endpoint to generate the request is identified. The server system generates a verification code for a command executable in the memory device to perform the update. After receiving the command and the verification code, the memory device validates the verification code to determine whether to execute the command for firmware update.

Growing community of inventors

Pacifica, CA, United States of America

Olivier Duval