1289results about "Unauthorized memory use protection" patented technology

Systems, devices, methods, and circuits for managing data security in storage devices. In one aspect, a storage device includes at least one memory device and a controller coupled to the at least one memory device. The controller is configured to: encrypt first data with a first type of cryptographic algorithm and encrypt second data with a second type of cryptographic algorithm. The first data is associated with a first security level, and the second data is associated with a second security level that is higher than the first security level. The second type of cryptographic algorithm has a greater encryption strength than the first type of cryptographic algorithm.

A computer system implements a unified framework integrating an adaptive elastic funnel (AEF) with a convergent intelligence fabric (CIF) for flexible and contextualized multi-agent AI and human collaboration at scale. The system provides a universal multi-modal key-value subsystem for sharing partial computations across agents, implements a hybrid greedy / non-greedy placement strategy for dynamic memory management, orchestrates dynamic computational workflows and tensor workflows using hierarchical tensor-fragment scheduling, enables cross-agent orchestration with policy-based privacy preservation, and incorporates quantum-resistant secure memory enclaves. The architecture supports continuous learning without catastrophic forgetting, compositional reasoning across modalities, and secure task execution in distributed environments. This integration enables unprecedented computational efficiency, secure collaboration, and adaptive intelligence in high-dimensional decision-making environments while supporting incremental adoption through modular interfaces.

A data storage device and method are provided for using a dynamic floating flash region to secure a firmware update. In one embodiment, a data storage device is provided comprising a first non-volatile memory, a second non-volatile memory, and a controller. The controller is configured to communicate with the first and second non-volatile memories and further configured to: determine addresses in the second non-volatile memory to store portions of a firmware update, wherein the addresses are determined on-the-fly as opposed to being predetermined; and store the portion of the firmware update in the addresses in the second non-volatile memory. Other embodiments are provided.

The invention relates to an automatic memory protection method and device, computer equipment and a storage medium, and the automatic memory protection method comprises the steps: responding to a real-time memory read-write instruction, and determining a target memory address corresponding to the memory read-write instruction; determining a pre-stored tag value corresponding to the target memory address and an actual tag value currently embedded in a memory block pointed by the target memory address; and when it is detected that the pre-stored tag value is not matched with the actual tag value, stopping a memory operation associated with the memory read-write instruction. Through the method and the device, the problem that the data-oriented attack cannot be effectively prevented is solved, the data-oriented attack is effectively prevented, and the memory security and the system operation efficiency are improved.

The invention belongs to the field of computer systems, and provides a low-latency RDMA (Remote Direct Memory Access) acceleration system based on memory registration, which comprises the following steps of: registering a memory region applied by an application program by utilizing a memory pin technology in a kernel; receiving a remote direct memory access (RDMA) work request initiated by an application program, and packaging information comprising a source virtual address and a target virtual address in the request to form a work queue element; the assembly line is used for processing data receiving from a remote system and sending of local data, and hardware logic used for table look-up, QoS detection and message processing is embedded in the assembly line; the server manages the working queue, the data transmission state and the abnormal information processing in a unified manner, and is used for adjusting the transmission parameters of the RDMA acceleration system in real time according to the received context signal; a standardized software calling interface is provided, and cooperative control between software and hardware is achieved.

Various embodiments relate to integrated key revocation with a field loading process and / or related safety and security checks related to an asset system. In an implementation, a data loading request to store a data file via a target storage device of an asset is received. The data file can be signed based on a first key. In response to the data loading request, a key identifier for the first key associated with the data file is compared against (i) a list of key identifiers stored in a key revocation list and (ii) a one-time programmable (OTP) memory of the asset. Additionally, in response to a determination that the data file is successfully authenticated against the key revocation list and the OTP memory, a key revocation process is performed with respect to a second key for the data file associated with the data loading request.

Methods, apparatuses, and systems related to securing memory data are described. A hardware circuit is configured to encrypt and decrypt memory data using a scrambling key unique to a computing process processing the memory data. In writing the memory data, the hardware circuit generates scrambled memory data based on encrypting the memory data according to the security key. The scrambled memory data is stored for the write operation instead of the memory data. When the same process reads back the scrambled data, the same security key can be used to decrypt the scrambled data and recover the initial unscrambled memory data.

The invention discloses a cost-effective solid state disk based on host end resource borrowing and a host. The hard disk comprises a nonvolatile memory, a memory resource, a CXL TSP characteristic module, a CXL driven communication module, a load detection module and a firmware binary code. The firmware binary code is stored in a nonvolatile memory and is used for executing a solid state disk management function by borrowing computing resources of a host after being uploaded to an enclave of the host; the communication module driven by the CXL is responsible for performing communication interaction with an SGX enclave in a host end; the CXL TSP characteristic module is used for ensuring confidentiality and integrity of communication interaction; the load detection module is used for monitoring the load of the I / O request, and when the load is higher than a threshold value, a daemon thread located at a host end is notified to load a firmware binary code to a host and start the host; the nonvolatile memory is used for storing data. According to the invention, efficient and safe host end resource use can be realized.

The invention discloses a memory management method and device, equipment, a storage medium and a computer program, and belongs to the technical field of computers. The method comprises the following steps: receiving a memory allocation request, wherein the memory allocation request is used for requesting to allocate a memory interval for a target VM; obtaining the sizes, physical addresses and distribution conditions of a plurality of encrypted memory intervals through an operating system kernel, wherein the plurality of encrypted memory intervals correspond to different keys; selecting one encrypted memory interval from the plurality of encrypted memory intervals as a target encrypted memory interval based on the sizes and distribution conditions of the plurality of encrypted memory intervals; and allocating the target encrypted memory interval to the target VM based on the physical address of the target encrypted memory interval. Therefore, due to the fact that the operating system kernel determines the physical address of the encrypted memory interval of the target VM in the memory allocation stage, the corresponding encrypted memory interval can be accessed based on the physical address, a hardware architecture does not need to be changed, and the method can be suitable for different processor architectures.

Modifications to existing computer hardware, compiler changes or source-to-source transforms performed during the software build process, and a collection of libraries and modifications to existing standard system software and libraries. The invention allows a program author to enforce various kinds of locality of causality in software to provide enforcement of boundaries for the following aspects of a computer program: control, space, time, modularity, reference, initialization, and mutability. Where these properties do not suffice to guarantee a property at static time, dynamic checks may be added and the constraints on control flow prevent such dynamic checks from being avoided by the program.

The invention provides a lightweight confidential container construction method based on a hardware trusted environment, which belongs to the technical field of confidential containers, and comprises a shared security memory module, a shared security storage module and a system call distribution module, according to the method, a lightweight confidential container is realized by utilizing an existing open source trusted execution environment operating system (OP-TEE) on end side embedded equipment supporting an ARM TrustZone technology; through the design based on the unique identifier of the confidential container, a plurality of confidential containers are realized in the TEE, and a plurality of trusted applications in the same confidential container have fine-grained secure memory and secure storage condition sharing, so that the communication overhead among the trusted applications in the confidential containers is reduced; the secure memory and the secure storage of the confidential container are strongly isolated from the untrusted world; according to the method, the development and deployment difficulty of the security sensitive application is reduced, and the resource utilization efficiency and the system expandability are remarkably improved while the confidentiality and integrity of hardware-level data are guaranteed.

There is provided an apparatus in which processing circuitry performs processing in one of a fixed number of at least two domains, one of the domains being subdivided into a variable number of execution environments. Memory translation circuitry, in response to a memory access request to a given memory address, determines a given encryption environment identifier associated with the one of the execution environments and forwards the memory access request together with the given encryption environment identifier. Storage circuitry stores a plurality of entries, each associated with an associated encryption environment identifier and an associated memory address. The storage circuitry includes determination circuitry that determines, in at least one enabled mode of operation, whether the given encryption environment identifier differs from the associated encryption environment identifier associated with one of the entries associated with the given memory address.

The invention relates to the technical field of program loading and memory management, and provides a method and equipment for creating an executable program code segment read-only file mapping memory copy, and the method comprises the steps: in a system of an NUMA architecture, when a process is executed on a certain NUMA node, mapping a code segment in a read-write mode; traversing all pages mapped by the code segment, reading one byte from each page and writing back the byte, triggering a missing page processing flow, and completing the distribution of the code segment memory copy of the process; and carrying out locking and authority control on the code segment memory copy through system calling. According to the method and equipment for creating the executable program code segment read-only file mapping memory copy, the execution performance of the program under the NUMA architecture is remarkably improved through an innovative process level code segment copy scheme and a flexible implementation mode.

A storage device includes a memory storage region and a controller having a processor. The processor retrieves user data from the memory storage region using a physical block address corresponding to a logical block address (LBA), in response to a read command. The retrieved user data includes a first hash received through a host interface in a prior host data transmission. The processor further performs error correction on the user data to generate error-corrected user data. The processor further causes a cryptographic engine to produce a second hash of the error-corrected user data. The first hash is compared to the second hash associated with the error-corrected user data to determine a match result. A notification is generated in response to the match result.

Systems and methods are disclosed for memory protection for memory protection for gather-scatter operations. For example, an integrated circuit may include a processor core; a memory protection circuit configured to check for memory protection violations with a protection granule; and an index range circuit configured to: memoize a maximum value and a minimum value of a tuple of indices stored in a vector register of the processor core as the tuple of indices is written to the vector register; determine a range of addresses for a gather-scatter memory instruction that takes the vector register as a set of indices based on a base address of a vector in memory, the memoized minimum value, and the memoized maximum value; and check, using the memory protection circuit during a single clock cycle, whether accessing elements of the vector within the range of addresses will cause a memory protection violation.

The invention discloses a method for disguising and hiding data in a memory address, and relates to the technical field of data protection and memory management. The method comprises the steps of obtaining a real numerical value of a target variable needing to be protected; splitting the real numerical value into a plurality of sub-numerical values, and storing the plurality of sub-numerical values in a group of newly allocated storage units in a memory; and when the target variable needs to be used, restoring the real numerical value of the target variable from the plurality of sub-numerical values. The target variable still allocates an address in the memory, but stores the disguise value. The sub-values can be generated through multiple attenuation modes and written into a protection array which is the same as the target variable data in type. The sub-values can be stored in a random index or sequential storage mode, and the protection array can be re-declared during each assignment or reused when conditions are met. According to the method, the hiding performance and the tamper-resistant capability of the data in the memory are effectively improved, and the method is suitable for an application scene in which safety protection is carried out on the local operation data.

The invention provides a method and equipment for realizing a firmware trusted platform module on an RISC-V platform, the functions of the trusted platform module are realized without extra hardware extension through cooperation of software and firmware in combination with a PMP mechanism, a PUF and a hardware timer of the RISC-V platform, and the realization mode comprises an isolation execution process, a hardware execution process and a hardware execution process. An fTPM isolation memory area is configured in the starting stage through a PMP mechanism, and access to fTPM codes and data is limited; a static data protection process: generating a device key by using a PUF (Physical Unclonable Function), and carrying out encryption and integrity protection on fTPM persistent data in combination with a Flash locking mechanism; the trusted starting process comprises the steps of adopting a DME mechanism, ensuring and maintaining the integrity of a starting metric chain and supporting a PCR register function; the efficient communication process comprises the steps of dynamically adjusting the PMP permission of a shared memory area through a dynamic permission exchange page mechanism, and realizing zero-copy communication between the fTPM and an operating system or an application program; and the secure clock process comprises the step of constructing an independent trusted clock source based on a hardware timer of the RISC-V platform.

Examples described herein relate to updating a cryptographic process. In some examples, circuitry is to update a cryptographic process by a write of a firmware image to a non-volatile memory; authenticate the firmware image based on a hash value stored in One Time Programmable Memory (OTPM); and permit execution of the authenticated firmware image to perform the cryptographic process.

A computer-implemented method, according to one approach, includes: receiving an indication that memory has entered a protected state. An I / O request that is intended for a target location in the memory is also received. Moreover, the relative significance of the I / O request is evaluated, and in response to concluding the I / O request is sufficiently significant, the I / O request is performed at the target location. However, in response to concluding the I / O request is insufficiently significant, the I / O request is denied.

A target virtual address is translated to a target physical address for a memory access request. At least for write requests, the memory access request is rejected when a target stage-1 translation table entry specifies that a target memory region corresponding to the target virtual address is a guarded control stack (GCS) region for storing a GCS data structure for protecting return state information, and the memory access request is not a GCS memory access request triggered by one of a restricted subset of GCS-accessing instruction types. When an anti-aliasing property is specified for the target memory region and the target stage-1 translation table entry or another stage-1 translation table entry used to locate the target stage-1 translation table entry is an unhardened entry unprotected by a translation hardening mechanism, the memory access request is rejected. In at least one operating state, a GCS memory access request is rejected when the anti-aliasing property is not specified for the target memory region.

There is provided an apparatus, a method, and a computer program. The apparatus is provided with instruction decoding circuitry to decode instructions and processing circuitry to perform a processing operation in response to a decoded instruction. In response to an authentication code generating instruction, the processing circuitry is configured to generate an authentication code associated with an 10 authentication target value. For at least one type of the authentication code generating instruction, the processing circuitry is configured to generate an authentication code, when operating in a first code generation mode, by applying a code generating function to: a key; the authentication target value; a first modifier dependent on a stack pointer, and / or a second modifier dependent on a program counter address; and a further 15 modifier dependent on a further value obtained from an architecturally visible register different from the stack pointer register and the program counter register.

According to one embodiment, a memory system includes a nonvolatile memory and a controller. The controller manages first account information to be used for authentication of a first account and second account information to be used for authentication of a second account. The controller receives third account information from a host device. When the third account information matches the first account information, the controller permits access to at least a partial storage area of the nonvolatile memory based on a request from the host device and transmits first data that includes the second account information to a first memory system.

Rolling encryption within a memory region. A method includes storing data in a first encrypted memory portion in the memory region. The data in the first encrypted memory portion is encrypted to a first runtime encryption key. Data is stored in a second encrypted memory portion in the memory region. The data in the second encrypted memory portion is encrypted to a second runtime encryption key. A pointer is stored. The pointer defines a boundary between the first encrypted memory portion and the second encrypted memory portion. The first encrypted memory portion and second encrypted memory portion are both configured to be accessible together to entities external to the memory to provide data stored in the first encrypted memory portion and second encrypted memory portion.

A method for extending a memory isolation domain includes allocating memories of multiple isolation domains, where the multiple isolation domains are in a correspondence with N protection keys and M extended page tables. When a first application is allowed to access a memory of a first isolation domain, the method further includes determining, based on the correspondence, a first protection key and a first extended page table that correspond to the first isolation domain, where the multiple isolation domains include the first isolation domain, the N protection keys include the first protection key, and the M extended page tables include the first extended page table. The method further includes enabling access permission for the first isolation domain based on the first protection key and the first extended page table, for the first application to access the memory of the first isolation domain.

The embodiment of the specification provides a memory access method, the method is implemented based on a system-on-chip comprising a processor core, a bus monitoring module, a first storage module and a network-on-chip, the first storage module comprises a secure storage area, and the secure storage area corresponds to at least one application program. A target corresponding relation is stored in the bus monitoring module, and the target corresponding relation comprises a corresponding relation between the secure storage area and the application program; when the method is implemented, an application program sends an access request carrying a target access address to a bus monitoring module, verifies the access request based on verification information when the target access address is in a secure storage area, and transmits the access request to a network-on-chip when the verification of the access request is passed. According to the technical scheme, the corresponding secure storage area is distributed for the application program, even if malicious programs exist in a certain secure storage area, the security of the whole system cannot be harmed, and the security of the system can be improved.

An apparatus may comprise an off-chip data storage device and a semiconductor device package including processing circuitry and an on-chip memory device, the off-chip data storage device including master data and portions of the computer-readable instructions. The processing circuitry may retrieve a master data that includes a digital signature that may be used to verify the master data and a hash table that may include hash information for others of the portions. The processing circuitry may also verify the master instructions responsive to the digital signature, retrieve a portion, calculate a hash value of the retrieved portion, and determine whether the calculated hash value correlates to hash information of the hash table.

Examples include techniques associated with mapping system memory physical addresses to isolation domains for uniform memory access (UMA) by a system. Examples include mapping separate system memory physical addresses ranges associated with memory devices communicatively coupled with at least one compute die of the system through an input / output (I / O) die of the system. The separate system memory physical addresses to be mapped to isolation domains and address decoder information is generated to indicate the mapping of the separate system memory physical address ranges to the isolation domains.

An apparatus (100) includes an instruction fetch circuit (105) that fetches an instruction associated with an instruction fetch address in response to the instruction fetch address; processing circuitry (125), in response to the instruction, to perform an operation in dependence on a target memory address when the instruction includes a request specifying the target memory address and the request specifying the target memory address is allowed; and memory security circuitry (135) that, when the instruction includes the request specifying the target memory address: determines a current region identifier based on a predetermined slice of the instruction fetch address; identifying, based on the current area identifier, permission information for a request issued in response to an instruction associated with the current area identifier; determining whether to prohibit the request based on the permission information; and issuing a response to the processing circuitry indicating that the request is prohibited in response to determining that the request is prohibited.

According to examples, an apparatus may include a memory on which is stored machine-readable instructions that may cause a processor to determine, for each of a plurality of members in a group, a respective least privilege level for a resource and determine, based on the determined respective least privilege levels, a privilege level to be assigned to the group for the resource. The instructions may also cause the processor to assign the determined privilege level to the group for the resource and apply the assigned privilege level to the members of the group for the resource.