1687results about "Unauthorized memory use protection" patented technology

Systems, devices, methods, and circuits for managing data security in storage devices. In one aspect, a storage device includes at least one memory device and a controller coupled to the at least one memory device. The controller is configured to: encrypt first data with a first type of cryptographic algorithm and encrypt second data with a second type of cryptographic algorithm. The first data is associated with a first security level, and the second data is associated with a second security level that is higher than the first security level. The second type of cryptographic algorithm has a greater encryption strength than the first type of cryptographic algorithm.

A computer system implements a unified framework integrating an adaptive elastic funnel (AEF) with a convergent intelligence fabric (CIF) for flexible and contextualized multi-agent AI and human collaboration at scale. The system provides a universal multi-modal key-value subsystem for sharing partial computations across agents, implements a hybrid greedy / non-greedy placement strategy for dynamic memory management, orchestrates dynamic computational workflows and tensor workflows using hierarchical tensor-fragment scheduling, enables cross-agent orchestration with policy-based privacy preservation, and incorporates quantum-resistant secure memory enclaves. The architecture supports continuous learning without catastrophic forgetting, compositional reasoning across modalities, and secure task execution in distributed environments. This integration enables unprecedented computational efficiency, secure collaboration, and adaptive intelligence in high-dimensional decision-making environments while supporting incremental adoption through modular interfaces.

Systems and methods provide for inherited access permissions, thereby facilitating read and write access by called contexts. Hardware logic may enforce access permissions in the system. When a processor core executes code associated with a first context, the processor core generates a first hardware signal identifying the first context. The processor core may then switch from the first context to the second context due to the first context calling the second context. The processor core may then generate a second hardware signal identifying the calling (first) context, and then the first hardware signal identifies the called (second) context. The hardware logic that enforces the access permissions may then determine that the second context is being called and that the second context includes either direct access permissions or inherited access permissions associated with the calling (first) context.

A data storage device and method are provided for using a dynamic floating flash region to secure a firmware update. In one embodiment, a data storage device is provided comprising a first non-volatile memory, a second non-volatile memory, and a controller. The controller is configured to communicate with the first and second non-volatile memories and further configured to: determine addresses in the second non-volatile memory to store portions of a firmware update, wherein the addresses are determined on-the-fly as opposed to being predetermined; and store the portion of the firmware update in the addresses in the second non-volatile memory. Other embodiments are provided.

The invention relates to an automatic memory protection method and device, computer equipment and a storage medium, and the automatic memory protection method comprises the steps: responding to a real-time memory read-write instruction, and determining a target memory address corresponding to the memory read-write instruction; determining a pre-stored tag value corresponding to the target memory address and an actual tag value currently embedded in a memory block pointed by the target memory address; and when it is detected that the pre-stored tag value is not matched with the actual tag value, stopping a memory operation associated with the memory read-write instruction. Through the method and the device, the problem that the data-oriented attack cannot be effectively prevented is solved, the data-oriented attack is effectively prevented, and the memory security and the system operation efficiency are improved.

The invention belongs to the field of computer systems, and provides a low-latency RDMA (Remote Direct Memory Access) acceleration system based on memory registration, which comprises the following steps of: registering a memory region applied by an application program by utilizing a memory pin technology in a kernel; receiving a remote direct memory access (RDMA) work request initiated by an application program, and packaging information comprising a source virtual address and a target virtual address in the request to form a work queue element; the assembly line is used for processing data receiving from a remote system and sending of local data, and hardware logic used for table look-up, QoS detection and message processing is embedded in the assembly line; the server manages the working queue, the data transmission state and the abnormal information processing in a unified manner, and is used for adjusting the transmission parameters of the RDMA acceleration system in real time according to the received context signal; a standardized software calling interface is provided, and cooperative control between software and hardware is achieved.

A thread of a storage server determines that a command to modify a reservation record which comprises access permissions of an object stored at the server has been received. A version of the record is stored in an in-memory cache. The thread acquires a first lock associated with the record in exclusive mode, and a second lock in shared mode. The thread reads the cached version, constructs a modified version indicated in the command, and releases the second lock without updating the cache. After entries representing the modified version are stored in an operations journal, the thread acquires the second lock in exclusive mode and updates the cache. The thread then releases both locks. An indication that the command has succeeded is provided without verifying that the second version is stored at a metadata store.

A computer-implemented method, according to one embodiment, includes: receiving encrypted data at a storage controller, and providing the encrypted data to a secure software container. The secure software container is configured to decrypt the encrypted data, calculate hash values using the decrypted data, and compress the decrypted data. The secure software container is also configured to re-encrypt the decrypted data. The computer-implemented method also includes receiving a new copy of the encrypted data from the secure software container. The new copy of the encrypted data may be compressed, include hash values calculated at the secure software container, or compressed as well as including hash values. The new copy of the encrypted data received may thereby be stored in memory.

Various embodiments relate to integrated key revocation with a field loading process and / or related safety and security checks related to an asset system. In an implementation, a data loading request to store a data file via a target storage device of an asset is received. The data file can be signed based on a first key. In response to the data loading request, a key identifier for the first key associated with the data file is compared against (i) a list of key identifiers stored in a key revocation list and (ii) a one-time programmable (OTP) memory of the asset. Additionally, in response to a determination that the data file is successfully authenticated against the key revocation list and the OTP memory, a key revocation process is performed with respect to a second key for the data file associated with the data loading request.

Methods, apparatuses, and systems related to securing memory data are described. A hardware circuit is configured to encrypt and decrypt memory data using a scrambling key unique to a computing process processing the memory data. In writing the memory data, the hardware circuit generates scrambled memory data based on encrypting the memory data according to the security key. The scrambled memory data is stored for the write operation instead of the memory data. When the same process reads back the scrambled data, the same security key can be used to decrypt the scrambled data and recover the initial unscrambled memory data.

The present disclosure provides a memory device and a control method for the memory device. The memory device includes a memory array and a control logic circuit. The memory array includes memory cell rows. The control logic circuit comprises a counter and a reset circuit. The counter counts the number of accesses performed on the memory cell rows to generate a count value corresponding to the memory cell row accessed among the memory cell rows, and sets the count value to a random value when the count value is equal to a predetermined value and when the accesses are performed. The reset circuit resets the count value to a predetermined value in response to a refresh command. When the count value reaches a threshold value, the control logic circuit arranges a memory cell row near the accessed memory cell row into a mitigation operation.

Systems and methods for access control systems includes first and second access facilities, and first and second readers. The first reader is configured to control access through the first access facility, receive a credential using a first communication protocol from a device that stores the credential, and establish a secret with the device using the credential. The second reader is configured to control access through the second access facility. The first reader is configured to provide the secret to the second reader, and the second device is further configured to perform ranging using the secret and a second communication protocol different than the first communication protocol to identify intent information. Access through one of the first facility or the second facility is coordinated using the intent information.

Techniques for preventing replay for matching pair asymmetrical encryption in a computing system are described. In certain examples, a computing system includes a memory; an execution circuitry to execute an instruction to generate a memory request to read a data line from the memory; and a memory controller circuit to: decrypt the data line into a decrypted data line, determine that a field of the decrypted data line is set to a locator value for a repeated value, identify a first location of a first instance of the repeated value in the decrypted data line based on the locator value, read the repeated value from the first location in the decrypted data line, identify a second location in the decrypted data line for a second instance of the repeated value based on the locator value, shift the decrypted data line to remove the locator value from the decrypted data line and to generate space for the repeated value to be inserted into the second location, and insert the repeated value into the space within the decrypted data line to generate a resultant data line.

The invention discloses a memory isolation method and device for an embedded system and a medium, and relates to the technical field of computer information, and the method comprises the steps: generating a corresponding initial domain strategy for each memory region through a domain protection unit according to the configuration of a target system; receiving a memory access request, determining a source domain and a target domain requested to be accessed through a domain state controller, obtaining an execution task in the memory access request, and adjusting an operation mode of a target system according to the execution task; generating an access instruction based on the memory access request, and sending the access instruction to a domain protection unit; judging whether the source domain has the access authority of the target domain or not according to the initial domain strategy corresponding to the target domain through a domain protection unit; if yes, access is allowed, and the execution task corresponding to the access instruction is executed. The access instruction is checked through the domain protection unit according to the corresponding domain strategy, and unauthorized memory access operation can be directly and effectively prevented on hardware.

The invention discloses a cost-effective solid state disk based on host end resource borrowing and a host. The hard disk comprises a nonvolatile memory, a memory resource, a CXL TSP characteristic module, a CXL driven communication module, a load detection module and a firmware binary code. The firmware binary code is stored in a nonvolatile memory and is used for executing a solid state disk management function by borrowing computing resources of a host after being uploaded to an enclave of the host; the communication module driven by the CXL is responsible for performing communication interaction with an SGX enclave in a host end; the CXL TSP characteristic module is used for ensuring confidentiality and integrity of communication interaction; the load detection module is used for monitoring the load of the I / O request, and when the load is higher than a threshold value, a daemon thread located at a host end is notified to load a firmware binary code to a host and start the host; the nonvolatile memory is used for storing data. According to the invention, efficient and safe host end resource use can be realized.

The invention discloses a memory management method and device, equipment, a storage medium and a computer program, and belongs to the technical field of computers. The method comprises the following steps: receiving a memory allocation request, wherein the memory allocation request is used for requesting to allocate a memory interval for a target VM; obtaining the sizes, physical addresses and distribution conditions of a plurality of encrypted memory intervals through an operating system kernel, wherein the plurality of encrypted memory intervals correspond to different keys; selecting one encrypted memory interval from the plurality of encrypted memory intervals as a target encrypted memory interval based on the sizes and distribution conditions of the plurality of encrypted memory intervals; and allocating the target encrypted memory interval to the target VM based on the physical address of the target encrypted memory interval. Therefore, due to the fact that the operating system kernel determines the physical address of the encrypted memory interval of the target VM in the memory allocation stage, the corresponding encrypted memory interval can be accessed based on the physical address, a hardware architecture does not need to be changed, and the method can be suitable for different processor architectures.

Modifications to existing computer hardware, compiler changes or source-to-source transforms performed during the software build process, and a collection of libraries and modifications to existing standard system software and libraries. The invention allows a program author to enforce various kinds of locality of causality in software to provide enforcement of boundaries for the following aspects of a computer program: control, space, time, modularity, reference, initialization, and mutability. Where these properties do not suffice to guarantee a property at static time, dynamic checks may be added and the constraints on control flow prevent such dynamic checks from being avoided by the program.

The invention provides a lightweight confidential container construction method based on a hardware trusted environment, which belongs to the technical field of confidential containers, and comprises a shared security memory module, a shared security storage module and a system call distribution module, according to the method, a lightweight confidential container is realized by utilizing an existing open source trusted execution environment operating system (OP-TEE) on end side embedded equipment supporting an ARM TrustZone technology; through the design based on the unique identifier of the confidential container, a plurality of confidential containers are realized in the TEE, and a plurality of trusted applications in the same confidential container have fine-grained secure memory and secure storage condition sharing, so that the communication overhead among the trusted applications in the confidential containers is reduced; the secure memory and the secure storage of the confidential container are strongly isolated from the untrusted world; according to the method, the development and deployment difficulty of the security sensitive application is reduced, and the resource utilization efficiency and the system expandability are remarkably improved while the confidentiality and integrity of hardware-level data are guaranteed.

Systems, methods, and corresponding non-transitory computer readable media describe a proposed system adapted as a platform governing the loading of data in a multiparty secure computing environment. In the multiparty secure computing environment described herein, multiple parties are able to load their secure information into a data warehouse having specific secure processing adaptations that limit both access and interactions with data stored thereon.

There is provided an apparatus in which processing circuitry performs processing in one of a fixed number of at least two domains, one of the domains being subdivided into a variable number of execution environments. Memory translation circuitry, in response to a memory access request to a given memory address, determines a given encryption environment identifier associated with the one of the execution environments and forwards the memory access request together with the given encryption environment identifier. Storage circuitry stores a plurality of entries, each associated with an associated encryption environment identifier and an associated memory address. The storage circuitry includes determination circuitry that determines, in at least one enabled mode of operation, whether the given encryption environment identifier differs from the associated encryption environment identifier associated with one of the entries associated with the given memory address.

Establish a secure connection from a device to a server by, at the device: sending a shared secret request (SSRq) and an obfuscated secret value of the device to the server, wherein the SSRq is encrypted by a symmetric rolling key known to the device and to a trusted authority but not known to the server and the SSRq incorporates a symmetric key for decrypting the device's obfuscated secret value; receiving a shared secret response (SSRs) and an obfuscated secret value of the server, wherein the device's symmetric rolling key encrypts the SSRs and the SSRs incorporates a symmetric server obfuscation key for decrypting the server's obfuscated secret value; calculating a shared secret by hashing a concatenation of the device's secret value and the server's secret value; generating a symmetric session key based on the shared secret; and establishing the secure connection using the symmetric session key.

The invention relates to the technical field of program loading and memory management, and provides a method and equipment for creating an executable program code segment read-only file mapping memory copy, and the method comprises the steps: in a system of an NUMA architecture, when a process is executed on a certain NUMA node, mapping a code segment in a read-write mode; traversing all pages mapped by the code segment, reading one byte from each page and writing back the byte, triggering a missing page processing flow, and completing the distribution of the code segment memory copy of the process; and carrying out locking and authority control on the code segment memory copy through system calling. According to the method and equipment for creating the executable program code segment read-only file mapping memory copy, the execution performance of the program under the NUMA architecture is remarkably improved through an innovative process level code segment copy scheme and a flexible implementation mode.

In some embodiments, an integrated circuit may include a substrate and a memory array disposed on the substrate, where the memory array includes a plurality of discrete memory banks. The integrated circuit may also include a processing array disposed on the substrate, where the processing array includes a plurality of processor subunits, each one of the plurality of processor subunits being associated with one or more discrete memory banks among the plurality of discrete memory banks. The integrated circuit may also include a controller configured to implement at least one security measure with respect to an operation of the integrated circuit and take one or more remedial actions if the at least one security measure is triggered.

A storage device includes a memory storage region and a controller having a processor. The processor retrieves user data from the memory storage region using a physical block address corresponding to a logical block address (LBA), in response to a read command. The retrieved user data includes a first hash received through a host interface in a prior host data transmission. The processor further performs error correction on the user data to generate error-corrected user data. The processor further causes a cryptographic engine to produce a second hash of the error-corrected user data. The first hash is compared to the second hash associated with the error-corrected user data to determine a match result. A notification is generated in response to the match result.

Systems and methods are disclosed for memory protection for memory protection for gather-scatter operations. For example, an integrated circuit may include a processor core; a memory protection circuit configured to check for memory protection violations with a protection granule; and an index range circuit configured to: memoize a maximum value and a minimum value of a tuple of indices stored in a vector register of the processor core as the tuple of indices is written to the vector register; determine a range of addresses for a gather-scatter memory instruction that takes the vector register as a set of indices based on a base address of a vector in memory, the memoized minimum value, and the memoized maximum value; and check, using the memory protection circuit during a single clock cycle, whether accessing elements of the vector within the range of addresses will cause a memory protection violation.

The invention discloses a method for disguising and hiding data in a memory address, and relates to the technical field of data protection and memory management. The method comprises the steps of obtaining a real numerical value of a target variable needing to be protected; splitting the real numerical value into a plurality of sub-numerical values, and storing the plurality of sub-numerical values in a group of newly allocated storage units in a memory; and when the target variable needs to be used, restoring the real numerical value of the target variable from the plurality of sub-numerical values. The target variable still allocates an address in the memory, but stores the disguise value. The sub-values can be generated through multiple attenuation modes and written into a protection array which is the same as the target variable data in type. The sub-values can be stored in a random index or sequential storage mode, and the protection array can be re-declared during each assignment or reused when conditions are met. According to the method, the hiding performance and the tamper-resistant capability of the data in the memory are effectively improved, and the method is suitable for an application scene in which safety protection is carried out on the local operation data.

The invention provides a method and equipment for realizing a firmware trusted platform module on an RISC-V platform, the functions of the trusted platform module are realized without extra hardware extension through cooperation of software and firmware in combination with a PMP mechanism, a PUF and a hardware timer of the RISC-V platform, and the realization mode comprises an isolation execution process, a hardware execution process and a hardware execution process. An fTPM isolation memory area is configured in the starting stage through a PMP mechanism, and access to fTPM codes and data is limited; a static data protection process: generating a device key by using a PUF (Physical Unclonable Function), and carrying out encryption and integrity protection on fTPM persistent data in combination with a Flash locking mechanism; the trusted starting process comprises the steps of adopting a DME mechanism, ensuring and maintaining the integrity of a starting metric chain and supporting a PCR register function; the efficient communication process comprises the steps of dynamically adjusting the PMP permission of a shared memory area through a dynamic permission exchange page mechanism, and realizing zero-copy communication between the fTPM and an operating system or an application program; and the secure clock process comprises the step of constructing an independent trusted clock source based on a hardware timer of the RISC-V platform.

Techniques for cache scrubbing for cache-set randomization to resist contention-based cache attacks are described. In certain examples, a system includes a memory; an execution circuit to cause a memory access request for the memory; a cache to store a plurality of sets that each include a plurality of cache lines from the memory; a cache randomizer circuit to generate a randomized index into the plurality of sets of the cache based on an address of the memory access request; and a cache scrubber circuit to determine that a number of invalid cache lines in a set of the plurality of sets of the cache is less than a threshold number of invalid cache lines, and in response, invalidate a valid cache line in the set of the plurality of sets of the cache.

Systems, apparatuses, and methods related to a computer system having a page table entry containing permission bits for predefined types of memory accesses made by executions of routines in predefined domains are described. The page table entry can be used to map a virtual memory address to a physical memory address. In response to a routine accessing the virtual memory address, a permission bit corresponding to the execution domain of the routine and a type of the memory access can be extracted from the page table entry to determine whether the memory access is to be rejected.

Examples described herein relate to updating a cryptographic process. In some examples, circuitry is to update a cryptographic process by a write of a firmware image to a non-volatile memory; authenticate the firmware image based on a hash value stored in One Time Programmable Memory (OTPM); and permit execution of the authenticated firmware image to perform the cryptographic process.