Management of protected areas of memory

Abstract

Apparatus and methods are described that relate to managing regions of memory. Managing regions may include verifying whether an access command is authorized to access a particular region of a memory array, which may have regions with rules or restrictions governing access (e.g., so-called "protected regions"). Authorization may be verified using a key and a memory address corresponding to the access command. If the access command is authorized to access a region, a row of the memory array corresponding to the access command may be activated. If the access command is not authorized to access the region, a row of the memory array corresponding to the access command may not be activated.

Description

Technical Field

[0001] The present disclosure relates generally to memory and, more particularly, to apparatus and methods associated with managing protected regions of memory. Background Art

[0002] Memory devices are typically provided as internal semiconductor integrated circuits in computers or other electronic devices. There are many different types of memory, including volatile and non-volatile memory. Volatile memory may require power to maintain its data and includes random access memory (RAM), dynamic random access memory (DRAM), and synchronous dynamic random access memory (SDRAM), etc. Non-volatile memory can provide persistent data by retaining stored data when not powered, and may include NAND flash memory, NOR flash memory, read-only memory (ROM), electrically erasable programmable ROM (EEPROM), erasable programmable ROM (EPROM), and resistance variable memory, such as phase change random access memory (PCRAM), resistive random access memory (RRAM), and magnetoresistive random access memory (MRAM), etc.

[0003] The memory is also utilized as volatile and non-volatile data storage for a wide variety of electronic applications including, but not limited to, personal computers, portable memory sticks, digital cameras, cellular phones, portable music players (e.g., MP3 players), movie players, and other electronic devices. The memory cells may be arranged in an array, where the array is used in a memory device.

[0004] Various computing systems include a number of processing resources coupled to a memory (e.g., a memory system) that is accessed in association with executing a set of instructions (e.g., a program, an application, etc.). For various reasons, it may be desirable to prevent unauthorized access (e.g., via read and / or write operations) to the memory or specific portions thereof. For example, the memory system may store sensitive data (e.g., data that needs to remain encrypted, such as passwords, personal information, etc.). Summary of the invention

[0005] Aspects of the present disclosure relate to an apparatus for managing protected areas, comprising: a host configured to host a plurality of virtual machines (VMs); and a memory resource coupled to the host and shared by the plurality of VMs; wherein the memory resource comprises a plurality of regions each allocated to a respective one of the plurality of VMs and each having a respective key associated therewith, and wherein a respective address space of each region is unique relative to other regions of the plurality of regions; wherein the memory resource is configured to: receive an access command from one of the plurality of VMs; compare a key associated with the received access command with a key associated with one of the plurality of regions; and allow or prevent access to the one of the plurality of regions based at least in part on comparing the key associated with the received access command with the key associated with the one of the plurality of regions.

[0006] Another aspect of the present disclosure relates to a device for managing protected areas, comprising: a first plurality of registers configured to store a plurality of keys for determining whether an access command is allowed to access a plurality of areas of the device; a second plurality of registers configured to store a plurality of addresses defining the plurality of areas; and a control circuit system configured to: in response to receiving a command to start an operating mode: store the plurality of keys in the first plurality of registers; store the plurality of addresses of the device in the second plurality of registers, wherein the plurality of addresses and the plurality of keys correspond to the plurality of areas; and control access to the different addresses based on whether a different address corresponding to the access command is within an area from a plurality of protected areas and based on whether a different key corresponding to the access command matches a corresponding one of the plurality of keys stored in the first plurality.

[0007] Yet another aspect of the present disclosure relates to a method for managing a protected area, comprising: receiving, at a memory device, an access command including an address of a group of memory devices for access; determining that the address corresponds to an address in a register of a first plurality of registers; comparing a first key associated with the access command with a second key stored in a register of a second plurality of registers based at least in part on determining that the address of the access command corresponds to the address in the register; and allowing or preventing access to the address of the memory array based at least in part on comparing the first key to the second key. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1A is a block diagram of an apparatus in the form of a computing system including a memory device according to several embodiments of the present disclosure.

[0009] Figure 1B is a block diagram of a device in the form of a memory array including a plurality of banks according to several embodiments of the present disclosure.

[0010] Figure 2 is a block diagram of an apparatus in the form of a portion of a memory device including a memory array and a controller capable of protecting memory regions using keys in accordance with several embodiments of the present disclosure.

[0011] Figure 3 An example flow chart illustrating a method for accessing a protected area of ​​a memory array according to several embodiments of the present disclosure is shown.

[0012] Figure 4 An example flow chart illustrating a method for accessing a protected area of ​​a memory array according to several embodiments of the present disclosure is shown.

[0013] Figure 5 An example machine of a computer system is shown within which a set of instructions for causing the machine to perform the various methods discussed herein may be executed. DETAILED DESCRIPTION

[0014] The present disclosure includes apparatus and methods related to managing protected areas of memory. Access commands may be provided from a host to a memory device. The memory device may rely on the host for implementing security measures to prevent unauthorized access to the memory device. However, implementing security measures at the memory device may further improve security and may reduce unauthorized memory access.

[0015] In various embodiments, a memory device can reduce unauthorized memory access by authenticating an access command as authorized using credentials provided with or as part of the access command. The credentials can be stored in a plurality of registers implemented in the memory device prior to receiving the access command (e.g., from a host). As used herein, an access command can include one or more sub-commands. For example, an access command can include a precharge command, an activate command, a read command, and / or a write command, among other possible commands.

[0016] The authorization of the access command may be verified using a key (e.g., a credential). The access command may request access to an address and / or multiple addresses. The memory device may determine whether the address is locked or unlocked based on a security mode associated with the address. If the address is locked, the memory device may prohibit providing access to the address unless the key associated with the access command is also provided to the memory device. The key may be verified against a stored key to determine whether to unlock the address.

[0017] If the key matches the stored key, the memory device may unlock the address and provide access to the address. If the key does not match the stored key, the memory device may prohibit providing access to the address.

[0018] In various embodiments, a memory system may include one or more protected areas. The memory system may include different sets of registers for each of the protected areas. Each of the protected areas of the memory system may be managed by a hypervisor. The hypervisor may assign the protected areas to multiple virtual machines (VMs) so that the VMs can share memory resources including the protected areas. The protected areas of the shared memory resources may be allocated among the VMs so that the VMs are separated from each other. That is, the protected areas allocated to one VM are inaccessible to other VMs. For example, in several embodiments, a key exchange procedure may be implemented to prevent a VM from accessing an address space allocated to another (e.g., different) VM. For example, an access command / request to an address space within a protected area of ​​a shared memory resource by a specific VM may be authorized or denied based on a key comparison. In this way, even if multiple VMs can access a common memory space, a specific area of ​​the common space may be separated from other areas to prevent a VM from making unauthorized access from an address space designated only for another VM.

[0019] Implementing security measures at the memory device to prevent unauthorized access can increase the security of the memory device beyond what the host can provide. For example, unauthorized access commands can be prevented from accessing the memory device by security measures implemented at the host and by security measures implemented at the memory device.

[0020] In various examples, data can be protected in response to detecting an unauthorized access attempt. The unauthorized access attempt can include an access command to a protected area without providing a key corresponding to the protected area. For example, a VM can provide an access command to a protected area that is not assigned to the VM. The access command can be considered unauthorized, for example, because the VM provides a key that does not match a key corresponding to the protected area, or because the VM fails to provide a key associated with the access command.

[0021] A security mode corresponding to a protected area of ​​a memory array storing data may be modified in response to detecting an unauthorized access attempt. The protected area may be placed in a first security mode from a second security mode, wherein the first security mode is a stronger security mode than the second security mode. Data may be moved to a different protected area and / or an unprotected area in response to detecting an unauthorized access attempt. In some examples, a power state of a computing device including a memory array may be modified in response to detecting an unauthorized access attempt. The computing device may be shut down or placed in a sleep state. In response to detecting an unauthorized access attempt, a memory device to which the access attempt was directed or a computing device including the memory device may be locked to prevent access to the memory device and / or the computing device.

[0022] As used herein, "a number of" something may refer to one or more of such things. For example, a number of memory devices may refer to one or more memory devices. "A plurality of" something means two or more. Additionally, designators such as "N" as used herein, particularly with respect to reference numerals in the drawings, indicate that a number of embodiments of the present disclosure may include a number of the particular features so designated.

[0023] The figures herein follow a numbering convention, wherein the first one or more digits correspond to the figure number, and the remaining digits identify the elements or components in the diagram. Similar elements or components between different figures can be identified by using similar numbers. As will be appreciated, the elements shown in the various embodiments herein can be added, exchanged and / or removed to provide several additional embodiments of the present disclosure. In addition, the proportions and relative scales of the elements provided in the figures are intended to illustrate various embodiments of the present disclosure and are not used in a limiting sense.

[0024] Figure 1A is a block diagram of an apparatus in the form of a computing system 100 including a memory device 120 according to several embodiments of the present disclosure. As used herein, memory device 120, memory array 130, and / or host 110, for example, might also be individually considered as a "device."

[0025] In this example, the system 100 includes a host 110 coupled to a memory device 120 via an interface 156. The computing system 100 may be a personal laptop computer, a desktop computer, a digital camera, a mobile phone, a memory card reader, or an Internet of Things (IoT) enabled device, among various other types of systems. The host 110 may include a number of processing resources (e.g., one or more processors, microprocessors, or some other type of control circuitry) that are capable of accessing the memory 120. The system 100 may include separate integrated circuits, or both the host 110 and the memory device 120 may be on the same integrated circuit. For example, the host 110 may be a system controller of a memory system that includes a plurality of memory devices 120, wherein the system controller 110 provides access to the respective memory devices 120 by another processing resource, such as a central processing unit (CPU).

[0026] exist Figure 1A 1, host 110 is responsible for executing operating system (OS) 103-1, multiple VMs 103-2, and hypervisor 103-3. However, in various examples, host 110 may be responsible for executing the OS and / or various applications that may be loaded thereon (e.g., from memory device 120 via controller 140). In other embodiments, hypervisor 103-3 may include hardware or firmware and may not be executed by host 110. In some examples, OS 103-1 may be executed by one or more of VMs 103-2 and hypervisor 103-3 hosted by host 110.

[0027] For clarity, system 100 has been simplified to focus on features that are particularly relevant to the present disclosure. Memory array 130 may be, for example, a DRAM array, an SRAM array, an STT RAM array, a PCRAM array, a TRAM array, an RRAM array, a NAND flash array, and / or a NOR flash array. Array 130 may include memory cells arranged in rows coupled by access lines (which may be referred to herein as word lines or select lines) and columns coupled by sense lines (which may be referred to herein as digit lines or data lines). Although in Figure 1A A single array 130 is shown in FIG. 1 , but embodiments are not limited thereto. For example, the memory device 120 may include several arrays 130 (eg, arrays of DRAM cells).

[0028] The memory device 120 includes an address circuit system 142 to latch address signals provided via an interface 156. The interface may include, for example, a physical interface that employs a suitable protocol (e.g., a data bus, an address bus, and a command bus, or a combined data / address / command bus). Such protocols may be custom or proprietary, or the interface 156 may utilize a standardized protocol, such as Peripheral Component Interconnect Express (PCIe), Gen-Z, CCIX, etc. The address signals are received and decoded by a row decoder 146 and a column decoder 152 to access the memory array 130. Data may be read from the memory array 130 by sensing voltage and / or current changes on the sense lines using the sense circuit system 150. The sense circuit system 150 may include, for example, a sense amplifier that can read and latch a page (e.g., a row) of data from the memory array 130. The I / O circuit system 144 may be used for bidirectional data communication with the host 110 via the interface 156. The read / write circuit system 148 is used to write data to the memory array 130 or read data from the memory array 130. As examples, circuitry 148 may include various drivers, latch circuitry, and the like.

[0029] Controller 140 decodes signals provided by host 110. These signals may include chip enable signals, write enable signals, and address latch signals used to control operations performed on memory array 130, including data read, data write, and data erase operations. In various embodiments, controller 140 is responsible for executing instructions from host 110. Controller 140 may include a state machine, a sequencer, and / or some other type of control circuitry, which may be implemented in hardware, firmware, or software, or any combination of the three.

[0030] According to various embodiments, controller 140 may be configured to decode a security mode initialization command it receives. The security mode initialization command may be received from host 110 (e.g., as directed by hypervisor 103-3). The security mode initialization command may be provided to memory device 120 to set a security mode of memory device 120 and / or specify one or more protected areas of memory device 120. The security mode may include a locked mode and an unlocked mode, among other possible security modes. Memory device 120 may be configured to provide access to protected areas of memory array 130 when memory device 120 is in unlocked mode, or to prevent access to protected areas of memory array 130 when memory device 120 is in locked mode.

[0031] The hypervisor 103-3, as executed by the host 110, may initiate a secure mode initialization command to store a plurality of keys and a plurality of addresses or a plurality of series of addresses of the memory array 130 in a plurality of registers of the controller 140. The stored keys and addresses may define a protected area of ​​the memory array 130. The hypervisor 103-3 may initiate the secure mode initialization command during initialization of the system 100 or during a time after the system is initialized.

[0032] In various examples, the protected area may be defined by providing a single secure mode initialization command or by providing multiple secure mode initialization commands. For example, a first secure mode initialization command may define a first protected area, and a second secure mode initialization command may define a second protected area of ​​the memory array. The secure mode initialization commands may be provided by hypervisor 103-3 and / or by a combination of hypervisor 103-3 and VM 103-2. For example, a first secure mode initialization command may be provided by hypervisor 103-3, a second secure mode initialization command may be provided by a first VM from VM 103-2, and a third secure mode initialization command may be provided by a second VM from VM 103-2.

[0033] In an instance where the hypervisor defines multiple protected areas by initializing a secure mode initialization command, the hypervisor may assign keys to each of the protected areas. The hypervisor may then manage the keys by assigning keys to VM 103-2. For example, the hypervisor may assign a first protected area to a first VM and provide a first key corresponding to the first protected area to the first VM. The hypervisor may assign a second protected area to a second VM and provide a second key corresponding to the second protected area to the second VM. The hypervisor may assign a third protected area to itself and retain a third key corresponding to the third protected area.

[0034] In an example where the hypervisor defines a single protected region to be used by itself and VM 103-2 defines its own protected region, the hypervisor may not know the address corresponding to the protected region managed by VM 103-2. The hypervisor may also not know the key corresponding to the protected region.

[0035] The key may be a security token used to gain access to a protected area of ​​the memory array 130. The key may be encrypted or unencrypted. The key may be provided by the hypervisor 103-3 and / or by a VM 103-2 hosted by the hypervisor 103 to access a protected area of ​​the memory array 130. The key may be unique to a protected area of ​​memory and / or may be associated with multiple protected areas of memory. As further described below, the key may include one or more bits that may be stored in one or more registers of the memory device 120.

[0036] The protected region of the memory array 130 describes a region of the memory array 130 that is protected using a key. Each protected series of addresses may be defined by a first memory address and a second memory address. The first memory address may be a starting address and the second memory address may be an ending address. In various examples, the protected series is stored as a starting address and is stored as an offset. The offset along with the starting address may be used to generate an ending address. The protected region may be continuous from the starting address to the ending address. In various examples, the protected region may be discontinuous and may be described by multiple sets of starting addresses and ending addresses.

[0037] In various examples, the memory array 130 may include one or more protected regions. Each of the protected regions may be defined using a starting address and an offset. Each of the starting addresses corresponding to different protected regions may be unique and / or may be the same starting address. Each of the offsets of the protected regions may also be the same offset or a different offset.

[0038] In various cases, the host 110 may provide an access command to the memory device 120. The access command may be provided from the hypervisor 103-3 and / or the VM 103-2 via the host 110. The access command may be provided to access a protected area from a plurality of protected areas of the memory device 120. The access command may be associated with an address or a series of addresses and a key. The memory device 120 may compare the provided address with each of the plurality of protected areas to determine whether the address is within any one of the protected areas (e.g., any one of the protected series). If the address is within the protected area, the memory device 120 may compare the key with the stored key corresponding to the protected area to determine whether the key matches the stored key. If the key matches the stored key, the memory device 120 may enter an unlocked mode from a locked mode, wherein the unlocked mode corresponds to the protected area and does not correspond to other protected areas from the plurality of protected areas.

[0039] For example, if the key corresponding to the access command matches the stored key corresponding to the identified protected area from the plurality of protected areas, the identified protected area may be unlocked while the other protected areas from the plurality of protected areas remain in the locked mode. For example, if the access command to the first protected area is authenticated, the first protected area may be unlocked while the second and third protected areas remain locked.

[0040] In various examples, the address corresponding to the access command may be within the first protected area and the second protected area. The third key corresponding to the access command may match the first key corresponding to the first protected area and may not match the second key corresponding to the second protected area. The first protected area may be unlocked and the second protected area may remain locked.

[0041] The memory device 120 may enable a row driver via the controller 140 to activate a row of the memory array 130 corresponding to an address (e.g., a protected region). If the keys do not match, the memory device 120 may prevent access to the protected region via the controller 140 by preventing the row driver 147 of the memory array 130 from being enabled, thereby preventing the row corresponding to the access command from being activated.

[0042] Figure 1B 1 is a block diagram of a device in the form of a memory array 130 including a plurality of banks according to several embodiments of the present disclosure. The memory array 130 may include a plurality of banks. For example, the memory array 130 includes banks 133-1 through 133-N, which may be referred to as banks 133. Figure 1B Also shown is a host 110 coupled to a memory array 130. The host 110 may host VMs 103-1 through 103-N-1 and a hypervisor 103-N.

[0043] Each of the groups 133 may include a protected area. For example, group 133-1 includes protected area 135-1, ..., and group 133-N includes protected area 135-N. Protected areas 135-1 to 135-N may be referred to as protected areas 135. Thus, memory array 130 may include protected areas 135, wherein each of protected areas 135 corresponds to a group from group 133. Although not shown, in some examples, each of the groups 133 may include two or more protected areas.

[0044] In various embodiments, each of the protected regions 135 may correspond to VMs 103-1 to 103-N-1 and / or hypervisor 103-N. For example, protected region 135-1 may correspond to VM 103-1, ..., protected region 135-N-1 may correspond to VM 103-N-1, and protected region 135-N may correspond to hypervisor 103-N. VMs 103-1 to 103-N-1 may be coupled to each other and hypervisor 103-N to allow assignment of protected regions 135 and provision of keys corresponding to protected regions 135.

[0045] Figure 2 is a block diagram of an apparatus in the form of a memory device 220 including a memory array 230 and a portion of a controller capable of protecting memory regions using a key in accordance with several embodiments of the present disclosure. The memory device 220 may be similar to Figure 1A The memory device 120 in FIG. 2 includes a memory array 230 and a memory device 220 such as Figure 1A Part of a controller such as controller 140 in.

[0046] The controller may include a command decoder 221, mode registers 224-1 to 224-N, key registers 226-1 to 226-N, a protected region register 228, and an access counter register 231. The controller may also include an address matching unit 222 and a key matching unit 223. Each of the mode registers 224-1 to 224-N, the key registers 226-1 to 226-N, the protected region registers 228-1 to 228-N, and the access counter registers 231-1 to 231-N may be associated with a different protected region and / or group of the memory array 230. For example, the mode register 224-1, the key register 226-1, the protected region register 228-1, and the access counter register 231-1 correspond to a first protected region, ..., and the mode register 224-N, the key register 226-N, the protected region register 228-N, and the access counter register 231-N correspond to an Nth protected region. As used herein, mode registers 224-1 to 224-N, key registers 226-1 to 226-N, protected region registers 228-1 to 228-N, and access counter registers 231-1 to 231-N may be referred to as mode registers 224, key registers 236, protected region registers 228, and access counter registers 231, respectively.

[0047] In this example, the interface (e.g. Figure 1A156) shown in FIG. 1 includes an address bus 256-1, a command bus 256-2, and a data bus 256-3. The device 220 may receive a security mode initialization command and / or an access command and a key via the command bus 256-2. The device 220 may receive an address via the address bus 256-1, and data may be provided to / from the device 220 via the data bus 256-3.

[0048] The host may provide a security mode initialization command via the command bus 256-2 to initialize the security mode of the memory device 220. The memory device 220 may receive the security mode initialization command at the command decoder 221. The command decoder 220 may decode the security mode initialization command.

[0049] In various examples, the secure mode initialization command may be associated with one or more keys and a number of addresses received via the command bus 256-2 and the address bus 256-1.

[0050] The controller may store the key in the key register 226 and may store one or more addresses in the protected region register 228. Each of the mode register 224, the key register 226, the protected region register 228, and / or the access counter register 231 may be composed of one or more registers.

[0051] One or more addresses may be stored as a starting address and an offset in the protected region register 228. The starting address may be stored in a first register of the protected region register 228, and the offset may be stored in a second register of the protected region register 228. The starting address and the ending address may define a protected region of the memory array 230. Thus, a region to be protected (e.g., a protected region) may be stored in the protected region register 228.

[0052] The key may be stored in the key register 226. In various examples, multiple keys may be stored in the key register 226. Each of the multiple keys may be associated with a different one of the multiple protected areas stored in the protected area register 228. The multiple keys may be used to allow access to the protected areas. For example, a first key may be used to allow access to a first protected area, and a second key may be used to allow access to a second protected area.

[0053] In response to storing a key in the key register 226 and storing an address in the protected area register 228, the controller may change the security mode of the corresponding protected area from the unlocked mode to the locked mode in the mode register 224. In response to storing multiple keys in the key register 226 and storing multiple addresses in the protected area register 228, the controller may change the security mode of the corresponding multiple protected areas from the unlocked mode to the locked mode in the mode register 224. The mode register 224 may include multiple security mode registers. The security mode register may store a first value representing the unlocked mode or a second value representing the locked mode and other possible modes for each of the protected areas. The locked mode may be used to prevent access to the protected areas of the memory array 230. The unlocked mode may be used to allow access to the protected areas of the memory array 230.

[0054] In various examples, in response to receiving the security mode initialization command, the controller may set the access counter registers 231. For example, the access counter registers 231 may be set to zero. Each of the access counter registers 231 may provide a count of unauthorized access commands directed to a corresponding protected region of the memory array 230 (e.g., as defined by the protected region registers 228).

[0055] The controller may also process access commands. For example, an access command received via command bus 256-2 may be decoded by command decoder 221. Address matching unit 222 may receive an address corresponding to the access command. Address matching unit 222 may determine whether the received address is within a protected region from a plurality of protected regions (e.g., as stored in protected region register 228).

[0056] If the received address is in the protected area, the controller may determine whether the key associated with the access command matches the key corresponding to the protected area via the key matching unit 223. If the key associated with the access command matches the key corresponding to the protected area, the controller may modify the mode register corresponding to the protected area from the locked mode to the unlocked mode.

[0057] If the mode register corresponding to the protected area reflects the unlocked mode, the controller may provide a signal to the row driver 247 to activate the row corresponding to the received address. If the mode register 224 reflects the locked mode, the controller may prevent the signal from being provided to the row driver 247. Although the row driver 247 is shown as being in the memory array 230, the row driver 247 may also be implemented external to the memory array 230, such as Figure 1A As shown in .

[0058] The controller may also include an access counter register 231. The access counter register may store a count corresponding to the number of unauthorized access commands received at the memory device 220, wherein the access command is associated with an address of at least one of the protected areas. The access counter register 231 may be accessed to determine whether an unauthorized access command has been received by the memory device 220.

[0059] Figure 3 An example flow chart of a method for accessing a protected area of ​​a memory array according to several embodiments of the present disclosure is shown. At 351, an authorized process having a key obtains access to a protected area. A process may be an instance of a program such as an application process being executed by a host. For example, a process may be a VM, a hypervisor, and / or a different application, among other possible processes. The process may be authorized upon verification that a key associated with an access command matches a stored key in one of the key registers and that an address corresponding to the process is within a corresponding protected area from a plurality of protected areas.

[0060] At 353, the enable bit flag may be flipped. The enable bit flag may be stored in Figure 2 The controller may be configured to enable a row driver to activate a row in response to the enable bit flag indicating the locked mode, wherein the row corresponds to a received address associated with the access command. For example, when the mode bit indicates that the protected memory region is locked, the controller may prevent any row driver from being enabled.

[0061] At 357, the authorized process may end reading from the protected area. At 359, the controller may return the enable bit flag to its original value. For example, the enable bit flag may return to a locked mode.

[0062] In various embodiments, the hypervisor may initiate a secure mode initialization command. The secure mode initialization command may be provided by the hypervisor to define one or more protected regions of the memory array and associate a key with the one or more protected regions.

[0063] Utilizing a secure mode initialization command to define protected areas provides hypervisor flexibility. The hypervisor may have flexibility to define the size and content of protected areas of a memory array and / or allow a VM to define the size and content of protected areas. For example, the hypervisor may define one or more of the protected areas to include a first size or a second size among several possible sizes. The hypervisor and / or VM may activate secure mode by providing a secure mode initialization command, or may refrain from activating secure mode by avoiding providing a secure mode initialization command to a memory device. For example, the hypervisor and the first VM may activate secure modes for the first protected area and the second protected area, respectively, while the second VM may refrain from activating a secure mode corresponding to a third protected area.

[0064] The memory device may operate in a safe mode or without a safe mode based on the selection of the hypervisor. In addition, after the protected area has been initialized, the hypervisor or VM may limit the size or location of the protected area. For example, after the initialization of the safe mode, the hypervisor may increase the size of the protected area or reduce the size of the protected area. After the initialization of the safe mode, the hypervisor or VM may also change the base address of the protected area and / or the offset of the protected area. After the memory device has been placed in the safe mode, the hypervisor or VM may also exit the safe mode. For example, the hypervisor may store a predefined value in a protected area register. The hypervisor may store zero as the base address and / or offset of the protected area to exit the safe mode. The memory device may set the corresponding mode register to an unlocked mode in response to identifying that the base address and / or offset of the protected area has a zero value.

[0065] The hypervisor may utilize an application programming interface (API) to generate a security mode initialization command and / or an access command for defining and / or accessing a protected area of ​​a memory array. The hypervisor may comply with security features of the memory device utilizing the API.

[0066] In various examples, a secure mode initialization command may be generated by a hypervisor and / or a VM and may be received by a memory device as part of an initialization process of a computing device, a VM, and / or a hypervisor. The memory device may store a key in a key register from a plurality of key registers in response to receiving a secure mode initialization command. The memory device may store an address of the memory device in one of the protected region registers. In various examples, each of the key registers may be associated with a different one of the protected region registers and / or the mode register. Such that a key is stored in a key register associated with a protected region register storing an address. The key register and the protected region register may correspond to a protected region of a group. Thus, each of the key register and the protected region register may be uniquely associated with a different group of a memory array or a memory device.

[0067] The memory device may set a mode register based on the storage of the key and / or the storage of the address. The mode register may identify whether a protected area of ​​the memory array is protected. The memory device may set the mode register to a locked mode. The locked mode may be a protected mode.

[0068] Figure 4 An example flow chart of a method for accessing a protected area of ​​a memory array according to several embodiments of the present disclosure is shown. The method may be performed by a memory device of a computing system.

[0069] At 460, the memory device may receive an access command including an address of a group of memory devices to access. At 462, a determination may be made as to whether the address corresponds to an address in a register of the first plurality of registers. The address in the register may define a protected region corresponding to the group from a plurality of protected regions of the memory device as indicated by a plurality of protected region registers. If the address is greater than a starting address of the protected region but less than an ending address of the protected region, then the address may be within the protected region. In various examples, the access command may be associated with a plurality of addresses to be accessed. If at least one of the plurality of addresses is greater than the starting address and at least one of the plurality of addresses is less than an ending address of the protected region, then the plurality of addresses may be within the protected region.

[0070] At 464, the memory device may compare a first key associated with the access command to a second key stored in a register of the second plurality of registers based at least in part on determining that the address of the access command corresponds to an address in the register. For example, in response to determining that the address is within a protected area, the controller may determine whether a received key associated with the access command from a plurality of keys associated with a plurality of protected areas matches a key stored in a plurality of key registers. If the received key is equal to the stored key or if the received key is substantially equal to the stored key, then the received key may match the stored key. If the stored key is derivable from the received key, then the received key may match the stored key, as well as other examples.

[0071] At 468, the memory device may allow or prevent access to the address of the memory array based at least in part on comparing the first key to the second key. For example, in response to determining that the received key matches the stored key, the controller may allow access to the address of the memory array. The memory device may allow access to the address by providing data stored at the memory cell corresponding to the address to the host. Access may be allowed by permitting activation of a row of the array corresponding to the address. The method may further allow activation of the row corresponding to the address by switching an access enable flag from a first state to a second state, wherein the row corresponding to the address within the protected area cannot be activated unless the access enable flag is in the second state. After executing an access command (e.g., a read command), the access enable flag may return to the first state to prevent activation of the row corresponding to the protected area. In response to determining that the received key does not match the stored key, the controller may prevent access to the address of the memory array. In response to determining that the address is outside the protected area, the controller may allow access to the address without performing a key match comparison.

[0072] In various examples, the stored key may correspond to a specific area (e.g., a protected area) of the group. The stored key and the protected area may be assigned to the VM by the hypervisor. The stored key and the protected area may be assigned to the hypervisor. The stored key and the protected area may be assigned to one or more of the VMs and the hypervisor. In various embodiments, one or more of the key register, the protected area register, and / or the mode register may be written by the first device and may be accessed by the second device. For example, the key register may be written by a processing resource external to the memory device and may be read by the memory device itself. The processing resource external to the memory device may execute instructions corresponding to the hypervisor and / or the VM to store one or more keys in the key register. However, the processing resource may not be provided with access to the data stored in the key register. The key register may be accessed only from a device internal to the memory device (e.g., within the memory device). For example, the key register may be accessed only from a controller internal to the memory device.

[0073] In various examples, the protected area can store the kernel of the hypervisor and / or the kernel of the VM. Each of the protected areas corresponding to different groups can store different kernels corresponding to the hypervisor and the VM.

[0074] In various cases, the hypermanager can provide the key and address corresponding to the protected area via the safe mode initialization command to define the protected area and place the protected area in a locked mode. For example, the hypermanager can define the protected area at startup. The hypermanager can then start multiple VMs. The hypermanager can then assign the protected area to the VM so that each protected area corresponds to a different VM. The assignment of the protected area to the VM can occur at runtime. The hypermanager can continue to manage the protected area after the protected area is assigned to the VM. For example, in response to starting a new VM and deleting the previously started VM, the hypermanager can reassign the protected area from the previously started VM to the newly started VM. The hypermanager can provide the password and the address that defines the previously started VM to the newly started VM. In various instances, the hypermanager can generate a new key and associate the new key with the protected area before assigning the new key and the protected area to the newly started VM. The hypermanager can also re-define the protected area by providing a new starting address and / or a new ending address. The hypervisor may provide the redefined protected area to the newly started VM. Redefining the protected area may prevent other VMs that were previously assigned with the protected area from accessing the redefined protected area.

[0075] In various cases, a host may be configured to host multiple virtual machines (VMs). A memory resource may be coupled to the host and shared by the multiple VMs. The memory resource may include multiple regions each assigned to a respective one of the multiple VMs and each having a respective key associated therewith, and wherein a respective address space of each region is unique relative to other regions of the multiple regions. The memory resource may be configured to receive an access command from one of the multiple VMs, compare a key associated with the received access command with a key associated with one of the multiple regions, and allow or prevent access to one of the multiple regions based at least in part on comparing the key associated with the received access command with a key associated with one of the multiple regions.

[0076] The host may be further configured to host a hypervisor, and wherein the hypervisor is configured to assign a plurality of keys corresponding to the plurality of regions to the plurality of VMs. The hypervisor may be configured to assign the plurality of regions and the plurality of keys to the plurality of VMs at startup. The hypervisor may also assign the plurality of regions and the plurality of keys to the plurality of VMs in response to creation of the plurality of VMs.

[0077] In various examples, the hypervisor can be configured to assign multiple regions and multiple keys to multiple VMs using commands to initialize a secure mode provided to the memory resource. The VM can also be configured to generate and store multiple keys corresponding to the multiple regions in the memory resource.

[0078] In various cases, a device (e.g., a memory device) may include a first plurality of registers configured to store a plurality of keys for determining whether to allow an access command to access a plurality of regions of the device, a second plurality of registers configured to store a plurality of addresses defining the plurality of regions, and a control circuit system. The control circuit system may be configured to store the plurality of keys in the first plurality of registers and store the plurality of addresses of the device in the second plurality of registers in response to receiving a command to initiate an operating mode, wherein the plurality of addresses and the plurality of keys correspond to the plurality of regions. The control circuit system may also be configured to control access to different addresses corresponding to the access command based on whether the different addresses are within a region from the plurality of protected regions and based on whether the different keys corresponding to the access command match a corresponding one of the plurality of keys stored in the first plurality in response to receiving a command to initiate an operating mode.

[0079] In some examples, each of the plurality of regions may correspond to a different set of devices. The control circuit system may be configured to receive a command from a hypervisor to initiate an operating mode. The control circuit system may also be configured to receive an access command in response to a signaling from a VM. The region may further be configured to store a kernel of a VM.

[0080] The control circuit system may be further configured to receive access commands in response to signaling from the hypervisor. The area may be configured to store a kernel of the hypervisor. In an example, portions of the plurality of keys and the plurality of addresses are associated with the hypervisor assignment of the plurality of VMs. The hypervisor may assign portions of the plurality of keys and the plurality of addresses to the plurality of VMs so that the hypervisor divides and assigns protected areas. The hypervisor may retain keys from the plurality of keys and addresses from the plurality of addresses for its use. In some cases, each of the plurality of keys may be associated with a different one of the plurality of addresses and correspond to a different one of the plurality of areas.

[0081] Figure 5 An example machine of a computer system 540 is shown within which a set of instructions for causing the machine to perform one or more of the methodologies discussed herein may be executed. In various embodiments, the computer system 540 may correspond to a host system (e.g., Figure 1A 110), wherein the host system includes, is coupled to, or utilizes a memory subsystem (e.g., Figure 1A 120) or may be used to execute a controller (e.g., Figure 1A The controller 140 includes Figure 2 In some embodiments, the machine may be connected (e.g., using a network connection) to other machines in a LAN, an intranet, an extranet, and / or the Internet. The machine may operate in the capacity of a server or a client machine in a client-server network environment, or in the capacity of a peer machine in a peer-to-peer (or distributed) network environment, or as a server or a client machine in a cloud computing infrastructure or environment.

[0082] The machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a cellular phone, a network appliance, a server, a network router, a switch or a bridge, or any such machine capable of executing (sequentially or otherwise) a set of instructions that specify actions to be taken by the machine. Further, while a single machine is illustrated, the term "machine" shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform one or more of the methodologies discussed herein.

[0083] The example computer system 540 includes a processing device 502, a main memory 504 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM)), etc.), a static memory 506 (e.g., flash memory, static random access memory (SRAM), etc.), and a data storage system 518 that communicate with each other via a bus 530.

[0084] The processing device 502 represents one or more general-purpose processing devices, such as a microprocessor, a central processing unit, etc. More specifically, the processing device may be a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or a processor that implements other instruction sets, or a processor that implements a combination of instruction sets. The processing device 502 may also be one or more special-purpose processing devices, such as an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), a network processor, etc. The processing device 502 is configured to execute instructions 526 for performing the operations and steps discussed herein. The computer system 540 may further include a network interface device 508 to communicate via a network 520.

[0085] The data storage system 518 may include a machine-readable storage medium 524 (also referred to as a computer-readable medium) on which is stored one or more sets of instructions 526 or software embodying one or more of the methods or functions described herein. The instructions 526 may also reside, completely or at least partially, within the main memory 504 and / or within the processing device 502 during execution thereof by the computer system 540, the main memory 504 and the processing device 502 also constituting machine-readable storage media.

[0086] In one embodiment, instructions 526 include instructions for implementing the Figure 1A The functional instructions of the controller 140 of the present invention are provided. Although the machine-readable storage medium 524 is shown as a single medium in the example embodiment, the term "machine-readable storage medium" should be considered to include a single medium or multiple media storing one or more sets of instructions. The term "machine-readable storage medium" should also be considered to include any medium capable of storing or encoding a set of instructions for execution by a machine and causing the machine to perform one or more of the methods of the present disclosure. Therefore, the term "machine-readable storage medium" should be considered to include, but not limited to, solid-state memory, optical media, and magnetic media.

[0087] Although specific embodiments have been shown and described herein, it will be appreciated by those skilled in the art that arrangements calculated to achieve the same results may replace the specific embodiments shown. The present disclosure is intended to cover modifications or variations of the various embodiments of the present disclosure. It should be understood that the above description is provided in an illustrative and non-restrictive manner. After reviewing the above description, the combination of the above embodiments and other embodiments not specifically described herein will be apparent to those skilled in the art. The scope of the various embodiments of the present disclosure includes other applications in which the above structures and methods are used. Therefore, the scope of the various embodiments of the present disclosure should be determined with reference to the attached claims and the full scope of equivalents granted by these claims.

[0088] In the foregoing detailed description, various features are grouped together in a single embodiment for the purpose of streamlining the disclosure. This approach to the disclosure should not be interpreted as reflecting an intention that the disclosed embodiments of the disclosure must use more features than those explicitly stated in each claim. On the contrary, as reflected in the appended claims, the subject matter of the present invention lies in less than all of the features of a single disclosed embodiment. Therefore, the appended claims are hereby incorporated into the detailed description, with each claim acting on its own as a separate embodiment.

Claims

1. A device for managing a protected area, comprising: A host (110) configured to host a plurality of virtual machines (VMs) (103-1, 103-2, ..., 103-N-1) via a plurality of processors; and a memory resource (120, 220) comprising an array of memory cells, the memory resource being external to the host and coupled to the host via a physical interface, the physical interface comprising a plurality of buses, wherein the host and the memory resource are implemented on separate integrated circuits, and the memory resource is shared by the plurality of VMs; wherein the memory resource comprises a plurality of regions (135-1, ..., 135-N) each allocated to a respective one of the plurality of VMs and each having a respective key associated therewith, and wherein a respective address space of each region is unique with respect to other regions of the plurality of regions; The memory resources are configured as follows: receiving an access command from one of the plurality of VMs and a key associated with the received access command; comparing the key associated with the received access command with a key associated with one of the plurality of regions at the memory resource by accessing a register of the memory resource that is writable by the host but not accessible by the host, wherein each of the plurality of VMs is uniquely associated only with a respective key associated with the one of the plurality of regions; allowing access to the one of the plurality of regions by modifying a mode register corresponding to the one of the plurality of regions from a locked mode to an unlocked mode based at least in part on determining that the key associated with the received access command matches the key associated with the one of the plurality of regions; and Access is prevented based at least in part on a determination that the key associated with the received access command does not match the key associated with the one of the plurality of zones.

2. The apparatus of claim 1, wherein the host is further configured to host a hypervisor (103-3, 103-N), and wherein the hypervisor is configured to assign a plurality of keys corresponding to the plurality of regions to the plurality of VMs. 3 . The apparatus of claim 2 , wherein the hypervisor is configured to assign the plurality of regions and the plurality of keys to the plurality of VMs at startup. 4 . The apparatus of claim 2 , wherein the hypervisor is configured to assign the plurality of regions and the plurality of keys to the plurality of VMs in response to creation of the plurality of VMs. 5 . The apparatus of claim 2 , wherein the hypervisor is configured to assign the plurality of regions and the plurality of keys to the plurality of VMs using a command to initialize a secure mode provided to the memory resource. 6 . The apparatus according to claim 1 , wherein the plurality of VMs are configured to generate and store a plurality of keys corresponding to the plurality of regions in the memory resource.

7. A device for managing a protected area, comprising: a first plurality of registers (226-1, ..., 226-N) configured to store a plurality of keys for determining whether an access command is allowed to access a plurality of regions (135-1, ..., 135-N) of the device; a second plurality of registers (228-1, ..., 228-N) configured to store a plurality of addresses defining the plurality of regions; as well as A control circuit system (140) configured to: In response to receiving a command to initiate an operating mode: storing the plurality of keys in the first plurality of registers; storing the plurality of addresses of the device in the second plurality of registers, wherein the plurality of addresses and the plurality of keys correspond to the plurality of regions; and Controlling access to a different address corresponding to an access command based on whether the different address is within a region (135-1, ..., 135-N) from a plurality of regions and based on whether a different key corresponding to the access command matches a corresponding one of the plurality of keys stored in the first plurality of registers by: determining whether the different address is within the region; comparing the different key to the corresponding one of the plurality of keys; as well as In response to determining that the different address is within the region and the different key matches the corresponding one of the plurality of keys, a mode register corresponding to one of the plurality of regions is modified from a locked mode to an unlocked mode.

8. The apparatus of claim 7, wherein each of the plurality of regions corresponds to a different group (133-1, ..., 133-N) of the apparatus.

9. The apparatus of claim 7, wherein the control circuitry is configured to receive the command to initiate the operating mode from a hypervisor (103-3, 103-N).

10. The apparatus of claim 7, wherein the control circuitry is configured to receive the access command in response to signaling from a virtual machine (VM) (103-1, 103-2, ..., 103-N-1). The apparatus of claim 10 , wherein the area is configured to store a kernel of the VM.

12. The apparatus of claim 7, wherein the control circuitry is configured to receive the access command in response to signaling from a hypervisor (103-3, 103-N).

13. The apparatus of claim 12, wherein the region is configured to store a kernel of the hypervisor.

14. The apparatus according to any one of claims 7 to 13, wherein the plurality of keys and the portion of the plurality of addresses are associated with a hypervisor (103-3, 103-N) assignment for a plurality of VMs (103-1, 103-2, ..., 103-N-1).

15. An apparatus according to any one of claims 7 to 13, wherein the hypervisor is configured to retain keys from the plurality of keys and addresses from the plurality of addresses for use by the hypervisor.

16. The apparatus of any one of claims 7 to 13, wherein each of the plurality of keys is associated with a different one of the plurality of addresses and corresponds to a different one of the plurality of regions.

17. A method for managing a protected area, comprising: At a memory resource, receiving, via a plurality of processors, an access command and a key associated with the received access command from one of a plurality of virtual machines VM hosted by a host, wherein the memory resource is shared by the plurality of VMs, wherein the memory resource comprises a plurality of regions each allocated to a respective one of the plurality of VMs and each having a respective key associated therewith, wherein the respective address space of each region is unique relative to other regions of the plurality of regions, wherein the memory resource comprises an array of memory cells, and the memory resource is external to the host and coupled to the host via a physical interface comprising a plurality of bus lines, and wherein said host and said memory resource are implemented on separate integrated circuits; comparing, at the memory resource, the key associated with the received access command with a key associated with one of the plurality of regions by accessing a register of the memory resource that is writable by the host but not accessible by the host, wherein each of the plurality of VMs is uniquely associated only with a respective key associated with the one of the plurality of regions; at the memory resource, allowing access to the one of the plurality of regions by modifying a mode register corresponding to the one of the plurality of regions from a locked mode to an unlocked mode based at least in part on determining that the key associated with the received access command matches the key associated with the one of the plurality of regions; as well as At the memory resource, access is prevented based at least in part on determining that the key associated with the received access command does not match the key associated with the one of the plurality of regions.

Images