Memory write access control

Abstract

This application is directed to memory write access control. In some instances, a memory system can include a storage space that is protected from access (e.g., protected from write access). To enable access to the protected storage space, a server node can communicate a command signed with a private key that is not accessible to the memory system to the memory system. The memory system can verify the command using a public key and can enable access to the protected storage space. Access commands associated with the protected storage space can be processed until access to the protected storage space is disabled.

Description

[0001] Cross-reference

[0002] This application claims priority to U.S. Patent Application No. 17 / 003,103, entitled “Memory Write Access Control,” filed August 26, 2020, by Liu, which is assigned to the assignee and is expressly incorporated herein by reference in its entirety. Technical Field

[0003] The technical field relates to memory write access control. Background Technology

[0004] The following text generally refers to one or more memory systems, and more specifically, to memory write access control.

[0005] Memory devices are widely used to store information in various electronic devices such as computers, wireless communication devices, cameras, and digital displays. Information is stored by programming memory cells within the memory device to different states. For example, a binary memory cell can be programmed to one of two supported states, typically corresponding to logic 1 or logic 0. In some instances, a single memory cell can support more than two possible states, any of which can be stored by the memory cell. To access the information stored by the memory device, a component can read or sense the state of one or more memory cells within the memory device. To store information, a component can write or program one or more memory cells within the memory device to corresponding states.

[0006] Various types of memory devices exist, including magnetic hard disks, random access memory (RAM), read-only memory (ROM), dynamic RAM (DRAM), synchronous dynamic RAM (SDRAM), ferroelectric RAM (FeRAM), magnetic RAM (MRAM), resistive RAM (RRAM), flash memory, phase-change memory (PCM), 3D crosspoint memory, NOR (Non-OR), and NAND (NAND) memory devices. Memory devices can be volatile or non-volatile. Volatile memory cells (e.g., DRAM cells) may lose their programmed state over time unless periodically refreshed by an external power supply. Non-volatile memory cells (e.g., NAND memory cells) can maintain their programmed state for a long period of time even without an external power supply. Summary of the Invention

[0007] A non-transitory computer-readable medium storing code is described. In some instances, the non-transitory computer-readable medium storing code may contain instructions that, when executed by a processor of a memory device, cause the memory device to: receive a command enabling write access to a portion of the memory device, wherein the command is signed using a private key associated with a server; enable write access to the portion of the memory device at least in part based on authenticating the command using a public key; receive a write command for an address of the portion of the memory device; and process the write command at least in part based on enabling write access to the portion of the memory device.

[0008] A system is described. In some instances, the system may include a memory device configured to be allocated for write access, wherein the memory device is configured to receive a command from a compute node to enable write access to a storage portion, enable write access to the storage portion at least in part based on authenticating the command using a public key, receive a write command for an address of the storage portion, and process the write command at least in part based on enabling write access to the storage portion.

[0009] A non-transitory computer-readable medium storing code is described. In some instances, the non-transitory computer-readable medium storing code may contain instructions that, when executed by a processor of a memory device, cause the memory device to: receive a write command to an address of a portion of the memory device, the write command being write-protected using a key pair containing a public key and a private key associated with a server external to the memory device; determine, at least in part, that the portion of the memory device is write-protected based on receiving the write command; and avoid processing the write command, at least in part, based on determining that the portion of the memory device is write-protected. Attached Figure Description

[0010] Figure 1 This describes an example of a system that supports memory write access control, based on examples disclosed herein.

[0011] Figure 2 This describes an example of a system that supports memory write access control, based on examples disclosed herein.

[0012] Figure 3 This document describes an example of a flowchart illustrating the process of supporting memory write access control, as disclosed in the examples herein.

[0013] Figure 4 A block diagram illustrating a memory device supporting memory write access control according to aspects of this disclosure.

[0014] Figure 5 and 6 The flowchart illustrates one or more methods for supporting memory write access control based on examples disclosed herein. Detailed Implementation

[0015] A computing system generally comprises an operating system that manages the hardware and software. A computing system may contain files, such as log files, for recording data on storage devices (e.g., memory devices). Generally, file access is controlled by the operating system, which may authorize access to one or more files based on attributes maintained for file system partitions, directories, or folders. This type of access may be referred to as operating system-level access, file system-level access, or file-level access. Therefore, access control to files on storage devices is typically associated with the computing system associated with the storage device and cannot be moved or accessed from different machines (e.g., different computing systems).

[0016] File-level access permissions are typically granted to supervisors, such as administrators or root users. In some cases, the root user may have access to all files on the storage device; however, the root user may not be the owner of all files. In some situations, a hacker could gain root privileges through malicious actions, and thus gain access to all files on the storage device. Therefore, it may be necessary to have access control that authorizes the storage device owner while preventing access from other users, including the root user.

[0017] This document describes methods and systems for authorizing access control to the owner of a storage device. Access control to a storage area used for files (e.g., log files) can be enabled using public / private key pairs, such as public key encryption (e.g., public key authentication). To authorize access (e.g., write access), a command can be signed using a private key belonging to a server associated with the owner (e.g., by generating a hash of the command and signing the hash using the private key). The storage device may store a public key corresponding to the private key, and the public key can be used to verify commands (e.g., by verifying the signed hash using the public key). The storage device may also have a physically unclonable function (PUF) for generating a device key public / private key pair for responding to commands about the owner. By authorizing access control to the owner of files, the systems and methods described herein prevent malicious actors from gaining access to files stored on the storage device.

[0018] First, as referenced Figure 1 and 2 The features of this disclosure are described in the context of the system described. (See references...) Figure 3 The features of this disclosure are described in the context of the process flowchart. (See references...) Figures 4 to 6The device diagrams and flowcharts relating to memory write access control described herein are used to further illustrate and describe these and other features of this disclosure, and reference is made to the device diagrams and flowcharts described herein.

[0019] Figure 1 This is an example of a system 100 that supports memory write access control according to examples disclosed herein. System 100 includes a host system 105 coupled to a memory system 110.

[0020] The memory system 110 may be or include any device or collection of devices, wherein the device or collection of devices includes at least one memory array. For example, the memory system 110 may be or include a Universal Flash Storage (UFS) device, an Embedded Multimedia Controller (eMMC) device, a flash device, a Universal Serial Bus (USB) flash device, a Secure Digital (SD) card, a Solid State Drive (SSD), a Hard Disk Drive (HDD), a Dual In-line Memory Module (DIMM), a Small Form-factor DIMM (SO-DIMM), or a Non-volatile DIMM (NVDIMM), and other possibilities.

[0021] System 100 may be included in a computing device such as a desktop computer, laptop computer, web server, mobile device, vehicle (e.g., airplane, drone, train, car or other means of transport), device with Internet of Things (IoT) capabilities, embedded computer (e.g., embedded computer included in a vehicle, industrial equipment or networked business device), or any computing device that includes memory and processing means.

[0022] System 100 may include a host system 105 that can be coupled to a memory system 110. In some instances, this coupling may include an interface to a host system controller 106, which may be an instance of a control component configured to cause the host system 105 to perform various operations as described herein. The host system 105 may include one or more devices, and in some cases, may include a processor chipset and a software stack executed by the processor chipset. For example, the host system 105 may include an application configured to communicate with the memory system 110 or devices therein. The processor chipset may include one or more cores, one or more caches (e.g., memory native to the host system 105 or included in the host system), a memory controller (e.g., an NVDIMM controller), and a storage protocol controller (e.g., a PCIe controller, a SATA controller). The host system 105 may use the memory system 110, for example, to write data to and read data from the memory system 110. Although Figure 1The diagram shows a memory system 110, but it should be understood that the host system 105 can be coupled to any number of memory systems 110.

[0023] Host system 105 may be coupled to memory system 110 via at least one physical host interface. In some cases, host system 105 and memory system 110 may be configured to communicate via the physical host interface using associated protocols (e.g., to exchange or otherwise convey control, address, data, and other signals between memory system 110 and host system 105). Examples of physical host interfaces may include, but are not limited to, Serial Advanced Technology Attachment (SATA) interfaces, UFS interfaces, eMMC interfaces, Peripheral Component Interconnect High Speed ​​(PCIe) interfaces, USB interfaces, Fibre Channel, Small Computer System Interface (SCSI), Serial Attached SCSI (SAS), Dual Data Rate (DDR), Dual In-line Memory Module (DIMM) interfaces (e.g., DDR-enabled DIMM socket interfaces), Open NAND Flash Interface (ONFI), and Low Power Dual Data Rate (LPDDR). In some instances, one or more of these interfaces may be contained in or otherwise supported between host system controller 106 of host system 105 and memory system controller 115 of memory system 110. In some instances, host system 105 may be coupled to memory system 110 via a corresponding physical host interface for each memory device 130 or memory device 140 included in memory system 110, or via a corresponding physical host interface for each type of memory device 130 or memory device 140 included in memory system 110 (e.g., host system controller 106 may be coupled to memory system controller 115).

[0024] Memory system 110 may include memory system controller 115, memory device 130, and memory device 140. Memory device 130 may include one or more memory arrays of a first type of memory cells (e.g., a type of non-volatile memory cells), and memory device 140 may include one or more memory arrays of a second type of memory cells (e.g., a type of volatile memory cells). Although in Figure 1 The example shows a memory device 130 and a memory device 140, but it should be understood that the memory system 110 may contain any number of memory devices 130 and memory devices 140, and in some cases, the memory system 110 may lack either memory device 130 or memory device 140.

[0025] The memory system controller 115 may be coupled to and communicate with the host system 105 (e.g., via a physical host interface) and may be an example of a control component configured to cause the memory system 110 to perform various operations according to the examples described herein. The memory system controller 115 may also be coupled to and communicate with memory device 130 or memory device 140 to perform operations generally referred to as access operations at memory device 130 or memory device 140, such as reading data, writing data, erasing data, or refreshing data, and other such operations. In some cases, the memory system controller 115 may receive commands from the host system 105 and communicate with one or more memory devices 130 or memory device 140 to execute such commands (e.g., at a memory array within one or more memory devices 130 or memory device 140). For example, the memory system controller 115 may receive commands or operations from the host system 105 and may translate these commands or operations into instructions or appropriate commands to enable desired access to memory device 130 or memory device 140. In some cases, the memory system controller 115 may exchange data with the host system 105 and with one or more memory devices 130 or memory device 140 (e.g., in response to or otherwise in conjunction with commands from the host system 105). For example, the memory system controller 115 may translate responses (e.g., data packets or other signals) associated with memory device 130 or memory device 140 into corresponding signals for the host system 105.

[0026] The memory system controller 115 may be configured for other operations associated with memory device 130 or memory device 140. For example, the memory system controller 115 may perform or manage operations such as wear leveling, garbage collection, error control operations such as error detection or error correction, encryption, caching, media management, background refresh, health monitoring, and address translation between logical addresses (e.g., logical block addresses (LBAs)) associated with commands from host system 105 and physical addresses (e.g., physical block addresses) associated with memory cells within memory device 130 or memory device 140.

[0027] The memory system controller 115 may include hardware, such as one or more integrated circuits or discrete components, buffer memories, or combinations thereof. The hardware may include circuitry with dedicated (e.g., hard-decoded) logic to perform the operations attributed herein to the memory system controller 115. The memory system controller 115 may be or include a microcontroller, a dedicated logic circuitry system (e.g., a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a digital signal processor (DSP)), or any other suitable processor or processing circuitry.

[0028] The memory system controller 115 may also include local memory 120. In some cases, local memory 120 may include read-only memory (ROM) or other memory that can store operational code (e.g., executable instructions) that can be executed by the memory system controller 115 to perform the functions attributed to the memory system controller 115 herein. In some cases, local memory 120 may additionally or alternatively include static random access memory (SRAM) or other memory used by the memory system controller 115 for, for example, internal storage or operations related to the functions attributed to the memory system controller 115 herein. Additionally or alternatively, local memory 120 may act as a cache for the memory system controller 115. For example, data may be stored in local memory 120 when read from or written to memory device 130 or memory device 140, and may be available within local memory 120 for subsequent retrieval or manipulation (updating) by the host system 105 according to a caching strategy (e.g., in the case of reduced latency relative to memory device 130 or memory device 140).

[0029] although Figure 1 The example of memory system 110 has been described as including memory system controller 115, but in some cases, memory system 110 may not include memory system controller 115. For example, memory system 110 may additionally or alternatively rely on external controllers (e.g., implemented by host system 105) or may perform the functions attributed herein to memory system controller 115, respectively, within memory device 130 or memory device 140. Generally, one or more functions attributed herein to memory system controller 115 may, in some cases, be performed by host system 105, local controller 135, or local controller 145, or any combination thereof.

[0030] Memory device 140 may include one or more arrays of volatile memory cells. For example, memory device 140 may include random access memory (RAM) cells, such as dynamic RAM (DRAM) cells and synchronous DRAM (SDRAM) cells. In some instances, memory device 140 may (e.g., by host system 105) support random access operations with reduced latency relative to memory device 130, or may provide one or more other performance differences relative to memory device 130.

[0031] Memory device 130 may include one or more arrays of non-volatile memory cells. For example, memory device 130 may include NAND (e.g., NAND flash) memory, ROM, phase-change memory (PCM), select memory, other chalcogenide-based memories, ferroelectric RAM (FeRAM), magnetic RAM (MRAM), NOR (e.g., NOR flash) memory, spin-transfer torque (STT)-MRAM, conductive bridged RAM (CBRAM), resistive random access memory (RRAM), oxide-based RRAM (OxRAM), and electrically erasable programmable ROM (EEPROM).

[0032] In some instances, memory device 130 or memory device 140 may each include (e.g., on the same die or within the same package) a local controller 135 or local controller 145, which can perform operations on one or more memory cells of memory device 130 or memory device 140. Local controller 135 or local controller 145 may operate in conjunction with memory system controller 115, or may perform one or more functions attributed herein to memory system controller 115. In some cases, memory device 130 or memory device 140 including local controller 135 or local controller 145 may be referred to as a managed memory device and may include a memory array and associated circuitry combined with a local (e.g., on-die or within-package) controller (e.g., local controller 135 or local controller 145). An example of a managed memory device is a managed NAND (MNAND) device.

[0033] In some cases, memory device 130 may be or include a NAND device (e.g., a NAND flash device). Memory device 130 may be or include a memory die 160. For example, in some cases, memory device 130 may be a package containing one or more dies 160. In some instances, die 160 may be a block of electronic-grade semiconductor diced from a wafer (e.g., a silicon die diced from a silicon wafer). Each die 160 may include one or more planes 165, and each plane 165 may include a set of corresponding blocks 170, wherein each block 170 may include a set of corresponding pages 175, and each page 175 may include a set of memory cells.

[0034] In some cases, the NAND memory device 130 may include memory cells configured to each store one bit of information, which may be referred to as a single-level cell (SLC). Alternatively, the NAND memory device 130 may include memory cells configured to each store multiple bits of information; if configured to store two bits of information, they may be referred to as a multi-level cell (MLC); if configured to store three bits of information, they may be referred to as a three-level cell (TLC); if configured to store four bits of information, they may be referred to as a four-level cell (QLC), or more generally, a multi-level memory cell. Multi-level memory cells can provide greater storage density compared to SLC memory cells, but in some cases, this may involve narrower read or write margins or greater complexity for supporting circuitry.

[0035] In some cases, plane 165 may refer to a group of blocks 170, and in some cases, parallel operations may occur within different planes 165. For example, parallel operations may be performed on memory cells within different blocks 170, provided that the different blocks 170 are in different planes 165. In some cases, performing parallel operations in different planes 165 may be subject to one or more restrictions, such as performing the same operation on memory cells within different pages 175, which have the same page address within their respective planes 165 (e.g., regarding command decoding, page address decoding circuitry, and other circuitry shared across planes 165).

[0036] In some cases, block 170 may contain memory cells organized into rows (page 175) and columns (e.g., strings, not shown). For example, memory cells in the same page 175 may share a common word line (e.g., coupled thereto), and memory cells in the same string may share a common digital line (which may alternatively be called a bit line) (e.g., coupled thereto).

[0037] For some NAND architectures, memory cells can be read and programmed (e.g., written) at a first granularity level (e.g., at the page granularity level), but can be erased at a second granularity level (e.g., at the block granularity level). That is, page 175 may be the smallest unit of memory (e.g., a collection of memory cells) that can be independently programmed or read (e.g., simultaneously programmed or read as part of a single programming or reading operation), and block 170 may be the smallest unit of memory (e.g., a collection of memory cells) that can be independently erased (e.g., simultaneously erased as part of a single erase operation). Furthermore, in some cases, NAND memory cells may be erased before they can be rewritten with new data. Therefore, for example, in some cases, the used page 175 may not be updated until the entire block 170 containing page 175 has been erased.

[0038] System 100 may include any number of non-transitory computer-readable media that support memory write access control. For example, host system 105, memory system controller 115, memory device 130, or memory device 140 may include or otherwise have access to one or more non-transitory computer-readable media that store instructions (e.g., firmware) for performing functions attributed herein to host system 105, memory system controller 115, memory device 130, or memory device 140. For example, such instructions, when executed by host system 105 (e.g., by host system controller 106), memory system controller 115, memory device 130 (e.g., by local controller 135), or memory device 140 (e.g., by local controller 145), may cause host system 105, memory system controller 115, memory device 130, or memory device 140 to perform one or more associated functions as described herein.

[0039] In some instances, memory system 110 may include access-protected storage space. For example, memory device 130 may be access-protected and accessible after being enabled (e.g., unlocked) by a server associated with the owner of memory system 110, which may be the same as or different from host system 105 (e.g., access commands from servers outside host system 105 may be sent via host system 105). To make memory device 130 or a portion thereof available for write access, the server may communicate a signed command to memory system 110. The command may be signed using a key that can only be accessed by the server (e.g., inaccessible to memory system 110). Memory system 110 may contain a public key that can be used to verify the signed command. After verifying the command, memory device 130 may be enabled for write access, and write access operations may be performed on memory device 130.

[0040] Once memory device 130 is enabled for write access, write access operations can be performed until memory device 130 is disabled (e.g., until write access to memory device 130 is disabled). To disable write access to memory device 130, a server (e.g., via host system 105) can communicate a signed command (e.g., a second signed command) to memory system 110. The command can be signed using a key accessible only to the server, and the command can be verified using a public key maintained by memory system 110. When the command is verified, memory device 130 can be disabled (e.g., write access operations can be prevented from being performed on memory device 130). By enabling write access to memory device 130 as described herein, write access can be controlled by the server, which prevents malicious actors from gaining access to data stored in memory system 110 (e.g., even when root access is gained against host system 105).

[0041] Figure 2 This describes an example of a system 200 that supports memory write access control, as disclosed herein. System 200 may include server node 205 and memory system 210, which may be referenced. Figure 1 Examples of server or host system 105 and storage system 110 described herein. Server node 205 may communicate with storage system 210 to enable access (e.g., write access) to protected portions of storage system 210 (e.g., protected storage portions). That is, server node 205 may enable (or disable) access control to storage system 210, which prevents malicious actors from gaining access to data stored in storage system 210. Server node 205 may be directly connected to storage system 210, or server node 205 may be connected to storage system 210 via other nodes. For example, the connection 260 between server node 205 and storage system 210 may include one or more networks, such as a local area network (LAN) or the Internet.

[0042] Server node 205 may be configured to generate commands that enable access to memory system 210 (e.g., write access). In some instances, server node 205 may be an instance of a server, computing device, host computing device, etc. Server node 205 may include a controller 215 (or a similar device, such as a processor) configured to generate commands to be conveyed to memory system 210. For example, controller 215 may generate commands that enable access to a portion of memory system 210 (e.g., write access) and commands that disable access to a portion of memory system 210 (e.g., write access).

[0043] Server node 205 may contain one or more keys for signing (e.g., encrypting) or verifying (e.g., decrypting) commands. For example, server node 205 may contain a private key 220 for signing commands that enable access to a portion of memory system 210 (e.g., write access). Private key 220 may be simply a private key known and / or accessible to server node 205, representing a private key used in a public-key cryptography (e.g., public key infrastructure (PKI)) scheme.

[0044] To enable access to a portion of the memory system 210, server node 205 can generate commands that include the address space of memory system 210. These commands can be signed using private key 220 (e.g., encrypted using a public-key encryption scheme). Since private key 220 is accessible only to server node 205, memory system 210 can verify commands from server node 205 by decrypting them using the corresponding public key. Therefore, server node 205 can control file system-level access to memory system 210, preventing other users (e.g., the root user of a host system connected to memory system 210) from gaining access to data stored on memory system 210.

[0045] In some instances, server node 205 may contain a copy of device public key 235-b received from memory system 210. As described herein, memory system 210 may contain a physically unclonable function (PUF) 240. PUF 240 may generate device public key 235-a that can be communicated to server node 205 and may be used to verify (e.g., decrypt) one or more commands generated by memory system 210 (e.g., and communicated to server node 205). Therefore, server node 205 may store a copy of device public key 235-b to verify commands received from memory system 210.

[0046] The memory system 210 may be configured to receive commands from server node 205 that enable access to protected storage space 255 (e.g., write access). In some instances, the memory system 210 may be an instance of a system within a computing device. In other instances, the memory system 210 may be an instance of a memory device (e.g., a non-volatile memory device), and / or may contain multiple memory devices (e.g., non-volatile memory devices).

[0047] like Figure 2As shown, memory system 210 may include storage space 250, which may contain one or more memory cells, such as non-volatile memory cells (e.g., flash memory cells). In some instances, storage space 250 may include a protected portion (e.g., protected storage space 255). For example, protected storage space 255 may be a subset of storage space 250 containing an address space (e.g., a range of protected memory addresses). In other instances, protected storage space 255 may include the entire storage space 250 of memory system 210 except for the portion reserved for storing one or more keys.

[0048] In some instances, protected storage space 255 may be configured to store communications between storage system 210 and users of storage system 210 (e.g., users of devices associated with storage system 210). These communications may be stored as transaction logs (e.g., log files) capturing the type, content, and / or time of transactions performed by individuals from terminals associated with storage system 210. When protected storage space 255 is enabled for access (e.g., enabled for write access), log files can be written to protected storage space 255, and / or log files previously stored on protected storage device 255 can be modified. Therefore, users can be authorized to access the data by server node 205, which prevents actors with file-level access (e.g., root access) from modifying data stored on protected storage space 255 when write access is not enabled on server node 205.

[0049] Memory system 210 may include a controller 245 configured to receive and process commands received from server node 205. For example, controller 245 may receive a signed command to enable access to protected storage space 255 (e.g., write access). Therefore, controller 245 may access one or more keys (e.g., public key 230 as described herein) and may use the keys to verify (e.g., decrypt) the signed command. Alternatively, controller 245 may receive a signed command to disable access to protected storage space 255 (e.g., write access) and may generate a command to be transmitted to server node 205. In some instances, controller 245 may use the private key of memory system 210 (e.g., using private key 225) to sign the command to be transmitted to server node 205.

[0050] Memory system 210 may contain one or more keys for verifying (e.g., decrypting) or signing (e.g., encrypting) commands. For example, memory system 210 may contain a public key 230 associated with a private key 220 of a computing node. In some cases, the public key may be stored in a protected portion of storage space 250 (e.g., protected storage space 255). Alternatively, the public key may be stored in a portion of storage space 250 or in controller 245 that is accessible only via a separate interface (e.g., not via the connection 260 between server node 205 and memory system 210). For example, public key 230 may represent a public key used in a public key encryption scheme used to enable access to protected storage space 255. Thus, when a signed command is received from server node 205, controller 245 can use public key 230 to verify (e.g., decrypt) the command.

[0051] After verifying the signed command, access to the protected storage space 255 can be enabled, and any subsequent commands (e.g., write commands) to the protected storage space 255 can be processed (e.g., via controller 245). For example, controller 245 can process access commands (e.g., write commands) for memory system 210. In some instances, the access command may be associated with an unlocked protected storage space 255. Alternatively, controller 245 may process access commands for unprotected (e.g., unwrite-protected) portions of memory system 210.

[0052] The memory system 210 may also include a private key 225 for signing commands communicated to the server node 205. For example, the private key 225 may be used to sign a command indicating that write access to protected storage space 255 is enabled. The command may be communicated along with (or in addition to) a device public key 235-a, which may be used by the server node 205 to verify the signed command. The private key 225 and the device public key 235-a may be instances of public-key cryptography schemes. As described herein, the device public key 235-a may be generated by a PUF 240 (e.g., a component configured to generate a PUF). The PUF 240 provides a physically defined digital fingerprint that acts as a unique identifier. The device public key 235-a may be communicated along with a digital fingerprint that identifies the memory system 210 as the source of the command. The server node 205 may verify the digital fingerprint before verifying the command (e.g., using the device public key 235-b) to ensure that the command is received from a trusted source. After the verification command, the memory system 210 can process the access command (e.g., write command) to the protected storage space 255 that has been enabled (e.g., unlocked).

[0053] For example, the controller 215 of server node 205 can generate a command to enable write access to log files in protected storage space 255. The command can be signed using private key 220. The command can be communicated to storage system 210 and processed by controller 245. Controller 245 can verify the signed command using public key 230, and after verification, enable write access to log files in protected storage space 255. Log files can then be written to protected storage space 255, and / or existing log files stored in protected storage space 255 can be modified.

[0054] In some instances, controller 245 may use private key 225 to generate a signed command to confirm enabling write access to protected storage space 255. The signed command may be communicated along with device public key 235-a generated using PUF 240. Server node 205 may verify the signed command using device public key 235-b, and may subsequently issue additional signed commands to disable write access to protected storage space 255. The additional commands may be signed using private key 220, and controller 245 may verify the signed commands using public key 230. After verifying the additional commands, write access to log files in protected storage space 255 may be disabled. By using the methods described herein for enabling write access to protected storage space 255, server node 205 can control access to storage system 210, which prevents malicious actors from gaining access to data stored in storage system 210.

[0055] Figure 3 This describes an example of a process flowchart 300 supporting memory write access control, as disclosed herein. Process flowchart 300 may include or be performed by server node 305, compute node 310, and memory device 315. In some instances, server node 305 may be an instance of server node 205, and memory device 315 may be an instance of server node 205, as described in the references. Figure 2 The memory system 210 or an instance of a component of the memory system 210 described herein. Alternatively, the compute node 310 may be as described in the references. Figure 1 The components of the described host system 105 may be instances of nodes between server node 305 and storage device 315. In some instances, server node 305 and compute node 310 may be associated with the same owner (e.g., the same entity, organization, enterprise, etc.). In other cases, server node 305 may be associated with the owner of storage device 315, while compute node 310 is an independent node.

[0056] Server node 305 can communicate with memory device 315 to enable access (e.g., write access) to a protected portion of memory device 315 (e.g., protected storage portion). Once access is enabled, compute node 310 can access (e.g., via one or more access commands) the protected portion of memory device 315. Therefore, server node 305 can control access to memory device 315, which prevents malicious actors from accessing data stored on memory device 315 via compute node 310.

[0057] At 320, a private key may be generated and stored at server node 305. The private key may represent a private key used in a public-key encryption scheme and may be generated and / or stored during the manufacturing process of server node 305 and / or storage device 315. As described herein, the private key may be accessible only by server node 305 and can be used to control system, block, partition, directory, or file-level access to storage device 315.

[0058] At 325, a public key corresponding to the private key (e.g., generated and stored at 320) can be generated and stored in memory device 315. The public key may represent a public key corresponding to the private key used in a public-key cryptography scheme and may be generated and / or stored during the manufacturing process of server node 305 and / or memory device 315. The public key may be stored in an access-protected (e.g., write-protected) portion of the memory device 315 and can be used to verify commands signed using the private key. Alternatively, the public key may be stored in an area inaccessible via access commands (e.g., not within the address space of memory device 315) or in an unprotected area. Verification of the signed command authorizes system, block, partition, directory, or file-level access to memory device 315 to compute node 310.

[0059] At 330, a private key can be generated and stored at memory device 315. The private key may represent a private key used in a public-key encryption scheme and may be generated and / or stored during the manufacturing process of memory device 315. The private key may be stored in a portion of memory device 315 that can be accessed only by memory device 315, or may be accessed only via an interface separate from the interface used to connect memory device 315 to computing node 310 (e.g., a local interface). In some instances, the private key can be used to sign commands communicated to server node 305. In some instances, the signed command may be linked to the device public key (e.g., as referenced). Figure 2 The described device communicates using public key 235-a).

[0060] At location 335, a secure storage region for memory device 315 can be initialized. (See reference...) Figure 2As described, a secure storage region (e.g., protected storage space 255) can be configured to store data such as log files. Therefore, at 335, an address range of the storage space of the memory device 315 can be designated (e.g., set, allocated) as a secure storage region. Compute node 310 can access the secure storage region when a signed command used to enable access to the secure storage region is verified. Although shown in the order of setup, the operations at 320, 325, 330, and 335 can be performed serially or simultaneously, and can be synchronized with... Figure 3 The order in which the different sequences are displayed is the execution order.

[0061] At 340, compute node 310 may optionally send one or more access commands to memory device 315. The access commands may be associated with a secure storage region. At 345, memory device 315 may optionally suppress one or more access commands due to the secure storage region being access-protected (e.g., write-protected). For example, memory device 315 may suppress write access commands for a locked secure storage region, while memory device 315 may execute read access commands for a locked secure storage region. In some instances, memory device 315 may recognize that an address (e.g., an address range) indicated by an access command is associated with a locked storage region and may effectively ignore (e.g., not process) the associated command (e.g., a write access command). Memory device 315 may indicate to compute node 310 (e.g., via notification; not shown) that the access command is suppressed.

[0062] At 350, server node 305 may generate a write enable command. As described herein, the write enable command may be signed (e.g., encrypted) using a private key accessible only to server node 305 (e.g., the private key generated and stored at 320). In some instances, a hash of the write enable command may be generated. After the hash is generated, it may be signed using the private key before being communicated to memory device 315. The write enable command may indicate the address space or range of a secure storage region to be enabled (e.g., unlocked), or it may indicate that the entire secure storage region will be enabled. At 355, the signed write enable command may be communicated to memory device 315.

[0063] At 360, memory device 315 can enable access to a portion of the secure storage region indicated by a write enable command. Memory device 315 can enable access by verifying (e.g., decrypting) a signed command using a public key corresponding to a private key used to sign the write enable command (e.g., the public key generated and stored at 325). In some instances, memory device 315 can use the public key to verify a signed hash (e.g., the hash of the write enable command). When the write enable command is verified, a portion of the secure storage region indicated by the command (e.g., the address space or range indicated by the command) can be enabled for write access.

[0064] At 365, the memory device may optionally generate a response command in response to enabling access to a portion of the secure storage region. The response command may be signed (e.g., encrypted) using a private key accessible only by the memory device 315 (e.g., the private key generated and stored at 330). The response command may indicate that a portion of the secure storage region is enabled for access (e.g., write access). In some instances, in addition to generating a response command, a device public key may also be generated. The device public key may use a PUF (e.g., as referenced). Figure 2 The described PUF component 240) generates the response and can be communicated along with or separately from the response command. The device public key can be used by the server node 305 to verify (e.g., decrypt) the response command.

[0065] At 370, the response command may optionally be communicated to server node 305. In some instances, the device public key may be communicated along with the response command or separately from the response command (e.g., separately from the response command). At 375, server node 305 may optionally use the device public key to verify (e.g., decrypt) the response command. At 380, server node 305 may optionally send a notification to compute node 310 indicating that a portion of the secure storage area is enabled for access (e.g., write access).

[0066] At 385, compute node 310 can communicate one or more access commands (e.g., write commands) to the enabled portion of the secure storage region. As described herein, the enabled portion of the secure storage region can be used to store log files, and therefore access commands communicated from compute node 310 to storage device 315 can be used to write log files to the secure storage region and / or edit log files stored in the secure storage region. At 390, the enabled portion of the secure storage region can be accessed (e.g., via access commands).

[0067] At 393, server node 305 may optionally generate a write deactivation command. As described herein, the write deactivation command may be signed (e.g., encrypted) using a private key accessible only to server node 305 (e.g., the private key generated and stored at 320). The write deactivation command may deactivate the address space of a previously enabled (e.g., at 360) secure storage region. At 395, the signed write deactivation command may optionally be communicated to memory device 315.

[0068] At 397, memory device 315 may optionally disable access to a portion of a previously enabled secure storage region. Access can be disabled by verifying (e.g., decrypting) a signed command using a public key corresponding to a private key used to sign the write disable command (e.g., the public key generated and stored at 325). When the write disable command is verified, a portion of the secure storage region indicated by the command (e.g., the address space indicated by the command) may be disabled for access (e.g., for write access).

[0069] Aspects of process flow 300 may be implemented by a controller and other components. Alternatively, aspects of process flow 300 may be implemented as instructions stored in memory (e.g., firmware stored in memory coupled to memory device 315). For example, the instructions are implemented by a controller (e.g., as referenced in...). Figure 2 When the controller 245 and / or controller 215 described are executed, they can cause the controller to perform the operation of process flow 300.

[0070] Figure 4 A block diagram 400 illustrates a memory device 405 supporting memory write access control according to an example disclosed herein. The memory device 405 may be as described in the references... Figure 2 and 3 Examples of aspects of the described memory device and / or memory system. Memory device 405 may include a receiving component 410, an enabling component 415, a processing component 420, an identification component 425, an authentication component 430, a transmitting component 435, a generating component 440, and a determining component 445. Each of these modules may communicate with each other directly or indirectly (e.g., via one or more buses).

[0071] The receiving component 410 can receive, via the memory device, a command enabling write access to a portion of the memory device, wherein the command is signed using a private key associated with a server. In some instances, the receiving component 410 can receive a write command to an address of a portion of the memory device. In some instances, the receiving component 410 can receive a write command to an address of a portion of the memory device, the write command being write-protected using a key pair containing a public key and a private key associated with a server external to the memory device.

[0072] In some instances, receiving component 410 may receive, via the memory device, a second command for disabling write access to a portion of the memory device after processing a write command, wherein the second command is signed using a private key. In some instances, receiving component 410 may receive, via the memory device, a command for enabling write access to a portion of the memory device based on sending a notification to a server, wherein the command is signed using a private key associated with the server. In some instances, receiving component 410 may receive, via the memory device, a second write command for the address of a portion of the memory device.

[0073] Enabling component 415 can enable write access to portions of the memory device based on a public key authentication command. In some instances, enabling component 415 can enable write access to portions of the memory device based on a public key authentication command.

[0074] Processing component 420 may process a write command through the memory device based on enabling write access to a portion of the memory device. In some instances, processing component 420 may avoid processing a write command through the memory device based on determining that a portion of the memory device is write-protected. In some instances, processing component 420 may process a second write command through the memory device based on enabling write access to a portion of the memory device.

[0075] The identification component 425 can identify, at least in part, a portion of the memory device for write access based on a received command, wherein enabling write access to the portion of the memory device is based on the identification.

[0076] The verification component 430 can use a public key corresponding to a private key associated with a server to verify the signature of a command via a memory device, wherein processing of a write command is based on verifying the signed command.

[0077] The transmitting component 435 can transmit a third command signed using the private key of the memory device, wherein the third command is configured to indicate that the command is authenticated. In some instances, the transmitting component 435 can transmit the device's public key from the memory device to a server. In some instances, the transmitting component 435 can transmit a notification to a server.

[0078] The generation component 440 may generate a device public key for verifying a third command at the memory device and using a physically unclonable function (PUF). In some instances, the generation component 440 may generate a notification from the memory device indicating that a write command has not been processed, based on the need to avoid processing write commands.

[0079] The determination component 445 can determine that a portion of the memory device is write-protected based on the receipt of a write command.

[0080] Figure 5 The flowchart illustrates one or more methods 500 supporting memory write access control according to aspects of this disclosure. Operation of method 500 may be implemented by a memory device or its components as described herein. For example, operation of method 500 may be performed by, as referenced... Figure 4 The described memory device performs the function. In some instances, the memory device may execute a set of instructions to control the functional elements of the memory device to perform the described function. Alternatively, the memory device may use dedicated hardware to perform aspects of the described function.

[0081] At position 505, a command enabling write access to a portion of the memory device can be received. The command can be signed using a private key associated with the server. The operation of position 505 can be performed according to the methods described herein. In some instances, aspects of the operation of position 505 may be as described in the references... Figure 4 The described receiving component is executed.

[0082] At point 510, write access to a portion of the memory device can be enabled based on a public key authentication command. The operation at point 510 can be performed according to the methods described herein. In some instances, aspects of the operation at point 510 may be provided as referenced. Figure 4 The described enable component execution.

[0083] At 515, write commands to the address portion of the memory device can be received. The operation of 515 can be performed according to the methods described herein. In some instances, aspects of the operation of 515 may be as described in the references... Figure 4 The described receiving component is executed.

[0084] At point 520, write commands can be processed based on enabling write access to a portion of the memory device. The operation of point 520 can be performed according to the methods described herein. In some instances, aspects of the operation of point 520 can be derived from, as referenced... Figure 4 The described processing component is executed.

[0085] In some instances, the device as described herein may perform one or more methods, such as method 500. The device may include features, means, or instructions (e.g., a non-transitory computer-readable medium storing instructions executable by a processor) for performing the following operations: receiving, via a memory device, a command enabling write access to a portion of the memory device, wherein the command is signed using a private key associated with a server; enabling write access to a portion of the memory device via the memory device based on authenticating the command using a public key; receiving, via the memory device, a write command for an address of a portion of the memory device; and processing, via the memory device, the write command based on enabling write access to a portion of the memory device.

[0086] Method 500 and some instances of the devices described herein may further include operations, features, means, or instructions for identifying, at least in part, a portion of the memory device for write access based on receiving the command, wherein enabling write access to the portion of the memory device may be based on the identification.

[0087] Method 500 and some instances of the devices described herein may further include operations, features, means, or instructions for receiving a second command via the memory device to disable write access to portions of the memory device after processing a write command, wherein the second command may be signed using a private key.

[0088] In some instances of method 500 and the device described herein, the authentication command may include operations, features, means, or instructions for verifying the signature of the command via a memory device using a public key corresponding to a private key associated with a server, wherein processing of the write command may be based on verifying the signed command.

[0089] Method 500 and some instances of the devices described herein may further include operations, features, means, or instructions for transmitting a third command from the memory device that can be signed using the private key of the memory device, wherein the third command may be configured to indicate that the command is authenticated.

[0090] Method 500 and some instances of the devices described herein may further include operations, features, means, or instructions for performing the following: generating a device public key at the memory device and using a physically unclonable function (PUF) for verifying a third command; and transmitting the device public key from the memory device to a server.

[0091] In some instances of method 500 and the devices described herein, a portion of the memory device may be associated with a corresponding portion of a first address space of the memory device, wherein a public key may be stored in a second address space that may not contain the first address space.

[0092] In some instances of method 500 and the devices described herein, the first address space may be accessible after a public key authentication command is used, and the second address space may be accessible only by a memory device.

[0093] Figure 6 The flowchart illustrates one or more methods 600 supporting memory write access control according to aspects of this disclosure. Operation of method 600 can be implemented by a memory device or its components as described herein. For example, operation of method 600 can be performed by, as referenced... Figure 4 The described memory device performs the function. In some instances, the memory device may execute a set of instructions to control the functional elements of the memory device to perform the described function. Alternatively, the memory device may use dedicated hardware to perform aspects of the described function.

[0094] At 605, a write command to a portion of the address of the memory device can be received, the write command being write-protected using a key pair containing a public key and a private key associated with a server external to the memory device; the operation of 605 can be performed according to the methods described herein. In some instances, aspects of the operation of 605 may be as referenced Figure 4 The described receiving component is executed.

[0095] At 610, the portion of the write-protected memory device can be determined based on the receipt of a write command. The operation of 610 can be performed according to the methods described herein. In some instances, aspects of the operation of 610 may be determined by reference to [reference needed]. Figure 4 The described component is executed.

[0096] At 615, write commands can be avoided by determining that a portion of the memory device is write-protected. The operation at 615 can be performed according to the methods described herein. In some instances, aspects of the operation at 615 may be as described in the references... Figure 4 The described processing component is executed.

[0097] In some instances, the device as described herein may perform one or more methods, such as method 600. The device may include features and apparatus instructions (e.g., a non-transitory computer-readable medium storing instructions executable by a processor) for performing the following operations: receiving a write command via the memory device to an address of a portion of the memory device, the write command being write-protected using a key pair containing a public key and a private key associated with a server external to the memory device; determining, based on receiving the write command, that a portion of the memory device is write-protected; and avoiding processing the write command via the memory device based on determining that a portion of the memory device is write-protected.

[0098] Method 600 and some instances of the devices described herein may further include operations, features, means, or instructions for performing: generating a notification via the memory device based on avoiding processing a write command, the notification indicating that the write command has not been processed; and sending the notification to a server.

[0099] Method 600 and some examples of the devices described herein may further include operations, features, means, or instructions for: receiving, via the memory device, a command enabling write access to a portion of the memory device based on transmitting a notification to a server, wherein the command is signed using a private key associated with the server; enabling write access to a portion of the memory device via the memory device based on authenticating the command using a public key; receiving, via the memory device, a second write command for an address of a portion of the memory device; and processing, via the memory device, the second write command based on enabling write access to a portion of the memory device.

[0100] It should be noted that the methods described above describe possible implementations, and the operations and steps may be rearranged or otherwise modified, and other implementations are possible. Furthermore, two or more parts from the methods described may be combined.

[0101] The information and signals described herein can be represented using any of a variety of techniques and methods. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the foregoing description can be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, optical fields or optical particles, or any combination thereof. Some diagrams may show signals as single signals; however, those skilled in the art will understand that the signals may represent signal buses, where the buses may have various bit widths.

[0102] The terms "electronic communication," "conductive contact," "connection," and "coupling" refer to the relationship between components that enables the flow of signals between them. Components are considered to be in electronic communication with each other (or in conductive contact with each other, or connected to each other, or coupled to each other) if there is any conductive path between them that enables the flow of signals at any given time. At any given time, the conductive path between components that are in electronic communication with each other (or in conductive contact with each other, or connected to each other, or coupled to each other) can be open or closed, depending on the operation of the device containing the connected components. The conductive path between connected components can be a direct conductive path between the components, or an indirect conductive path between connected components that may include intermediate components such as switches, transistors, or other components. In some instances, one or more intermediate components, such as switches or transistors, may be used to interrupt the signal flow between connected components for a period of time.

[0103] The term "coupling" refers to the condition of moving from an open-circuit relationship between components to a closed-circuit relationship, in which a signal is currently not allowed to travel between the components via a conductive path, and in which a signal can travel between the components via the conductive path. When a component, such as a controller, couples other components together, the component initially allows a change in the flow of signals between the other components via conductive paths that were previously not permitted.

[0104] The term "isolation" refers to a relationship between components where signals cannot currently flow between them. Components are isolated from each other if there is an open circuit between them. For example, components separated by a switch positioned between them are isolated from each other when the switch is open. When a controller isolates two components, it prevents signals from flowing between them using previously permitted conductive paths.

[0105] The devices containing memory arrays discussed herein can be formed on semiconductor substrates, such as silicon, germanium, silicon-germanium alloys, gallium arsenide, gallium nitride, etc. In some instances, the substrate is a semiconductor wafer. In other instances, the substrate can be a silicon-on-insulator (SOI) substrate, such as silicon-on-glass (SOG) or silicon-on-sapphire (SOP), or an epitaxial layer of semiconductor material on another substrate. The conductivity of the substrate or subregions of the substrate can be controlled by doping with various chemicals containing, but not limited to, phosphorus, boron, or arsenic. Doping can be performed during the initial formation or growth of the substrate, either by ion implantation or by any other doping method.

[0106] The switching components or transistors discussed herein may represent field-effect transistors (FETs) and include a three-terminal device comprising a source, drain, and gate. These terminals may be connected to other electronic components via a conductive material, such as a metal. The source and drain may be conductive and may comprise heavily doped (e.g., degenerate) semiconductor regions. The source and drain may be separated by lightly doped semiconductor regions or channels. If the channel is n-type (i.e., the majority of charge carriers are electrons), then the FET may be called an n-type FET. If the channel is p-type (i.e., the majority of charge carriers are holes), then the FET may be called a p-type FET. The channel may be end-capped with an insulating gate oxide. The channel conductivity can be controlled by applying a voltage to the gate. For example, applying a positive or negative voltage to an n-type FET or a p-type FET, respectively, can make the channel conductive. When a voltage greater than or equal to the transistor's threshold voltage is applied to the transistor's gate, the transistor may be "on" or "activated." When a voltage less than the transistor's threshold voltage is applied to the transistor's gate, the transistor may be "off" or "deactivated."

[0107] The descriptions herein, illustrated with reference to the accompanying drawings, depict exemplary configurations and do not represent all instances that can be implemented or that are within the scope of the claims. The term "exemplary" as used herein means "serving as an example, illustration, or description" and is not "preferred" or "superior" to other instances. The detailed description includes specific details that provide an understanding of the described techniques. However, these techniques can be practiced without these specific details. In some cases, well-known structures and apparatuses are shown in block diagram form to avoid obscuring the concepts of the described instances.

[0108] In the accompanying drawings, similar components or features may have the same reference numerals. Furthermore, various components of the same type can be distinguished by a dash followed by the reference numeral and a second label to differentiate similar components. If only the first reference numeral is used in the specification, the description applies to any of the similar components that have the same first reference numeral but are independent of the second reference numeral.

[0109] The information and signals described herein can be represented using any of a variety of techniques and methods. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the foregoing description can be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, light fields or light particles, or any combination thereof.

[0110] The various illustrative blocks and modules described in connection with the disclosure herein may be implemented or performed using a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware component or any combination thereof designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but alternatively, the processor may be any processor, controller, microcontroller or state machine. The processor may also be implemented as a combination of computing devices (e.g., a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors incorporating a DSP core, or any other such configuration).

[0111] The functionality described herein can be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented as software executed by a processor, the functionality can be stored on or transmitted via a computer-readable medium as one or more instructions or code. Other examples and embodiments are within the scope of this disclosure and the appended claims. For example, due to the nature of software, the functionality described above can be implemented using software executed by a processor, hardware, firmware, hardwired, or any combination thereof. Features implementing the functionality can also be physically located in various locations, including distributed implementations such that portions of the functionality are implemented in different physical locations. Furthermore, as used herein, the word "or" in the list of items included in the claims (e.g., a list of items beginning with phrases such as "at least one of" or "one or more of") indicates an inclusive list, such that a list of at least one of, for example, A, B, or C means A or B or C or AB or AC or BC or ABC (i.e., A and B and C). And, as used herein, the phrase "based on" should not be construed as a reference to a closed set of conditions. For example, without departing from the scope of this disclosure, an exemplary step described as “based on condition A” may be based on both condition A and condition B. In other words, as used herein, the phrase “based on” should also be interpreted as the phrase “at least partially based on”.

[0112] Computer-readable media includes both non-transitory computer storage media and communication media, with communication media encompassing any media that facilitates the transfer of a computer program from one place to another. Non-transitory storage media can be any available media accessible by a general-purpose or special-purpose computer. By way of example, and not limitation, non-transitory computer-readable media may include RAM, ROM, electrically erasable programmable read-only memory (EEPROM), optical disc (CD) ROM or other optical disc storage devices, magnetic disk storage devices or other magnetic storage devices, or any other non-transitory media that can be used to carry or store desired program code in the form of instructions or data structures and is accessible by a general-purpose or special-purpose computer or a general-purpose or special-purpose processor. Furthermore, any connection is appropriately referred to as computer-readable media. For example, if software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then such coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave are included in the definition of media. As used herein, disks and optical discs include CDs, laser discs, optical discs, digital versatile discs (DVDs), floppy disks, and Blu-ray discs, where disks typically reproduce data magnetically, while optical discs reproduce data optically using lasers. Combinations of these are also included within the scope of computer-readable media.

[0113] The description herein is provided to enable those skilled in the art to make or use this disclosure. Various modifications to this disclosure will be apparent to those skilled in the art, and the general principles defined herein can be applied to other variations without departing from the scope of this disclosure. Therefore, this disclosure is not limited to the examples and designs described herein, but is given the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A non-transitory computer-readable medium storing code comprising instructions that, when executed by a processor of a memory device, cause the memory device to: receive a command to enable write access to a portion of the memory device, wherein the command is signed using a private key accessible to a server; enable write access to the portion of the memory device based at least in part on authenticating the command using a public key; receive a write command to an address of the portion of the memory device; process the write command based at least in part on enabling write access to the portion of the memory device; receive a second command to disable only the write access to the portion of the memory device after processing the write command, wherein the second command is signed using the private key; transmit a third command, wherein the third command comprises an indication that the command is unauthenticated, wherein the third command is signed using a private key specific to the memory device; and transmit a fourth command, wherein the fourth command comprises a key to validate the third command.

2. The non-transitory computer-readable medium of claim 1, wherein the instructions that, when executed by the processor of the memory device, further cause the memory device to: identify the portion of the memory device for write access based at least in part on receiving the command, wherein enabling the write access to the portion of the memory device is based at least in part on the identification.

3. The non-transitory computer-readable medium of claim 1, wherein the instructions that, when executed by the processor of the memory device, further cause the memory device to: validate a signature of the command using the public key corresponding to the private key associated with the server, wherein processing the write command is based at least in part on validating the signature of the command.

4. The non-transitory computer-readable medium of claim 1, wherein the instructions that, when executed by the processor of the memory device, further cause the memory device to: generate a device public key for validating the third command using a physically unclonable function (PUF); and transmit the device public key to the server.

5. The non-transitory computer-readable medium of claim 1, wherein the portion of the memory device is associated with a corresponding portion of a first address space of the memory device, and wherein the public key is stored to a second address space that does not include the first address space.

6. The non-transitory computer-readable medium of claim 5, wherein the first address space is accessible after authenticating the command using the public key, and wherein the second address space is only accessible by the memory device.

7. A memory system, comprising: a memory device configured to be allocated for write access, the memory device configured to: receive a command from a compute node to enable write access to a portion of storage, wherein the command is signed using a private key accessible to the compute node; enable write access to the portion of storage based at least in part on authenticating the command using a public key; receive a write command to an address of the portion of storage; process the write command based at least in part on enabling write access to the portion of storage; receive a second command to disable the write access to the portion of the memory device after processing the write command, wherein the second command is signed using the private key; transmit a third command to the compute node, wherein the third command comprises an indication that the command is not authenticated, wherein the third command is signed using a private key specific to the memory device; and transmit a fourth command to the compute node, wherein the fourth command comprises a key to validate the third command.

8. The memory system of claim 7, wherein the memory device is configured to: identify the portion for write access based at least in part on receiving the command, wherein enabling the write access to the portion of the memory device is based at least in part on the identification.

9. The memory system of claim 7, further comprising: the compute node, wherein the compute node is configured to: sign the command using the private key that is only accessible to the compute node.

10. The memory system of claim 9, wherein the memory device is configured to authenticate the command by: validating a signature of the command using the public key associated with the private key, wherein the public key is only accessible to the memory device, wherein the memory device is configured to process the write command based at least in part on validating the signature of the command.

11. The memory system of claim 9, wherein the compute node is configured to: transmit the second command to the memory device after transmitting the command.

12. The memory system of claim 11, wherein receiving the second command comprises receiving the second command from the compute node, and wherein the memory device is configured to: disable write access to the portion of storage based at least in part on authenticating the second command using the public key.

13. The memory system of claim 12, wherein the memory device is configured to: receive a second write command to the address of the portion of storage; and refrain from processing the second write command based at least in part on disabling the write access to the portion of storage.

14. The memory system of claim 7, wherein the compute node is configured to: receive the third command; receive the fourth command; validate the third command using the key received with the fourth command; and retransmit the command to the memory device based at least in part on the third command indicating that the command is not authenticated.

Images