Device intrusion detection via variable code comparison

Abstract

This application relates to apparatuses and methods related to detecting synchronization between multiple devices. If a device receives a command from an unauthorized source, the security of the device can be compromised. The state of a device can be affected by the command received by the device. Different devices can determine whether there is synchronization between a device and the different device to determine whether the security of the device can have been compromised.

Description

Technical Field

[0001] This disclosure generally relates to memory, and more specifically, to devices and methods associated with device intrusion detection via variable code comparison. Background Technology

[0002] Memory devices are typically provided as internal semiconductor integrated circuit devices in computers or other electronic devices. Many different types of memory exist, including volatile and non-volatile memory. Volatile memory may require power to maintain its data and includes random access memory (RAM), dynamic random access memory (DRAM), and synchronous dynamic random access memory (SDRAM), among others. Non-volatile memory provides persistent data by retaining the stored data when no power is supplied and includes NAND flash memory, NOR flash memory, read-only memory (ROM), electrically erasable programmable ROM (EEPROM), erasable programmable ROM (EPROM), and resistive variable memory, such as phase-change random access memory (PCRAM), resistive random access memory (RRAM), and magnetoresistive random access memory (MRAM), among others.

[0003] Memory is also used as a volatile and non-volatile data storage device for a wide range of electronic applications. These include, but are not limited to, personal computers, portable memory sticks, digital cameras, cellular phones, portable music players such as MP3 players, movie players, and other electronic devices. Memory cells can be arranged in arrays, wherein the array is used in the memory device.

[0004] Various computing systems contain several processing resources coupled to memory (e.g., a memory system), which is accessed in association with executing a set of instructions (e.g., a program, an application, etc.). For various reasons, the memory system may receive commands from multiple sources. Some commands may be authorized while others are unauthorized. Attached Figure Description

[0005] Figure 1 This is a block diagram of a device in the form of a computing system including a memory device, according to several embodiments of the present disclosure.

[0006] Figure 2 This is a block diagram of a device in the form of a computing system including a memory device and a controller, according to several embodiments of the present disclosure.

[0007] Figure 3 This is a block diagram of a device in the form of a computing system including a memory device and a controller, according to several embodiments of the present disclosure.

[0008] Figure 4An example system for variable code comparison is shown according to several embodiments of the present disclosure.

[0009] Figure 5 An example system for variable code comparison is shown according to several embodiments of the present disclosure.

[0010] Figure 6 An example system for variable code comparison is shown according to several embodiments of the present disclosure.

[0011] Figure 7 Example flowcharts for variable code comparison according to several embodiments of the present disclosure are shown.

[0012] Figure 8 An example machine of a computer system is shown, within which a set of instructions can be executed to cause the machine to perform the various methods discussed herein. Detailed Implementation

[0013] This disclosure includes devices and methods related to intrusion detection via variable code comparison. In several instances, devices may be subject to security threats. It may be necessary to identify which devices may have experienced such security threats.

[0014] As used herein, an example of a security threat is the unauthorized use of devices such as memory devices, Internet of Things (IoT) devices, central processing units (CPUs), and so on. For example, unauthorized use of a device may involve causing the device to process unauthorized commands. Unauthorized commands may include commands provided by an unauthorized source to provide commands to the device.

[0015] In some instances, if a device has received and / or processed an unauthorized command, then the first device can be identified as having experienced a security threat. If a received command changes the state of the first device, then the command received by the first device can be considered unauthorized. The state of the first device can be verified by a second device. The second device can be authorized to provide commands to the first device. The state of the first device can reflect the state of the first device. The states of the first and second devices can depend on the generation and reception of the command.

[0016] For example, a first device may generate a command and provide that command to a second device. Generating and / or providing a command to the second device may contribute to the state of the second device or a portion thereof. Receiving and / or processing a command by the first device may change the state of the first device such that the state of the first device reflects the state of the second device, or vice versa. Receiving and / or processing a command not received from the first device by the second device may change the state of the second device without altering the state of the first device. The state of the second device may differ from the state of the first device, allowing the first device to identify the second device as having experienced a security threat.

[0017] As used herein, “several things” can refer to one or more of such things. For example, “several memory devices” can refer to one or more memory devices. “Multiple things” means two or more. Additionally, designations such as “N” as used herein, especially with respect to reference numerals in the figures, indicate that several specific features so specified may be included together with several embodiments of this disclosure.

[0018] The figures in this document follow a numbering convention, where the first one or more numbers correspond to the figure number, and the remaining numbers identify elements or components in the figures. Similar elements or components can be identified between different figures by using similar numbers. As will be understood, elements shown in various embodiments herein may be added, interchanged, and / or removed to provide several additional embodiments of this disclosure. Furthermore, the scale and relative dimensions of the elements provided in the figures are intended to illustrate various embodiments of this disclosure and are not intended to be limiting.

[0019] Figure 1 This is a block diagram of a device in the form of a computing system 100 including a memory device 103, according to several embodiments of the present disclosure. As used herein, for example, the memory device 103, the memory array 110, and / or the controller 102 may also be individually considered as a “device”.

[0020] In this example, system 100 includes a controller 102 coupled to memory device 103 via interface 104. The computing system 100 may be a personal laptop, desktop computer, digital camera, mobile phone, memory card reader, or Internet of Things (IoT) enabled device, as well as various other types of systems. The controller 102 may be a system controller for a memory system including multiple memory devices 103, wherein the system controller 102 provides access to the respective memory devices 103 via processing resources such as a central processing unit (CPU). The controller 102 may be a host that includes several processing resources (e.g., one or more processors, microprocessors, or other types of control circuitry) capable of accessing the memory 103. System 100 may include a separate integrated circuit, or the controller 102 and memory device 103 may both be on the same integrated circuit.

[0021] Controller 102 may be responsible for providing access to the host. Controller 102 may provide commands to memory device 103. Controller 102 may also determine whether other devices (e.g., unauthorized devices) have provided commands to memory device 103. Controller 102 may determine whether other devices have provided commands to memory device 103 by analyzing the state of memory device 103 and / or the state of a portion of memory device 103. The state of memory device 103 may be affected by commands received and / or processed by memory device 103. Controller 102 may analyze the state of memory device 103 by comparing the state of memory device 103 with the state of controller 102 and / or a portion of controller 102. The state of controller 102 and / or a portion of controller 102 may be affected by commands provided by controller 102 to memory device 103. Figure 2 and 3 Describe the relationship between commands and the state of controller 102 and / or memory device 103.

[0022] For clarity, system 100 has been simplified to focus on features particularly relevant to this disclosure. For example, memory array 110 may be a DRAM array, SRAM array, STT RAM array, PCRAM array, TRAM array, RRAM array, NAND flash array, and / or NOR flash array. Array 110 may include memory cells arranged in rows coupled by access lines (which may be referred to herein as word lines or select lines) and columns coupled by sense lines (which may be referred to herein as digital lines or data lines). Although in Figure 1 The illustration shows a single array 110, but the embodiments are not limited thereto. For example, the memory device 103 may include several arrays 110 (e.g., arrays of DRAM cells).

[0023] Memory device 103 includes address circuitry 106 to latch address signals provided via interface 104. The interface may include, for example, a physical interface employing a suitable protocol (e.g., a data bus, address bus, and command bus, or a combined data / address / command bus). Such protocols may be custom or proprietary, or interface 104 may employ standardized protocols such as PCIe, Gen-Z, CCIX, etc. Address signals are received and decoded by row decoder 108 and column decoder 112 to access memory array 110. Data can be read from memory array 110 by sensing voltage and / or current changes on a sensing line using sensing circuitry 111. Sensing circuitry 111 may include, for example, a sensing amplifier that can read and latch pages (e.g., rows) of data from memory array 110. I / O circuitry 107 can be used for bidirectional data communication with controller 102 and / or a host via interface 104. Read / write circuitry 113 is used to write data to or read data from memory array 110. As an example, circuit system 113 may include various drivers, latching circuit systems, etc.

[0024] Control circuitry system 105 decodes signals provided by controller 102. These signals may be commands provided by controller 102. These signals may include chip enable signals, write enable signals, and address latch signals for controlling operations performed on memory array 110 (including data read operations, data write operations, and data erase operations). In various embodiments, control circuitry system 105 is responsible for executing instructions from controller 102. Control circuitry system 105 may include a state machine, sequence generator, and / or some other type of control circuitry system, which may be implemented in hardware, firmware, or software, or any combination thereof. In some instances, controller 102 may be a controller external to memory device 103. Control circuitry system 105 may be internal to memory device 103. Controller 102 may be a memory controller coupled to the processing resources of a computing device.

[0025] Figure 2 This is a block diagram of a device in the form of a computing system including a memory device 203 and a controller 202, according to several embodiments of the present disclosure. The controller 202 and memory device 203 are similar to... Figure 1 The controller 102 and memory device 103 are included.

[0026] Memory device 203 includes code generator component 222-1, command decoder 226, and register 224-1 for storing a seed value, which may be referred to as seed value 224-1. In some instances, command decoder 226 may be part of control circuitry system 105, or may be independent of it. Figure 1The control circuit system 105 is included. As used herein, code generator components 222-1 and 222-2 may also be referred to as code generators.

[0027] Controller 202 includes a code generator component 222-2, a register 224-2 for storing a seed value, which may be referred to as seed value 224-2, a code comparison component 228, and a trigger generator 230. Memory device 203 and controller 202 can communicate via buses 204-1 and 204-2. For example, controller 202 can provide commands to memory device 203 via bus 204-1, and memory device 203 can provide code via bus 204-1. As used herein, the component description can also be implemented as a circuit system.

[0028] Buses 204-1 and 204-2 can be bidirectional buses. Although shown as bidirectional buses, buses 204-1 and 204-2 can also be implemented as unidirectional buses. Buses 204-1 and 204-2 can be implemented as command buses, address buses, and / or data buses, as well as other types of buses. Buses 204-1 and 204-2 can also represent the interface when devices 203 and 202 are implemented as memory devices.

[0029] Code generators 221-1 and 221-2 may be, for example, linear feedback shift registers (LFSRs) that output pseudo-random numbers based on a seed value; however, embodiments are not limited thereto. For example, code generators 221-1 and 221-2 may include other types of pseudo-random code generators, such as random cyclic bit generators, permutation congruence generators, etc. As further described herein, code generators 221-1 and 221-2 may be identical, such that their outputs are configured to match a given seed value and an increment value. As used herein, the increment value may be a value combined with the seed value. That is, incrementing the two code generators one after the other will, for example, produce the same output. In several embodiments, the code generated by code generators 221-1 and 221-2 can be used as a key and compared to detect synchronization of the means on which the key resides. Thus, instances of code can be keys. As used herein, synchronization describes the matching of the states of the code generator components such that the code generator components produce the same code.

[0030] For example, when the codes generated by code generators 222-1 and 222-2 match, memory device 203 and controller 202 can be considered synchronized. Code generator 222-2 can change its state based on commands generated by trigger generator 230. Code generator 222-1 can change its state based on commands received by command decoder 226. The states of code generators 222-1 and 222-2 can be based on commands generated by controller 202 and / or commands received by memory device 203.

[0031] Code generator 222-1 may be coupled to command decoder 226, such that command decoder 226 may trigger code generator 222-1 to change its state. Command decoder 226 may trigger code generator 222-1 based on several factors associated with commands received from memory device 203. For example, command decoder 226 may trigger code generator 222-1 whenever a command is received, based on the amount of the received command and / or the type of the received command. For example, command decoder 226 may trigger a change in the state of code generator 222-1 after receiving the amount of a command at memory device 203 or whenever a read or write command is received.

[0032] Command decoder 226 can further process commands to set seed value 224-1. For example, controller 202 can provide a command to set seed value 224-1. The command provided to set seed value 224-1 may be accompanied by a value (e.g., seed value). Command decoder 226 can store the seed value in register 224-1, which stores the seed value. After updating seed value 224-1, code generator 222-1 can use the seed value to generate a number instead of using its own last state to generate code.

[0033] The seed value can be encrypted or unencrypted. For example, the seed value can be received by memory device 103 as either an encrypted or unencrypted seed value. If the seed value received by memory device 103 is unencrypted, then command decoder 226 or a different circuit system can encrypt the received seed value so that the encrypted seed value is stored in register 224-1. The registers described herein that include register 224-1 and / or register 224-2 can be mode registers. The encrypted seed value can also be received by memory device 203. The encrypted seed value can be stored in register 224-1 and / or can be further processed to further encrypt the already encrypted seed value received by memory device 203.

[0034] The trigger code generator 222-1 may include a function to generate pseudo-random numbers. The code generator 222-1 may use trigger commands to change its state. The trigger commands may be commands provided to the code generator 222-1 by the command decoder 226.

[0035] The code generator 222-1 and / or command decoder 226 can receive commands from several sources and can trigger the code generator 222-1 regardless of the source of the received command. The code generated by the code generator 222-1 can reflect the command received by the memory device 203.

[0036] Code generator 222-2 can be used to generate code that reflects the commands provided by controller 202 to memory device 203. Code generators 222-1 and 222-2 can be different instances of the same circuit system, such that given the same input, both code generators 222-1 and 222-2 produce the same code.

[0037] Trigger generator 230 may be coupled to register 224-2 storing a seed value (e.g., seed value 224-2) and / or code generator 222-2. Trigger generator 230 may generate commands and may trigger code generator 222-2 based on the generated commands. Both command decoder 226 and trigger generator 230 may trigger code generator 222-2 and code generator 222-1 based on the same criteria. The criteria used to trigger code generators 222-1 and 222-2 may define the type and / or frequency of commands used to trigger code generators 222-1 and 222-2. Using the same criteria to trigger code generators 222-1 and 222-2 allows code generators 222-1 and 222-2 to synchronize, thereby generating the same code even when memory device 203 does not receive additional commands.

[0038] If memory device 203 receives a command from a source other than controller 202, the code generated by memory device 203 may differ from the code generated by controller 202 because the states of code generators 222-1 and 222-2 may differ. The states of code generators 222-1 and 222-2 may differ in response to asynchronous triggering of code generators 222-1 and 222-2. The triggering of code generators 222-1 and 222-2 may be asynchronous because memory device 203 may receive commands not generated by controller 202, thereby causing code generator 222-1 to trigger even when code generator 222-2 is not triggered.

[0039] Controller 202 may utilize code generator 222-2 to generate code that controller 202 expects to receive from memory device 203. Code comparison component 228 may compare the code received from memory device 203 with the code generated by code generator 222-2 to determine whether memory device 203 is synchronized with controller 202. Controller 202 may store a value reflecting the synchronization determination in a register. The result of the synchronization determination may be used to determine whether to continue trusting memory device 203 and / or whether to prevent trusting memory device 203. In some cases, where memory device 203 and controller 202 may be implemented in different computing devices, the synchronization determination may be presented to the user of a system including memory device 203 and / or controller 202.

[0040] The controller 202 may prevent the use of the memory device 203 based on the determination that the controller 202 is not synchronized with the memory device 203. The controller 202 may also continue to use the memory device 203 based on the determination that the controller 202 is synchronized with the memory device 203. For example, the controller 202 may continue to store data or read data from the memory device 203 based on the determination that the memory device 203 is synchronized with the controller 202.

[0041] Although not shown, device 202 can also be a different memory device. For example, both device 202 and device 203 can be memory devices. Memory device 202 can act as a controller, allowing memory device 202 to provide triggers to memory device 203. Therefore, device 202 can include trigger generator 230, seed value 224-2, code generator component 222-2, and code comparison component 228, regardless of whether device 202 is implemented as a host control circuitry or as a host-independent memory device.

[0042] Figure 3 This is a block diagram of a device in the form of a computing system including a memory device 303 and a controller 302, according to several embodiments of the present disclosure. The memory device 303 and the controller 302 are similar to... Figure 2 The memory device 203 and the controller 202 are included.

[0043] Memory device 303 includes a code generator 322-1, a register 324-1 for storing a seed value called a seed value 324-1, a command decoder 326, a mode register 332 from a multipurpose register (MPR), and logic 334. Controller 302 includes a code generator 322-2, a register 324-2 for storing the seed value, a code comparison circuit 328, and a command generator 330. Memory device 303 and controller 302 communicate via address bus 304-1 and command bus 304-2.

[0044] Figure 2 Command decoder 226 is similar to command decoder 326 and / or logic 334. Command decoder 226 can decode received commands (e.g., command decoder 326) and can determine whether the command triggers the generation of codes via randomization circuit system 322-1.

[0045] Command decoder 326 may be coupled to logic 334. Logic 334 determines whether code generator 322-1 is triggered. Logic 334 may receive information about the decoded command. In various instances, logic 334 may receive the decoded command.

[0046] Logic 334 may access criteria used to determine whether the decoding circuitry system 322-1 is triggered from the mode register 332. For example, logic 334 may access a counter used to track the amount of commands received by the memory device 303. The mode register may indicate which commands cause the code generator 322-1 to increment, how many given commands trigger the increment of the code generator 322-1, the seed value, and / or how the seed value increments. Therefore, logic 332 may be coupled to the mode register 332, the register 324-1 storing the seed value, and the code generator 322-1. The value stored in the mode register 332 can be used to determine which commands trigger the code generator 322-1 to generate code. Logic 334 may be implemented as a multiplexer (MUX) to select which commands cause the code generator 322-1 to increment.

[0047] Logic 334 can also determine when to increment, modify, and / or reset the seed value. For example, to enhance security, logic 332 can periodically modify the seed value instead of incrementing the code generator 322-1. Logic 334 can increment the seed value at any interval, such as incrementing it one, two, or three times in other possible intervals. The code generated by the memory device 303 can exhibit a pattern that can be recognized and copied by a third device to generate appropriate code. The third device can provide commands to the memory device 303 and provide the code to the controller 302 to attempt to forge synchronization. Periodically modifying the seed value and periodically using the seed value to generate code can add an additional level of security to prevent different devices from generating code.

[0048] Triggering code generator 322-1 may include incrementing code generator 322-1. Incrementing code generator 322-1 may include modifying a value stored by code generator 322-1 for generating the next state of code generator 322-1, which can then be used to generate code. Seed value 324-1 can be set and / or incremented via logic 334. Controller 302 may provide commands to increment and / or reset seed value 324-1. Controller 302 may also provide a new seed value that can be stored in a register to update the seed value. Although not shown, logic 334 and mode register 332 may be implemented in controller 302 to allow the controller to generate code that reflects synchronization with memory device 303.

[0049] Despite Figure 1 , 2 Synchronization is shown in section 3 as occurring between the memory device and the host, but synchronization can occur between different devices, such as... Figure 4 , 5 As shown in Figure 6. For example, synchronization can occur between memory devices and / or between non-memory devices.

[0050] Figure 4 An example system for variable code comparison according to several embodiments of the present disclosure is shown. The system includes Internet of Things (IoT) devices 440-1, 440-2, 440-3, and 440-4, referred to as IoT device 440. The system also includes a memory device 403. Figure 4 The system can be a network system in which IoT devices 440 are coupled to memory devices 403 via a network. The system can be further described as a distributed network system in which IoT devices 440 can be coupled to each other via network connections.

[0051] As used herein, an IoT device may include a network device. An IoT device may be a device that includes sensors and is used to transmit data collected by the sensors. An IoT device may perform functions such as data collection and may utilize a network connection to store said data, provided that the IoT device has limited power, processing, and storage capabilities.

[0052] For example, IoT device 440 may collect data via one or more sensors, and the data may be stored in external memory. In various cases, the data may be provided to memory device 403 via network connection and / or physical connection.

[0053] Therefore, memory device 403 can perform operations targeting Figure 2 and 3 The controllers 202 and 302 in the diagram describe the functions, while the IoT device 440 performs the functions specified in the diagram. Figure 2 and 3 The functions described in memory devices 203 and 303 are as follows.

[0054] exist Figure 4 In this example, memory device 403 can generate a command and provide it to IoT device 440 to confirm synchronization between IoT device 440 and memory device 403. IoT device 440 can receive the command and generate code based on the code it can provide to memory device 403. Memory device 403 can compare the received code with its internally generated code to determine whether IoT device 440 can be trusted. If IoT device 440 is synchronized with memory device 403, then IoT device 440 can be trusted.

[0055] In various instances, memory device 403 may generate commands for IoT device 440, even if memory device 403 does not control IoT device 440 and even if memory device 403 is used by IoT device 440.

[0056] The memory device 403 can maintain multiple states or a single state. For example, the memory device 403 may consist of multiple instances of a code generator and / or multiple registers configured to store multiple seed values. The memory device 403 can maintain different states (e.g., the states of the code generator and the registers storing seed values) such that each state corresponds to a different IoT device. The memory device 403 can also maintain multiple states using multiple instances of the code generator, where each state maps to multiple states in the IoT devices. For example, a first state of a first code generator and registers (e.g., seed value registers) may map to IoT devices 440-1 and 440-2, while a second state of a second code generator and registers may map to IoT devices 440-3 and 440-4.

[0057] The multiple different states of the code generator provide the ability to synchronize multiple IoT devices 440 with a single memory device. The multiple different states of the code generator also provide the ability to handle IoT devices 440 that are not synchronized with memory device 403 in a manner different from that of IoT devices 440 synchronized with memory device 403.

[0058] In various instances, memory device 403 can maintain a single state for code generators of multiple IoT devices 440. For example, memory device 403 can provide the same code to each of the IoT devices 440 to ensure that the state of the IoT devices 440 changes consistently. Memory device 403 can then use the single code generated within the IoT device to verify multiple codes generated by the IoT device.

[0059] In an instance where IoT device 440 controls storage device 403 and storage device 403 verifies synchronization, storage device 403 may stop providing services to IoT device 440 based on the determination that IoT device 440 is not synchronized with storage device 403. For example, storage device 403 may prevent the storage of data and / or prevent the provision of data to IoT devices identified as out of sync. Storage device 403 may also store data and provide data to IoT devices 440 identified as synchronized with storage device 403. Regardless of the actual synchronization determination, storage device 403 can verify the synchronization of multiple IoT devices 440.

[0060] Figure 5 An example system for variable code comparison is shown according to several embodiments of the present disclosure. Figure 5 The system includes a controller 502 and memory devices 503-1, 503-2, 503-3, and 503-4, wherein the memory devices are referred to as memory device 503. The system may be similar to... Figure 1 The system is a computing system of 100.

[0061] Controller 502 can verify synchronization with memory device 503. Controller 502 can verify synchronization with each of the memory devices 503 individually and independently. For example, the controller can verify synchronization with memory device 503-1 independently of synchronization verification performed using memory device 503-2. Synchronization checks can be performed simultaneously and / or sequentially. For example, controller 502 can verify synchronization with memory devices 503-1 and 503-2 simultaneously, or controller 502 can verify synchronization with memory device 503-1 before verifying synchronization with memory device 503-2.

[0062] Controller 502 can maintain multiple instances of the code generator, enabling the generation of code reflecting the state of each memory device 503 using different code generators. Controller 502 can also maintain a single instance of the code generator that generates multiple codes corresponding to memory devices 503. For example, a seed value corresponding to each memory device 503-1 can be stored in a register, and a value including the state of the code generator can also be stored in a register. The seed value and any other values ​​associated with the code register can be referred to as the context of the code generator. Controller 502 can store different contexts corresponding to each of the memory devices 503. Controller 502 can generate code corresponding to one of the memory devices 503 by loading the context corresponding to one of the memory devices in the code generator and generating code based on the loaded context. Controller 502 can make any necessary changes to the context corresponding to a memory device 503 before storing the context and loading different contexts to generate code for different memory devices 503.

[0063] In various instances, each of the memory devices 503 may have the same state, such that each of the memory devices 503 generates the same code. The controller 502 can maintain the same state of the memory devices 503 by issuing the same command and by programming each of the memory devices 503 to similarly modify their state. For example, each of the memory devices 503 may simultaneously trigger the code generator based on the same receipt of the same command.

[0064] Figure 6 An example system for variable code comparison according to several embodiments of the present disclosure is shown. The system includes memory devices 603-1, 603-2, 603-3, 603-4, and 603-5, referred to as memory device 603.

[0065] and Figure 1 , 2 3 and 5 are different. Figure 6 There is no controller in the system. The memory device 603 can act as a central security monitor and trigger the release chip.

[0066] Figure 6 The system does not use, for example Figure 4 The controller and / or memory device 403 is centered on a memory device. Figure 6 The system relies on each of the memory devices 603 to verify the access synchronization between them.

[0067] For example, memory device 603-1 can verify synchronization with memory device 603-2. Memory device 603-2 can verify synchronization with memory device 603-3. Memory device 603-3 can verify synchronization with memory device 603-4. Memory device 603-4 can verify synchronization with memory device 603-5. Memory device 603-5 can verify synchronization with memory device 603-3.

[0068] Therefore, memory device 603-1 can maintain the context of memory device 603-2, while memory device 603-1 also has its own context. Memory device 603-2 can maintain the context of memory device 603-3, while memory device 603-2 also has its own context. Memory device 603-3 can maintain the context of memory device 603-4, while memory device 603-3 also has its own context. Memory device 603-4 can maintain the context of memory device 603-5, while memory device 603-4 also has its own context. Memory device 603-5 can maintain the context of memory device 603-1, while memory device 603-5 also has its own context.

[0069] Each of the memory devices 603 can generate multiple contexts using multiple instances of the code generator or using a single instance of the code generator and multiple contexts for the code generator. For example, memory device 603-1 can maintain a first context and a second context for the code generator. The first context can correspond to the context of memory device 603-1, and the second context can correspond to the context of memory device 603-2. Each of the contexts can be used to program the code generator based on whether code corresponding to memory device 603-1 or memory device 603-2 is required. For example, memory device 603-1 can generate code for verifying synchronization with memory device 603-2 using the second context. Memory device 603-1 can generate code for verifying its own state using the first context.

[0070] Memory device 603 can request code describing the context of a different memory device 603 based on providing its own code corresponding to its own context. For example, memory device 603-2 can request code from memory device 603-3 in response to having received a request for code from memory device 603-1. Memory device 603-2 can receive a request for code corresponding to its own state. In response to providing code to memory device 603-1, memory device 603-2 can request code from memory device 603-3. Synchronous verification can be performed sequentially, such that a request to generate its own code can trigger a memory device to request code from a different memory device.

[0071] Memory device 603-1 can initiate a verification chain, such that memory device 603-1 verifies the code first and examines it last. Although synchronous verification is presented as being performed using incremental markers (603-1, 603-2, 603-3, etc.), several different topologies can be used to perform chained synchronous verification on several memory devices 603. For example, memory devices 603 can be divided into two groups, each of which may include a central security monitor memory device, and synchronous verification can be performed simultaneously on both groups.

[0072] Figure 7 An example flowchart for variable code comparison according to several embodiments of the present disclosure is shown. At 760, a signal including a command for accessing a memory array of a memory device can be received from the device. The device may be a host device. The command may be received at a command decoder of the memory device. For example, the command may be a request to generate code and / or may be any activation command.

[0073] At 762, code can be generated at the memory device. The code can be generated based at least on the command and the seed value. The seed value can be based at least in part on another sub-value generated at the host device.

[0074] At 764, the memory device can be accessed in response to a command. For example, the signal may include an access command that can be used to provide access to the memory array of the memory device.

[0075] At 766, a component that can transfer code from a memory device to a host device is configured to compare the code with another code generated based on at least other seed values. The comparison can be performed to determine whether the code generator that generated the code is synchronized with the component. Commands that facilitate synchronization can modify the state of the code generator implemented by the memory device and the host device, such that commands facilitating synchronization can be encoded into the code generated by the application.

[0076] The code generator for the memory device (e.g., a first code generator) and the code generator for the host (e.g., a second code generator) may be the same type of code generator, configured to output the same updated code for the same seed value in response to the same increment value associated with updating the first and second code generators. The first and second code generators may be linear feedback shift registers. Updating the output code value generated by the first and second code generators may include incrementing the linear feedback shift register by the same amount.

[0077] In some instances, the second code generator may reside in the host controller, and the first code generator may reside in a memory device. The seed value corresponding to the second code generator can be changed via circuitry on the controller. Commands can be provided from the controller to the memory device to change the seed value corresponding to the second code generator, such that the seed values ​​corresponding to the first and second code generators match.

[0078] Responding to the determination that the command is different from the triggering command can prevent code updates. In other words, if the received command is the triggering command, then the code can be updated.

[0079] In various instances, the device may be a first device coupled to a second device via a bus. The second device may include a second code generator. One or more registers on the second device may be programmed to set at least one of the following: a trigger command, an amount adjusting the first and second code generators in response to the trigger command, a seed value for the first and second code generators, and / or adjusting the seed value in response to a command to adjust an amount corresponding to the seed value of the first and second code generators.

[0080] Commands can be classified as trigger commands in response to receiving a specific number of commands and / or receiving all commands of a threshold amount. For example, every 100th read command can be identified as a trigger command, or every 100th command (regardless of command type) can be identified as a trigger command. In various instances, a command can be a trigger command in response to receiving multiple specific commands of a threshold amount. For example, a trigger can include a specific sequence of commands. For example, a trigger can include receiving 10 read commands and 10 write commands.

[0081] In various instances, the device may include: a first means including a first code generator; and a second means including a second code generator. The second means may be configured to receive a command from the first means and update the output code value generated by the second code generator in response to determining that the received command is a trigger command. The first means may be configured to update the output code value generated by the first code generator in response to sending a trigger command. The device may include a comparison component configured to compare the updated output code values ​​generated by the first and second code generators to determine whether the first code generator is synchronized with the second code generator.

[0082] In some cases, the first device may include a comparison component. The comparison component may be configured to store the comparison result of the updated output code value by setting a flag in the device's register.

[0083] The first device may be further configured to prevent the provision of commands to the second device in response to a flag indicating that the first code generator is not synchronized with the second code generator. The first device may also be configured to continue providing commands to the second device in response to a flag indicating that the first code generator is synchronized with the second code generator.

[0084] Figure 8 An example machine of computer system 840 is shown, within which a set of instructions is executable to cause the machine to perform the various methods discussed herein. In various embodiments, computer system 840 may correspond to including, coupled to, or utilizing a memory subsystem (e.g., Figure 1 The memory device 103) or the controller that can be used to execute the controller (e.g., Figure 1 The system operating the controller 105) (e.g., Figure 1 (System 100). In alternative embodiments, the machine may be connected (e.g., networked) to other machines in a LAN, intranet, extranet, and / or the Internet. The machine may operate as a peer machine in a peer-to-peer (or distributed) network environment or as a server or client machine in a cloud computing infrastructure or environment, with the capabilities of a server or client machine in a client-server network environment.

[0085] The machine may be a personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), cellular telephone, network appliance, server, network router, switch, or bridge, or any machine capable of (sequentially or otherwise) executing a set of instructions that will take a specified action by said machine. Furthermore, although a single machine is described, it should be understood that the term "machine" also includes any collection of machines that individually or collectively execute a set (or more) of instructions to perform any one or more of the methods discussed herein.

[0086] The example computer system 840 includes a processing device 802, a main memory 804 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM), such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM), etc.), a static memory 806 (e.g., flash memory, static random access memory (SRAM), etc.), and a data storage system 818, which communicate with each other via a bus 830.

[0087] Processing device 802 represents one or more general-purpose processing devices, such as microprocessors, central processing units, etc. More specifically, the processing device may be a Complex Instruction Set Computing (CISC) microprocessor, a Reduced Instruction Set Computing (RISC) microprocessor, a Very Long Instruction Word (VLIW) microprocessor, or a processor implementing other instruction sets, or a combination of instruction sets. Processing device 802 may also be one or more special-purpose processing devices, such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), network processors, etc. Processing device 802 is configured to execute instructions 826 for performing the operations and steps discussed herein. Computer system 840 may further include a network interface device 808 for communication via network 820. The processing device may also be a controller among other types of devices with verifiable synchronization.

[0088] The data storage system 818 may include a machine-readable storage medium 824 (also referred to as a computer-readable medium) on which one or more sets of instructions 826 or software embodying any one or more methods or functions described herein are stored. The instructions 826 may also reside wholly or at least partially in main memory 804 and / or processing device 802 during execution by computer system 840, which also constitute machine-readable storage media.

[0089] In one embodiment, instruction 826 includes instructions for implementing the corresponding Figure 1 The controller 102 provides functional instructions. Although the machine-readable storage medium 824 is shown as a single medium in the exemplary embodiment, the term "machine-readable storage medium" should be considered to include a single medium or multiple media storing one or more sets of instructions. The term "machine-readable storage medium" should also be considered to include any medium capable of storing or encoding a set of instructions executable by a machine and causing the machine to perform any one or more of the methods of this disclosure. Therefore, the term "machine-readable storage medium" should be considered to include, but is not limited to, solid-state memory, optical media, and magnetic media.

[0090] While specific embodiments have been described and illustrated herein, those skilled in the art will understand that arrangements calculated to achieve the same results may replace the specific embodiments shown. This disclosure is intended to cover modifications or variations of various embodiments of this disclosure. It should be understood that the above description has been presented in an illustrative rather than restrictive manner. After reviewing the above description, combinations of the above embodiments and other embodiments not specifically described herein will be apparent to those skilled in the art. The scope of the various embodiments of this disclosure includes other applications using the above structures and methods. Therefore, the scope of the various embodiments of this disclosure should be determined by reference to the appended claims and the full scope of their equivalents.

[0091] In the foregoing detailed description, various features have been grouped together in a single embodiment for the purpose of brevity. This approach of the disclosure should not be construed as reflecting an intention that the disclosed embodiments must use more features than are expressly stated in each claim. Rather, as reflected in the appended claims, the subject matter of the invention lies in less than all the features of a single disclosed embodiment. Therefore, the appended claims are hereby incorporated into the detailed description, wherein each claim is, in itself, a separate embodiment.

Claims

1. An apparatus for intrusion via a variable code comparison detection device, comprising: A trigger generator (230) is configured to transmit access commands to memory devices (103, 203, 303, 503-1, 503-2, 503-3, 503-4, 603-1, 603-2, 603-3, 603-4, 603-5), wherein the access commands are read commands or write commands; Code generators (222-1, 222-2, 322-1, 322-2), configured as follows: The state of the code generator on the host is updated based on the transmission of the access command; In response to transmitting the access command and based on the state of the code generator, update the output code; as well as A comparison component (228, 328) is configured to compare the output code with different codes generated by different code generators of the memory device to determine whether the state of the code generator is synchronized with the different states of the different code generators (222-1, 222-2, 322-1, 322-2), and to determine that an intrusion has occurred in the memory device in response to determining that the state of the code generator is not synchronized with the different states of the different code generators.

2. The device of claim 1, wherein the comparison component is further configured to store a comparison result of the updated output code and the different code by setting a flag in a register of the device.

3. The device of claim 1, wherein the memory device is a first memory device, and wherein the trigger generator and the code generator are located on different memory devices of the device.

4. The device according to any one of claims 1 to 3, wherein the device is further configured to: In response to a flag indicating that the code generator is not synchronized with the different code generators, commands are prevented from being provided to the memory device; and Commands continue to be supplied to the memory device in response to the flag indicating that the code generator is synchronized with the different code generators.

5. The device according to any one of claims 1 to 3, wherein the code generator is a linear feedback shift register (LFSR).

6. The device according to any one of claims 1 to 3, wherein the code generator is further configured to generate the output code by randomizing seed values ​​(224-1, 224-2, 324-1, 324-2).

7. The device according to any one of claims 1 to 3, wherein the comparison component is further configured to compare the output code with the different code to determine whether the memory device has received an unauthorized command.

8. A method for intrusion via a variable code comparison detection device, comprising: The command decoder (226, 326) of the memory device (103, 203, 303, 503-1, 503-2, 503-3, 503-4, 603-1, 603-2, 603-3, 603-4, 603-5) receives signaling from the host device, the signaling including a command for accessing the memory array (110) of the memory device; The state of the code generator of the memory device is updated based on the receipt of commands based on the threshold amount; Code is generated at the code generator of the memory device based at least in part on the state and seed values ​​(224-1, 224-2, 324-1, 324-2), wherein the seed values ​​are based at least in part on another sub-value (224-1, 224-2, 324-1, 324-2) generated at the host device. Access the memory array in response to at least one of the commands for the threshold amount; as well as A component (228, 328) that transfers the code from the memory device to the host device, the component being configured to compare the code with another code generated at a different code generator on the host device and at least in part based on other seed values ​​to determine whether the state of the code generator is synchronized with the different states of the different code generators, and to determine that an intrusion has occurred in the memory device in response to determining that the state of the code generator is not synchronized with the different states of the different code generators, wherein the memory device does not perform the comparison of the code with the different code, wherein the memory device accesses the memory array regardless of the result of the comparison, and wherein the memory device is a receiving device.

9. The method of claim 8, wherein the transmission further comprises transmitting the code via an address interface (104, 204-1, 204-2, 304-1).

10. The method of claim 8, further comprising receiving the seed value from the host device, wherein the seed value is used to generate the code and the other code.

11. The method of claim 8, further comprising synchronizing the code with the other code generated by the component by generating the code at the memory device.

12. The method according to any one of claims 8 to 11, further comprising incrementing a linear feedback shift register to generate the code.

13. The method according to any one of claims 8 to 11, further comprising: Receive updated seed values ​​(224-1, 224-2, 324-1, 324-2) from the host device; and In response to receiving a command from the host device to update the seed value, the seed value is updated with the updated seed value, wherein the seed value is updated to synchronize the seed value with the other seed values ​​corresponding to the host device.

14. The method according to any one of claims 8 to 11, further comprising preventing the generation of the code in response to determining that the signaling does not include a trigger command.

15. The method of claim 14, further comprising programming one or more registers on the second device to set at least one of the following: The trigger command; The amount of code is adjusted in response to the trigger command; The seed value; or The amount by which the seed value is adjusted in response to a command to adjust the seed value.

16. The method according to any one of claims 8 to 11, further comprising determining the command as a triggering command in response to at least one of the following: The threshold amount for receiving several specific commands; and The threshold amount for receiving all commands.

17. An apparatus for intrusion via a variable code comparison detection device, comprising: A circuit system configured to provide a plurality of specific commands of threshold quantity to a receiving device (102, 103, 202, 203, 302, 303, 403, 440-1, 440-2, 440-3, 440-4, 502, 503-1, 503-2, 503-3, 503-4, 603-1, 603-2, 603-3, 603-4, 603-5); Code generators (222-1, 222-2, 322-1, 322-2), configured as follows: The state of the code generator on the host is updated based on the plurality of specific commands that provide the threshold amount; In response to the plurality of specific commands providing the threshold amount and based on the state, generate code; The code comparison component (228, 328) is configured as follows: Receive different codes generated at different code generators in the receiving device; Determining that the code matches the different codes, and determining that no intrusion has occurred in the receiving device by determining that the state of the code generator is synchronized with the different states of the different code generators; and In response to the determination that the first code does not match the second code, it is determined that an intrusion has occurred.

18. The device of claim 17, wherein the receiving device is an Internet of Things (IoT) device (440-1, 440-2, 440-3, 440-4).

19. The device according to any one of claims 17 to 18, wherein the receiving means is a memory device and the device is the host.

Images