Playback protection temporary random number generation

Abstract

Apparatuses and techniques for replay protection of ephemeral random number generation are described herein. A hash of a first length can be generated from a first input. A first subset of the hash can be extracted as a selector. A second subset of the hash can be selected using the selector. Here, the second subset has a second length that is less than the first length. The second subset can be transmitted in a replay protected communication as an ephemeral random number of a freshness value.

Description

[0001] This application is a divisional application of Chinese invention patent application entitled "Replay Protection Temporary Random Number Generation", application number 201980091228.7, and application date December 12, 2019.

[0002] Priority application

[0003] This application claims priority to U.S. Application No. 16 / 235,189, filed December 28, 2018, which is incorporated herein by way of application. Technical Field

[0004] This application relates to the generation of temporary random numbers for playback protection. Background Technology

[0005] Memory devices are typically provided as internal semiconductor integrated circuits in computers or other electronic devices. Many different types of memory exist, including volatile memory and non-volatile memory.

[0006] Volatile memory requires power to maintain its data and includes random access memory (RAM), dynamic random access memory (DRAM), or synchronous dynamic random access memory (SDRAM).

[0007] Non-volatile memory can retain stored data when not powered, and includes flash memory, read-only memory (ROM), electrically erasable programmable ROM (EEPROM), static RAM (SRAM), erasable programmable ROM (EPROM), and resistive variable memory (such as phase-change random access memory (PCRAM), resistive random access memory (RRAM) or magnetoresistive random access memory (MRAM)).

[0008] Flash memory is used as a non-volatile memory for a wide range of electronic applications. Flash memory devices typically contain one or more groups of single-transistor floating-gate or charge-trapping memory cells that allow for high memory density, high reliability, and low power consumption.

[0009] Two common types of flash memory array architectures include NAND architecture and NOR architecture, named after the logical form of the basic memory cell configuration in which each is arranged. The memory cells of a memory array are typically arranged in a matrix. In one example, the gate of each floating-gate memory cell in a row of the array is coupled to an access line (e.g., a word line). In a NOR architecture, the drain of each memory cell in a column of the array is coupled to a data line (e.g., a bit line). In a NAND architecture, the drains of each memory cell in a string of the array are coupled together in series (source to drain) between the source line and the bit line.

[0010] Both NOR and NAND architecture semiconductor memory arrays are accessed via a decoder that activates a specific memory cell by selecting a word line coupled to its gate. In a NOR architecture semiconductor memory array, once the selected memory cell is activated, its data value is placed on the bit line, causing different current flows depending on the programming state of the specific cell. In a NAND architecture semiconductor memory array, a high bias voltage is applied to the drain-side selected gate (SGD) line. A word line coupled to the gate of each group of unselected memory cells is driven at a specified pass voltage (e.g., Vpass) to operate each group of unselected memory cells as a pass transistor (e.g., to pass current regardless of its stored data value). Current then flows from the source line to the bit line through their respective series-coupled groups, limited only by the selected memory cell in each group, thereby placing the currently encoded data value of the selected memory cell on the bit line.

[0011] Each flash memory cell in a NOR or NAND architecture semiconductor memory array can be individually or collectively programmed into one or more programming states. For example, a single-level cell (SLC) can represent one of two programming states (e.g., 1 or 0), which represents a data bit.

[0012] However, flash memory cells can also represent one of more than two programmed states, allowing for the manufacture of higher-density memory without increasing the number of memory cells, because each cell can represent more than one binary digit (e.g., more than one bit). Such cells may be referred to as multi-state memory cells, multi-digit cells, or multi-level cells (MLCs). In some instances, MLC can refer to a memory cell that can store two data bits per cell (e.g., one of four programmed states), three-level cells (TLCs) can refer to a memory cell that can store three data bits per cell (e.g., one of eight programmed states), and four-level cells (QLCs) can store four data bits per cell. MLC is used herein in its broader context and can thus refer to any memory cell that can store more than one data bit per cell (i.e., can represent more than two programmed states).

[0013] Traditional memory arrays are two-dimensional (2D) structures arranged on the surface of a semiconductor substrate. To increase memory capacity for a given area and reduce cost, the size of individual memory cells has been reduced. However, there are technological limitations to the reduction in the size of individual memory cells and therefore the memory density of 2D memory arrays. In response, three-dimensional (3D) memory structures (such as 3D NAND architecture semiconductor memory devices) are being developed to further increase memory density and reduce memory costs.

[0014] Such 3D NAND devices typically comprise strings of memory cells series-coupled (e.g., drain-to-source) between one or more source-side selected gates (SGS) near the source and one or more drain-side selected gates (SGD) near the bit lines. In examples, the SGS or SGD may comprise one or more field-effect transistor (FET) or metal-oxide-semiconductor (MOS) structure devices, etc. In some examples, the string extends vertically through multiple vertically spaced layers containing corresponding word lines. Semiconductor structures (e.g., polysilicon structures) may extend near the string memory cells to form channels for the memory cells of the string. In examples of vertical strings, the polysilicon structure may be in the form of vertically extending pillars. In some examples, the string may be “folded” and thus arranged relative to U-shaped pillars. In other examples, multiple vertical structures may be stacked on top of each other to form a stacked array of memory cell strings.

[0015] Memory arrays or devices can be combined to form the storage capacity of a memory system, such as solid-state drives (SSDs) and universal flash memory (UFS). TM Multimedia Card (MMC) solid-state storage device, embedded MMC device (eMMC) TM SSDs, in particular, can be used as the primary storage device for computers, offering advantages over traditional hard drives with moving parts in areas such as performance, size, weight, robustness, operating temperature range, and power consumption. For example, SSDs can have reduced search time, latency, or other delays associated with disk drives (e.g., electromechanical latency). SSDs use non-volatile memory cells, such as flash memory, to eliminate the need for an internal battery power supply, thus allowing for more versatile and compact drives.

[0016] An SSD may include several memory devices (comprising several dies or logical units (e.g., logical unit numbers or LUNs)) and may include one or more processors or other controllers that perform the logical functions required to operate the memory devices or interface with external systems. Such an SSD may include one or more flash memory dies, or may contain several memory arrays and peripheral circuitry thereon. A flash memory array may contain blocks of memory cells organized into several physical pages. In many instances, the SSD will also include DRAM or SRAM (or other forms of memory dies or other memory structures). The SSD may receive commands from the host associated with memory operations (e.g., read or write operations to transfer data (e.g., user data and associated integrity data, such as error data and address data) between the memory devices and the host, or erase operations to erase data from the memory devices). Summary of the Invention

[0017] On one hand, this disclosure provides an apparatus comprising: an interface configured to communicate with a hash engine during operation, the interface being configured to receive a hash from the hash engine; and processing circuitry configured to: extract a selector from a first portion of the hash; use the selector to select a second portion of the hash, the second portion being smaller than the hash; and transmit the second portion of the hash subset as a temporary random number for a freshness value.

[0018] On the other hand, this disclosure further provides a method comprising: receiving a hash from a hash engine; extracting a selector from a first portion of the hash; using the selector to select a second portion of the hash, the second portion being smaller than the hash; and transmitting the second portion of the hash subset as a temporary random number for a freshness value.

[0019] On the other hand, this disclosure further provides a system including components for performing the methods described above.

[0020] On the other hand, this disclosure further provides a machine-readable medium containing instructions that, when executed, cause a machine to perform the methods described above. Attached Figure Description

[0021] In drawings that are not necessarily drawn to scale, similar element symbols can describe similar components in different views. Similar element symbols with different letter subscripts can represent different examples of similar components. The drawings generally illustrate the various embodiments discussed in this document by way of example rather than limitation.

[0022] Figure 1 Describe an example of an environment that includes a memory device.

[0023] Figure 2 This section describes an instance of a system for generating temporary random numbers for replay protection.

[0024] Figure 3 This describes an instance of generating a self-contained temporary random number from a hash.

[0025] Figure 4 An example illustrating the control flow between the host and the memory device that performs temporary random number generation.

[0026] Figure 5 This describes several instances of the message format used during the initialization of temporary random number generation.

[0027] Figure 6 A flowchart illustrating an example of a method for generating temporary random numbers for playback protection.

[0028] Figure 7 It is a block diagram illustrating an example of a machine on which one or more embodiments may be implemented. Detailed Implementation

[0029] Communication security has played an increasingly important role. To understand the different aspects of secure communication, several different domains are considered: identity; authentication; message integrity; data protection (e.g., encryption); data proof; and replay protection. Various technologies are used to implement these different aspects of secure communication. However, the systems and technologies described in this paper focus on replay protection.

[0030] A replay attack, referred to herein as a replay, is a technique by which an attacker copies part or all of a normally secure communication between two parties and later uses it to achieve an unauthorized response from one of the parties. For example, a garage door remote transmits radio signals to the garage door controller to open the garage door. Even if the remote requires authenticated and encrypted communication, simply recording the radio symbols and replaying them later can produce the garage door opening effect desired by the attacker. This replay attack can be used in other communications, such as between components in a vehicle (e.g., via a Controller Area Network (CAN) bus), between an industrial controller and an actuator, or between a memory device and other components using the memory device.

[0031] Various techniques have been designed to prevent replay attacks. Typically, these techniques involve incorporating a constantly changing element that the valid party to the communication can predict with each subsequent exchange. For example, consider a monotonic (e.g., continuously increasing) counter. With each message in the communication, both parties increment their respective counters (e.g., by 1) and include that value in the reply message. When verifying the reply message, the receiver uses the predicted value of the monotonic counter as part of the verification. If an attacker logs and attempts to replay the message, the counter verification will fail along with the replay attack. The constantly changing element can be referred to as a freshness value. Using a freshness value can involve appending it to the message and securing it using encryption, Message Authentication Code (MAC) (e.g., HMAC-SHA256), or other cryptographic techniques (e.g., Elliptic Curve Digital Signature Algorithm (ECDSA)). However, a common feature of freshness values ​​is the ability of each party to the communication to predict the next valid freshness value so that it can be checked for correctness in any future exchange.

[0032] Monotonic counters and timestamps are two techniques used to generate freshness values. However, these techniques suffer from several problems in the context of memory devices operating in the same way as NAND flash memory. First, monotonic counters involve storing a current count value that can change rapidly. Due to the nature of NAND flash, individual counter updates typically involve constant writes to the counter and garbage collection, leading to excessive wear and tear and inefficient maintenance of the underlying memory device. Timestamps have the advantage that multiple hardware components usually already have clocks. However, for a freshness value to be successful, the clocks need to be largely synchronized. This synchronization is impractical for additional memory devices deployed in various hardware configurations.

[0033] To address these issues in generating freshness values, temporary random numbers (e.g., single-number generation) can be used. Here, a temporary random number is a value that is not inherently meaningful. Rather, the value in the temporary random number sequence represents the ability of both parties to determine what the next temporary random number should be. Therefore, temporary random number generation can be accomplished using pseudo-random number generation based on a known seed between the parties. By using a running pseudo-random number generator, an observer without access to the seed should be unable to inform (e.g., through statistical analysis) what the next value in the sequence will be, but both parties will be able to generate this value independently.

[0034] In this example, after both parties agree on an initial seed, the memory device can use the seed to generate a hash. A portion of this hash can be used as a freshness value. For example, consider a 256-bit hash and a desired freshness value of 32 bits. The 256 bits of the hash can be divided into eight 32-bit segments. The first three bits or any three-bit definition technique (e.g., the last three bits, the first bit, the middle and last bits, the first three of every four bits, etc.) are used as group identifiers. Therefore, bits from any of the eight groups identified by these three bits are used as freshness values. The hash can then be used as a seed in a new iteration of this process to determine the next freshness value.

[0035] Temporary random number generation works better than other freshness value techniques used in NAND flash type devices because seeds can be stored and reused during a session (e.g., without the need for non-volatile memory) and clock synchronization does not require the same precision as in timestamps. Furthermore, many current memory devices include several hardware or software components to implement other aspects of secure communication, such as physically uncopyable function (PUF) blocks, hash blocks, MAC blocks, encryption and key management blocks, and others. Therefore, temporary random number generation can be added to existing device designs with minimal impact. In addition, memory devices configured to generate temporary random numbers as described herein can also provide hash deterministic random bit generators (HASH-DRBG) for other components to which they communicate, such as processors.

[0036] Additional details and examples are described below. Figure 1 Includes several details about the managed memory device (e.g., the memory controller is contained within the memory device), and Figure 2 This describes architectural features more specifically related to replay-protected temporary random number generation, and Figure 6 Explain several changes in the operation of this architecture.

[0037] Figure 1 The description includes an example of an environment 100 containing a host device 105 and a memory device 110 configured to communicate via a communication interface. The host device 105 or the memory device 110 may be included in a variety of products 150 (e.g., Internet of Things (IoT) devices, such as refrigerators or other appliances, sensors, motors or actuators, mobile communication devices, automobiles, drones, etc.)) to support the processing, communication, or control of the product 150. Figure 2 Provides more specific details regarding the adjustable NAND write performance using pSLC encoding.

[0038] Memory device 110 includes a memory controller 115 and a memory array 120 comprising, for example, several individual memory dies (e.g., a three-dimensional (3D) NAND die stack). In 3D architecture semiconductor memory technology, vertical structures are stacked, thereby increasing the number of layers, physical pages, and thus the density of memory devices (e.g., storage devices). In one example, memory device 110 may be a discrete memory or storage device component of host device 105. In other examples, memory device 110 may be part of an integrated circuit (e.g., a system-on-a-chip (SoC) or the like) stacked or otherwise incorporated with one or more other components of host device 105. In these examples, memory device 110 communicates with components of host device 105 via an interlink 111 (e.g., a bus). Therefore, as described herein, even when memory device 110 is integrated into host device 105, the operation of the host or host device 105 differs from the operation of memory device 110.

[0039] One or more communication interfaces (e.g., interconnect 111) can be used to transfer data between the memory device 110 and one or more other components of the host device 105, such as a Serial Advanced Technology Attachment (SATA) interface, a Peripheral Component Interconnect Fast (PCIe) interface, a Universal Serial Bus (USB) interface, a Universal Flash Storage (UFS) interface, or an eMMC interface. TM An interface or one or more other connectors or interfaces. Host device 105 may include a host system, electronic devices, a processor, a memory card reader, or one or more other electronic devices external to memory device 110. In some instances, host 105 may be equipped with... Figure 7The machine 700 is a machine of some or all of the components described.

[0040] The memory controller 115 may receive instructions from the host 105 and may communicate with the memory array 120 to, for example, transfer data to (e.g., write or erase) one or more of the memory cells, planes, sub-blocks, blocks, or pages of the memory array 120 or to transfer (e.g., read) data from said one or more. The memory controller 115 may, in particular, include circuitry or firmware comprising one or more components or integrated circuits. For example, the memory controller 115 may include one or more memory control units, circuitry, or components configured to control access across the memory array 120 and provide a translation layer between the host 105 and the memory device 110. Although the memory controller 115 is described herein as part of the memory device 110 package, other configurations may be employed, such as the memory controller 115 being a component of the host 105 (e.g., as a discrete package on a system-on-a-chip of the host 105 separate from the memory service 110) or even implemented via the central processing unit (CPU) of the host 105.

[0041] The memory manager 125 may include, in particular, circuitry or firmware, such as several components or integrated circuits associated with various memory management functions. For the purposes of this description, example memory operation and management functions will be described within the context of NAND memory. Those skilled in the art will recognize that other forms of non-volatile memory may have similar memory operation or management functions. Such NAND management functions include wear leveling (e.g., discarded item collection or recycling), error detection or correction, block scrapping, or one or more other memory management functions. The memory manager 125 may parse or format host commands (e.g., commands received from the host) into device commands (e.g., commands associated with the operation of the memory array, etc.), or generate device commands for the array controller 135 or one or more other components of the memory device 110 (e.g., to perform various memory management functions).

[0042] The memory manager 125 may include a set of management tables 130 configured to maintain various information associated with one or more components of the memory device 110, such as information associated with a memory array or one or more memory cells coupled to the memory controller 115. For example, management table 130 may contain information about block age, block erase count, error history, or one or more error counts (e.g., write operation error count, read bit error count, read operation error count, erase error count, etc.) of one or more blocks of memory cells coupled to the memory controller 115. In some instances, a bit error may be termed an uncorrectable bit error if the number of detected errors in one or more of the error counts exceeds a threshold. Management table 130 may specifically maintain counts of correctable or uncorrectable bit errors. In instances, management table 130 may contain translation tables or logic-to-physical (L2P) mappings.

[0043] The array controller 135 may include, in particular, circuitry or components configured to control memory operations associated with writing data to, reading data from, or erasing data from the memory devices 110 coupled to the memory controller 115. Memory operations may be based on host commands received from, for example, the host 105 or generated internally by the memory manager 125 (e.g., associated with wear leveling, error detection, or correction).

[0044] Array controller 135 may include an error correction code (ECC) component 140, which may in particular include an ECC engine or other circuitry configured to detect or correct errors associated with writing data to or reading data from one or more memory cells coupled to memory device 110, which is connected to memory controller 115. Memory controller 115 may be configured to proactively detect and recover from various errors associated with data operation or storage, such as bit errors, operational errors, etc., based on ECC data maintained by array controller 135. This enables memory controller 115 to maintain the integrity of data transferred between host 105 and memory device 110 or to maintain the integrity of stored data. This integrity maintenance may include removing (e.g., scrapping) faulty memory resources (e.g., memory cells, memory arrays, pages, blocks, etc.) to prevent future errors. RAIN is another technique that memory device 110 may employ to maintain data integrity. Array controller 135 may be arranged to implement RAIN parity data generation and storage in array 120. The memory controller 115 can participate in using parity data to reconstruct corrupted data.

[0045] Memory array 120 may include several memory cells arranged (for example) in several devices, planes, sub-blocks, blocks, or pages. As an example, a 48GB TLC NAND memory device may contain 18,592 bytes (B) of data per page (16,384 + 2208 bytes), 1536 pages per block, 548 blocks per plane, and 4 or more planes per device. As another example, a 32GB MLC memory device (which stores two data bits per cell (i.e., 4 programmable states)) may contain 18,592 bytes (B) of data per page (16,384 + 2208 bytes), 1024 pages per block, 548 blocks per plane, and 4 planes per device, but has half the required write time and twice the program / erase (P / E) cycles of a corresponding TLC memory device. Other examples may contain other numbers or arrangements. In some instances, the memory device or a portion thereof may selectively operate in SLC mode or in the desired MLC mode (e.g., TLC, QLC, etc.).

[0046] During operation, data is typically written to or read from the NAND memory device 110 in pages and erased in blocks. However, one or more memory operations (e.g., read, write, erase, etc.) may be performed on larger or smaller groups of memory cells as needed. The data transfer size of the NAND memory device 110 is typically referred to as a page, while the data transfer size of the host is typically referred to as a segment.

[0047] Although a data page may contain several bytes of user data (e.g., a data payload containing several data segments) and its corresponding metadata, the page size typically refers only to the number of bytes used to store the user data. For example, a data page with a page size of 4KB may contain 4KB of user data (e.g., eight segments of 512B segment size) and several bytes of metadata corresponding to the user data (e.g., 32B, 54B, 224B, etc.), such as integrity data (e.g., error detection or correction code data), address data (e.g., logical address data, etc.), or other metadata associated with the user data.

[0048] Different types of memory cells or memory arrays 120 can provide different page sizes, or may require different amounts of metadata associated with them. For example, different memory device types may have different bit error rates, which can result in different amounts of metadata necessary to ensure the integrity of data pages (e.g., a memory device with a higher bit error rate may require more bytes of error correction code data compared to a memory device with a lower bit error rate). As an example, a multi-level cell (MLC) NAND flash device may have a higher bit error rate than its corresponding single-level cell (SLC) NAND flash device. Therefore, an MLC device may require more metadata bytes for error data compared to its corresponding SLC device.

[0049] Figure 2 This describes an instance of a system for generating temporary random numbers for replay protection. The system includes features as described above. Figure 1 The host 205 and memory device 210 operate in the manner described. In the following example, the host 205 is a partner that securely communicates with the memory device 210. As illustrated, the memory device 210 includes: a controller 220; an authentication block 225 that includes an ECDSA element with public and private key (PU / PR) memory and a MAC element with a secret (e.g., symmetric) key memory; a Diffie Hellman block 235 that includes PU / PR memory to an Elliptic Curve Diffie Hellman (ECDH) element; a key generator 215 that includes a PUF and Key Derivation Function (KDF) element; a multiplexer 240; a hash engine 245; and a selector block 250.

[0050] During the authentication and replay protection communication, a temporary random number sequence is initialized. This begins with seed initialization. In one instance, host 205 issues a temporary random number request command to memory device 210 to initialize freshness (or the DRBG generator). In another instance, the request does not deliver any actual data to memory device 210. In yet another instance, the request includes a signature from host 205.

[0051] In response to a temporary random number request command, memory device 210 is configured to send a zero temporary random number (e.g., nonce_0) value to host 205, which will be used to initialize the remaining temporary random number sequence. After receiving the zero temporary random number, host 205 provides a system setting command to select one of several usage modes supported by memory device 210. In this example, this command is authenticated and uses the zero temporary random number as a replay protection measure.

[0052] Upon receipt, controller 220 uses the usage mode to configure multiplexer 240 via selector 230. As illustrated, host 205 can select three usage modes; these modes correspond to seed A (mode 0), seed B (mode 1), and seed C (mode 2). As illustrated, in mode 0, memory device 210 generates a secret seed (e.g., seed = KDF(PUF)) using the PUF value processed by KDF. In mode 1, host 205 and memory device 210 share a common seed. In one instance, the seed is unsigned, for example, passed directly from host 205 to controller 220. In another instance, the seed is signed (e.g., via ECDSA or MAC) and verified by authentication block 225. In mode 2, host 205 and memory device 210 share a secret SEED using ECDH or other similar techniques configured for the protocol.

[0053] Once the mode is selected by host 205, controller 220 is positioned to pulse the calculus_on signal to hash engine 240 to generate a hash from the selected seed source. The hash is then sent to selector block 250. Selector block is configured to select either a temporary random number 255 directly from the hash or the basis of a temporary random number 255. For example, if the hash is N bits long, then selector 250 selects m bits from the hash to generate an m-bit temporary random number 255. Figure 3 The example technique is described, in which selector block 250 is configured to use the example technique to generate a temporary random number 255 from the hash.

[0054] After initialization and the generation of the first hash, controller 220 selects mode 3 on the multiplexer and feeds the hash back to multiplexer 240 via hash engine 245. In this way, the hash is used as a seed in the generation of the next temporary random number in the temporary random number sequence; for example, hash... n =SELECTOR(HASH(hash) n-1 In this context, SELECTOR is the selector block 250 and HASH is the hash engine 245. The hash engine 245 contains a memory (e.g., a register) to store the hash until it receives the next calculus_on signal from the controller 220 (at which point the hash is delivered to the multiplexer 240) or a reset signal from the controller 220. Figure 4 Examples of messages between host 205 and memory device 210 (e.g., controller 220) for initialization with a temporary random number sequence and subsequent communication between the two are described.

[0055] The described architecture enables the use of various seeds to initiate temporary random number sequences. Furthermore, since many of the components are already included in modern memory devices, only a small number of additions (e.g., multiplexer 240 and selector block 250) are required to implement the replay-resistant temporary random number technique described herein.

[0056] Figure 3 This illustrates an example of generating a self-contained temporary random number from a hash. Here, the hash is 256 bits and divided into eight non-overlapping 32-bit groups. Therefore, group 0 contains bits 0 to 31 of the hash, group 1 contains bits 32 to 63, and so on. To determine which of the eight groups is the temporary random number, a set of selector bits is extracted from the hash sufficient to explicitly select one of the groups. Therefore, for each of the eight groups, three selector bits are extracted. The extraction can be positional, such as the first few bits, the last few bits, every other bit, etc. The values ​​of the extracted bits determine the selected group. Therefore, for each of the eight groups, three selector bits are used to explicitly select one of the eight groups. If the first three bits are extracted, and these bits have a value of 110, then group 6 is selected, and the bits of the hash belonging to group 6 are the temporary random number.

[0057] Figure 4 This illustrates an example of the control flow between the host and the memory device that performs the temporary random number generation. The host initializes the memory device for a temporary random number sequence via a temporary random number request (message 405). Although this request is not protected—for example, enabling any entity to issue the request—authentication in a later message can be used to restrict which entities can participate in the temporary random number sequence protected communication session.

[0058] In response to the temporary random number request, the memory device responds with a zero temporary random number (message 410). In this example, the zero temporary random number is calculated as the m least significant bits of the output of the KDF using the PUF as input, or nonce0 = LSB(KDF(PUF), m). Figure 2 In the architecture described, controller 220 can select mode 0 via selector 230 to feed the key block 215 output to multiplexer 240. Then, controller 220 can pulse the calculus_on signal to hash engine 245 to generate a zero-temporal random number. In this example, after obtaining the zero-temporal random number, controller 220 uses the reset signal of hash engine 245 to clear the zero-temporal random number.

[0059] Next, the host issues a system setup command (message 415) with replay protection using zero temporary random numbers to configure the system. In this instance, the system setup command is authenticated. This instance helps prevent unintended entities from enabling or resetting the temporary random number generation sequence at the memory device. In this instance, this is done by using ECDSA or alternatively as indicated in the command data structure (e.g., as...). Figure 5 (See the instructions) for MAC address authentication system settings commands.

[0060] The memory device uses data from system setup commands to configure the generation of temporary random number sequences (e.g., as described above). Figure 2 In the middle or below Figure 6 (As described in the text) and responds with success or failure depending on its ability to perform the task (message 420). Assuming success, after message 420, the host and memory devices can use the temporary random number sequence (e.g., messages 425 and 430) to participate in the communication session. If the host restarts the temporary random number sequence for any reason, the host can issue a temporary random number request command again (message 405) and update the program.

[0061] Figure 5 This section describes several instances of the message format used during the initialization of temporary random number generation. As illustrated, each of these message data structures contains several fields marked in the diagram.

[0062] The Temporary Random Number Request message 505 includes an operation code, optional parameters (e.g., for selecting a mode), and the type of signature requested in the response (e.g., 0 = MAC, 1 = ECDSA, and 2 = no signature).

[0063] The response message 510 to the temporary random number request message 505 contains a temporary random number (e.g., a zero temporary random number) and a signature (if a signature was requested in message 505).

[0064] System setup message 515 includes an opcode, a zero-temporal random number for replay protection, setup parameters, a signature type identifier, and the signature itself. As explained, the parameters may be structured to include pattern recognition and provide the corresponding data expected by the memory device. For example, here, for modes 1 and 2, a seed is expected, while mode 3 does not involve seed sharing but relies on an external protocol (e.g., Diffie-Hellman). In this case, the parameters contain data for setting the protocol.

[0065] Figure 6 A flowchart illustrating an example of method 600 for replaying protected temporary random number generation. The operation of method 600 is implemented in computer hardware, such as the computer hardware described above (e.g., memory device) or the computer hardware described below (e.g., processing circuitry system).

[0066] In operation 605, a hash is generated from the first input. The hash has a value of the length determined by the hashing algorithm used. In this example, the hash is a cryptographic hash. In this example, the cryptographic hash is one of an MD5 hash, a secure hash (SHA) (e.g., SGA-0, SHA-1, SHA-2, SHA-3, etc.), a RIPEMD-160 hash, a Whirlpool hash, or a BLAKE2 hash.

[0067] In operation 610, the first subset of the hash is extracted as the selector.

[0068] In operation 615, a selector is used to select a second subset of the hash. In this example, the second subset is shorter than the length of the hash (the first length) (e.g., it has a second length less than the length of the hash). Therefore, a selector is obtained from the hash and used to select a portion of the hash. To this end, selector characteristics are selected based on the desired characteristics of the second subset, which will form the basis for replay-protected temporary random numbers.

[0069] For example, the hash can be divided into several groups, each group having a number of bits equal to the size of the desired second subset. Groups can be non-overlapping or overlapping, or they can be consecutive or non-consecutive. For instance, if there are five groups, then each group consists of five bits separated by an offset from the start of the hash (e.g., group 0 has an offset of 0, group 1 has an offset of 1 bit, etc.). In this case, the first subset is sized to represent the number of groups (e.g., if there are two groups, then the first subset is 1 bit; if there are eight groups, then the second subset is 3 bits, etc.). Then, the value of a selector is used to determine which group is the second subset. For example, if the selector is 0010, then the second subset is group 2 out of 16 groups (with the lowest group index of 0).

[0070] Furthermore, the selection of the first subset can be accomplished in any repeatable manner until it matches the size of the first subset. Therefore, the selector can be the first few bits of a specified length, the next few bits of the specified length, every seven bits of the specified length, and so on. However, due to the near-statistical randomness of hashing, selecting the first three bits is generally the most efficient.

[0071] The following example illustrates non-overlapping group selection. Specifically, a first subset (e.g., a selector) has a third length based on a first length and a second length. In this example, the third length is equal to the number of bits representing the first length divided by the second length. In this example, the hash is divided into non-overlapping groups with a length equal to the second length. In this example, using a selector to select a second subset of the hash involves evaluating the numerical values ​​of the bits in the selector and using the groups from the non-overlapping groups corresponding to those values ​​as the second subset.

[0072] In operation 620, a second subset of temporary random numbers is transmitted as a freshness value in the replay protection communication. The transmission may include an encrypted component that passes the temporary random numbers to the same device or provides them to an external entity. In this example, the temporary random numbers may act as a HASH-DRBG.

[0073] The operation described above pertains to a single iteration of freshness generation in a communication session. In this example, method 600 is extended to include initializing a sequence of temporary random numbers. Here, the temporary random number is the first temporary random number in the temporary random number sequence, and the seed is the first input. In this example, the seed is of type one of the following: self-generated (e.g., via a PUF or other random number generator), an unsigned shared public value, a signed shared public value, or a secret value generated from the Diffie-Hellman protocol (or any other key or secret exchange used as part of the secure communication setup). The last option is similar to a signed shared public value but does not require setting anything beyond what the protocol uses to set up a secure channel, which can be more efficient.

[0074] When implemented in hardware, to maintain various seed choices given operating parameters, the device may include hardware for accepting any of different types of seeds and a selection mechanism for selecting which seed will be used for any given temporary random number sequence. Thus, in an example, seed selection involves, for example, receiving a command specifying a pattern from a partner in replay protection communications. The pattern can then be used to update the multiplexer. Here, the multiplexer has inputs for various types of supported seeds. The device can then generate a seed via the multiplexer. Therefore, pattern selection defines which of the multiplexer's output inputs will be used as the seed.

[0075] In this example, the available patterns include several input patterns followed by a sequence of patterns. The sequence of patterns is used after generating temporary random numbers to generate additional temporary random numbers within the sequence. Therefore, in this example, method 600 is extended to include generating a second temporary random number after the first temporary random number within the sequence. The second temporary random number is generated by using the hash of the first temporary random number as the first input to the second temporary random number. Here, the sequence of patterns is used to replace the seed with the final hash generated for each new hash.

[0076] The initialization sequence may include additional elements to help ensure secure exchange for setting a sequence of temporary random numbers. In this example, the last communication during initialization is the command to agree to the seed. This includes a first request from the partner to begin initialization and a response to that request with replay protection using a zero temporary random number. The zero temporary random number (e.g., nonce_0) is not part of the temporary random number sequence but rather a one-time value that the device expects its partner to send back. Therefore, the command uses a zero temporary random number to prevent replay attacks during initialization. In this example, the command is a data structure with an opcode field, a zero temporary random number field, a parameter field, a signature type field, and a signature field. In this example, the parameter field contains pattern recognition and a payload. Here, pattern recognition is used to set the mode selector on the multiplexer. The payload may be the seed or other parameters used to derive the seed.

[0077] Figure 7 The block diagram illustrates instance machine 700, on which any or more of the techniques (e.g., methodologies) discussed herein can be executed. In alternative embodiments, machine 700 may operate as a standalone device or be connectable (e.g., networked) to other machines. In a networked deployment, machine 700 may operate as a server machine, a client machine, or both in a server-client network environment. In an example, machine 700 may act as a peer-to-peer (P2P) (or other distributed) network environment. Machine 700 may be a personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), mobile phone, network device, IoT device, automotive system, or any machine capable of executing instructions (sequentially or otherwise) specifying actions to be taken by said machine. Furthermore, while only a single machine is described, the term "machine" should also be considered as any collection of machines that individually or jointly execute sets of instructions (or multiple sets of instructions) to perform any or more of the methodologies discussed herein, such as cloud computing, Software as a Service (SaaS), and other computer cluster configurations.

[0078] The examples described herein may include logic, components, devices, packages, or mechanisms or operable by them. A circuit system is a collection (e.g., a group) of circuits implemented in a tangible entity containing hardware (e.g., simple circuits, gates, logic, etc.). The relationships between circuit system members can change flexibly over time and due to the variability of the underlying hardware. A circuit system contains members that can perform specific tasks individually or in combination during operation. In some examples, the hardware of a circuit system may be designed immutably to perform specific operations (e.g., hardwiring). In some examples, the hardware of a circuit system may contain variablely connected physical components (e.g., execution units, transistors, simple circuits, etc.) containing computer-readable media that have been physically modified (e.g., magnetically, electrically, movable placement of immutable aggregate particles, etc.) to encode instructions for specific operations. When connecting physical components, the basic electrical properties of the hardware components (for example) change from insulators to conductors, or vice versa. Instructions enable participating hardware (e.g., execution units or loading mechanisms) to establish members of a circuit system within the hardware via variable connections to perform specific tasks during operation. Therefore, the computer-readable medium is communicatively coupled to other components of the circuit system during device operation. In an example, any of the physical components may be used in more than one member of more than one circuit system. For instance, during operation, an execution unit may be used in a first circuit of a first circuit system at one point in time and reused at different times by a second circuit of the first circuit system or by a third circuit of the second circuit system.

[0079] Machine (e.g., computer system) 700 (e.g., host device 105, memory device 110, etc.) may include a hardware processor 702 (e.g., a central processing unit (CPU), graphics processing unit (GPU), hardware processor core, or any combination thereof, such as memory controller 115, etc.), main memory 704, and static memory 706, some or all of which may communicate with each other via interconnect (e.g., bus) 730. Machine 700 may further include a display unit 710, an alphanumeric input device 712 (e.g., keyboard), and a user interface (UI) navigation device 714 (e.g., mouse). In an example, the display unit 710, input device 712, and UI navigation device 714 may be a touch screen display. Machine 700 may additionally include a storage device (e.g., drive unit) 708, a signal generation device 718 (e.g., speaker), a network interface device 720, and one or more sensors 716, such as a global positioning system (GPS) sensor, compass, accelerometer, or other sensors. Machine 700 may include an output controller 728 (e.g., serial (e.g., Universal Serial Bus (USB), parallel or other wired or wireless (e.g., infrared (IR), near field communication (NFC) etc.)) connection) to communicate with or control one or more peripheral devices (e.g., printer, card reader, etc.).

[0080] Storage device 708 may include machine-readable medium 722 on which one or more sets of data structures or instructions 724 (e.g., software) embody or utilize any or more of the techniques or functions described herein. Instructions 724 may also reside wholly or at least partially within main memory 704, static memory 706, or hardware processor 702 during execution by machine 700. In an example, one or any combination of hardware processor 702, main memory 704, static memory 706, or storage device 708 may constitute machine-readable medium 722.

[0081] Although machine-readable media 722 is described as a single medium, the term "machine-readable media" may include a single medium or multiple media (e.g., a centralized or distributed database or associated cache and server) configured to store one or more instructions 724.

[0082] The term "machine-readable medium" may include any or more of the technologies capable of storing, encoding, or carrying instructions to be executed by machine 700 and causing machine 700 to perform the present invention, or any medium capable of storing, encoding, or carrying data structures used by or associated with such instructions. Non-limiting examples of machine-readable media may include solid-state memory as well as optical and magnetic media. In examples, aggregated machine-readable media includes machine-readable media having a plurality of particles with invariant (e.g., rest) mass. Therefore, aggregated machine-readable media is not a transient propagation of signals. Specific examples of aggregated machine-readable media may include: non-volatile memory, such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROMs and DVD-ROMs.

[0083] Instructions 724 (e.g., software, programs, operating system (OS), etc.) or other data are stored on storage device 721 and are accessible by memory 704 for use by processor 702. Memory 704 (e.g., DRAM) is typically fast but volatile and is therefore a different type of storage than storage device 721 (e.g., SSD), which is suitable for long-term storage, including when in a "shutdown" state. Instructions 724 or data used by the user or machine 700 are typically loaded into memory 704 for use by processor 702. When memory 704 is full, virtual space from storage device 721 can be allocated to supplement memory 704; however, since storage device 721 is typically slower than memory 704, and write speeds are typically at least twice as slow as read speeds, using virtual memory can significantly degrade the user experience (compared to memory 704 (e.g., DRAM)) due to storage device latency. Furthermore, using storage device 721 for virtual memory can significantly reduce the available lifespan of storage device 721.

[0084] Compared to virtual memory, virtual memory compression (e.g., The core feature, "ZRAM," uses a portion of memory as compressed block memory to avoid paging of storage device 721. Paging occurs within the compressed block until it is necessary to write the data to storage device 721. Virtual memory compression increases the available size of memory 704 while reducing wear and tear on storage device 721.

[0085] Storage devices optimized for mobile electronic devices or mobile storage traditionally include MMC solid-state storage devices (e.g., microSD cards). TM (e.g., cards, etc.) MMC devices contain several parallel interfaces (e.g., 8-bit parallel interfaces) with the host device and are typically removable and decoupled components from the host device. In contrast, eMMC... TM The device is attached to the circuit board and is considered a component of the host device; its read speed is comparable to that based on Serial ATA. TM Comparable to SSDs with (Serial ATA (Advanced Technology) or SATA) interfaces. However, the demand for mobile device performance continues to increase, such as fully enabling virtual or augmented reality devices and taking advantage of ever-growing network speeds. In response to this demand, storage devices have shifted from parallel communication interfaces to serial communication interfaces. Universal Flash Storage (UFS) devices, which include the controller and firmware, communicate with host devices using a Low Voltage Differential Signaling (LVDS) serial interface with dedicated read / write paths, thereby further advancing read / write speeds.

[0086] Furthermore, instructions 724 can be transmitted or received via communication network 726 using any of several transmission protocols (e.g., Frame Relay, Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), etc.) through network interface device 720 using a transmission medium. Example communication networks may include local area networks (LANs), wide area networks (WANs), packet data networks (e.g., the Internet), mobile phone networks (e.g., cellular networks) (e.g., mobile phone networks defined by the 3rd Generation Partnership Project (3GPP) series of standards (e.g., 3G, 4G, 5G, Long Term Evolution (LTE), etc.)), simple legacy telephone (POTS) networks, and wireless data networks (e.g., referred to as…). The network interface device 720 may include one or more physical jacks (e.g., Ethernet, coaxial, or telephone jacks) or one or more antennas for connection to the communication network 726. In an example, the network interface device 720 may include multiple antennas to wirelessly communicate using at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) technologies. The term "transmission medium" should be considered to include any intangible medium that may store, encode, or carry instructions for execution by machine 700, and includes digital or analog communication signals or other intangible media to facilitate communication of the software.

[0087] Additional examples:

[0088] Example 1 is a memory device for generating temporary random numbers for replay protection, the memory device comprising: a hash engine for generating a hash from a first input having a first length; and a processing circuit system for: extracting a first subset of the hash as a selector; using the selector to select a second subset of the hash having a second length less than the first length; and transmitting the second subset as a temporary random number for freshness values ​​in replay protection communication.

[0089] In Example 2, the object according to Example 1, wherein the first subset has a third length based on the first length and the second length.

[0090] In Example 3, according to the object described in Example 2, the third length is equal to the number of bits representing the first length divided by the second length.

[0091] In Example 4, the target described in Example 3 is used, wherein the hash is divided into non-overlapping groups with a length equal to the second length.

[0092] In Example 5, according to the object described in Example 4, wherein, in order to use the selector to select the second subset of the hash, the processing circuitry is configured to: evaluate the value of the bits in the selector; and use the group corresponding to the value in the non-overlapping group as the second subset.

[0093] In Example 6, the object described in any of Examples 1 to 5 is wherein the processing circuitry is configured to initialize a temporary random number sequence, wherein the temporary random number is used as a first temporary random number, and wherein a seed is selected as the first input.

[0094] In Example 7, the subject matter according to Example 6 is wherein the seed is of the type of one of the following: self-generated, unsigned shared public value, signed shared public value, or secret value generated from the Diffie-Hellman protocol.

[0095] In Example 8, based on the subject described in any of Examples 6 to 7, wherein, in order to select the seed, the processing circuitry is configured to: receive a command for a specified mode from a partner in the replay protection communication; update a multiplexer using the mode, the multiplexer having inputs for the various types of seeds supported; and generate the seed via the multiplexer.

[0096] In Example 9, according to the subject matter described in Example 8, wherein the command is the last communication in the initialization, the initialization comprising: a first request from the partner to begin the initialization; and a response to the first request with replay protection using a zero ephemeral random number, which is not part of the ephemeral random number sequence, wherein the command uses the zero ephemeral random number to prevent replay attacks during the initialization.

[0097] In Example 10, the subject matter is based on that described in Example 9, wherein the command is a data structure having an opcode field, a zero temporary random number field, a parameter field, a signature type field, and a signature field.

[0098] In Example 11, the object described in Example 10 is used, wherein the parameter field includes pattern recognition and payload.

[0099] In Example 12, the subject matter according to any of Examples 6 to 11, wherein the processing circuitry is configured to generate a second temporary random number in the temporary random number sequence after the first temporary random number, wherein the hash of the first temporary random number is used as the first input to the second temporary random number.

[0100] Example 13 is a method for generating temporary random numbers for replay protection, the method comprising: generating a hash from a first input having a first length; extracting a first subset of the hash as a selector; using the selector to select a second subset of the hash having a second length less than the first length; and transmitting the second subset as a temporary random number for freshness values ​​in replay protection communication.

[0101] In Example 14, the object according to Example 13, wherein the first subset has a third length based on the first length and the second length.

[0102] In Example 15, according to the object described in Example 14, wherein the third length is equal to the number of bits representing the first length divided by the second length.

[0103] In Example 16, according to the object described in Example 15, the hash is divided into non-overlapping groups with a length equal to the second length.

[0104] In Example 17, according to the object described in Example 16, the second subset of the hash is selected using the selector, which includes: evaluating the value of the bits in the selector; and using the group corresponding to the value in the non-overlapping group as the second subset.

[0105] In Example 18, the subject matter according to any of Examples 13 to 17 includes initializing a sequence of temporary random numbers containing the temporary random number as the first temporary random number by selecting a seed as the first input.

[0106] In Example 19, the subject matter according to Example 18 is wherein the seed is of the type of one of the following: self-generated, unsigned shared public value, signed shared public value, or secret value generated from the Diffie-Hellman protocol.

[0107] In Example 20, based on the subject matter described in any of Examples 18 to 19, selecting the seed comprises: receiving a command for a specified mode from a partner in the replay protection communication; using the mode to update a multiplexer having inputs of various types of seeds supported; and generating the seed via the multiplexer.

[0108] In Example 21, according to the subject matter of Example 20, wherein the command is the last communication in the initialization, the initialization comprising: a first request from the partner to begin the initialization; and a response to the first request with replay protection using a zero ephemeral random number, which is not part of the ephemeral random number sequence, wherein the command uses the zero ephemeral random number to prevent replay attacks during the initialization.

[0109] In Example 22, the subject matter according to Example 21 is described, wherein the command is a data structure having an opcode field, a zero temporary random number field, a parameter field, a signature type field, and a signature field.

[0110] In Example 23, the object is as described in Example 22, wherein the parameter fields include pattern recognition and payload.

[0111] In Example 24, the subject matter according to any of Examples 18 to 23 includes generating the second temporary random number in the sequence of temporary random numbers after the first temporary random number by using the hash of the first temporary random number as the first input to the second temporary random number.

[0112] Example 25 is a machine-readable medium containing instructions for generating replay-protected temporary random numbers, the instructions, when executed by a processing circuitry system, causing the processing circuitry system to perform operations including: generating a hash from a first input having a first length; extracting a first subset of the hash as a selector; using the selector to select a second subset of the hash having a second length less than the first length; and transmitting the second subset as a temporary random number for freshness values ​​in replay-protected communication.

[0113] In Example 26, the object according to Example 25, wherein the first subset has a third length based on the first length and the second length.

[0114] In Example 27, according to the object described in Example 26, the third length is equal to the number of bits representing the first length divided by the second length.

[0115] In Example 28, the target is as described in Example 27, wherein the hash is divided into non-overlapping groups with a length equal to the second length.

[0116] In Example 29, according to the object described in Example 28, the second subset of the hash is selected using the selector, which includes: evaluating the value of the bits in the selector; and using the group corresponding to the value in the non-overlapping group as the second subset.

[0117] In Example 30, the subject matter is as described in any of Examples 25 to 29, wherein the instructions include initializing a sequence of temporary random numbers containing the temporary random number as the first temporary random number by selecting a seed as the first input.

[0118] In Example 31, the subject matter according to Example 30, wherein the seed is of the type of one of the following: self-generated, unsigned shared public value, signed shared public value, or secret value generated from the Diffie-Hellman protocol.

[0119] In Example 32, based on the subject matter described in any of Examples 30 to 31, selecting the seed comprises: receiving a command for a specified mode from a partner in the replay protection communication; using the mode to update a multiplexer having inputs of various types of seeds supported; and generating the seed via the multiplexer.

[0120] In Example 33, according to the subject matter described in Example 32, wherein the command is the last communication in the initialization, the initialization comprising: a first request from the partner to begin the initialization; and a response to the first request with replay protection using a zero ephemeral random number, the zero ephemeral random number not being part of the ephemeral random number sequence, wherein the command uses the zero ephemeral random number to prevent replay attacks during the initialization.

[0121] In Example 34, based on the object of Example 33, the command is a data structure having an opcode field, a zero temporary random number field, a parameter field, a signature type field, and a signature field.

[0122] In Example 35, the object is as described in Example 34, wherein the parameter field includes pattern recognition and payload.

[0123] In Example 36, the subject matter according to any of Examples 30 to 35, wherein the instructions include generating a second temporary random number in the sequence of temporary random numbers after the first temporary random number by using the hash of the first temporary random number as a first input to the second temporary random number.

[0124] Example 37 is a system for generating temporary random numbers for replay protection, the system comprising: a component for generating a hash from a first input, the hash having a first length; a component for extracting a first subset of the hash as a selector; a component for using the selector to select a second subset of the hash, the second subset having a second length less than the first length; and a component for transmitting the second subset as a temporary random number of freshness value in replay protection communication.

[0125] In Example 38, the object according to Example 37, wherein the first subset has a third length based on the first length and the second length.

[0126] In Example 39, according to the object described in Example 38, the third length is equal to the number of bits representing the first length divided by the second length.

[0127] In Example 40, the target is as described in Example 39, wherein the hash is divided into non-overlapping groups with a length equal to the second length.

[0128] In Example 41, according to the object described in Example 40, the component for selecting the second subset of the hash using the selector comprises: a component for evaluating the value of a bit in the selector; and a component for using the group corresponding to the value in the non-overlapping group as the second subset.

[0129] In Example 42, the object according to any of Examples 37 to 41 includes a component for initializing a sequence of temporary random numbers containing the temporary random number as the first temporary random number by selecting a seed as the first input.

[0130] In Example 43, the subject matter according to Example 42 is wherein the seed is of the type of one of the following: self-generated, unsigned shared public value, signed shared public value, or secret value generated from the Diffie-Hellman protocol.

[0131] In Example 44, the object according to any of Examples 42 to 43, wherein the component for selecting the seed comprises: a component for receiving a command for a specified mode from a partner in the replay protection communication; a component for updating a multiplexer using the mode, the multiplexer having inputs of various types of supported seeds; and a component for generating the seed via the multiplexer.

[0132] In Example 45, according to the subject matter described in Example 44, wherein the command is the last communication in the initialization, the initialization comprising: a first request from the partner to begin the initialization; and a response to the first request with replay protection using a zero ephemeral random number, which is not part of the ephemeral random number sequence, wherein the command uses the zero ephemeral random number to prevent replay attacks during the initialization.

[0133] In Example 46, the subject matter according to Example 45 is described, wherein the command is a data structure having an opcode field, a zero temporary random number field, a parameter field, a signature type field, and a signature field.

[0134] In Example 47, the object is as described in Example 46, wherein the parameter field includes pattern recognition and payload.

[0135] In Example 48, the object according to any of Examples 42 to 47 includes a component for generating a second temporary random number in the sequence of temporary random numbers after the first temporary random number by using the hash of the first temporary random number as a first input to the second temporary random number.

[0136] Example 49 is at least one machine-readable medium containing instructions that, when executed by a processing circuitry system, cause the processing circuitry system to perform operations to implement any of Examples 1 to 48.

[0137] Example 50 is a device that includes components for implementing any of Examples 1 to 48.

[0138] Example 51 is a system for implementing any of Examples 1 through 48.

[0139] Example 52 is a method for implementing any of Examples 1 through 48.

[0140] The detailed description above includes reference to the accompanying drawings, which form part of the detailed description. The drawings illustrate, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are also referred to herein as “examples.” Such examples may include elements other than those shown or described. However, the inventors also contemplate that only examples of the elements shown or described are provided herein. Furthermore, the inventors also contemplate examples using any combination or arrangement of the elements (or aspects thereof) shown or described with respect to a particular example (or one or more aspects thereof) or with respect to other examples (or one or more aspects thereof) shown or described herein.

[0141] In this document, any other examples or uses of "at least one" or "one or more," such as the terms "a" or "an" commonly used in patent literature, are used to include one or more. In this document, the term "or" is used to refer to a non-exclusive "or," such that "A or B" may include "A but not B," "B but not A," and "A and B," unless otherwise indicated. In the appended claims, the terms "comprising" and "in which" are used as concise English equivalents to the corresponding terms "including" and "wherein." Furthermore, in the following claims, the terms "comprising" and "including" are open-ended, meaning that a system, apparatus, object, or process comprising elements other than those listed after this term in the claims is still considered to be within the scope of the claims. Additionally, in the appended claims, the terms "first," "second," and "third," etc., are used merely as labels and are not intended to impose numerical requirements on their subject matter.

[0142] In various instances, the components, controllers, processors, units, engines, or tables described herein may particularly include physical circuitry systems or firmware stored on a physical device. As used herein, "processor" means any type of computing circuitry, such as, but not limited to, microprocessors, microcontrollers, graphics processors, digital signal processors (DSPs), or any other type of processor or processing circuitry, including groups of processors or multi-core devices.

[0143] In this document, the terms "wafer" and "substrate" are used to generally refer to any structure on which an integrated circuit is formed, and also to such structures during the various stages of integrated circuit fabrication. Therefore, the following specific embodiments should not be construed as limiting, and the scope of the various embodiments is defined only by the full scope of the appended claims, together with their equivalents.

[0144] The various embodiments of the present invention, and described herein, include memory utilizing a vertical structure of memory cells (e.g., a NAND string of memory cells). As used herein, directional adjectives will be considered relative to the surface of the substrate on which the memory cells are formed (i.e., the vertical structure will be considered as extending away from the substrate surface, the bottom end of the vertical structure will be considered as the end closest to the substrate surface and the top end of the vertical structure will be considered as the end furthest from the substrate surface).

[0145] As used herein, operating a memory cell includes reading from a memory cell, writing to a memory cell, or erasing a memory cell. The operation of placing a memory cell in a desired state is referred to herein as “programming” and may include both writing to and erasing from a memory cell (e.g., a memory cell can be programmed to an erase state).

[0146] According to one or more embodiments of the present invention, a memory controller (e.g., processor, controller, firmware, etc.) located inside or outside the memory device can determine (e.g., select, set, adjust, calculate, change, clear, communicate, adapt, derive, define, utilize, modify, apply, etc.) a number of wear cycles or wear states (e.g., record wear cycles, count operations when an operation of the memory device occurs, track the memory device operation that started it, evaluate memory device characteristics corresponding to wear states, etc.).

[0147] According to one or more embodiments of the present invention, the memory access means may be configured to provide wear cycle information to the memory device for each memory operation. The memory device control circuitry (e.g., control logic) may be programmed to compensate for memory device performance variations corresponding to the wear cycle information. The memory device may receive the wear cycle information and determine one or more operating parameters (e.g., values, characteristics) in response to the wear cycle information.

[0148] The methods described herein may be implemented, at least in part, by a machine or computer. Some examples may include computer-readable or machine-readable media encoded with instructions operable to configure an electronic device to perform the methods described in the examples above. Implementations of such methods may include program code, such as microprogram code, assembly language code, higher-level language code, or the like. This program code may contain computer-readable instructions for performing various methods. The program code may form part of a computer program product. Furthermore, the program code may be tangibly stored, for example, during execution or at other times, on one or more volatile or non-volatile tangible computer-readable media. Examples of such tangible computer-readable media may include (but are not limited to) hard disks, removable disks, removable optical disks (e.g., optical discs and digital video discs), magnetic tapes, memory cards or sticks, random access memory (RAM), read-only memory (ROM), solid-state drives (SSDs), universal flash memory (UFS) devices, embedded MMC (eMMC) devices, and the like.

[0149] The foregoing description is intended to be illustrative and non-limiting. For example, the above examples (or one or more aspects thereof) may be used in combination with each other. Other embodiments may be used by those skilled in the art, for instance, upon review of the foregoing description. It should be understood that it is not intended to interpret or limit the scope or meaning of the claims. Furthermore, in the detailed description above, various features may be grouped together to simplify the invention. This should not be construed as implying that any undisclosed features are essential to any claim. Rather, the subject matter of the invention may consist of fewer than all the features of a particular disclosed embodiment. Therefore, the appended claims are hereby incorporated into the detailed description, wherein each claim is an independent, separate embodiment, and such embodiments are contemplated to be combined or arranged in various ways. The scope of the invention should be determined with reference to the appended claims together with the full scope of the equivalents granted by these claims.

Claims

1. An apparatus for replaying protected communications, the apparatus comprising: An interface configured to communicate with a hash engine during operation, the interface being used to receive hashes from the hash engine; and The processing circuit is used to: Extract the selector from the first part of the hash; The selector is used to select a second portion of the hash, which is smaller than the hash; and In the replay protection communication, the second part of the hash subset is transmitted as a temporary random number for the freshness value.

2. The device according to claim 1, wherein the processing circuit is configured to: Initialize a temporary random number sequence; and A seed is selected, wherein the temporary random number is used as the first temporary random number in the sequence of temporary random numbers, and wherein the seed is input into the hash engine to generate the hash.

3. The device according to claim 2, wherein the seed is one of several types.

4. The device of claim 3, wherein the type is one of self-generated, unsigned shared public value, signed shared public value, or secret value generated from the Diffie-Hellman protocol.

5. The device according to claim 3, comprising: A multiplexer that includes inputs to various types of supported seeds, the multiplexer being configured to generate the seeds based on the inputs.

6. The device of claim 5, wherein, in order to select the seed, the processing circuit is configured to: Receive a command specifying a pattern corresponding to the type from a partner in the replay-protected communication using the temporary random number sequence; Use the pattern to select the input corresponding to the type; and The seed corresponding to the type is generated via the multiplexer.

7. The device of claim 6, wherein the command is the last communication in the initialization of the replay protection communication, the initialization comprising: A first request from the partner to begin the initialization; and A response to the first request with replay protection using zero ephemeral random numbers, wherein the zero ephemeral random number is not part of the ephemeral random number sequence, wherein the command uses the zero ephemeral random number to prevent replay attacks during the initialization.

8. The device according to claim 7, wherein the command is a data structure having an opcode field, a zero temporary random number field, a parameter field, a signature type field, and a signature field.

9. The device according to claim 8, wherein the parameter field includes pattern recognition and payload.

10. The apparatus of claim 2, wherein the processing circuitry is configured to generate a second temporary random number in the temporary random number sequence after the first temporary random number, wherein the hash of the first temporary random number is used as a first input to the second temporary random number.

11. The device of claim 1, wherein the device is configured to include in a memory device, the memory device including the hash engine.

12. A method for replaying protected communications, the method comprising: Receive hashes from the hash engine; Extract the selector from the first part of the hash; The selector is used to select a second portion of the hash, which is smaller than the hash. and In the replay protection communication, the second part of the hash subset is transmitted as a temporary random number for the freshness value.

13. The method of claim 12, further comprising: Initialize a temporary random number sequence, wherein the temporary random number is used as the first temporary random number in the temporary random number sequence; and A seed is selected as input to the hash engine to generate the hash.

14. The method of claim 13, wherein the seed is one of several types.

15. The method of claim 14, wherein the type is one of self-generated, unsigned shared public value, signed shared public value, or secret value generated from the Diffie-Hellman protocol.

16. The method of claim 14, further comprising: Enable one of several inputs to a multiplexer, which includes inputs to various types of supported seeds, and the multiplexer is configured to generate the seed based on the input.

17. The method of claim 16, wherein selecting the seed comprises: Receive a command specifying a pattern corresponding to the type from a partner in the replay-protected communication using the temporary random number sequence; Use the mode to enable the input corresponding to the type; and The seed corresponding to the type is generated via the multiplexer.

18. The method of claim 17, wherein the command is the last communication in the initialization of the replay protection communication, the initialization comprising: A first request from the partner to begin the initialization; and A response to the first request with replay protection using zero ephemeral random numbers, wherein the zero ephemeral random number is not part of the ephemeral random number sequence, wherein the command uses the zero ephemeral random number to prevent replay attacks during the initialization.

19. The method of claim 18, wherein the command is a data structure having an opcode field, a zero temporary random number field, a parameter field, a signature type field, and a signature field.

20. The method of claim 19, wherein the parameter field includes pattern recognition and payload.

21. The method of claim 13, further comprising: A second temporary random number is generated in the temporary random number sequence after the first temporary random number, wherein the hash of the first temporary random number is used as the first input of the second temporary random number.

22. A system comprising components for performing the method according to any one of claims 12 to 21.

23. A machine-readable medium comprising instructions that, when executed, cause a machine to perform the method according to any one of claims 12 to 21.

Images