Memory system, operating method thereof, and storage medium

Abstract

The embodiment of the invention provides a memory system, an operation method thereof and a storage medium. A memory system includes: a memory device; the memory controller is coupled with the memory device and is configured to perform first protocol authentication when it is determined that access protection is set for the memory device; after the first protocol authentication is passed, an access operation is performed on the memory device.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of semiconductor technology, and in particular to a memory system and an operating method thereof, and a storage medium. Background Art

[0002] Memory devices are storage devices used to store information in modern information technology. Among them, flash memory, as a typical non-volatile semiconductor memory, has advantages such as high storage density, controllable production cost, suitable editing and erasing speed and retention characteristics, and has gradually become a mainstream product in the storage market.

[0003] For example, memory systems such as solid state drives (SSD) used in personal computers and servers, and universal flash storage (UFS) used in mobile phones and various embedded systems usually use flash memory as their permanent storage medium. Therefore, how to further improve the performance of memory systems has become an urgent problem to be solved in the industry. Summary of the invention

[0004] Based on this, the embodiments of the present disclosure provide a memory system and an operation method thereof, and a storage medium. The memory system includes: a memory device; a memory controller coupled to the memory device and configured to: perform a first protocol authentication when it is determined that the memory device has been set for access protection; and perform an access operation on the memory device after the first protocol authentication passes.

[0005] In some embodiments, the memory controller is also configured to: send a first command set to the memory device; use the first command set to perform the first protocol authentication; wherein the first command set includes a first instruction, a second instruction and a third instruction; the first instruction instructs to obtain the first data of the memory device; the first data is used to characterize the identity characteristics of the memory device; the second instruction instructs to obtain the second data of the memory device; the second data is a random number; the third instruction instructs to compare the first ciphertext with the second ciphertext in the memory device; wherein the third instruction includes third data and the first ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the first ciphertext is obtained by performing a first encryption operation on the first data, the second data and the third data; the second ciphertext is obtained by performing a second encryption operation on the first data, the second data and the third data.

[0006] In some embodiments, the memory controller is further configured to: send a fourth instruction to the memory device; the fourth instruction instructs obtaining a comparison result of the first ciphertext and the second ciphertext; wherein, when the comparison result shows that the first ciphertext is the same as the second ciphertext, the first protocol authentication is passed.

[0007] In some embodiments, the memory controller is further configured to: perform at least one second protocol authentication after the first protocol authentication is passed; change the current access permission status of the memory device each time the second protocol authentication is passed; the access permission status includes allowing access operations to be performed and not allowing access operations to be performed.

[0008] In some embodiments, the memory controller is also configured to: send a second command set to the memory device; use the second command set to perform the second protocol authentication; wherein the second command set includes a first instruction, a second instruction and a fifth instruction; the first instruction instructs to obtain the first data of the memory device; the first data is used to characterize the identity characteristics of the memory device; the second instruction instructs to obtain the second data of the memory device; the second data is a random number; the fifth instruction instructs to use a third ciphertext to compare with a fourth ciphertext in the memory device; wherein the fifth instruction includes third data, fourth data and the third ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the third ciphertext is obtained by performing a third encryption operation on the first data, the second data, the third data and the fourth data; the fourth ciphertext is obtained by performing a fourth encryption operation on the first data, the second data, the third data and the fourth data.

[0009] In some embodiments, the memory controller is further configured to: send a sixth instruction to the memory device; the sixth instruction instructs obtaining a comparison result of the third ciphertext and the fourth ciphertext; wherein, when the comparison result shows that the third ciphertext is the same as the fourth ciphertext, the second protocol authentication is passed.

[0010] An embodiment of the present disclosure also proposes a memory system, comprising: a memory device and a memory controller coupled to the memory device; the memory controller is configured to: send a first command set when it is determined that access protection has been set for the memory device; the memory device is configured to: receive the first command set, and perform a first protocol authentication in response to the first command set; the memory controller is also configured to: perform an access operation on the memory device when the first protocol authentication is passed.

[0011] In some embodiments, the first command set includes a first instruction, a second instruction, and a third instruction; the memory device is configured to: receive the first instruction; in response to the first instruction, send first data to the memory controller; the first data is used to characterize the identity characteristics of the memory device; receive the second instruction; in response to the second instruction, send second data to the memory controller; the second data is a random number; receive the third instruction; in response to the third instruction, compare the received first ciphertext with the second ciphertext; the third instruction includes third data and the first ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the memory controller is also configured to: obtain the first ciphertext by performing a first encryption operation on the first data, the second data, and the third data; the memory controller is also configured to: obtain the second ciphertext by performing a second encryption operation on the first data, the second data, and the third data.

[0012] In some embodiments, the memory device is further configured to: receive a fourth instruction; in response to the fourth instruction, send a comparison result of the first ciphertext and the second ciphertext to the memory controller; wherein, when the comparison result shows that the first ciphertext and the second ciphertext are the same, the first protocol authentication is passed.

[0013] In some embodiments, the memory device is further configured to: receive a second command set; perform a second protocol authentication using the second command set; wherein the second command set includes a first instruction, a second instruction, and a fifth instruction; the memory device is configured to: receive the first instruction; in response to the first instruction, send first data to the memory controller; the first data is used to characterize the identity characteristics of the memory device; receive the second instruction; in response to the second instruction, send second data to the memory controller; receive the fifth instruction; in response to the fifth instruction, compare the received third ciphertext with the fourth ciphertext; wherein the fifth instruction includes third data, fourth data, and the third ciphertext; the memory controller is further configured to: obtain the third ciphertext by performing a third encryption operation on the first data, the second data, the third data, and the fourth data; the memory device is further configured to: obtain the fourth ciphertext by performing a fourth encryption operation on the first data, the second data, the third data, and the fourth data.

[0014] In some embodiments, the memory device is also configured to: receive a sixth instruction; in response to the sixth instruction, send a comparison result of the third ciphertext and the fourth ciphertext to the memory controller; wherein, when the comparison result shows that the third ciphertext is the same as the fourth ciphertext, the second protocol authentication is passed.

[0015] In some embodiments, the memory device includes multiple storage pages; the memory device is configured to: in response to the second instruction, apply a first read voltage and a second read voltage to a selected storage page among the multiple storage pages, respectively, to obtain first read data and second read data; perform a logical operation on the first read data and the second read data to obtain third read data; the first read voltage is different from the second read voltage; perform error data collection on the third read data; and generate the second data based on the collected error data.

[0016] The disclosed embodiment also proposes an operating method of a memory system, the operating method comprising: when it is determined that access protection has been set for a memory device, performing a first protocol authentication; when the first protocol authentication passes, performing an access operation on the memory device.

[0017] In some embodiments, the first protocol authentication includes: sending a first command set to the memory device; performing the first protocol authentication using the first command set; wherein the first command set includes a first instruction, a second instruction, and a third instruction; the operation method specifically includes: obtaining first data of the memory device according to the first instruction; the first data is used to characterize the identity characteristics of the memory device; obtaining second data of the memory device according to the second instruction; the second data is a random number; comparing the first ciphertext with the second ciphertext in the memory device according to the third instruction; wherein the third instruction includes third data and the first ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the first ciphertext is obtained by performing a first encryption operation on the first data, the second data, and the third data; the second ciphertext is obtained by performing a second encryption operation on the first data, the second data, and the third data.

[0018] In some embodiments, the operating method also includes: sending a fourth instruction to the memory device; the fourth instruction instructs obtaining a comparison result of the first ciphertext and the second ciphertext; when the comparison result shows that the first ciphertext and the second ciphertext are the same, the first protocol authentication is passed.

[0019] In some embodiments, the operating method also includes: after the first protocol authentication is passed, performing at least one second protocol authentication; each time the second protocol authentication is passed, changing the current access permission status of the memory device; the access permission status includes allowing access operations to be performed and not allowing access operations to be performed.

[0020] In some embodiments, performing at least one second protocol authentication includes: sending a second command set to the memory device; performing the second protocol authentication using the second command set; wherein the second command set includes a first instruction, a second instruction, and a fifth instruction; the operation method specifically includes: obtaining first data of the memory device according to the first instruction instruction; the first data is used to characterize the identity characteristics of the memory device; obtaining second data of the memory device according to the second instruction instruction; using a third ciphertext to compare with a fourth ciphertext in the memory device according to the fifth instruction instruction; wherein the fifth instruction includes third data, fourth data, and the third ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the third ciphertext is obtained by performing a third encryption operation on the first data, the second data, the third data, and the fourth data; the fourth ciphertext is obtained by performing a fourth encryption operation on the first data, the second data, the third data, and the fourth data.

[0021] In some embodiments, the operating method also includes: sending a sixth instruction to the memory device; the sixth instruction instructs obtaining a comparison result of the third ciphertext and the fourth ciphertext; when the comparison result shows that the third ciphertext is the same as the fourth ciphertext, the second protocol authentication is passed.

[0022] In some embodiments, the operation method further includes: when it is determined that the memory device has not set the access protection, directly performing the access operation on the memory device.

[0023] The embodiments of the present disclosure further provide a storage medium having executable instructions stored thereon. When the executable instructions are executed by a memory controller, the steps of the operating method described in the above embodiments of the present disclosure can be implemented.

[0024] The embodiments of the present disclosure provide a memory system and an operation method thereof, and a storage medium; wherein the memory system includes: a memory device; a memory controller coupled to the memory device and configured to: perform a first protocol authentication when it is determined that the memory device has been set for access protection; and perform an access operation on the memory device after the first protocol authentication passes. In the embodiments of the present disclosure, during the use of the memory system, by setting the first protocol authentication for the memory device, the memory controller needs to perform the first protocol authentication before accessing the memory device, and can only access the memory device after the first protocol authentication passes; in this way, the security of the data in the memory device can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A schematic diagram of an exemplary system having a memory system according to an embodiment of the present disclosure;

[0026] Figure 2a A schematic diagram of an exemplary memory card having a memory system according to an embodiment of the present disclosure;

[0027] Figure 2b A schematic diagram of an exemplary solid-state drive having a memory system according to an embodiment of the present disclosure;

[0028] Figure 3a A schematic diagram of the distribution of storage cells of a three-dimensional NAND memory according to an embodiment of the present disclosure;

[0029] Figure 3b is a schematic diagram of an exemplary memory device including a peripheral circuit according to an embodiment of the present disclosure;

[0030] Figure 4 is a cross-sectional schematic diagram of a memory array including a NAND-type memory string according to an embodiment of the present disclosure;

[0031] Figure 5 A schematic diagram of an exemplary memory device including a memory cell array and a peripheral circuit according to an embodiment of the present disclosure;

[0032] Figure 6 A block diagram of a memory system according to an embodiment of the present disclosure;

[0033] Figure 7 A schematic diagram of a memory system operation flow including a first protocol authentication provided for an embodiment of the present disclosure;

[0034] Figure 8a A schematic diagram of multiple instruction interactions in a first authentication protocol provided in an embodiment of the present disclosure;

[0035] Figure 8b A signal timing diagram of multiple instructions in a first authentication protocol provided by an embodiment of the present disclosure;

[0036] Fig. 9 A schematic diagram of a process for obtaining second data provided by an embodiment of the present disclosure;

[0037] Fig.10 A schematic diagram of an instruction interaction for obtaining a first authentication protocol result provided by an embodiment of the present disclosure;

[0038] Fig.11a A schematic diagram of multiple instruction interactions in a second authentication protocol provided in an embodiment of the present disclosure;

[0039] Fig.11b A signal timing diagram of multiple instructions in a second authentication protocol provided by an embodiment of the present disclosure;

[0040] Fig.12A schematic diagram of the instruction interaction for obtaining the second authentication protocol result provided in one embodiment of the present disclosure. DETAILED DESCRIPTION

[0041] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the specific embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0042] In the following description, a large number of specific details are given to provide a more thorough understanding of the present disclosure. However, it is obvious to those skilled in the art that the present disclosure can be implemented without one or more of these details. In other examples, in order to avoid confusion with the present disclosure, some technical features known in the art are not described; that is, all features of actual embodiments are not described here, and well-known functions and structures are not described in detail.

[0043] In the drawings, the sizes of layers, regions, elements and their relative sizes may be exaggerated for clarity. Like reference numerals denote like elements throughout.

[0044] It should be understood that when an element or layer is referred to as "on ...", "adjacent to ...", "connected to" or "coupled to" other elements or layers, it can be directly on, adjacent to, connected to or coupled to other elements or layers, or there can be intervening elements or layers. On the contrary, when an element is referred to as "directly on ...", "directly adjacent to ...", "directly connected to" or "directly coupled to" other elements or layers, there is no intervening element or layer. It should be understood that although the terms first, second, third, etc. can be used to describe various elements, components, regions, layers and / or parts, these elements, components, regions, layers and / or parts should not be limited by these terms. These terms are only used to distinguish one element, component, region, layer or part from another element, component, region, layer or part. Therefore, without departing from the teachings of the present disclosure, the first element, component, region, layer or part discussed below can be represented as the second element, component, region, layer or part. And when the second element, component, region, layer or part is discussed, it does not indicate that the present disclosure necessarily has the first element, component, region, layer or part.

[0045] Spatially relative terms such as "under", "beneath", "below", "under", "above", "above", etc., may be used here for convenience of description to describe the relationship between an element or feature shown in the figure and other elements or features. It should be understood that in addition to the orientation shown in the figure, the spatial relationship terms are intended to also include different orientations of the device in use and operation. For example, if the device in the accompanying drawings is turned over, then the elements or features described as "under other elements" or "under it" or "under it" will be oriented as "on" other elements or features. Therefore, the exemplary terms "under" and "under" may include both upper and lower orientations. The device can be oriented otherwise (rotated 90 degrees or other orientations) and the spatial descriptors used herein are interpreted accordingly.

[0046] The purpose of the terms used herein is only to describe specific embodiments and is not intended to be a limitation of the present disclosure. When used herein, the singular forms "one", "an" and "said / the" are also intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the terms "consisting of" and / or "comprising", when used in this specification, determine the presence of the features, integers, steps, operations, elements and / or parts, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, parts and / or groups. When used herein, the term "and / or" includes any and all combinations of the relevant listed items.

[0047] In order to enable a more detailed understanding of the features and technical contents of the embodiments of the present disclosure, the implementation of the embodiments of the present disclosure is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present disclosure.

[0048] The memory device in the embodiments of the present disclosure includes but is not limited to a three-dimensional NAND memory. For ease of understanding, a three-dimensional NAND memory is taken as an example for description.

[0049] Figure 1 A block diagram of an exemplary system 100 having a memory device according to some aspects of the present disclosure is shown. The system 100 may be a mobile phone, a desktop computer, a laptop computer, a tablet computer, a vehicle computer, a game console, a printer, a positioning device, a wearable electronic device, a smart sensor, a virtual reality (VR) device, an augmented reality (AR) device, or any other suitable electronic device having a memory therein. Figure 1As shown in , system 100 may include a host 108 and a memory system 102, the memory system 102 having one or more memory devices 104 and a memory controller 106. The host 108 may be a processor (e.g., a central processing unit (CPU)) or a system on chip (SoC) (e.g., an application processor (AP)) of an electronic device. The host 108 may be configured to send data to the memory device 104 or receive data from the memory device 104.

[0050] According to some embodiments, the memory controller 106 is coupled to the memory device 104 and the host 108 and is configured to control the memory device 104. The memory controller 106 can manage data stored in the memory device 104 and communicate with the host 108. In some embodiments, the memory controller 106 is designed to operate in a low duty cycle environment, such as a secure digital (SD) card, a compact flash (CF) card, a universal serial bus (USB) flash drive, or other media for use in electronic devices such as personal computers, digital cameras, mobile phones, etc. In some embodiments, the memory controller 106 is designed to operate in a high duty cycle environment solid state drive (SSD) or embedded multimedia card (eMMC), which is used as a data storage for mobile devices such as smart phones, tablet computers, laptop computers, etc. and enterprise storage arrays.

[0051] The memory controller 106 may be configured to control the operation of the memory device 104, such as read, erase, and program operations. The memory controller 106 may also be configured to manage various functions regarding data stored or to be stored in the memory device 104, including but not limited to bad block management, garbage collection, logical to physical address translation, wear leveling, etc. In some embodiments, the memory controller 106 is also configured to process error correction codes (ECC) regarding data read from or written to the memory device 104. The memory controller 106 may also perform any other suitable functions, such as formatting the memory device 104. The memory controller 106 may communicate with an external device (e.g., a host 108) according to a specific communication protocol. For example, the memory controller 106 can communicate with external devices through at least one of various interface protocols, such as USB protocol, MMC protocol, peripheral component interconnect (PCI) protocol, PCI Express (PCI-E) protocol, advanced technology attachment (ATA) protocol, serial ATA protocol, parallel ATA protocol, small computer mini interface (SCSI) protocol, enhanced small disk interface (ESDI) protocol, integrated drive electronics (IDE) protocol, Firewire protocol, etc.

[0052] The memory controller 106 and the one or more memory devices 104 may be integrated into various types of storage devices, for example, included in the same package (e.g., a Universal Flash Storage (UFS) package or an eMMC package). That is, the memory system 102 may be implemented and packaged into different types of terminal electronic products. Figure 2a In one example shown in , the memory controller 106 and the single memory device 104 can be integrated into a memory card 202. The memory card 202 may include a PC card (PCMCIA, Personal Computer Memory Card International Association), a CF card, a Smart Media (SM) card, a memory stick, a multimedia card (MMC, RS-MMC, MMCmicro), an SD card (SD, miniSD, microSD, SDHC), UFS, etc. The memory card 202 may also include a processor that connects the memory card 202 to a host (e.g., Figure 1 The memory card connector 204 is coupled to the host 108 in the embodiment. Figure 2b In another example shown in , the memory controller 106 and the plurality of memory devices 104 may be integrated into an SSD 206. The SSD 206 may also include a processor that interfaces the SSD 206 with a host (e.g., Figure 1 In some implementations, the storage capacity and / or operating speed of the SSD 206 is greater than the storage capacity and / or operating speed of the memory card 202.

[0053] Figure 3a A schematic diagram of the structure of a storage cell array of a three-dimensional NAND memory is given as an example. Figure 3a As shown, the memory cell array of the three-dimensional NAND memory is composed of several parallel and staggered rows of memory cell rows parallel to the gate isolation structure, every two rows of memory cell rows are separated by the gate isolation structure and the upper selection gate isolation structure, and each memory cell row includes a plurality of memory cells. The gate isolation structure may include a first gate isolation structure and a second gate isolation structure, the first gate isolation structure divides the memory cell array into a plurality of memory blocks (Blocks), the plurality of second gate isolation structures may divide the memory blocks into a plurality of finger storage areas (Fingers), and the upper selection gate isolation structure disposed in the middle of each finger storage area may divide the finger storage area into two parts, thereby dividing the finger storage area into two memory slices. Figure 3a The memory block shown in FIG. 1 includes 6 memory cells. In practical applications, the number of memory cells in a memory block is not limited thereto. In some embodiments, each memory block can be coupled to multiple word lines (WL), and multiple memory cells coupled to each independently controlled word line constitute a memory page. For example, Figure 3a All memory cells in each memory slice are coupled to form a memory page.

[0054] It should be noted that Figure 3a The number of memory cell rows between the gate isolation structure and the upper selection gate isolation structure given in the disclosure is only an exemplary demonstration and is not used to limit the number of memory cell rows contained in a finger storage area of ​​the three-dimensional NAND memory in the present disclosure. In actual applications, the number of memory cell rows contained in a finger storage area can be adjusted according to actual conditions, such as 2, 4, 8, 16, etc.

[0055] Figure 3b 1 is a schematic circuit diagram of an exemplary memory device 300 including peripheral circuits according to some aspects of the present disclosure. The memory device 300 may be Figure 1 300. The memory device 300 may include a memory cell array 301 and a peripheral circuit 302 coupled to the memory cell array 301. The memory cell array 301 is taken as an example of a three-dimensional NAND memory cell array, wherein the memory cell 306 is a NAND memory cell, and the memory cell 306 is provided in the form of an array of memory strings 308, each memory string 308 extending vertically above a substrate (not shown).

[0056] like Figure 3bAs shown in , each memory string 308 may include a lower selection transistor 310 (also known as a source selection transistor, which includes a source selection gate BSG) at its source terminal and an upper selection transistor 312 (also known as a drain selection transistor, which includes a drain selection gate TSG) at its drain terminal. The source selection transistor BSG310 and the drain selection transistor TSG312 can be configured to activate the selected memory string 308 during read and program operations. In some embodiments, the sources of the memory strings 308 in the same memory block 304 are coupled through the same source line (SL) 314 (e.g., a common SL). In other words, according to some embodiments, all memory strings 308 in the same memory block 304 have an array common source (ACS). According to some embodiments, the TSG312 of each memory string 308 is coupled to a corresponding bit line (BL) 316, and data can be read from or written to the bit line 316 via an output bus (not shown). In some embodiments, each storage string 308 is configured to be selected or deselected by applying a selection voltage (e.g., higher than the threshold voltage of a transistor having TSG 312) or a deselection voltage (e.g., 0 V) ​​to a corresponding TSG 312 via one or more TSG lines 313 and / or by applying a selection voltage (e.g., higher than the threshold voltage of a transistor having BSG 310) or a deselection voltage (e.g., 0 V) ​​to a corresponding BSG 310 via one or more BSG lines 315.

[0057] like Figure 3b As shown in , the memory string 308 can be organized into a plurality of memory blocks 304, each of which can have a common source line 314 (e.g., coupled to ground). In some embodiments, each memory block 304 is a basic data unit for an erase operation, that is, all memory cells 306 on the same memory block 304 are erased at the same time. In order to erase the memory cells 306 in a selected memory block 304, the source lines 314 coupled to the selected memory block 304 and the unselected memory blocks 304 in the same plane as the selected memory block 304 can be biased with an erase voltage (Vers) (e.g., a high positive voltage (e.g., 20V or higher)). It should be understood that in some examples, the erase operation can be performed at a half-memory block level, at a quarter-memory block level, or at a level with any suitable number of memory blocks or any suitable fraction of memory blocks. The memory cells 306 of adjacent memory strings 308 can be coupled by word lines 318, which select which row of memory cells 306 is affected by the read and program operations. In some embodiments, in combination with the previous Figure 3a, multiple memory cells are isolated by an upper selection gate isolation structure and a gate isolation structure, and multiple memory cells between the upper selection gate isolation structure and the gate isolation structure are arranged into multiple memory cell rows, and each memory cell row is parallel to the gate isolation structure and the upper selection gate isolation structure.

[0058] refer to Figure 3a , Figure 3b Each memory cell 306 in the plurality of memory cells is coupled to a corresponding word line 318, and each memory string 308 is coupled to a corresponding bit line 316 via a corresponding selection transistor (such as the top selection transistor (TSG) 312).

[0059] Figure 4 FIG. 3 is a cross-sectional schematic diagram of an exemplary memory cell array 301 including a memory string 308 using NAND as an example according to some aspects of the present disclosure. Figure 4 As shown, the NAND memory cell array 301 may include a stacked structure 410, which includes a plurality of gate layers 411 and a plurality of insulating layers 412 that are alternately stacked in sequence, and a channel structure that vertically penetrates the gate layers 411 and the insulating layers 412, wherein the channel structure is coupled with each gate layer to form a memory cell, and the channel structure is coupled with a plurality of gate layers in the stacked structure 410 to form a memory string 308. The gate layers 411 and the insulating layers 412 may be alternately stacked, and two adjacent gate layers 411 are separated by a layer of insulating layer 412.

[0060] The constituent material of the gate layer 411 may include a conductive material. Conductive materials include, but are not limited to, tungsten (W), cobalt (Co), copper (Cu), aluminum (Al), polysilicon, doped silicon, silicide, or any combination thereof. In some embodiments, each gate layer 411 includes a metal layer, for example, a tungsten layer. In some embodiments, each gate layer 411 includes a doped polysilicon layer. Each gate layer 411 may include a control gate surrounding a memory cell. The gate layer 411 at the top of the stacked structure 410 may extend laterally as an upper selection gate line, the gate layer 411 at the bottom of the stacked structure 410 may extend laterally as a lower selection gate line, and the gate layer 411 extending laterally between the upper selection gate line and the lower selection gate line may serve as a word line layer.

[0061] In some embodiments, the stacked structure 410 may be disposed on a substrate 401. The substrate 401 may include silicon (e.g., single crystal silicon), silicon germanium (SiGe), gallium arsenide (GaAs), germanium (Ge), silicon on insulator (SOI), germanium on insulator (GOI), or any other suitable material.

[0062] In some embodiments, the memory string 308 includes a channel structure extending vertically through the stacked structure 410. In some embodiments, the channel structure includes a channel hole filled with (one or more) semiconductor materials (e.g., as a semiconductor channel) and (one or more) dielectric materials (e.g., as a memory film). In some embodiments, the semiconductor channel includes silicon, for example, polysilicon. In some embodiments, the memory film is a composite dielectric layer including a tunneling layer, a storage layer (also referred to as a "charge trapping / storage layer"), and a barrier layer. The channel structure may have a cylindrical shape (e.g., a column shape). According to some embodiments, the semiconductor channel, the tunneling layer, the storage layer, and the barrier layer are arranged radially from the center of the column toward the outer surface of the column in this order. The tunneling layer may include silicon oxide, silicon oxynitride, or any combination thereof. The storage layer may include silicon nitride, silicon oxynitride, or any combination thereof. The barrier layer may include silicon oxide, silicon oxynitride, a high dielectric constant (high-k) dielectric, or any combination thereof. In one example, the memory film may include a composite layer of silicon oxide / silicon oxynitride / silicon oxide (ONO).

[0063] Return to reference Figure 3b , the peripheral circuit 302 may be coupled to the memory cell array 301 through the bit line 316, the word line 318, the source line 314, the BSG line 315, and the TSG line 313. The peripheral circuit 302 may include any suitable analog, digital, and mixed signal circuits for facilitating the operation of the memory cell array 301 by applying a voltage signal and / or a current signal to each target memory cell 306 and sensing a voltage signal and / or a current signal from each target memory cell 306 via the bit line 316, the word line 318, the source line 314, the BSG line 315, and the TSG line 313. The peripheral circuit 302 may include various types of peripheral circuits formed using metal-oxide-semiconductor (MOS) technology. For example, Figure 5 Some exemplary peripheral circuits are shown, and the peripheral circuit 302 includes a page buffer / sense amplifier 504, a column decoder / bit line driver 506, a row decoder / word line driver 508, a voltage generator 510, a control logic 512, a register 514, an interface 516, and a data bus 518. It should be understood that in some examples, it may also include Figure 5 Additional peripheral circuits not shown.

[0064] The page buffer / sense amplifier 504 can be configured to read data from the memory cell array 301 and program (write) data to the memory cell array 301 according to a control signal from the control logic 512. In one example, the page buffer / sense amplifier 504 can store the program data (write data) to be programmed into the memory cell array 301. In another example, the page buffer / sense amplifier 504 can perform a program verification operation to ensure that the data has been correctly programmed into the memory cell 306 coupled to the selected word line 318. In yet another example, the page buffer / sense amplifier 504 can also sense a low-power signal from the bit line 316 representing the data bit stored in the memory cell 306, and amplify the small voltage swing to a recognizable logic level in a read operation. The column decoder / bit line driver 506 can be configured to be controlled by the control logic 512, and select one or more memory strings 308 by applying a bit line voltage generated from the voltage generator 510.

[0065] The row decoder / word line driver 508 may be configured to be controlled by the control logic 512 and select / deselect the memory block 304 of the memory cell array 301 and select / deselect the word line 318 of the memory block 304. The row decoder / word line driver 508 may also be configured to drive the word line 318 using the word line voltage generated from the voltage generator 510. In some embodiments, the row decoder / word line driver 508 may also select / deselect and drive the BSG line 315 and the TSG line 313. As described in detail below, the row decoder / word line driver 508 is configured to perform a programming operation on the memory cell 306 coupled to the (one or more) selected word lines 318. The voltage generator 510 may be configured to be controlled by the control logic 512 and generate a word line voltage (e.g., a read voltage, a program voltage, a pass voltage, a channel boosting voltage, a verification voltage, etc.), a bit line voltage, and a source line voltage to be supplied to the memory cell array 301.

[0066] The control logic 512 may be coupled to each of the other parts in the peripheral circuits described above, and is configured to control the operation of each of the other parts in the peripheral circuits. The register 514 may be coupled to the control logic 512, and includes a status register, a command register, and an address register for storing status information, a command operation code (OP code), and a command address for controlling the operation of each peripheral circuit. The interface 516 may be coupled to the control logic 512, and act as a control buffer to buffer control commands received from a host (not shown) and relay them to the control logic 512, and to buffer status information received from the control logic 512 and relay them to the host. The interface 516 may also be coupled to the column decoder / bit line driver 506 via the data bus 518, and act as a data I / O interface and a data buffer to buffer data and relay them to the memory cell array 301 or relay or buffer data from the memory cell array 301.

[0067] Currently, for NAND type memories, after the device is powered on, any user can access the memory device. Thus, for some users with security requirements, there is no guarantee that the stored data is only accessed by the authorized user. In other words, after the device is powered on, the security of the data stored in the memory device cannot be guaranteed.

[0068] Based on this, an embodiment of the present disclosure provides a memory system and an operation method thereof, and a storage medium; wherein the memory system includes: a memory device; and a memory controller coupled to the memory device.

[0069] Exemplary, reference Figure 6 , Figure 6 A block diagram of a memory system is shown. The memory system 601 includes: a memory controller 602 and a memory device 603. The memory controller 602 is used to control the memory device 603 to perform operations such as reading, writing, and erasing. Here, the memory controller 602 and the memory device 603 can be coupled in any suitable manner. In the embodiment of the present disclosure, the memory device 603 can be a semiconductor memory for storing data in a non-volatile manner, such as a NAND type memory. The memory system 601 is connected to a host 604, and the host 604 can be an electronic device such as a personal computer or a mobile terminal. The host I / F 6021 outputs commands, user data, etc. received from the host 604 to the internal bus 6020, and sends user data read from the memory device 603, responses from the control unit 6023, etc. to the host 604.

[0070] The memory I / F 6022 controls the process of writing user data and the like to the memory device 603 and the process of reading from the memory device 603 based on the instruction of the control unit 6023. The control unit 6023 controls the memory system 601 as a whole, and the control unit 6023 is, for example, a central processing unit (CPU), a microprocessor (MPU), etc. When the control unit 6023 receives a command from the host 604 via the host I / F 6021, it performs control according to the command. For example, the control unit 6023 instructs the memory I / F 6022 to write user data to the memory device 603 according to the command from the host 604. In addition, the control unit 6023 instructs the memory I / F 6022 to read user data from the memory device 603 according to the command from the host 604.

[0071] In the embodiments of the present disclosure, in order to improve the security of data, security protection is set for the memory device before accessing the data stored in the memory device, such as read protection, write protection and other access protection; in other words, before the memory controller accesses the memory device, one or more protocol authentications are required, such as a handshake protocol, to enable security protection (such as access protection); further, only after the protocol authentication is passed can the memory controller continue to access the data stored in the memory device and perform other operations, thereby improving the security of the data in the memory device.

[0072] In actual applications, different security protections can be set according to the current state of the memory device; for example, in order to confirm whether the identity features of the memory device and the memory controller match, and to verify whether the current user is an authorized user, an access protection is set. That is, before the memory controller accesses the data stored in the memory device, a first protocol authentication is required; only after the first protocol authentication is passed, the memory controller can access the data stored in the memory device. For another example, during the period when the memory controller performs an access operation on the memory device, in order to prevent non-authorized users from changing the current permitted access status of the memory device, another security protection is set. That is, when the memory controller wants to change the current permitted access status of the memory device, a second protocol authentication is required; only after the second protocol authentication is passed, the memory controller can change the current permitted access status of the memory device. In the disclosed embodiment, according to the different needs of the memory device, various other security protections can be set, and various protocol authentications can be performed accordingly, which will not be described one by one here.

[0073] Combine the following Figure 7 , Figure 8a , Figure 8b , Fig. 9 , Fig.10 , Fig.11a , Fig.11b , Fig.12 After two types of security protection are set in the embodiment of the present disclosure, the corresponding protocol authentication process performed between the memory device and the memory controller is described in detail.

[0074] The present disclosure also provides a method for operating a memory system; Figure 7 , Figure 7 A schematic diagram of a process implementation of an operating method of a memory system provided by an embodiment of the present disclosure; Figure 7 As shown, step S701, the memory system is powered on or reset (Power on & POR). Step S702, it is determined whether the memory device is set with access protection. Exemplarily, it is determined whether the memory controller can directly access the data stored in the memory device; wherein, when the memory controller cannot directly access the data in the memory device, it indicates that the memory device has been set with access protection; when the memory controller can directly access the data in the memory device, it indicates that the memory device has not been set with access protection. Here, access protection may include, for example, write protection, read protection, etc. In other words, the judgment result may include that the memory device has been set with access protection and that the memory device has not been set with access protection.

[0075] Next, according to the judgment result, when it is determined that the memory device has no access protection (N), step S705 is directly executed, that is, the memory controller performs an access operation (normal operation) on the memory device. The access operation includes operations such as reading data in the memory device and writing data to the memory device.

[0076] On the other hand, according to the judgment result, when it is determined that the memory device has been set for access protection (i.e., step S703) (Y), step S704 is executed, that is, the memory controller performs a first protocol authentication on the memory device. The first protocol authentication can be an identity authentication of the memory controller, such as a handshake protocol set between the memory controller and the memory device to confirm whether the current user is an authorized user. The results of the first protocol authentication include the first protocol authentication passing and the first protocol authentication failing. Among them, if the first protocol authentication passes, it indicates that the current user is an authorized user and can use the memory controller to access the data stored in the memory device. If the first protocol authentication fails, it indicates that the current user is a non-authorized user and cannot use the memory controller to access the data stored in the memory device. Reference Figure 7 When the first protocol authentication passes (Y), step S705 is executed, that is, the current user can use the memory controller to perform access operations on the memory device; when the first protocol authentication fails (N), step S706 is executed, and the access operation is terminated, that is, the current user cannot use the memory controller to perform access operations on the memory device.

[0077] Combine the following Figure 8a , Figure 8b , Fig. 9 , Fig.10 The specific process of the first protocol authentication is described in detail. Figure 8a A schematic diagram of multiple instruction interactions in a first authentication protocol provided in an embodiment of the present disclosure; Figure 8b A signal timing diagram of multiple instructions in a first authentication protocol provided by an embodiment of the present disclosure; Fig.10 A schematic diagram of the instruction interaction for obtaining the first authentication protocol result provided by an embodiment of the present disclosure.

[0078] In the embodiment of the present disclosure, when it is determined that the memory device has been set with access protection, the memory controller sends a first command set to the memory device; and performs a first protocol authentication using the first command set.

[0079] Here, the first command set includes a first instruction, a second instruction and a third instruction; wherein, according to the first instruction, the first data of the memory device is obtained; the first data is used to characterize the identity characteristics of the memory device; according to the second instruction, the second data of the memory device is obtained; the second data is a random number; according to the third instruction, the first ciphertext is compared with the second ciphertext in the memory device; wherein the third instruction includes third data and the first ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the first ciphertext is obtained by performing a first encryption operation on the first data, the second data and the third data; the second ciphertext is obtained by performing a second encryption operation on the first data, the second data and the third data.

[0080] Exemplary, reference Figure 8a , Figure 8b , Fig.10 ,from Figure 8b It can be seen that Figure 8b Three instructions are shown in <cmd:90-00h> 、 <cmd:bdh> 、 <cmd:aah>Each of the three instructions includes a cycle type (Cycle Type), transmission data (DQ[7:0]), and an R / B_n signal; in addition, different instructions also show status information (SR, StatusRegister), and waiting time tWHR, etc.

[0081] Among them, reference Figure 8a , Figure 8b , Fig.10 When it is determined that the memory device 603 (NAND) has been set for access protection, step S1 is executed: the memory controller 602 (CTRL) sends a first instruction to the memory device 603 (NAND), and the first instruction instructs to obtain first data for characterizing the identity characteristics of the memory device. Here, reference Figure 8b , the first instruction is a read command, such as <cmd:90-00h>, Figure 8b It is shown in <cmd:90-00h>Signal timing diagram.

[0082] The memory device 603 receives the first instruction; in response to the first instruction, generates first data and executes step S2: the memory device 603 sends the first data to the memory controller 602. Figure 8a , the first data is, for example, flash_id[31:0]; it should be understood that the first data is stored in the first storage unit of the memory device 603 .

[0083] Next, step S3 is executed: the memory controller 602 sends a second instruction to the memory device 603, the second instruction instructing to obtain the second data. Here, reference is made to Figure 8b , the second instruction proposes a new protocol command for the embodiment of the present disclosure, such as <cmd:bdh>, Figure 8b It is shown in <cmd:bdh>Signal timing diagram.

[0084] The memory device 603 receives the second instruction; in response to the second instruction, generates second data and executes step S4: the memory device 603 sends the second data to the memory controller 602; here, the second data can be a random number, such as Random_DATA[31:0]. It should be understood that the second data is stored in the second storage unit of the memory device 603. It should be noted that the first storage unit is different from the second storage unit, and the first storage unit and the second storage unit are any storage units in the memory device.

[0085] To facilitate understanding of the generation of the second data, an embodiment of the present disclosure shows a process for generating the second data, which specifically includes: the memory device applies a first read voltage and a second read voltage to a selected storage page among a plurality of storage pages in response to a second instruction, respectively, to obtain first read data and second read data; performs a logical operation on the first read data and the second read data to obtain third read data; the first read voltage is different from the second read voltage; error data is collected on the third read data; and the second data is generated based on the collected error data.

[0086] Combine the following Fig. 9 The process of generating the second data (ie, the random number Random_DATA[31:0]) is explained. Fig. 9 As shown, Fig. 9 A flow chart of generating second data is provided for an embodiment of the present disclosure, wherein the memory device includes a plurality of memory pages.

[0087] Exemplary, reference Fig. 9 In response to the second instruction, the memory device applies a first read voltage to the selected storage page to obtain first read data, and stores the first read data in a first latch; then applies a second read voltage different from the first read voltage to the selected storage page to obtain second read data, and stores the second read data in a second latch; then, performs an exclusive OR operation (the symbol of the exclusive OR operation is XOR) on the first read data and the second read data to obtain third read data, and stores the third read data in a third latch.

[0088] It should be noted that the first read voltage and the second read voltage are not the optimal read voltages for the selected storage page. Here, the optimal read voltage is the read voltage corresponding to the minimum failure bit rate count result after reading the selected storage page. In this way, error data appears in both the first read data and the second read data; that is, error data also exists in the third read data. In this case, the error data in the third read data is collected (VFC); and a group of 32-bit random numbers, such as Random_DATA[31:0], is generated based on the collected error data. In other words, the group of 32-bit random numbers obtained here is the second data. In the process of executing step S4, the second data sent by the memory device 603 to the memory controller 602 is this group of 32-bit random numbers Random_DATA[31:0]. It should be noted that after the error data is collected, multiple groups of random numbers can be generated, and the number of bits of each group of random numbers can also be selected and set according to actual needs, such as 8 bits, 16 bits, 64 bits, etc.; here, the second data can be arbitrarily selected from multiple groups of random numbers, and the present disclosure is not limited.

[0089] refer to Figure 8a , Fig.10 After receiving the second data, the memory controller 602 uses the third data representing the identity characteristics of the memory controller, such as Chip-id[31:0], the first data flash_id[31:0], and the second data Random_DATA[31:0], in combination with the first encryption algorithm to perform a first encryption operation to obtain a first ciphertext, such as MAC1[31:0]. It should be noted that the third data is data in the memory controller used to represent the identity characteristics of the memory controller.

[0090] Next, step S5 is performed: the memory controller 602 sends a third instruction to the memory device 603, where the third instruction includes third data Chip_id[31:0] and first ciphertext MAC1[31:0]. Figure 8b , the third instruction proposes another new protocol command for the embodiment of the present disclosure, such as <cmd:aah>, Figure 8b It is shown in <cmd:aah>The third instruction instructs to compare the first ciphertext with the second ciphertext in the memory device.

[0091] It should be noted that the second ciphertext is obtained by the memory device 603 by performing a second encryption operation on the first data, the second data and the received third data. Specifically, the memory device 603 receives a third instruction; the third instruction includes the third data Chip_id[31:0] and the first ciphertext MAC1[31:0]. In other words, after the memory device 603 receives the third data Chip_id[31:0], the third data Chip_id[31:0], the first data flash_id[31:0], the second data Random_DATA[31:0], and the second encryption algorithm are used to perform a second encryption operation to obtain a second ciphertext, such as MAC2[31:0].

[0092] In response to the third instruction, the first ciphertext MAC1[31:0] is compared with the second ciphertext MAC2[31:0], wherein the comparison result includes that the first ciphertext MAC1[31:0] is the same as the second ciphertext MAC2[31:0], and the first ciphertext MAC1[31:0] is different from the second ciphertext MAC2[31:0].

[0093] In some embodiments, the operation method further includes: sending a fourth instruction to the memory device; the fourth instruction instructs to obtain a comparison result of the first ciphertext and the second ciphertext; when the comparison result shows that the first ciphertext and the second ciphertext are the same, the first protocol authentication is passed. Fig.10 , execute step S6, the memory controller 602 sends a fourth instruction to the memory device 603, the fourth instruction is a read command, such as <cmd:70h>And executing step S7, the memory device 603 sends the comparison result of the first ciphertext and the second ciphertext to the memory controller 602.

[0094] When the comparison result shows that the first ciphertext MAC1[31:0] is the same as the second ciphertext MAC2[31:0], it indicates that the first encryption algorithm is the same as the second encryption algorithm, that is, the first protocol authentication is passed, that is, the current memory device matches the current memory controller, that is, the current user can use the current memory controller to perform data read, write and other access operations on the current memory device. When the first ciphertext MAC1[31:0] is not the same as the second ciphertext MAC2[31:0], it indicates that the first encryption algorithm is not the same as the second encryption algorithm, that is, the first protocol authentication fails, that is, the current user cannot use the current memory controller to perform data read, write and other access operations on the current memory device. In other words, only when it is determined that the user operates the memory controller can the access operation be performed on the memory device, thereby improving the security of the data in the memory device.

[0095] In some embodiments, the operation method further includes: after the first protocol authentication is passed, performing at least one second protocol authentication; each time the second protocol authentication is passed, changing the current access permission status of the memory device; the access permission status includes allowing access operations to be performed and not allowing access operations to be performed.

[0096] It should be noted that the second protocol authentication may be performed once or multiple times, and each time the second protocol authentication is performed, the current access permission status of the memory device is changed. Exemplarily, if the memory device is currently in a state where access operations are allowed, after the second protocol authentication is performed and passed, the current access permission of the memory device can be changed to access disallowed. Exemplarily, if the memory device is currently in a state where access operations are not allowed, after the second protocol authentication is performed and passed, the current access disallowed of the memory device can be changed to access allowed.

[0097] Combine the following Fig.11a , Fig.11b , Fig.12 , Fig. 9 The specific process of the second protocol authentication is described in detail. Fig.11a A schematic diagram of multiple instruction interactions in a second authentication protocol provided in an embodiment of the present disclosure; Fig.11b A signal timing diagram of multiple instructions in a second authentication protocol provided by an embodiment of the present disclosure; Fig.12 A schematic diagram of the instruction interaction for obtaining the second authentication protocol result provided in one embodiment of the present disclosure.

[0098] In the embodiment of the present disclosure, on the basis of passing the first protocol authentication, the memory controller 602 sends a second command set to the memory device 603; and performs a second protocol authentication using the second command set.

[0099] Here, the second command set includes a first instruction, a second instruction, and a fifth instruction; wherein, according to the first instruction, the first data of the memory device is obtained; the first data is used to characterize the identity characteristics of the memory device; according to the second instruction, the second data of the memory device is obtained; the second data is a set of random numbers in the memory device; according to the fifth instruction, the third ciphertext is used to compare with the fourth ciphertext in the memory device; wherein the fifth instruction includes third data, fourth data, and third ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the fourth data is a set of random numbers determined by the memory controller according to its own attribute information, which can be the same or different from the random number shown in the second data; illustratively, in this embodiment, the second data is different from the fourth data; in addition, the acquisition method of the fourth data can be the same or different from the acquisition method of the second data. Here, the third ciphertext is obtained by the memory controller through the third encryption operation on the first data, the second data, the third data, and the fourth data; the fourth ciphertext is obtained by the memory device through the fourth encryption operation on the first data, the second data, the third data, and the fourth data.

[0100] Exemplary, reference Fig.11a , Fig.11b , Fig.12 ,from Fig.11b It can be seen that multiple instructions include cycle type (Cycle Type), transmission data (DQ[7:0]), and R / B_n signal; in addition, different instructions also show: status information SR, and waiting time tWHR, etc.

[0101] refer to Fig.11a , Fig.12 , based on the first protocol authentication being passed, step T1 is executed: the memory controller 602 (CTRL) sends a first instruction to the memory device 603 (NAND), the first instruction instructing to obtain first data for characterizing the identity characteristics of the memory device. Here, reference Fig.11b , the first instruction is a read command, such as <cmd:90-00h>, Fig.11b It is shown in <cmd:90-00h>Signal timing diagram.

[0102] The memory device 603 receives the first instruction; in response to the first instruction, generates first data and executes step T2: the memory device 603 sends the first data to the memory controller 602. Fig.11a , the first data is flash_id[31:0]; it should be understood that the first data is stored in the first storage unit of the memory device 603.

[0103] Next, step T3 is executed: the memory controller 602 sends a second instruction to the memory device 603, the second instruction instructing to obtain the second data. Here, reference is made to Fig.11b , the second instruction proposes a new protocol command for the embodiment of the present disclosure, such as <cmd:bdh>, Fig.11b It is shown in <cmd:bdh>Signal timing diagram.

[0104] The memory device 603 receives the second instruction; in response to the second instruction, executes step T4: the memory device 603 sends the second data to the memory controller 602; here, the second data can be a random number. It should be understood that the second data is stored in the second storage unit of the memory device 603. It should be noted that the steps S1, S2, S3, and S4 mentioned above may be the same as or different from the steps T1, T2, T3, and T4, and the embodiments of the present disclosure only describe the same situation.

[0105] refer to Fig. 9 In response to the second instruction, the memory device applies a first read voltage to the selected storage page to obtain first read data, where the first read data is stored in the first latch; then applies a second read voltage different from the first read voltage to the selected storage page to obtain second read data, where the second read data is stored in the second latch; then, performs an XOR operation (the symbol of the XOR operation is XOR) on the first read data and the second read data to obtain third read data, and stores the third read data in the third latch. The error data in the third read data is collected (VFC); and a set of 32-bit random numbers, such as Random_DATA[31:0], are generated based on the collected error data. In other words, the 32-bit random number obtained here is the second data. In the process of executing step S4, the memory device 603 sends this set of 32-bit random numbers Random_DATA[31:0] to the memory controller 602.

[0106] After receiving the second data, the memory controller 602 uses the third data representing the identity characteristics of the memory controller, such as Chip_id[31:0], and the fourth data, and the first data flash_id[31:0], the second data Random_DATA[31:0], and the first encryption algorithm to perform a first encryption operation to obtain a third ciphertext, such as MAC3[31:0]. The fourth data is a set of random numbers determined according to the attribute information of the memory controller itself, such as Rand[31:0].

[0107] Next, step T5 is executed: the memory controller 602 sends a fifth instruction to the memory device 603, where the fifth instruction includes the third data Chip_id[31:0], the fourth data Rand[31:0] and the third ciphertext MAC3[31:0]. Fig.11b , the fifth instruction proposes another new protocol command for the embodiment of the present disclosure, such as <cmd:a9h>, Fig.11b It is shown in <cmd:a9h>The fifth instruction instructs to compare the third ciphertext with the fourth ciphertext in the memory device.

[0108] It should be noted that the fourth ciphertext is obtained by the memory device 603 by performing a fourth encryption operation on the first data, the second data, and the received third data and the fourth data. Specifically, the memory device 603 receives a fifth instruction; the fifth instruction includes the third data Chip_id[31:0] and the fourth data Rand[31:0]. In other words, after the memory device 603 receives the third data Chip_id[31:0] and the fourth data Rand[31:0], the third data Chip_id[31:0], the fourth data Rand[31:0], the first data flash_id[31:0], the second data Random_DATA[31:0], and the fourth encryption algorithm are used to perform a fourth encryption operation to obtain a fourth ciphertext, for example, MAC4[31:0].

[0109] In response to the fifth instruction, the third ciphertext MAC3[31:0] is compared with the fourth ciphertext MAC4[31:0], wherein the comparison result includes that the third ciphertext MAC3[31:0] is the same as the fourth ciphertext MAC4[31:0], and the third ciphertext MAC3[31:0] is different from the fourth ciphertext MAC4[31:0].

[0110] In some embodiments, the operation method further includes: sending a sixth instruction to the memory device; the sixth instruction instructs to obtain a comparison result of the third ciphertext and the fourth ciphertext; when the comparison result shows that the third ciphertext and the fourth ciphertext are the same, the second protocol authentication is passed. Fig.12 , execute step T6, the memory controller 602 sends a sixth instruction to the memory device 603, the sixth instruction is a read command, such as <cmd:70h>And executing step T7, the memory device 603 sends the comparison result of the third ciphertext and the fourth ciphertext to the memory controller 602.

[0111] When the comparison result shows that the third ciphertext MAC3[31:0] is the same as the fourth ciphertext MAC4[31:0], it indicates that the third encryption algorithm is the same as the fourth encryption algorithm, that is, the second protocol authentication is passed, that is, the current user can change the current access permission status of the memory device. When the third ciphertext MAC3[31:0] is different from the fourth ciphertext MAC4[31:0], it indicates that the third encryption algorithm is different from the fourth encryption algorithm, that is, the second protocol authentication fails, that is, the current user cannot change the current access permission status of the memory device. In this way, the identified user can flexibly change the access status of the memory device, further improving the security of the data.

[0112] It should be noted that in the embodiment of the present disclosure, in the second instruction such as <cmd:bdh>, the third instruction is as follows <cmd:aah>, the fifth instruction is as follows <cmd:a9h>During the transmission process of , the original instruction interaction channel between the memory device and the memory controller can be used. For example, the first instruction is <cmd:90-00h>The command channels used in this way do not need to add additional command channels, thereby avoiding increasing manufacturing costs.

[0113] In the disclosed embodiment, during the use of the memory system, security protection is set for the memory device so that the memory controller needs to perform a first protocol authentication before accessing the memory device, and can only access the memory device after the first protocol authentication is passed; in this way, the security of the memory device can be improved. In addition, on the basis of passing the first protocol authentication, the memory device is authenticated by a second protocol, and the current access permission of the memory device can be changed after the second protocol authentication is passed. In this way, the recognized user can flexibly change the access status of the data in the memory device, further improving the security of the data.

[0114] Based on the operating method of the above-mentioned memory system, an embodiment of the present disclosure also provides a memory system, wherein the memory system includes: a memory device; a memory controller, coupled to the memory device and configured to: perform a first protocol authentication when it is determined that access protection has been set for the memory device; and perform an access operation on the memory device after the first protocol authentication passes.

[0115] In some embodiments, the memory controller is also configured to: send a first command set to the memory device; use the first command set to perform the first protocol authentication; wherein the first command set includes a first instruction, a second instruction and a third instruction; the first instruction instructs to obtain the first data of the memory device; the first data is used to characterize the identity characteristics of the memory device; the second instruction instructs to obtain the second data of the memory device; the second data is a random number; the third instruction instructs to compare the first ciphertext with the second ciphertext in the memory device; wherein the third instruction includes third data and the first ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the first ciphertext is obtained by performing a first encryption operation on the first data, the second data and the third data; the second ciphertext is obtained by performing a second encryption operation on the first data, the second data and the third data.

[0116] In some embodiments, the memory controller is further configured to: send a fourth instruction to the memory device; the fourth instruction instructs obtaining a comparison result of the first ciphertext and the second ciphertext; wherein, when the comparison result shows that the first ciphertext is the same as the second ciphertext, the first protocol authentication is passed.

[0117] In some embodiments, the memory controller is further configured to: perform at least one second protocol authentication after the first protocol authentication is passed; change the current access permission status of the memory device each time the second protocol authentication is passed; the access permission status includes allowing access operations to be performed and not allowing access operations to be performed.

[0118] In some embodiments, the memory controller is also configured to: send a second command set to the memory device; use the second command set to perform the second protocol authentication; wherein the second command set includes a first instruction, a second instruction and a fifth instruction; the first instruction instructs to obtain the first data of the memory device; the first data is used to characterize the identity characteristics of the memory device; the second instruction instructs to obtain the second data of the memory device; the second data is a random number; the fifth instruction instructs to use a third ciphertext to compare with a fourth ciphertext in the memory device; wherein the fifth instruction includes third data, fourth data and the third ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the third ciphertext is obtained by performing a third encryption operation on the first data, the second data, the third data and the fourth data; the fourth ciphertext is obtained by performing a fourth encryption operation on the first data, the second data, the third data and the fourth data.

[0119] In some embodiments, the memory controller is further configured to: send a sixth instruction to the memory device; the sixth instruction instructs obtaining a comparison result of the third ciphertext and the fourth ciphertext; wherein, when the comparison result shows that the third ciphertext is the same as the fourth ciphertext, the second protocol authentication is passed.

[0120] An embodiment of the present disclosure also provides a memory system, comprising: a memory device and a memory controller coupled to the memory device; the memory controller is configured to: send a first command set when it is determined that access protection has been set for the memory device; the memory device is configured to: receive the first command set, and perform a first protocol authentication in response to the first command set; the memory controller is also configured to: perform an access operation on the memory device when the first protocol authentication is passed.

[0121] In some embodiments, the first command set includes a first instruction, a second instruction, and a third instruction; the memory device is configured to: receive the first instruction; in response to the first instruction, send first data to the memory controller; the first data is used to characterize the identity characteristics of the memory device; receive the second instruction; in response to the second instruction, send second data to the memory controller; the second data is a random number; receive the third instruction; in response to the third instruction, compare the received first ciphertext with the second ciphertext; the third instruction includes third data and the first ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the memory controller is also configured to: obtain the first ciphertext by performing a first encryption operation on the first data, the second data, and the third data; the memory controller is also configured to: obtain the second ciphertext by performing a second encryption operation on the first data, the second data, and the third data.

[0122] In some embodiments, the memory device is further configured to: receive a fourth instruction; in response to the fourth instruction, send a comparison result of the first ciphertext and the second ciphertext to the memory controller; wherein, when the comparison result shows that the first ciphertext and the second ciphertext are the same, the first protocol authentication is passed.

[0123] In some embodiments, the memory device is further configured to: receive a second command set; perform a second protocol authentication using the second command set; wherein the second command set includes a first instruction, a second instruction, and a fifth instruction; the memory device is configured to: receive the first instruction; in response to the first instruction, send first data to the memory controller; the first data is used to characterize the identity characteristics of the memory device; receive the second instruction; in response to the second instruction, send second data to the memory controller; receive the fifth instruction; in response to the fifth instruction, compare the received third ciphertext with the fourth ciphertext; wherein the fifth instruction includes third data, fourth data, and the third ciphertext; the memory controller is further configured to: obtain the third ciphertext by performing a third encryption operation on the first data, the second data, the third data, and the fourth data; the memory device is further configured to: obtain the fourth ciphertext by performing a fourth encryption operation on the first data, the second data, the third data, and the fourth data.

[0124] In some embodiments, the memory device is also configured to: receive a sixth instruction; in response to the sixth instruction, send a comparison result of the third ciphertext and the fourth ciphertext to the memory controller; wherein, when the comparison result shows that the third ciphertext is the same as the fourth ciphertext, the second protocol authentication is passed.

[0125] In some embodiments, the memory device includes multiple storage pages; the memory device is configured to: in response to the second instruction, apply a first read voltage and a second read voltage to a selected storage page among the multiple storage pages, respectively, to obtain first read data and second read data; perform a logical operation on the first read data and the second read data to obtain third read data; the first read voltage is different from the second read voltage; perform error data collection on the third read data; and generate the second data based on the collected error data.

[0126] It should be noted that in the above embodiments of the present disclosure, the instruction interaction between the memory controller and the memory device can be achieved by combining a transistor logic circuit (RTL circuit) with a firmware program, which will not be described in detail here.

[0127] The embodiments of the present disclosure further provide a storage medium having executable instructions stored thereon. When the executable instructions are executed by a memory controller, the steps of the operating method described in the above embodiments of the present disclosure can be implemented.

[0128] In some specific embodiments, the storage medium can be a magnetic random access memory (FRAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, a magnetic surface storage, an optical disk, or a compact disc read-only memory (CD-ROM); it can also be various devices including one or any combination of the above-mentioned memory devices.

[0129] In some embodiments, executable instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0130] As an example, executable instructions may, but need not, correspond to a file in a file system, may be stored as part of a file that stores other programs or data, such as in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or code portions).

[0131] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present disclosure. Therefore, "in one embodiment" or "in an embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in the various embodiments of the present disclosure, the size of the serial number of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present disclosure. The serial numbers of the embodiments of the present disclosure mentioned above are for description only and do not represent the advantages and disadvantages of the embodiments.

[0132] The methods disclosed in several method embodiments provided in the present disclosure can be arbitrarily combined without conflict to obtain new method embodiments.

[0133] The above is only a specific embodiment of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present disclosure, which should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims. < / cmd:aah> < / cmd:bdh> < / cmd:bdh> < / cmd:bdh> < / cmd:aah> < / cmd:aah> < / cmd:bdh> < / cmd:bdh> < / cmd:aah> < / cmd:bdh> < / cmd:90-00h>

Claims

1. A memory system, characterized in that: include: Memory device; A memory controller is coupled to the memory device and is configured to: When it is determined that the memory device has been set with access protection, performing a first protocol authentication; When the first protocol authentication is passed, an access operation is performed on the memory device.

2. The memory system according to claim 1, wherein: The memory controller is further configured to: Sending a first command set to the memory device; performing the first protocol authentication using the first command set; Wherein, the first command set includes a first instruction, a second instruction and a third instruction; The first instruction instructs to obtain first data of the memory device; the first data is used to characterize the identity characteristics of the memory device; The second instruction instructs to obtain second data of the memory device; the second data is a random number; The third instruction instructs to compare the first ciphertext with the second ciphertext in the memory device; Among them, the third instruction includes third data and the first ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the first ciphertext is obtained by performing a first encryption operation on the first data, the second data and the third data; the second ciphertext is obtained by performing a second encryption operation on the first data, the second data and the third data.

3. The memory system according to claim 2, wherein: The memory controller is further configured to: Sending a fourth instruction to the memory device; the fourth instruction instructs obtaining a comparison result between the first ciphertext and the second ciphertext; When the comparison result shows that the first ciphertext is the same as the second ciphertext, the first protocol authentication is passed.

4. The memory system according to claim 1, wherein: The memory controller is further configured to: After the first protocol authentication is passed, performing at least one second protocol authentication; Each time the second protocol authentication is passed, the current access permission status of the memory device is changed; the access permission status includes allowing the access operation to be executed and not allowing the access operation to be executed.

5. The memory system according to claim 4, characterized in that: The memory controller is further configured to: Sending a second command set to the memory device; performing the second protocol authentication using the second command set; Wherein, the second command set includes a first instruction, a second instruction and a fifth instruction; The first instruction instructs to obtain first data of the memory device; the first data is used to characterize the identity characteristics of the memory device; The second instruction instructs to obtain second data of the memory device; the second data is a random number; The fifth instruction instructs to compare the third ciphertext with the fourth ciphertext in the memory device; Among them, the fifth instruction includes third data, fourth data and the third ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the third ciphertext is obtained by performing a third encryption operation on the first data, the second data, the third data and the fourth data; the fourth ciphertext is obtained by performing a fourth encryption operation on the first data, the second data, the third data and the fourth data.

6. The memory system according to claim 5, characterized in that: The memory controller is further configured to: Sending a sixth instruction to the memory device; the sixth instruction instructs obtaining a comparison result between the third ciphertext and the fourth ciphertext; When the comparison result shows that the third ciphertext is the same as the fourth ciphertext, the second protocol authentication is passed.

7. A memory system, characterized in that: include: A memory device and a memory controller coupled to the memory device; The memory controller is configured to: send a first command set when determining that the memory device has been set with access protection; The memory device is configured to: receive the first command set, and perform a first protocol authentication in response to the first command set; The memory controller is further configured to: perform an access operation on the memory device after the first protocol authentication is passed.

8. The memory system according to claim 7, characterized in that: The first command set includes a first instruction, a second instruction and a third instruction; The memory device is configured to: receiving the first instruction; in response to the first instruction, sending first data to the memory controller; the first data is used to characterize the identity characteristics of the memory device; receiving the second instruction; in response to the second instruction, sending second data to the memory controller; the second data is a random number; receiving the third instruction; In response to the third instruction, the received first ciphertext is compared with the second ciphertext; the third instruction includes third data and the first ciphertext; the third data is used to characterize the identity characteristics of the memory controller; The memory controller is further configured to: obtain the first ciphertext by performing a first encryption operation on the first data, the second data and the third data; The memory controller is further configured to obtain the second ciphertext by performing a second encryption operation on the first data, the second data and the third data.

9. The memory system according to claim 8, characterized in that: The memory device is further configured to: receiving a fourth instruction; and in response to the fourth instruction, sending a comparison result between the first ciphertext and the second ciphertext to the memory controller; When the comparison result shows that the first ciphertext is the same as the second ciphertext, the first protocol authentication is passed.

10. The memory system according to claim 7, characterized in that: The memory device is further configured to: receiving a second command set; and performing a second protocol authentication using the second command set; Wherein, the second command set includes a first instruction, a second instruction and a fifth instruction; The memory device is configured to: receiving the first instruction; in response to the first instruction, sending first data to the memory controller; the first data is used to characterize the identity characteristics of the memory device; receiving the second instruction; and sending second data to the memory controller in response to the second instruction; receiving the fifth instruction; and in response to the fifth instruction, comparing the received third ciphertext with the fourth ciphertext; wherein the fifth instruction includes the third data, the fourth data and the third ciphertext; The memory controller is further configured to: obtain the third ciphertext by performing a third encryption operation on the first data, the second data, the third data and the fourth data; The memory device is further configured to obtain the fourth ciphertext by performing a fourth encryption operation on the first data, the second data, the third data and the fourth data.

11. The memory system according to claim 10, characterized in that: The memory device is further configured to: receiving a sixth instruction; and in response to the sixth instruction, sending a comparison result of the third ciphertext and the fourth ciphertext to the memory controller; When the comparison result shows that the third ciphertext is the same as the fourth ciphertext, the second protocol authentication is passed.

12. The memory system according to claim 8 or 10, characterized in that: The memory device includes a plurality of memory pages; The memory device is configured to: In response to the second instruction, applying a first read voltage and a second read voltage to a selected storage page among the plurality of storage pages, respectively, to obtain first read data and second read data; performing a logic operation on the first read data and the second read data to obtain third read data; the first read voltage is different from the second read voltage; performing error data collection on the third read data; And generating the second data according to the collected error data.

13. A method for operating a memory system, characterized in that: The operation method comprises: When it is determined that the memory device has been set with access protection, performing a first protocol authentication; When the first protocol authentication is passed, an access operation is performed on the memory device.

14. The operating method according to claim 13, characterized in that: The performing of the first protocol authentication includes: Sending a first command set to the memory device; performing the first protocol authentication using the first command set; Wherein, the first command set includes a first instruction, a second instruction and a third instruction; The operation method specifically includes: Acquire first data of the memory device according to the first instruction; the first data is used to characterize the identity characteristics of the memory device; Acquire second data of the memory device according to the second instruction; the second data is a random number; Comparing the first ciphertext with the second ciphertext in the memory device according to the third instruction; Among them, the third instruction includes third data and the first ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the first ciphertext is obtained by performing a first encryption operation on the first data, the second data and the third data; the second ciphertext is obtained by performing a second encryption operation on the first data, the second data and the third data.

15. The operating method according to claim 14, characterized in that: The operation method also includes: Sending a fourth instruction to the memory device; the fourth instruction instructs obtaining a comparison result between the first ciphertext and the second ciphertext; When the comparison result shows that the first ciphertext is the same as the second ciphertext, the first protocol authentication is passed.

16. The operating method according to claim 13, characterized in that: The operation method also includes: After the first protocol authentication is passed, performing at least one second protocol authentication; Each time the second protocol authentication is passed, the current access permission status of the memory device is changed; the access permission status includes allowing the access operation to be executed and not allowing the access operation to be executed.

17. The operating method according to claim 16, characterized in that: The performing at least one second protocol authentication comprises: Sending a second command set to the memory device; performing the second protocol authentication using the second command set; Wherein, the second command set includes a first instruction, a second instruction and a fifth instruction; The operation method specifically includes: Acquire first data of the memory device according to the first instruction; the first data is used to characterize the identity characteristics of the memory device; Acquire second data of the memory device according to the second instruction; comparing the third ciphertext with the fourth ciphertext in the memory device according to the fifth instruction; Among them, the fifth instruction includes third data, fourth data and the third ciphertext; the third data is used to characterize the identity characteristics of the memory controller; the third ciphertext is obtained by performing a third encryption operation on the first data, the second data, the third data and the fourth data; the fourth ciphertext is obtained by performing a fourth encryption operation on the first data, the second data, the third data and the fourth data.

18. The operating method according to claim 17, characterized in that: The operation method also includes: Sending a sixth instruction to the memory device; the sixth instruction instructs obtaining a comparison result between the third ciphertext and the fourth ciphertext; When the comparison result shows that the third ciphertext is the same as the fourth ciphertext, the second protocol authentication is passed.

19. The operating method according to claim 13, characterized in that: The operation method also includes: When it is determined that the memory device is not set with the access protection, the access operation is directly performed on the memory device.

20. A storage medium, characterized in that: The storage medium stores executable instructions, and when the executable instructions are executed by the memory controller, the steps of the operating method as described in any one of claims 13 to 19 can be implemented.

Images