Random Accessing

Abstract

A random number generator selects an address, while a "scoreboard" bank of registers (or bits) keeps track of which addresses have already been output (e.g., to store or retrieve a piece of data). If the scoreboard detects that an address has already been output, it outputs a second address that has not yet been used, rather than the randomly selected one. The second address may be selected from nearby addresses that have not yet been output.

Description

[Brief description of the drawings]

[0001] [Figure 1] FIG. 2 is a block diagram showing address generation logic. [Diagram 2] FIG. 2 is a block diagram showing a fixed-time address generation block. [Figure 3A-3B] 1 illustrates an exemplary fixed-time address generation logic. [Figure 4] 1 illustrates a system that accesses data in a randomized order. [Diagram 5] 1 is a flowchart illustrating a method for generating an address. [Figure 6] 1 is a flowchart illustrating a method for selecting an address. [Figure 7] FIG. 1 is a block diagram of a processing system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0002] Certain secret or sensitive data (e.g., an encryption key, or a portion of an encryption key) may be stored on a chip in the non-volatile memory ("NVM") of that chip. Typically, this data is stored in a linear order, such that a first portion of the secret data (e.g., a word, byte, nibble, etc.) is stored in a first memory location, a second portion is stored in a second memory location, and so on. And when the data is accessed, it is typically also accessed in a linear order (i.e., the first memory location is read, then the second memory location is read, etc.). This traditional linear access approach allows an attacker to recover the secret data by invasively monitoring the data signals between the security core requesting the data and the NVM circuitry. In such an attack, the attacker does not need to monitor the address lines, but can instead infer the address that corresponds to the recovered data. Because the number of data lines is often significantly less than the number of address lines (e.g., an NVM circuit uses 16 address lines, but the output bus is only 4 bits), allowing the attacker to recover the secret data by simply monitoring the data lines greatly simplifies the attacker's task during an intrusion attack.

[0003] In one embodiment, a random number generator is used during the generation of the access pattern of addresses, while a "scoreboard" bank of registers (or bits) keeps track of which addresses have already been used (e.g., to store or retrieve portions of data). When the scoreboard detects that an address is already in use, a second address that has not yet been used is used instead of the randomly selected one. The second address may be selected from nearby addresses that have not yet been output. In this way, an attacker monitoring the data lines while the security core is accessing a block of secret data will not be able to correctly piece together the entire secret data because the portions are being accessed in a random order. At the same time, the scoreboard approach ensures that the security core can retrieve the block of secret data in the minimum amount of time necessary.

[0004] Figure 1 is a block diagram illustrating address generation logic. In Figure 1, address generation system 100 includes a candidate address generator 110, a repeat address detector 120, and an output address selector 130. Candidate address generator 110 is operably coupled to output address selector 130 and repeat address detector 120. Repeat address detector 120 is operably coupled to output address selector 130. Output address selector 130 provides an address that is output by address generation system 100.

[0005] In one embodiment, the candidate address generator 110 provides candidate addresses to the repeat address detector 120 and the output address selector 130. The repeat address detector 120 determines whether a given candidate address has already been provided by the address generation system 100 (e.g., provided to an arbiter circuit responsible for reading data from the NVM circuit). The repeat address detector 120 may determine whether a given candidate address has already been output by the address generation system 100 before the entire set (or range) of addresses is output, to prevent the repeat address from being output until the entire set (or range) of addresses has been output. In this way, the entire set (or range) of addresses is output in a known (i.e., fixed) number of transactions / cycles, etc.

[0006] For example, to retrieve / store a burst of data consisting of 64 bytes (or words, or nibbles, etc.), address generation system 100 may be configured to output addresses in the range of 0 to 63. Repeat addresses from this range are not output until the entire range (i.e., burst / block) has been output, so address generation system 100 outputs 64 addresses before allowing a repeat address to be output. In other words, address generation system 100 outputs each of the 64 addresses exactly once during the retrieval / storage of a given 64-byte data block.

[0007] In one embodiment, the candidate address generator 110 outputs a candidate address based on a randomly or pseudo-randomly generated number (hereinafter collectively referred to as random, randomized, or randomly selected number). The repeat address detector 120 determines whether each candidate address randomly selected from a set or range of addresses has already been output during the search / storage of the current block. If it is determined that the given candidate address has not yet been output during the current burst, the output address selector 130 selects a candidate address provided by the candidate address generator 110 to be output by the address generation system 100. If it is determined that the given candidate address has already been output during the current burst, the output address selector 130 selects an address that has not yet been output during the current burst based on information from the repeat address detector 120.

[0008] In one embodiment, if it is determined that a given candidate address has already been output during the current burst, output address selector 130 may select the next lowest valued (compared to the candidate) address that has not yet been output during the current burst. If there is no low valued address that has not yet been output, output address selector 130 may select the next highest valued (compared to the candidate) address that has not yet been output during the current burst. Similarly, in another embodiment, if it is determined that a given candidate address has already been output during the current burst, output address selector 130 may select the next highest valued (compared to the candidate) address that has not yet been output during the current burst. If there is no high valued address that has not yet been output, output address selector 130 may select the next lowest valued (compared to the candidate) address that has not yet been output during the current burst.

[0009] In another embodiment, if it is determined that a given candidate address has already been output during the current burst output, output address selector 130 may select whether to select the next lower or higher value address not yet output during the current burst based on a random number. If the next higher value address is selected based on a random number and there is no higher value address not yet output, output address selector 130 may select the next lower value address (as compared to the candidate) not yet output during the current burst. Similarly, if the next lower value address is selected based on a random number and there is no lower value address not yet output, output address selector 130 may select the next higher value address (as compared to the candidate) not yet output during the current burst.

[0010] 2 is a block diagram illustrating a fixed-time address generation block. In FIG. 2, address generation system 200 includes a random number generator 211, an address selector 231, and used address tracking 221. Random number generator 211 is operably coupled to address selector 231. Random number generator 211 is operably coupled to address selector 231 to provide at least a random number that selector 231 uses, at least in part, to select at least one address to be output by address generation system 200.

[0011] Address tracking 221 is operatively coupled to selector 231. Address tracking 221 is operatively coupled to selector 231 to provide information to selector 231 regarding which addresses have or have not been output from a set (or range) of addresses. In a given output cycle, selector 231 provides an address to be output by address generation system 200 based on at least the random number provided by random number generator 211 and information from address tracking 221. Addresses output by address generation system 200 are fed back to address tracking 221 as indicated as used.

[0012] In one embodiment, random number generator 211 provides a random number to selector 231. The random number may include a candidate address. The random number may include an index to the candidate address (e.g., an index into a table of addresses not yet used). Selector 231 determines whether a candidate address has already been output by address generation system 200 based at least in part on information from tracking 221. Selector 231 may determine whether a given candidate address has already been output to prevent a repeat address from being output until the entire set (or range) of addresses has been output. In this manner, the entire set (or range) of addresses is output in a known (i.e., fixed) number of transactions / cycles, etc.

[0013] For example, to retrieve / store a burst of data consisting of 64 bytes (or words, or nibbles, etc.), the random number generator 211 may be configured to output candidate addresses in the range of 0 to 63. Because the random number generator 211 outputs a substantially (or virtually) random sequence of candidate addresses, it is possible that the random number generator 211 may output one or more repeat addresses from the range before all numbers in the range have been output. When a repeat candidate address occurs, the selector 231 detects this occurrence using information from the address tracker 221. The selector 231 then prevents this reoccurring address from being output and selects (also based on information from tracker 221) to output a new address that has not yet been output. In this manner, the address generation system 200 outputs each of the 64 addresses exactly once during the retrieval / storage of a given 64-byte data block.

[0014] In one embodiment, the random number generator 211 outputs a sequence of randomly or pseudo-randomly generated numbers. Each number in the sequence may include a candidate address (e.g., a subset of the bits output by the random number generator 211 may be used as a candidate address, and the remainder may be used for other purposes by the selector 231). The selector 231 determines, with respect to information from the track 221, whether each randomly generated candidate address has already been output during the search / storage of the current block. If it is determined that the given candidate address has not yet been output during the current burst, the selector 231 selects the candidate address provided by the random number generator 211 to be output by the address generation system 200. If it is determined that the given candidate address has already been output during the current burst, the selector 231 selects, based at least on information from the track 221, an address that has not yet been output during the current burst.

[0015] In one embodiment, if it is determined that a given candidate address has already been output during the current burst, the selector 231 may select the next lowest valued (compared to the candidate) address that has not yet been output during the current burst based on information from the tracking 221. If there is no low valued address that has not yet been output, the selector 231 may select the next highest valued (compared to the candidate) address that has not yet been output during the current burst based on information from the tracking 221. Conversely, in another embodiment, if it is determined that a given candidate address has already been output during the current burst, the selector 231 may select the next highest valued (compared to the candidate) address that has not yet been output during the current burst based on information from the tracking 221. If there is no high valued address that has not yet been output, the selector 231 may select the next lowest valued (compared to the candidate) address that has not yet been output during the current burst based on information from the tracking 221.

[0016] In another embodiment, if it is determined that a given candidate address has already been output during the current burst, the selector 231 may select whether to select the next lower or higher valued address that has not yet been output during the current burst based on information from the tracking 221 and the random number (e.g., one or more bits of the random number received from the random number generator 211 that were not used as a candidate address). When the next higher valued address is selected based on the random number and there is no higher valued address that has not yet been output, the selector 231 may select the next lower valued address (as compared to the candidate) that has not yet been output during the current burst based on information from the tracking 221. Similarly, when the next lower valued address is selected based on the random number and there is no lower valued address that has not yet been output, the selector 231 may select the next higher valued address (as compared to the candidate) that has not yet been output during the current burst based on information from the tracking 221.

[0017] 3A and 3B show exemplary fixed-time address generation logic. FIG. 3A shows an exemplary circuit for generating a next address. In FIG. 3A, next address generator 301 includes random number generator (RNG) 311, 64-bit address tracking register 321 (also known as "ATR" or "scoreboard"), address tracking control 322, 64:1 multiplexer (MUX) 331, 12:6 MUX 332, 12:6 MUX 333, 6-bit last address register 351, 2-input OR gate 352, 2-input AND gate 353, and INV gate 354. Note that in this embodiment, ATR 321 is shown as a "linear" register starting at address 0 and ending at address 63. In other embodiments, the ATR can be organized in a "circular" fashion such that incrementing addresses above 63 are address 0 and incrementing addresses below 0 are 63.

[0018] In one embodiment, the address generator 301 selects the next address to be output. For example, the RNG 311 outputs a 7-bit value RN[6:0]. The lower 6 bits RN[5:0] are effectively tested as a "candidate address" by the MUX 331. If the bit of the access tracking register 321 associated with the candidate address is empty (e.g., the value is "0" in the position corresponding to the 6-bit RN[5:0] value), then that candidate address RN[5:0] is selected by the MUX 332 to be output as the next address. After the RN[5:0] is provided as an output, the ATR control 322 updates the corresponding position in the ATR 321 (e.g., from 0 to 1). In addition, the value of the last address register 351 is also updated. This value is used by the repeat address resolver 302 described herein with reference to FIG. 3B. It should be noted that the ATR control 322 initially resets the contents of the ATR 321 (e.g., to contain all "0"s in all positions) at the beginning of a search / store transaction.

[0019] When the bit of access tracking register 321 corresponding to RN[5:0] indicates a logic value of "1" (meaning the value of RN[5:0] has already been used / output), MUX 332 selects a different address. Based at least in part on RN[7], MUX 333 selects either the "next up" address NA[5:0] (i.e., the next empty address location having an address value greater than the last used register value LAD[5:0]) or the "next down" address NB[5:0] (i.e., the next empty address location having an address value less than the last used register value).

[0020] When ATR 321 indicates that there are no unused values ​​above (i.e., the "nothing left above" signal NLA is at logic "1") or below (i.e., the "nothing left below" signal NLB is at logic "1"), the logic function formed by OR gate 352, AND gate 353, and inverter 354 selects the next value below or the next value above, respectively. In other words, when random bit RN[7] indicates that the "next above" address NA[5:0] should be used, but there is no "next above" address left unused, address generator 301 outputs the "next below" address NB[5:0]. When random bit RN[7] indicates that the "next below" address NB[5:0] should be used, but there is no "next below" address left unused, address generator 301 outputs the "next above" address NB[5:0].

[0021] 3B shows an exemplary circuit that provides at least one unused address and an address that has already been output when the random number indicates. In FIG. 3B, the repeat address resolver 302 includes an address tracking register 321 (same element as FIG. 3A), a last address register 351 (same element as FIG. 3A), a 6-bit to 64-bit thermometer decoder 361, a 64 2-input NOR gate 362, a 64 2-input NOR gate 363, a 64-input AND gate 364, a 64-input NOR gate 365, a 64-input NOR gate 366, a least significant bit (LSB) to most significant bit (MSB) rotator 371, a 64-bit to 6-bit priority encoder 372, a subtractor 373, and a 64-bit to 6-bit priority encoder 372.

[0022] The last used address value LAD[5:0] is recoded by decoder 361 into a 64-bit thermometer code value. For example, if the LAD[5:0] value is "13", the resulting 64-bit output will have 51 leading zeros (from the MSB to bit 14) followed by 13 ones (from bit 13 to the LSB). When this 64-bit vector (and vice versa) is NORed with the 64-bit value contained within the bits of ATR 321, the resulting vector can be used to determine the "next up" NA[5:0] and "next down" NB[5:0] values.

[0023] The 64-bit thermometer-coded value output by decoder 361 is NORed with the corresponding bit value from access tracking register 321 by NOR gate 362. The order of the outputs of NOR gate 362 is sequentially reversed by LSB-to-MSB rotation 371. The output of LSB-to-MSB rotation 371 is input to priority encoder 372. The output of priority encoder 372 indicates the number of address steps from 63 that the "next up" address is (i.e., the maximum possible address value NA[5:0]=111111b). The output of priority encoder 372 is subtracted from 63 by subtractor 373 to generate the next up address NA[5:0]. If the outputs of all NOR gates 362 are zero, it indicates that there are no unused addresses above the last used value LAD[5:0]. To detect this, 64-input NOR gate 365 receives the output of NOR gate 362 and determines a "none left above" (NLA) signal. In some embodiments, NOR gate 365 may be implemented as several stages of gates, for example, a NOR gate, an OR gate, etc.

[0024] The inverted thermometer value output by the decoder 361 is NORed with the corresponding bit value from the access tracking register 321 by NOR gate 363. The output of NOR gate 363 is input to the priority encoder 372 to determine the "next down" address NB[5:0]. If all NOR gates 363 outputs are zero, it indicates that there are no unused addresses below the last used value LAD[5:0]. To detect this, a 64-input NOR gate 366 receives the output of NOR gate 363 and determines a "nothing left below" (NLB) signal. As shown in FIG. 3A, the "next up" NA[5:0], the "next down" NB[5:0], the "nothing left above" NLA, and the "nothing left below" value / signal are provided to the address generator 301. Finally, to detect completion (i.e., all address values ​​within the range have been output), AND gate 354 detects when all ATR values ​​are logic "1" and, as a result, asserts a "done" signal.

[0025] 4 illustrates a system for accessing data in a randomized order. In FIG. 4, the data access system 400 includes an address generator 435, a non-volatile memory arbiter / controller 480, a non-volatile memory 486, and a data requester 482. The address generator 435 includes an address tracking register 421, a random number generator 411, and an address selector 431. The address generator is operably coupled to the non-volatile memory arbiter 480. The data requester is operably coupled to the non-volatile memory arbiter 480. The non-volatile memory arbiter 480 is operably coupled to the non-volatile memory 486 via at least an address bus 492 and a read data bus 491. The address generator 435 may be or include the address generation system 100, the address generation system 200, and / or the address generation systems 301, 302.

[0026] In an exemplary operation, a data requester 482 (e.g., a security processor and / or security core, etc.) issues a request to the non-volatile memory arbiter 480 to deliver a block of secret data values ​​stored in the non-volatile memory 486. In this example, the secret data is distributed across 64 address locations (e.g., a 256-bit secret key value is stored as 64 nibbles of 4-bit data). The NVM arbiter 480 circuit uses the address generator 435 to provide 64 unique addresses in a randomly generated order. The NVM arbiter 480 transmits the unique addresses in a randomly generated order via address bus 492 to address NVM memory 486 to read the secret data. Data is transferred between NVM memory 486 and NVM arbiter 480 via read data bus 491. Thus, because the unique addresses are transmitted in a randomly generated order, an attacker wishing to learn the secret data must monitor the address bus 492 in addition to monitoring the data bus 491.

[0027] As described herein, address generator 435 uses both a random number generator 411 and a "scoreboard" address tracking register 421. In this example, ATR 421 holds 64 1-bit values ​​that correspond to addresses that have already been used / are yet to be used.

[0028] 5 is a flow chart illustrating a method for generating addresses. The steps illustrated in FIG. 5 may be performed by address generation system 100, address generation system 200, and / or address generation systems 301, 302, system 400, and / or one or more of their components. A first candidate address is selected from the set of access addresses based at least in part on the randomly generated number (502). For example, to retrieve / store a block of data consisting of 64 bytes (or words, or nibbles, etc.), random number generator 211 may be configured to output candidate addresses in the range of 0 to 63.

[0029] It is determined (504) whether the first candidate address has already been output as part of the access required to retrieve / store the current block. For example, based on information received from address tracking 221, selector 231 determines whether a randomly generated candidate address has already been output as part of the retrieve / store of the current block. If the first address has not previously been output as part of the retrieve / store of the current block, the first address is output (506). For example, if it is determined that the candidate address has not yet been output during the retrieve / store of the current block, selector 231 selects and outputs the candidate address provided by random number generator 211.

[0030] If the first address has already been output as part of the access required to retrieve / store the current block, then a second address not previously used during the retrieve / store of the current block is selected and the second address is output (508). For example, if it is determined that the candidate address has already been output during the retrieve / store of the current block, then selector 231 selects an address that has not yet been output during the retrieve / store of the current block based on at least information from tracker 221.

[0031] For example, when it is determined that a candidate address has already been output during the lookup / storage of the current block, selector 231 may select the next lowest valued address (compared to the candidate) that has already been output during the lookup / storage of the current block based on information from track 221. If there is no lower valued address that has not yet been output, selector 231 may select the next highest valued address (compared to the candidate) that has not yet been output during the lookup / storage of the current block based on information from track 221.

[0032] In another example, when it is determined that the candidate address has already been output during the lookup / storage of the current block, selector 231 may select the next highest valued address (compared to the candidate) that has not yet been output during the lookup / storage of the current block based on information from track 221. If there is no higher valued address that has not yet been output, selector 231 may select the next lowest valued address (compared to the candidate) that has not yet been output during the lookup / storage of the current block based on information from track 221.

[0033] In another example, when it is determined that a candidate address has already been output during the retrieval / storage of the current block, the selector 231 may select whether to select the next lower or next higher valued address that has not yet been output during the retrieval / storage of the current block based on information from the track 221 and the random number (e.g., one or more non-candidate address bits of the random number received from the random number generator 211). When the next higher valued address is selected based on the random number and there is no higher valued address that has not yet been output, the selector 231 may select the next lower valued address (as compared to the candidate) that has not yet been output during the retrieval / storage of the current block based on information from the track 221. Similarly, when the next lower valued address is selected based on the random number and there is no lower valued address that has not yet been output, the selector 231 may select the next higher valued address (as compared to the candidate) that has not yet been output during the retrieval / storage of the current block based on information from the track 221.

[0034] Figure 6 is a flow chart illustrating a method for selecting an address. The steps illustrated in Figure 6 may be performed by address generation system 100, address generation system 200, and / or address generation systems 301, 302, system 400, and / or one or more of their components. A set of indicators is maintained corresponding to each of the sets of access addresses (602). For example, address tracking 221 may maintain a register (or multiple registers) whose output indicates whether the corresponding address has already been output during retrieval / storage of a block of data.

[0035] When an address corresponding to each of the set of indicators is output, one of the set of indicators is modified (604). For example, address tracking 221 may modify the output of a register (or registers) whose output indicates whether the corresponding address has already been output, while retrieval / storage of a block of data may be modified when the corresponding address is output.

[0036] An address is selected (606) based at least in part on the set of indicators. For example, when a repeat address occurs, selector 231 may detect this occurrence using information from address tracking 221. Selector 231 may then prevent this reoccurring address from being output and select a new address for output that has not yet been output (also based on information from tracking 221). In this way, the access pattern to a block of data is different each time the data is accessed, but the time required to access the entire block is constant.

[0037] The above methods, systems, and devices may be implemented in or stored by a computer system. The above methods may be stored on a non-transitory computer-readable medium. The devices, circuits, and systems described herein may be implemented using computer-aided design tools available in the art and embodied by computer-readable files that contain software descriptions of such circuits. This includes, but is not limited to, the address generation system 100, the address generation system 200, and / or the address generation systems 301, 302, the system 400, and one or more of their components. These software descriptions may be behavioral, register transfer, logic component, transistor, and layout geometry level descriptions. Additionally, the software descriptions may be stored on a storage medium or communicated by a carrier wave.

[0038] Data formats in which such descriptions may be implemented include, but are not limited to, formats supporting behavioral languages ​​such as C, formats supporting register transfer level (RTL) languages ​​such as Verilog and VHDL, formats supporting geometry description languages ​​(such as GDSII, GDSIII, GDSIV, CIF, and MEBES), and other suitable formats and languages. Furthermore, data transfer of such files on machine-readable media may occur via a variety of media on the Internet or electronically, for example, via email. It is noted that physical files may be implemented on machine-readable media such as 4 mm magnetic tape, 8 mm magnetic tape, 3-1 / 2 inch floppy media, CDs, DVDs, and the like.

[0039] 7 is a block diagram illustrating one embodiment of a processing system 700 for containing, processing, or generating a representation of a circuit component 720. The processing system 700 includes one or more processors 702, memory 704, and one or more communication devices 706. The processors 702, memory 704, and communication devices 706 communicate using any suitable type, number, and / or configuration of wired and / or wireless connections 708.

[0040] Processor 702 executes instructions of one or more processes 712 stored in memory 704 to process and / or generate circuit components 720 in response to user inputs 714 and parameters 716. Process 712 may be any suitable electronic design automation (EDA) tool or portion thereof used to design, simulate, analyze, and / or verify electronic circuits and / or generate photomasks for electronic circuits. Representation 720 includes data describing all or a portion of address generation system 100, address generation system 200, and / or address generation systems 301, 302, system 400 and their components, as shown in the figure.

[0041] Representation 720 may include one or more of behavioral, register transfer, logical component, transistor, and layout geometry level descriptions. Additionally, representation 720 may be stored on a storage medium or communicated by a carrier wave.

[0042] Data formats in which the representation 720 may be implemented include, but are not limited to, formats that support behavioral languages ​​such as C, formats that support register transfer level (RTL) languages ​​such as Verilog and VHDL, formats that support geometry description languages ​​(such as GDSII, GDSIII, GDSIV, CIF, and MEBES), and other suitable formats and languages. Additionally, data transfer of such files on machine-readable media may occur over a variety of media over the Internet or electronically, for example, via email.

[0043] User input 714 may include input parameters from a keyboard, mouse, voice recognition interface, microphone and speaker, graphic display, touch screen, or other type of user interface device. This user interface may be distributed across multiple interface devices. Parameters 716 may include specifications and / or characteristics entered to help define representation 720. For example, parameters 716 may include information defining a device type (e.g., NFET, PFET, etc.), topology (e.g., block diagram, circuit description, schematic, etc.), and / or device description (e.g., device characteristics, device dimensions, power supply voltage, simulation temperature, simulation model, etc.).

[0044] Memory 704 includes any suitable type, number, and / or configuration of non-transitory computer-readable storage media for storing processes 712 , user inputs 714 , parameters 716 , and circuit components 720 .

[0045] The communications device 706 includes any suitable type, number, and / or configuration of wired and / or wireless devices that transmit information from the processing system 700 to and / or receive information from another processing or storage system (not shown). For example, the communications device 706 may transmit the circuit components 720 to another system. The communications device 706 may receive the processes 712, user inputs 714, parameters 716, and / or circuit components 720 and cause the processes 712, user inputs 714, parameters 716, and / or circuit components 720 to be stored in the memory 704.

[0046] Implementations discussed herein include, but are not limited to, the following examples.

[0047] Example 1: An address generation circuit comprising: a candidate address generator for randomly selecting a candidate address from a set of addresses; a repeat address detector for determining whether the candidate address has already been output at least once before all of the addresses from the set of addresses have been output; and an output selector for outputting the candidate address if the candidate address has not already been output at least once, and for selecting from the set of addresses and outputting a different address that has not already been output at least once if the candidate address has already been output at least once.

[0048] Example 2. The address generation circuit of Example 1, further comprising a set of indicators corresponding to each of the set of addresses, the set of indicators corresponding to whether each of the set of addresses has already been output at least once.

[0049] Example 3: The address generation circuit of example 2, further comprising an indicator updater that changes a value of a corresponding one of the set of indicators when the address is output.

[0050] Example 4: The address generation circuit of example 2, wherein the distinct addresses are selected based at least in part on a set of indicators.

[0051] Example 5: The address generation circuit of example 1, wherein the candidate addresses are selected based on a value from a random number generator.

[0052] Example 6: The address generation circuit of example 5, wherein the distinct addresses are selected based at least in part on a value from a random number generator.

[0053] Example 7. The address generation circuit of example 1, wherein the candidate addresses are used to address a non-volatile memory.

[0054] Example 8: A method of outputting a set of access addresses, the method including: selecting a first address from the set of access addresses based at least in part on a randomly generated number; determining whether the first address has been output before all of the other addresses in the set of access addresses have been output; outputting the first address if the first address has not yet been output before all of the other addresses in the set of access addresses have been output; and if the first address has already been output before all of the other addresses in the set of access addresses have been output, selecting a second address that has not yet been output before all of the other addresses in the set of access addresses have been output and outputting the second address.

[0055] Example 9: The method of Example 8, further including maintaining a set of indicators each corresponding to each of the set of access addresses, the set of indicators being associated with whether each of the set of access addresses has been output before all of the other addresses in the set of access addresses have been output.

[0056] The method of Example 8, further comprising: modifying a value of one of the set of indicators when an address corresponding to one of the set of indicators is output.

[0057] Example 11: The method of example 8, wherein the second address is selected based at least in part on the set of indicators.

[0058] Example 12: The method of example 8, wherein the first address is selected based on at least one value from a random number generator.

[0059] Example 13: The method of example 12, wherein the different addresses are selected based at least in part on a value from a random number generator.

[0060] Example 14: The method of example 8, wherein the second address is used to address the non-volatile memory.

[0061] Example 15: A memory system including a memory for storing confidential data addressed by a set of N access addresses, N being greater than 4, and an address generator for randomly and non-repetitively selecting one of the set of N access addresses until all of the N access addresses have been used to address the memory.

[0062] Example 16: The memory system of Example 15, wherein the address generator is for randomly selecting the first address from the set of N access addresses.

[0063] Example 17: The memory system of example 16, wherein the address generator is for determining whether the first address has been used to address the memory.

[0064] Example 18: The memory system of example 17, wherein the memory system is for addressing the memory based at least in part on the first address if the first address has not been used to address the memory.

[0065] Example 19: The memory system of example 18, wherein the memory system is for addressing the memory based at least in part on the second address when the first address is used to address the memory.

[0066] Example 20: The memory system of example 18, wherein the memory system is for selecting the second address from a subset of the set of N access addresses not used to address the memory.

[0067] The above description of the invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed, and other modifications and variations may be possible in light of the above teachings. The implementations have been chosen and described in order to best explain the principles of the invention and its practical application, so that those skilled in the art can best utilize the invention in various embodiments and modifications suited to the particular use contemplated. It is intended that the appended claims be construed to include other alternative embodiments of the invention, except insofar as limited by the prior art.

Claims

1. An address generation circuit, a candidate address generator configured to randomly select a candidate address from the set of addresses; a repeat address detector configured to determine whether a candidate address has already been output at least once before all of the addresses from the set of addresses have been output; an output selector configured to output the candidate address if the candidate address has not yet been output at least once, and to select from the set of addresses to output a different address that has not yet been output at least once if the candidate address has already been output at least once, the candidate address and the different address being memory addresses; Including, The address generation circuitry is operably coupled to a non-volatile memory arbiter that is operably coupled to a non-volatile memory via at least one address bus and a read data bus.

2. 2. The address generation circuit of claim 1, further comprising a set of indicators corresponding to each of said set of addresses, said set of indicators corresponding to whether each of said set of addresses has already been output at least once.

3. 3. The address generation circuit of claim 2, further comprising an indicator updater for changing a value of a corresponding one of said set of indicators when an address is output.

4. The address generation circuit of claim 2 , wherein the different addresses are selected based at least in part on the set of indicators.

5. 2. The address generation circuit of claim 1, wherein the candidate addresses are selected based on a value from a random number generator.

6. 6. The address generation circuit of claim 5, wherein the different addresses are selected based at least in part on a value from the random number generator.

7. The address generation circuit of claim 1 , wherein the candidate addresses are used to address a non-volatile memory.

8. A method for outputting a set of access addresses for a memory, performed by an address generation circuit, comprising: selecting a first address from the set of access addresses based at least in part on a randomly generated number; determining whether the first address has been output before all of the other addresses in the set of access addresses have been output; outputting the first address if the first address has not already been output before all of the other addresses in the set of access addresses have been output, transmitting the first address over an address bus and reading corresponding data over a data bus; if the first address has already been output before all of the other addresses in the set of access addresses have been output, selecting a second address that has not yet been output before all of the other addresses in the set of access addresses have been output, outputting the second address, transmitting the second address over the address bus, and reading corresponding data over the read data bus.

9. 9. The method of claim 8, further comprising: maintaining a set of indicators each corresponding to each of the set of access addresses, the set of indicators associated with whether the each of the set of access addresses has been output before all of the other addresses in the set of access addresses have been output.

10. 10. The method of claim 9, further comprising: changing a value of one of the set of indicators when an address corresponding to the one of the set of indicators is output.

11. The method of claim 9 , wherein the second address is selected based at least in part on the set of indicators.

12. The method of claim 8 , wherein the first address is selected based on at least one value from a random number generator.

13. The method of claim 12 , wherein the second address is selected based at least in part on a value from the random number generator.

14. The method of claim 8 , wherein the second address is used to address a non-volatile memory.

15. The address generation circuitry is operatively coupled to a memory for storing confidential data addressed by a set of N access addresses, N being greater than 4; the candidate address generator is configured to randomly and non-repeatedly select one of the set of N access addresses until all of the N access addresses have been used to address the memory; the candidate address generator is configured to randomly select a first address from the set of N access addresses and determine if the first address has been used to address the memory; the output selector is configured to address the memory based at least in part on the first address when the first address has not been used to address the memory, and to address the memory based at least in part on the second address when the first address has been used to address the memory; 2. The address generation circuit of claim 1, wherein the output selector is configured to select the second address from a subset of the set of N access addresses not used to address the memory.

Images