Memory Protected Region Access Verification With Embedded Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory systems lack effective mechanisms to prevent unauthorized access to sensitive data stored in protected regions, relying solely on host-level security measures which can be insufficient.
Innovation Solution
Implementing security measures directly at the memory device level by verifying access commands with credentials and keys, segregating protected regions among virtual machines, and enhancing security modes to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security measures are implemented only at the host level, then device complexity is reduced, but memory security is insufficient
Solution Approach 1:
The memory device performs self-verification of access commands by comparing credentials embedded in commands against stored credentials. The device autonomously determines whether to grant or deny access without requiring external verification, making the security system self-sufficient and eliminating the need for complex host-level security mechanisms.
Solution Approach 2:
Credentials are pre-loaded into the memory device during manufacturing or initialization. This preliminary action enables the device to perform security verification independently when access commands are received, resolving the contradiction by providing built-in security capability without adding operational complexity.
2Object-affected harmful factors
If credentials are verified at the memory device level, then unauthorized access is prevented, but device complexity increases
Solution Approach 1:
The memory device is segmented into distinct functional components: a credential storage unit, a verification unit, and a control unit. This segmentation allows each component to perform its specific function independently, simplifying the overall verification mechanism while effectively preventing unauthorized access through multi-stage validation.
Solution Approach 2:
A control unit acts as an intermediary between the credential storage unit and the memory array. It receives access commands, coordinates credential verification, and determines whether to grant access based on verification results. This intermediary simplifies the verification mechanism by centralizing control logic while maintaining security effectiveness.
3Loss of information
If protected regions are segregated among virtual machines, then data confidentiality is improved, but memory management complexity increases
Solution Approach 1:
Different regions of the memory device are assigned different security attributes and credential requirements specific to each virtual machine. This local quality approach allows each protected region to have customized security parameters while maintaining a unified verification framework, improving data confidentiality without proportionally increasing management complexity.
Solution Approach 2:
The verification mechanism is designed to handle multiple virtual machines and their respective credentials through a universal verification process. The same verification unit and control logic are used across all protected regions, enabling the system to manage multiple VMs with different security requirements without requiring separate verification mechanisms for each, thus reducing overall management complexity.
Data Source
AI summary
Apparatuses and methods related to managing regions of memory are described. Managing regions can include verifying whether an access command is authorized to access a particular region of a memory array, which may have some regions that have rules or restrictions governing access (e.g., so-called “protected regions”). The authorization can be verified utilizing a key and a memory address corresponding to the access command. If an access command is authorized to access a region, then a row of the memory array corresponding to the access command can be activated. If an access command is not authorized to access the region, then a row of the memory array corresponding to the access command may not be activated.