Methods and apparatus for in-memory device access control

Patent metadata

Field	Value
Publication number	US-11636231-B2
Application number	US-202016937907-A
Country	US
Kind code	B2
Filing date	Jul 24, 2020
Priority date	Jul 24, 2020
Publication date	Apr 25, 2023
Grant date	Apr 25, 2023

Abstract

Various embodiments may include methods and systems for providing secure in-memory device access of a memory device by a system-on-a-chip (SOC). Various methods may include receiving a configuration message from the SOC for configuring a memory access control of the memory device, and configuring the memory access control based on the configuration message. Various embodiments may include receiving an access request message from the SOC requesting access to a memory base address and a memory access range of a memory cell array of the memory device, wherein the access request message includes a read/write operation. Various embodiments may include comparing the access request message with the configured memory access control to determine whether the access request message is allowable. Various embodiments may further include performing the read/write operation in response to determining that the access request message is allowable.

First claim

What is claimed is:

1. A method for indicating access pass/violation feedback to a system on chip (SOC) as part of a read/write transaction sequence of a memory device, comprising:
receiving an unlock password from the SOC;
closing at least one pass gate to allow a memory access control of the memory device to receive a configuration message in response to the received unlock password matching a password within a set of acceptable passwords;
receiving the configuration message from the SOC for configuring the memory access control of the memory device;
configuring the memory access control based on the configuration message;
receiving an access request message from the SOC requesting access to a memory base address and a memory access range of a memory cell array of the memory device, wherein the access request message includes a read/write operation;
comparing the access request message with the configured memory access control to determine whether the access request message is allowable; and
performing the read/write operation in response to determining that the access request message is allowable.

2. The method of claim 1 , wherein:
the configuration message includes a configuration security domain ID; and
the access request message includes a requested security domain ID.

3. The method of claim 2 , wherein comparing the access request message with the configured memory access control to determine whether the access request message is allowable comprises:
determining whether the configuration security domain ID matches the requested security domain ID; and
in response to determining that the configuration security domain ID matches the requested security domain ID:
determining that the access request message is allowable; and
transmitting a notification to the SOC indicating that the access request message is allowable.

4. The method of claim 3 , further comprising:
in response to determining that the configuration security domain ID does not match the requested security domain ID:
determining that the access request message is not allowable;
storing error information including the memory base address, the memory access range, and the requested security domain ID;
transmitting a notification to the SOC indicating that the access request message is not allowable; and
transmitting the error information to the SOC in response to receiving an error interrupt request from the SOC.

5. The method of claim 2 , wherein:
the configuration message is an encoded JEDEC message including the configuration security domain ID; and
the access request message is an encoded JEDEC message including the requested security domain ID.

6. The method of claim 1 , further comprising:
receiving, from the SOC, a lock command configured to set a lock bit within a register of the memory device; and
setting the lock bit to prevent configuration changes to the configured memory access control.

7. A memory device, comprising:
a memory cell array;
at least one pass gate;
a trust hardware block, wherein the trust hardware block is configured to perform operations comprising:
receiving an unlock password from a system-on-chip (SOC);
closing the at least one pass gate to allow a memory access control hardware block to receive a configuration message in response to the received unlock password matching a password within a set of acceptable passwords; and

wherein the access control hardware block is configured to perform operations comprising:
receiving the configuration message from the SOC for configuring memory access control of the memory device;
configuring memory access control based on the configuration message;
receiving an access request message from the SOC requesting access to a memory base address and a memory access range of the memory cell array, wherein the access request message includes a read/write operation;
comparing the access request message with the configured memory access control to determine whether the access request message is allowable; and
performing the read/write operation in response to determining that the access request message is allowable.

8. The memory device of claim 7 , wherein the access control hardware block is configured to perform operations such that:
receiving the configuration message from the SOC comprises receiving a configuration message that includes a configuration security domain ID; and
receiving an access request message from the SOC comprises receiving an access request message that includes a requested security domain ID.

9. The memory device of claim 8 , wherein the access control hardware block is configured to perform operations such that comparing the access request message with the configured memory access control to determine whether the access request message is allowable comprises:
determining whether the configuration security domain ID matches the requested security domain ID; and
in response to determining that the configuration security domain ID matches the requested security domain ID:
determining that the access request message is allowable; and
transmitting a notification to the SOC indicating that the access request message is allowable.

10. The memory device of claim 9 , wherein the access control hardware block is configured to perform operations further comprising:
in response to determining that the configuration security domain ID does not match the requested security domain ID:
determining that the access request message is not allowable;
storing error information including the memory base address, the memory access range, and the requested security domain ID;
transmitting a notification to the SOC indicating that the access request message is not allowable; and
transmitting the error information to the SOC in response to receiving an error interrupt request from the SOC.

11. The memory device of claim 8 , wherein the access control hardware block is configured to perform operations such that:
receiving the configuration message from the SOC comprises receiving an encoded JEDEC message including the configuration security domain ID; and
receiving an access request message from the SOC comprises receiving an encoded JEDEC message including the requested security domain ID.

12. The memory device of claim 7 , wherein the access control hardware block is configured to perform operations further comprising:
receiving, from the SOC, a lock command configured to set a lock bit within a register of the memory device; and
setting the lock bit to prevent configuration changes to the configured memory access control.

13. The memory device of claim 7 , wherein the trust hardware block comprises:
a fuse memory configured to store a set of acceptable passwords; and
a logic block coupled to the fuse memory and the at least one pass gate and configured to:
signal the at least one pass gate to unlock the memory device gate logic by closing the at least one pass gate in response to the received unlock password matching the password within the set of acceptable passwords stored in the fuse memory.

14. The memory device of claim 7 , wherein the access control hardware block comprises:
an access control configuration block;
an access violation syndrome; and
a policy enforcement block.

15. A memory device, comprising:
a memory cell array;
means for receiving an unlock password from a system-on-chip (SOC);
means for closing at least one pass gate to allow a memory access control of the memory device to receive a configuration message in response to the received unlock password matching a password

Assignees

• Qualcomm Inc
• Chun Candace Sachi

Inventors

• Li Yanru
• Chun Dexter Tamio

Classifications

• G06F11/0772

  Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers · CPC title

• G06F21/79 Primary

  in semiconductor storage media, e.g. directly-addressable memories · CPC title

• G06F11/0787

  Storage of error reports, e.g. persistent data storage, storage using memory protection · CPC title

• G06F21/31

  User authentication · CPC title

• G06F12/1425

  the protection being physical, e.g. cell, word, block · CPC title