Memory system with enhanced security access to parital storage areas

Patent metadata

Field	Value
Publication number	US-2026079633-A1
Application number	US-202519398149-A
Country	US
Kind code	A1
Filing date	Nov 24, 2025
Priority date	Feb 15, 2021
Publication date	Mar 19, 2026
Grant date	—

Abstract

According to one embodiment, a memory system includes a nonvolatile memory and a controller. The controller enables a first access authority to a first storage area which is at least a partial storage area of the nonvolatile memory and sets a first time limit at which the first access authority becomes disabled. The first access authority is assigned to first user identification information. The controller disables the first access authority in a case where current time exceeds the first time limit.

First claim

1 - 16 . (canceled)

17 . A memory system comprising:
a memory; a real-time clock; and a controller configured to:
control an access to the memory;
manage authority information on first access authority and first authentication information that corresponds to first identification information, the first access authority assigned to the first identification information; and
function to set a first time limit based on a current time from the real-time clock, wherein the controller,
when the current time has exceeded the first time limit associated with the authority information, disables the first access authority, updates the authority information, and changes the first authentication information corresponding to the first identification information.

18 . The memory system of claim 17 , wherein
the controller is further configured to:
receive a first command from a host, the first command requesting enabling the first access authority and including the first identification information and information indicative of the first time limit; and
in accordance with the first command, set the first time limit and information indicating that the first access authority is enabled in the authority information.

19 . The memory system of claim 18 , wherein
the controller is further configured to:
manage one or more ranges obtained by logically dividing a storage area of the memory, the one or more ranges including a first range;
manage the authority information to access the first range;
acquire the current time from the real-time clock;
while the acquired current time does not exceed the first time limit, enable the first access authority; and
when the acquired current time has exceeded the first time limit, disable the first access authority, update the authority information to indicate that the access to the first range is disabled, and change the first authentication information.

20 . The memory system of claim 19 , wherein
the controller is further configured to:
receive a second command from the host, the second command being a command for accessing the first range and being associated with the first identification information;
in a case that the first access authority is enabled, execute a process related to access to the first range in accordance with the second command; and
in a case that the first access authority is disabled, notify the host of an error without executing the process related to access to the first range in accordance with the second command.

21 . The memory system of claim 20 , wherein
the controller is further configured to:
receive a third command from the host, the third command including second authentication information associated with the first identification information;
in a case that the first access authority is enabled, execute an authentication process of the first identification information using the second authentication information; and
in a case that the first access authority is disabled, notify the host of an error without executing the authentication process of the first identification information using the second authentication information.

22 . The memory system of claim 21 , wherein
the controller is further configured to:
in a case that the first access authority is enabled and the executed authentication process is successful, execute the process related to access to the first range in accordance with the second command; and
in a case that the first access authority is enabled but the executed authentication process is not successful, notify the host of an error without executing the process related to access to the first range in accordance with the second command.

23 . The memory system of claim 19 , wherein
the controller is further configured to:
receive a third command from the host, the third command including third authentication information associated with administrator identification information that corresponds to administrator authority;
execute an authentication process of the administrator identification information using the third authentication information; and
in a case that the executed authentication process of the administrator identification information is successful, set the first time limit and the information indicating that the first access authority is enabled in the authority information in accordance with the first command.

24 . The memory system of claim 17 , further comprising:
a power storage device configured to supply power to the real-time clock, wherein the controller is further configured to acquire the current time from the real-time clock.

25 . A memory system comprising:
a memory; a real-time clock configured to acquire a current time; and a controller configured to:
receive a first command including first identification information and first authentication information that corresponds to the first identification information and execute an authentication process for the first identification information;
receive a second command after receiving the first command, the second command including second identification information and a first time limit for the second identification information, and enable access authority for the second identification information when the authentication process for the first identification information has been succeeded;
receive a third command after receiving the second command, and accept an access to the memory corresponding to the second identification information, when the access authority is enabled, wherein
the controller enables the access authority when the current time acquired from the real-time clock does not exceed the first time limit and disables when the current time exceeds the first time limit.

26 . The memory system of claim 25 , wherein
the memory includes one or more ranges obtained by logically dividing a storage area, and the third command is a request for accessing a storage area corresponding to a first range of the ranges, the first range being associated with the second identification information.

27 . The memory system of claim 25 , wherein
the controller is further configured to execute the authentication process for the second identification information after the authentication process for the first identification information.

28 . The memory system of claim 25 , wherein
the first identification information is for an administrator and the second identification information is for a user.

29 . The memory system of claim 25 , wherein
the controller is further configured to acquire the current time periodically from the real-time clock.

30 . The memory system of claim 25 , wherein
the controller is further configured to acquire the current time when the memory system has executed a restart process.

31 . The memory system of claim 25 , wherein
the second identification information is shared by one or more users.

32 . The memory system of claim 31 , wherein
the memory includes one or more ranges obtained by logically dividing a storage area, and the third command is a request for accessing a storage area corresponding to a second range of the ranges, the second range being associated with the second identification information, the storage area corresponding to the second range is enabled to access by a first user that is associated to the second identification information but is disabled to access by a second user that is associated to the second identification information.

33 . The memory system of claim 25 , wherein
the c

Assignees

• Kioxia Corp

Inventors

• Hikichi Mari

Classifications

• G06F3/0679

  Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP] · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F1/14

  Time supervision arrangements, e.g. real time clock · CPC title

• G06F3/0637

  Permissions · CPC title