Abstract: An apparatus includes a memory, a Memory Section Attribute Storage (MSAS) and a memory access circuit (MAC). The memory includes a plurality of memory sections. The MSAS includes one or more entries, wherein at least some of the entries specify, for respective sections of the memory, respective section security policies, respective section base addresses and respective section sizes. The MAC is configured to receive, from a host, a memory access request that specifies an address to be accessed in the memory, to identify a target memory section that corresponds to the address, responsively to the section base addresses and to the section sizes specified in the MSAS, to receive, from the MSAS, a security policy that corresponds to the target memory section, and to apply the security policy to the memory access request.

Abstract: A memory device includes a Non-Volatile Memory (NVM) comprising a plurality of sectors, and a memory access circuit. The memory access circuit is configured to receive, from a host, a logical address of a block of data, to compute a mapping of the logical address to a data physical address comprising a selected sector among the plurality of sectors and a selected data offset within the same selected sector, to compute a metadata physical address that comprises the selected sector and a metadata offset in the selected sector, and to access the block of data at the data physical address, and the metadata at the metadata physical address.

Abstract: A memory device includes a non-volatile memory (NVM) and a secure-programming circuit (SPC). The SPC is configured to receive a program-NVM instruction to program a given data word in a given location of the NVM, and, responsively to receiving the program-NVM instruction, to program bits of the given data word in the NVM in a random order.

Abstract: System on chips, memory circuits, and method for data access, the memory circuits including a memory cell array and an input/output (I/O) connection interface coupled to the memory cell array, wherein the I/O connection interface is configured for coupling to an external signal line to directly receive a transistor-level operation signal from an external memory controller for accessing data in the memory cell array.

Abstract: A memory device includes a memory, a secure-access circuit, a plain-access circuit, and protection hardware. The memory includes at least a secure-storage partition assigned a first address range and a plain-storage partition assigned a second address range, disjoint from the first address range. The secure-access circuit is configured to access the secure-storage partition by generating addresses in the first address range. The plain-access circuit is configured to access the plain-storage partition by generating addresses in the second address range. The protection hardware is configured to prevent the plain-access circuit from accessing the first address range assigned to the secure-storage partition.

Abstract: A method for Serial Peripheral Interface (SPI) operating-mode synchronization between an SPI host and an SPI device, which communicate over an SPI bus, includes predefining, in the SPI device, one or more values on the SPI bus as indicative of lack of synchronization of an SPI operating mode between the SPI host and the SPI device. Re-synchronization of the SPI operating mode is initiated in response to receiving any of the predefined values in the SPI device.

Abstract: System on chips, memory circuits, and method for data access, the memory circuits including a memory cell array and an input/output (I/O) connection interface coupled to the memory cell array, wherein the I/O connection interface is configured for coupling to an external signal line to directly receive a transistor-level operation signal from an external memory controller for accessing data in the memory cell array.

Abstract: A method is provided for generating a new instance of an N-bit cryptographic key for storage in a non-volatile memory (NVM) in which unprogrammed cells have a particular binary value. The method includes generating a random N-bit updating sequence, and generating the new instance of the N-bit cryptographic key by negating each bit in a current instance of the N-bit cryptographic key that has the particular binary value and differs from a correspondingly-positioned bit in the random N-bit updating sequence, without negating any bits in the current instance of the N-bit cryptographic key that do not have the particular binary value. Other embodiments are also described.

Abstract: A memory device includes a non-volatile memory (NVM) and circuitry. The circuitry is configured to initialize and prepare the NVM for executing memory-access operations for a processor, and to ascertain that no memory-access operations are received from the processor before the NVM is ready, by preventing the processor from bootstrapping during at least part of initialization and preparation of the NVM.

Abstract: A secured storage system includes a non-volatile memory and a controller. The non-volatile memory is configured to store a first data item and a respective first version identifier assigned to the first data item. The controller is configured to receive a second data item accompanied by a second version identifier and a signature, for replacing the first data item in the non-volatile memory, to authenticate at least the second version identifier using the signature, to make a comparison between the stored first version identifier and the second version identifier, and to replace the first data item with the second data item only in response to verifying that (i) the second version identifier is authenticated successfully, and (ii) the second data item is more recent than the first data item, as indicated by the comparison between the stored first version identifier and the authenticated second version identifier.

Abstract: A memory subsystem includes a memory interface for accessing a non-volatile memory (NVM), a host interface for communicating with a host, and a processor. The processor is configured to calculate a signature over program code that is used by the host and is stored in the NVM, to verify, upon detecting a boot process performed by the host, whether the boot process is legitimate, and, only if the boot process was verified to be legitimate, to provide the signature to the host for authentication to a remote server.

Abstract: A memory device including a plurality of memory units; at least one geometric mean operator coupled to at least two of the plurality of memory units; and a memory state reader coupled to the at least one geometric mean operator to read a memory state of the plurality of memory units.

Abstract: A memory system includes an interface, a non-volatile memory and a controller. The interface is configured to communicate over an unsecured communication link with an external host. The non-volatile memory is pre-programmed with a device identifier and a corresponding initialization key that are additionally stored in a database that resides externally to the memory system, and is securely accessible by the host. The controller is configured to send the device identifier to the host, to receive from the host, via the interface, binding information that was generated in the host, to generate, using at least the received binding information and the pre-programmed initialization key, a first binding key that matches a second binding key that is generated in the host based on an initialization key securely obtained by the host from the database, and to securely communicate with the host over the communication link using the first binding key.

Abstract: A method of controlling access to a flash memory device having multiple sectors divided into multiple blocks of memory, including accepting a virtual block address, calculating a set of possible sectors that can be used for storing data having the virtual block address based on a predefined function, reading meta-data of each sector from the set of possible sectors, wherein the meta-data of a sector includes information for each block in the sector indicating if the block is currently in use and the virtual block address of the data stored in the block, determining the physical block address of the virtual block address if the data is currently stored in a block in the possible sectors or if a block is currently allocated to store the data, wherein the set of possible sectors is distinct for each virtual block address.

Abstract: A power-gating electronic system for synchronized power transitions, includes a power generation block including a plurality of cells, each cell including a cell enabling input; a circuit block including a plurality of circuits, each circuit including a circuit enabling input; and a power-gating controller including a plurality of gate signal outputs. In the power-gating electronic system, each gate signal output is coupled to one of the cell enabling inputs and one of the circuit enabling inputs.

Abstract: A memory device includes a delay locked loop (DLL) circuit to receive an external clock, and delay the external clock by a DLL delay time to provide a DLL clock, an output driver to output the DLL clock as a data strobe signal, and a DLL offset control circuit configured to receive at least one of a plurality of functional statement commands, and adjust the DLL delay time based on the at least one of the functional statement commands. Each one of the DLL circuit and the output driver is selectively powered according to the at least one of the functional statement commands.

Abstract: A memory device includes a memory block including a plurality of sectors, and a control unit configured to: pre-store a plurality of first indicators in a storage unit, the plurality of first indicators respectively corresponding to a plurality of refresh units in the memory block, each refresh unit including at least one sector, and the first indicators being generated based on a first reference voltage level; and in an erase cycle for erasing a target sector of the memory block: read data from a selected one of the refresh units with a second reference voltage level; generate a second indicator for the selected refresh unit based on the data; compare one of the first indicators corresponding to the selected refresh unit with the second indicator of the selected refresh unit; and if the second indicator is not equal to the first indicator, refresh data in the selected refresh unit.

Abstract: A memory device includes a memory array including a plurality of memory cells that store data, a sense circuit coupled to the memory array for reading data stored in the memory array, a data register for storing data to be written into the memory array, a data processor, and a control unit. The data processor is configured to receive input data units to be written into the memory array, and process the input data units based on array data units stored in the memory array to generate processed data units. The control unit is configured to write the processed data units into the memory array.

Abstract: Serial NAND flash memory may be provided with the characteristics of continuous read of the memory across page boundaries and from logically contiguous memory locations without wait intervals, while also being clock-compatible with the high performance serial flash NOR (“HPSF-NOR”) memory read commands so that the serial NAND flash memory may be used with controllers designed for HPSF-NOR memory. Serial NAND flash memory having these compatibilities is referred to herein as high-performance serial flash NAND (“SPSF-NAND”) memory. Since devices and systems which use HPSF-NOR memories and controllers often have extreme space limitations, HPSF-NAND may also be provided with the same physical attributes of low pin count and small package size of HPSF-NOR memory for further compatibility. HPSF-NAND memory is particularly suitable for code shadow applications, even while enjoying the low “cost per bit” and low per bit power consumption of a NAND memory array at higher densities.

Abstract: An apparatus includes a processor and a bus encryption unit. The processor is configured to communicate information over a secured data bus, and to communicate respective addresses over an address bus. The bus encryption unit is configured to generate an encryption key based on multiple addresses that appeared on the address bus, and to encrypt the information communicated between the processor and the secured data bus with the encryption key.