Abstract: Methods, systems, and devices for on-the-fly decryption within a memory system are described. For example, the memory system and a host system may share a root key that may be used for derivation of subsequent symmetric session keys. The host system may encrypt data using the session keys and may transmit the encrypted data to the memory system with verification information to be stored with the data. The memory system may receive and store the verification information and data in an encrypted form. During an access operation, the memory system may access at least a portion of the encrypted data in a memory array and may decrypt the data in accordance with the session keys on-the-fly. After decrypting and verifying the data using the session keys and the verification information, the memory system may use the data to perform one or more operations associated with the access operation.

Abstract: The disclosed embodiments are related to securely updating a semiconductor device and in particular to a key management system. In one embodiment, a method is disclosed comprising storing a plurality of activation codes, each of the activation codes associated with a respective unique identifier (UID) of semiconductor device; receiving, over a network, a request to generate a new storage root key (SRK), the request including a response code and a requested UID; identifying a selected activation code from the plurality of activation codes based on the requested UID; generating the SHRSRK value using the response code and the selected activation code; associating the SHRSRK value with the requested UID and storing the SHRSRK value; and returning an acknowledgement in response to the request.

Abstract: A server system configured to allow a group of endpoints to share a subscription. For example, data can be stored to associate the endpoint group with at least one subscriber identifier. After receiving a validation request containing identity data generated by a memory device configured in an endpoint in the group, the server system can validate the identity data based at least in part on a secret of the memory device. In response to a determination that the identity data is valid, the system can determine that the subscriber identifier is not currently assigned to any endpoint in the group and thus assign, based on the data associating the endpoint group with the subscriber identifier, the subscriber identifier to the endpoint to cause a service offered to an account represented by the subscriber identifier to be provided to the endpoint.

Abstract: A security server to implement security operations during validation of the identity of an endpoint based on activity data of the endpoint. For example, a server system stores data representative of preferences for the endpoint. After receiving, a validation request containing identity data generated by a memory device configured in the endpoint, the server system can validate the identity data based at least in part on a secret of the memory device. If the identity data is valid, the server system can further determine whether an activity, as identified by the identity data and/or the validation request, satisfies a condition specified for the endpoint. If so, the server system can perform a security operation associated with the condition in providing a validation response in responding to the validation request.

Abstract: A system, method and apparatus to control memory devices over computer networks. For example, a server system establishes a secure authenticated connection with a client computer system to receive a request having a batch identification that is configured in the server system to identify a batch of multiple memory devices. After determining that the client computer system is eligible to control the multiple memory devices in the batch, the server system transmits to the client computer system a response. The response contains control data for each respective memory device in the batch. The control data is based on at least a cryptographic key stored in the server system in association with the respective memory device. Using the control data the client computer system submits a command with a digital signature to the respective memory device, which validates the digital signature prior to execution of the command.

Abstract: A storage device includes a memory storage region and a controller having a processor. The processor retrieves user data from the memory storage region using a physical block address corresponding to a logical block address (LBA), in response to a read command. The retrieved user data includes a first hash received through a host interface in a prior host data transmission. The processor further performs error correction on the user data to generate error-corrected user data. The processor further causes a cryptographic engine to produce a second hash of the error-corrected user data. The first hash is compared to the second hash associated with the error-corrected user data to determine a match result. A notification is generated in response to the match result.

Abstract: Methods, systems, and devices for data buffer error correction functionality are described. A data buffer of a memory system may support system-level error correction capabilities. For example, the data buffer may be configured to perform error correction for data stored within multiple memory dies in the memory system using parity bits aggregated from one or more of the memory dies. In some examples, on-die error correction at one or more of the memory dies may be disabled. Extra parity bits previously used for on-die error correction may be transferred from the memory dies to the data buffer for use in the system-level error correction. The aggregation of the extra bits for error correction within the data buffer may improve a performance and reliability of the system-level error correction.

Abstract: Methods, systems, and devices for memory recovery partitions are described. A memory system may include a memory array configured with one or more logical partitions. In some examples, a primary boot image may be stored to a first logical partition and a recovery boot image may be stored to a second logical partition. During a boot operation, the memory system may determine whether the primary boot image includes one or more errors. If the primary boot image includes relatively few (or no) errors, the memory system may boot using the primary boot image. If the primary boot image includes a relatively high quantity of errors (e.g., higher than a threshold quantity of errors), the memory system may autonomously load a recovery boot image stored to the second logical partition.

Abstract: Methods, systems, and devices for metadata for indication of access authorization in a memory system are described. Some memory systems may not permit access to data stored within the memory system by a host system until the host system and corresponding access request are verified. If a host system attempts to access the memory system and is not verified, the memory system described herein may send invalid data or poisoned data back to the host system in addition to metadata that indicates that the host system was not verified to access the memory system. The metadata may include multiple bits associated with multiple candidate values. At least one value of the multiple candidate values may be reserved for indicating that an access request was denied due to a failed verification of the host system. The host system may use the metadata to improve subsequent access requests.

Abstract: Methods, systems, and devices for module-level encryption of error correction data are described. A memory system may include an error correction module that is configured to encrypt data and parity information generated by system-level error correction circuitry of the memory system prior to communicating the data and parity information via a data bus coupled with the error correction module. For example, the error correction module may be configured with one or more encryption schemes that are enabled for encryption of the data and the parity information by the error correction module prior to communication of the data and the parity information external to the error correction module. In some examples, the error correction module may encrypt the data and the parity information prior to transmission of the data and parity information to a host system, prior to storage in one or more memory dies, or both.

Abstract: A security server to provide security services over a computer network based on security features of memory devices connected to host systems. For example, the security features of a memory device can include a unique device secret, a cryptographic engine, and an access controller to implement access privileges represented by cryptographic keys. After receiving identity data that is generated by the memory device and represented by a cryptographic key, the security server can determine authenticity of the memory device based on its copy of the unique device secret of the memory device. The security server can generate a verification code for a command and cause the command and the verification code to be communicated to the memory device, where the access controller of the memory device validates the verification code in determining whether to block execution of the command in the memory device.

Abstract: A security server to implement security operations during validation of the identity of an endpoint based on activity data of the endpoint. For example, a server system stores data representative of preferences for the endpoint. After receiving, a validation request containing identity data generated by a memory device configured in the endpoint, the server system can validate the identity data based at least in part on a secret of the memory device. If the identity data is valid, the server system can further determine whether an activity, as identified by the identity data and/or the validation request, satisfies a condition specified for the endpoint. If so, the server system can perform a security operation associated with the condition in providing a validation response in responding to the validation request.

Abstract: Methods, systems, and devices for partitioned cryptographic protection for a memory system are described. The method may include a host system generating a command to update a protection attribute of a first set of memory cells of the memory system, where the memory system includes multiple sets of memory cells, each set associated with a respective set of one or more first keys. The method may further include encrypting the command based on a second key corresponding to a first key within the respective set of one or more first keys, and transmitting, after encrypting the command, the command to the memory system to update the protection attribute of the first set of memory cells.

Abstract: Methods, systems, and devices for memory system security and authentication using asymmetric keys are described. In some examples, host systems and memory systems may be configured to implement techniques for the generation and distribution of asymmetric keys, which may support evaluating the authenticity of interfacing systems (e.g., system identities) in connection with exchanged signaling, such as access commands, requests, data, or other signaling. Such techniques may include implementing asymmetric cryptographic security directly in a memory system. For example, a memory system may be configured to be cryptographically identified by a public asymmetric key, and authenticity of the memory system may be proven by signing a challenge using an asymmetric private key of the memory system. Further, a host system may be identified by signing signaling with its asymmetric private key, and the signature may be verified by a memory system using an asymmetric public key of the host system.

Abstract: Methods, systems, and devices for authenticated reading of memory system data are described. In some examples, a host system and a memory system may exchange keys used to grant the host system access to one or more protected regions of the memory system. The keys may be symmetric or asymmetric. In some cases, the host system may transmit a read command to access data stored at a protected region of the memory system, along with a signature generated using the key associated with the protected region. The memory system may verify the signature to determine whether the host is authorized to access the protected region, and may transmit the requested data to the host system. In some examples, the memory system may sign the returned data, so that the host system may verify the source of the data.

Abstract: Methods, systems, and devices for techniques for generating a shared secret for an electronic system are described. A memory system may identify an initial key pair and exchange a public key of the key pair with a public key associated with a server. The memory system and the server may each generate a shared secret. In some cases, the memory system and the server may use the shared secret to generate a device identifier for the memory system, for example by incorporating the device identifier into a cryptographic representation of a software layer of the memory system. The memory system and the server may use the device identifier to generate one or more asymmetric key pairs, which may be used by the server to authenticate the memory system.

Abstract: Methods, systems, and devices for authenticated modification of memory system data are described. A host system may transmit a command to program data to a protection region of a memory system, and the host system may sign the command using a key associated with the protection region. In some examples, the host system may transmit the data associated with the command, or the command may include instructions to move the data from another region of the memory system. Upon receiving the command, the memory system may verify the signature to determine whether the host is authorized to modify the protection region, and may program the data as requested by the host system. In some cases, the protection regions of the memory system may be updated, for example by adjusting the size or address range of the protection regions, in response to a command from the host system.

Abstract: Methods, systems, and devices for memory recovery partitions are described. A memory system may include a memory array configured with one or more logical partitions. In some examples, a primary boot image may be stored to a first logical partition and a recovery boot image may be stored to a second logical partition. During a boot operation, the memory system may determine whether the primary boot image includes one or more errors. If the primary boot image includes relatively few (or no) errors, the memory system may boot using the primary boot image. If the primary boot image includes a relatively high quantity of errors (e.g., higher than a threshold quantity of errors), the memory system may autonomously load a recovery boot image stored to the second logical partition.

Abstract: Methods, systems, and devices for memory system security and authentication using asymmetric keys are described. In some examples, host systems and memory systems may be configured to implement techniques for the generation and distribution of asymmetric keys, which may support evaluating the authenticity of interfacing systems (e.g., system identities) in connection with exchanged signaling, such as access commands, requests, data, or other signaling. Such techniques may include implementing asymmetric cryptographic security directly in a memory system. For example, a memory system may be configured to be cryptographically identified by a public asymmetric key, and authenticity of the memory system may be proven by signing a challenge using an asymmetric private key of the memory system. Further, a host system may be identified by signing signaling with its asymmetric private key, and the signature may be verified by a memory system using an asymmetric public key of the host system.

Abstract: A memory module includes one or more memory devices and a module logic chip. The module is coupled to a host which operates the memory devices. Certain features of the module may only be accessible once the module has authenticated with the host. For example, the module logic chip may perform asymmetric authentication with the host and the feature may be enabled only after successful authentication. In some embodiments, the module logic may additionally authenticate the memory devices. For example, the module logic chip may perform symmetric authentication on the memory devices after authentication with the host.