Abstract: Apparatuses and methods related to concurrently measuring and executing images. An apparatus for concurrently measuring and executing images can include a memory device, a first processing resource and a second processing resource. The first processing resource can execute instructions stored in the memory device to execute a first portion of an image responsive to measuring the first portion of the image and execute a second portion of the image responsive to measuring the second portion of the image. The second processing resource can execute instructions stored in the memory device to measure the first portion of the image and measure the second portion of the image concurrently with an execution of the first portion of the image by the first processing resource.

Abstract: Methods, systems, and devices for modes to extend life of memory systems are described. In some examples a host system and a memory system may support one or more vendor commands to configure one or more logical units of the memory system to be accessible in a read-only mode. For example, the host system may periodically transmit a command to retrieve health information of the memory system. The host system may compare the health information to one or more thresholds associated with one or more host entities. If the health information satisfies a threshold for a host entity, the host system may transmit a command to the memory system to initiate a read-only mode for the logical units associated with the host entity. Additionally or alternatively, the memory system may track the health information and compare the health information to the one or more thresholds.

Abstract: Methods, systems, and devices for memory-aligned access operations are described. A target packet size based on a quantity of physical pages addressable by individual first-level pages of a first-level page table for mapping logical address to respective physical pages may be indicated to a host system. A buffer may be configured based on the target packet size and data for an application at the host system and associated with the target packet size may be stored in the buffer. Based on a utilization threshold of the buffer being reached, a set of data stored in the buffer and having the target packet size may be written to a memory device, where a set of physical addresses for storing the set of data may be identified based on a second-level entry of a second-level page.

Abstract: Methods, systems, and devices for command prioritization techniques for reducing latency in a memory system are described. In some examples, a host system may receive a set of commands from one or more virtual machines to access a common memory system. The host system may store the set of command in a command queue associated with the memory system and arrange the set of command according to order that is based on one or more identified pattern of accessing sequential addresses in the set of commands. The host system may transmit the set of command to the memory system based on the order and the memory system may execute the commands according to the order.

Abstract: Methods, systems, and devices for environmental condition tracking for a memory system are described. A memory system may include one or more sensors (e.g., temperature sensors) for identifying a temperature of a memory device. For example, the sensor(s) may identify a first temperature of the memory device when performing a write operation on a memory cell and may identify a second temperature of the memory device when performing a read operation on the memory cell. The memory system may determine a performance characteristic of the memory device based on a correlation between the first temperature and the second temperature and may transmit the performance characteristic to a server.

Abstract: A method is provided for synchronizing timing in phase and frequency of clocks associated with a plurality of radio nodes (RNs) in a small cell radio access network (RAN) having an access controller operatively coupled to each of the RNs. In accordance with the method, a donor list is generated for each given RN in the RAN. The donor list represents an ordered list of potential wireless access points that are able to serve as a source of a wireless sync signal for the given RN. The donor lists are distributed to the respective RNs. An access point is selected by each of the RNs from their respective donor lists to use as a sync signal source. Each of the RNs synchronize their respective clocks in phase and frequency using wireless sync signals received from the respective selected access points.

Abstract: Disclosed herein are methods, computer readable media, and devices for performing software updates. In one embodiment, a method is disclosed comprising initializing a storage space of a secure storage device into a plurality of portions; copying an update program to a first portion in the portions and copying update data to a second portion of the portions; generating a first golden measurement for the first portion and a second golden measurement for the second portion; measuring the first portion; updating or rolling back an update to the secure device in response to determining that the measuring of the first portion does not match the first golden measurement of the first portion; and verifying an update operation upon determining that the measuring of the first portion matches the first golden measurement of the first portion.

Abstract: Methods, systems, and devices for a differential write operation are described. The operations described herein may be used to alter a portion of a program file from a first state to a second state. For example, a file (e.g., a patch file) that is associated with a signature may be received at a memory device. Based on an authentication process, the file may be used to alter the program file to the second state. In some examples, the program file may be altered to the second state using a buffer of the memory device. A host system may transmit a file that includes the difference between the first state and the second state. A signature may be associated with the file and may be used to authenticate the file.

Abstract: Session access to files in a file system mounted in a secure memory region in a secure memory device. In response to a request from an application to open a session for the file system to access the memory region, a secure command is sent to the memory device to install an access control key for the memory region. After storing a session key in a key repository, the application can call the operating system to access files in the file system. In response, the file system can generate access commands to be transmitted to the memory device. The session key stored in the key repository can be used to sign the access commands on behalf of the application. The memory device uses the access control key to validate the access commands signed using the session key prior to the execution of the access commands.

Abstract: Methods, systems, and devices for authenticating software images are described. A system may include one or more control units that use software images for managing different functions of the system. The system may also include a secure storage device configured to validate or authenticate the software images used by the different control units of the system. A software image of a control unit may be authenticated by generating a first hash associated with a portion of its underlying source code and generating a second hash associated with a corresponding portion of the source code of the copy of the software image stored to the secure storage device. Different patterns of the source code of the software images may be used to generate the hashes. The first hash and second hash may be compared, and the software image may be authenticated based on the hashes matching.

Abstract: A method is provided for synchronizing timing in phase and frequency of clocks associated with a plurality of radio nodes (RNs) in a small cell radio access network (RAN) having an access controller operatively coupled to each of the RNs. In accordance with the method, a donor list is generated for each given RN in the RAN. The donor list represents an ordered list of potential wireless access points that are able to serve as a source of a wireless sync signal for the given RN. The donor lists are distributed to the respective RNs. An access point is selected by each of the RNs from their respective donor lists to use as a sync signal source. Each of the RNs synchronize their respective clocks in phase and frequency using wireless sync signals received from the respective selected access points.

Abstract: A system, method and apparatus to record a file in a file system that is mounted in a secure section of a memory device. The memory device authenticates a requester to write data into secure section based on whether the requester is in possession of a cryptographic key. Nonprivileged modules of the operation system can write into a nonsecure section of the memory device. Requests to write or change a file can be recorded by nonprivileged modules into the nonsecure section for subsequent committing into the file system. In response to a request to commit the file, a security manager having the cryptographic key is called to identify, based on the records in the nonsecure section, data eligible to be written into the secure section. The security manager can generate commands, signed using the cryptographic key, to write the content of the file into the secure memory section.

Abstract: Methods, systems, and devices for security descriptor generation are described. An end device may be authenticated based on a certificate and a device key based on a security descriptor. The security descriptor may be generated based on publicly-available information such as time of day information, geographical information, or a default set of information. The security descriptor may be used for generation of a certificate accessible by a server used for authenticating the device and also may be used by an end device to generate a device key for verification by the server authenticating the device.

Abstract: Disclosed herein are methods, computer readable media, and devices for performing software updates. In one embodiment, a method is disclosed comprising initializing a storage space of a secure storage device into a plurality of portions; copying an update program to a first portion in the portions and copying update data to a second portion of the portions; generating a first golden measurement for the first portion and a second golden measurement for the second portion; measuring the first portion; updating or rolling back an update to the secure device in response to determining that the measuring of the first portion does not match the first golden measurement of the first portion; and verifying an update operation upon determining that the measuring of the first portion matches the first golden measurement of the first portion.

Abstract: Methods, systems, and devices associated with techniques for secure writes by non-privileged users are described. A memory device may be configured with one or more blocks of memory operating in a secure write mode. The memory device may receive an append command from a non-privileged user. The append command may indicate data to write to the block of memory at an address determined by the memory device. The memory device may identify a pointer to the address for storing the data within the block of memory. The memory device may write the data to a portion of the block of memory based on identifying the pointer and may update the pointer associated with the block of memory based on writing the data.

Abstract: Various examples are directed to systems and methods for programming memory. A programming appliance may receive a command file comprising a first pre-generated digital signature. The first pre-generated digital signature may be associated with a memory system, with a first command and with a first memory system counter value. The programming appliance may send to a memory system a first command message. The first command system may comprise the first command and the first pre-generated digital signature.

Abstract: A system, apparatus and method to provide vendor independent access to secure memory devices via an abstraction layer, which can be implemented via an operating system kernel and one or more utility programs. After receiving a request to perform a function, the abstraction layer uses parameters provided in the request to generate at least one first command in a format independent of a specification of the memory device. The at least one first command is provided to a device driver of the memory device identified in the request, causing the memory device to generate at least one second command to the memory device according to the specification of the memory device. The second command includes a signature generated using a portion of the second command; and the function is implemented by execution of the at least one second command in the memory device.

Abstract: Methods, systems, and devices for a differential write operation are described. The operations described herein may be used to alter a portion of a program file from a first state to a second state. For example, a file (e.g., a patch file) that is associated with a signature may be received at a memory device. Based on an authentication process, the file may be used to alter the program file to the second state. In some examples, the program file may be altered to the second state using a buffer of the memory device. A host system may transmit a file that includes the difference between the first state and the second state. A signature may be associated with the file and may be used to authenticate the file.

Abstract: Methods, systems, and devices for authenticating software images are described. Software images may include different portions (e.g., different versions, different users) that may be authenticated using hashes associated with an underlying data structure of the portion of the software image. In some examples, hashes (e.g., first hashes) associated with the software image may be generated and stored using a tree structure, such that a previous hash may be used when calculating a hash associated with a new portion of the software image. To authenticate a portion of the software image, a command may be issued, and a second hash may be calculated using the current data structure of the software image. The second hash may be compared to the associated first hash, and the software image may be authenticated based on the hashes matching.

Abstract: A system, method and apparatus to record a file in a file system that is mounted in a secure section of a memory device. The memory device authenticates a requester to write data into secure section based on whether the requester is in possession of a cryptographic key. Nonprivileged modules of the operation system can write into a nonsecure section of the memory device. Requests to write or change a file can be recorded by nonprivileged modules into the nonsecure section for subsequent committing into the file system. In response to a request to commit the file, a security manager having the cryptographic key is called to identify, based on the records in the nonsecure section, data eligible to be written into the secure section. The security manager can generate commands, signed using the cryptographic key, to write the content of the file into the secure memory section.