Abstract: Methods, systems, and devices for out-of-band authentication for multi-port memory systems are described. A multi-port memory system may grant host systems access to multiple ports of the memory system based on attestation with an authentication management controller that uses out of band (OOB) signaling to communicate with the memory system. For example, upon power up of the memory system, access to the memory system via the multiple ports may be limited, and some commands requested from host systems via the multiple ports may be denied. Increased access to the memory system via the multiple ports may be granted based on OOB signaling from the authentication management controller that attests each host system that is coupled with a respective port of the memory system. After a host system has been attested, the host system may be granted full access to a command set of the memory system.

Abstract: Methods, systems, and devices for port resource management within a multi-port memory system are described. A memory system may include multiple ports each coupled with one or more host systems. The memory system may receive a command defining a secure management port via an interface with a management controller or via another port. In some cases, the defined management port may be a dedicated port, or may be selected during one or more power-on procedures. The command may also indicate a quantity of ports to be activated, and may be based on an attestation of one or more host systems. In some examples, the memory system may use the management port to receive additional communications and commands. For example, the management port may receive and execute commands for resource allocation, additional configurations, sub-system operations including power management and reset, or for diagnostic functions, among other operations.

Abstract: Methods, systems, and devices for security function management within a multi-port memory system are described. A memory system may include multiple ports each coupled with one or more host systems. The memory system may receive a namespace configuration indicating an allocation of one or more logical block addresses (LBAs) to one or more of the ports. The memory system may further receive one or more requests for access to one or more LBA ranges, and may perform an authorization procedure to authorize a single entity to provision and unlock corresponding LBA ranges. In some examples, LBA ranges may be locked by default on bootup of the memory system. In some cases, host systems may request a management controller to coordinate authorization, or may request authorization from a memory system directly using one or more credentials or identifiers. Further, a management port may be indicated via one or more commands.

Abstract: Methods, systems, and devices for security management modes of a multi-port memory system are described. A multi-port memory system may be configured to operate according to one or more security modes that adjust access by host systems to the multiple ports of the memory system. For example, in a first mode, which may be referred to herein as a port security management mode, the memory system may restrict access by unauthenticated host systems to ports of the memory system, such that any unauthenticated host systems have no access to the memory system via the ports or are limited to a relatively primitive set of commands until the host systems are authenticated. In a second mode, which may be referred to herein as an operational mode, any host systems coupled with ports of the memory system are granted, without authentication, full access to a command set supported by the memory system.

Abstract: A processing device receives, from a host system, a key manifest and a digital signature generated based on the key manifest using a private key corresponding to a public/private key pair. The key manifest comprises one or more verification keys. The digital signature is verified using the public key and the processing device stores the key manifest in a persistent storage component in response to successful verification of the digital signature. The one or more verification keys are utilized in one or more verification operations based on the key manifest being stored in the persistent memory component.

Abstract: A processing device initializes a memory device in an unauthenticated state in which the memory device is unable to execute one or more restricted commands. The processing device accesses a security capsule that is digitally signed using a private key. The processing device transitions the memory device to an authenticated state based on verifying that the security capsule is validly signed. The processing device uses a public key corresponding to the private key to verify the security capsule is validly signed. While in the authenticated state, the memory device is able to execute the one or more restricted commands.

Abstract: A processing device is configured to process an initial set of command types. A command extension module and a digital signature are received. The digital signature is generated based on the command extension module using a private key of a key pair. The command extension module, once installed by the processing device, enables the processing device to process a new command type that is not included in the initial set of command types. The digital signature is verified using a public key of the key pair. Based on a successful verification of the digital signature, the command extension module is temporarily installed by loading the command extension module in a volatile memory device.

Abstract: A processing device receives, from a host system, a key manifest and a digital signature generated based on the key manifest using a private key corresponding to a public/private key pair. The key manifest comprises one or more verification keys. The digital signature is verified using the public key and the processing device stores the key manifest in a persistent storage component in response to successful verification of the digital signature. The one or more verification keys are utilized in one or more verification operations based on the key manifest being stored in the persistent memory component.

Abstract: A request for password generation is received from a host system. In response to receiving the request, a password derivation key is generated based on a key derivation seed. A password is derived from the password derivation key, and a wrapping key is derived from the password. The wrapping key is used to wrap an authorization state indication, which is stored in local memory. Encrypted data is generated based on an encryption of the key derivation seed using an asymmetric encryption key. The encrypted data is provided in response to the request.

Abstract: A request for password generation is received from a host system. In response to receiving the request, a password derivation key is generated based on a key derivation seed. A password is derived from the password derivation key, and a wrapping key is derived from the password. The wrapping key is used to wrap an authorization state indication, which is stored in local memory. Encrypted data is generated based on an encryption of the key derivation seed using an asymmetric encryption key. The encrypted data is provided in response to the request.

Abstract: A method includes receiving signaling indicative of performance of a sanitization operation to a processing device coupled to a memory device and applying a sanitization voltage to a plurality of memory blocks of the memory device. The sanitization voltage can be greater than an erase voltage of the plurality of memory blocks.

Abstract: A system includes a memory component and a processing device, operatively coupled with the memory component, to generate a physical presence security identification (PSID) for the memory component using a statistically random number generator. The processing device, operatively coupled with the memory component, can securely retrieve the PSID and revert the memory component to an original state using the PSID.

Abstract: A processing device is configured to process an initial set of command types. A command extension module and a digital signature are received. The digital signature is generated based on the command extension module using a private key of a key pair. The command extension module, once installed by the processing device, enables the processing device to process a new command type that is not included in the initial set of command types. The digital signature is verified using a public key of the key pair. Based on a successful verification of the digital signature, the command extension module is temporarily installed by loading the command extension module in a volatile memory device.

Abstract: A processing device initializes a memory device in an unauthenticated state in which the memory device is unable to execute one or more restricted commands. The processing device accesses a security capsule that is digitally signed using a private key. The processing device transitions the memory device to an authenticated state based on verifying that the security capsule is validly signed. The processing device uses a public key corresponding to the private key to verify the security capsule is validly signed. While in the authenticated state, the memory device is able to execute the one or more restricted commands.

Abstract: A processing device receives a command to arm a memory device for self-destruction. In response to the command, a self-destruction countdown timer is commenced. An expiry of the self-destruction countdown timer and based on detecting the expiry of the self-destruction countdown timer, data stored by the memory device is destructed.

Abstract: A method includes receiving signaling indicative of performance of a sanitization operation to a processing device coupled to a memory device and applying a sanitization voltage to a plurality of memory blocks of the memory device. The sanitization voltage can be greater than an erase voltage of the plurality of memory blocks.

Abstract: A processing device is configured to process an initial set of command types. A command extension module and a digital signature are received. The digital signature is generated based on the command extension module using a private key of a key pair. The command extension module, once installed by the processing device, enables the processing device to process a new command type that is not included in the initial set of command types. The digital signature is verified using a public key of the key pair. Based on a successful verification of the digital signature, the command extension module is temporarily installed by loading the command extension module in a volatile memory device.

Abstract: A processing device initializes a memory device in an unauthenticated state in which the memory device is unable to execute one or more restricted commands. The processing device accesses a security capsule that is digitally signed using a private key. The processing device transitions the memory device to an authenticated state based on verifying that the security capsule is validly signed. The processing device uses a public key corresponding to the private key to verify the security capsule is validly signed. While in the authenticated state, the memory device is able to execute the one or more restricted commands.

Abstract: A method includes identifying a target plane in respective planes of a memory die in a non-volatile memory array and identifying, from blocks of non-volatile memory cells coupled to a common bit line in the target plane, at least one target block in the target plane. The method further includes performing an operation to disable at least one gate associated with the at least one target block to prevent access to the blocks of non-volatile memory cells coupled to the common bit line in the target plane.

Abstract: A method includes receiving signaling indicative of performance of a sanitization operation to a processing device coupled to a memory device and applying a sanitization voltage to a plurality of memory blocks of the memory device. The sanitization voltage can be greater than an erase voltage of the plurality of memory blocks.