Non-persistent unlock for secure memory

Apparatuses and methods related to implementing a non-persistent unlock state for secure memory. Implementing the non-persistent unlock state can include verifying whether an access command is authorized to access a protected region of a memory array. The authorization can be verified utilizing a key and a memory address corresponding to the access command. If an access command is authorized to access a protected region, then a row of the memory array corresponding to the access command can be activated following the placement of the protected region in a non-persistent unlocked mode. If the row of the memory array corresponding to the access command is activated, then the protected region can be placed on a locked mode.

TECHNICAL FIELD

The present disclosure relates generally to memory, and more particularly to apparatuses and methods associated with implementing a non-persistent unlock for secure memory.

BACKGROUND

Memory devices are typically provided as internal, semiconductor, integrated circuits in computers or other electronic devices. There are many different types of memory including volatile and non-volatile memory. Volatile memory can require power to maintain its data and includes random-access memory (RAM), dynamic random access memory (DRAM), and synchronous dynamic random access memory (SDRAM), among others. Non-volatile memory can provide persistent data by retaining stored data when not powered and can include NAND flash memory, NOR flash memory, read only memory (ROM), Electrically Erasable Programmable ROM (EEPROM), Erasable Programmable ROM (EPROM), and resistance variable memory such as phase change random access memory (PCRAM), resistive random access memory (RRAM), and magnetoresistive random access memory (MRAM), among others.

Memory is also utilized as volatile and non-volatile data storage for a wide range of electronic applications. including, but not limited to personal computers, portable memory sticks, digital cameras, cellular telephones, portable music players such as MP3 players, movie players, and other electronic devices. Memory cells can be arranged into arrays, with the arrays being used in memory devices.

Various computing systems include a number of processing resources that are coupled to memory (e.g., a memory system), which is accessed in association with executing a set of instructions (e.g., a program, applications, etc.). For various reasons, it can be desirable to prevent unauthorized access to memory (e.g., via read and/or write operations) or particular portions thereof. For instance, a memory system may store sensitive data (e.g., data desired to be kept secret, such as passwords, personal information, etc.).

DETAILED DESCRIPTION

The present disclosure includes apparatuses and methods related to implementing a non-persistent unlock state for secure memory. Access commands can be provided from a host to a memory device. The memory device may rely on the host for implementing security measures to prevent unauthorized access to the memory device. However, implementing security measures at the memory device may further improve security and may mitigate unauthorized memory accesses.

In various embodiments, a memory device can mitigate unauthorized memory accesses by verifying access commands as authorized utilizing credentials provided along with, or as part of, the access commands. The credentials can be stored in a plurality of registers implemented in the memory device prior to receipt of the access command (e.g., from a host). As used herein, an access command can include one or more commands. An access command can be one of a pre-charge command, an activate command, a read command, and/or a write command, among other possible commands. The access command can include one more commands including one or more of the pre-charge commands, the activate commands, the read command, and/or the write commands. In various embodiments, an access command can be propagated into a plurality of access commands. For example, an access command can be a read command which can be propagated into the access commands including a pre-charge command, an activate command, and a read command.

The authorization of an access command can be verified utilizing a key (e.g., credential(s)). The access command can request access to an address and/or a plurality of addresses. The memory device can determine whether the address is locked or unlocked based on a security mode associated with the address. If the address is locked, then the memory device can refrain from providing access to the address unless a key associated with the access command is also provided to the memory device. The key can be verified against a stored key to determine whether to unlock the address.

If the key matches the stored key, then the memory device can unlock the address and can provide access to the address(es). If the key does not match the stored key, then the memory device can refrain from providing access to the address(es).

In various examples, an initial authorized access command can result in an unlocking of a protected region of memory to allow access thereto (e.g., to a physical row). However, the protected region may not be re-locked until after a number of access commands have been executed, leaving the protected region in what may be referred to as a persistent unlocked state. While the protected region is unlocked, access commands may be capable of accessing the protected region (e.g., without having to be verified using a key).

A security feature, in accordance with a number of embodiments of the present disclosure, can include implementing a non-persistent unlocked state for the memory. As described further herein, a protected region of memory can be referred to as being in a non-persistent unlocked state when each access attempt (e.g., access command) is verified prior to being executed such that the protected region is not left in an unlocked state. For example, in a non-persistent unlocked state a key associated with each access command may be checked prior to granting access to a protected region of the memory by the command.

Implementing security measures at a memory device to prevent unauthorized access can increase the security of the memory device beyond the security which may be provided by a host. For example, unauthorized access commands may be prevented from accessing the memory device by security measures implemented at a host as well as by security measures implemented at a memory device.

In various examples, unauthorized access attempts can be detected, and data can be protected based on the detection. A security mode corresponding to a protected region of a memory array storing the data can be modified responsive to the detection of the unauthorized access attempts. The protected region can be placed in a first security mode from a second security mode where the first security mode is a more heightened security mode than the second security mode. The data can be moved to a different protection region and/or an unprotected region responsive to the detection of the unauthorized access attempts. In various examples, a power status of a computing device comprising the memory array can be modified responsive to the detection of the unauthorized access attempts. The computing device can be shut down or placed in a sleep state. Responsive to detecting the unauthorized access attempts, the memory device targeted by the access attempt or the computing device comprising the memory device can be locked to prevent access to the memory device and/or the computing device.

As used herein, “a number of” something can refer to one or more of such things. For example, a number of memory devices can refer to one or more memory devices. A “plurality” of something intends two or more. Additionally, designators such as “N,” as used herein, particularly with respect to reference numerals in the drawings, indicates that a number of the particular feature so designated can be included with a number of embodiments of the present disclosure.

The figures herein follow a numbering convention in which the first digit or digits correspond to the drawing figure number and the remaining digits identify an element or component in the drawing. Similar elements or components between different figures may be identified by the use of similar digits. As will be appreciated, elements shown in the various embodiments herein can be added, exchanged, and/or eliminated so as to provide a number of additional embodiments of the present disclosure. In addition, the proportion and the relative scale of the elements provided in the figures are intended to illustrate various embodiments of the present disclosure and are not to be used in a limiting sense.

FIG. 1is a block diagram of an apparatus in the form of a computing system100including a memory device120in accordance with a number of embodiments of the present disclosure. As used herein, a memory device120, a memory array130, and/or host110, for example, might also be separately considered an “apparatus.”

In this example, system100includes a host110coupled to memory device120via an interface156. The computing system100can be a personal laptop computer, a desktop computer, a digital camera, a mobile telephone, a memory card reader, or an Internet-of-Things (IoT) enabled device, among various other types of systems. Host110can include a number of processing resources (e.g., one or more processors, microprocessors, or some other type of controlling circuitry) capable of accessing memory120. The system100can include separate integrated circuits, or both the host110and the memory device120can be on the same integrated circuit. For example, the host110may be a system controller of a memory system comprising multiple memory devices120, with the system controller110providing access to the respective memory devices120by another processing resource such as a central processing unit (CPU).

In the example shown inFIG. 1, the host110is responsible for executing an operating system (OS)103and/or various applications that can be loaded thereto (e.g., from memory device120via controller140). The host110may not be responsible for managing keys or addresses that define the protected region. The host110can provide access commands and/or security mode initialization commands to a memory device via the interface156. In various examples, the memory device may provide an indication of an unauthorized access attempt. In various embodiments, the unauthorized access attempt can result in providing data to the host such that the issuer of the unauthorized access attempt is not notified of the memory device's identification of the unauthorized access attempt. The data received from the memory device120may not be the data stored by the memory cells having the address provided by the access command. The host110may receive data generated responsive to identifying the access command as unauthorized.

For clarity, the system100has been simplified to focus on features with particular relevance to the present disclosure. The memory array130can be a DRAM array, SRAM array, STT RAM array, PCRAM array, TRAM array, RRAM array, NAND flash array, and/or NOR flash array, for instance. The array130can comprise memory cells arranged in rows coupled by access lines (which may be referred to herein as word lines or select lines) and columns coupled by sense lines (which may be referred to herein as digit lines or data lines). Although a single array130is shown inFIG. 1, embodiments are not so limited. For instance, memory device120may include a number of arrays130(e.g., a number of banks of DRAM cells).

The memory device120includes address circuitry142to latch address signals provided over an interface156. The interface can include, for example, a physical interface employing a suitable protocol (e.g., a data bus, an address bus, and a command bus, or a combined data/address/command bus). Such protocol may be custom or proprietary, or the interface156may employ a standardized protocol, such as Peripheral Component Interconnect Express (PCIe), Gen-Z, CCIX, or the like. Address signals are received and decoded by a row decoder146and a column decoder152to access the memory array130. Data can be read from memory array130by sensing voltage and/or current changes on the sense lines using sensing circuitry150. The sensing circuitry150can comprise, for example, sense amplifiers that can read and latch a page (e.g., row) of data from the memory array130. The I/O circuitry144can be used for bi-directional data communication with host110over the interface156. The read/write circuitry148is used to write data to the memory array130or read data from the memory array130. As an example, the circuitry148can comprise various drivers, latch circuitry, etc.

Controller140decodes signals provided by the host110. These signals can include chip enable signals, write enable signals, and address latch signals that are used to control operations performed on the memory array130, including data read, data write, and data erase operations. In various embodiments, the controller140is responsible for executing instructions from the host110. The controller140can comprise a state machine, a sequencer, and/or some other type of control circuitry, which may be implemented in the form of hardware, firmware, or software, or any combination of the three.

In accordance with various embodiments, the controller140can be configured to decode a security mode initialization command received thereto. The security mode initialization command can be received from the host110. The security mode initialization command can be provided to the memory device120to set a security mode of the memory device120and/or to designate one or more protected regions of the memory device120. A security mode can include a locked mode and an unlocked mode. The memory device120can be configured to provide access to a protected region of the memory array130if the memory device120is in an unlocked mode or to prevent access to the protected region of the memory array130if the memory device120is in a locked mode.

The OS103, as executed by the host110, can initialize the security mode initialization command to store a key and an address or a range of addresses of the memory array130in one or more registers of the controller140. The stored key and address can define the protected region of the memory array130. The OS103can initialize the security mode initialization command during an initialization of the OS103or a time after the OS103is initialized.

The address received form the host110can be a logical address. A logical address can be translated, mapped, or resolved to a physical address. A logical address can include a virtual address, for example. The physical address may be used by the memory device130to access data from a memory array130. The physical address can be directly mapped to a memory cells or row of the memory array130. The logical address corresponding to the initialization command and/or access commands and received from the host110can be translated by the memory device120to generate the physical address. The physical address can be a physical row address of the memory array130.

The key can be a security token used to gain access to a protected region of the memory array130. The key can be encrypted or unencrypted. The key can be provided by the OS103and used by the OS103to access the protected region of the memory array130. The key can be unique to a protected region of memory and/or can be associated with a plurality of protected regions of memory. As described further below, the key can comprise one or more bits which can be stored in one or more registers of the memory device120.

The protected region of the memory array130describes a region of the memory array130that is protected using the key. The protected range can be defined by a first memory address and a second memory address. The first memory address can be a starting address and the second memory address can be an ending address. In various examples, the protected range is stored as a starting address and as an offset. The offset together with the starting address can be used to generate the ending address. The protected region can be continuous from the starting address to the ending address.

In various examples, the memory array130can comprise one or more protected regions. Each of the protected regions can be defined using a starting address and an offset. Each of the starting addresses corresponding to a different protected region can be unique and/or can be a same starting address. Each of the offsets can also be a same offset or a different offset.

In various instances, the host110can provide an access command and/or a plurality of access commands to the memory device120. Access commands can be provided to access a protected region of the memory device120. The access command can be associated with an address or a range of addresses and a key. The memory device120can compare the provided address to a protected range to determine whether the address is within the protected range. If the address is within the protected range, the memory device120can compare the key with a stored key to determine whether the key and the stored key match. If the key matches the stored key, then the memory device can enter a non-persistent unlocked mode from a locked mode. The memory device120can, via the controller140, enable a row driver to activate a row of the memory array130corresponding to the address (e.g., protected region). Responsive to enabling the row driver, the memory device120can transition the protected region from a non-persistent unlocked mode to a locked mode. If the key does not match, the memory device120can, via the controller140, prevent access to the protected region by preventing enablement of the row driver147of the memory array130, thus preventing activation of a row corresponding to the access command.

FIG. 2is a block diagram of an apparatus in the form of a memory device220including a memory array230and portions of a controller capable of protecting regions of memory using a key in accordance with a number of embodiments of the present disclosure. The memory device220can be analogous to the memory device120inFIG. 1. The memory device220includes the memory array230and portions of a controller such as the controller140inFIG. 1.

The controller can include a command decoder221, mode registers224, a key register226, protected region registers228, and an access counter register231. The controller can also include the address match unit222and a key match unit223.

In this example, the interface (e.g.,156shown inFIG. 1) comprises an address bus256-1, a command bus256-2, and a data bus256-3. The device220can receive the security mode initialization command and/or access commands along with keys via the command bus256-2. The device220can receive addresses via the address bus256-1, and data can be provided to/from the device220via the data bus256-3.

A host can provide, via the command bus256-2, the security mode initialization command to initialize a security mode of the memory device220. The memory device220can receive the security mode initialization command at the command decoder221. The command decoder220can decode the security mode initialization command.

In various examples, the security mode initialization command can be associated with a key and a number of addresses received via the command bus256-2and the address bus256-1. The controller can store a key in the key register226and can store the one or more addresses in the protected region registers228. Each of the mode registers224, the key registers226, the protected region registers228, and/or the access counter register231can be comprised of one or more registers.

The one or more addresses can be stored in the protected region registers228as a starting address and an offset. The starting address can be stored in a first register of the protected regions registers228and the offset can be stored in a second register of the protected region registers228. The starting address and the ending address can define a protected region of the memory array230which can be stored in the protected region register228.

The key can be stored in the key register226. In various examples, a plurality of keys can be stored in one or more key registers including the key register226. Each of the plurality of keys can be associated with a different one of the plurality of protected regions stored in the protected region registers including the protected region register228. The plurality of keys can be used to allow access to the protected regions. For example, a first key can be used to allow access to a first protected region and a second key can be used to allow access to a second protected region.

Responsive to storing the key in the key register226and the address in the protected region register228, the controller can change a security mode of the memory device220from an unlocked mode (e.g., persistent unlocked mode) to a locked mode in the mode registers224. The mode registers224can include a security mode register. The security mode register can store a first value representing a persistent unlocked mode, a second value representing a non-persistent unlocked mode, and/or a third value representing a locked mode, among other possible modes. The locked mode can be used to prevent access to a protected region of the memory array230. A persistent unlocked mode can be used to allow a plurality of instances of access to a protected region of the memory array230where a first access is provided contingent on a first key and the reminding instances of access are provided without verifying additional keys. A non-persistent unlocked mode can be used to allow a plurality of instances of access to the protected region of the memory array230where each instance of access is provided contingent on the verification of a different instance of a same key. In a non-persistent unlocked mode, each instance of access is followed by placing the protected region in a locked mode.

In various examples, responsive to receipt of the security mode initialization command, the controller can set or reset an access counter register231. For example, the access counter register231can be set to zero. The access counter register231can provide a count of unauthorized access commands directed to the protected region of the memory array230(e.g., as defined by protected region register228).

The controller can also process access commands. For example, an access command received via the command bus256-2can be decoded by the command decoder221. The address match unit222can receive an address corresponding to the access command at the address match unit222of the controller. The address match unit222can determine whether the received address is within a protected region (e.g., as stored in the protected region register228).

If the received address is in a protected region, then the controller, via the key match unit223, can determine whether the key associated with the access command matches a key stored in the key register226. If the key associated with the access command matches the key stored in the key register226, then the controller can modify the mode registers224from a locked mode to a non-persistent unlocked mode.

The controller can provide a signal to the row drivers247to activate a row corresponding to the received address if the mode registers224reflect an unlocked mode (e.g., non-persistent unlocked mode or persistent unlocked mode). The controller can prevent a signal from being provided to the row drivers247if the mode registers224reflect a locked mode. Although the row drivers247are shown as being in the memory array230, the row drivers247can also be implemented externally to the memory array230as shown inFIG. 1.

Responsive to providing a signal to the row drivers247while the protected region is in an un-persistent unlocked mode, the controller can place the protected region in a locked mode. In various embodiments, responsive to providing a signal to the row drivers247while the protected region is in a persistent unlocked mode, the controller may refrain from placing the protected region in the locked mode. In various examples, the controller may refrain from placing the protected region in the locked mode until a plurality of associated access sum-commands have been processed. For example, the controller may refrain from placing the protected region in the locked mode until a pre-charge command, an activate command, and a read command or a write command (e.g., access commands) have been processed by the controller.

An access command can be unauthorized if the key corresponding to the access command does not match a key stored in the key register226. A key associated with the access command can be determined to not match a key stored in the key register226if no key is associated with the access command or if the key associated with the access command226does not have the same value as the key stored in key register226. In some examples, a mismatch of the keys can be determined if the key stored in the key register226cannot be derived from the key associated with the access command. A key stored in the key register226can be derived from the key associated with the access command through an encryption process and/or a decryption process. In some instances, a key can be encrypted before being stored in the key register226. The key associated with the access command may be unencrypted. Comparing an encrypted key with an unencrypted key can include decrypted an encrypted key and comparing the decrypted key with the unencrypted key. The encrypted key can be derived from the unencrypted key if the decrypted key matches the unencrypted key.

FIG. 3illustrates an example flow diagram of a method for accessing a protected region of a memory array in accordance with a number of embodiments of the present disclosure. At351, the access command that has the key gains access to the protected region. The access command can be provided by a program that is being executed by the host such as an application process, an OS, a hypervisor, and/or a virtual machine (VM). For example, the access command can be provided by an OS and/or a different application, among other possible processes. The access command can be authorized upon verifying that a key associated with the access command and provided by a process matches a stored key in the key register.

At353, the enablement bit flag can be flipped. The enablement bit flag can be stored in a security mode register show inFIG. 2as one of the mode registers224. The enablement bit flag can be flipped from a locked mode to a non-persistent unlocked mode. At355, the authorized process can read from the protected region of memory. The access command can be a read command or a write command, among other possible access commands. The controller can prevent enabling a row driver from activating a row responsive to the enablement bit flag indicating the locked mode, where the row corresponds to a received address associated with the access command. For example, the controller can prevent any row driver enablement when the mode bit indicated that a secured memory region is locked. In various examples, the controller can set the security mode register to a locked mode responsive to enabling the row driver and responsive to a prior state of the security mode register being a non-persistent locked mode. In other examples, the controller can reframe from setting the security mode register to a locked mode responsive to enabling the row driver and responsive to a prior state of the security mode register being a persistent locked mode. In a different embodiment, the controller can set the security mode register to a locked mode responsive to enabling the row driver and regardless of whether the prior state of the security mode register was a non-persistent locked mode or a persistent locked mode.

At357, the authorized process can conclude reading from the protected region. At359, the controller can return the enablement bit flag to its original value. For example, the enablement bit flag can be returned to a locked mode.

In various embodiments, an OS, hypervisor, and/or virtual machine can initiate a security mode initialization command. The security mode initialization command can be provided by the OS to define a protected region of a memory array and to associate a key with the protected region.

Defining a protected region utilizing the security mode initialization command provides the OS flexibility. The OS can have flexibility to define the size and content of a protected region of the memory array. For example, the OS can define the protected region as comprising a first size or a second size, among a number of other sizes. The OS can activate a security mode by providing the security mode initialization command or can refrain from activating the security mode by refraining from providing the security mode initialization command to the memory device.

A memory device can function in a security mode or without the security mode based on the OS's selection. Further, the OS can define a size or location of the protected region after the protected region has been initialized. For example, after initialization of a security mode, the OS can increase the size of the protected region or decrease the size of the protected region. After initialization of a security mode, the OS can also change a base address of the protected region and/or an offset of the protected region. The OS can also exit the security mode after the memory device has been placed in the security mode. For example, the OS can store a predefined value in the protected region registers. The OS can store a zero as a base address and/or an offset of the protected region to exit the security mode.

The OS can utilize an application programming interface (API) to generate the security mode initialization command and/or an access command used to define and/or access a protected region of the memory array. The OS can comply with the security features of the memory device utilizing the API.

In various examples, the security mode initialization command can be generated by the OS and/or received by the memory device as part of an initialization process of a computing device and/or the OS. The memory device can store a key in a key register responsive to receiving the security mode initialization command. The memory device can store an address of a memory device in a protected region register. The memory device can set a mode register based on the storing of the key and/or the storing of the address. The mode register can identify whether a region of the memory array is protected. The memory device can set the mode register to a locked mode. The locked mode can be a protected mode. The mode register can also be set to a persistent unlocked mode or a non-persistent unlocked mode.

FIG. 4illustrates an example flow diagram of a method for accessing a protected region of a memory array in accordance with a number of embodiments of the present disclosure. The method can be executed by a memory device of a computing system.

At460, a memory device can receive a command comprising an indication of an address of a memory array to access. At462, a determination can be made, based at least in part on the indication in the command, as to whether the address is within a protected region of the memory arrays as indicated by a protected region register. The address can be within the protected region if the address is greater than a starting address of the protected region but less than the ending address of the protected region. In various examples, the access command can be associated with a plurality of addresses to access. The plurality of addresses can be within the protected region if at least one of the plurality of addresses is greater than a starting address and at least one of the of the plurality of addresses is less than the ending address of the protected region.

At464, responsive to determining that the address is within the protected region, the controller can determine whether a received key associated with the access command matches a key stored in a key register of the memory device. The received key can match the stored key if the received key is equal to the stored key or if the received key is substantially equal to the stored key. The received key can be substantially equal to the stored key if the stored key can be derived from the received key.

At468, responsive to determining that the received key matches the stored key, the controller can set a mode register to a first mode (e.g., a non-persistent unlocked mode) to allow a row driver to activate. The memory device can allow access to the address by providing the data stored at memory cells having the address to the host. Access can be allowed by allowing an activation of a row of the array corresponding to the address. The method can further allow activation of a row to which the address corresponds by switching an access enable flag from a second state to a first state, wherein rows corresponding to addresses within the protected region are not activatable unless the access enable flag is in the first state. The first state (e.g., first mode) can correspond to the non-persistent unlocked mode. The second state (e.g., second mode) can correspond to a locked mode.

At470, responsive to activating the row driver, the mode register can be set to e.g., second mode (e.g., a locked mode) to prevent the row driver from being activated by different access commands. The mode register can be set to a second mode to prevent the row driver from being activated by different access commands regardless of whether the different access commands are associated with the authenticated access command. For example, the authenticated access command can be an activate command and a different access command can be a read command.

The mode register can be set to the first mode to allow the row driver to activate a row of the memory array corresponding to the address. The mode register can be set to the second mode responsive to activating the row of the memory array.

In various examples, a different access command to the address can be received, wherein the different access command is associated with a third key. The third key can be independent of the second key. For example, the third key can be provided independently of the second key and can correspond uniquely to the different access command. A controller can determine whether the address is within the protected region of the memory array as indicated by the protected region register. Responsive to determining that the address is within the protected region, the controller can determine whether the third key associated with the different access command matches the second key stored in the key register of the memory device. Responsive to determining that the third key matches the second key, the controller can set the mode register to the first mode to allow the row driver to activate. Responsive to activating the row driver, the controller can set the mode register to the second mode to prevent the row driver from being activated. Each access command can be authenticated independently and the protected region of the array can be set to a second mode before a different access command is processed by a controller.

In various examples, the mode register can be set to a second mode if the address is not within the protected region or if the key does not match the second key. The mode register can be set to a second mode even if the mode register was already in a second mode. In other examples, the controller can refrain from modifying the mode register if the address is not within the protected region or the key does not match the second key.

In various embodiments, a different access command to an activated row can be received at a memory device, where the different access command is associated with the address. The controller can determine whether the address is within the protected region of the memory array as indicated by the protected region register. Responsive to determining that the address is within the protected region, the controller can determine whether the third key associated with the different access command matches the second key stored in the key register of the memory device. Responsive to determining that the third key matches the second key, the controller can set the mode register to the first mode to allow the row driver to activate. Responsive to activating the row driver, the controller can set the mode register to the second mode to prevent the row driver from being activated. Access commands, that are received and/or processed while a targeted row of the array is activated, can be authenticated prior to processing the access commands.

In various examples, a second access command that was generated from the propagation of a first access command can be authenticated prior to processing the second access command. Responsive to receiving the access command from the host, the controller can determine whether an address corresponding to the access command is in a protected region of the memory. Responsive to determining that the address is in the protected region, the controller can determine whether a stored key corresponding to the access command matches a received key stored in a key register of the memory device. Responsive to determining that the stored key matches the received key, the access command can be propagated into a plurality of access commands. For example, a read command (e.g., access command) can be propagated into a pre-charge command, an activate command, and a read command (e.g., access commands). The write command (e.g., access command) can be propagated into a pre-charge command, an activate command, and a write command (e.g., access commands). The plurality of access command can be processed based on the authentication of the access command.

In various examples, memory utilizing board side addressing can propagate access commands from an access command. Some examples of memory that utilize broad side addressing include reduced latency dynamic random-access memory (RLDRAM), hybrid memory cube (HMC) memory, and static random-access memory (SRAM), among other examples of memory that utilize board side addressing.

Responsive to determining that the stored key does not match the received key, a memory device may refrain from propagating the access command. By not propagating the access command, the access command is not processed to conclusion and the access to the protected region of the memory device is rejected given that the propagated access commands were not created.

In propagating the access command, the address and/or the key corresponding to the access command can be associated with each of the propagated access commands. Responsive to determining that the address is in the protected region, a memory device can determine whether the received key associated with each of the plurality of access commands matches the stored key. The memory device can be configured to, prior to processing each of the plurality of access commands, set a mode register to a first mode to allow for a row decoder to activate rows of the memory array based on whether the received key associated with each of the plurality of access commands matches the stored key.

Responsive to activating a row of the memory array as part of the processing of the plurality of access commands, the memory device can set the mode register to a second mode to prevent the row decoder from activating rows of the memory array. As such, the mode register can be set to a first mode prior to providing access to the protected region for each of the plurality of access commands. The mode register can also be set to a second mode following access to the protected region for each of the plurality of access commands. That is, after processing each of the plurality of access commands, the memory device can set the mode register to a second mode to prevent the row decoder from activating a row of the memory array by other access commands from the plurality of access commands or by access commands not propagated from the access command.

In various examples, the memory device can further be configured to, responsive to determining that the received key does not match the stored key, set a mode register to a second mode to prevent a row decoder from activating a row of the memory array in view of the access command. If the received key does not match the stored key, the access command may not be propagated and the mode register may be placed in a second mode.

The plurality of access commands can be accessed sequentially regardless of whether the access commands were or were not propagated from an access command. Providing sequential access can include providing a first access to a protected region of memory in conjunction with the processing of a first access command prior to providing a second access to a protected region of the memory in conjunction with the processing of a second access command. Each access command can be authenticated before access to a protected region is granted and different instances of access to a protected region may not be simultaneously granted.

FIG. 5illustrates an example machine of a computer system540within which a set of instructions, for causing the machine to perform any one or more of the methodologies discussed herein, can be executed. In various embodiments, the computer system540can correspond to a host system (e.g., the system110ofFIG. 1) that includes, is coupled to, or utilizes a memory sub-system (e.g., the memory device120ofFIG. 1) or can be used to perform the operations of a controller (e.g., the controller140ofFIG. 1, including the register224,226,228, and231ofFIG. 2). In alternative embodiments, the machine can be connected (e.g., networked) to other machines in a LAN, an intranet, an extranet, and/or the Internet. The machine can operate in the capacity of a server or a client machine in client-server network environment, as a peer machine in a peer-to-peer (or distributed) network environment, or as a server or a client machine in a cloud computing infrastructure or environment.