# US 10,372,629 B2 · Control for authenticated accesses to a memory device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,629 B2 - Document ID: US10372629B2 - Status: Granted - Kind: B2 - Application number: 15/705,597 - Filed: 2017-09-15 - Published: 2018-03-08 - Granted: 2019-08-06 - Earliest claimed: 2014-08-29 - Assignees: Memory Technologies LLC - Applicants: Memory Technologies LLC - Inventors: Kimmo J. Mylly - Web page: https://patentgrep.com/patent/US10372629B2 ## CPC - G06F 12/145: {the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism} - G06F 9/4403: {Processor initialisation} - G06F 21/44: Program or device authentication - G06F 21/575: {Secure boot} - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories - G06F 2212/1052: Security improvement - G06F 2212/2022: Flash memory - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The embodiments of the invention describe settings, commands, command signals, flags, attributes, parameters or the like for signed access prior to allowing data to be written to (e.g., a write access), read from (e.g., a read access) or erased from (e.g., an erase access) protected areas of a memory device (e.g., a region, logical unit, or a portion of memory in the storage module). ## Claims ### Claim 1 A memory device comprising: a plurality of addressable memory locations, each addressable memory location of the plurality of addressable memory locations having at least one memory cell, the plurality of addressable memory locations collectively forming a storage; and one or more controllers operable to: receive a request for a read access to a logical portion of the storage; read, as read data, data associated with the logical portion of the storage; determine, based at least in part on a configurable setting and as a determination, that signed access to the logical portion is enabled; sign, as signed data, the read data associated with the logical portion of the storage based at least in part on the determination that signed access to the logical portion is enabled; and cause the signed data to be sent at least partially in response to receiving the request for the read access. ### Claim 2 (depends on 1) The memory device according to claim 1, wherein the one or more controllers are further operable to use a key to sign the read data associated with the logical portion of the storage. ### Claim 3 (depends on 1) The memory device according to claim 1, wherein: the one or more controllers are further operable to use a nonce to sign the read data associated with the logical portion of the storage; and the nonce is received in association with the request for the read access. ### Claim 4 (depends on 1) The memory device according to claim 1, wherein the one or more controllers are further operable to check, based at least in part on the request for the read access, the at least one configurable setting in the memory device to determine that the signed access is specifically enabled for the logical portion of the storage prior to signing the read data associated with the logical portion of the storage. ### Claim 5 (depends on 1) The memory device according to claim 1, wherein the signed data comprises at least one of signed boot data, boot data, a signature, or a nonce. ### Claim 6 (depends on 1) The memory device according to claim 1, wherein the logical portion of the storage comprises one or more of a boot partition, a boot logical unit, a defined portion of a partition, a defined address, or a range of addresses of a partition or of a logical unit, from which the data can be read and sent at least partially in response to receiving the request. ### Claim 7 (depends on 1) The memory device according to claim 1, wherein the one or more controllers are further operable to receive a command to define the at least one configurable setting in the memory device so that it indicates that the signed access for the logical portion of the storage is enabled or disabled. ### Claim 8 (depends on 1) The memory device according to claim 1, wherein the one or more controllers are further operable to: cause a reply to be sent to a host device at least partially in response to receiving the request, the reply indicating the memory device is configured to sign the read data based at least in part on a parameter to be received from the host device; and receive the parameter from the host device at least partially in response to sending the reply. ### Claim 9 (depends on 8) The memory device according to claim 8, wherein the parameter comprises a nonce. ### Claim 10 (depends on 1) The memory device according to claim 1, wherein the memory device comprises one of a Universal Flash Storage (UFS) module or an embedded MultiMediaCard (eMMC). ### Claim 11 A method comprising: receiving, at a memory device, a request for a read access to a logical portion of a storage associated with the memory device; reading, as read data and by a controller of the memory device, data associated with the logical portion of the storage; determining, based at least in part on a configurable setting, that signed access to the logical portion is enabled; signing, as signed data and by the controller of the memory device, the read data associated with the logical portion of the storage based at least in part on the determining that signed access to the logical portion is enabled; and sending, by the memory device, the signed data at least partially in response to receiving the request for the read access. ### Claim 12 (depends on 11) The method according to claim 11, further comprising using a key to sign the read data associated with the logical portion of the storage. ### Claim 13 (depends on 11) The method according to claim 11, further comprising using a nonce to sign the read data associated with the logical portion of the storage, wherein the nonce is received in association with the request for the read access. ### Claim 14 (depends on 11) The method according to claim 11, further comprising checking, based at least in part on the request for the read access, the at least one configurable setting in the memory device to determine that the signed access is specifically enabled for the logical portion of the storage prior to signing the read data associated with the logical portion of the storage. ### Claim 15 (depends on 11) The method according to claim 11, wherein the signed data comprises at least one of signed boot data, boot data, a signature, or a nonce. ### Claim 16 (depends on 11) The method according to claim 11, wherein the logical portion of the storage comprises one or more of a boot partition, a boot logical unit, a defined portion of a partition, a defined address, or a range of addresses of a partition or of a logical unit, from which the data can be read and sent at least partially in response to receiving the request. ### Claim 17 (depends on 11) The method according to claim 11, further comprising receiving a command to define the at least one configurable setting stored in the memory device so that it indicates that the signed access for the logical portion of the storage is enabled or disabled. ### Claim 18 (depends on 11) The method according to claim 11, further comprising: sending, by the memory device, a reply to a host device at least partially in response to receiving the request, the reply indicating the memory device is configured to sign the read data based at least in part on a parameter to be received from the host device; and receiving, by the memory device, the parameter from the host device at least partially in response to sending the reply, wherein the parameter comprises a nonce. ### Claim 19 A host device comprising a controller operable to: send a request for a read access of a logical portion of a storage associated with a memory device; receive a reply from the memory device at least partially in response to sending the request, the reply indicating that the memory device is required, based at least in part on a configurable setting indicating that signed access to the logical portion is enabled, to sign the data based at least in part on a parameter to be received from the host device; send the parameter to the memory device at least partially in response to receiving the reply; receive signed data associated with the logical portion of the storage at least partially in response to sending the request for the read access; and use the signed data for signed booting of the host device. ### Claim 20 (depends on 19) the host device according to claim 19, wherein the parameter comprises a nonce.