# US 10,482,039 B2 · Method and device for protecting dynamic random access memory > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,039 B2 - Document ID: US10482039B2 - Status: Granted - Kind: B2 - Application number: 15/068,657 - Filed: 2016-03-14 - Published: 2017-06-29 - Granted: 2019-11-19 - Earliest claimed: 2015-12-29 - Assignees: Montage Technology Co., Ltd. - Applicants: Montage Technology (Shanghai) Co., Ltd. - Inventors: Shuna Xu; Guobing Mo; Cheng-Tie Chen - Web page: https://patentgrep.com/patent/US10482039B2 ## CPC - G06F 12/1483: {using an access-table, e.g. matrix or list} - G06F 12/0292: {using tables or multilevel address translation means (G06F12/023 takes precedence; address translation in virtual memory systems G06F12/10)} - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode - G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories - G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00) - G06F 2212/1052: Security improvement - G06F 2212/20: Employing a main memory using a specific memory technology - G06F 2212/402: Encrypted data - H04L 2209/60: Digital content management, e.g. content distribution - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for DRAM protection comprises allocating address spaces respectively for a first and second common region, a first and second secure region; detecting whether common data has an address within the address spaces for the first secure region; outputting a digital signal remapping an address of the common data to the address space for the second common region if yes; detecting whether secure data has an address within the address spaces for the first common region; outputting a digital signal indicating remapping an address of the secure data to the address space for the second secure region if yes. Alternatively, the method further comprises generating a random key; an updated written data by permuting orders of bits of an original DRAM written data; generating an encrypted data by performing a function on the updated written data with the generated random key; and dynamically updating the generated random key. ## Claims ### Claim 1 A method for Dynamic Random Access Memory (DRAM) protection, comprising: allocating address spaces respectively for a first common region, a second common region, a first secure region and a second secure region; detecting whether common data has an address within the address spaces for the first secure region; outputting a digital signal indicating remapping the address of the common data to an address space for the second common region if the common data has the address within the address spaces for the first secure region; detecting whether secure data has an address within the address spaces for the first common region; outputting a digital signal indicating remapping the address of the secure data to an address space for the second secure region if the secure data has the address within the address spaces for the first common region; maintaining a first table and a second table for both a first map between the address of the common data to the address space for the second common region, and a second map between the address of the secure data to the address space for the second secure region, wherein the first table is currently being used, and the second table is idle; updating the second table with an updated first map and the second map; and when the updated of the second table is completed, directly using the second table when updating the first table. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining whether a device is enabled to remap addresses; if the device is not enabled to remap address, keep an original address of the common data or an original address of the secure data that the device is to access; and if the device is enabled to remap address, remapping an address of the common data to the address space for the second common region if the common data has the address within the address spaces for the first secure region; or remapping an address of the secure data to the address space for the second secure region if the secure data has the address within the address spaces for the first common region. ### Claim 3 (depends on 1) The method of claim 1, wherein detecting whether the common data has the address within the address spaces for the first secure region or detecting whether the secure data has the address within the address spaces for the first common region is implemented using binary search. ### Claim 4 (depends on 1) The method of claim 1, further comprising: configuring a device ID and a transaction type for a device that access the address; and determining whether the device is allowed to access the address according to the transaction type and the device ID by comparing with an authorization table. ### Claim 5 (depends on 1) A method of claim 1, further comprising: generating a decrypted read data by performing a reverse function on a read data using a random key; and generating a plain read data by reverse permuting orders of bits of the decrypted data. ### Claim 6 A device for Dynamic Random Access Memory (DRAM) protection, comprising: one or more processors that execute a program to function as: an allocating circuit, configured to allocate address spaces respectively for a first common region, a second common region, a first secure region and a second secure region; a detector configured to detect whether common data has an address within the address spaces for the first secure region; a remapping circuit configured to remap the address of the common data to an address space for the second common region if the common data has the address within the address spaces for the first secure region, wherein the detector is further configured to detect whether secure data has an address within the address spaces for the first common region, and the remapping circuit is further configured to: remap the address of the secure data to an address space for the second secure region if the secure data has an address within the address spaces for the first common region; maintain a first table and a second table for both a first map between the address of the common data to the address space for the second common region, and a second map between the address of the secure data to the address space for the second secure region, wherein the first table is currently being used, and the second table is idle; update the second table with an updated first map and the second map; and when the updated of the second table is completed, directly use the second table to update the first table. ### Claim 7 (depends on 6) The device of claim 6, wherein the one or more processors execute a program to function as: a determining circuit, configured to determine whether a device is enabled to remap address, wherein the remapping circuit is further configured to, if the device is not enabled to remap address, keep an original address of the common data or an original address of the secure data that the device is to access, and if the device is enabled to remap addresses, the remapping circuit is further activated to: remap an address of the common data to the address space for the second common region if the common data has the address within the address spaces for the first secure region; or remap an address of the secure data to the address space for the second secure region if the secure data has the address within the address spaces for the first common region. ### Claim 8 (depends on 6) The device of claim 6, wherein the detector detects whether the common data has the address within the address spaces for the first secure region or detecting whether the secure data has the address within the address spaces for the first common region using binary search. ### Claim 9 (depends on 6) The device of claim 6, wherein the allocating circuit is further configured to configure a device ID and a transaction type for a device that access the address, and the determining circuit is further configured to determine whether the device is allowed to access the address according to the transaction type and the device ID by comparing with an authorization table. ### Claim 10 (depends on 6) A device according to claim 6, wherein the one or more processors execute a program to function as: a second data generator configured to generate a decrypted read data by performing a reverse function on a read data using a random key, wherein the second data generator is further configured to generate a plain read data by reverse permuting orders of bits of the decrypted data. ### Claim 11 (depends on 10) The device of claim 10, wherein the one or more processors execute a program to function as: a second updating circuit configured to dynamically update the generated random key according to time, when there is no request for accessing the DRAM. ### Claim 12 (depends on 1) The method of claim 1, further comprising: generating a random key; generating an updated written data by permuting orders of bits of an original DRAM written data; generating an encrypted data by performing a function on used updated written data with the generated random key; and dynamically updating used random key according to time, when there is no request for accessing the DRAM. ### Claim 13 (depends on 6) The device of claim 6, further comprising: a key generator configured to generate a random key; a first data generator configured to: generate an updated written data by permuting orders of bits of an original DRAM written data; and generate an encrypted data by performing a function on the updated written data with used generated random key; and a first updating circuit configured to dynamically update the used random key according to time, when there is no request for accessing the DRAM. ### Claim 14 (depends on 12) The method of claim 12, further comprising: dynamically updating the random key in a predetermined time interval; and encrypting data with the updated random key. ### Claim 15 (depends on 13) The device of claim 13, wherein the updating circuit is further configured to: dynamically update the random key in a predetermined time interval; and the device further comprises an encrypting circuit configured to encrypt data with the updated random key.