# US 11,907,559 B1 · Physically secure memory partitioning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,559 B1 - Document ID: US11907559B1 - Status: Granted - Kind: B1 - Application number: 17/883,651 - Filed: 2022-08-09 - Published: 2024-02-15 - Granted: 2024-02-20 - Earliest claimed: 2022-08-09 - Assignees: Winbond Electronics Corp. - Applicants: Winbond Electronics Corporation - Inventors: Itay Admon; Uri Kaluzhny; Nir Tasher - Web page: https://patentgrep.com/patent/US11907559B1 ## CPC - G06F 3/0644: {Management of space entities, e.g. partitions, extents, pools} - G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories - G06F 3/0622: {in relation to access} - G06F 11/1044: {with specific ECC/EDC distribution} - G06F 11/1048: {using arrangements adapted for a specific error detection or correction feature} - G06F 12/1441: {for a range} - G06F 3/0679: {Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]} - G06F 12/1433: {for a module or a part of a module} - G06F 2212/1052: Security improvement - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A memory device includes a memory, a secure-access circuit, a plain-access circuit, and protection hardware. The memory includes at least a secure-storage partition assigned a first address range and a plain-storage partition assigned a second address range, disjoint from the first address range. The secure-access circuit is configured to access the secure-storage partition by generating addresses in the first address range. The plain-access circuit is configured to access the plain-storage partition by generating addresses in the second address range. The protection hardware is configured to prevent the plain-access circuit from accessing the first address range assigned to the secure-storage partition. ## Claims ### Claim 1 A memory device, comprising: a memory, comprising at least (i) a secure-storage partition assigned a first address range and (ii) a plain-storage partition assigned a second address range, disjoint from the first address range; a secure-access circuit, configured to access the secure-storage partition by generating addresses in the first address range; a plain-access circuit, configured to access the plain-storage partition by generating addresses in the second address range; and protection hardware, configured to prevent the plain-access circuit from accessing the first address range assigned to the secure-storage partition. ### Claim 2 (depends on 1) The memory device according to claim 1, wherein the protection hardware is configured to prevent the plain-access circuit from generating addresses in the first address range assigned to the secure-storage partition. ### Claim 3 (depends on 1) The memory device according to claim 1, wherein: the first address range comprises first addresses having one or more given bits set to respective first bit values; the second address range comprises second addresses having the one or more given bits set to respective second bit values, opposite to the respective first bit values; and the protection hardware comprises hardwiring of respective lines on an address bus of the plain-access circuit to the respective second bit values, thereby preventing the plain-access circuit from generating any of the first addresses in the first address range assigned to the secure-storage partition. ### Claim 4 (depends on 1) The memory device according to claim 1, wherein a Hamming distance between any address in the first address range and any address in the second address range is greater than one. ### Claim 5 (depends on 1) The memory device according to claim 1, wherein the protection hardware is configured to assert a dedicated control signal when accessing the secure-storage partition, and wherein the memory is configured to permit access to the secure-storage partition only while the dedicated control signal is asserted. ### Claim 6 (depends on 1) The memory device according to claim 1, wherein one or both of the secure-access circuit and the plain-access circuit are configured to: store data in a given address by calculating an Error Detection Code (EDC) or Error Correction Code (ECC) over both (i) at least part of the data and (ii) at least part of the given address, and store both the data and the EDC or ECC; verify the EDC or ECC upon reading the data from the given address; and in response to an error detected by the EDC or ECC, identify a fault or attack and refrain from providing the data as output. ### Claim 7 (depends on 6) The memory device according to claim 6, wherein the EDC is a Cyclic Redundancy Check (CRC) code. ### Claim 8 A method for memory access, comprising: in a memory, which comprises at least (i) a secure-storage partition assigned a first address range and (ii) a plain-storage partition assigned a second address range disjoint from the first address range, accessing the secure-storage partition using a secure-access circuit by generating addresses in the first address range, and accessing the plain-storage partition using a plain-access circuit by generating addresses in the second address range; and preventing the plain-access circuit from accessing the first address range assigned to the secure-storage partition. ### Claim 9 (depends on 8) The method according to claim 8, wherein preventing the plain-access circuit from accessing the first address range comprises preventing the plain-access circuit from generating addresses in the first address range assigned to the secure-storage partition. ### Claim 10 (depends on 8) The method according to claim 8, wherein: the first address range comprises first addresses having one or more given bits set to respective first bit values; the second address range comprises second addresses having the one or more given bits set to respective second bit values, opposite to the respective first bit values; and respective lines on an address bus of the plain-access circuit are hardwired to the respective second bit values, thereby preventing the plain-access circuit from generating any of the first addresses in the first address range assigned to the secure-storage partition. ### Claim 11 (depends on 8) The method according to claim 8, wherein a Hamming distance between any address in the first address range and any address in the second address range is greater than one. ### Claim 12 (depends on 8) The method according to claim 8, wherein preventing the plain-access circuit from accessing the first address range comprises asserting a dedicated control signal when accessing the secure-storage partition, and permitting access to the secure-storage partition only while the dedicated control signal is asserted. ### Claim 13 (depends on 8) The method according to claim 8, wherein accessing one or both of the secure-storage partition and the plain-storage partition comprises: storing data in a given address by calculating an Error Detection Code (EDC) or Error Correction Code (ECC) over both (i) at least part of the data and (ii) at least part of the given address, and storing both the data and the EDC or ECC; verifying the EDC or ECC upon reading the data from the given address; and in response to an error detected by the EDC or ECC, identifying a fault or attack and refraining from providing the data as output. ### Claim 14 (depends on 13) The method according to claim 13, wherein the EDC is a Cyclic Redundancy Check (CRC) code.