# US 12,190,996 B2 · Memory controller and a method for controlling access to a memory module

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,190,996 B2
- Document ID: US12190996B2
- Status: Granted
- Kind: B2
- Application number: 17/326,352
- Filed: 2021-05-21
- Published: 2021-11-25
- Granted: 2025-01-07
- Earliest claimed: 2020-05-22
- Assignees: Montage Technology Co., Ltd.
- Applicants: Montage Technology Co., Ltd.
- Inventors: Yi Li; Gang Shan; Guohui Li; Chunhui Zhang
- Web page: https://patentgrep.com/patent/US12190996B2

## CPC

- G06F 21/85: interconnection devices, e.g. bus-connected or in-line devices
- G11C 8/18: Address timing or clocking circuits; Address control signal generation or management, e.g. for row address strobe [RAS] or column address strobe [CAS] signals
- G06F 12/1441: {for a range}
- G06F 12/1466: {Key-lock mechanism}
- G06F 21/44: Program or device authentication
- G11C 7/1057: {Data output buffers, e.g. comprising level conversion circuits, circuits for adapting load}
- G11C 7/1084: {Data input buffers, e.g. comprising level conversion circuits, circuits for adapting load}
- G11C 8/20: Address safety or protection circuits, i.e. arrangements for preventing unauthorized or accidental access
- G06F 2212/1052: Security improvement
- G11C 7/24: Memory cell safety or protection circuits, e.g. arrangements for preventing inadvertent reading or writing; Status cells; Test cells
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G11C: STATIC STORES (semiconductor memory devices H10B)

## Abstract

The application discloses a memory controller coupled between a memory module and a host controller to control access of the host controller to the memory module, comprising a central buffer coupled between the host controller and the memory module. The central buffer is configured to receive a command/address signal from the host controller via a command/address channel and selectively provide the command/address signal to the memory module. The command/address signal has an identity authentication message for identifying a source. The central buffer comprises: a verification module coupled to the command/address channel to receive the command/address signal and the identity authentication message, and configured to determine whether the command/address signal conforms to an authority management rule based on the identity authentication message; and an access control module coupled to the command/address channel to receive the command/address signal and coupled to the verification module to receive the determination result, and configured to process the command/address signal based on the determination result to selectively provide the command/address signal to the memory module.

## Claims

### Claim 1

A memory controller coupled between a memory module and a host controller to control access of the host controller to the memory module, wherein the memory controller comprises:
a central buffer coupled between the host controller and the memory module, wherein the central buffer is configured to receive a command/address signal from the host controller via a command/address channel, and selectively provide the command/address signal to the memory module, and the central buffer is further configured to receive an identity authentication message identifying a source of the command/address signal from the host controller, wherein the central buffer comprises a main signal path and a branch signal path, wherein the main signal path is between a receiving side and an output side of the command/address channel, and the branch signal path is coupled to the main signal path through an access control module, wherein the central buffer comprises:
a verification module, wherein the verification module is coupled in the branch signal path, and further coupled to the command/address channel to receive the command/address signal and the identity authentication message, and configured to determine whether the command/address signal conforms to an authority management rule based on the identity authentication message and generate a determination result; and
the access control module, wherein the access control module is coupled in the main signal path and further coupled to the command/address channel to receive the command/address signal, and coupled to the verification module to receive the determination result generated by the verification module, wherein the access control module is configured to process the command/address signal based on the determination result generated by the verification module to selectively provide the command/address signal to the memory module.

### Claim 2 (depends on 1)

The memory controller of claim 1, wherein the authority management rule comprises:
an access command type allowed for the identity authentication message; and/or an access address range of the memory module allowed for the identity authentication message.

### Claim 3 (depends on 2)

The memory controller of claim 2, wherein the verification module is further configured to:
based on the identity authentication message corresponding to the command/address signal, acquire the access command type allowed for the identity authentication message from the authority management rule;
compare an access command included in the command/address signal with the allowed access command type; and
in response to that the access command included in the command/address signal is consistent with the allowed access command type, determine that the command/address signal conforms to the authority management rule; or
in response to that the access command included in the command/address signal is inconsistent with the allowed access command type, determine that the command/address signal does not conform to the authority management rule.

### Claim 4 (depends on 2)

The memory controller of claim 2, wherein the verification module is further configured to:
based on the identity authentication message corresponding to the command/address signal, acquire the access address range allowed for the identity authentication message from the authority management rule;
compare an access address included in the command/address signal with the allowed access address range;
in response to that the access address included in the command/address signal is within the allowed access address range, determine that the command/address signal conforms to the authority management rule; or
in response to that the access address included in the command/address signal is not within the allowed access address range, determine that the command/address signal does not conform to the authority management rule.

### Claim 5 (depends on 2)

The memory controller of claim 2, wherein the verification module is further configured to:
based on the identity authentication message corresponding to the command/address signal, acquire the access address range and the access command type allowed for the identity authentication message from the authority management rule;
compare an access address included in the command/address signal with the allowed access address range;
compare an access command included in the command/address signal with the allowed access command type; and
in response to that the access address included in the command/address signal is within the allowed access address range and the access command included in the command/address signal is consistent with the allowed access command type, determine that the command/address signal conforms to the authority management rule; or in response to that the access address included in the command/address signal is not within the allowed access address range or the access command included in the command/address signal is inconsistent with the allowed access command type, determine that the command/address signal does not conform to the authority management rule.

### Claim 6 (depends on 1)

The memory controller of claim 1, wherein the access control module is further configured to:
in response to that the verification module determines that the command/address signal conforms to the authority management rule, provide the command/address signal to the memory module;
in response to that the verification module determines that the command/address signal does not conform to the authority management rule, not provide the command/address signal to the memory module.

### Claim 7 (depends on 1)

The memory controller of claim 1, wherein the access control module is further configured to:
in response to that the verification module determines that the command/address signal conforms to the authority management rule, provide the command/address signal to the memory module;
in response to that the verification module determines that the command/address signal does not conform to the authority management rule, convert the command/address signal into an invalid signal.

### Claim 8 (depends on 1)

The memory controller of claim 1, wherein the access control module is further configured to:
in response to that the verification module determines that the command/address signal conforms to the authority management rule, provide the command/address signal to the memory module;
in response to that the verification module determines that one or more command/address signals do not conform to the authority management rule, count a number of the one or more command/address signals not conforming to the authority management rule:
in response to that the number of the one or more command/address signals not conforming to the authority management rule does not exceed a predetermined number, provide the one or more command/address signals not conforming to the authority management rule to the memory module; and
in response to that the number of the one or more command/address signals not conforming to the authority management rule exceeds the predetermined number, not provide subsequent command/address signals determined by the verification module as not conforming to the authority management rule to the memory module or converting the subsequent command/address signals determined by the verification module as not conforming to the authority management rule into invalid signals.

### Claim 9 (depends on 1)

The memory controller of claim 1, wherein the verification module comprises:
an identification module coupled to the command/address channel to receive the command/address signal and the identity authentication message, and the identification module being configured to identify an access command and/or an access address included in the command/address signal;
a determination module coupled to the identification module to receive the access command and/or the access address included in the command/address signals and the identity authentication message, the determination module being configured to determine whether the command/address signal conforms to the authority management rule based on the corresponding identity authentication message; and
a rule module configured to store the authority management rule, and the rule module being coupled to the determination module to provide the authority management rule to the determination module.

### Claim 10 (depends on 9)

The memory controller of claim 9, wherein the verification module further comprises a configuration module coupled to the rule module, wherein the authority management rule can be configured in advance or dynamically via the configuration module.

### Claim 11 (depends on 10)

The memory controller of claim 10, wherein the configuration module is further configured to receive configuration data from the host controller, so that the configuration module uses the configuration data to configure the authority management rule.

### Claim 12 (depends on 1)

The memory controller of claim 1, wherein the verification module comprises:
an identification module coupled to the command/address channel to receive the command/address signal and the identity authentication message, and the identification module being configured to identify an access command and/or an access address included in the command/address signal;
a determination module coupled to the identification module to receive the access command and/or the access address included in the command/address signal and the identity authentication message, the determination module being configured to determine whether the command/address signal conforms to the authority management rule based on the corresponding identity authentication message; and
an input channel coupled to the determination module, the input channel being configured to receive the authority management rule from the outside of the central buffer and provide the authority management rule to the determination module.

### Claim 13 (depends on 1)

The memory controller of claim 1, wherein the central buffer further comprises an output channel and a warning module, the warning module being configured to send a warning notice to the user via the output channel in response to that the verification module determines that the command/address signal does not conform to the authority management rule.

### Claim 14 (depends on 13)

The memory controller of claim 13, wherein the verification module comprises the warning module and the output channel.

### Claim 15 (depends on 1)

The memory controller of claim 1, wherein the central buffer further comprises a recording module, in response to that the verification module determines that the command/address signal does not conform to the authority management rule, the recording module being configured to record the command/address signal.

### Claim 16 (depends on 15)

The memory controller of claim 15, wherein the verification module comprises the recording module.

### Claim 17

A method for controlling access to a memory module, wherein the method comprises:
receiving, from a host controller, a command/address signal and a corresponding identity authentication message identifying a source of the command/address signal;
determining, by a verification module, whether the command/address signal conforms to an authority management rule based on the identity authentication message and generating a determination result;
processing, by an access control module, the command/address signal based on the determination result to selectively provide the command/address signal to the memory module,
wherein the command/address signal is received from the host controller via a command/address channel, a central buffer is coupled between the host controller and the memory module, wherein the central buffer comprises a main signal path and a branch signal path, wherein the main signal path is between a receiving side and an output side of the command/address channel, and the branch signal path is coupled to the main signal path through the access control module, wherein the verification module is coupled in the branch signal path and the access control module is coupled in the main signal path.

### Claim 18 (depends on 17)

The method of claim 17, wherein the authority management rule comprises:
an access command type allowed for the identity authentication message; and/or an access address range of the memory module allowed for the identity authentication message.

### Claim 19 (depends on 18)

The method of claim 18, wherein determining whether the corresponding command/address signal conforms to the authority management rule based on the identity authentication message and generating the determination result further comprises:
based on the identity authentication message corresponding to the command/address signal, acquiring the access command type allowed for the corresponding identity authentication message from the authority management rule;
comparing an access command included in the command/address signal with the allowed access command type; and
in response to that the access command included in the command/address signal is consistent with the allowed access command type, determining that the command/address signal conforms to the authority management rule; or
in response to that the access command included in the command/address signal is inconsistent with the allowed access command type, determining that the command/address signal does not conform to the authority management rule.

### Claim 20 (depends on 18)

The method of claim 18, wherein determining whether the corresponding command/address signal conforms to the authority management rule based on the identity authentication message and generating the determination result further comprises:
based on the identity authentication message corresponding to the command/address signal, acquiring the access address range allowed for the corresponding identity authentication message from the authority management rule;
comparing an access address included in the command/address signal with the allowed access address range;
in response to that the access address included in the command/address signal is within the allowed access address range, determining that the command/address signal conforms to the authority management rule;
in response to that the access address included in the command/address signal is not within the allowed access address range, determining that the command/address signal does not conform to the authority management rule.

### Claim 21 (depends on 18)

The method of claim 18, wherein determining whether the corresponding command/address signal conforms to the authority management rule based on the identity authentication message and generating the determination result further comprises:
based on the identity authentication message corresponding to the command/address signal, acquiring the access address range and the access command type allowed the corresponding identity authentication message from the authority management rule;
comparing an access address included in the command/address signal with the allowed access address range;
comparing an access command included in the command/address signal with the allowed access command type; and
in response to that the access address included in the command/address signal is within the allowed access address range and the access command included in the command/address signal is consistent with the allowed access command type, determining that the command/address signal conforms to the authority management rule; or
in response to that the access address included in the command/address signal is not within the allowed access address range or the access command included in the command/address signal is inconsistent with the allowed access command type, determining that the command/address signal does not conform to the authority management rule.

### Claim 22 (depends on 17)

The method of claim 17, wherein processing the command/address signal based on the determination result to selectively provide the command/address signal to the memory module comprises:
in response to that the verification module determines that the command/address signal conforms to the authority management rule, providing the command/address signal to the memory module;
in response to that the verification module determines that the command/address signal does not conform to the authority management rule, not providing the command/address signal to the memory module.

### Claim 23 (depends on 17)

The method of claim 17, wherein processing the command/address signal based on the determination result to selectively provide the command/address signal to the memory module comprises:
in response to that the verification module determines that the command/address signal conforms to the authority management rule, providing the command/address signal to the memory module;
in response to that the verification module determines that the command/address signal does not conform to the authority management rule, converting the command/address signal into an invalid signal.

### Claim 24 (depends on 17)

The method of claim 17, wherein processing the command/address signal based on the determination result to selectively provide the command/address signal to the memory module comprises:
in response to that the verification module determines that the command/address signal conforms to the authority management rule, providing the command/address signal to the memory module;
in response to that the verification module determines that one or more of command/address signals do not conform to the authority management rule, counting a number of the one or more command/address signals not conforming to the authority management rule:
in response to that the number of the one or more command/address signals not conforming to the authority management rule does not exceed a predetermined number, providing the one or more command/address signals not conforming to the authority management rule to the memory module; and
in response to that the number of the one or more command/address signals not conforming to the authority management rule exceeds the predetermined number, not providing subsequent command/address signals determined by the verification module as not conforming to the authority management rule to the memory module or converting the subsequent command/address signals determined by the verification module as not conforming to the authority management rule into invalid signals.

### Claim 25 (depends on 18)

The method of claim 18, wherein before determining whether the corresponding command/address signal conforms to the authority management rule based on the
identity authentication message and generating the determination result, the method further comprises:
identifying an access command and/or an access address in the command/address signal; and
receiving the authority management rule.

### Claim 26 (depends on 25)

The method of claim 25, wherein the authority management rule can be configured in advance or dynamically.

### Claim 27 (depends on 26)

The method of claim 26, wherein the method further comprises:
receiving configuration data from the host controller to configure the authority management rule with the configuration data.

### Claim 28 (depends on 17)

The method of claim 17, wherein the method further comprises:
sending a warning notice to the user in response to determining that the command/address signal does not conform to the authority management rule.

### Claim 29 (depends on 17)

The method of claim 17, wherein the method further comprises:
in response to determining that the command/address signal does not conform to the authority management rule, recording the command/address signal.