# US 12,664,277 B2 · Malware-resistant computer system memory capture > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,664,277 B2 - Document ID: US12664277B2 - Status: Granted - Kind: B2 - Application number: 18/199,582 - Filed: 2023-05-19 - Published: 2023-11-23 - Granted: 2026-06-23 - Earliest claimed: 2022-05-22 - Assignees: Elta Systems Ltd. - Applicants: Elta Systems Ltd. - Inventors: Yaniv Marks - Web page: https://patentgrep.com/patent/US12664277B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 11/1458: {Management of the backup or restore process} - G06F 11/2071: {using a plurality of controllers} - G06F 12/14: Protection against unauthorised use of memory {or access to memory} - G06F 21/554: {involving event detection and direct action} - G06F 21/567: {using dedicated hardware} - G06F 2201/805: Real-time - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract There is provided a computer system of malware-resistant memory capture, comprising memory units operably connected to a first processor; secondary-storage-enabled memory units (SSEMUs) comprising a backup memory, being adapted to copy stored data to the comprised backup memory, and providing a data interface of reading from the backup memory; wherein the first processor and the one or more SSEMUs are configurable so that each SSEMU of the one or more SSEMUs at least partially mirrors a respective memory unit of the one or more memory units; and a memory controller (MC) operably connected to a control interface and the provided data interface of at least one SSEMU, and configured to signal, to the SSEMU, a control interface signal of copying of stored data to a comprised backup memory, and initiate reading of data from the comprised backup memory. ## Claims ### Claim 1 A computer system of malware-resistant memory capture, the system comprising: a) one or more memory units, each of the one or more memory units being operably connected to a first processor; b) at least one secondary-storage-enabled memory unit (SSEMU), comprising: i) a volatile random access main memory, and a first data interface of, at least, writing to the volatile random access memory, ii) a backup memory, and a second data interface of, at least, reading from the backup memory, the SSEMU being adapted to copy data stored in the comprised volatile random access main memory to the comprised backup memory, via a third data interface, responsive to, at least, a signal received on a control interface, the first, second, and third data interfaces being distinct; each SSEMU being operably connected to the first processor and configurable to store data from the first processor to the volatile random access main memory, at least one SSEMU being adapted to copy comprised main memory data to the comprised backup memory responsive to a control interface signal comprising a low voltage on a dedicated bus pin, thereby enabling a given SSEMU to conduct memory mirroring operations upon data of the first processor, concurrent with a manager or controller reading data from the backup memory of the given SSEMU; and c) a memory controller (MC) operably connected to a respective control interface of at least one of the SSEMUs, the MC being configurable to: signal, to a respective SSEMU, a control interface signal of copying of comprised main memory data to comprised backup memory, by setting the low voltage on the dedicated bus pin. ### Claim 2 (depends on 1) The system of claim 1, wherein the computer system is configurable to enable at least one SSEMU to at least partially mirror at least one of the memory units. ### Claim 3 (depends on 1) The system of claim 1, wherein the MC is configurable to perform the signaling responsive to an instruction from a manager that is operably connected to the MC via a network. ### Claim 4 (depends on 1) The system of claim 1, wherein the MC is configurable to initiate transfer of data from: the second data interface of a respective SSEMU to: a forensic server, thereby enabling transfer of SSEMU data to the manager, concurrent to SSEMU storing data from the first processor. ### Claim 5 (depends on 1) The system of claim 1, wherein the comprised backup memory of at least one of the SSEMUs is flash memory. ### Claim 6 (depends on 1) The system of claim 1, wherein the third data interface of at least one SSEMU utilizes at least one of: sideband signals, and an inter-integrated circuit interface. ### Claim 7 (depends on 1) The system of claim 1, wherein at least one SSEMU is a non-volatile Dual In-line Memory Module (NVDIMM). ### Claim 8 (depends on 1) The system of claim 1, wherein the second data interface of at least one SSEMU is a universal serial bus (USB) data interface. ### Claim 9 A processor-based method of malware-resistant memory capture, the method comprising: a) providing one or more memory units, each of the one or more memory units being operably connected to a first processor; b) providing at least one secondary-storage-enabled memory unit (SSEMU), comprising: i) a volatile random access main memory, and a first data interface of, at least, writing to the volatile random access memory, ii) a backup memory, and a second data interface of, at least, reading from the backup memory, the SSEMU being adapted to copy data stored in the comprised volatile random access main memory to the comprised backup memory, responsive to, at least, a signal received on a control interface, each SSEMU being operably connected to the first processor and configurable to store data from the first processor to the volatile random access main memory, at least one SSEMU being adapted to copy comprised main memory data to the comprised backup memory responsive to a control interface signal comprising a low voltage on a dedicated bus pin, thereby enabling a given SSEMU to conduct memory mirroring operations upon data of the first processor, concurrent with a manager or controller reading data from the backup memory of the given SSEMU; and c) signaling, by a memory controller, to a respective SSEMU, a control interface signal of copying of comprised main memory data to comprised backup memory, by setting the low voltage on the dedicated bus pin.