# US 2018/0025171 A1 · Method and apparatus for controlling application to access memory > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0025171 A1 - Document ID: US20180025171A1 - Status: Published application - Kind: A1 - Application number: 15/369,831 - Filed: 2016-12-05 - Published: 2018-01-25 - Earliest claimed: 2016-07-20 - Assignees: Montage Technology (Shanghai) Co., Ltd. - Applicants: Montage Technology (Shanghai) Co., Ltd. - Inventors: Gang SHAN; Yi LI; Dongjie TANG - Web page: https://patentgrep.com/patent/US20180025171A1 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/44: Program or device authentication - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for controlling an application to access a memory includes: receiving a first access request provided by the application and having a first access key; verifying the first access key; generating a second access key for the application if the verification of the first access key is successful; storing the second access key and providing the second access key to the application; receiving a second access request provided by the application and having a target address and a second access key; identifying whether the target address is within a reference address space indicative of a preset storage location of the memory, and verifying the second access key; generating an access control command according to an identification result of whether the target address is within the reference address space and a verification result of the second access key received from the application so as to restrict or permit the application to access the memory. ## Claims ### Claim 1 An apparatus for controlling an application to access a memory, comprising: an access controller, configured to receive and verify a first access request provided by the application and having a first access key, the access controller being further configured to receive a second access request provided by the application and having a target address and a second access key, identify whether the target address is within a reference address space indicative of a preset storage location of the memory, and verify the second access key; and a key generator, configured to generate the second access key for the application if the verification of the first access key is successful, and provide the second access key to the application, wherein the access controller is further configured to receive the second access key from the key generator and store the second access key for verifying the second access key received from the application; and generate an access control command according to an identification result of whether the target address is within the reference address space and a verification result of the second access key received from the application so as to restrict or permit the application to access the memory. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the reference address space is a continuous physical address space. ### Claim 3 (depends on 1) The apparatus of claim 1, further comprising: a register clock driver coupled to the access controller to receive the access control command, and configured to restrict or permit the application to access the memory according to the access control command. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the register clock driver is in accordance with the JEDEC DDR4 register standard. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the key generator is a random key generator. ### Claim 6 (depends on 1) The apparatus of claim 1, further comprising: a timer, configured to time a validity time of the generated second access key, wherein the access controller is further configured to stop using the second access key for verification after the validity time of the second access key exceeds a preset time threshold. ### Claim 7 (depends on 1) The apparatus of claim 1, further comprising: an access recorder coupled to the access controller, and configured to record information related to the first access request if the verification of the first access key has failed. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the second access request further comprises an access type of data access to the memory, and the access controller stores access authority; and wherein the access controller is further configured to generate the access control command according to a comparison result of whether the access type complies with the access authority, the identification result of whether the target address is within the reference address space, and the verification result of the second access key received from the application. ### Claim 9 (depends on 1) The apparatus of claim 1, wherein the first access request further comprises a key identifier, and the access controller is further configured to obtain a local access key for verifying the first access key based on the key identifier. ### Claim 10 A method for controlling an application access a memory, comprising: receiving a first access request provided by the application and having a first access key; verifying the first access key; generating a second access key for the application if the verification of the first access key is successful; storing the second access key and providing the second access key to the application; receiving a second access request provided by the application and having a target address and the second access key; identifying whether the target address is within a reference address space indicative of a preset storage location of the memory, and verifying the second access key received from the application using the stored second access key; and generating an access control command according to an identification result of whether the target address is within the reference address space and a verification result of the second access key received from the application so as to restrict or permit the application to access the memory. ### Claim 11 (depends on 10) The method of claim 10, wherein the reference address space is a continuous physical address space. ### Claim 12 (depends on 11) The method of claim 11, wherein the target address is a virtual address, and the method further comprises: converting the target address to a physical address so as to compare the target address with the reference address space. ### Claim 13 (depends on 10) The method of claim 10, wherein the second access key is randomly generated. ### Claim 14 (depends on 10) The method of claim 10, further comprising: timing a validity time of the generated second access key; and stopping using the second access key for verification after the validity time of the second access key exceeds a preset time threshold. ### Claim 15 (depends on 10) The method of claim 10, further comprising: recording information related to the first access request if the verification of the first access key has failed. ### Claim 16 (depends on 10) The method of claim 10, wherein the second access request further comprises an access type of a data access to the memory, and the step of generating an access control command further comprises: identifying whether the access type complies with the a preset access authority; and generating the access control command according to a comparison result of whether the access type complies with the access authority, the identification result of whether the target address is within the reference address space and the verification result of the second access key received from the application. ### Claim 17 (depends on 10) The method of claim 10, wherein the first access request further comprises a key identifier, and the method further comprises: obtaining a local access key for verifying the first access key based on the key identifier. ### Claim 18 A method for controlling an application to access a memory, comprising: receiving a first configuration request provided by the application and having a first configuration key; verifying the first configuration key; generating a second configuration key for the application if the verification of the first configuration key is successful; storing the second configuration key and providing the second configuration key to the application; receiving a second configuration request provided by the application, wherein the second configuration request comprises access configuration rule data and the second configuration key, and the access configuration rule data is used to define an access authority of a reference address space indicative of a preset storage location of the memory; verifying the second configuration key received from the application using the stored second configuration key; and storing the access configuration rule data for security access to the memory, if the verification of the second configuration key received from the application is successful. ### Claim 19 (depends on 18) The method of claim 18, wherein the reference address space is a continuous physical address space. ### Claim 20 (depends on 18) The method of claim 18, wherein the second configuration key is randomly generated. ### Claim 21 (depends on 18) The method of claim 18, further comprising: recording information related to the first configuration request if the verification of the first configuration key has failed. ### Claim 22 (depends on 18) The method of claim 18, wherein the access configuration rule data further comprises an access type of data access to the memory. ### Claim 23 A method for controlling an application to access a memory, comprising: transmitting a first access request having a first access key to the memory; receiving a second access key; transmitting a second access request having a target address and the second access key to the memory; and accessing the memory.