A memory controller for controlling a memory operation of a memory device includes: an error correction code (ECC) circuit configured to detect an error of first read data read from the memory device and correct the error; an error type detection logic configured to write first write data to the memory device, compare second read data with the first write data, detect an error bit of the second read data based on a result of the comparing, and output information about an error type identified by the error bit; and a data patterning logic configured to change a bit pattern of input data to reduce an error of the second read data based on the information about the error type.

An integrated circuit device including processing circuitry, communications circuitry configured to provide a communication link with a communication apparatus external to the integrated circuit device, and a memory accessible by the processing circuitry and by the communications circuitry, the memory comprising a memory region to which the processing circuitry has write access and to which the communications circuitry has read access, in which the processing circuitry is configured to write information to the memory region indicative of one or more use conditions of the integrated circuit device, and in which the communications circuitry is configured to access the memory region and to provide the information indicative of the one or more use conditions of the integrated circuit device via the communication link.

In one embodiment, a processor includes a memory hierarchy and a core coupled to the memory hierarchy. The memory hierarchy stores encrypted data, and the core includes circuitry to access the encrypted data stored in the memory hierarchy, decrypt the encrypted data to yield decrypted data, perform an entropy test on the decrypted data, and update a processor state based on a result of the entropy test. The entropy test may include determining a number of data entities in the decrypted data whose values are equal to one another, determining a number of adjacent data entities in the decrypted data whose values are equal to one another, determining a number of data entities in the decrypted data whose values are equal to at least one special value from a set of special values, or determining a sum of n highest data entity value frequencies.

A computer storage device having a host interface, a controller, non-volatile storage media, and firmware. The firmware instructs the controller to: limit a crypto key to be used in data access requests made in a first namespace allocated on the non-volatile storage media of the computer storage device; store data in the first namespace in an encrypted form that is to be decrypted using the crypto key; free a portion of the non-volatile storage media from the first namespace, the portion storing the data; and make the portion of the non-volatile storage media available in a second namespace without erasing the data stored in the portion of the non-volatile storage media.

A processor includes a register to store an encoded pointer to a variable in stack memory. The encoded pointer includes an encrypted portion and a fixed plaintext portion of a memory address corresponding to the variable. The processor further includes circuitry to, in response to a memory access request for associated with the variable, decrypt the encrypted portion of the encoded pointer to obtain first upper address bits of the memory address and a memory allocation size for a variable, decode the encoded pointer to obtain the memory address, verify the memory address is valid based, at least in part on the memory allocation size, and in response to determining that the memory address is valid, allow the memory access request.

Devices and techniques for efficient obfuscated logical-to-physical mapping are described herein. For example, activity corresponding to obfuscated regions of an L2P map for a memory device can be tracked. A record of discontinuity between the obfuscated regions and L2P mappings resulting from the activity can be updated. The obfuscated regions can be ordered based on a level of discontinuity from the record of discontinuity. When an idle period is identified, an obfuscated region from the obfuscated regions is selected and refreshed based on the ordering.

A method for device authentication comprises receiving, by processing hardware of a first device, a message from a second device to authenticate the first device. The processing hardware retrieves a secret value from secure storage hardware operatively coupled to the processing hardware. The processing hardware derives a validator from the secret value using a path through a key tree, wherein the path is based on the message, wherein deriving the validator using the path through the key tree comprises computing a plurality of successive intermediate keys starting with a value based on the secret value and leading to the validator, wherein each successive intermediate key is derived based on at least a portion of the message and a prior key. The first device then sends the validator to the second device.

A processor includes a decode unit to decode an instruction that is to indicate a page of a protected container memory, and a storage location outside of the protected container memory. An execution unit, in response to the instruction, is to ensure that there are no writable references to the page of the protected container memory while it has a write protected state. The execution unit is to encrypt a copy of the page of the protected container memory. The execution unit is to store the encrypted copy of the page to the storage location outside of the protected container memory, after it has been ensured that there are no writable references. The execution unit is to leave the page of the protected container memory in the write protected state, which is also valid and readable, after the encrypted copy has been stored to the storage location.

A device includes a reset resistant store and a trusted key service. The reset resistant store maintains data across various different device reset or data invalidation operations. The trusted key service maintains, for each of one or more operating systems that run on the device from a boot configuration, an encrypted key associated with the boot configuration. The device also has a master key that is specific to the device. Each of the keys associated with a boot configuration is encrypted using the master key. When booting the device, the boot configuration being run on the device is identified, and the key associated with that boot configuration is obtained (e.g., from the reset resistant store or the encrypted key vault). The master key is used to decrypt the obtained key, and the obtained key is used to decrypt secrets associated with the operating system run from the boot configuration.

A method of writing data to a memory device and reading data from the memory device includes issuing a challenge to a PUF device during a power-up process in order to derive a PUF response, error correcting the PUF response, providing delinearized addresses via a delinearization algorithm to the memory device using the error corrected PUF response, masking data, which is written to the memory device, via a masking module using the error corrected PUF response, de-masking data, which is read from the memory device, via the masking module (19) using the error corrected PUF response; and performing a check-sum verification of read data such that address delinearization and data masking are used together to obfuscate the memory content.