Method and device for protecting dynamic random access memory

1. A method for Dynamic Random Access Memory (DRAM) protection, comprising:

allocating address spaces respectively for a first common region, a second common region, a first secure region and a second secure region;

detecting whether common data has an address within the address spaces for the first secure region;

outputting a digital signal indicating remapping the address of the common data to an address space for the second common region if the common data has the address within the address spaces for the first secure region;

detecting whether secure data has an address within the address spaces for the first common region;

outputting a digital signal indicating remapping the address of the secure data to an address space for the second secure region if the secure data has the address within the address spaces for the first common region;

generating a random key;

maintaining a first table and a second table for both a first map between the address of the common data to the address space for the second secure region, and a second map between the address of the secure data to the address space for the second common region, wherein the first table is currently being used, and the second table is idle;

updating the second table with an updated first map and the second map; and

when the updated of the second table is completed, directly using the second table when updating the first table.

2. The method of claim 1 , further comprising:

determining whether a device is enabled to remap addresses;

if the device is not enabled to remap address, keep an original address of the common data or an original address of the secure data that the device is to access; and

if the device is enabled to remap address, remapping an address of the common data to the address space for the second common region if the common data has the address within the address spaces for the first secure region; or

remapping an address of the secure data to the address space for the second secure region if the secure data has the address within the address spaces for the first common region.

3. The method of claim 1 , wherein detecting whether the common data has the address within the address spaces for the first secure region or detecting whether the secure data has the address within the address spaces for the first common region is implemented using binary search.

4. The method of claim 1 , further comprising:

configuring a device ID and a transaction type for a device that access the address; and

determining whether the device is allowed to access the address according to the transaction type and the device ID by comparing with an authorization table.

5. A method of claim 1 , further comprising:

generating a decrypted read data by performing a reverse function on a read data using a random key; and

generating a plain read data by reverse permuting orders of bits of the decrypted data.

6. A device for Dynamic Random Access Memory (DRAM) protection, comprising:

one or more processors that execute a program to function as:

an allocating circuit, configured to allocate address spaces respectively for a first common region, a second common region, a first secure region and a second secure region;

a detector configured to detect whether common data has an address within the address spaces for the first secure region;

a remapping circuit configured to remap the address of the common data to an address space for the second common region if the common data has the address within the address spaces for the first secure region, wherein

the detector is further configured to detect whether secure data has an address within the address spaces for the first common region, and

the remapping circuit is further configured to:

remap the address of the secure data to an address space for the second secure region if the secure data has an address within the address spaces for the first common region;

maintain a first table and a second table for both a first map between the address of the common data to the address space for the second secure region, and a second map between the address of the secure data to the address space for the second common region, wherein the first table is currently being used, and the second table is idle;

update the second table with an updated first map and the second map; and

when the updated of the second table is completed, directly use the second table to update the first table.

7. The device of claim 6 , wherein the one or more processors execute a program to function as:

a determining circuit, configured to determine whether a device is enabled to remap address, wherein

the remapping circuit is further configured to, if the device is not enabled to remap address, keep an original address of the common data or an original address of the secure data that the device is to access, and

if the device is enabled to remap addresses, the remapping circuit is further activated to: remap an address of the common data to the address space for the second common region if the common data has the address within the address spaces for the first secure region; or remap an address of the secure data to the address space for the second secure region if the secure data has the address within the address spaces for the first common region.

8. The device of claim 6 , wherein the detector detects whether the common data has the address within the address spaces for the first secure region or detecting whether the secure data has the address within the address spaces for the first common region using binary search.

9. The device of claim 6 , wherein

the allocating circuit is further configured to configure a device ID and a transaction type for a device that access the address, and

the determining circuit is further configured to determine whether the device is allowed to access the address according to the transaction type and the device ID by comparing with an authorization table.

10. A device according to claim 6 , wherein the one or more processors execute a program to function as:

a second data generator configured to generate a decrypted read data by performing a reverse function on a read data using a random key, wherein

the second data generator is further configured to generate a plain read data by reverse permuting orders of bits of the decrypted data.

11. The device of claim 10 , wherein the one or more processors execute a program to function as:

a second updating circuit configured to dynamically update the generated random key according to time, when there is no request for accessing the DRAM.

12. The method of claim 1 , further comprising:

generating a random key;

generating an updated written data by permuting orders of bits of an original DRAM written data;

generating an encrypted data by performing a function on used updated written data with the generated random key; and

dynamically updating used random key according to time, when there is no request for accessing the DRAM.

13. The device of claim 6 , further comprising:

a key generator configured to generate a random key;

a first data generator configured to: generate an updated written data by permuting orders of bits of an original DRAM written data; and generate an encrypted data by performing a function on the updated written data with used generated random key; and

a first updating circuit configured to dynamically update the used random key according to time, when there is no request for accessing the DRAM.

14. The method of claim 12 , further comprising:

dynamically updating the random key in a predetermined time interval; and

encrypting data with the updated random key.

15. The device of claim 13 , wherein the updating circuit is further configured to:

dynamically update the random key in a predetermined time interval; and

the device further comprises an encrypting circuit configured to encrypt data with the updated random key.