Securing a memory drive
An arrangement for securing a memory device of a computing system in which a memory access command is compared to each command in a list of commands. The command, with specified attributes, is authenticated when the command and its attributes match an entry in the list of commands. Following authentication, the command is evaluated according to usage and behavior metrics in order to identify and prevent unauthorized or malicious access of the memory device. If no violation of usage or behavior metrics is detected, the command may be issued to the memory device for execution.
1. A method for securing a memory device of a computing system, comprising:
receiving a plurality of access commands in a sequence;
for each received respective access command in the sequence:
updating a store of access statistics with statistics for the respective access command, and
evaluating the respective access command in the sequence according to an access metric to derive a metric value for the respective access command, wherein the access metric is defined as a function of at least one statistic of the access statistics;
determining whether a pattern comprising different types of access commands of the plurality of access commands in the sequence deviates from an expected behavior pattern based on statistics in the store of access statistics; and
selectively executing the plurality of access commands based on a comparison of the metric value for each respective access command of the plurality of access commands and an access metric reference value, and based on determining whether the pattern of the different types of access commands deviates from the expected behavior pattern.
2. The method of claim 1 , wherein the access statistics include temporal statistics.
3. The method of claim 2 , further comprising defining an access metric to identify a particular access pattern of the plurality of access commands in the sequence.
4. The method of claim 3 , wherein the particular access pattern comprises a sequence of access commands issued within a predefined time interval and including a number of accesses which exceeds a predefined threshold number.
5. A system comprising
a memory controller to communicate with a memory device via a serial bus, the memory controller to receive a plurality of memory access commands in a sequence;
a store of access statistics coupled to the memory controller; and
a register, coupled to the memory controller, for storing an access metric reference value;
the memory controller to:
evaluate each respective memory access command in the sequence according to an access metric defined as a function of at least one statistic in the store of access statistics, to derive a metric value for the respective memory access command,
determine whether a pattern comprising different types of memory access commands of the plurality of memory access commands in the sequence deviates from an expected behavior pattern based on statistics in the store of access statistics, and
selectively execute the plurality of memory access commands based on a comparison of the metric value derived for each respective access command of the plurality of memory access commands with the access metric reference value, and based on determining whether the pattern of the different types of memory access commands deviates from the expected behavior pattern.
6. The system of claim 5 , wherein the memory controller comprises an application-specific integrated circuit.
7. A non-transitory machine-readable storage medium comprising instructions that upon execution cause a memory controller to:
receive a plurality of access commands in a sequence from a processor;
responsive to each respective access command in the sequence:
update an access statistics store with statistics for the respective access command,
evaluate the respective access command according to an access metric defined as a function of at least one statistic in the access statistics store, to derive an access metric value for the respective access command, and
compare the access metric value for the respective access command to a metric reference value;
determine whether a pattern comprising different types of access commands of the plurality of access commands in the sequence deviates from an expected behavior pattern based on statistics in the access statistics store; and
selectively issue the plurality of access commands to a memory device based on the comparison of the access metric value for each respective access command of the plurality of access commands and the metric reference value, and based on determining whether the pattern of the different types of access commands deviates from the expected behavior pattern.
8. The method of claim 1 , wherein determining that the pattern of the different types of access commands deviates from the expected behavior pattern comprises determining that a read command of a storage location in the memory device follows an erase command of the storage location in the memory device.
9. The method of claim 1 , wherein determining that the pattern of the different types of access commands deviates from the expected behavior pattern comprises determining that a read command of a storage location in the memory device follows an erase command of the storage location without an intervening write command of the storage location.
10. The method of claim 1 , wherein the selectively executing the plurality of access commands comprises:
rejecting a first access command of the plurality of access commands in response to a metric value for the first access command violating a minimum time interval between successive accesses of a storage location in the memory device.
11. The system of claim 5 , wherein the memory controller is to determine that the pattern of the different types of memory access commands deviates from the expected behavior pattern based on determining that a read command of a storage location in the memory device follows an erase command of the storage location in the memory device.
12. The system of claim 5 , wherein the memory controller is to determine that the pattern of the different types of memory access commands deviates from the expected behavior pattern based on determining that a read command of a storage location in the memory device follows an erase command of the storage location without an intervening write command of the storage location.
13. The system of claim 5 , wherein the memory controller is to determine that the pattern of the different types of memory access commands deviates from the expected behavior pattern based on determining that a relationship between the different types of memory access commands in the sequence violates an expected relationship.
14. The system of claim 5 , wherein the memory controller is to selectively execute the plurality of memory access commands by:
rejecting a first memory access command of the plurality of memory access commands in response to a metric value for the first memory access command violating a minimum time interval between successive accesses of a storage location in the memory device.
15. The non-transitory machine-readable storage medium of claim 7 , wherein the instructions upon execution cause the memory controller to selectively issue the plurality of access commands to the memory device by:
rejecting a first access command of the plurality of access commands in response to a comparison of an access metric value for the first access command violating the metric reference value, or in response to the pattern of the different types of access commands deviating from the expected behavior pattern.
16. The non-transitory machine-readable storage medium of claim 15 , wherein the instructions upon execution cause the memory controller to selectively issue the plurality of access commands to the memory device by:
allowing issuance of a second access command of the plurality of access commands to the memory device in response to a comparison of an access metric value for the second access command not violating the metric reference value, and in response to the pattern of the different types of access commands not deviating from the expected behavior pattern.
17. The non-transitory machine-readable storage medium of claim 7 , wherein the instructions upon execution cause the memory controller to determine that the pattern of the different types of access commands deviates from the expected behavior pattern based on determining that a read command of a storage location in the memory device follows an erase command of the storage location in the memory device.
18. The non-transitory machine-readable storage medium of claim 7 , wherein the instructions upon execution cause the memory controller to determine that the pattern of the different types of access commands deviates from the expected behavior pattern based on determining that a read command of a storage location in the memory device follows an erase command of the storage location without an intervening write command of the storage location.
19. The non-transitory machine-readable storage medium of claim 7 , wherein the instructions upon execution cause the memory controller to determine that the pattern of the different types of access commands deviates from the expected behavior pattern based on determining that a relationship between the different types of access commands in the sequence violates an expected relationship.
20. The non-transitory machine-readable storage medium of claim 7 , wherein the instructions upon execution cause the memory controller to selectively execute the plurality of access commands by:
rejecting a first access command of the plurality of access commands in response to an access metric value for the first access command violating a minimum time interval between successive accesses of a storage location in the memory device.