CN109144401A - Have both the memory of virus investigation function - Google Patents

Abstract

The present invention proposes a kind of memory for having both virus investigation function.The memory contains multiple storage processing units, and each unit contains a mode processing circuit and at least one three-dimensional storage (3D-M) array.The 3D-M array is stacked on above mode processing circuit, and stores user data.The virus identifications of input and the user data are carried out pattern match or pattern-recognition by mode processing circuit.

Description

Have both the memory of virus investigation function

Technical field

The present invention relates to integrated circuit fields, more precisely, being related to having both the memory of virus investigation function.

Background technique

Pattern match and pattern-recognition, which refer to, to be searched and is examined in target pattern (mode being retrieved, target pattern) The identical or close mode of rope mode (for the mode of retrieval, search pattern).Wherein, pattern match requires to find Identical mode, pattern-recognition, which requires nothing more than, finds close mode.In addition to illustrating, this specification does not distinguish pattern match And pattern-recognition, and it is referred to as the various operations carried out to mode with mode treatment.

Mode treatment (including pattern match and pattern-recognition) is widely used.Common mode treatment includes character string Match, code matches, speech recognition and image recognition etc..String matching be widely used in big data analysis (such as finance data analysis, Electric quotient data analysis, bioinformatics) etc. fields: from big data (at present be mostly text database, contain target string) Searching character string is searched, and for statistical analysis.Code matches are widely used in anti-Malware (anti-malware, such as network Safety, computer antivirus) etc. fields: from network packet search virus identifications (virus signature) or check network Whether data packet meets the network standard (network rules), to determine whether network packet is safe.Speech recognition will lead to It crosses speech transducer and collected or be stored in voice signal in audio file library and acoustic model repository and language model library Match.Image recognition by by imaging sensor collected or stored in image file library picture signal and iconic model library Matching.

With the arrival of big data era, traditional pattern base (including search modes library and target pattern library) is had become greatly Type database (TB grades to PB grades or even EB grades): the data volume of search modes library (including all modes for retrieval) is It is very big, and the data volume of target pattern library (including all modes being retrieved, usually customer data base) is then more huge.Mesh The von Neumann framework that preceding computer uses has been unable to meet requirement of the big data era to mode treatment.In von In Neumann framework, the processor for tupe and the memory for memory module are separation: memory is (as firmly Disk, CD, tape etc.) memory module data are used only as, and any mode treatment cannot be carried out to it；All mode treatments are all It is completed by external processor (such as CPU, GPU).It is well known that bandwidth is limited between isolated processor and memory, light is All data are read in slave pattern library just to take a long time, and processing analysis still more is carried out to them.Therefore, to large-scale mode The mode treatment in library needs to expend for a long time.

One typical case of mode treatment is enhancing computer security.The main means for enhancing computer security are to evil Meaning software is screened, i.e. virus investigation.In virus investigation, schema processor will be by the virus identifications in user data and virus identifications library Carry out code matches.In the present specification, user data refers to the program and data of various storages in a computer；Virus identifications Refer to the mark of various internet worms, the mark of computer virus, the network standard for needing to follow and filespec etc..In order to increase Strong computer security, schema processor need that the part containing virus identifications in user data is isolated or is deleted.

In traditional computer, user data is stored in external memory (such as hard disk).External memory is a simple memory, Itself do not have any virus investigation function.After a new virus is found, need all numbers of users in hard disc of computer According to reading in processor, code matches are carried out with new virus.Since conventional processors number of cores is limited, (such as CPU only has several The depth of parallelism of kernel, code matches is low), and reading all customer data time-consuming is very long from external memory, therefore traditional computer Framework inefficiency when handling computer security affairs.

Summary of the invention

The main object of the present invention is enhancing computer security.

It is a further object of the present invention to provide a kind of memories for having both virus investigation function.

In order to realize that these and other purpose, the present invention propose a kind of memory for having both virus investigation function: it can not only Memory module data, moreover it is possible to which mode treatment is implemented to mode data.The memory chip contains multiple storage processing units, each Unit all contains the three-dimensional storage of a mode processing circuit and an at least one storage at least mode (target pattern or search modes) (three-dimensional memory, referred to as 3D-M) array.The Vertical collection band of 3D-M array and mode processing circuit Carry out many advantages: since 3D-M array does not account for Substrate Area, it be can integrate on mode processing circuit, this can increase storage and holds Amount reduces chip area.Importantly, since 3D-M array and mode processing circuit are in same chip and apart from very Closely, a big bandwidth electrical connection is able to achieve between them.By using extensive parallel computing, (each memory chip can contain A storage processing units up to ten thousand), which can realize quick mode processing to large-scale pattern base.

Correspondingly, the present invention proposes a kind of memory (200) for having both virus investigation function, it is characterised in that contains: a transmission The input bus (110) of an at least virus identifications (virus signature)；Semi-conductive substrate (0) and multiple storages processing Unit (100aa-100mn), the multiple storage processing unit are coupled with the input bus (110), each storage processing unit (100ij) contains at least one three-dimensional storage (3D-M) array (170) and a mode processing circuit (180), in which: the 3D-M Array (170) is stacked on above the substrate (0), which stores an at least user data；The mode treatment electricity Road (180) is located in the substrate (0), which carries out mode knowledge to the virus identifications and the user data Other or pattern match；The 3D-M array (170) and the mode processing circuit (180) by multiple contact access openings (1av, 3av) couple.

Detailed description of the invention

Fig. 1 is a kind of circuit block diagram of distributed mode processor.

Fig. 2A-Fig. 2 C is the circuit block diagram of three kinds of storage processing units；

Fig. 3 A be a kind of three-dimensional writable memory (three-dimensional writable memory, referred to as 3D-W) and The sectional view of storage processing unit based on 3D-W；Fig. 3 B is that a kind of three-dimensional print records reservoir (three-dimensional Printed memory, referred to as 3D-P) and the storage processing unit based on 3D-P sectional view.

Fig. 4 is a kind of perspective view of storage processing unit.

Fig. 5 A- Fig. 5 C is the substrate circuitry layout of three kinds of storage processing units.

It is noted that these attached drawings are only synoptic diagrams, their nots to scale (NTS) are drawn.For the sake of obvious and is convenient, in figure Portion size and structure may zoom in or out.In different embodiments, the subsequent letter suffix of number indicates same class The different instances of structure；Identical number prefix indicates same or similar structure.In the present specification, "/" indicate " and/ Or ".

Specific embodiment

Fig. 1 shows a kind of memories 200 for having both virus investigation function, it is a kind of distributed mode processor chips.This is deposited Reservoir 200 contains m x n storage processing unit 100aa-100mn.These storage processing units 100aa-100mn is both formed in On substrate 0.Input bus 110 is coupled with each storage processing unit, and output bus 120 is coupled with each storage processing unit. It is noted that distributed mode processor chips 200 can contain a storage processing unit 100aa-100mn up to ten thousand.Such quantity Numerous storage processing unit 100aa-100mn can guarantee extensive parallel computing, to realize that high-speed mode is handled.

Each storage processing unit 100ij stores an at least mode containing a mode processing circuit 170 and at least one 3D-M array 180.Fig. 2A-Fig. 2 C is the circuit block diagram of three kinds of storage processing unit 100ij.In these embodiments, a mould Formula processing circuit 180 is that the 3D-M array 170 of different number services.Mode processing circuit 180 in Fig. 2A is one 3D-M gusts Column 170 service: the mode data being stored in 3D-M array 170 is electrically connected 160(referring to Fig. 3 A- Fig. 4 by big bandwidth) it is sent into Mode processing circuit 180 carries out pattern match or pattern-recognition with input pattern data 110, and generates output mode data 120.Mode processing circuit 180 in Fig. 2 B is four storage array 170A-170D services: being stored in 3D-M array 170A- Mode data in 170D is electrically connected 160A-160D(referring to Fig. 3 A- Fig. 4 by big bandwidth) it is sent into mode processing circuit 180, and Pattern match or pattern-recognition are carried out with input pattern data 110.Mode processing circuit 180 in Fig. 2 C is eight storage arrays 170A-170D and 170W-170Z service: the mode data being stored in 3D-M array 170A-170D and 170W-170Z passes through big Bandwidth is electrically connected 160A-160D and 160W-160Z(referring to Fig. 3 A- Fig. 4) it is sent into mode processing circuit 180, and and input pattern Data 110 carry out pattern match or pattern-recognition.It can be seen that from later Fig. 5 A- Fig. 5 C as more 3D-M array services Mode processing circuit 180 has bigger area and stronger function.

Fig. 3 A- Fig. 3 B indicates two kinds of typical case 3D-M.Fig. 3 A is the section of storage processing unit 100ij based on 3D-W a kind of Figure.The information of 3D-W storage uses electrical programming typing.Common 3D-W has 3D-XPoint.Other 3D-W include memristor, Resistance-variable storing device (RRAM), phase transition storage (PCM), programmable metallization cell(PMC), Conductive bridging random-access memory (CBRAM) etc..According to its programmable number, 3D-W is again Be divided into three-dimensional one-time programming memory (three-dimensional one-time-programmable memory, referred to as 3D-OTP) and three-dimensional repeatedly programmable memory (three-dimensional multiple-time-programmable Memory, referred to as 3D-MTP).As its name suggests, 3D-OTP can be programmed once, 3D-MTP can program repeatedly (including repeat compile Journey).3D-OTP technical maturity, it can memory scan pattern base (such as virus identifications library, network standard library, acoustic model repository, language Model library etc.), the mode data in these pattern bases, which only increases, not to be modified.3D-MTP is a kind of general-purpose storage, it can be used to Objective model storage library, such as user data (including personal code work).

Storage processing unit 100ij based on 3D-W contains the substrate circuitry layer 0K being formed on substrate 0.Accumulation layer 16A is stacked on substrate circuitry 0K, and accumulation layer 16B is stacked on accumulation layer 16A.Substrate circuitry layer 0K contains accumulation layer The peripheral circuit of 16A, 16B, it includes transistor 0t and interconnection line 0M.Each accumulation layer (such as 16A) contains a plurality of first address Line (such as 2a, in the y-direction), a plurality of second address wire (such as 1a, in the x-direction) and multiple 3D-W store first (such as 1aa).Accumulation layer 16A, 16B pass through contact access opening 1av respectively, and 3av is coupled with substrate 0.

3D-W storage member 5aa contains one layer of programming film 12 and a layer diode film 14.Programming film 12 can be antifuse film (being used for 3D-OTP) is also possible to other multiple programming films (for 3D-MTP).Diode film 14 has following generalized character: Under read voltage, resistance is smaller；When applied voltage be less than read voltage or it is contrary with read voltage when, resistance is larger. Diode film can be P-i-N diode, be also possible to metal oxide (such as TiO₂) diode etc..

Fig. 3 B is the sectional view of storage processing unit 100ij based on 3D-P a kind of.The information of 3D-P storage is in factory Using (the print record method) of mode of printing typing in production process.These information are permanently fixed, and cannot be changed after factory.Print record Method can be photoetching (photo-lithography), nano-imprint method (nano-imprint), electron beam scanning exposure (e- Beam lithography), DUV scan exposure, laser scanning exposure (laser programming) etc..Common 3D-P has Three-dimensional masking film program read-only memory (3D-MPROM), it passes through masking film program logging data by photoetching process.The reading speed of 3D-P The pattern base (such as acoustic model repository and language model library) faster than 3D-W, it is suitble to storage fixed is spent, and realizes high-performance mould Formula processing (such as realization natural language processing and real-time language translation).

3D-P contains at least two storage member 5aa, 6aa.Storage member 6aa is a kind of low-resistance storage member, and storage member 5aa is A kind of high resistant storage member.Low-resistance storage member 6aa contains a layer diode film 14, and it is more than low-resistance storage member 6aa that high resistant stores member 5aa Containing one layer of high resistance film 12.As a simply example, high resistance film 12 can be layer of silicon dioxide film.The high resistance film 12 is in work It is physically removed at storage member 6aa in skill process using print record method.

Include 3D-W and 3D-P in the 3D-M(of Fig. 3 A- Fig. 3 B) in, each accumulation layer contains multiple 3D-M arrays.3D-M gusts Column are the set of all storage members for having shared at least one address wire in an accumulation layer.In a 3D-M array, institute Address wire is continuously, not share any address wire from different 3D-M arrays.On the other hand, a 3D-M chip contains more A 3D-M module.Each 3D-M module contains all accumulation layers in 3D-M, and top accumulation layer contains only a 3D-M array, and The projection of the 3D-M array on substrate determines the boundary of the 3D-M module.

Fig. 4 discloses the structure of storage processing unit 100ij from another angle.170 heap of 3D-M array of memory module It is stacked in the top of substrate 0, the mode processing circuit 180 of tupe is located in substrate 0, and at least partly by 3D-M array 170 Covering.Big bandwidth between 3D-M array 170 and mode processing circuit 180 by being constituted by largely contacting access opening 1av, 3av Communication is realized in electrical connection 160.Due to contact access opening 1av, 3av large number of (can be with up to ten thousand) and the very short (micron of length Grade), the bandwidth of the interior electrical connection 160 of chip is much higher than the communication bandwidth of chip chamber.

The Vertical collection of 3D-M array 170 and mode processing circuit 180 brings many advantages: not due to 3D-M array 170 Substrate Area 0 is accounted for, it can integrate on mode processing circuit 180, this can increase memory capacity, reduces chip area.It is heavier It wants, since 3D-M array 170 and mode processing circuit 180 are in same chip 200 and apart from close, energy between them Realize large bandwidth.By using extensive parallel computing, distributed mode processor 200 can realize large-scale pattern base quick Mode treatment.

Fig. 5 A- Fig. 5 C discloses the specific implementation of three kinds of storage processing units.The embodiment of Fig. 5 A corresponds to Fig. 2A Middle storage processing unit 100ij.Mode processing circuit 180 is that a 3D-M array 170 services, it is complete by 3D-M array 170 Covering.In this embodiment, 3D-M array 170 contains there are four peripheral circuit, including X-decoder 15,15` and Y-decoder (including Reading circuit) 17,17`, mode processing circuit 180 is located between this four peripheral circuits.In fig. 5, due to 3D-M array 170 are located above substrate circuitry 0K, and not in substrate circuitry 0K, its projection on substrate 0 is represented by dashed line herein.

In the present embodiment, mode processing circuit 180 is limited between four peripheral circuits, and area is no more than The area of 3D-M array 170, therefore its area is smaller, function is limited.The embodiment is well suited to realize better simply mode treatment (such as String matching and code matches).It is obvious that more complex mode treatment (such as speech recognition, image recognition) needs are bigger Circuit, this needs vacates bigger Substrate Area under 3D-M array 170, so as to the layout of mode processing circuit 180.Fig. 5 B- Fig. 5 C, which discloses two kinds, has more large area and more powerful mode processing circuit 180.

The embodiment of Fig. 5 B corresponds to storage processing unit 100ij in Fig. 2 B.In this embodiment, a mode treatment electricity Road 180 is four 3D-M array 170A-170D services.Only there are two peripheral circuit (such as X decodings for each 3D-M array (such as 170A) Device 15A and Y-decoder 17A).Below this four 3D-M array 170A-170D, substrate circuitry 0K can be formed with free surface jet One mode processing circuit 180.It is obvious that the mode processing circuit 180 in Fig. 5 B can be it is four times of Fig. 5 A big, it be able to achieve compared with Complicated mode treatment function.

The embodiment of Fig. 5 C corresponds to storage processing unit 100ij in Fig. 2 C.In this embodiment, a mode treatment electricity Road 180 is eight 3D-M array 170A-170D and 170W-170Z services.This eight 3D-M arrays are divided into two groups of 150A, 150B. Every group (such as 150A) includes four 3D-M arrays (such as 170A-170D).In four 3D-M array 170A-170D of first group of 150A Lower section, substrate circuitry can form first mode processing circuit component A 180A with free surface jet.Similarly, in second group of 150B Four 3D-M array 170W-170Z below, substrate circuitry can also form second mode processing circuit component B with free surface jet 180B.First mode processing circuit component 180A and second mode processing circuit component 180B constitutes mode processing circuit 180.? In the present embodiment, between adjacent peripheral circuit (between such as adjacent X-decoder 15A, 15C；In adjacent Y-decoder 17A, Between 17B；Between adjacent Y-decoder 17C, 17D) there are gap (such as G), to form wiring channel 190Xa, 190Ya, 190Yb is communicated for realizing between different mode processing circuit component 150A, 150B or between different mode processing circuit.Very Obviously, the mode processing circuit 180 in Fig. 5 C can be the octuple big of Fig. 5 A, it is able to achieve more complicated mode treatment function.

In some embodiments of the invention, mode processing circuit 180 only needs to complete partial mode processing function.Such as It says, mode processing circuit 180 only needs to complete simple mode processing (extracting and processing for such as simple feature).By the simple mode Mode after processing screening will be further sent to by output bus 120 complete in more powerful external processor (such as CPU, GPU) At final mode treatment.Since most of mode in pattern base can be screened out by simple mode processing, the mode of output is only accounted for The fraction of pattern base, this can reduce the bandwidth pressure of output bus 120.

In distributed mode processor 200, storage processing unit 100ij can use both of which processing mode --- Class processor mode and class memory mode.For class processor mode, storage processing unit 100ij is for the external world just as one A processor that can carry out mode treatment to external user data with its included search modes library.Particularly, storage is handled The 170 memory scan database of 3D-M array of unit 100ij；The input data 110 of storage processing unit 100ij is user data (including personal code work), these user data generally generate in real time, such as network packet；Storage processing unit User data 110 and search modes library are carried out pattern match or pattern-recognition by 100ij.At 3D-M array 170 and mode Managing between device 180 has big bandwidth connection 160, and this mode treatment mode is stored in separation and deposits than traditional, search modes inventory The mode treatment mode of reservoir is high-efficient.

For class memory mode, storage processing unit 100ij is for the external world as one is mainly used for storing number of users According to and included mode processing circuit can be utilized to carry out the memory of mode treatment.Particularly, user data is stored in for a long time In the 3D-M array 170 for storing up processing unit 100ij；The input data 110 of storage processing unit 100ij is search modes data； Search modes data 110 and its user data are carried out pattern match or pattern-recognition by storage processing unit 100ij.It is noted that Multiple distributed mode processor chips 200 using class memory mode can be packaged into storage card as flash chip (such as SD card, TF card) and solid state hard disk, for storing the user data (such as user data archives) of magnanimity.Due to each distribution Each storage processing unit 100ij in schema processor chip 200 carries a mode processing circuit 180, this mode Processing circuit 180 only needs to handle the data that 3D-M array 170 stores in storage processing unit 100ij.Therefore, no matter storage card Have with the capacity of solid state hard disk much, the time of mode treatment all handles close to single-mode processing circuit 180 coupled 3D-M array 170 in time of data for storing.This big advantage is unimaginable for conventional processors.

In class memory mode, storage processing unit 100ij is the final memory device of user data.This and tradition , processor containing in-line memory it is different: the in-line memory in conventional processors only temporarily stores user data, The final memory device or external memory (such as hard disk, CD, tape) of user data.If user data stores for a long time In conventional processors, then the conventional processors are only capable of as these data services, and can not be other data services.Namely It says, a large number of users data are needed using many processors.Since conventional processors are very expensive, this processing mode cost is excessively It is high.Compare therewith, in storage processing unit 100ij proposed by the present invention, mode processing circuit 180 is integrated in 3D-M array 170 lower sections, are formed simultaneously with the peripheral circuit (such as decoder) of 3D-M array.Since 3D-M will natively form peripheral circuit, And peripheral circuit only accounts for very little area (referring to Fig. 5 A- Fig. 5 C) on substrate 0, most of Substrate Area can be used to formation mode Processing circuit 180, mode processing circuit 180 are free for 3D-M.Therefore, in distributed mode processor chips A large amount of approximate free mode processing circuits 180 can be formed on 200, each mode processing circuit 180 is that specific data (are deposited Storage is in 3D-M array 170 coupled thereto) service.

A simple introduction is done with regard to the application of distributed mode processor below.As an example, distributed mode is handled Device 200 is anti-Malware (anti-malware) processor, it is mainly used for network security and computer antivirus.Network peace Class processor mode can be used entirely: the input data 110 of distributed mode processor 200 is network packet, 3D-M array 170 Network standard library and virus identifications library are stored, mode processing circuit 180 carries out pattern match to them.Computer antivirus can be used Class processor mode and class memory mode: for class processor mode, the user data stored in computer is as input number It is transmitted to distributed mode processor 200 according to 110,3D-M array 170 stores virus identifications library, and mode processing circuit 180 is to it Carry out pattern match；For class memory mode, virus identifications are sent to distributed mode processor as input data 110 200, user data is stored in 3D-M array 170, and mode processing circuit 180 carries out pattern match to them.In class processor In mode, 3D-M can be 3D-OTP or 3D-MTP, it is for storing network standard library and virus identifications library.In class memory side In formula, 3D-M is preferably 3D-MTP, it stores customer data base.

As another example, distributed mode processor 200 can be used for big data analysis (such as finance data analysis, electricity Quotient data analysis, bioinformatics).Big data analysis is related to unstructured data or semi-structured data.It is traditional, using pass Be type database (relational database) analysis method it is helpless to this.Distributed mode processor 200 can mention Tall and big data analysis capabilities.In order to improve efficiency, preferably with class memory mode: big data is as archives storage at 3D-M gusts In column 170, the keyword for data analysis is sent as input pattern data 110 to distributed mode processor 200, at mode It manages circuit 180 and pattern match is carried out to them.In big data analysis, 3D-M is preferably 3D-MTP, it is for storing number of users According to.

Distributed mode processor 200 can be also used for speech recognition and/or image recognition.It, can be in identification process Using class processor mode and class memory mode.For class processor mode, voice/image data that user generates is as defeated Enter data 110 to send to distributed mode processor 200,3D-M array 170 store various identification model libraries (such as acoustic model repository, Language model library, iconic model library etc.), schema processor 180 is identified later.Class memory mode, user are generated Voice/image data is as archives storage in 3D-M array 170, and the speech signal or picture signal required to look up is as input Data 110 are sent to distributed mode processor 200, and mode processing circuit 180 is identified and searched later.In class processor side In formula, 3D-M can be 3D-P, 3D-OTP or 3D-MTP, it stores acoustic model repository, language model library, iconic model library etc.. In class memory mode, 3D-M is preferably 3D-MTP, its storaged voice/image file library.

It should be appreciated that under the premise of not far from the spirit and scope of the present invention, it can be to form and details of the invention It is modified, this does not interfere them using spirit of the invention.Therefore, in addition to the spirit according to appended claims, The present invention should not be any way limited.

Claims (10)

1. a kind of memory (200) for having both virus investigation function, it is characterised in that contain:

The input bus (110) of an one transmission at least virus identifications (virus signature)；

Semi-conductive substrate (0) and multiple storage processing units (100aa-100mn), the multiple storage processing unit are defeated with this Enter bus (110) coupling, each storage processing unit (100ij) contains at least one three-dimensional storage (3D-M) array (170) and one Mode processing circuit (180), in which:

The 3D-M array (170) is stacked on above the substrate (0), which stores an at least user data；

The mode processing circuit (180) is located in the substrate (0), and the mode processing circuit (180) is to the virus identifications and is somebody's turn to do User data carries out pattern-recognition or pattern match；

The 3D-M array (170) and the mode processing circuit (180) are coupled by multiple contact access openings (1av, 3av).

2. memory (200) according to claim 1, it is further characterized in that: the 3D-M is three-dimensional writeable storage member (3D-W).

3. memory (200) according to claim 1, it is further characterized in that: the 3D-M array is a three-dimensional primary volume Journey memory (3D-OTP) array.

4. memory (200) according to claim 1, it is further characterized in that: the 3D-M array is a three-dimensional repeatedly volume Journey memory (3D-MTP) array.

5. memory (200) according to claim 1, it is further characterized in that: the 3D-M array (170) covers at least partly The mode processing circuit (180).

6. memory (200) according to claim 1, it is further characterized in that: the mode processing circuit (180) is by least Two 3D-M array (170A, 170B) coverings.

7. memory (200) according to claim 1, it is further characterized in that: the mode processing circuit (180) is by least Four 3D-M array (170A-170D) coverings.

8. memory (200) according to claim 1, it is further characterized in that: the mode processing circuit (180) is by least Eight 3D-M array (170A-170D, 170W-170Z) coverings.

9. memory (200) according to claim 1, it is further characterized in that: the multiple contact access opening (1av, 3av) constitute a big bandwidth electrical connection.

10. memory (200) according to claim 1, it is further characterized in that: the memory is in storage user data Virus investigation function is had both simultaneously.