TW201830284A - Data storage system, data storage method and data read method - Google Patents

Abstract

A data storage system, a data storage method and a data read method are provided. The data storage system includes a host system and a memory storage device. The host system transmits an encryption write command which carries a first code and instructs to store data to at least one logical unit according to the first code. The memory storage device encrypts the data by the first code according to the encryption write command and stores encrypted data to at least one physical unit. The host system transmits a decryption read command which carries a second code and instructs to read the data from said logical unit. The memory storage device read the encrypted data from said physical unit and decrypts the encrypted data by the second code according to the decryption read command and then transmits the decrypted data to the host system.

Description

Data storage system, data storage method and data reading method

The present invention relates to a data storage technology, and more particularly to a data storage system, a data storage method, and a data reading method.

In order to prevent data from being stolen, some memory storage devices provide additional encryption. When the host system wants to store data, the host system sends a general write command, and the memory storage device encrypts the corresponding data according to the general write command. Thereafter, when the host system wants to read the previously stored data, the host system sends a general read command, and the memory storage device reads the corresponding data according to the general read command, decrypts it, and transmits it to the host. system. Thereby, when the data stored in the memory storage device is stolen, unless the thief knows the encryption key of the memory storage device, the stolen data may be garbled and cannot be restored to the original data.

However, memory storage devices that provide encrypted storage are generally supported for full hard disk encryption. The host system cannot directly specify the encryption function provided by the memory storage device, and the user cannot decide which data is encrypted by the memory storage device.

In view of the above, the present invention provides a data storage system, a data storage method, and a data reading method, which can be dynamically controlled by a host system to perform encrypted storage by a memory storage device.

An embodiment of the invention provides a data storage system including a host system and a memory storage device. The memory storage device is coupled to the host system via a connection interface, wherein the host system is configured to send an encrypted write command with a first password and to indicate that the data is stored in the at least one according to the first password a logic unit, wherein the at least one logic unit is mapped to at least one physical unit of the memory storage device, wherein the memory storage device is configured to encrypt the data using the first password according to the encrypted write command And storing the encrypted data to the at least one physical unit, wherein the host system is further configured to send a decrypted read command with a second password and indicating to read from the at least one logical unit according to the second password The first data, wherein the memory storage device is further configured to read the encrypted data from the at least one physical unit according to the decrypted read instruction and decrypt the encrypted data using the second password and A decrypted data is transmitted to the host system.

Another embodiment of the present invention provides a data storage method for a host system, the data storage method comprising: transmitting an encrypted write command with a first password and indicating that the data is stored according to the first password At least one logical unit, wherein the at least one logical unit is mapped to at least one physical unit of the memory storage device, and the first password is used to encrypt the data in the memory storage device; and in the file system The at least one logical unit is marked as a hardware encrypted state.

Another embodiment of the present invention provides a data reading method for a host system, the data reading method comprising: determining whether at least one logical unit is marked as a hardware encrypted state in a file system, wherein the at least one a logical unit mapped to at least one physical unit of the memory storage device; and if the at least one logical unit is marked as the hardware encrypted state, transmitting a decrypted read command with a second password and indicating The second password reads data from the at least one logical unit, wherein the second password is used to decrypt the material in the memory storage device.

Based on the above, the present invention allows the host system to notify that the specific data needs to be encrypted and stored by the memory storage device by setting a specific encrypted write command and the decrypted read command, and can smoothly from the memory when reading the data. The storage device reads the decrypted data. Thereby, the protection efficiency and operational flexibility of the data can be improved.

The above described features and advantages of the invention will be apparent from the following description.

FIG. 1 is a schematic diagram of a data storage system according to an embodiment of the invention. Referring to FIG. 1, the data storage system 10 includes a host system 11 and a memory storage device 12. The host system 11 can store data in or read from the memory storage device 12. For example, the host system 11 is any system that can substantially cooperate with the memory storage device 12 to store data, such as a computer system, a digital camera, a video camera, a communication device, an audio player, a video player, or a tablet computer, and the like. The storage device 12 is a flash drive, a memory card, a solid state drive (SSD), a Secure Digital (SD) card, a Compact Flash (CF) card, or an embedded storage device. Non-volatile memory storage device.

2 is a functional block diagram of a host system and a memory storage device according to an embodiment of the invention. Referring to FIG. 2, the host system 11 includes a processor 211, a buffer memory 212, and a connection interface 213. The processor 211 is coupled to the buffer memory 212 and the connection interface 213. The processor 211 is used to control the overall operation of the host system 11. For example, processor 211 can be a central processing unit (CPU) or any form of processing circuit. The buffer memory 212 contains various types of volatile memory. For example, buffer memory 212 can include one or more dynamic random access memory (DRAM).

The connection interface 213 is coupled to the memory storage device 12 . For example, the connection interface 213 may be compatible with Serial Advanced Technology Attachment (SATA), Parallel Advanced Technology Attachment (PATA), Peripheral Component Interconnect Express (PCI Express) or general purpose. Various serial interface standards such as the serial bus (Universal Serial Bus, USB). In addition, in another embodiment, the host system 11 also includes any hardware devices required for practical purposes, such as a network interface card, a keyboard (or trackpad), a screen, and/or a speaker.

The memory storage device 12 includes a memory controller 121, a memory array 222, a connection interface 223, and an encryption/decryption engine 224. The memory controller 121 is coupled to the memory array 222, the connection interface 223, and the encryption/decryption engine 224. The memory controller 121 is configured to execute a plurality of logic gates or control commands implemented in a hard type or a firmware type and perform writing, reading and erasing of data in the memory array 222 according to an instruction of the host system 11. Waiting for the operation. In addition, the memory controller 221 also controls the overall operation of the memory storage device 12.

The memory array 222 includes a plurality of memory cells and is used to store data written by the host system 11. For example, the memory array 222 can be a single level cell (SLC) NAND type flash memory module (ie, a memory cell can store 1 bit of flash memory module), multi-order cells. (multi level cell, MLC) NAND flash memory module (ie, a memory cell can store 2 bits of flash memory module) or triple level cell (TLC) NAND flash The memory module (ie, a memory cell can store a 3-bit flash memory module). In addition, the memory cells in the memory array 222 store data in a change in threshold voltage.

The connection interface 223 can be a variety of connection interface standards compatible with advanced serial accessories, parallel advanced accessories, high speed peripheral component connection interfaces, or universal serial busses. The host system 11 and the memory storage device 12 can communicate and transmit various instructions and materials via the connection interfaces 213 and 223. The encryption/decryption engine 224 includes at least one hardware encryption/decryption circuit and supports at least one encryption/decryption algorithm. In the present embodiment, the encryption/decryption engine 224 is an advanced encryption standard (AES) engine and uses an advanced encryption standard algorithm to encrypt and decrypt data. In another embodiment, the encryption/decryption engine 224 may also use other types of encryption/decryption algorithms, such as RSA algorithms and the like, which are not limited in the present invention. In addition, the memory storage device 12 can also have basic components such as a buffer memory and a power management module, and will not be described herein.

In the present embodiment, the host system 11 manages to manage a plurality of logical units using a file system. Wherein, one logical unit may be a logical block address (LBA) or composed of multiple logical block addresses. When the data is to be stored, the host system 11 instructs the memory storage device 12 to store the data to a certain logical unit. When the data is to be read, the host system 11 instructs the memory storage device 12 to read data from a certain logical unit. In addition, when the data is to be deleted, the host system 11 instructs the memory storage device 12 to delete the data stored by a certain logical unit.

FIG. 3 is a timing diagram of a data access mechanism according to an embodiment of the invention. Referring to FIG. 3, in step S301, when a piece of data (also referred to as original data) is to be stored using the hardware encryption of the memory storage device 12, the host system 11 sends an encrypted write command to the memory storage device. 12. Unlike a normal write command, an encrypted write command has a password (also known as a first password). The encrypted write command is configured to indicate that the original data is stored in the at least one logical unit according to the first password, wherein the at least one logical unit is mapped to the at least one physical unit of the memory storage device 12, and the first password is used in The original data is encrypted in the memory storage device 12.

In this embodiment, one physical unit may be a physical block address (PBA). In another embodiment, one physical unit may also be composed of multiple physical block addresses. A physical block address can be used to locate a physical block in memory array 222. For example, multiple memory cells belonging to the same physical block in the memory array 222 can be used sequentially but will be erased at the same time. For convenience of explanation, the logical unit for storing the original material is indicated by the host system 11 in LBA0, and the physical unit to which the logical unit LBA0 is mapped is represented by PBA0.

In step S302, the memory storage device 12 encrypts the data (ie, the original data) using the first password according to the received encrypted write command and stores the encrypted data to the physical unit PBA0. For example, the memory controller 221 obtains the first password from the encrypted write command and instructs the encryption/decryption engine 224 to encrypt the original data using the first password to obtain encrypted material. Then, the memory controller 221 queries a logical to physical mapping table to obtain the physical unit PBA0 and instructs the memory array 222 to store the encrypted data in the physical unit PBA0.

In other words, the material stored at the physical unit PBA0 at this time is the encrypted data generated by the encryption/decryption engine 224 performing encryption on the original material based on the first password. Moreover, in an embodiment, in addition to the first password, the encryption/decryption engine 224 also uses a hash key to encrypt the original data to obtain the encrypted material. For example, this hash key is recorded in the encryption/decryption engine 224 and is not provided by the encrypted write command.

In step S303, when the data stored using the hardware encryption of the memory storage device 12 is to be read, the host system 303 transmits a decryption read command. Unlike a normal read command, the decrypt read command has a password (also known as a second password). The decrypt read command is used to instruct to read data from the logical unit LBA0 according to the second password. In the present embodiment, the second password is used to decrypt the encrypted material in the memory storage device 12. For example, the second password is the same as the first password.

In step S304, the memory storage device 12 reads the encrypted material from the physical unit PBA0 according to the received decrypted read command and decrypts the encrypted data using the second password. For example, after receiving the decrypted read command, the memory controller 221 queries the logical entity mapping table to obtain the physical unit PBA0 and instructs the memory array 222 to read the encrypted data stored in the physical unit PBA0. Additionally, the memory controller 221 obtains the second password from the decrypted read command and instructs the encryption/decryption engine 224 to decrypt the encrypted data using the second password to obtain decrypted material. In an embodiment, in addition to the second password, the encryption/decryption engine 224 also uses the hash key to decrypt the encrypted material to obtain the decrypted material.

In step S304, the memory storage device 12 transmits the decrypted data to the host system 11. It should be noted that if the second password and the hash key used by the encryption/decryption engine 224 to decrypt the encrypted data are correct, the generated decrypted data will be identical to the original data before encryption. However, if at least one of the second password and the hash key used by the encryption/decryption engine 224 is incorrect, the encryption/decryption engine 224 decrypts the encrypted material to obtain a string of garbled characters that are meaningless. In an embodiment, this garbled code will still be transmitted to the host system 11.

In an embodiment, the host system 11 uses a general read command to read the logic that currently stores the hardware-encrypted data, except that the second password is different from the first password, causing the memory storage device 12 to return the garbled code. The unit, memory storage device 12 will also return garbled characters. Therefore, using the normal read command will not be able to read the original data stored using the encrypted write command.

FIG. 4 is a timing diagram of a data access mechanism according to another embodiment of the invention. Referring to FIG. 4, in step S401, when a certain piece of data (ie, original data) is to be stored using the hardware encryption of the memory storage device 12, the host system 11 sends an encrypted write command to the memory storage device 12. . The encrypted write command has a first password and is used to indicate that the original data is stored in the logical unit LBA0 according to the first password, wherein the logical unit LBA0 is mapped to the physical unit PBA0 of the memory storage device 12.

In step S402, the memory storage device 12 encrypts the data (ie, the original data) using the first password according to the received encrypted write command and stores the encrypted data to the physical unit PBA0. Steps S401 and S402 are respectively the same or similar to steps S301 and S302 in FIG. 3, and the details are not repeated here.

In step S403, when the data stored by the hardware encryption using the memory storage device 12 is to be read, if the host system 11 sends a general read command to instruct reading from the logical unit LBA0, the memory is stored. The device 12 is unable to obtain the second password (or the first password) from the general read command, so in step S404, the memory storage device 12 reads the encrypted material from the physical unit PBA0, but does not decrypt the encrypted data. Then, in step S405, the memory storage device 12 transmits the undecrypted material (i.e., the read encrypted data) to the host system 11. For example, the undecrypted data is a string of garbled characters.

In other words, for the data protected by the host system 11 to be protected by the hardware encryption of the memory storage device 12, if the data is stolen without being decrypted by the encryption/decryption engine 224, or by the first encryption. If the password is read by another host system, the data will be garbled back to protect the original data content.

In an embodiment, upon receiving a data storage operation corresponding to at least one logical unit (eg, logical unit LBA0), host system 11 determines whether to use hardware encryption of memory storage device 12. If the hardware encryption of the memory storage device 12 is to be used, the host system 11 temporarily stores the data to be stored and the first password in the buffer memory 212 and according to the data and the temporary storage in the buffer memory 212. A password generates an encrypted write command. This encrypted write command can be sent to the memory storage device 12 in step S301 of FIG. 3 or step S401 of FIG.

On the other hand, if the hardware encryption of the memory storage device 12 is not required, the host system 11 temporarily stores the data to be stored in the buffer memory 212 and generates the data according to the data temporarily stored in the buffer memory 212. Write instructions. The general write command does not carry the first password and is used to indicate that the data to be stored is stored in the at least one logical unit (eg, logical unit LBA0). In other words, the data stored according to the general write command will not be encrypted by the encryption/decryption engine 224. In addition, the data stored according to the general write command can also be read directly using the general read command without reading garbled characters.

In one embodiment, whether or not to use the hardware encryption of the memory storage device 12 can be determined based on a data storage operation performed by the user. For example, when the user performs a data storage operation, the user can choose whether to use hardware encryption. Alternatively, in an embodiment, whether or not to use the hardware encryption of the memory storage device 12 may be automatically determined by the host system 11 based on information such as the type of data to be stored or the storage location. For example, if the information to be stored is sensitive information related to identity information (for example, identity card number or various account passwords, etc.) or stored in an important folder requiring additional protection, the host system 11 can automatically enable the Hardware encryption.

In an embodiment, if a logical unit (eg, logical unit LBA0) is used to store hardware encrypted data, host system 11 marks the logical unit (eg, logical unit LBA0) in the file system. Encrypted state for the hardware. For example, the file name of the file of the logical unit LBA0 can be set to ".aes" as a mark of the hardware encryption state in the file system. It should be noted that if the host system 11 also supports the host-side encryption operation using the encryption software, the logical unit for storing the encrypted data via the host-side encryption operation may be marked as the software encryption state. The marked hardware encryption status will not be the same as the marked software encryption status. For example, the file name of a certain logical unit file may be set to ".host" as a mark of the software encryption state in the file system, but the specific mark content is not limited to this.

In an embodiment, upon receiving a data read operation corresponding to at least one logical unit (eg, logical unit LBA0), host system 11 also determines whether the logical unit to be read is marked in the file system as Hardware encryption status. If the logical unit to be read is marked as a hardware encrypted state, the host system 11 will use the corresponding decrypted read command to read the data. For the operation of reading data using the decryption read command, reference may be made to the description of steps S303 and S304 of FIG. 3, and details are not described herein. Conversely, if the logical unit to be read is not marked as a hardware encrypted state, the host system 11 can directly read the data using a general read command.

FIG. 5 is a flowchart of a data storage method according to an embodiment of the invention. Referring to FIG. 5, in step S501, a data storage operation corresponding to at least one logical unit is received. For example, this data storage operation may be that the user stores a file. In step S502, it is determined whether or not to use the hardware encryption of the memory storage device. If hardware encryption is to be used, in step S503, an encrypted write command with a password is sent to indicate that the data is stored in at least one logical unit according to the first password. If it is determined that hardware encryption is not required, in step S504, a general write command without the first password is sent to indicate that the data is stored in the at least one logical unit. In addition, if hardware encryption is to be used, in step S505, the at least one logical unit is marked as a hardware encrypted state in the file system.

FIG. 6 is a flowchart of a data reading method according to an embodiment of the invention. Referring to FIG. 6, in step S601, a data reading operation corresponding to at least one logical unit is received. For example, this data reading operation may be when a user opens a file. In step S602, it is determined whether the at least one logical unit is marked as a hardware encrypted state in the file system. If the at least one logical unit is marked as a hardware encrypted state in the file system, in step S603, a decrypted read command with a second password is sent to indicate that the at least one logical unit is read according to the second password. data. On the other hand, if the at least one logical unit is not marked as a hardware encrypted state in the file system, in step S604, a general read command without the second password is sent to indicate reading from the at least one logical unit. data.

However, the steps in FIGS. 3 to 6 have been described in detail above, and will not be described again. It should be noted that the steps in FIG. 3 to FIG. 6 can be implemented as a plurality of codes or circuits, and the present invention is not limited. In addition, the methods of FIG. 3 to FIG. 6 may be used in combination with the above exemplary embodiments, or may be used alone, and the invention is not limited thereto.

In summary, the present invention allows the host system to notify that a specific data needs to be encrypted and stored by the memory storage device by setting a specific encrypted write command and a decrypt read command, and can smoothly be read from the data. The memory storage device reads the decrypted data. Thereby, the protection efficiency and operational flexibility of the data can be improved. In addition, by marking a specific logical unit as a hardware encryption state in the file system of the host system, the host system can also dynamically determine whether to use an encrypted read command or a normal read command to read data when reading data.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention, and any one of ordinary skill in the art can make some changes and refinements without departing from the spirit and scope of the present invention. The scope of the invention is defined by the scope of the appended claims.

10‧‧‧ Data Storage System

11‧‧‧Host system

12‧‧‧Memory storage device

211‧‧‧ processor

212‧‧‧Buffered memory

213, 223‧‧‧ connection interface

221‧‧‧ memory controller

222‧‧‧ memory array

224‧‧‧Add/Decrypt Engine

S301~S305, S401~S405, S501~S505, S601~S604‧‧‧ steps

FIG. 1 is a schematic diagram of a data storage system according to an embodiment of the invention. 2 is a functional block diagram of a host system and a memory storage device according to an embodiment of the invention. FIG. 3 is a timing diagram of a data access mechanism according to an embodiment of the invention. FIG. 4 is a timing diagram of a data access mechanism according to another embodiment of the invention. FIG. 5 is a flowchart of a data storage method according to an embodiment of the invention. FIG. 6 is a flowchart of a data reading method according to an embodiment of the invention.

Claims (9)

A data storage system, comprising: a host system; and a memory storage device coupled to the host system via a connection interface, wherein the host system is configured to send an encrypted write command with a first password and Instructing to store, according to the first password, a data in at least one logical unit, wherein the at least one logical unit is mapped to at least one physical unit of the memory storage device, wherein the memory storage device is configured to use according to the encrypted write instruction The first password encrypts the data and stores an encrypted data to the at least one physical unit, wherein the host system is further configured to send a decrypted read command with a second password and indicating from the at least the second password a logic unit reads the data, wherein the memory storage device is further configured to read the encrypted data from the at least one physical unit according to the decrypted read command and decrypt the encrypted data and transmit the decrypted data by using the second password Give the host system. The data storage system of claim 1, wherein the host system is further configured to mark the at least one logical unit as a hardware encrypted state in a file system. The data storage system of claim 1, wherein the host system includes a buffer memory, wherein the host system is further configured to temporarily store the data and the first password in the buffer memory according to the temporary The data stored in the buffer memory and the first password generate the encrypted write command. The data storage system of claim 1, wherein when the data stored in the at least one logical unit is to be read, the host system is further configured to determine whether the at least one logical unit is in a file system. Marked as a hardware encrypted state, wherein the operation of the decryption read command by the host system is performed corresponding to determining that the at least one logical unit is marked as the hardware encrypted state in the file system. The data storage system of claim 1, wherein if the host system sends a general read command without the second password to indicate that the data is read from the at least one logical unit, the memory is stored. The device is further configured to transmit the encrypted data read from the at least one physical unit and not yet decrypted to the host system. A data storage method for a host system, the data storage method comprising: transmitting an encrypted write command with a first password and indicating that a data is stored in the at least one logical unit according to the first password, wherein the at least one a logical unit is mapped to at least one physical unit of a memory storage device, and the first password is used to encrypt the data in the memory storage device; and the at least one logical unit is marked as a hard file in a file system Body encryption status. The data storage method of claim 6, further comprising: temporarily storing the data and the first password in a buffer memory of the host system; and according to the temporary storage in the buffer memory The data and the first password generate the encrypted write command. A data reading method for a host system, the data reading method comprising: determining whether at least one logical unit is marked as a hardware encrypted state in a file system, wherein the at least one logical unit is mapped to a memory At least one physical unit of the storage device; and if the at least one logical unit is marked as the hardware encrypted state, transmitting a decrypted read command with a second password and indicating from the at least one logical unit based on the second password Reading a data, wherein the second password is used to decrypt the data in the memory storage device. The method for reading data according to claim 8 further includes: if the at least one logical unit is not marked as the hardware encryption state, sending a general read command without the second password, Instructing to read the material from the at least one logical unit.