JP2020038426A - Storage device and control method of storage device - Google Patents

Abstract

To provide a storage device and a control method of the storage device which can prevent leakage of information, when a flash memory device is carried out from a storage apparatus with illicit means.SOLUTION: A storage device mounted in a storage apparatus 100 comprises a controller 101, a flash memory 102, an interface 110, a battery 115 and a removal detecting circuit 111. The removal detecting circuit sets in a flag a value indicating the protection of data stored in the flash memory, when a command for removing the storage device from the storage apparatus is detected; refers to the value of the flag, and determines whether or not the data stored in the flash memory are to be protected, when it is detected that the storage device was removed from the storage apparatus; and outputs the command indicating the destruction of the data stored in the flash memory to a controller, when determining that the data stored in the flash memory are not protected.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a storage device mounted on a storage apparatus and a control method thereof. In particular, the present invention relates to a storage device for preventing information leakage and a control method thereof.

  2. Description of the Related Art In recent years, instead of HDDs (Hard Disk Drives), storage devices equipped with flash memory devices such as SSDs (Solid State Drives) as storage devices have become widespread.

  Flash memory devices employ a different control scheme than HDDs. In particular, since data is erased in blocks, the flash memory device has a characteristic that data is not completely erased. Therefore, when information such as personal information and confidential information is stored in the flash memory device, there is a problem that the information is leaked. On the other hand, the techniques described in Patent Literature 1 and Patent Literature 2 are known.

  Patent Document 1 discloses a method of recording a file on a storage medium using a nonvolatile semiconductor storage device having a plurality of erase blocks each including a plurality of memory cells from which data is erased at a time. In the erase block, only one file is recorded, or (b) predetermined data or random data is overwritten on the bit of the memory cell recording the file to be erased. "

  Japanese Patent Application Laid-Open No. H11-163873 discloses that “a partition for recording user data of an information device is provided in a NAND flash memory, and a processor of the NAND flash memory device is configured to execute a command code and an Interpret an erase command consisting of the start sector address of the area and the number of sectors, and erase all data stored in the partition. "

JP 2014-096122 A JP 2010-176399 A

  Both the techniques described in Patent Literature 1 and Patent Literature 2 disclose techniques for erasing data (files) from a flash memory device in order to prevent information leakage. However, none of the techniques considers information leakage when a flash memory device is taken out of a storage device by unauthorized means. That is, when the flash memory device is taken out by unauthorized means, there is a problem that data that has not been deleted can be read from the flash memory device.

  The present invention provides a flash memory device and a flash memory device control method for preventing information leakage when the flash memory device is taken out by unauthorized means.

  A typical example of the invention disclosed in the present application is as follows. That is, a storage device mounted on a storage device, which includes a controller, a flash memory, an interface for connecting to the storage device, and a battery, and further determines whether to protect data stored in the flash memory. When detecting a command to remove the storage device from the storage device, the removal detection unit determines a value indicating protection of data stored in the flash memory by the flash unit. A flag for controlling an operation on data stored in the memory is set, and when it is detected that the storage device is removed from the storage device, the flag is stored in the flash memory by referring to the value of the flag. The data to be protected and store it in the flash memory. If the data is determined not to protect that, the first command instructing the destruction of data stored in the flash memory, and outputs to the controller.

  According to the present invention, when removal of a storage device (flash memory device) by unauthorized means is detected, data stored in the storage device can be reliably destroyed. Thus, information leakage can be prevented.

FIG. 2 illustrates an example of a configuration of a storage device according to the first embodiment. 5 is a flowchart illustrating a removal flag management process performed by the removal detection circuit according to the first embodiment. 6 is a flowchart illustrating data destruction determination processing executed by the removal detection circuit according to the first embodiment. 5 is a flowchart illustrating a process performed by the ASSP according to the first embodiment. FIG. 9 illustrates an example of a configuration of a storage device according to a second embodiment. 9 is a flowchart illustrating a data destruction determination process performed by a removal detection circuit according to the second embodiment. 9 is a flowchart illustrating a removal flag management process performed by a removal detection circuit according to a second embodiment. 11 is a flowchart illustrating a process performed by the ASSP according to the second embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. Note that the present invention is not construed as being limited to the description of the embodiments below. It is easily understood by those skilled in the art that the specific configuration can be changed without departing from the spirit or spirit of the present invention.

  In the structures of the invention described below, the same or similar structures or functions are denoted by the same reference numerals, and redundant description will be omitted.

  FIG. 1 is a diagram illustrating an example of a configuration of the storage device according to the first embodiment.

  The storage device 100 provides a storage area to a host computer (not shown) connected to the storage device 100. The storage device 100 includes a controller 101, a flash memory device 102, and a power supply 103. The storage device 100 may include two or more flash memory devices 102. Further, the storage device 100 may include a network interface, an input device, and an output device.

  The controller 101 controls the entire storage device 100. The controller 101 includes an interface (not shown) for connecting to a processor, a memory, and a flash memory device 102.

  The power supply 103 supplies power to hardware included in the storage device 100, such as the controller 101 and the flash memory device 102.

  The flash memory device 102 is a storage device that provides a storage area. It is assumed that the flash memory device 102 according to the present embodiment is mounted in a removable form without turning off the power of the storage device 100. For example, it is a storage device mounted on a large-scale storage device 100.

  The flash memory device 102 includes an interface 110, a removal detection circuit 111, an Application Specific Standard Product (ASSP) 112, a cache memory 113, a flash memory 114, and a battery 115.

  The interface 110 is an interface for connecting to the controller 101. The ASSP 112 is an integrated circuit that functions as a controller that controls the flash memory device 102. The ASSP 112 executes firmware (not shown) for controlling the flash memory device 102.

  The cache memory 113 is a storage device including a volatile storage element, and provides a storage area for temporarily storing data. The cache memory 113 is, for example, a DRAM (Dynamic Random Access Memory). The flash memory 114 is a storage device including a nonvolatile storage element, and provides a storage area for permanently storing data. The flash memory 114 is, for example, a NAND flash memory.

  The present invention is not limited to the types of storage elements forming the cache memory 113 and the flash memory 114.

  The battery 115 supplies power to hardware included in the flash memory device 102 when the flash memory device 102 is removed from the storage device 100.

  The removal detection circuit 111 determines whether the removal of the flash memory device 102 from the storage device 100 is based on a regular procedure. The removal detection circuit 111 manages a removal flag for controlling operations on data stored in the flash memory 114.

  One of “ON” indicating protection of data and “OFF” indicating destruction of data is set in the removal flag. The initial value of the removal flag is set to “OFF”.

  Here, the processing executed by the removal detection circuit 111 will be described in detail with reference to FIGS.

  FIG. 2 is a flowchart illustrating a removal flag management process performed by the removal detection circuit 111 according to the first embodiment. When the power from the power supply 103 is supplied to the flash memory device 102, that is, when the flash memory device 102 is connected to the storage device 100, the removal detection circuit 111 starts the processing described below.

  First, the removal detection circuit 111 sets “OFF” to the removal flag (step S101), and thereafter starts monitoring the removal command.

  The removal detection circuit 111 determines whether or not the removal command issued by the controller 101 has been detected (step S102).

  The removal command may be, for example, a command for releasing the mount of the flash memory device 102 or a command for releasing the logical connection between the storage apparatus 100 and the flash memory device 102. It is assumed that the command detected as the removal command is set in advance. The command to be detected can be updated at any time. Note that the present invention is not limited to the type of command detected as the removal command.

  When it is determined that the removal command has not been detected, the removal detection circuit 111 continues to monitor the removal command.

  If it is determined that the removal command has been detected, the removal detection circuit 111 sets the removal flag to “ON” (step S103), and ends the removal flag management process.

  When the flash memory device 102 is removed from the storage device 100, the removal detection circuit 111 ends the removal flag management processing.

  FIG. 3 is a flowchart illustrating a data destruction determination process performed by the removal detection circuit 111 according to the first embodiment. When the power from the power supply 103 is supplied to the flash memory device 102, that is, when the flash memory device 102 is connected to the storage device 100, the removal detection circuit 111 starts the processing described below.

  The removal detection circuit 111 determines whether removal of the flash memory device 102 from the storage device 100 has been detected (step S201).

  For example, when the removal detection circuit 111 detects that the supply of power from the power supply 103 has been stopped, the removal detection circuit 111 determines that the flash memory device 102 has been removed from the storage device 100. When the supply of power from the power supply 103 is stopped, the battery 115 starts supplying power to each piece of hardware.

  If it is determined that the removal of the flash memory device 102 from the storage device 100 has not been detected, the removal detection circuit 111 continues monitoring the removal of the flash memory device 102 from the storage device 100.

  If it is determined that the removal of the flash memory device 102 from the storage device 100 has been detected, the removal detection circuit 111 starts a timer (step S202).

  The timer is provided to prevent data from being destroyed due to removal of the flash memory device 102 due to an erroneous operation. As an erroneous operation, for example, an operation in which the user removes the flash memory device 102 from the storage device 100 without issuing a command can be considered. After the removal of the flash memory device 102 due to an erroneous operation, control is performed so that the data is not destroyed when the user immediately reconnects the flash memory device 102 to the storage apparatus 100.

  Next, the removal detection circuit 111 determines whether reconnection of the flash memory device 102 to the storage device 100 has been detected (step S203).

  For example, the removal detection circuit 111 determines that the flash memory device 102 has been reconnected to the storage device 100 when detecting that the supply of power from the power supply 103 has been restarted during operation using the battery 115.

  If it is determined that reconnection of the flash memory device 102 to the storage device 100 has not been detected, the removal detection circuit 111 proceeds to step S205.

  If it is determined that reconnection of the flash memory device 102 to the storage device 100 has been detected, the removal detection circuit 111 sets the removal flag to “ON” (step S204), and then proceeds to step S205.

  After the determination result of step S203 is NO or the process of step S204 is performed, the removal detection circuit 111 determines whether the elapsed time measured by the timer is greater than a threshold value (step S205). The threshold is set in advance. The threshold can be updated at any timing.

  If it is determined that the elapsed time is equal to or less than the threshold, the removal detection circuit 111 continues monitoring the reconnection of the flash memory device 102 to the storage device 100.

  If it is determined that the elapsed time is longer than the threshold, the removal detection circuit 111 refers to the removal flag (Step S206) and determines whether the removal flag is “ON” (Step S207).

  If the removal flag is determined to be “ON”, the removal detection circuit 111 issues a data protection instruction to the ASSP 112 (step S208), and ends the data destruction determination process.

  If it is determined that the removal flag is “OFF”, the removal detection circuit 111 issues a data destruction instruction to the ASSP 112 (step S209), and ends the data destruction determination process.

  When it is not necessary to consider an erroneous operation, the processing from step S202 to step S205 may be omitted.

  FIG. 4 is a flowchart illustrating a process performed by the ASSP 112 according to the first embodiment. After the power from the power supply 103 is supplied to the flash memory device 102, the ASSP 112 starts processing described below.

  The ASSP 112 determines whether a command has been received from the removal detection circuit 111 (step S301).

  If it is determined that no command has been received from the removal detection circuit 111, the ASSP 112 continues to monitor the command transmitted from the removal detection circuit 111.

  When it is determined that the command has been received from the removal detection circuit 111, the ASSP 112 determines whether the received command is a data destruction command (step S302).

  When it is determined that the received command is a data destruction command, the ASSP 112 executes a data destruction process (step S303), and thereafter ends the process.

  Specifically, the ASSP 112 writes a random value to the entire storage area of the flash memory 114.

  If it is determined that the received command is not a data destruction command, the ASSP 112 determines whether the received command is a data protection command (step S304).

  When it is determined that the received instruction is a data protection instruction, the ASSP 112 determines whether data exists in the cache memory 113 (step S303).

  If it is determined that no data exists in the cache memory 113, the ASSP 112 ends the processing.

  When it is determined that data exists in the cache memory 113, the ASSP 112 performs a data protection process (step S306), and thereafter ends the process.

  Specifically, the ASSP 112 writes data existing in the cache memory 113 to the flash memory 114.

  If it is determined in step S304 that the received command is not a data protection command, the ASSP 112 executes a process corresponding to the received command (step S307). For example, the ASSP 112 reads data from the flash memory 114 or writes data to the flash memory 114. After executing the processing, the ASSP 112 continues monitoring the command transmitted from the removal detection circuit 111.

  The data destruction command and the data protection command are commands issued while power is supplied from the battery 115. Therefore, the ASSP 112 ends the processing after executing the data destruction processing or the data protection processing.

  Although the removal detection circuit 111 and the ASSP 112 are described as separate hardware, the removal detection circuit 111 may be included in the ASSP 112. Further, the function of the removal detection circuit 111 may be included in the firmware executed by the ASSP 112.

  According to the first embodiment, when the flash memory device 102 is removed from the storage device 100 by an unauthorized means, the data stored in the flash memory device 102 is automatically destroyed. Thereby, information leakage can be prevented.

  In addition, when power is supplied from the battery 115, data stored in the cache memory 113 is written to the flash memory 114, so that data corruption and data inconsistency can be prevented.

  In the second embodiment, the hardware configuration and processing contents of the flash memory device 102 are partially different from the first embodiment. Hereinafter, the second embodiment will be described focusing on differences from the first embodiment.

  FIG. 5 is a diagram illustrating an example of a configuration of the storage device according to the second embodiment.

  The hardware configuration of the storage device 100 of the second embodiment is the same as that of the first embodiment. In the second embodiment, the hardware configuration of the flash memory device 102 is different. Specifically, the flash memory device 102 of the second embodiment does not include the battery 115.

  FIG. 6 is a flowchart illustrating a data destruction determination process performed by the removal detection circuit 111 according to the second embodiment. When the power from the power supply 103 is supplied to the flash memory device 102, that is, when the flash memory device 102 is connected to the storage device 100, the removal detection circuit 111 starts the processing described below.

  The removal detection circuit 111 refers to the removal flag (step S401), and determines whether or not the removal flag is “ON” (step S402).

  If the removal flag is determined to be “ON”, the removal detection circuit 111 proceeds to step S404.

  If the removal flag is determined to be “OFF”, the removal detection circuit 111 issues a data destruction instruction to the ASSP 112 (step S403), and then proceeds to step S404.

  After the determination result of step S402 is YES or the process of step S403 is performed, the removal detection circuit 111 sets the removal flag to “OFF” (step S404), and thereafter starts the removal flag management process.

  FIG. 7 is a flowchart illustrating a removal flag management process performed by the removal detection circuit 111 according to the second embodiment.

  The removal detection circuit 111 determines whether or not the removal command issued by the controller 101 has been detected (step S501). The process of step S501 is the same as step S102.

  If it is determined that the removal command has not been detected, the removal detection circuit 111 proceeds to step S503.

  If it is determined that the removal command has been detected, the removal detection circuit 111 sets the removal flag to “ON” (step S502), and then proceeds to step S503.

  After the determination result of step S501 is NO or the processing of step S502 is performed, the removal detection circuit 111 determines whether removal of the flash memory device 102 from the storage device 100 has been detected (step S503).

  For example, when the removal detection circuit 111 detects that the supply of power from the power supply 103 has been stopped, the removal detection circuit 111 determines that the flash memory device 102 has been removed from the storage device 100. Note that the flash memory device 102 according to the second embodiment does not include the battery 115, and thus stops operating when power supply from the power supply 103 stops.

  If it is determined that the flash memory device 102 has been removed from the storage device 100, the removal detection circuit 111 ends the processing.

  If it is determined that the flash memory device 102 has not been removed from the storage device 100, the removal detection circuit 111 continues monitoring the removal command.

  FIG. 8 is a flowchart illustrating a process performed by the ASSP 112 according to the second embodiment. After the power from the power supply 103 is supplied to the flash memory device 102, the ASSP 112 starts processing described below.

  The ASSP 112 determines whether a command has been received from the removal detection circuit 111 (step S601).

  If it is determined that no command has been received from the removal detection circuit 111, the ASSP 112 continues to monitor the command transmitted from the removal detection circuit 111.

  If it is determined that the command has been received from the removal detection circuit 111, the ASSP 112 determines whether the received command is a data destruction command (step S602).

  When it is determined that the received command is a data destruction command, the ASSP 112 executes a data destruction process (step S603). The processing in step S603 is the same as the processing in step S303. After executing the processing, the ASSP 112 continues monitoring the command transmitted from the removal detection circuit 111.

  When it is determined that the received command is not the data destruction command, the ASSP 112 executes a process corresponding to the received command (step S604). The processing in step S604 is the same as the processing in step S307. After executing the processing, the ASSP 112 continues monitoring the command transmitted from the removal detection circuit 111.

  When the flash memory device 102 is removed from the storage device 100, the ASSP 112 ends the processing.

  Although the removal detection circuit 111 and the ASSP 112 are described as separate hardware, the removal detection circuit 111 may be included in the ASSP 112. Further, the function of the removal detection circuit 111 may be included in the firmware executed by the ASSP 112.

  According to the second embodiment, the same effects as those of the first embodiment can be achieved for the flash memory device 102 having no battery 115 such as a USB memory.

  Note that the present invention is not limited to the above-described embodiment, and includes various modifications. Further, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described above. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of one embodiment can be added to the configuration of another embodiment. Further, for a part of the configuration of each embodiment, it is possible to add, delete, or replace another configuration.

  In addition, each of the above-described configurations, functions, processing units, processing means, and the like may be partially or entirely realized by hardware, for example, by designing an integrated circuit. In addition, the above-described configurations, functions, and the like may be realized by software by a processor interpreting and executing a program that realizes each function. Information such as a program, a table, and a file for realizing each function may be stored in a storage device such as a memory, an HDD and an SSD, or a recording medium such as an IC card, an SD card, and an optical disk. In addition, control lines and information lines are shown as necessary for the description, and do not necessarily indicate all control lines and information lines on a product. For example, it may be considered that almost all components are actually connected to each other.

REFERENCE SIGNS LIST 100 Storage device 101 Controller 102 Flash memory device 103 Power supply 110 Interface 111 Removal detection circuit 112 ASSP (Application Specific Standard Product)
113 Cache memory 114 Flash memory 115 Battery

Claims (13)

A storage device mounted on a storage device,
A controller, a flash memory, an interface for connecting to the storage device, and a battery,
Further, a removal detection unit that determines whether to protect data stored in the flash memory,
The removal detection unit,
When detecting a command to remove the storage device from the storage device, a value indicating protection of data stored in the flash memory is set to a flag for controlling an operation on data stored in the flash memory. Set,
When detecting that the storage device has been removed from the storage device, by referring to the value of the flag, it is determined whether to protect data stored in the flash memory,
When it is determined that the data stored in the flash memory is not protected, the storage device outputs a first instruction to destroy the data stored in the flash memory to the controller. The storage device according to claim 1, wherein
The storage device, wherein, when the controller receives the first command, the controller destroys data stored in the flash memory by writing a value to the flash memory. The storage device according to claim 2, wherein
The removal detection unit,
Manages a timer for monitoring reconnection to the storage device,
When detecting that the storage device has been removed from the storage device, start the timer,
When the time measured by the timer is equal to or less than a threshold value, and it is detected that the storage device is connected to the storage device, a value indicating protection of data stored in the flash memory is set in the flag. Set,
When the time measured by the timer is larger than a threshold value, a value of the flag is referred to. The storage device according to claim 3, wherein
Equipped with a cache memory that temporarily stores data,
The removal detection unit, when it is determined that the data stored in the flash memory is to be protected, outputs a second command instructing protection of the data stored in the flash memory to the controller,
The controller is
When receiving the second instruction, determine whether data is stored in the cache memory,
When it is determined that data is stored in the cache memory, the data stored in the cache memory is written to the flash memory. The storage device according to claim 4, wherein
The storage device, wherein the removal detection unit is realized using hardware or software. A method for controlling a storage device mounted on a storage device, comprising:
The storage device,
A controller, a flash memory, an interface for connecting to the storage device, and a battery,
Further, a removal detection unit that determines whether to protect data stored in the flash memory,
The method of controlling the storage device,
When the removal detection unit detects a command to remove the storage device from the storage device, a value indicating protection of data stored in the flash memory is changed to an operation on data stored in the flash memory. A first step of setting a flag to control;
When detecting that the storage device has been removed from the storage device, the removal detection unit determines whether to protect data stored in the flash memory by referring to the value of the flag. Two steps,
A third step in which, when it is determined that the data stored in the flash memory is not protected, the removal detection unit outputs to the controller a first command instructing destruction of data stored in the flash memory. And a control method of the storage device. It is a control method of the storage device of Claim 6, Comprising:
The third step includes the step of, when the controller receives the first command, destroying data stored in the flash memory by writing a value to the flash memory. Control method. It is a control method of the storage device of Claim 7, Comprising:
The removal detection unit manages a timer for monitoring reconnection to the storage device,
The second step is
When the removal detection unit detects that the storage device has been removed from the storage device, activating the timer;
If the time measured by the timer is equal to or less than a threshold value and the storage device is detected to be connected to the storage device, the removal detection unit indicates protection of data stored in the flash memory. Setting a value in the flag;
A step of referring to the flag when the removal detection unit detects that the time measured by the timer is larger than a threshold value. It is a control method of the storage device of Claim 8, Comprising:
The storage device has a cache memory for temporarily storing data,
The removal detection unit, when it is determined that the data stored in the flash memory is to be protected, outputs a second command instructing protection of the data stored in the flash memory to the controller,
The controller is
When receiving the second instruction, determine whether data is stored in the cache memory,
When it is determined that data is stored in the cache memory, the data stored in the cache memory is written to the flash memory. A method for controlling a storage device according to claim 9, wherein:
The method of controlling a storage device, wherein the removal detection unit is realized using hardware or software. A storage device mounted on a storage device,
A controller, a flash memory, and an interface for connecting to the storage device,
A removal detection unit that determines whether to protect data stored in the flash memory;
The removal detection unit,
When a command to remove the storage device from the storage device is detected, a value indicating protection of data stored in the flash memory is set to a flag for controlling an operation on data stored in the flash memory. Set,
When detecting the connection of the storage device to the storage device, referring to the value of the flag, determine whether to protect the data stored in the flash memory,
When it is determined that the data stored in the flash memory is not protected, a command for instructing destruction of data stored in the flash memory is output to the controller. The storage device according to claim 11, wherein
The storage device, wherein the controller destroys data stored in the flash memory by writing a random value to the flash memory when receiving the command. The storage device according to claim 12, wherein
The storage device, wherein the removal detection unit is realized using the controller, a circuit connected to the controller, or a program executed by the controller.

Images