KR20240003750A - Storage device hving real-time secure deletion function and operating method thereof - Google Patents

Abstract

A method of operating a storage device according to the present invention includes receiving a secure deletion request for a file from a host, converting at least one logical address for the file to a physical address in response to the secure deletion request, and Generating error correction parity corresponding to a deletion request, performing a partial programming operation on the error correction parity in a spare area of a page corresponding to the converted physical address, and completing the partial programming operation, performing a partial programming operation on the converted physical address. It may include performing a read operation on the page corresponding to and, when error correction is not possible in the read operation, outputting completion information regarding the secure deletion request to the host.

Description

Storage device having real-time secure deletion function and operating method thereof {STORAGE DEVICE HVING REAL-TIME SECURE DELETION FUNCTION AND OPERATING METHOD THEREOF}

The present invention relates to a storage device having a real-time secure erase function and a method of operating the same.

In general, de-identification of personal information is an important issue in the big data ecosystem. To enhance privacy, de-identification technologies are needed to reduce the threat of re-identification, and are being actively discussed, especially focusing on single output, linkability, inference, and de-identification. Single output refers to the extent to which a set corresponding to a specific individual can be identified from the entire data set. Linkability refers to the degree to which personalized information can be linked to other information and identified as information about a specific individual. Inference possibility refers to the degree to which a specific individual can be inferred through the attribute values of specific information. Indistinguishability refers to the degree to which a specific information value is distinguishable from a specific individual included in a specific group or affiliation. Generally, de-identification techniques are introduced in various ways, such as masking, pseudonymization, anonymity, diversity, similarity, sampling, and aggregation. To design privacy for big data, the European Union proposes requirements appropriate for the four stages of data collection, data analysis, data storage, and data use.

NAND flash memory is a non-volatile memory with low power consumption and high-performance read/write functions. For this reason, the use of NAND flash memory in storage devices such as smartphones, IoT devices, and SSDs is explosively increasing. NAND flash memory has fundamentally different units of write operations (or program operations) and erase operations. Additionally, it is generally known that NAND flash memory cannot be overwritten. For this reason, NAND flash memory performs various internal operations to extend its lifespan and improve performance. In relation to these internal operations, recent research has been conducted on the risks of forensics.

Registered Patent 10-2445057 “Method for disposing personal information from NAND flash memory” Registered Patent 10-2144124 “Data management method and device for non-volatile memory of hybrid main memory system”

K. Patel and G. B. Jethava, “Privacy Preserving Techniques for Big Data: A Survey,” 2018 Second International Conference on Inventive Communication and Computational Technologies (ICICCT), Coimbatore, 2018, pp. 194-199, doi: 10.1109/ICICCT.2018.8473289 M. Shamila, K. Vinuthna and AK Tyagi, "A Review on Several Critical Issues and Challenges in IoT based e-Healthcare System," 2019 International Conference on Intelligent Computing and Control Systems (ICCS), Madurai, India, 2019, pp. 1036-1043, doi: 10.1109/ICCS45141.2019.9065831. B. Alabdullah, N. Beloff and M. White, "Rise of Big Data - Issues and Challenges," 2018 21st Saudi Computer Society National Computer Conference (NCC), Riyadh, 2018, pp. 1-6, doi: 10.1109/NCG.2018.8593166. K. El Emam, “Risk-Based De-Identification of Health Data,” in IEEE Security & Privacy, vol. 8, no. 3, pp. 64-67, May-June 2010, doi: 10.1109/MSP.2010.103. A. Kassem, G. cs, C. Castelluccia and C. Palamidessi, "Differential Inference Testing: A Practical Approach to Evaluate Sanitizations of Datasets," 2019 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA, 2019, pp. 72-79, doi: 10.1109/SPW.2019.00024. QN Hong, NN Tuan, TT Quang, DN Tien and CV Le, "Deep spatio-temporal network for accurate person re-identification," 2017 International Conference on Information and Communications (ICIC), Hanoi, 2017, pp. 208-213, doi: 10.1109/INFOC.2017.8001673. JR Pinto, MV Correia and JS Cardoso, “Secure Triplet Loss: Achieving Cancelability and Non-Linkability in End-to-End Deep Biometrics,” in IEEE Transactions on Biometrics, Behavior, and Identity Science, doi: 10.1109/TBIOM.2020.3046620. M. Mendieta et al., "A Novel Application/Infrastructure Co-design Approach for Real-time Edge Video Analytics," 2019 SoutheastCon, Huntsville, AL, USA, 2019, pp. 1-7, doi: 10.1109/SoutheastCon42311.2019.9020639. J. Soria-Comas and J. Domingo-Ferrer, "Probabilistic k-anonymity through microaggregation and data swapping," 2012 IEEE International Conference on Fuzzy Systems, Brisbane, QLD, Australia, 2012, pp. 1-8, doi: 10.1109/FUZZ-IEEE.2012.6251280. P. Silva, E. Monteiro and P. Simes, “Privacy in the Cloud: A Survey of Existing Solutions and Research Challenges,” in IEEE Access, vol. 9, pp. 10473-10497, 2021, doi: 10.1109/ACCESS.2021.3049599. S. Niksefat, P. Kaghazgaran and B. Sadeghiyan, “Privacy issues in intrusion detection systems: A taxonomy survey and future directions”, Comput. Sci. Rev., vol. 25, pp. 69-78, Aug. 2017. N. Mehta, A. Pandit, and M. Kulkarni. “Elements of Healthcare Big Data Analytics,” In: Kulkarni A. et al. (eds) Big Data Analytics in Healthcare. Studies in Big Data, vol 66. Springer, Cham. 2020, https://doi.org/10.1007/978-3-030-31672-3_2 C. Park, Jeong-Uk Kang, Seon-Yeong Park and Jin-Soo Kim, "Energy-aware demand paging on NAND flash-based embedded storages," Proceedings of the 2004 International Symposium on Low Power Electronics and Design (IEEE Cat. No.04TH8758), Newport Beach, CA, USA, 2004, pp. 338-343, doi: 10.1109/LPE.2004.241161. Soo-Young Kim and Sung-In Jung, "A Log-based Flash Translation Layer for Large NAND flash memory," 2006 8th International Conference Advanced Communication Technology, Phoenix Park, Korea (South), 2006, pp. 1641-1644, doi: 10.1109/ICACT.2006.206302. NY Ahn and DH Lee, "Duty to delete on non-volatile memory", arXiv:1707.02842, Jul. 2017, [online] Available: https://arxiv.org/abs/1707.02842. A. Nisbet and R. Jacob, "TRIM, Wear Leveling and Garbage Collection on Solid State Drives: A Prediction Model for Forensic Investigators," 2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), Rotorua, New Zealand, 2019, pp. 419-426, doi: 10.1109/TrustCom/BigDataSE.2019.00063. NY Ahn and DH Lee, "Schemes for Privacy Data Destruction in NAND Flash Memory," in IEEE Access, vol. 7, pp. 181305-181313, 2019, doi: 10.1109/ACCESS.2019.2958628. M. Gibson, N. Medina, and Z. Nail. “SSD Forensics: Evidence Generation and Analysis,” In: Zhang X., Choo KK. (eds) Digital Forensic Education. Studies in Big Data, vol 61. Springer, Cham. 2020. https://doi.org/10.1007/978-3-030-23547-5_11 W.-C. Wang, C.-C. Ho, Y.-M. Chang and Y.-H. Chang, "Challenges and Designs for Secure Deletion in Storage Systems," 2020 Indo - Taiwan 2nd International Conference on Computing, Analytics and Networks (Indo-Taiwan ICAN), Rajpura, India, 2020, pp. 181-189, doi: 10.1109/Indo-TaiwanICAN48429.2020.9181335. NY Ahn and DH Lee, "Forensics and Anti-Forensics of NAND Flash Memory: From a Copy-Back Program Perspective," in IEEE Access, vol. 9, pp. 14130-14137, 2021, doi: 10.1109/ACCESS.2021.3052353. NY Ahn and DH Lee, "Forensic Issues and Techniques to Improve Security in SSD with Flex Capacity Feature," in IEEE Access, vol. 9, pp. 15130-15137, 2021, doi: 10.1109/ACCESS.2021.3136483. S. Jia, L. Xia, B. Chen and P. Liu, "NFPS: Adding undetectable secure deletion to flash translation layer", Proc. 11th ACM Asia Conf. Comput. Commun. Security (ASIA CCS), pp. 305-316, 2016. W.-C. Wang, C.-C. Ho, Y.-H. Chang, T.-W. Kuo and P.-H. Lin, “Scrubbing-Aware Secure Deletion for 3-D NAND Flash,” in IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 37, no. 11, pp. 2790-2801, Nov. 2018, doi: 10.1109/TCAD.2018.2857260. L. Yang, T. Wei, F. Zhang and J. Ma, “SADUS: Secure data deletion in user space for mobile devices”, Comput. Security, vol. 77, pp. 612-626, Aug. 2018. B. Fitzgerald, C. Ryan and J. Sullivan, “An Early-Life NAND Flash Endurance Prediction System,” in IEEE Access, vol. 9, pp. 148635-148649, 2021, doi: 10.1109/ACCESS.2021.3124604. BR Reddy, H.C. Shadakshri V., S. Anand and SKP, "Error-free Communication in NB-IoT using ECC Approach," 2020 Fourth World Conference on Smart Trends in Systems, Security and Sustainability (WorldS4), 2020, pp. 174-180, doi: 10.1109/WorldS450073.2020.9210266. Z. Qin, Y. Wang, D. Liu, Z. Shao and Y. Guan, "MNFTL: An efficient flash translation layer for MLC NAND flash memory storage systems," 2011 48th ACM/EDAC/IEEE Design Automation Conference (DAC) , 2011, pp. 17-22. P. Lin, Y. Chang, Y. Li, W. Wang, C. Ho and Y. Chang, "Achieving Fast Sanitization with Zero Live Data Copy for MLC Flash Memory," 2018 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), 2018, pp. 1-8, doi: 10.1145/3240765.3240773. J. Park, M. Kim, M. Chun, L. Orosa, J. Kim and O. Mutlu, "Reducing solid-state drive read latency by optimizing read-retry", Proc. 26th ACM Int. Conf. Archit. Support Program. Lang. Opera. Syst., pp. 702-716, 2021.

The purpose of the present invention is to provide a storage device capable of real-time secure deletion and a method of operating the same.

A method of operating a storage device according to an embodiment of the present invention includes receiving a secure deletion request for a file from a host; converting at least one logical address for the file into a physical address in response to the secure deletion request; generating error correction parity corresponding to the secure deletion request; performing a partial program operation to apply the error correction parity to a spare area of a page corresponding to the converted physical address; performing a read operation on a page corresponding to the converted physical address after completing the partial program operation; and when the read operation is unable to correct an error, outputting completion information for the secure deletion request to the host.

The storage device and its operating method according to an embodiment of the present invention can perform real-time secure deletion and its security verification operations by adjusting an error correction code.

The drawings attached below are intended to aid understanding of the present embodiment and provide examples along with a detailed description.
Figure 1 is a diagram showing the physical page configuration of a typical NAND flash memory.
Figure 2 is a diagram showing the ECC encoding process.
Figure 3 is a diagram showing the ECC decoding process.
Figure 4 is a diagram showing an on-chip secure deletion target according to an embodiment of the present invention.
Figure 5 is a diagram illustrating partial programming for a spare area.
Figure 6 is a diagram illustrating real-time read failure output according to an embodiment of the present invention.
Figure 7 is a ladder diagram showing the proposed secure erase operation using ECC parity according to an embodiment of the present invention.
FIG. 8 is a diagram illustrating a storage device 10 according to an embodiment of the present invention.

Below, using the drawings, the content of the present invention will be described clearly and in detail so that a person skilled in the art can easily implement it.

In general, secure deletion is divided into an off-chip secure deletion method and an on-chip secure deletion method. Because the off-chip secure erase method is based on a block-level erase operation, it cannot perform a real-time trim operation. Because of this, it is basically exposed to hacking threats. Meanwhile, since the on-chip secure erase method performs a page-by-page erase operation, a real-time trim operation is possible. However, the on-chip secure deletion method has a program disturbance problem with adjacent page data. The proposed on-chip erase method can dramatically reduce program disturbance problems for adjacent page data by using ECC code modulation through partial program operations. Additionally, the proposed code tampering secure deletion method can verify whether the original data has been deleted in real time.

Recently, discussion about the possibility of malware injection attacks on invalidation areas, especially OP areas, has become an issue. This problem occurs because the existing trim behavior is imperfect. Problems inevitably arise because real-time trim operations are not performed. Even if the host sends a trim command, the storage device does not actually perform the trim operation but only simulates the trim operation, so the original data still remains in the storage device. This issue is fundamentally caused by previous secure delete techniques that perform based on delete operations. Recently, page-level secure deletion technology was released. This page-level secure deletion technique has the advantage of performing a real-time trim operation.

The present invention reviews existing secure erase methods, such as off-chip secure erase methods, and discusses the limitations of existing secure erase technologies. The present invention also discusses on-chip secure erase technology. Additionally, the present invention proposes an ECC modulation secure deletion technique. Chapter 5 compares the performance of the existing off-chip secure erase method and the on-chip secure erase method, and then compares the performance of various on-chip secure erase methods and the proposed on-chip secure erase method.

The present invention contributes to proposing an on-chip secure erase technique that is economical, reasonable, and can be easily implemented to perform real-time trim operations.

Basically, when the operating system deletes a file, it does not actually delete the file, but rather deletes the metadata about the file. When managing files, the file system manages metadata that stores information about the file along with the actual file. This metadata is information necessary for file management, such as the location where the file is actually stored on the storage device, file size, file name, and access rights to the file. Conversely, if the metadata for a specific file disappears, the file is treated as if it does not exist inside the storage device. In other words, when metadata is deleted, the file is also treated as deleted. Secure deletion means completely deleting not only the file's metadata, but also the actual file.

TRIM means performing the operation of actually deleting a file with deleted metadata from inside the storage device. Trim is an operation that completely deletes invalidated data inside a storage device to secure the necessary space. In general, these trim settings can increase the storage device's write speed and extend the life of the storage device by using free space more efficiently. The auto trim function is supported starting from the Windows 7 operating system. The storage device supports the trim function internally. Generally, a trim command is a command passed from the host to the storage device.

For NAND flash memory, the size of the Read/Program operation and the size of the Erase operation are set differently depending on the physical structure. NAND flash memory includes a plurality of memory blocks, each of the plurality of memory blocks includes a plurality of pages, and each of the plurality of pages includes a plurality of memory cells connected to one word line. In general, read/program operations are performed with page size, and erase operations are performed with block size. In general, NAND flash memory is managed with relatively few erase operations in terms of lifespan management. This means that the time when a user wants to completely delete a file and the time when the file is completely deleted from inside the storage device may be different. This is a problem that arises from the structural and inherent limitations of NAND flash memory. In general, the erase operation is a block-level operation that removes a large amount of charge from the charge trap layer. Meanwhile, program/read operations are performed in pages with a size much smaller than the block size. However, the existing trim operation is performed based on the delete operation. Therefore, the trim operation is a very necessary operation for security purposes, but it is also an operation that should be avoided in terms of performance and lifespan management of the storage device.

The trim operation basically performs garbage collection before the erase operation. Garbage collection refers to the operation of collecting valid pages from at least two blocks into a new block. Only valid pages consisting of two or more blocks are copied to a new memory block by garbage collection. In this way, a new block consisting only of valid pages is mapped to a block accessible to the host. Additionally, an erase operation regenerates two or more blocks into reusable memory blocks. Since this garbage collection degrades the performance of the storage device, it is performed as a background operation or in an idle state.

Data is encrypted and stored using an encryption key. When deleting data, only the encryption key is deleted. This encryption scheme allows for fast and secure deletion. However, deleting all keys in a file incurs significant overhead. Therefore, a method of storing all keys in one memory block and then deleting them at once is also proposed. However, this encryption key deletion method is difficult to apply to a database with real-time invalidation method applied.

When deleted data is removed for undetectable secure deletion, it becomes inaccessible to hosts and the deletion history is hidden so that no one knows that the deleted data was deleted in the past. The full scrubbing method turns all page data into zero pages. The partial scrubbing method converts part of the page data into zero data. This method is called NFPS (NAND Flash Partial Scrubbing). This partial scrubbing method makes it difficult to detect the presence of deleted files. For example, partial scrubbing involves partial page reprogramming.

The deletion pulse application method is similar to the page-by-page reprogramming method. However, the reprogramming method is to program the data with specific data, for example, zero bits. However, the erase pulse application method applies a plurality of erase pulses to the relevant word line to perform partial overwriting even if the most significant bit is not necessarily obtained. The level and number of erase pulses can be determined a priori. For example, the level and number of erase pulses can be determined to change data only to the extent that it cannot be recovered with an error correction code. Depending on the deletion pulse application method, the original data is changed to random data. In particular, in the case of multi-bit memory cells, the erase pulse application method is more useful and simple to apply.

The trim operation basically means the operation of completely deleting files on the storage device at the host's request. When a command related to a trim operation is sent to the storage device, the host believes that the trim operation has been completed because it has received a completion message from the storage device indicating that the trim operation has been performed. However, in reality, the completion of this TRIM operation is only processed inside the storage device without being recognized by the host, and it is not uncommon for only the related metadata to be deleted without actually deleting the original data. Unfortunately, most secure erase schemes are in this state. For this reason, forensics of storage devices is relatively easy. This is because the original data is not deleted, only related metadata is deleted, and the host is notified that secure deletion has been completed. While hackers are eager to recover metadata, storage administrators are researching schemes to make metadata recovery impossible.

From the customer's perspective, a full trim operation is required. However, in the existing secure deletion method, when performing a full TRIM operation, an erase operation must be performed on valid or invalid blocks to delete the original data. Because this method is unreasonable in terms of the lifespan and cost of the storage device, storage device manufacturers are performing secure deletion at a level that partially compromises the host's request. Ultimately, the customer is requesting a full-trim operation, but the storage device does not 100% accept this request and performs an incomplete trim operation in the middle of the line.

This problem occurs because basically erase operations are performed in block units and program operations are performed in page units. This is a well known fact to those skilled in the art. However, those skilled in the art do not proceed even though they know that this is a solution to the page-level deletion operation. Some researchers have been proposing this solution since 2016. For example, a scrubbing method was proposed in 2016, a random data overwriting method and a deletion pulse application method were proposed in 2017, and a subprogram method for multi-level modulation was proposed. The program was proposed as a single-level program in 2018. This page-level secure erase system is called an on-chip secure erase system. Others will of course be called off-chip security systems.

Off-chip secure erase schemes are inherently limited. Notifies the host to perform a trim operation and reports an incorrect completion. Please be assured that although the strict definition of the TRIM operation does not delete the original data, it has the same effect as deleting. Is this true? no. Those skilled in the art know better than anyone else that the answer is wrong. For example, the argument is that because the original data is encrypted and the encryption key is deleted, the possibility of recovering the original data due to missing encryption key is low. But technology is advancing quite rapidly. Quantum computing technology is expected to be commercialized in the near future. What does this mean? This means that even hackers can use quantum computing technology. The possibility of recovering encrypted data using quantum computing is undeniable. If the cost of recovering encrypted data is greater than the cost of using quantum computing, hackers will inevitably attempt to recover the original encrypted data.

What makes storage device management difficult is WAF (Write Amplification Factor). Because storage devices have different erase units and program units, WAF is increasing over time. Generally, invalid blocks and verification blocks exist inside the storage device. As WAFs grow, it is natural to see more and more of these invalid and validation blocks. However, only invalid pages exist in an invalid block, but invalid pages as well as invalid pages can exist in valid blocks and invalid blocks. This situation makes it difficult to manage the original data. There may be one or more original data in a validation block or one or more data in an invalid block. When the host issues a command to delete original data on a storage device, a global TRIM operation must be performed to delete all original data in invalid/valid blocks across the storage device. In order to perform a full TRIM operation, it is necessary to comprehensively look at the garbage collection and deletion history. This poses a significant burden in terms of storage device management.

Essentially, to avoid these problems, on-chip secure erase methods must be applied in real time. Regardless of the trim request, the storage device can apply an on-chip secure erase method in real time at the time a data update or data delete operation is performed. This can prevent original data from existing on invalidated pages, which can occur congenitally. It can also fundamentally prevent original data from existing in invalid blocks. When applying the on-chip secure erasure method, the original data exists only on the verified pages of the verified block. This makes the management of the original data very light.

Proposed on-chip secure erasure method

It is a storage technology that inevitably requires on-chip secure erase for complete trim operation of the host. Depending on the host or customer's request, on-chip secure erase is likely to develop into an essential technology for storage devices.

Traditional on-chip secure erase method

Existing on-chip secure erasure methods basically focus on tampering with the original data using overwrite technology. The scrubbing method converts the threshold voltage of a memory cell into the most significant bit. The partial overwrite method generates random data and reprograms it. The deletion pulse application method applies pulses to modulate the original data only to the extent that error correction is impossible in ECC.

The scrubbing method takes a significant amount of time to program the memory cells up to the most significant bit. Additionally, if the upper state program executes relatively excessively, there is a high possibility that the page will be physically destroyed. Partial overwriting can reduce the likelihood of physical destruction relative to scrubbing, but requires the added time required to generate and program programmable random data.

Compared to the scrubbing method and partial overwriting method, the deletion pulse application method can simply and efficiently delete original data on a page basis while reducing the risk of physical destruction. However, there is concern that data connected to adjacent valid word lines may be modified. In other words, there is a possibility that erase pulse disturbance may occur.

Figure 1 is a diagram showing the physical page configuration of a typical NAND flash memory. A physical page includes a main area that stores user data and a spare area that stores metadata. Here, metadata includes ECC of user data.

Data stored in NAND flash memory is incomplete. There is a lot of leakage current and data corruption due to program/read disturbance. Accordingly, many technologies have been developed to ensure data reliability. The most basic method is to apply error correction as a data recovery method. When the parity needed to recover the original data to be programmed is created and a write operation is performed, the original data and parity are stored simultaneously. When performing a read operation, the original data and parity are read and errors in the original data are corrected using the parity. Referring to Figure 1, a NAND flash memory device includes a plurality of planes. Each of the plurality of planes includes a plurality of blocks connected to word lines and bit lines. Each of the plurality of blocks includes pages corresponding to each word line. Each page includes a basic area and a spare area. The spare area can be used for error management functions.

Additionally, depending on the embodiment, metadata for each page and/or block (e.g., number of erases, address information, bad block information, etc.) may be stored in the main area or spare field area. In NAND flash memory, the required spare area size is a function of page size, process technology, number of bits per cell (i.e. 1 bit per cell, 2 bits per cell, 3 bits per cell, etc.) and bits. Error rate. When NAND flash memory was initially created, the page size was 512 bytes for the primary area and 16 bytes for the spare area. This page size has grown as processing technology has advanced to achieve greater memory densities. However, this growth has resulted in high bit error rates, which require the use of more robust error correction coding. Examples of modern page sizes are 8K bytes for the primary area and 256 bytes for the spare area.

Figure 2 is a diagram showing the ECC encoding process. The ECC engine generates parity in response to user data. Referring to Figure 2, the ECC engine includes a parity generator. The parity generator generates parity data using input data of the target page of the NAND flash memory device. Here, parity data can be generated using a segment of input data (for example, 1KB out of 4KB) or the entire input data. Input data is programmed in the main area of the target page and parity data is programmed in the spare area of the target page.

Figure 3 is a diagram showing the ECC decoding process. Referring to Figure 3, the ECC engine consists of a syndrome generator, Berlekamp block, Chien block, and data corrector. There is an error. The syndrome is input to the Berlecamp block, which determines the error location polynomial and error number. The Chien block finds the square root of a polynomial in the error locator polynomial output of the Berleykamp block. Lastly, if there is an error based on the output of the Qian block, the output data can be corrected using a data corrector. The output of data correction is corrected data.

Figure 4 is a diagram showing an on-chip secure deletion target according to an embodiment of the present invention. A new on-chip secure erase scheme that mainly uses parity modulation is proposed. The time and cost required to achieve secure deletion can be reduced by tampering with relatively small parity rather than tampering with relatively large original data. Therefore, we propose a parity modulation-based secure erase method when performing secure erase upon the host's request. To this end, a partial program operation can be performed on data in the spare area connected to the word line related to the original data. A partial program operation is generally defined as no more than four operations per word line.

FIG. 5 is a diagram illustrating partial programming of a spare area. The proposed on-chip secure erase method may include a partial programming operation of a spare area where parity is stored. Here, the partial program operation can perform programming with zero bits or apply a predetermined program pulse to the part where parity is stored.

Figure 6 is a diagram illustrating real-time read failure output according to an embodiment of the present invention. The ECC engine has a number of bits available for error correction. With the development of technology, the number of errors that can be corrected is gradually increasing. When error correction is not possible, NAND flash memory devices typically perform recovery codes. Defense code performs page reading operations in a variety of ways. When error correction is not possible even in the defense code, the NAND flash memory device eventually transmits a read failure to the host. In the proposed method, there is a very high possibility that error correction will not be possible even if a defense code is applied through modulation of parity data. Therefore, as shown in FIG. 6, a read failure is output to the host. However, the proposed method does not require this additional verification operation. The impossibility of read operations on invalid/valid pages can be immediately confirmed through the on-chip secure erase operation.

Figure 7 is a ladder diagram showing the proposed secure erase operation using ECC parity according to an embodiment of the present invention. Referring to FIG. 7, the storage device (SSD) includes a controller and NAND flash memory. The controller performs ECC modulation using partial programming in response to the security erase request, and if error correction is not possible, it transmits a security erase completion message to the host.

Referring again to FIG. 7, the host transmits a secure deletion request for a file stored in the storage device SSD. The storage device's controller converts the logical address associated with the file into a physical address in response to the host's secure deletion request. The controller generates ECC parity for secure erase. The controller transmits a command to perform a partial program operation for the ECC area to the NAND flash memory device through the word line corresponding to the physical address. The NAND flash memory device performs a partial program operation using ECC parity generated for the spare area in response to the partial program command. A non-volatile memory device transmits completion of a partial program operation to the controller. Afterwards, the controller transmits a read command to the non-volatile memory device through the corresponding word line. The nonvolatile memory device transmits read data to the controller in response to a read command. The controller determines whether error correction for the read data is possible. If the read data cannot be corrected, the controller sends a secure erase complete message to the host.

The above-described secure erase operation may be performed in connection with the storage device's defense code (or read retry). Meanwhile, even if the storage device generates a separate ECC parity for secure erase, it can delete this process and perform an operation of applying a predetermined number of erase pulses to the spare area where the ECC is stored.

The proposed secure deletion technique can perform deletion operations in real time and deletion verification can also be performed in real time. Additionally, because the proposed secure erase technique does not perform program operations on data, it can significantly reduce disturbance to valid data compared to the existing on-chip secure erase technique. Meanwhile, the ECC engine can be implemented in NAND flash memory with an on-chip structure. In this case, the concept of secure deletion would be a good topic for future research.

Performance Comparison

A comparison between the off-chip secure erase method and the on-chip secure erase method is as follows. The off-chip secure erase method is basically a trim method with an encryption method and an erase operation. Meanwhile, on-chip secure erase methods include scrubbing method, partial overwrite method, down bit programming method, erase pulse application method, and the proposed code tampering secure erase method.

First, the performance of the off-chip secure erase method and the on-chip secure erase method is compared as shown in Table 1 below.

Access delete size Real-time response overhead Off-chip secure erase block unit impossible maintenance cost On-chip secure erase per page possible Program Disturbance

In the off-chip secure erase method, the erase operation is performed on a block basis. In general, NAND flash memory devices do not frequently perform an erase operation on a block-by-block basis due to management issues. As is known, NAND flash memory manufacturers basically guarantee 1000 erase operations in a block. If one block is erased more than 1000 times, it becomes difficult to use the storage device. For this reason, off-chip secure erase methods cannot perform real-time trim operations. Since trim operations cannot be performed in real time, block management costs inevitably occur. Meanwhile, the on-chip secure erase method can perform an erase operation on a page-by-page basis. The scrubbing method, partial overwriting method, down programming method, deletion pulse application method, and the proposed code modulation method can all delete the original data on a word line basis. Since these page units can be deleted, real-time trim operations can be performed. However, since the page-by-page method basically applies a constant voltage level to the word line, adjacent valid pages may be affected. In other words, there is a disadvantage in that program disturbance occurs.

Below, Table 2 compares the performance of on-chip secure erase methods.

On-chip secure erase scheme data generation endurance Program Disturbance Confirmation report scrubbing
zero beat Increased cell wear High doesn't exist Partial overwrite
Possible random bits doesn't exist middle doesn't exist downbeat programming SLC data bit doesn't exist low doesn't exist Apply Delete Pulse doesn't exist doesn't exist low doesn't exist Code Tampering Secure Erase doesn't exist doesn't exist low read failed

Basically, the on-chip erasure method is based on overwriting, so random data must be generated. The scrubbing method generates the most significant bit, that is, bit 0. In the partial overwrite method, it is necessary to generate random data in a programmable state by comparing it with the state of programmed data according to the multi-level cell. The down-bit programming method requires generating data by converting multi-level cell data into single-level cells. In this case, the downbit program method requires separate management to ensure that the storage capacity does not change. The erase pulse application method is a method of applying a plurality of erase pulses rather than programming standardized data. This method can eliminate the time required for data generation compared to other on-chip secure erasure methods. Code tampering secure deletion method may generate random data in some cases. The code modulation secure erase method can be implemented by applying a plurality of pulses, like the erase pulse application method.

Next, comparing indicators related to durability are as follows. Since the scrubbing method is programmed at the highest level, the wear rate of the cell is bound to increase significantly. In terms of durability, performing an erase operation on a block basis may be better than frequently using the scrubbing method. The partial overwrite method, down-bit programming method, erase pulse application method, and code modulation security erase method do not have durability problems. Since the on-chip secure erase method is basically based on overwriting, program disruption is inevitable. Since the scrubbing method writes data at the highest level, it has no choice but to proceed to the upper level program. Therefore, the scrubbing method can cause relatively high program disturbance. It is highly likely that additional data management for adjacent valid pages will be performed. Similar to the scrubbing method, the partial overwriting method has the potential to proceed with relatively high-level programs, inevitably causing program disturbance. However, the partial overwrite method causes moderate program disturbance because the data is not in the highest state of the scrubbing method. The down-bit programming method, erase pulse application method, and code tampering security erase method have relatively less program disturbance than the scrubbing method and partial overwriting method.

Lastly, in the scrubbing method, partial overwriting method, down bit programming method, and erase pulse application method, an operation to check whether the original data is completely erased from the NAND flash memory device must be performed separately. On the other hand, the proposed code tampering secure deletion method outputs a read failure during the read operation, so a separate verification operation is not required.

We looked at the imperfections of the trim operation in secure erase. The existing off-chip secure erase method is basically based on an erase operation, so it cannot perform a real-time trim operation from a management perspective. On the other hand, the on-chip secure erase method performs a page-by-page erase operation, so a real-time trim operation is possible. This on-chip secure erase method guarantees a complete trim operation compared to the off-chip secure erase method. Because the on-chip secure erase method applies pulses only to word lines on a page basis, program disturbance occurred. The proposed on-chip secure erase method is based on ECC modulation using partial programming to simplify erasure and easily protect while minimizing program disturbance problems. Compared to other on-chip secure erase methods, the ECC modulation secure erase method minimizes program disturbance problems and enables confirmation of deletion of original data in real time. The proposed secure deletion method can be usefully applied to verify data in invalidated areas of a storage device. It is highly likely that the code tampering secure deletion method proposed as an anti-forensic technology for storage devices will be installed in the future.

FIG. 8 is a diagram illustrating a storage device 10 according to an embodiment of the present invention. Referring to FIG. 8 , the storage device 10 may include at least one non-volatile memory device (NVM(s), 100) and a controller 200.

At least one non-volatile memory device 100 may be implemented to store data. The non-volatile memory device 100 includes NAND flash memory, vertical NAND flash memory, NOR flash memory, resistive random access memory (RRAM), and phase-change memory. memory; PRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), spin transfer torque random access memory (STT-RAM), etc. . The non-volatile memory device 100 may include a memory cell array having a plurality of memory blocks. Each of the plurality of memory blocks includes a plurality of memory cells connected between word lines and bit lines. Each of the plurality of memory cells can store at least one bit.

Controller 200 may be coupled to at least one non-volatile memory device 100 through a plurality of control pins that transmit control signals (e.g., CLE, ALE, CE(s), WE, RE, etc.). there is. Additionally, the non-volatile memory device 100 may be controlled using control signals (CLE, ALE, CE(s), WE, RE, etc.). Additionally, the controller 200 may be implemented to control overall operations. The controller 200 performs cache/buffer management, firmware management, garbage collection management, wear leveling management, data deduplication management, read refresh/reclaim management, bad block management, multi-stream management, and mapping of host data and non-volatile memory. Management, QoS (quality of service) management, system resource allocation management, non-volatile memory queue management, read level management, erase/program management, hot/cold data management, power loss protection management, dynamic thermal management, initialization management, Various management operations such as RAID (redundant array of inexpensive disk) management can be performed.

Controller 200 may include a real-time trim module 211. The real-time trim module 211 can perform a real-time trim operation by modulating the ECC code and a verification operation for real-time secure deletion.

The device described above may be implemented with hardware components, software components, and/or a combination of hardware components and software components. For example, the devices and components described in the embodiment include a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), and a programmable logic unit (PLU). It may be implemented using one or more general-purpose or special-purpose computers, such as a unit, microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. Additionally, a processing device may access, store, manipulate, process, and generate data in response to the execution of software. For ease of understanding, a single processing device may be described as being used; however, those skilled in the art will understand that a processing device includes multiple processing elements or multiple types of processing elements. You can see that it can be done. For example, a processing device may include a plurality of processors or one processor and one controller. Additionally, other processing configurations, such as parallel processors, are possible.

Software may include a computer program, code, instructions, or a combination of one or more of these, and may configure a processing unit to operate as desired, or to process independently or collectively. You can command the device. Software and/or data may be used by any type of machine, component, physical device, virtual equipment, computer storage medium or device to be interpreted by or to provide instructions or data to a processing device. It can be embodied in . Software may be distributed over networked computer systems and thus stored or executed in a distributed manner. Software and data may be stored on one or more computer-readable recording media.

Meanwhile, the contents of the present invention described above are only specific examples for carrying out the invention. The present invention will include not only concrete and practically usable means, but also technical ideas, which are abstract and conceptual ideas that can be used as technology in the future.

10: storage device
100: non-volatile memory device
200: controller

Claims (1)

In a method of operating a storage device,
Receiving a secure delete request for a file from a host;
converting at least one logical address for the file to a physical address in response to the secure deletion request;
generating error correction parity corresponding to the secure deletion request;
performing a partial program operation to apply the error correction parity to a spare area of a page corresponding to the converted physical address;
performing a read operation on a page corresponding to the converted physical address after completing the partial program operation; and
When the read operation is unable to correct an error, outputting completion information for the secure deletion request to the host.