Storage system and method for providing gray levels of read security

A storage system and method for providing gray levels of read security are provided. In one embodiment, a storage system is provided comprising a memory and a controller in communication with the memory. The controller is configured to perform a test of a security feature of the storage system; and in response to failure of the test of the security feature of the storage system, degrade a subsequent read of a set of locations in the memory. Other embodiments are possible, and each of the embodiments can be used alone or together in combination.

BACKGROUND

Some storage systems implement a security feature, such as requiring a correct user password before allowing access to the storage system. Some security features specify a number of incorrect attempts that are allowed before taking punitive action. For example, if an incorrect password in entered more than five times, the storage system can prevent additional attempts to enter the correct password (e.g., for some period of time or only after a subsequent power up occurs) or can even erase data on the storage system. Some storage systems allow the security feature to be enabled/disabled.

DETAILED DESCRIPTION

By way of introduction, the below embodiments relate to a storage system and method for providing gray levels of read security. In one embodiment, a storage system is provided comprising a memory and a controller in communication with the memory. The controller is configured to perform a test of a security feature of the storage system; and in response to failure of the test of the security feature of the storage system, degrade a subsequent read of a set of locations in the memory.

In some embodiments, the set of locations is predetermined.

In some embodiments, the set of locations is selected based on a type of the test being performed.

In some embodiments, the test of the security feature of the storage system comprises one or more of the following: testing a password for validity, testing a request to determine authorization to access a memory location, testing access to diagnostic capabilities, testing access to administrative functionality in the storage system, testing write access to a read only area in the memory, testing a password change from an unauthorized user, detecting an attempt to revert with an invalid pointer to security identifier (PSID), and detecting an attempt to format the storage system without proper access credentials.

In some embodiments, an amount of degradation increases with a number of failures of the test of the security feature of the storage system.

In some embodiments, the controller is configured to degrade the subsequent read by lowering a read voltage.

In some embodiments, the controller is configured to degrade the subsequent read by re-encoding data in the set of locations in the memory with a higher rate.

In some embodiments, the controller is configured to degrade the subsequent read by increasing a read voltage to a level sufficient to cause a read disturb.

In some embodiments, the controller is configured to degrade the subsequent read by performing an erase operation instead of a read operation.

In some embodiments, the controller is configured to degrade the subsequent read by performing at least one of the following: blocking access to an address translation table and altering an address translation table to return data from an address different from an address in a read command.

In some embodiments, the memory comprises a three-dimensional memory.

In some embodiments, the storage system is embedded in a host.

In some embodiments, the storage system is removably connected to a host.

In another embodiment, a method is provided that is performed in a storage system comprising a memory. The method comprises: selecting a candidate range in the memory; tracking a number of failures of a security test; and in response to a failure of the security test, increasing a difficulty level of reading data in the candidate range, wherein the difficulty level increase with the number of failures of the security test.

In some embodiments, the candidate range is selected based on a type of security test being performed.

In some embodiments, the security test comprises one or more of the following: testing a password for validity, testing a request to determine authorization to access a memory location, testing access to diagnostic capabilities, testing access to administrative functionality in the storage system, testing write access to a read only area in the memory, testing a password change from an unauthorized user, detecting an attempt to revert with an invalid pointer to security identifier (PSID), and detecting an attempt to format the storage system without proper access credentials.

In some embodiments, the difficulty level increases by performing at least one of the following: lowering a read voltage, re-encoding data in the candidate range with a higher rate, increasing a read voltage to a level sufficient to cause a read disturb, performing an erase operation instead of a read operation, blocking access to an address translation table, and altering an address table to return data from an address different from an address in a read command.

In some embodiments, the memory comprises a three-dimensional memory.

In some embodiments, the storage system is embedded in a host.

In some embodiments, the storage system is removably connected to a host.

In another embodiment, a storage system is provided comprising a memory and means for progressively impeding a read of data in the memory in response to increased violations of a security policy of the storage system.

In some embodiments, the memory comprises a three-dimensional memory.

In some embodiments, the storage system is embedded in a host.

In some embodiments, the storage system is removably connected to a host.

Turning now to the drawings, storage systems suitable for use in implementing aspects of these embodiments are shown inFIGS. 1A-1C.FIG. 1Ais a block diagram illustrating a non-volatile storage system100according to an embodiment of the subject matter described herein. Referring toFIG. 1A, non-volatile storage system100includes a controller102and non-volatile memory that may be made up of one or more non-volatile memory die104. As used herein, the term die refers to the collection of non-volatile memory cells, and associated circuitry for managing the physical operation of those non-volatile memory cells, that are formed on a single semiconductor substrate. Controller102interfaces with a host system and transmits command sequences for read, program, and erase operations to non-volatile memory die104.

Non-volatile memory die104may include any suitable non-volatile storage medium, including NAND flash memory cells and/or NOR flash memory cells. The memory cells can take the form of solid-state (e.g., flash) memory cells and can be one-time programmable, few-time programmable, or many-time programmable. The memory cells can also be single-level cells (SLC), multiple-level cells (MLC), triple-level cells (TLC), or use other memory cell level technologies, now known or later developed. Also, the memory cells can be fabricated in a two-dimensional or three-dimensional fashion.

The interface between controller102and non-volatile memory die104may be any suitable flash interface, such as Toggle Mode 200, 400, or 800. In one embodiment, storage system100may be a card based system, such as a secure digital (SD) or a micro secure digital (micro-SD) card. In an alternate embodiment, storage system100may be part of an embedded storage system.

Although, in the example illustrated inFIG. 1A, non-volatile storage system100(sometimes referred to herein as a storage module) includes a single channel between controller102and non-volatile memory die104, the subject matter described herein is not limited to having a single memory channel. For example, in some NAND storage system architectures (such as the ones shown inFIGS. 1B and 1C), 2, 4, 8 or more NAND channels may exist between the controller and the NAND memory device, depending on controller capabilities. In any of the embodiments described herein, more than a single channel may exist between the controller and the memory die, even if a single channel is shown in the drawings.

FIG. 1Billustrates a storage module200that includes plural non-volatile storage systems100. As such, storage module200may include a storage controller202that interfaces with a host and with storage system204, which includes a plurality of non-volatile storage systems100. The interface between storage controller202and non-volatile storage systems100may be a bus interface, such as a serial advanced technology attachment (SATA) or peripheral component interface express (PCIe) interface. Storage module200, in one embodiment, may be a solid state drive (SSD), such as found in portable computing devices, such as laptop computers, and tablet computers.

FIG. 1Cis a block diagram illustrating a hierarchical storage system. A hierarchical storage system250includes a plurality of storage controllers202, each of which controls a respective storage system204. Host systems252may access memories within the storage system via a bus interface. In one embodiment, the bus interface may be an NVMe or fiber channel over Ethernet (FCoE) interface. In one embodiment, the system illustrated inFIG. 1Cmay be a rack mountable mass storage system that is accessible by multiple host computers, such as would be found in a data center or other location where mass storage is needed.

FIG. 2Ais a block diagram illustrating components of controller102in more detail. Controller102includes a front end module108that interfaces with a host, a back end module110that interfaces with the one or more non-volatile memory die104, and various other modules that perform functions which will now be described in detail. A module may take the form of a packaged functional hardware unit designed for use with other components, a portion of a program code (e.g., software or firmware) executable by a (micro)processor or processing circuitry that usually performs a particular function of related functions, or a self-contained hardware or software component that interfaces with a larger system, for example. Modules of the controller102may include a security test module111, which is discussed in more detail below, and can be implemented in hardware or software/firmware.

Referring again to modules of the controller102, a buffer manager/bus controller114manages buffers in random access memory (RAM)116and controls the internal bus arbitration of controller102. A read only memory (ROM)118stores system boot code. Although illustrated inFIG. 2Aas located separately from the controller102, in other embodiments one or both of the RAM116and ROM118may be located within the controller. In yet other embodiments, portions of RAM and ROM may be located both within the controller102and outside the controller.

Front end module108includes a host interface120and a physical layer interface (PHY)122that provide the electrical interface with the host or next level storage controller. The choice of the type of host interface120can depend on the type of memory being used. Examples of host interfaces120include, but are not limited to, SATA, SATA Express, SAS, Fibre Channel, USB, PCIe, and NVMe. The host interface120typically facilitates transfer for data, control signals, and timing signals.

The storage system100also includes other discrete components140, such as external electrical interfaces, external RAM, resistors, capacitors, or other components that may interface with controller102. In alternative embodiments, one or more of the physical layer interface122, RAID module128, media management layer138and buffer management/bus controller114are optional components that are not necessary in the controller102.

FIG. 2Bis a block diagram illustrating components of non-volatile memory die104in more detail. Non-volatile memory die104includes peripheral circuitry141and non-volatile memory array142. Non-volatile memory array142includes the non-volatile memory cells used to store data. The non-volatile memory cells may be any suitable non-volatile memory cells, including NAND flash memory cells and/or NOR flash memory cells in a two dimensional and/or three dimensional configuration. Peripheral circuitry141includes a state machine152that provides status information to the controller102. Non-volatile memory die104further includes a data cache156that caches data.

FIG. 3is a block diagram of one particular implementation of a computer system310in communication with the storage system100of an embodiment. As shown inFIG. 3, the computer system310comprises a management module320configured to, among other functions, send read and/or write requests to the storage system100via a bus330. The storage system100of this embodiment comprises a controller102and a memory/storage medium104. The controller102comprises host and storage medium interfaces120,130, as discussed above, and also comprises a management module340and additional modules360. The management module comprises one or more central processing units (CPUs)350and the security test module111. The operation of the security test module111will be discussed in more detail below. In general, the security test module111can be implemented with hardware and/or software/firmware and can execute the algorithms presented in the flow charts discussed below. In one embodiment, the security test module111is implemented as an additional feature of an existing security protocol, such as, but not limited to, ATA (AT attachment) Security, TCG (Trusted Computing Group) Opal, and IEEE (Institute of Electrical and Electronic Engineers) 1667.

The controller102is in communication with the memory104via a bus370. In this embodiment, the memory104comprises a plurality of non-volatile memory devices380.FIG. 3shows a portion390of one of these devices. This portion390is sometimes referred to herein as a set of locations in the memory or candidate range.

As mentioned above, some storage systems implement a security feature, such as requiring a correct user password before allowing access to the storage system. Some storage systems allow the security feature to be enabled/disabled. However, this means that security is defined in some storage systems as “black or white”: either enabled or disabled. The following embodiments can be used to add a new security layer to the already-existing options. Specifically, these embodiments can be used to add a “gray” level (as compared to the “black or white” level previously provided) to allow more flexible usage. Examples of use cases that can benefit from “gray” level security include, but are not limited to, watchdog support scenarios (i.e., gradual degradation of data access based on proximity to an authenticating source or authority), variable access based on the reliability of the authenticated user, and gradual degradation of data access in response to authorization or authentication failure.

In general, one embodiment uses basic operations and phenomenon of flash memory to create data destruction of varying levels using reversible or irreversible methods. This provides another layer of security to storage systems, and a progressive system can be used to respond to increasing failures of a security test (e.g., the increasing number of erroneous attempt made to enter a password to unlock the storage system100). More specifically, the security test module111can be configured to select a set390of locations in the memory104(e.g., a candidate range of user data or other NAND areas) and then count the number of violations of a defined security feature, policy, or test (e.g., failures of a user to enter the correct password, attempts to take a certain action in the storage system100, etc.). Following each violation (or, alternatively, a plurality of violations), the controller102can disrupt the candidate range in a manner that will degrade future reads to this area, until eventually the disruption will be severe enough to possibly cause data corruption. In this way, the difficulty level of reading data in the candidate range increases with the number of failures of the security feature, policy, or test. This allows the controller102to impede a reading of the data in response to increased violations of a security feature, policy, or test of the storage system.

FIG. 4is a flow chart of a method of an embodiment for providing gray levels of read security. As shown inFIG. 4, in one embodiment, during power-up (410), the controller102(e.g., using the test security module111) selects a candidate range for a read disruption operation (420). The candidate range can be selected in advance at power up (i.e., the set of locations in the memory can be predetermined) or as a function of the security test being performed. For example, the candidate range can include key areas of user data or can include secure data, such as storage for system secrets or firmware-specific data. The candidate range can also include data related to the specific namespace (or locking range) being accessed or global data.

After the candidate range (i.e., the set of locations in memory) has been selected, the controller102performs a test (“Security test ‘A’”) of a security feature or policy of the storage system100(430). A security feature, policy, or test of the storage system100can take any suitable form. Examples include, but are not limited to, testing a password for validity, testing a request to determine authorization to access a memory location, testing access to diagnostic capabilities, testing access to administrative functionality in the storage system, testing write access to a read only area in the memory, testing a password change from unauthorized user, detecting an attempt to revert with an invalid pointer to security identifier (PSID), and detecting an attempt to format the storage system without proper access credentials.

If the test of the security feature is successful, the controller102resumes normal operation of the storage system100(440). However, if there was a failure of the test, the controller102can take an action to degrade a subsequent read of candidate range (450). Following the change in parameters, a read may be triggered to the candidate range in order to cause the desired disruption. As discussed above, in one embodiment, a progressive system is used, such that an amount of degradation/disruption can increase with a number of failures of the test (e.g., the controller102can set the read parameters according a failure count, which can be set by the user or otherwise provide an adjustable tolerance).

Examples of actions the controller102can take to disrupt the read operation include, but are not limited to, lowering a read voltage (e.g., to prevent current flow to a sense amplifier), re-encoding candidate ranges with a higher rate, increasing a read voltage to a level sufficient to cause a read disturb, performing an erase operation instead of a read operation, and preventing data access/returning unexpected data.FIGS. 5-8will now be discussed to illustrate some of these examples.

FIG. 5is a flow chart of a method of an embodiment for degrading a subsequent read of a set of locations in memory by lowering read voltage to prevent current flow to sense amplifiers (e.g., lowering the read voltage, Vread, to minimum to prevent any current flow to the sense amplifiers). The controller102can do this, for example, by programming a lower read voltage value into a register used by the state machine152in the memory104. As shown in the flow chart inFIG. 5, in one embodiment, when reading the candidate range, the controller102gradually reduces voltage to the bit lines in the memory (510), which gradually reduces the current to the sense amplifiers (520). This gradually increases the bit error rate (BER) on the memory cells written in the candidate range (530). This method impedes/prevents data from being read from the candidate range without disturbing the memory; hence, this method is fully reversible.

FIG. 6is a flow chart of a method of an embodiment for degrading a subsequent read of a set of locations in memory by re-encoding candidate ranges with a higher rate. The controller102can do this, for example, by changing the parameters used by the ECC module124. As shown inFIG. 6, the controller102first senses data from the candidate range (610). The controller102then re-encodes (e.g., using the ECC module124) the data with a higher-rate error correction code (ECC) (such as, for example, low-density parity-check (LDPC) code) and writes the data to the memory104(620). This action has two implications. First, the correction power of the controller102is reduced because decreasing the highest decodable bit error rate (BER) is similar to increasing the overall BER (630). Second, multiple ECC decoding stages would be required to get the user data (640). From a security point of view, this may be useful in certain scenarios, such as when the code matrices are acquired by a malicious third party. After re-encoding the data, the code matrices would be useless to the third party, thus complicating malicious reads.

FIG. 7is a flow chart of a method of an embodiment for degrading a subsequent read of a set of locations in memory by moving a read threshold. This method increases a read voltage (Vread) to a level sufficient to cause a read disturb (e.g., replacing Vsense by Vread, and setting Vread to a high level). The controller102can do this, for example, by programming a different read threshold value into a register used by the state machine152in the memory104. As shown inFIG. 7, the controller102can move thresholds used to read data from memory cells in the candidate range by a certain delta (710). Moving the voltage read threshold between different programmed states when reading from the candidate range can gradually increase the bit error rate (BER) (720). This method is generally reversible, but if used too much, may become irreversible because accumulating read disturb errors may impair the memory cells (730).

As another option, the controller102can prevent data access and/or return unexpected data by blocking access to the global address table (GAT) in the flash control layer132or media management layer138or altering it, so that when an attempt is made to read a certain logical block address, the logical-to-physical address translation will result in returning data corresponding to a different logical block address. In this embodiment, users can be given a special command sequence to “unlock” the secured data later (releasing the GAT blockage); hence, this GAT-based method may be reversible.

FIG. 8shows another option: erasing data in the candidate range when the host attempts to read it (e.g., replace a read operation from the host with an erase operation) (810). The controller102can do this, for example, by altering the flash control layer132or media management layer138to selectively swap read and erase operations when a certain logical block address is attempted to be read. While the above options are generally reversible, erasing data in the candidate range is not, as it destroys the data completely. This option may be desired in a “last resort” situation, where the host cannot be trusted at all, and the data needs wiping.

One of skill in the art will recognize that this invention is not limited to the two dimensional and three dimensional structures described but cover all relevant memory structures within the spirit and scope of the invention as described herein and as understood by one of skill in the art.