Information storage apparatus, information storage method, and electronic device

According to one embodiment, there is provided an information storage apparatus, including: a plurality of nonvolatile memories configured to store encryption information so that the stored encryption information are read out therefrom; a plurality of encryption processing modules provided correspondingly with the respective memories, and configured to encrypt the information to be stored in the memories and to decrypt the encryption information read out from the memories; and a storage processing module configured to collectively store a plurality of key information that are utilized when the encryption processing modules encrypt the information to be stored or decrypt the encryption information read out.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2010-223217, filed on Sep. 30, 2010, the entire contents of which are incorporated herein by reference.

FIELD

Embodiments described herein relate generally to an information storage apparatus, an information storage method, and an electronic device which store key information for the encryption and decryption of information.

BACKGROUND

In recent years, as a nonvolatile storage medium for storing information, a NAND flash memory is utilized in an information storage apparatus such as an SSD (Solid State Drive). The NAND flash memory is integrated as a semiconductor chip to have a capacity of several tens [Mbytes]. The SSD includes such semiconductor chips in plurality to realize a total capacity of several hundred [Mbytes]. Besides, the write of information into or the erase of information from the NAND flash memory is controlled in units of a predetermined capacity.

In the information storage apparatus, encrypted information is stored in the storage medium, and the encryption information read out from the storage medium is decrypted. Identical key information is utilized in the encryption and decryption of the information, whereby the decryption of the encrypted information is permitted. In the SSD, plural interface ICs for transmitting and receiving information to and from the plural semiconductor chips are included in correspondence with these semiconductor chips being the storage medium. The respective interface ICs concurrently execute the encryptions or decryptions of information for the corresponding semiconductor chips, by utilizing appropriate key information.

That is, in the SSD, the plural key information are sometimes utilized concurrently by the plural interface ICs which execute the encryptions or decryptions of the information. Besides, in an encryption system including plural encryption processing blocks, the plural encryption processing blocks store key information for encryptions and decryptions, respectively and individually.

Thus, even in a case where common key information is utilized for encryption and decryption, plural blocks which execute encryption processing store key information respectively and individually. As a result, the key information for the encryptions and decryptions of information are not stored efficiently.

DETAILED DESCRIPTION

In general, according to one embodiment, there is provided an information storage apparatus, including: a plurality of nonvolatile memories configured to store encryption information so that the stored encryption information are read out therefrom; a plurality of encryption processing modules provided correspondingly with the respective memories, and configured to encrypt the information to be stored in the memories and to decrypt the encryption information read out from the memories; and a storage processing module configured to collectively store a plurality of key information that are utilized when the encryption processing modules encrypt the information to be stored or decrypt the encryption information read out.

Embodiments will be described with reference to the drawings.

FIG. 1illustrates an example configuration of an electronic device2. In this embodiment, the electronic device2includes an SSD (Solid State Drive)1as an information storage apparatus and a host apparatus150. The SSD1is connected with the host apparatus150through a communication medium (host I/F)5, and it functions as the storage module of the host apparatus150. The host I/F5connects the host apparatus150and the SSD1, and it is utilized for communications concerning the transmissions and receptions of data and commands between the host apparatus150and the SSD1. For example, the electronic device2is a personal computer, and the host apparatus150is a CPU (Central Processing Unit) which is included in the personal computer.

In this embodiment, the SSD1includes a semiconductor memory (such as a NAND flash memory) as a nonvolatile storage medium. The SSD1stores program information concerning the control of the host apparatus150, user data, etc., in rewritable fashion. This SSD1functions as an SED (Self Encrypting Drive), and it stores the information in a state where the information is encrypted by an encryption scheme such as AES (Advanced Encryption Standard).

The information storage apparatus1includes a main storage portion110which is configured of a controller100, and plural memories111,112, . . . , and a key information storage portion120which is a nonvolatile memory. The controller100includes a host I/F controller10, a buffer controller20, a buffer memory21, an MPU30, a flash memory31, an SRAM32, encryption circuits41,42, . . . , memory controllers51,52, . . . , and an arbitrator60.

The host I/F controller10controls the communications of the SSD1with the host apparatus150through the host I/F5. This host I/F controller10outputs a command or user data received from the host apparatus150, to the MPU30or the buffer controller20. Besides, the host I/F controller10transmits user data inputted from the buffer controller20, or a response notification (such as a notification indicating the completion of the execution of a command) from the MPU30, to the host apparatus150.

Under the control of the MPU30, the buffer controller20writes user data inputted from the host I/F controller10, into the buffer memory21, and it reads out user data to be outputted to the host I/F controller10, from the buffer memory21. Besides, under the control of the MPU30, the buffer controller20reads out user data to be outputted to the encryption circuits41,42, . . . , from the buffer memory21, and it writes user data inputted from the encryption circuits41,42, . . . , into the buffer memory21.

The buffer memory21temporarily stores the user data to be exchanged between the host I/F controller10and the encryption circuits41,42, . . . , under the control of the buffer controller20.

The MPU30collectively controls the individual blocks of the SSD1, and in a case where the host I/F controller10receives an instruction from the host apparatus150, this MPU30performs a control conforming to the instruction. For example, the MPU30directs in conformity with the instruction from the host apparatus150, the buffer controller20, the encryption circuits41,42, . . . , and the memory controllers51,52, . . . to write user data into the main storage portion110and to execute processing necessary for the read-out of user data from the main storage portion110. Besides, the MPU30updates key information to be utilized in the encryption circuits41,42, . . . , and it outputs the updated key information to the arbitrator60.

The flash memory31is a nonvolatile storage medium, and it stores programs to be run by the MPU30, various setting information, etc. in rewritable fashion. The SRAM32is a volatile storage medium, it functions as the work area of the MPU30, and it functions as stacks, buffers, etc. at the times of various processes.

The encryption circuits41,42, . . . encrypt the user data inputted from the buffer controller20, and they output the encrypted user data to the respectively corresponding memory controllers51,52, . . . . Besides, the encryption circuits41,42, . . . decrypt the encrypted user data inputted from the respectively corresponding memory controllers51,52, . . . , and they output the decrypted user data to the buffer controller20. These encryption circuits41,42, . . . generate encryption keys on the basis of the key information obtained by making requests to the arbitrator60, and they encrypt the user data or decrypt the encrypted user data by using the generated encryption keys. Further, in a case where the key information are updated by the MPU30, the encryption circuits41,42, . . . are notified of the updated key information. Incidentally, the encryption circuits41,42, . . . may be configured as a hardware module or a software (program) module.

The memory controllers51,52, . . . include FIFO buffers and ECC processors, and they control the transmissions and receptions of information to and from the main storage portion110which is configured of, for example, NAND flash memories. These memory controllers51,52, . . . transmit and store the encrypted user data inputted from the respectively corresponding encryption circuits41,42, . . . , to and in the respectively corresponding memories111,112, . . . . Besides, these memory controllers51,52, . . . receive the encrypted user data read out from the respectively corresponding memories111,112, . . . , and they output the read-out data to the respectively corresponding encryption circuits41,42, . . . .

The arbitrator60reads out the key information requested by any of the encryption circuits41,42, . . . , from the key information storage portion120, and it outputs the read-out key information to the requesting one of the encryption circuits41,42, . . . . Besides, in a case where the key information is by the MPU30, the arbitrator60is notified of the updated key information, and it stores this key information in the key information storage portion120. Further, the arbitrator60manages the key information under predetermined conditions and causes the key information storage portion120to store them.

In this embodiment, the controller100controls the encryptions and decryptions of the user data between the host apparatus150and the main storage portion110, by utilizing the plural blocks. More specifically, in this embodiment, in the encryptions and decryptions of the user data, the key information which are collectively stored in the key information storage portion120are appropriately outputted to the corresponding ones of the encryption circuits41,42, . . . by the arbitrator60.

The key information storage portion120is the nonvolatile memory for storing the key information which are utilized in the encryptions and decryptions of the user data executed by the encryption circuits41,42, . . . . This key information storage portion120may be disposed within the controller100. Even in this case, the key information storage portion120is not divided for the respective encryption circuits41,42, . . . , but it is configured so as to collectively store all the key information which are utilized in the encryption circuits41,42, . . . .

The main storage portion110is configured of the plural memories111,112, . . . which are the NAND flash memories. For example, each of the memories111,112, . . . is a semiconductor chip having a capacity of several tens [Mbytes]. The SSD1includes the plural memories (semiconductor chips)111,112, . . . , whereby a total capacity of several hundred [Mbytes] is realized.

In the SSD1according to this embodiment, the write operations or read operations of the encryption user data into or from the plural memories111,112, . . . are concurrently executed. Likewise, the encryptions or decryptions for the individual user data are concurrently executed. In the concurrently-executed encryptions and decryptions of the user data, the arbitrator60outputs the key information to be collectively stored in the key information storage portion120, appropriately to the corresponding ones of the encryption circuits41,42, . . . . According to the SSD1including the above-described controller100, the key information management processing in which the plural key information are collectively managed is executed. In other words, according to this embodiment, the key information for the encryptions and decryptions of the information can be stored more efficiently.

Next, the plural blocks which are included in the controller100explained with reference toFIG. 1and which execute the key information management processing for collectively managing the plural key information will be described with reference toFIG. 2.FIG. 2illustrates an example system architecture which consists of plural blocks that execute the key information management processing for collectively managing the plural key information.

The encryption circuit41includes an encryption processor201, a key information I/F202, and a storage portion203. Likewise, the encryption circuit42includes an encryption processor211, a key information I/F212, and a storage portion213. The arbitrator60includes communication portions251,252, . . . , and a management portion260.

The encryption processor201encrypts user data inputted from the buffer controller20, and it outputs the encrypted user data to the memory controller51. Besides, the encryption processor201decrypts encrypted user data inputted from the memory controller51, and it outputs the decrypted user data to the buffer controller20. In case of encrypting or decrypting the user data, the encryption processor201reads out information on key information necessary for the encryption or decryption, from the storage portion203. The information on the key information is an ID which indicates the key information uniquely, or that LBA (positional information) of the key information storage portion120at which the key information is stored. The information content of the ID or the LBA is several [bytes]. The encryption processor201notifies a request for acquiring the key information, to the key information I/F202together with the read-out ID or LBA. This encryption processor201generates an encryption key for use in the encryption and decryption of the user data, on the basis of the key information inputted from the key information I/F202. Besides, in a case where the information on the key information is notified from the MPU30, the encryption processor201stores the notified information in the storage portion203.

The key information I/F202is a block which takes charge of the communications between the encryption circuit41and the arbitrator60. The key information I/F202outputs the acquisition request for the key information and the ID or LBA of the key information notified from the encryption processor201, to the communication portion251disposed in the arbitrator60, as the information on the key information. Besides, the key information I/F202outputs the key information inputted as a response from the communication portion251, to the encryption processor201.

The storage portion203stores the ID which indicates the key information uniquely, or that LBA of the key information storage portion120at which the key information is stored, as the information on the key information necessary for the generation of the encryption key in the encryption processor201. The storage portion203has the stored ID or LAB read out by the encryption processor201. Besides, the storage portion203may store key length information which indicates the information content (bit length) of the key information.

The encryption processors211, . . . execute operations similar to those of the encryption processor201, but they differ in the point that the corresponding blocks are substituted from the memory controller51to the memory controllers52, . . . , from the key information I/F202to the key information I/Fs212, . . . , and from the storage portion203to the storage portions213, . . . .

The key information I/Fs212, . . . execute operations similar to those of the key information I/F202, but they differ in the point that the corresponding blocks are substituted from the encryption processor201to the encryption processors211, . . . .

The storage portions213, . . . execute operations similar to those of the storage portion203, but they differ in the point that the corresponding blocks are substituted from the encryption processor201to the encryption processors211, . . . .

The communication portions251,252, . . . output the IDs or LBAs being the information on the key information as have been inputted from the key information I/Fs202,212, . . . , to the management portion260with the input sources managed. These communication portions251,252, . . . output the key information inputted as the responses from the management portion260, to the managing input sources. Besides, the communication portions251,252, . . . are in one-to-one correspondence with the key information I/Fs202,212, . . . .

The management portion260reads out the key information corresponding to the IDs or LBAs inputted from the communication portions251,252, . . . , from the key information storage portion120, and it outputs the read-out key information to the communication portions251,252, . . . . Besides, in a case where the management portion260is newly notified of key information from the MPU20, it stores the notified key information in the information storage portion120, and it newly manages the notified key information together with the information on the pertinent key information.

In this way, the IDs or LBAs being the information on the key information are outputted from the encryption circuits41,42, . . . to the arbitrator60. The arbitrator60outputs the key information to the encryption circuits41,42, . . . of the output sources as responses based on the inputted IDs or LBAs. Incidentally, not only the IDs or LBAs being the information on the key information, but also key length information may be outputted from the encryption circuits41,42, . . . to the arbitrator60. That is, the key information management processing in which the plural key information are collectively managed is executed chiefly by the encryption circuits41,42, . . . and the arbitrator60. According to the SSD1including the above-described controller100, the key information for the encryptions and decryptions of the information can be stored more efficiently.

Incidentally, the encryption circuits41,42, . . . , the arbitrator60, and the key information storage portion120should preferably be encapsulated within a single semiconductor package. The secrecy of the key information is enhanced owing to the encapsulation of these blocks within the single semiconductor package.

Besides, the encryption circuits41,42, . . . do not individually store the key information which are respectively utilized, but the arbitrator60collectively stores the key information which are utilized in all the encryption circuits41,42, . . . , in the key information storage portion120, thereby realizing the unitary management of the key information. In a case, for example, where the key information to be utilized in the encryption circuits41,42, . . . are common, one information suffices as the key information which is stored in the key information storage portion120. In the related art, the same key information are stored in the encryption circuits41,42, . . . , respectively and individually. On the other hand, according to the SSD1including the above-described controller100, the capacity of the key information to be stored can be sharply decreased.

Further, the communication portions251,252, . . . and the management portion260which are included in the arbitrator60are configured by hardware, whereby the key information can be outputted as in DMA operations in DRAM accesses. That is, it is permitted to easily heighten the speed of operations in which appropriate key information are outputted to the encryption circuits41,42, . . . of the output sources in accordance with the IDs or LBAs being the information on the key information as have been outputted from the encryption circuits41,42, . . . to the arbitrator60.

Next, the key information which is managed by the management portion260included in the arbitrator60will be described with reference toFIG. 3.FIG. 3illustrates examples of the key information which is managed by the management portion260.

As shown inFIG. 3, the key information is divided into plural pieces (for example, four pieces), and key addresses are associated with the respective key information. Besides, the key addresses are managed in association with key IDs, or the stored addresses (LBAs) of the key information storage portion120. For example, the key information for use in each of the encryption circuits41,42, . . . is of 128 [bits], 192 [bits], or 256 [bits]. In the case where the maximum bit length of the key information is 256 [bits] and where the key information is managed in four divisions, the minimum management unit becomes 64 [bits]. Assuming that the key information for use in the specified encryption circuit (for example, the encryption circuit41) is of 128 [bits], a component corresponding to two minimum management units becomes necessary key information. Incidentally, the management portion260may manage the key length information of every key ID (or LBA).

The same key information are sometimes used in the respective encryption circuits41,42, . . . . In this case, one information suffices as the key information which is stored in the key information storage portion120, and the plural key information for use in the respective encryption circuits41,42, . . . need not be stored. That is, in this case, the capacity of the key information to be stored can be made small. Besides, in the case where the key information is of 128 [bits], the component corresponding to the two minimum management units may be stored in the key information storage portion120, and the capacity of the key information to be stored can be made still smaller.

Besides, the key information which are utilized in the respective encryption circuits41,42, . . . are sometimes constituted by the combinations of the key information of the minimum management unit. Let's suppose, for example, a case where the key information for use in the encryption circuit41has the key address “0” of the key ID=0 constituted by high-order information and the key address “1” of the key ID=0 constituted by low-order information. On this occasion, if the key information for use in the encryption circuit42has the key address “1” of the key ID=0 constituted by the high-order information and the key address “0” of the key ID=0 constituted by the low-order information, the different key information are used in the encryption circuits41and42, but the key information of both the encryption circuits41and42are stored by storing the high-order information and low-order information of the key information.

In this manner, the key information is divided, and the key addresses are further associated with the divided key information, whereby the possibility of decreasing the key information to be stored becomes higher.

Next, the operation of the key information management processing which is executed chiefly by the encryption circuits41,42, . . . and the arbitrator60will be described with reference toFIG. 4.FIG. 4illustrates a timing chart in the key information management processing.

The timing chart shown inFIG. 4exemplifies a case where the encryption circuit41makes a request for the key address [0:4] of the key ID=0, while the encryption circuit42makes a request for the key address [0:4] of the key ID=1.

(a) The key information I/F202of the encryption circuit41outputs information which indicates the key ID=0 corresponding to desired key information, to the communication portion251of the arbitrator60. On this occasion, also information which indicates the key address [0:4] at the key ID=0 may be outputted together.

(b) The key information I/F212of the encryption circuit42outputs information which indicates the key ID=1 corresponding to desired key information, to the communication portion252of the arbitrator60. On this occasion, also information which indicates the key address [0:4] at the key ID=1 may be outputted together.

(c) The management portion260of the arbitrator60stacks a process for reading out from the key information storage portion120, the key information which corresponds to the key address [0:4] of the key ID=0 inputted from the communication portion251, and a process for reading out from the key information storage portion120, the key information which corresponds to the key address [0:4] of the key ID=1 inputted from the communication portion252.

(d) The management portion260instructs the key information storage portion120to perform the read-out of the key information stored at the LBA corresponding to the key address [0:4] of the key ID=0 as has been stacked as the first process.

(e) The key information storage portion120outputs the key information which is stored at the LBA corresponding to the key address [0:4] of the key ID=0, to the management portion260.

(f) The management portion260outputs the key information read out, to the communication portion251, and the communication portion251outputs the key information corresponding to the key address [0:4] of the key ID=0, to the key information I/F202every minimum management unit. When the output of all the key information is completed, the read-out process of the key information concerning the key address [0:4] of the key ID=0 as has been stacked as the first process is completed.

(g) When the read-out process of the key information concerning the key address [0:4] of the key ID=0 is completed, the management portion260instructs the key information storage portion120to perform the read-out of the key information stored at the LBA corresponding to the key address [0:4] of the key ID=1 inputted from the communication portion252as has been stacked as the next process.

(h) The key information storage portion120outputs the key information stored at the LBA corresponding to the key address [0:4] of the key ID=1, to the management portion260.

(i) The management portion260outputs the key information read out, to the communication portion252, and the communication portion252outputs the key information corresponding to the key address [0:4] of the key ID=1, to the key information I/F212every minimum management unit. When the output of all the key information is completed, the read-out process of the key information concerning the key address [0:4] of the key ID=1 as has been stacked as the next process is completed.

In this way, the key information management processing based on the encryption circuits41and42and the arbitrator60is executed at the timings indicated by (a)-(i). More specifically, concurrent requests can be made for the outputs of the key information from the encryption circuits41and42to the arbitrator60. Besides, regarding the operations of reading out the key information from the key information storage portion120by the management portion260, after the read-out of the previous key information is completed, the read-out of the succeeding key information is continuously executed. Accordingly, it is permitted to execute the key information management processing in which a time period from the request for the output of the key information, to the output of the key information is shortened to the utmost.

According to this embodiment, in the concurrently-executed encryption and decryption of the user data, the key information which are collectively stored in the key information storage portion120are appropriately outputted to the corresponding ones of the encryption circuits41,42, . . . by the arbitrator60. In other words, the key information management processing for collectively managing the plural information is executed by the encryption circuits41,42, . . . and the arbitrator60. In the key information management processing, requests for the outputs of the key information are concurrently made to the arbitrator60, and regarding the operations of reading out the key information from the key information storage portion120, after the read-out of the previous key information is completed, the read-out of the succeeding key information is continuously executed. Accordingly, it is permitted to execute the key information management processing in which the time period from the request for the output of the key information, to the output of the key information is shortened to the utmost. Thus, according to the SSD1including the above-described controller100, the key information for the encryption and decryption of the information can be stored more efficiently.

The present invention is not limited to the above embodiment, but various alterations, modifications, etc. can be made within a scope of the present invention. Besides, various inventions can be formed by appropriately combining plural components disclosed in the foregoing embodiments. For example, some components may be omitted from all the components indicated in the embodiments, and the components according to the different embodiments may be appropriately combined.