Patent Description:
Accelerator circuits such as graphics processing units (GPUs) and field programmable gate arrays (FPGAs) may be used to perform various computations such as those associated with artificial intelligence (Al) or machine learning.

However, certain large-scale data operations may drastically effect the speed of data transfer between a central processing unit (CPU) and a storage device. Thus, some data operation associated with the storage device may be performed using an accelerator circuit in the storage device. In addition, the storage device may store encrypted data to ensure data security.

<CIT> discloses a host controller that controls a storage device includes an encryption unit that is selectively configured in response to file encryption information and disk encryption information to encrypt data. The encryption unit encrypts the data using a file encryption operation based on the file encryption information and/or a disk encryption operation based on the disk encryption information.

<CIT> discloses a large file encryption method comprising, reading the file, get the content, according to the need for data or content block; according to the need to choose whether to encrypt, and what kind of encryption; selecting an existing key or generate a key, and encrypt each data block to be encrypted according to a selected method; encrypting the ciphertext obtained from each data block, and if necessary, perform necessary adaptive transcoding to generate a ciphertext segment actually written and cover the original plaintext segment. The obtained ciphertext segment is stored in one of two ways: a) when the original file format can be appended with the data, the ciphertext data is appended to the original file format according to the corresponding file format, and the last Ciphertext; b) storing the ciphertext in a new file; the above two encryption methods need to store the location information of the plaintext segment corresponding to the encrypted data block, the corresponding information required for decryption, and the parameter record.

<CIT> discloses a storage controller of a machine receives training data associated with a neural network model. The neural network model includes a plurality of layers, and the machine further including at least one graphics processing unit. The storage controller trains at least one layer of the plurality of layers of the neural network model using the training data to generate processed training data. A size of the processed data is less than a size of the training data. Training of the at least one layer includes adjusting one or more weights of the at least one layer using the training data. The storage controller sends the processed training data to at least one graphics processing unit of the machine. The at least one graphics processing unit is configured to store the processed training data and train one or more remaining layers of the plurality of layers using the processed training data.

Embodiments of the inventive concept provide storage devices capable of selectively encrypting data in accordance with a command field. Embodiments of the inventive concept also provide operating methods for such storage devices.

The invention provides an operating method for a storage device in accordance with claim <NUM> and a storage device as claimed in claim <NUM>.

Advantages, benefits, objects and features, as well as the making and use of the inventive concept, may be more clearly understood upon consideration of the following detailed description together with the accompanying drawings in which:.

Throughout the written description and drawings, like or similar numbers and labels are used to denote like or similar elements, components, features and/or method steps.

Figure (<FIG> is a block diagram illustrating a storage system <NUM> according to embodiments of the inventive concept.

Referring to <FIG>, the storage system <NUM> may generally include a host <NUM> and a storage device <NUM>, wherein the storage device <NUM> may include a storage controller <NUM> and a nonvolatile memory (NVM) <NUM>.

The host <NUM> may provide one or more command(s) (hereafter singularly or collectively, "command CMD" to the storage device <NUM>. Those skilled in the art will appreciate that the command CMD may be one or more of a read command, a write (or program) command, an erase command, a house-keeping command, etc. Thus, in response to a write command received from the host <NUM>, the storage device <NUM> may to store data (e.g., plain text PT or unencrypted data). Thereafter, in response to a read command received from the host <NUM>, the storage device <NUM> retrieve and provide the plain text PT.

The storage device <NUM> may include storage media (e.g., NVM <NUM>) capable of storing data in response to the command CMD received from the host <NUM>. In some embodiments, the storage device <NUM> may include at least one of a solid state drive (SSD), an embedded memory, a removable external memory, etc. Assuming that the storage device <NUM> includes a SSD, the storage device <NUM> may operate in a manner conforming to technical standards associated with a non-volatile memory express (NVMe). Assuming that the storage device <NUM> includes an embedded memory or an external memory, the storage device <NUM> may operate in a manner conforming to technical standards associated with a universal flash storage (UFS) or an embedded multi-media card (eMMC) standard.

In some embodiments, the host <NUM> and the storage device <NUM> may generate, communicate and/or receive (hereafter singularly or collectively, "communicate") packet(s) conforming to technical standards associated with one or more conventionally understood and/or commercially available data communications protocols.

The NVM <NUM> may include a flash memory (e.g., a two-dimensional (2D) NAND memory array or a three-dimensional (3D) or vertical NAND (VNAND) memory array). Alternately or additionally, the storage device <NUM> may include magnetic random access memory (RAM) (MRAM), spin-transfer torque MRAM, conductive bridging RAM (CBRAM), ferroelectric RAM (FeRAM), phase RAM (PRAM), resistive memory (resistive RAM), etc..

The storage controller <NUM> may include a host interface <NUM>, a first encryption circuit <NUM>, and a second encryption circuit <NUM>.

The host interface <NUM> may be used to communicate one or more packet(s) (hereafter singularly or collectively, "packet") between the host <NUM> and the storage device <NUM>. A packet communicated from the host <NUM> to the host interface <NUM> may include a command CMD and/or data (e.g., plain text PT) to be written to the NVM <NUM>. A packet communicated from the host interface <NUM> to the host <NUM> may include a response to a previously received command and/or read data retrieved from the NVM <NUM>. In some embodiments, the host interface <NUM> may communicate plain text PT to the first encryption circuit <NUM> and/or the second encryption circuit <NUM> in accordance with (or "based on") a field related to data included in the command CMD (hereafter, a "command field").

The first encryption circuit <NUM> may generate a first ciphertext CT1 by encrypting the plain text PT using a first encryption algorithm, and may decrypt the first ciphertext CT1 using the first encryption algorithm. In some embodiments, the first encryption algorithm may be a homomorphic encryption algorithm. The first encryption algorithm may provide a ciphertext on which one or more computation(s) have been performed. That is, the decrypted data generated by decrypting a computation (e.g., an arithmetic or logic operation) result on the first ciphertext CT1 may be the same as a computation result associated with the plain text PT. That is, security of the plain text PT may be maintained and computation may be performed using the first ciphertext CT1.

The second encryption circuit <NUM> may generate a second ciphertext CT2 by encrypting the plain text PT using a second encryption algorithm, and may decrypt the second ciphertext CT2 using the second encryption algorithm. In some embodiments, the second encryption algorithm may be a symmetric key algorithm or an asymmetric key algorithm. The second encryption algorithm may be a relatively simple encryption/decryption algorithm and may be used to provide a relatively fast encryption/decryption speed. Accordingly, when the plain text PT is encrypted using the second encryption algorithm, performance of various interface circuitry between the host <NUM> and the storage device <NUM> may be improved.

In some embodiments, the host interface <NUM> may respectively communicate the plain text PT based on a first field of the command CMD (e.g., a "first field") or a second field of the command CMD (e.g., a second field") to either the first encryption circuit <NUM> or the second encryption circuit <NUM>.

The first field includes information indicating whether or not a computation will be performed on data received from the host <NUM>. For example, when the first field includes a "<NUM>", the storage device <NUM> may perform, for example, an arithmetic operation on data received from the host <NUM>, a learning operation associated with a machine learning program, or an inference operation associated with the machine learning program. However, when the first field includes a "<NUM>", the storage device <NUM> may not perform the foregoing arithmetic operation, learning operation, or inference operation.

The second field includes information indicating whether or not data received from the host <NUM> is plain text PT (unencrypted data) or encrypted data. For example, when the second field includes a "<NUM>", the data received from the host <NUM> may be unencrypted plain text, and when the second field includes a "<NUM>", the data received from the host <NUM> may be a ciphertext.

<FIG> is a flowchart illustrating an operating method for a storage device according to embodiments of the inventive concept. Here, the example illustrated in <FIG> assumes a write operating method applied to the storage device <NUM> of <FIG>.

Referring to <FIG> and <FIG>, the host interface <NUM> of the storage device <NUM> may receive write data and a command from the host <NUM> (S210), wherein the write data may be unencrypted plain text or a ciphertext. Accordingly, the command may include at least one field associated with the data. In some embodiments, the command may include a first field or a second field, wherein the first field indicates whether or not a computation on data should be performed, and the second field indicates whether or not the data is encrypted.

The storage device <NUM> may then determine an operation mode based on the at least one command field (S220). That is, the host interface <NUM> may identify the first field or the second field included in the command, and the storage device <NUM> may determine the operation mode based on the information stored in the first field or the second field. For example, when the second field indicates that data is not encrypted and the first field indicates that computation on data is performed, the storage device <NUM> may operate in a first operation mode to generate first encrypted data. When the second field indicates that data is not encrypted and the first field indicates that no computation on data is performed, the storage device <NUM> may operate in a second operation mode to generate second encrypted data. And when the second field indicates that data is already encrypted, the storage device <NUM> may operate in a third operation mode to generate third encrypted data.

Thus, the storage device <NUM> may selectively encrypt write data received from the host <NUM> using an encryption algorithm corresponding to the determined operation mode (S230). For example, in the first operation mode, the host interface <NUM> may communicate the write data to the first encryption circuit <NUM>, and the first encryption circuit <NUM> may encrypt the write data using the first encryption algorithm to generate the first encrypted data. In the second operation mode, the host interface <NUM> may communicate the write data to the second encryption circuit <NUM>, and the second encryption circuit <NUM> may encrypt the write data using the second encryption algorithm to generate second encrypted data. And in the third operation mode, the host interface <NUM> may omit encryption of the write data (e.g., the write data received from the host <NUM> may have been previously encrypted) by either the first or second encryption circuits <NUM> and <NUM> to generate the third encrypted data.

The storage device <NUM> may then store the encrypted write data - as first encrypted data, second encrypted data, or third encrypted data - in the NVM <NUM> (S240). For example, in the first operation mode, the write data encrypted by the first encryption circuit <NUM> may be stored in the NVM <NUM>. In the second operation mode, the write data encrypted by the second encryption circuit <NUM> may be stored in the NVM <NUM>. In the third operation mode, write data received by the host interface <NUM> may be stored in the NVM <NUM>. In some embodiments, the storage device <NUM> may store not only the encrypted write data, but also information indicated in the first field and/or the second field of the command in the NVM <NUM>. That is, the storage device <NUM> may also store operating mode information in the NVM <NUM>.

<FIG> is a flowchart illustrating an operating method for a storage device according to an embodiments of the inventive concept. Here, the example illustrated in <FIG> assumes a read operating method applied to the storage device <NUM> of <FIG>.

Referring to <FIG> and <FIG>, the storage device <NUM> may receive a read command from the host <NUM> via the host interface <NUM> (S310). The storage device <NUM> may receive not only a read command, but also an address indicating a location of the read data in the NVM <NUM>.

In response, the storage device <NUM> may retrieve the read data from the NVM <NUM> (S320). The read data may be temporarily stored in a buffer memory (not illustrated). In some embodiments, the storage device <NUM> may read not only the read data, but also information indicating an operation mode from the NVM <NUM>. That is, the storage device <NUM> may read from the NVM <NUM> information indicated in the first field and/or second field corresponding to the read data.

The storage device <NUM> may then selectively decrypt the read data based on an operation mode corresponding to the read data (S330). That is, the storage device <NUM> may determine an operation mode corresponding to the read data based on the information of the first field and/or the second field corresponding to the read data. In a first operation mode, the storage device <NUM> may decrypt the read data using the first encryption algorithm. In a second operation mode, the storage device <NUM> may decrypt the read data using the second encryption algorithm, and in a third operation mode, the storage device <NUM> may omit decryption of the read data.

Then, the storage device <NUM> may provide the selectively decrypted data to the host <NUM> (S340). That is, in the first operation mode, the storage device <NUM> may provide data decrypted using the first encryption algorithm to the host <NUM>. In the second operation mode, the storage device <NUM> may provide data decrypted using the second encryption algorithm to the host <NUM>. In the third operation mode, the storage device <NUM> may provide data read from the NVM <NUM> to the host <NUM>.

<FIG> is a block diagram illustrating a storage system <NUM> according to embodiments of the inventive concept.

Referring to <FIG>, the storage system <NUM> may generally include a host <NUM> and a storage device <NUM>. In some embodiments, the host <NUM> may include a host controller <NUM> and a host memory <NUM>, wherein the host memory <NUM> functions as a buffer memory to temporarily store write data communicated to the storage device <NUM> and/or read data communicated from the storage device <NUM>.

In some embodiments, the host controller <NUM> and the host memory <NUM> may be implemented as separate semiconductor chips. Alternately, the host controller <NUM> and the host memory <NUM> may be integrated into a single semiconductor chip. For example, the host controller <NUM> may implement one or more of a plurality of modules included in an application processor, wherein the application processor is implemented as a System on Chip (SoC). In addition, the host memory <NUM> may include an embedded memory provided in the application processor or may include a non-volatile memory or a memory module outside the application processor.

The host controller <NUM> may be used to manage write operations and read operations in relation to a storage controller <NUM> and a non-volatile memory (NVM) <NUM> of the storage device <NUM>.

The storage controller <NUM> may include a host interface <NUM>, a memory interface <NUM>, and a storage processor <NUM>. In addition, the storage controller <NUM> may include a flash translation layer (FTL) <NUM>, a packet manager <NUM>, a buffer controller <NUM>, an error correction code (ECC) engine <NUM>, a first encryption circuit <NUM>, and a second encryption circuit <NUM>. The storage controller <NUM> may include a working memory (not illustrated) into which the FTL <NUM> may be loaded. Accordingly, as the storage processor <NUM> may implement the FTL <NUM>, write and read operations performed in relation to the NVM <NUM> may be controlled by the storage controller <NUM>.

The memory interface <NUM> may communicate write data received from the host <NUM> to the NVM <NUM> and/or communicate read data received from the NVM <NUM> to the host <NUM>. The memory interface <NUM> may be implemented to conform with technical standards associated with one or more data communications protocols such as Toggle or Open NAND Flash Interface (ONFI). In some embodiments, the memory interface <NUM> may communicate a ciphertext CT encrypted by the first encryption circuit <NUM> or the second encryption circuit <NUM> to the NVM <NUM>, as well as receive a ciphertext CT retrieved from the NVM <NUM>.

The FTL <NUM> may be used in conjunction with certain functions, such as address mapping, wear-leveling, and garbage collection. Here, address mapping may be understood as an operation whereby logical address(es) received from the host <NUM> are converted into corresponding physical address(es) associated with the NVM <NUM>. Wear-leveling is a data storing approach that prevents degradation of specified block(s) among a plurality of blocks in the NVM <NUM> due to non-uniform block usage. In some embodiments, wear-leveling may be implemented using firmware to balance erase counts associated with the plurality of blocks. Garbage collection is memory space management approach that seeks to maximize the useable data storage capacity of the NVM <NUM> by copying (or consolidating) valid data from one or more blocks into a new block, and then erasing one or more blocks to generate one or more new blocks.

The packet manager <NUM> may be used to generate a packet according to a protocol of an interface negotiated with the host <NUM> or may parse various types of information from a packet received from the host <NUM>. In addition, the buffer controller <NUM> may control data temporarily stored in the buffer memory <NUM> prior to exported outside of the storage controller <NUM>. That is, write data to-be-written in the NVM <NUM> and/or read data retrieved from the NVM <NUM> may be temporarily stored in the buffer memory <NUM> under the control by the buffer controller <NUM>. As illustrated in <FIG>, the buffer memory <NUM> may be provided in the storage controller <NUM> but may also be outside the storage controller <NUM>.

The ECC engine <NUM> may perform an error detection and correction function on read data retrieved from the NVM <NUM>. That is, the ECC engine <NUM> may generate parity bits for write data to be written to the NVM <NUM>, wherein the generated parity bits may be stored in the NVM <NUM> together with the write data. When data is subsequently read from the NVM <NUM>, the ECC engine <NUM> may correct error(s) in the resulting read data using the parity bits read from the NVM <NUM> together with the read data. In this manner, error-corrected read data may be generated.

The first encryption circuit <NUM> may encrypt the plain text PT using the first encryption algorithm, wherein, in some embodiments, the first encryption algorithm is a homomorphic encryption algorithm. The first encryption circuit <NUM> may perform at least one of an encryption operation and a decryption operation on the plain text PT received by the host interface <NUM> using the first encryption algorithm. For example, the first encryption circuit <NUM> may generate the ciphertext CT by encrypting plain text PT. The ciphertext CT generated by the first encryption circuit <NUM> may be temporarily stored in the buffer memory <NUM> under the control by the buffer controller <NUM>, and may then be provided to the memory interface <NUM>.

The second encryption circuit <NUM> may encrypt plain text PT using the second encryption algorithm, wherein, in some embodiments, the second encryption algorithm is a symmetric key algorithm. The second encryption circuit <NUM> may perform at least one of an encryption operation and a decryption operation on the plain text PT received by the host interface <NUM> using the second encryption algorithm. The ciphertext CT generated by the second encryption circuit <NUM> may be temporarily stored in the buffer memory <NUM> under the control by the buffer controller <NUM>, and may then be provided to the memory interface <NUM>.

The storage processor <NUM> may include a central processing unit (CPU) <NUM> including one or more CPU cores. The storage processor <NUM> may further include an accelerator <NUM> (e.g., a dedicated circuit for high-speed data operations such as Al data operations). The accelerator <NUM> may include a graphics processing unit (GPU), a neural processing unit (NPU), a data processing unit (DPU), a field programmable gate array (FPGA), etc., and may be implemented by a chip physically separate from the CPU <NUM>.

The accelerator <NUM> may perform computation on data stored in the NVM <NUM>. That is, the accelerator <NUM> may perform not only arithmetic operation(s) (e.g., addition, subtraction, multiplication etc.), but also training operation(s) (e.g., machine learning or inference operation(s) associated with machine learning). The accelerator <NUM> may perform computation on the encrypted ciphertext based on the first encryption algorithm. In some embodiments, the accelerator <NUM> may perform a training operation of machine learning using the first ciphertext CT1 loaded into the buffer memory <NUM> from the NVM <NUM>. The accelerator <NUM> may generate learning parameters of a learning model through a training operation and may temporarily store the learning parameters in the buffer memory <NUM> or the NVM <NUM>. In some embodiments, the accelerator <NUM> may also perform an inference operation of machine learning based on the learning parameters. For example, during the inference operation, the storage controller <NUM> may receive inference target data from the host <NUM> and encrypt the inference target data using the first encryption algorithm. Thereafter, the accelerator <NUM> may generate output data according to the learning model from the inference target data based on the learning parameters. The storage controller <NUM> may provide output data to the host <NUM>.

<FIG> is a flowchart illustrating an operating method for a storage device according to embodiments of the inventive concept. Here, the operating method may be applied to the storage system <NUM> of <FIG>.

Referring to <FIG> and <FIG>, the host interface <NUM> may receive plain text (or unencrypted data) and a command from the host <NUM> (S610). The command may include a read command or a write command. The command may include a first field indicating whether or not computation on the plain text is performed by the storage device <NUM>. Here, the term "computation" may denote an Al data operation, a learning operation associated with machine learning, or an inference operation associated with machine learning, for example. The computation may be performed by the CPU <NUM> or the accelerator <NUM> included in the storage processor <NUM>.

The storage device <NUM> may identify a first field of the command (S620). In some embodiments, the host interface <NUM> may identify the first field in relation to a preset bit among bits constituting the command. For example, when a bit constituting the first field among bits constituting the command is "<NUM>", the first field may indicate that computation is performed by the storage device <NUM> on the plain text received from the host <NUM>. Alternately, when the bit constituting the first field among the bits constituting the command is "<NUM>", the first field may indicate that no computation is performed by the storage device <NUM> on the plain text received from the host <NUM>. Although the host interface <NUM> is assumed to identify the first field in the illustrated example of <FIG>, in other embodiments of the inventive concept, the storage processor <NUM> or some other component may be used to identify the first field.

When the plain text is determined to be computation target data (S630=Yes), the first encryption circuit <NUM> may encrypt the plain text using a first encryption algorithm (S640). In some embodiments, the first encryption circuit <NUM> may generate a first ciphertext by encrypting the plain text using the first encryption algorithm, and the first ciphertext may be temporarily stored in the buffer memory <NUM>. In some embodiments, computation data may be generated as a result of computation on the first ciphertext. Thereafter, decrypted data may be generated by decrypting the computation data using the first encryption algorithm, and the decrypted data may be the same as the computation performed on the plain text. That is, because the storage device <NUM> encrypts the plain text (as computational target data) using the first encryption algorithm, the computation on the plain text may be performed by the storage device <NUM>. Accordingly, the storage device <NUM> not only provides a computation function in relation to the plain text, but also ensures data security of the plain text.

When the plain text is determined to not be computation target data (S630=No), the second encryption circuit <NUM> may encrypt the plain text using the second encryption algorithm (S650). In some embodiments, the second encryption circuit <NUM> may generate a second ciphertext by encrypting a plain text using a second encryption algorithm, and the second ciphertext may be temporarily stored in the buffer memory <NUM>. The second encryption algorithm may be, for example, a symmetric key algorithm or an asymmetric key algorithm. The second encryption algorithm may provide relatively fast encryption, as compared with the first encryption algorithm. Accordingly, the plain text - while not being target computation data in relation to the storage device <NUM> - may nonetheless be encrypted using the second encryption algorithm. And as a result, the storage device <NUM> may ensure data security and provide an encryption function, albeit with relatively increased speed.

Then, the storage controller <NUM> may store a first ciphertext or a second ciphertext generated by the first encryption algorithm or the second encryption algorithm in the NVM <NUM> (S660). That is, the memory interface <NUM> may receive the first ciphertext or the second ciphertext from the first encryption circuit <NUM> or the second encryption circuit <NUM> and provide the first ciphertext or the second ciphertext to the NVM <NUM>. In some embodiments, the memory interface <NUM> may also receive the first ciphertext or the second ciphertext temporarily stored in the buffer memory <NUM> and provide the first ciphertext or the second ciphertext to the NVM <NUM>. The memory interface <NUM> may also provide a write command to the NVM <NUM> together with the first ciphertext or the second ciphertext.

<FIG> is a conceptual diagram illustrating a data structure for a command according to embodiments of the inventive concept.

Referring to <FIG> and <FIG>, the command CMD may include a plurality of fields. In some embodiments, the command CMD may include an opcode field and a first field. The opcode field may be a field indicating the type of command. For example, the opcode may include information indicating a write command or a read command. Here, although the term "command CMD" is used, the commands or instructions contemplated by various embodiments of the inventive concept may alternately be referred to as requests, queries, packets, etc..

Referring to <FIG>, the command CMD of <FIG> may further include a first field (field1) and a second field (field2). The first field may include information on whether computation on data is performed by the storage device <NUM>. In some embodiments, the first field may consist of a single bit. For example, when the first field includes "<NUM>", the storage device <NUM> may perform an arithmetic operation on data received from the host <NUM>, a learning operation of machine learning, or an inference operation of machine learning. When the first field includes "<NUM>", the storage device <NUM> may not perform the arithmetic operation on the data received from the host <NUM>, the learning operation of machine learning, or an inference operation of machine learning. The second field may include information on whether data received from the host <NUM> is encrypted. In some embodiments, the second field may consist of one bit. For example, when the second field includes "<NUM>", the data received from the host <NUM> may be an unencrypted plain text, and when the second field includes "<NUM>", the data received from the host <NUM> may be a ciphertext.

When the data received from the host <NUM> is plain text, the plain text may be encrypted using the first encryption algorithm or the second encryption algorithm as described above in relation to <FIG>, <FIG>, <FIG>, <FIG> and <FIG>. When the data received from the host <NUM> is a ciphertext, the data received from the host <NUM> may not be encrypted, and the data may be stored in the NVM <NUM>.

<FIG> are respective diagrams illustrating examples of possible command data structures according to embodiments of the inventive concept. Here, <FIG> assumes a command supported by a UFS standard, and <FIG> assumes a command supported by an NVMe standard.

Referring to <FIG>, the command CMD may include a type code field, a flag field, a logical unit number (LUN) field, a task tag field, an initiator identifier (ID) field, a command set type field, first, second, third and fourth reserved fields (reserved <NUM> to reserved <NUM>), a total extra header segment (EHS) length field, a data segment length field, an expected data transmission length field, a command descriptor block (CDB) field, and a header E2ECRC field.

The type code field may include bits indicating the type of the command CMD. The flag field may include information indicating a direction of data transmission or command priority information. The LUN field may include information on a logical unit number of a device used to communicate a command. The task tag field may include a unique tag value maintained for transactions related to a task. The initiator identifier field may include information on an identifier of a device for communicating a command. The command set type field may include information on a command set defined by a command bit in the CDB field. The total EHS length field may include information indicating sizes of additional header segments. The data segment length field may include information indicating a length of a data segment following the command. The expected data transmission length field may include information on the number of bits communicated to complete a small computer system interface (SCSI) command request. The CDB field may include information on a standard command descriptor block defined by UFS command sets. The header E2ECRC field may include information on a cyclic redundancy check (CRC) result between a device for communicating a command and a device for receiving the command.

In some embodiments, the command CMD of <FIG> includes the first field and the second field of <FIG>. For example, one or more of the first to fourth reserved fields (e.g., reserved <NUM> to reserved <NUM>) of the command CMD of <FIG> may be designated as indicating the first field and the second field (e.g., a first designated bit and a second designated bit). In this manner, for example, distinct fields of the first to fourth reserved fields (e.g., reserved <NUM> to reserved <NUM>) of the command CMD of <FIG> may be used to indicate the first field and the second field of <FIG>.

Referring to <FIG>, the command CMD may include a plurality of fields. That is, the command CMD may include an opcode field, a fuse field, a first reserved field (reserved <NUM>), a PRP or SGL for data transfer (PSDT) field, a command identifier (CID) field, a namespace identifier (NSID) field, a second reserved field (reserved <NUM>), a metadata pointer (MPTR) field, a data pointer (DPTR) field, a number of words in data transfer (NDT) field, a number of words in metadata transfer (NDM) field.

The opcode field may indicate an opcode of a command to be executed. The fuse field may indicate whether a fused operation for combining two commands is performed. The PSDT field may indicate whether information including an address (physical region page (PRP) or a scatter gather list (SGL)) is used for data transmission associated with a command. The CID field may indicate a unique identifier for the command. The YSID field may indicate an identifier of a namespace to which a command is applied. The MPTR field may include an address of an adjacent physical buffer for meta data or an address of an SGL segment. The DPTR field may include data (a PRP entry or an SGL entry) used for a command. The NDT field may indicate the number of data of a unit size (for example, <NUM> bytes) when communicating data. The NDM field may indicate the number of data of a unit size (for example, <NUM> bytes) when communicating metadata.

In some embodiments, the command CMD of <FIG> includes the first field and the second field of <FIG>. For example, one or more of the first and second reserved fields (e.g., reserved <NUM> and reserved <NUM>) of the command CMD of <FIG> may be allocated as distinct fields (e.g., the first field and the second field). For example, the first and second reserved fields (e.g., reserved <NUM> and reserved <NUM>) of the command CMD of <FIG> may be used as the first field and the second field of <FIG>.

<FIG> is a block diagram illustrating a storage system <NUM> according to embodiments of the inventive concept, and may be compared with the storage system <NUM> of <FIG>.

Of particular note, the host <NUM> of the storage system <NUM>, in contrast to the host <NUM> of the storage system <NUM>, may additionally include a host encryption circuit <NUM>. Here, the host encryption circuit <NUM> may generate a ciphertext CT for plain text PT. The ciphertext CT may be provided to the storage device <NUM>. Although not shown in <FIG>, the host <NUM> may also provide a command to the storage device <NUM> together with the ciphertext CT. The command may include a second field as illustrated in <FIG>. The second field may include information on whether the received data is ciphertext.

The host interface <NUM> of the storage controller <NUM> may receive the ciphertext CT and the command, and determine whether the received data is the ciphertext CT based on a second field included in the command. When it is determined that the received data is the plain text PT not the ciphertext CT, the storage device <NUM> may encrypt the plain text PT by selectively using a first encryption algorithm or a second encryption algorithm as described above with reference to <FIG>, <FIG>, <FIG>, <FIG>, and <FIG>. However, when it is determined that the received data is the ciphertext CT, the storage device <NUM> may store the ciphertext CT in the NVM <NUM>. In some embodiments, the memory interface <NUM> may be used to store the ciphertext CT in the NVM <NUM> (e.g., by communicating the ciphertext CT to the NVM <NUM> in accordance with an appropriate communications protocol).

<FIG> is a flowchart illustrating an operating method for a storage device according to embodiments of the inventive concept. Here, the operating method will be described in relation to the storage system <NUM> of <FIG>.

The host interface <NUM> may receive data (e.g., plain text or a ciphertext) and a command from the host <NUM> (S910). That is, the host <NUM> may provide either the ciphertext, as encrypted by the host encryption circuit <NUM>, or the plain text to the host interface <NUM>.

The storage device <NUM> may then identify a second field included in the command (S920). In some embodiments, the host interface <NUM> may identify the second field in relation to a second designated bit among a plurality of bits constituting the command. For example, when the second designated bit of the second field is "<NUM>", the second field may be deemed to indicate that the data received from the host <NUM> is the ciphertext. Alternately, when the second designated bit of the command is "<NUM>", the second field may be deemed to indicate that the data received from the host <NUM> is plain text.

Here, it should be noted that in some embodiments, the storage processor <NUM>, or some other computational device, may be used to identify the second field instead of the host interface <NUM>.

When the data is determined to be the ciphertext (S930=Yes), the operating method jumps to step S980. Otherwise, and when the data is determined to be plain text, the storage device <NUM> may identify a first field of the command (S940). In some embodiments, the host interface <NUM> may be used to identify the first field through a first designated bit among bits constituting the command. In some embodiment, the step S940 of the operating method of <FIG> may be substantially the same as step S620 of the operating method of <FIG>.

When it is determined that the plain text is computation target data (S950=Yes), the first encryption circuit <NUM> may encrypt the plain text using the first encryption algorithm. That is, the first encryption circuit <NUM> may generate a first ciphertext by encrypting the plain text using the first encryption algorithm. In some embodiments, the first encryption algorithm may be a homomorphic encryption algorithm, and the step S960 of the operating method of <FIG> may be substantially the same as step the step S640 of <FIG>. Here, the phrase "computation target data" denotes data that is a target of computational operation performed by the storage device <NUM>.

When it is determined that the plain text is not computation target data (S950=No), the second encryption circuit <NUM> may encrypt the plain text using the second encryption algorithm (S970). In some embodiments, the second encryption circuit <NUM> may generate a second ciphertext by encrypting the plain text using the second encryption algorithm. Here, the second encryption algorithm may be a symmetric key algorithm or an asymmetric key algorithm. In some embodiment, the step S970 of the operating method of <FIG> may be substantially the same as step S650 of the operating method of <FIG>.

The storage controller <NUM> may store the ciphertext in the NVM <NUM> (S980). That is, the memory interface <NUM> may store the ciphertext received from the host <NUM>, the first ciphertext generated by the first encryption circuit <NUM>, or the second ciphertext generated by the second encryption circuit <NUM> in the NVM <NUM>. In this regard, the memory interface <NUM> may receive the ciphertext, the first ciphertext, or the second ciphertext received from the host <NUM> and provide the ciphertext, the first ciphertext, or the second ciphertext to the NVM <NUM>.

When receiving the ciphertext from the host <NUM>, the storage device <NUM> may store the ciphertext in the NVM <NUM> without further encryption of the ciphertext. And because storage device-based encryption is omitted, data storage speed may be improved. In addition, when receiving the plain text from the host <NUM>, the storage device <NUM> may encrypt the ciphertext and store the generated ciphertext in the NVM <NUM>. That is, the storage device <NUM> may provide increased storage speed and improved data security by selectively performing encryption according to whether the data received from the host <NUM> is plain text or a ciphertext.

<FIG> is a conceptual diagram illustrating an encryption process using the first encryption algorithm according to embodiments of the inventive concept, and <FIG> is another conceptual diagram illustrating computation on a first ciphertext according to embodiments of the inventive concept.

Referring to <FIG>, <FIG>, <FIG>, and <FIG>, the first ciphertext CT1 may be generated by encrypting the plain text PT using the first encryption algorithm (e.g., a homomorphic encryption algorithm). The encryption process of <FIG> may be performed, for example, using a first encryption circuit (e.g., <NUM> and <NUM> of <FIG> and <FIG>). In some embodiments, the first ciphertext CT1 may include a preliminary text PreT, a message M, and an error E due to properties of the homomorphic encryption algorithm. The message M may be a valid bit that does not include the error E. Whenever a multiplication operation on a ciphertext is performed, a length of the preliminary text PreT may be reduced. Therefore, when the length of the preliminary text PreT is long, more multiplication operations may be performed on a ciphertext.

The first encryption circuits <NUM> and <NUM> may be used to generate the first ciphertext CT1 by adding a random bit having a length Q and the error E having a length B to a plain text PT having a length D. The length D may be less than the length Q and may be greater than the length B. In the first ciphertext CT1, a length of the valid bit may be referred to as P, and a length of the preliminary text PreT may be referred to as L.

Referring to <FIG> and <FIG>, the accelerator <NUM> may perform a multiplication operation using a third ciphertext CT3 and a fourth ciphertext CT4. Here, the third ciphertext CT3 and the fourth ciphertext CT4 may be ciphertexts encrypted using the first encryption algorithm. Although the multiplication operation is described below in relation to <FIG>, the accelerator <NUM> may further perform an addition operation, or some other mathematical or logic operation. Alternately or additionally, the accelerator <NUM> may also perform an Al operation, a learning operation associated with machine learning, or an inference operation associated with machine learning.

The third ciphertext CT3 may include a first preliminary text PreT1, a first message M1, and a first error E1. The third ciphertext CT3 may be a ciphertext corresponding to a first plain text PT1. A total length of the third ciphertext CT1 may be Q, and a length of the first plain text PT1 may be D. In addition, a length of the first preliminary text PreT1 may be L, a length of the first message M1 representing a valid bit of the first plain text PT1 may be P, and a length of the first error E1 may be B. In addition, the fourth ciphertext CT4 may include a second preliminary text PreT2, a second message M2, and a second error E2. The fourth ciphertext CT4 may be a ciphertext corresponding to a second plain text PT2. A total length of the fourth ciphertext CT4 may be Q, and a length of the second plain text PT2 may be D. In addition, a length of the second preliminary text PreT2 may be L, a length of the second message M2 representing a valid bit of the second plain text PT2 may be P, and a length of the second error E2 may be B.

The accelerator <NUM> may generate a fifth ciphertext CT5 by performing a multiplication operation with the third ciphertext CT3 and the fourth ciphertext CT4. The fifth ciphertext CT5 may include a third preliminary text PreT3, a third message M3, and a third error E3. A total length of the fifth ciphertext CT5 may be Q, a length of the third preliminary text PreT3 may be L', a length of the third message M3 may be P', and a length of the third error may be B'. Due to a property of the multiplication operation on the homomorphic ciphertext, the length L' of the third preliminary text PreT3 may be less than the length L, the length P' of the third message M3 may be less than the length P, and the length B' of the third error E3 may less than the length B. A result of decrypting the fifth ciphertext CT5 using the first encryption algorithm may be the same as a result of a multiplication operation of the first plain text PT1 and the second plain text PT2.

In some embodiments, the accelerator <NUM> may obtain a changed third error E3t by removing some of lower bits LSB of the third error E3 included in the fifth ciphertext CT5. The number of lower bits to be removed may be set to D. Accordingly, a length Bt of the changed third error E3t may be less than the length B'. However, the length Bt of the changed third error E3t may be greater than the length B of the first error E1 due to a property of a multiplication operation, and thus, a length of an error included in a ciphertext may be increased as the multiplication operation is repeated. Because a lower bit having a length D is removed from the length Q of the fifth ciphertext CT5, the length Q' of the changed fifth ciphertext CT3t may be less than the length Q. In conclusion, as a multiplication operation is repeated, a total length of a ciphertext and a length of a valid bit included in the ciphertext may be reduced, and a length of an error may be increased. A result of decrypting the changed fifth ciphertext CT5t using the first encryption algorithm may be the same as a result of a multiplication operation of the first plain text PT1 and the second plain text PT2.

<FIG> is a block diagram illustrating a method of storing data according to embodiments of the inventive concept. The method of <FIG> will be described in relation to the storage system of <FIG>, wherein a storage controller <NUM> may be understood as one possible example of the storage controller <NUM>.

Referring to <FIG> and <FIG>, a non-volatile memory (NVM) <NUM> may include a normal region <NUM> and a meta region <NUM>. The normal region <NUM> may store a ciphertext CT, and the meta region <NUM> may store field data. In some embodiments, the normal region <NUM> and the meta region <NUM> may be physically separate.

The storage controller <NUM> may control the NVM <NUM> to store the ciphertext CT in the normal region <NUM>. The ciphertext CT may be received from the host <NUM> or may be generated by a first encryption circuit <NUM> or a second encryption circuit <NUM>.

The storage controller <NUM> may control the NVM <NUM> to store the field data in the meta region <NUM>. The field data may indicate information stored in a first field and/or a second field included in a command received from the host <NUM>. For example, the storage controller <NUM> may store the ciphertext CT in the normal region <NUM> and store information related to the first field and/or the second field of the command and further related to the ciphertext CT in the NVM <NUM>. Accordingly, the storage controller <NUM> may read the data stored in the meta region <NUM> to determine whether the ciphertext CT is computation target data or whether the ciphertext CT is in an encrypted state when received from the host <NUM>.

Referring to <FIG> and <FIG>, a non-volatile memory (NVM) <NUM> may include a first normal region <NUM> and a second normal region <NUM>. The first normal region <NUM> may store a first ciphertext CT1, and the second normal region <NUM> may store a second ciphertext CT2. In some embodiments, the first normal region <NUM> and the second normal region <NUM> may be physically separate. The first ciphertext CT1 may indicate a ciphertext encrypted using a first encryption algorithm, and the second ciphertext CT2 may indicate a ciphertext encrypted using a second encryption algorithm. In some embodiments, the first encryption algorithm may be a homomorphic encryption algorithm, and the second encryption algorithm may be a symmetric key or an asymmetric key algorithm.

The storage controller <NUM> may control the NVM <NUM> to store the first ciphertext CT1 in the first normal region <NUM>. The first ciphertext CT1 may be generated by the first encryption circuit <NUM>.

The storage controller <NUM> may control the NM <NUM> to store the second ciphertext CT2 in the second normal region <NUM>. The second ciphertext CT2 may be generated by the second encryption circuit <NUM>.

The storage controller <NUM> may determine that the first ciphertext CT1 is encrypted by the first encryption algorithm by reading the first ciphertext CT1 from the first normal region <NUM> and may determine that the second ciphertext CT2 is encrypted by the second encryption algorithm by reading the second ciphertext CT2 from the second normal region <NUM>.

<FIG> is a flowchart illustrating an operating method for a storage device according to embodiments of the inventive concept.

Referring to <FIG>, <FIG> and <FIG> the storage controller <NUM> may read a ciphertext CT from the normal region <NUM> (S1410). That is, the storage controller <NUM> may obtain the ciphertext CT by reading data from a region corresponding to an address received from the host <NUM> among the normal region <NUM>.

The storage controller <NUM> may read field data from the meta region <NUM> (S1420). That is, the storage controller <NUM> may read field data corresponding to the read ciphertext. The field data may include information related to the first field and/or information related to the second field. For example, the information related to the first field may indicate whether the ciphertext CT is computation target data, and the information related to the second field may indicate whether the ciphertext CT is in an encrypted state when received from the host <NUM>.

The storage controller <NUM> may selectively decrypt the ciphertext CT based on the field data (S1430). That is, when the second field indicates that the ciphertext CT is in an encrypted state when received from the host <NUM>, the storage controller <NUM> may omit decryption of the ciphertext CT. The storage controller <NUM> may provide the ciphertext CT to the host <NUM>. When the second field indicates that the ciphertext CT is unencrypted when received from the host <NUM>, the storage controller <NUM> may decrypt the ciphertext CT based on the information on the first field. When the information on the first field indicates that the ciphertext CT is computation target data, the storage controller <NUM> may generate plain text by decrypting the ciphertext CT according to the first encryption algorithm. When the information on the first field indicates that the ciphertext CT is not the computation target data, the storage controller <NUM> may generate a plain text by decrypting the ciphertext CT according to the second encryption algorithm. The storage controller <NUM> may provide the generated plain text to the host <NUM>.

<FIG> is a block diagram of a data center <NUM> that may incorporate one or more storage device(s) according to embodiments of the inventive concept.

Referring to <FIG>, the data center <NUM> may be a facility that collects various types of pieces of data and provides services and be referred to as a data storage center. The data center <NUM> may be a system for operating a search engine and a database, and may be a computing system used by companies, such as banks, or government agencies. The data center <NUM> may include application servers <NUM> to 3100n and storage servers <NUM> to <NUM>. The number of application servers <NUM> to 3100n and the number of storage servers <NUM> to <NUM> may be variously selected according to embodiments. The number of application servers <NUM> to 3100n may be different from the number of storage servers <NUM> to <NUM>.

The application server <NUM> or the storage server <NUM> may include at least one of processors <NUM> and <NUM> and memories <NUM> and <NUM>. The storage server <NUM> will now be described as an example. The processor <NUM> may control all operations of the storage server <NUM>, access the memory <NUM>, and execute instructions and/or data loaded in the memory <NUM>. The memory <NUM> may be a double-data-rate synchronous DRAM (DDR SDRAM), a high-bandwidth memory (HBM), a hybrid memory cube (HMC), a dual in-line memory module (DIMM), Optane DIMM, and/or a non-volatile DIMM (NVMDIMM). In some embodiments, the numbers of processors <NUM> and memories <NUM> included in the storage server <NUM> may be variously selected. In an embodiment, the processor <NUM> and the memory <NUM> may provide a processor-memory pair. In an embodiment, the number of processors <NUM> may be different from the number of memories <NUM>. The processor <NUM> may include a single-core processor or a multi-core processor. The above description of the storage server <NUM> may be similarly applied to the application server <NUM>. In some embodiments, the application server <NUM> may not include a storage device <NUM>. The storage server <NUM> may include at least one storage device <NUM>. The number of storage devices <NUM> included in the storage server <NUM> may be variously selected according to embodiments.

The application servers <NUM> to 3100n may communicate with the storage servers <NUM> to <NUM> through a network <NUM>. The network <NUM> may be implemented using a fiber channel (FC) or Ethernet. In this case, the FC may be a medium used for relatively high-speed data transmission and use an optical switch with high performance and high availability. The storage servers <NUM> to <NUM> may be provided as file storages, block storages, or object storages according to an access method of the network <NUM>.

In an embodiment, the network <NUM> may be a storage-dedicated network, such as a storage area network (SAN). For example, the SAN may be a fiber channel (FC)-SAN implemented in accordance with one or more FC protocols (FCP). As another example, the SAN may be an Internet protocol (IP)-SAN, which uses a transmission control protocol (TCP)/IP network and is implemented according to a SCSI over TCP/IP or Internet SCSI (iSCSI) protocol. In another embodiment, the network <NUM> may be a general network, such as a TCP/IP network. For example, the network <NUM> may be implemented according to a protocol, such as FC over Ethernet (FCoE), network attached storage (NAS), and NVMe over Fabrics (NVMe-oF).

Hereinafter, the application server <NUM> and the storage server <NUM> will mainly be described. A description of the application server <NUM> may be applied to another application server 3100n, and a description of the storage server <NUM> may be applied to another storage server <NUM>.

The application server <NUM> may store data, which is requested by a user or a client to be stored, in one of the storage servers <NUM> to <NUM> through the network <NUM>. Also, the application server <NUM> may obtain data, which is requested by the user or the client to be read, from one of the storage servers <NUM> to <NUM> through the network <NUM>. For example, the application server <NUM> may be implemented as a web server or a database management system (DBMS).

The application server <NUM> may access a memory 3120n or a storage device 3150n, which is included in another application server 3100n, through the network <NUM>. Alternately, the application server <NUM> may access memories <NUM> to <NUM> or storage devices <NUM> to <NUM>, which are included in the storage servers <NUM> to <NUM>, through the network <NUM>. Each of the storage devices <NUM> to <NUM> may be implemented as storage device <NUM>, <NUM>, <NUM> or <NUM> of <FIG>, <FIG>, <FIG>, <FIG> and/or <NUM>. The application server <NUM> may perform various operations on data stored in application servers <NUM> to 3100n and/or the storage servers <NUM> to <NUM>. For example, the application server <NUM> may execute an instruction for moving or copying data between the application servers <NUM> to 3100n and/or the storage servers <NUM> to <NUM>. In this case, the data may be moved from the storage devices <NUM> to <NUM> of the storage servers <NUM> to <NUM> to the memories <NUM> to 3120n of the application servers <NUM> to 3100n directly or through the memories <NUM> to <NUM> of the storage servers <NUM> to <NUM>. The data moved through the network <NUM> may be data encrypted for security or privacy.

The storage server <NUM> will now be described as an example. An interface <NUM> may provide physical connection between a processor <NUM> and a controller <NUM> and a physical connection between a network interface card (NIC) <NUM> and the controller <NUM>. For example, the interface <NUM> may be implemented using a direct attached storage (DAS) scheme in which the storage device <NUM> is directly connected with a dedicated cable. For example, the interface <NUM> may be implemented using various interface schemes, such as ATA, SATA, e-SATA, an SCSI, SAS, PCI, PCle, NVMe, IEEE <NUM>, a USB interface, an SD card interface, an MMC interface, an eMMC interface, a UFS interface, an eUFS interface, and/or a CF card interface.

The storage server <NUM> may further include a switch <NUM> and the NIC(Network InterConnect) <NUM>. The switch <NUM> may selectively connect the processor <NUM> to the storage device <NUM> or selectively connect the NIC <NUM> to the storage device <NUM> via the control of the processor <NUM>.

In an embodiment, the NIC <NUM> may include a network interface card and a network adaptor. The NIC <NUM> may be connected to the network <NUM> by a wired interface, a wireless interface, a Bluetooth interface, or an optical interface. The NIC <NUM> may include an internal memory, a digital signal processor (DSP), and a host bus interface and be connected to the processor <NUM> and/or the switch <NUM> through the host bus interface. The host bus interface may be implemented as one of the above-described examples of the interface <NUM>. In an embodiment, the NIC <NUM> may be integrated with at least one of the processor <NUM>, the switch <NUM>, and the storage device <NUM>.

In the storage servers <NUM> to <NUM> or the application servers <NUM> to 3100n, a processor may communicate a command to storage devices <NUM> to 3150n and <NUM> to <NUM> or the memories <NUM> to 3120n and <NUM> to <NUM> and program or read data. In this case, the data may be data of which an error is corrected by an ECC engine. The data may be data on which a data bus inversion (DBI) operation or a data masking (DM) operation is performed and may include cyclic redundancy code (CRC) information. The data may be data encrypted for security or privacy.

Storage devices <NUM> to 3150n and <NUM> to <NUM> may communicate a control signal and a command/address signal to NAND flash memory devices <NUM> to <NUM> in response to a read command received from the processor. Thus, when data is read from the NAND flash memory devices <NUM> to <NUM>, a read enable (RE) signal may be input as a data output control signal, and thus, the data may be output to a DQ bus. A data strobe signal DQS may be generated using the RE signal. The command and the address signal may be latched in a page buffer depending on a rising edge or falling edge of a write enable (WE) signal.

The controller <NUM> may control all operations of the storage device <NUM>. In an embodiment, the controller <NUM> may include SRAM. The controller <NUM> may write data to the NAND flash memory device <NUM> in response to a write command or read data from the NAND flash memory device <NUM> in response to a read command. For example, the write command and/or the read command may be provided from the processor <NUM> of the storage server <NUM>, the processor <NUM> of another storage server <NUM>, or the processors <NUM> and 3110n of the application servers <NUM> and 3100n. DRAM <NUM> may temporarily store (or buffer) data to be written to the NAND flash memory device <NUM> or data read from the NAND flash memory device <NUM>. Also, the DRAM <NUM> may store metadata. Here, the metadata may be user data or data generated by the controller <NUM> to manage the NAND flash memory device <NUM>. The storage device <NUM> may include a secure element (SE) for security or privacy.

Claim 1:
An operating method for a storage device including a storage controller and a non-volatile memory, the operating method comprising:
receiving (s210) a command including data and a field related to the data from a host
determining an operation mode (s220) based on the command:
selectively encrypting the data (s230) based on the operation mode to generate selectively encrypted data; and
storing (s240) the selectively encrypted data in the non-volatile memory,
wherein the selectively encrypting of the data includes encrypting the data based on a first encryption algorithm that is a homomorphic encryption algorithm when the operation mode is a first operation mode, and encrypting the data based on a second encryption algorithm different from the first encryption algorithm when the operation mode is a second operation mode, and
wherein determining of the operation mode in response to the command includes
identifying a first field included in the command indicating whether computation on the data is performed by the storage controller, wherein the computation comprises an arithmetic operation, learning operation, or inference operation, and a second field included in the command indicating whether the data included in the command is encrypted data; and
determining the operation mode based on the first field and the second field.