Patent ID: 12231537

DETAILED DESCRIPTION

Embodiments provide a memory system that can improve storage efficiency while maintaining the confidentiality of data for each user.

In general, according to one embodiment, a memory system includes a first nonvolatile memory, and a controller operatively coupled to the first nonvolatile memory. The controller is configured to, in response to determining that second data received based on a first write request from a host is the same as first data and a first user uses the host, the first data being encrypted using a first data encryption key (DEK) as first encrypted data and stored in the first nonvolatile memory, encrypt the first DEK using a first key encryption key (KEK) associated with the first user to acquire a first encrypted DEK, and store the first encrypted DEK. The controller is configured to, in response to determining that the second data is the same as the first data and a second user different from the first user uses the host, encrypt the first DEK using a second KEK associated with the second user to acquire a second encrypted DEK, and store the second encrypted DEK. The controller is configured to, in response to determining that the second data is different from the first data and the first user uses the host, use the second data to generate a second DEK, encrypt the second data using the second DEK to acquire second encrypted data, write the second encrypted data into the first nonvolatile memory, encrypt the second DEK using the first KEK to acquire a third encrypted DEK, and store the third encrypted DEK. The controller is configured to, in response to determining that the second data is different from the first data and the second user uses the host, use the second data to generate the second DEK, encrypt the second data with the second DEK to acquire the second encrypted data, write the second encrypted data into the first nonvolatile memory, encrypt the second DEK using the second KEK to acquire a fourth encrypted DEK, and store the fourth encrypted DEK.

Hereinafter, embodiments will be described with reference to the drawings.

First Embodiment

First, a configuration of an information processing system1that includes a memory system according to a first embodiment will be described with reference toFIG.1. The information processing system1includes a host device2(hereinafter, referred to as a host2) and the memory system.

The memory system is a semiconductor storage device configured to write data into a nonvolatile memory such as a NAND flash memory5and read the data from the nonvolatile memory, and is also called a storage device. The nonvolatile memory includes a plurality of memory elements. Data can be written to each of the plurality of memory elements multiple times. The memory system is implemented as, for example, a solid state drive (SSD)3that includes the NAND flash memory5. Although a case where the memory system is implemented as the SSD3will be exemplified, the memory system may be implemented as a hard disk drive (HDD). Alternatively, the memory system may be implemented as a storage system (e.g., enterprise storage) that includes a plurality of storage devices.

The host2may be a storage server that stores a large amount of various data in the SSD3, or may be a personal computer. The host2may be used by a plurality of users (for example, a user A, a user B, and a user C). The number of hosts2may be plural, and each host may be used by one or more users.

The SSD3may be used as a storage for the host2. The SSD3may be built in the host2or may be connected to the host2via a cable or a network.

An interface for connecting the host2to the SSD3is based on Small Computer System Interface (SCSI), Serial Attached SCSI (SAS), AT Attachment (ATA), Serial ATA (SATA), PCI Express (PCIe) (registered trademark), Ethernet (registered trademark), Fibre channel, NVM Express (NVMe) (registered trademark), and the like.

The SSD3includes a controller4and the NAND flash memory5. The controller4may be implemented by a circuit such as a system-on-a-chip (SoC).

The SSD3includes a random access memory (RAM), which is a volatile memory, for example, a dynamic random access memory (DRAM)6. Alternatively, a static random access memory (SRAM) may be built in the controller4. The DRAM6may also be built in the controller4.

The DRAM6is provided with a storage area for firmware (FW)20loaded from, for example, the NAND flash memory5.

The NAND flash memory5includes a plurality of blocks. Each block includes a plurality of pages. One block functions as a unit of a data erase operation. The block may be referred to as an “erasing block” or a “physical block”. Each page includes a plurality of memory cells connected to the same word line. A single page is a unit of a data write operation and a data read operation. The word line may be used as the unit of the data write operation and the data read operation. The data write operation may also be referred to as a data program operation.

There is an upper limit for the number of program/erase cycles (maximum number of P/E cycles) that is allowable for each block. One P/E cycle of a certain block includes a data erase operation of bringing all memory cells in this block into an erased state, and a data write operation of writing data into each page of this block.

The controller4includes a host interface (host I/F)11, a CPU12, a NAND I/F13, a DRAM interface (DRAM I/F)14, and the like. The host I/F11, the CPU12, the NAND I/F13, and the DRAM I/F14are connected to each other via a bus10.

The controller4is electrically connected to the NAND flash memory5via the NAND I/F13corresponding to an interface standard such as Toggle DDR or Open NAND Flash Interface (ONFI). The NAND I/F13functions as a NAND control circuit configured to control the NAND flash memory5.

The NAND I/F13may be connected to a plurality of NAND flash memory chips in the NAND flash memory5via a plurality of channels, respectively. The plurality of NAND flash memory chips can be driven in parallel, and thus a bandwidth of access to the NAND flash memory5can be widened.

The controller4functions as a memory controller configured to control the NAND flash memory5.

The controller4may function as a flash translation layer (FTL) configured to perform data management and block management on the NAND flash memory5. The data management executed by the FTL includes (1) management of mapping information indicating a correspondence relationship between each logical address and each physical address of the NAND flash memory5, (2) a process for concealing a data read/write operation in the page unit and a data erase operation in the block unit, and the like. The logical address is an address used by the host2to designate an address of the SSD3.

The management of mapping between each logical address and each physical address is executed by using a logical-to-physical address conversion table21. The controller4manages the mapping in a specific management size unit by using the logical-to-physical address conversion table21. A physical address corresponding to a certain logical address indicates a physical storage location in the NAND flash memory5in which data of this logical address is written. The logical-to-physical address conversion table21may be loaded from the NAND flash memory5into the DRAM6when the power of the SSD3is turned on.

Writing of data into one page is possible only once per P/E cycle. Thus, the controller4writes update data corresponding to a certain logical address into another physical storage location instead of a physical storage location in which the previous data corresponding to the logical address is stored. The controller4invalidates the previous data by updating the logical-to-physical address conversion table21to associate the logical address with the new physical storage location. Hereinafter, data referred to from the logical-to-physical address conversion table21(that is, data linked to the logical address) will be referred to as valid data. In addition, data that is not linked to any logical address will be referred to as invalid data. The valid data is data that may be read from the host2in the future. The invalid data is data that is no longer read from the host2.

The above-mentioned physical address and logical address are concepts for controlling the NAND flash memory5or a hard disk. The physical address generally specifies a storage area in units of 512 bytes to 4096 bytes. The logical address is defined by various international standards. The physical address and the logical address are physical/logical addresses of the NAND technology, and are referred to as lower layer physical/logical addresses here. The controller4uses the lower layer physical/logical addresses in a layer close to controlling of the NAND flash memory5, for example.

The controller4may further manage a physical address and a logical address for specifying a larger storage area in a layer close to the host2. Hereinafter this physical address and this logical address are referred to as upper layer physical/logical addresses. The physical address and the logical address specify, for example, storage areas in the unit of several kilobytes (KB) to megabytes (MB). In the present embodiment, for example, the upper layer physical/logical addresses are used in deduplication and encryption of data, which will be described later.

That is, the controller4may be configured to use the lower layer physical/logical addresses in a layer close to the NAND flash memory5and use the upper layer physical/logical addresses in a layer closer to the host2than the NAND flash memory5.

The block management includes defective block management, wear leveling, garbage collection (compaction), and the like.

The host I/F11is an interface circuit that performs communication between the SSD3and the host2which is an external device of the SSD3. The host I/F11functions as a circuit for receiving various commands, for example, I/O commands and various control commands from the host2. The I/O commands may include a write command and a read command. The control commands may include an unmap command (trim command) and a format command. The format command is a command for unmapping the entire logical addresses of the SSD3. The host I/F11also functions as a transmission circuit that transmits to the host2a response or data in accordance with a command.

The DRAM I/F14functions as a DRAM control circuit configured to control access to the DRAM6. A storage area of the DRAM6is allocated to, for example, an area for storing the FW20, a buffer area used as a read/write buffer, and a cache area for information such as the logical-to-physical address conversion table21, a physical address versus hash value table22, and an encrypted data encryption key (DEK) table23.

The physical address versus hash value table22and the encrypted DEK table23may be loaded from the NAND flash memory5into the DRAM6when the power of the SSD3is turned on. The physical address versus hash value table22and the encrypted DEK table23may be stored in the NAND flash memory5when the power of the SSD3is turned off. The physical address versus hash value table22represents a correspondence between a hash value of user data and a physical address indicating a physical storage location of the user data that is encrypted and stored in the NAND flash memory5. The encrypted DEK table23is a table for encrypting and storing a data encryption key for encrypting user data. Details of the physical address versus hash value table22and the encrypted DEK table23will be described later with reference toFIGS.4and5, respectively.

The controller4has functions for deduplication and encryption of data.

FIG.2illustrates an example of deduplication of data in the SSD3. The deduplication is a control method for preventing duplicated writing of data having the same data pattern into the NAND flash memory5. The controller4analyzes user data to be written into the NAND flash memory5and automatically excludes detected-duplicated data. That is, when user data to be written is duplicated data, the controller4skips writing of the user data into the NAND flash memory5.

For example, in a periodic backup process, writing of user data which is the same as user data previously written in the NAND flash memory5may be frequently performed. If deduplication is used in such a case, an amount of data transfer between the controller4and the NAND flash memory5and a data storage capacity of the NAND flash memory5can be significantly saved. Reducing the number of times of writing data can extend the lifetime of a memory device such as the NAND flash memory5, which has an upper limit of the number of P/E cycles.

FIG.2illustrates an example of data deduplication in a data arrangement51based on a physical address and a data arrangement52based on a logical address. The data arrangement51based on the physical address indicates physical storage locations of data (data patterns) on the NAND flash memory5. The data arrangement52based on the logical address indicates logical storage locations of the data recognized by the host2.

Specifically, in the data arrangement51based on the physical address, a data pattern A is stored in physical address “1”. A data pattern B is stored in physical address “2”. A data pattern C is stored in physical address “3”. Physical address “4” is in an unused state.

In the data arrangement52based on the logical address, the data pattern A is stored in logical address “1”. The data pattern B is stored in logical address “2”. The data pattern C is stored in logical address “3”. The data pattern B is stored in logical address “4”.

Therefore, the data pattern B is physically stored in only one place (that is, in physical address “2”), but is recognized as being stored in two places (that is, in logical addresses “2” and “4”) by the host2.

The controller4may manage this kind of relationship between the logical address and the physical address by using the logical-to-physical address conversion table21.

FIG.3illustrates a configuration example of the logical-to-physical address conversion table21. The logical-to-physical address conversion table21indicates mapping between the logical address and the physical address of the NAND flash memory5. The logical-to-physical address conversion table21is, for example, a look-up table (LUT).

The mapping between the logical address and the physical address indicated in the logical-to-physical address conversion table21corresponds to a set of data such as a block. That is, the controller4may manage the mapping between the logical address and the physical address in the block unit by using the logical-to-physical address conversion table21. A size of the block is, for example, several KB to several MB.

The logical-to-physical address conversion table21illustrated inFIG.3corresponds to the data arrangement51based on the physical address and the data arrangement52based on the logical address illustrated inFIG.2. More specifically, the logical-to-physical address conversion table21indicates (1) mapping between logical address “1” and physical address “1”, (2) mapping between logical address “2” and physical address “2”, (3) mapping between logical address “3” and physical address “3”, and (4) mapping between logical address “4” and physical address “2”.

Consequently, since the plurality of logical addresses “2” and “4” are associated with the single physical address “2” (that is, corresponding to the data pattern B), it is not necessary to physically store the data pattern B in two physical locations. That is, it is possible to avoid storing the same data pattern in the NAND flash memory5in duplicate.

Refer toFIG.1again. The CPU12is a processor configured to control the host I/F11, the NAND I/F13, and the DRAM I/F14. The CPU12performs various processes by executing the FW20loaded in the DRAM6. That is, the FW20is a control program for controlling an operation of the CPU12. In addition to the above-described FTL processing, the CPU12may execute command processing and the like for processing various commands from the host2. Part or the whole of the FTL processing and the command processing may be executed by dedicated hardware in the controller4.

In order to perform deduplication and encryption of data, the CPU12may function as, for example, a write control unit121, a read control unit122, a duplicate control unit123, a DEK generation unit124, a key encryption key (KEK) generation unit125, a DEK encryption/decryption unit126, and a data encryption/decryption unit127. The CPU12functions as each of these units by executing, for example, the FW20. Some functions of each of the units may be implemented by dedicated hardware (circuit). Alternatively, some of the functions of each unit may be implemented by dedicated hardware, and other functions may be implemented by the CPU12that executes the FW20.

The write control unit121receives a write command from the host2via the host I/F11. The write control unit121may control the duplicate control unit123, the DEK generation unit124, the KEK generation unit125, the DEK encryption/decryption unit126, and the data encryption/decryption unit127to perform a write operation in accordance with the write command.

The read control unit122receives a read command from the host2via the host I/F11. The read control unit122may control the KEK generation unit125, the DEK encryption/decryption unit126, and the data encryption/decryption unit127to perform a read operation in accordance with the read command.

The read control unit122reads encrypted data in accordance with the read command from the NAND flash memory5. The read control unit122acquires an encrypted DEK corresponding to the encrypted data from the encrypted DEK table23.

The DEK generation unit124generates a DEK for encrypting user data by using the user data received along with the write command. For the DEK, a value originated from the user data (in other words, a value corresponding to the user data) is used, and a value such as a random number not originated from the user data is not used. For example, a hash value derived from user data or a hash-based message authentication code (HMAC) value may be used for the DEK. The DEK generation unit124applies, for example, a first hash function to the user data to generate a hash value.

The duplicate control unit123determines whether the user data received along with the write command is the same as plaintext data (hereinafter, also referred to as stored data) corresponding to encrypted data stored in the NAND flash memory5. That is, the duplicate control unit123determines whether the received user data is duplicated data. Note that certain plaintext data corresponds to certain encrypted data when the certain encrypted data can be obtained by encrypting the certain plaintext data with a DEK.

More specifically, the duplicate control unit123calculates the hash value of the received user data. The duplicate control unit123determines whether the calculated hash value matches a hash value of plaintext data corresponding to encrypted data stored in the NAND flash memory5. When the two hash values match each other, the duplicate control unit123determines that the received user data is duplicated data. On the other hand, when the two hash values do not match each other, the duplicate control unit123determines that the received user data is not duplicated data. The hash value of the plaintext data corresponding to the encrypted data stored in the NAND flash memory5is managed, for example, in the physical address versus hash value table22.

FIG.4illustrates a configuration example of the physical address versus hash value table22used by the duplicate control unit123. The physical address versus hash value table22may include a plurality of entries corresponding to a plurality of physical addresses. Each entry includes a physical address field and a hash value field.

In an entry corresponding to a certain physical address, a physical address field indicates the physical address. A hash value field indicates a hash value of plaintext data (user data) corresponding to encrypted data stored in the physical address.

The physical address versus hash value table22illustrated inFIG.4corresponds to the data arrangement51based on the physical address and the data arrangement52based on the logical address illustrated inFIG.2.

In the example illustrated inFIG.4, a hash value of user data corresponding to encrypted data stored the physical address “1” is “0980340”. A hash value of user data corresponding to encrypted data stored in physical address “2” is “3412355”. A hash value of user data corresponding to encrypted data stored in physical address “3” is “5154131”.

In the entry corresponding to physical address “4”, no value is set in the hash value field. This is because valid data is not stored in the physical address “4”.

The data encryption/decryption unit127encrypts and decrypts data. The data encryption/decryption unit127encrypts data, which is to be written into the NAND flash memory via, for example, the NAND I/F13. The data encryption/decryption unit127decrypts data (that is, encrypted data), which is read from the NAND flash memory5via the NAND I/F13.

More specifically, when user data received along with a write command is not duplicated data, the data encryption/decryption unit127encrypts the user data with a DEK and thus acquires encrypted data. The encrypted data is written into the NAND flash memory5via the NAND I/F13.

Note that the duplicate control unit123may calculate a hash value of the encrypted data (i.e., instead of plaintext user data) to determine whether the received user data is duplicated data. In this case, when the calculated hash value is included in any entry in the physical address versus hash value table22, the duplicate control unit123determines that the received user data is duplicated data. When the calculated hash value is not included in any entry in the physical address versus hash value table22, the duplicate control unit123determines that the received user data is not duplicated data.

When a hash value of user data, which is plaintext data, is used, the original user data might be specified from the hash value if the strength of the hash value is weak. However, when a hash value of encrypted data is used, it is difficult to specify original user data from the hash value. Therefore, the security can be further increased by using a hash value of encrypted data for determining whether data is duplicated.

The data encryption/decryption unit127decrypts encrypted data read from the NAND flash memory5with a DEK and thus acquires plaintext data. When the encrypted data is data read according to a read command, the acquired plaintext data is transmitted to the host2.

The KEK generation unit125generates a KEK associated with a user who is using the host2. The KEK is a key used to encrypt a DEK. The KEK generation unit125generates a KEK by using, for example, a password entered by the user using the host2. The KEK generation unit125generates, for example, a hash value of the password as a KEK.

The DEK encryption/decryption unit126encrypts a DEK with a KEK and thus acquires an encrypted DEK. The encrypted DEK is stored into the encrypted DEK table23in association with a logical address specified by a write command.

The DEK encryption/decryption unit126decrypts the encrypted DEK acquired from the encrypted DEK table23with the KEK, and thus acquires the DEK. The DEK is used for decrypting encrypted data by the data encryption/decryption unit127.

FIG.5illustrates a configuration example of the encrypted DEK table23. The encrypted DEK table23includes one or more entries corresponding to one or more logical addresses. Each entry includes a logical address field and an encrypted DEK field.

In an entry corresponding to a certain logical address (hereinafter, referred to as a first logical address), a logical address field indicates the first logical address.

The encrypted DEK field indicates an encrypted DEK corresponding to the first logical address. When user data of the first logical address is required to be stored, the controller4encrypts the user data with a DEK and writes the encrypted user data into the NAND flash memory5. The encrypted DEK is obtained by encrypting the DEK used to encrypt the user data with a KEK of a corresponding user.

Hereinafter, an operation upon receipt of a write command for requesting writing of second data from the host2when first encrypted data is stored in the NAND flash memory5will be described in detail as an example. Here, it is assumed that the first encrypted data is obtained by encrypting first data with a first DEK, which is an encryption key generated by using the first data.

The write control unit121receives a write command requesting writing of the second data from the host2. The second data is received along with the write command. The second data is user data to be written into the NAND flash memory5.

The duplicate control unit123determines whether the second data is the same as the first data. When the second data is the same as the first data, the DEK generation unit124generates the first DEK by using the second data. The KEK generation unit125generates different KEKs for different users. For example, when a first user (for example, the user A) is using the host2, the KEK generation unit125generates a first KEK associated with the first user. The KEK generation unit125generates the first KEK by using, for example, a first password entered by the first user using the host2. The DEK encryption/decryption unit126encrypts the first DEK with the first KEK and thus acquires a first encrypted DEK. The first encrypted DEK is stored into, for example, the encrypted DEK table23. When a second user (for example, the user B) is using the host2, the KEK generation unit125generates a second KEK associated with the second user. The KEK generation unit125generates the second KEK by using, for example, a second password entered by the second user using the host2. The DEK encryption/decryption unit126encrypts the first DEK with the second KEK and thus acquires a second encrypted DEK. The second encrypted DEK is stored into, for example, the encrypted DEK table23.

On the other hand, when the second data is different from the first data, the DEK generation unit124generates a second DEK by using the second data. The second DEK is different from the first DEK used to encrypt the first data. The data encryption/decryption unit127encrypts the second data with the second DEK and thus acquires second encrypted data. The write control unit121writes the second encrypted data into the NAND flash memory5. When the first user is using the host2, the KEK generation unit125generates the first KEK associated with the first user. The DEK encryption/decryption unit126encrypts the second DEK with the first KEK and thus acquires a third encrypted DEK. The third encrypted DEK is stored into, for example, the encrypted DEK table23. When the second user is using the host2, the KEK generation unit125generates the second KEK associated with the second user. The DEK encryption/decryption unit126encrypts the second DEK with the second KEK and thus acquires a fourth encrypted DEK. The fourth encrypted DEK is stored in, for example, the encrypted DEK table23.

The read control unit122receives a read command for requesting reading of the second data.

When the second data is the same as the first data, the read control unit122reads the first encrypted data from the NAND flash memory5. When the first user is using the host2, the DEK encryption/decryption unit126decrypts the first encrypted DEK, corresponding to the first encrypted data, stored in the encrypted DEK table23with the first KEK and thus acquires the first DEK. When the second user is using the host2, the DEK encryption/decryption unit126decrypts the second encrypted DEK, corresponding to the first encrypted data, stored in the encrypted DEK table23with the second KEK and thus acquires the first DEK. The data encryption/decryption unit127decrypts the read first encrypted data with the first DEK. The first data (=second data) obtained through the decryption is transmitted to the host2.

On the other hand, when the second data is different from the first data, the read control unit122reads the second encrypted data from the NAND flash memory5. When the first user is using the host2, the DEK encryption/decryption unit126decrypts the third encrypted DEK, corresponding to the second encrypted data, stored in the encrypted DEK table23with the first KEK and thus acquires the second DEK. When the second user is using the host2, the DEK encryption/decryption unit126decrypts the fourth encrypted DEK, corresponding to the second encrypted data, stored in the encrypted DEK table23with the second KEK and thus acquires the second DEK. The data encryption/decryption unit127decrypts the read second encrypted data with the second DEK. The second data obtained through the decryption is transmitted to the host2.

Here, it is assumed that before receiving the above-described write command for requesting writing of the second data, the write control unit121receives a write command for requesting writing of the first data from the host2used by the second user. The first data is received along with the write command. The first data is user data to be written into the NAND flash memory5.

Then, the DEK generation unit124generates the first DEK by using the first data. The data encryption/decryption unit127encrypts the first data with the first DEK and thus acquires the first encrypted data. The write control unit121writes the first encrypted data into the NAND flash memory5. The KEK generation unit125generates the second KEK associated with the second user using the host2. The KEK generation unit125generates the second KEK by using, for example, the second password entered by the second user using the host2. The DEK encryption/decryption unit126encrypts the first DEK with the second KEK and thus acquires the second encrypted DEK. The second encrypted DEK is stored into, for example, the encrypted DEK table23.

The read control unit122receives a read command requesting read of the first data from the host2. It is assumed that the second user is requesting reading of the first data by using the read command.

The read control unit122reads the first encrypted data from the NAND flash memory5according to the read command. The DEK encryption/decryption unit126decrypts the second encrypted DEK stored in the encrypted DEK table23with the second KEK and thus acquires the first DEK. The data encryption/decryption unit127decrypts the read first encrypted data with the first DEK. The first data obtained through the decryption is transmitted to the host2. Therefore, when the first data and the second data are the same as each other, both the first user and the second user may acquire the first data obtained by decrypting the first encrypted data from the SSD3.

With the above configuration, the SSD3of the present embodiment can improve the storage efficiency while maintaining the confidentiality of data for each user. When the stored first data is the same as the second data received along with a new write request, the DEK generation unit124may generate the first DEK used to encrypt the first data, by using the second data. In this case, the second data encrypted with the first DEK is the same as the first data encrypted with the first DEK (that is, the first encrypted data). Therefore, it is not necessary to write the second data encrypted with the first DEK into the NAND flash memory5, and deduplication can be achieved.

The DEK encryption/decryption unit126encrypts the first DEK with the first KEK and stores the first encrypted KEK. Consequently, it can be said that the first data (=second data) obtained by decrypting the first encrypted data in the NAND flash memory5is kept confidential by the first user associated with the first KEK for decrypting the first encrypted DEK. Therefore, even though the NAND flash memory5is physically taken out, the stored first encrypted data cannot be decrypted, and thus it is possible to prevent corresponding plaintext data from being leaked.

The above-described data deduplication and encryption functions are not limited to be executed by the controller4of the SSD3, and may be installed in a file system driver or an operating system (OS) executed by various computing devices, or may be installed in a storage system that includes a plurality of SSDs and HDDs, which is owned by a company or implemented in a data center.

Some of the operations for deduplication and encryption of data performed by the controller4may be performed by the host2. That is, the host2and the controller4may cooperate to achieve deduplication and encryption of data.

Next, three comparative examples will be described with reference toFIGS.6to9. These comparative examples are executed by a storage device having a security function when accessed by a plurality of users. Specifically, a storage device according to a first comparative example is a non-encryption storage device having an access control function. A storage device according to a second comparative example is an encryption storage device that uses a DEK for each user. A storage device according to a third comparative example is an encryption storage device that uses a KEK for each user. Hereinafter, a description will be made of a case where deduplication is achieved by the storage device of each comparative example.

<Non-Encryption Storage Device Having Access Control Function>

FIG.6is a block diagram illustrating examples of a write operation and a read operation in a storage device7A (hereinafter, referred to as a first storage device7A) according to the first comparative example. The first storage device7A controls access to data by setting permission or denial for access of each user to data in a specific unit (for example, the block unit or the file unit).

The first storage device7A includes a host I/F11A, a NAND flash memory5A, a write control unit131, a duplicate control unit132, a read control unit133, an access control unit134, an access authority table135, and the like. The access authority table135indicates whether each user has an authority to access data in each specific unit stored in the NAND flash memory5A.

The write control unit131receives a write command from the host2via the host I/F11A. When the write control unit131receives the write command, the duplicate control unit132determines whether user data received along with the write command is duplicated data of plaintext data corresponding to encrypted data stored (stored data) in the NAND flash memory5A.

When the duplicate control unit132determines that the user data is not duplicated data of the stored data, the write control unit131performs a write operation for writing the user data into the NAND flash memory5A. That is, the write control unit131transfers the user data to the NAND flash memory5A and sends a write instruction (more specifically, a program instruction) thereto. The duplicate control unit132updates the access authority table135so as to give a user who has requested writing of the user data by using the write command an authority to access the written user data.

On the other hand, when the duplicate control unit132determines that the user data is duplicated data of the stored data, the write control unit131skips the write operation for writing the user data into the NAND flash memory5A. The duplicate control unit132updates the access authority table135so as to give the user the authority to access the stored data.

The read control unit133receives a read command from the host2via the host I/F11A. When the read control unit133receives the read command, the access control unit134refers to the access authority table135, and determines whether a user who has requested reading of the data by using the read command is given an authority to access the data.

When the access control unit134determines that the user is given the authority to access the data, the read control unit133performs a read operation of reading the data from the NAND flash memory5A in accordance with the read command. More specifically, the read control unit133sends a read instruction to the NAND flash memory5A. The read control unit133transmits the read data to the host2.

On the other hand, when the access control unit134determines that the user is not given the authority to access the data, the read control unit133does not perform the read operation of reading the data from the NAND flash memory5A in accordance with the read command. Consequently, it is possible to prevent illegal access from an unauthorized user.

As described above, in the first storage device7A, it is possible to perform access control so that only an authorized user can access data while achieving deduplication.

However, plaintext data is stored in the NAND flash memory5A of the first storage device7A. Therefore, the first storage device7A has a vulnerability that data can be easily stolen by physically taking out the NAND flash memory5A (memory unit).

<Encryption Storage Device Using DEK for Each User>

FIG.7is a block diagram illustrating examples of a write operation and a read operation in a storage device7B (hereinafter, referred to as a second storage device7B) according to the second comparative example. The second storage device7B stores user data encrypted with a DEK unique to each user.

The second storage device7B includes a host I/F11B, a NAND flash memory5B, a write control unit141, a read control unit142, a duplicate control unit143, a DEK generation unit144, a data encryption/decryption unit145, and the like.

The DEK generation unit144generates a DEK associated with a user by using a password entered by the user using the host2. The DEK generation unit144generates, for example, a hash value of the user's password as the DEK.

The write control unit141receives a write command from the host2via the host I/F11B. When the write control unit141receives the write command, the duplicate control unit143determines whether user data received along with the write command is duplicated data of plaintext data corresponding to encrypted data stored (stored data) in the NAND flash memory5B.

When the duplicate control unit143determines that the user data is not duplicated data of the stored data, the data encryption/decryption unit145encrypts the user data with the DEK. This DEK is a DEK associated with the user who has requested writing of the user data by using the write command.

The data encryption/decryption unit145transfers the encrypted user data to the NAND flash memory5B, and the write control unit141sends a write instruction for writing the encrypted user data to the NAND flash memory5B. Consequently, user data encrypted with a DEK unique to each user can be stored into the NAND flash memory5B.

On the other hand, when the duplicate control unit143determines that the user data is duplicated data of the stored data, the data encryption/decryption unit145does not encrypt the user data. The write control unit141skips the write operation for writing the encrypted user data into the NAND flash memory5B.

The read control unit142receives a read command from the host2via the host I/F11B. The read control unit142performs a read operation for reading data in accordance with the read command. More specifically, the read control unit142sends a read instruction to the NAND flash memory5B.

The data encryption/decryption unit145performs a process for decrypting encrypted data that is read through the read operation with the DEK. The encrypted data is encrypted with a DEK unique to each user. Therefore, when the DEK associated with the user who has requested reading of the data by using the read command matches the DEK used to encrypt the encrypted data, the data encryption/decryption unit145succeeds in decrypting the encrypted data. On the other hand, when the DEK associated with the user does not match the DEK used to encrypt the encrypted data, the data encryption/decryption unit145fails to decrypt the encrypted data.

As described above, the second storage device7B can prevent the same data from being written into the NAND flash memory5in duplicate. However, in the second storage device7B, since the data is encrypted by a DEK for each user, the encrypted data cannot be shared by a plurality of users. That is, certain encrypted data can be decrypted with only a DEK of one user used for encryption thereof.

Thus, when a write operation for writing user data is skipped because the user data received with a new write command is duplicated data of stored data, a new user who has requested writing by using the new write command cannot acquire the user data from the second storage device7B. This is because encrypted data corresponding to stored data cannot be decrypted with a DEK associated with the new user.

As described above, since encrypted data cannot be shared by a plurality of users, deduplication cannot be achieved in the second storage device7B.

<Encryption Storage Device Using KEK for Each User>

FIG.8is a block diagram illustrating an example of a write operation in a storage device7C (hereinafter, referred to as a third storage device7C) according to the third comparative example when there is no duplicated data stored. The third storage device7C encrypts a DEK for encrypting user data, with a KEK unique to each user, and stores the DEK.

The third storage device7C includes a host I/F11C, a NAND flash memory5C, a write control unit151, a duplicate control unit152, a DEK generation unit153, a KEK generation unit154, a DEK encryption/decryption unit155, and a data encryption/decryption unit156, a logical-to-physical address conversion table21C, a physical address versus hash value table22C, an encrypted DEK table23C, and the like.

The KEK generation unit154uses a password entered by a user using the host2to generate a KEK associated with the user. The KEK generation unit154generates, for example, a hash value of the user's password as the KEK. The KEK generation unit154sends the generated KEK to the DEK encryption/decryption unit155.

The write control unit151receives a write command from the host2via the host I/F11C.

When the write control unit151receives the write command, the DEK generation unit153generates a DEK unique to each piece of user data in a specific unit. The specific unit is, for example, an area, a block, or a file. The DEK generation unit153generates, for example, a random number as the DEK. The DEK generation unit153sends the generated DEK to the data encryption/decryption unit156and the DEK encryption/decryption unit155.

When the write control unit151receives the write command, the duplicate control unit152determines whether user data received along with the write command is duplicated data of plaintext data corresponding to encrypted data stored (stored data) in the NAND flash memory5C.

When the duplicate control unit152determines that the user data is not duplicated data of the stored data, the data encryption/decryption unit156encrypts the user data with the DEK. The data encryption/decryption unit156transfers the encrypted user data to the NAND flash memory5C, and the write control unit151sends a write instruction for writing the encrypted user data to the NAND flash memory5C. Consequently, user data encrypted with a DEK unique to each piece of user data in the specific unit can be stored into the NAND flash memory5C.

The DEK encryption/decryption unit155encrypts the DEK with the KEK and thus acquires an encrypted DEK. This KEK is a KEK associated with a user who has requested writing of the user data by using the write command. The DEK encryption/decryption unit155sends the encrypted DEK to the write control unit151. The write control unit151stores the encrypted DEK into the encrypted DEK table23C. In the encrypted DEK table23C, for example, an encrypted DEK associated with a logical address specified by a write command is stored.

As illustrated inFIG.8, when there is no stored duplicated data of the user data to be written, the third storage device7C encrypts the user data with the random number DEK, writes the user data into the NAND flash memory5C, and encrypts the DEK with the KEK for each user and stores the encrypted DEK.

FIG.9is a block diagram illustrating an example in which a write operation cannot be implemented when there is duplicate data stored in the third storage device7C.

When the duplicate control unit152determines that user data is duplicated data of stored data, the data encryption/decryption unit156does not encrypt the user data. The write control unit151skips a write operation for writing the encrypted user data into the NAND flash memory5C.

In this case, the write control unit151and the DEK encryption/decryption unit155are required to encrypt the DEK used to encrypt the encrypted data corresponding to the stored data with the KEK of a new user who has requested writing of the user data by using the write command and store the encrypted DEK into the encrypted DEK table23C. However, the DEK that is a random number is encrypted with another user's KEK and is stored in the encrypted DEK table23C. The DEK encryption/decryption unit155cannot decrypt the encrypted DEK that is encrypted with another user's KEK, with the current user's KEK. Thus, the write control unit151cannot store the DEK encrypted with the current user's KEK into the encrypted DEK table23C. Then, when the current user requests reading of the user data by using a read command, since a corresponding encrypted DEK is not stored in the encrypted DEK table23C, the user data cannot be acquired from the third storage device7C.

As mentioned above, since a DEK used to encrypt certain user data (that is, a data pattern) cannot be shared by a plurality of users, deduplication cannot be achieved in the third storage device7C.

In contrast to the storage devices7A,7B, and7C of the first to third comparative examples, the controller4of the SSD3of the present embodiment generates a DEK based on user data, encrypts the DEK with a KEK unique to each user, and stores the encrypted DEK. Since the DEK is not a random number and is derived from user data, a plurality of users who try to write user data with the same pattern can share the DEK corresponding to the user data. The user data is encrypted with the shared DEK, and thus a plurality of users can share the encrypted data.

Since the controller4encrypts the DEK with a KEK for each user and stores the encrypted DEK, for example, when a password for generating the KEK is correctly entered, the encrypted DEK can be decrypted, but, when the password is not entered correctly, the encrypted DEK cannot be decrypted. Therefore, since the encrypted DEK cannot be decrypted in illegal access, even though encrypted data in the NAND flash memory5is read, it is possible to prevent the encrypted data from being decrypted and plaintext data from being leaked.

As described above, the SSD3of the present embodiment can improve storage efficiency while maintaining the confidentiality of data for each user.

FIG.10is a block diagram illustrating an example of a write operation in the SSD3. The KEK generation unit125generates a KEK associated with a user by using a password entered by the user using the host2. The KEK generation unit125generates, for example, a hash value of the user's password as the KEK. The KEK generation unit125sends the generated KEK to the DEK encryption/decryption unit126.

The write control unit121receives a write command from the host2via the host I/F11.

When the write control unit121receives the write command, the DEK generation unit124uses user data received along with the write command to generate a DEK. The DEK generation unit124uses, for example, a first hash value calculated by applying a first hash function to the user data, as the DEK. The user data is data in a specific unit, such as an area, a block, or a file. The DEK generation unit124sends the generated DEK to the data encryption/decryption unit127and the DEK encryption/decryption unit126.

When the write control unit121receives the write command, the duplicate control unit123determines whether the user data received along with the write command is the same as plaintext data (stored data) corresponding to encrypted data stored in the NAND flash memory5.

Specifically, the duplicate control unit123calculates a second hash value, for example, by applying a second hash function to the user data. The second hash function is different from, for example, the first hash function described above. The duplicate control unit123determines whether there is an entry including the calculated second hash value in the physical address versus hash value table22. When there is an entry including the second hash value in the physical address versus hash value table22, the duplicate control unit123determines that the user data is the same as the stored data. On the other hand, when there is no entry including the second hash value in the physical address versus hash value table22, the duplicate control unit123determines that the user data is different from the stored data.

<Case where User Data is Different from Stored Data>

When the duplicate control unit123determines that the user data is different from the stored data, the data encryption/decryption unit127encrypts the user data with the DEK. This DEK is different from a DEK used to encrypt the stored data. The data encryption/decryption unit127transfers the encrypted user data to the NAND flash memory5, and the write control unit121sends a write instruction for writing the encrypted user data to the NAND flash memory5. Consequently, the user data encrypted with the DEK derived from the user data can be written into the NAND flash memory5.

The write control unit121updates the logical-to-physical address conversion table21and the physical address versus hash value table22according to writing of the user data. Specifically, the write control unit121updates the logical-to-physical address conversion table21to indicate mapping between a logical address specified by the write command and a physical address in which the user data is written. The write control unit121updates the physical address versus hash value table22to indicate a correspondence between the physical address in which the user data is written and the second hash value of the user data.

The DEK encryption/decryption unit126encrypts the DEK with the KEK and thus acquires an encrypted DEK. This KEK is a KEK associated with a user who has requested writing of the user data by using the write command. The DEK encryption/decryption unit126sends the encrypted DEK to the write control unit121.

The write control unit121stores the encrypted DEK into the encrypted DEK table23. In the encrypted DEK table23, for example, an encrypted DEK associated with a logical address specified by a write command is stored.

When the user data is different from the stored data as mentioned above, the controller4encrypts the user data with the DEK generated by using the user data and writes the user data into the NAND flash memory5. The controller4encrypts the DEK with the KEK associated with the user who has requested writing of the user data by using the write command, and stores the encrypted DEK into the encrypted DEK table23.

<Case where User Data is the Same as Stored Data>

When the duplicate control unit123determines that the user data is the same as the stored data, the data encryption/decryption unit127does not encrypt the user data. The write control unit121skips a write operation for writing the encrypted user data into the NAND flash memory5. That is, the write control unit121does not send a write instruction to the NAND flash memory5.

The write control unit121updates the logical-to-physical address conversion table21to indicate mapping between a logical address specified by the write command and a physical address in which the encrypted data obtained by encrypting the stored data is stored. Since no new physical writing has occurred, the write control unit121does not update the physical address versus hash value table22.

The DEK encryption/decryption unit126encrypts a DEK with the KEK and thus acquires the encrypted DEK. The DEK is the same as a DEK used to encrypt the stored data. The KEK is a KEK associated with the user who has requested writing of the user data by using the write command. The DEK encryption/decryption unit126sends the encrypted DEK to the write control unit121.

The write control unit121stores the encrypted DEK into the encrypted DEK table23. In the encrypted DEK table23, for example, an encrypted DEK associated with a logical address specified by a write command is stored.

As described above, when the user data is the same as the stored data, the controller4does not encrypt the user data and does not write the user data into the NAND flash memory5. However, the controller4encrypts the DEK generated by using the user data with the KEK associated with the user who has requested writing of the user data by using the write command, and stores the encrypted DEK into the encrypted DEK table23.

Therefore, when the user data is the same as the stored data, the controller4does not perform an operation for writing the user data into the NAND flash memory5, and can thus achieve deduplication. The controller4generates the DEK used to encrypt the stored data by using the user data, encrypts the DEK with the KEK associated with the user, and stores the encrypted DEK. Therefore, it can be said that the stored data that is the same as the user data is kept confidential by the user associated with the KEK.

As described above, a write operation differs according to whether the user data is the same as the stored data. For example, when the user data is the same as the stored data, an operation of encrypting the user data and writing the user data into the NAND flash memory5is not performed. In this case, a processing time in accordance with a write command is shorter and thus power consumption is lower than when the user data is different from the stored data.

Thus, when a certain user requests writing of certain user data by using a write command and a write operation is performed in accordance with the request, there is a possibility that the user data can be estimated to be duplicated data of stored data based on the processing time and power consumption, which might result in a security problem.

To address such a problem, even when user data is the same as stored data, the write control unit121and the data encryption/decryption unit127may perform a dummy encryption process or a write operation so that such an estimation cannot be made. Specifically, the data encryption/decryption unit127may encrypt dummy data with a DEK and thus acquires dummy encrypted data. Then the write control unit121may write the dummy encrypted data into the NAND flash memory5.

Consequently, it is possible to reduce a difference in a processing time or power consumption that occurs between when user data is different from stored data and when the user data is the same as the stored data. Therefore, it cannot be estimated whether user data requested to be written is the same as stored data.

FIG.11is a block diagram illustrating an example of a read operation in the SSD3. The KEK generation unit125uses a password entered by a user using the host2to generate a KEK associated with the user. The KEK generation unit125generates, for example, a hash value of the user's password as the KEK. The KEK generation unit125sends the generated KEK to the DEK encryption/decryption unit126.

The read control unit122receives a read command from the host2via the host I/F11. The read control unit122performs a read operation for reading data in accordance with the read command.

Specifically, the read control unit122converts a logical address specified by the read command into a corresponding physical address by using the logical-to-physical address conversion table21. The read control unit122sends a read instruction for reading data from this physical address to the NAND flash memory5. Consequently, encrypted data in accordance with the read command is read from the NAND flash memory5.

The read control unit122uses the encrypted DEK table23to acquire an encrypted DEK associated with the logical address specified by the read command. The read control unit122sends the acquired encrypted DEK to the DEK encryption/decryption unit126.

The DEK encryption/decryption unit126decrypts the encrypted DEK with the KEK and thus acquires the DEK. The KEK is a KEK associated with the user who has requested reading of user data by using the read command. The DEK encryption/decryption unit126sends the acquired DEK to the data encryption/decryption unit127.

The data encryption/decryption unit127decrypts the encrypted data read from the NAND flash memory5according to the read instruction with the DEK to acquire plaintext user data. The data encryption/decryption unit127transmits the user data to the host2via the host I/F11.

Consequently, the user using the host2can acquire the user data in accordance with the read command by using the KEK associated with the user.

When the KEK associated with the user is different from a KEK used to encrypt the encrypted DEK, the DEK encryption/decryption unit126fails to decrypt the encrypted DEK. In this case, the data encryption/decryption unit127cannot decrypt encrypted data read from the NAND flash memory5. Therefore, for example, in illegal access in which a correct password is not entered, the KEK used to encrypt the encrypted DEK cannot be generated, and thus the encrypted DEK cannot be decrypted and the encrypted data cannot be decrypted. Consequently, it is possible to prevent encrypted data from being decrypted and plaintext user data from being leaked.

With the configurations illustrated inFIGS.10and11, the SSD3can improve storage efficiency while maintaining the confidentiality of data for each user.

FIG.12is a flowchart illustrating an example of a procedure of a control process executed by the controller4. The control process is started according to, for example, establishment of connection between the SSD3and the host2.

The controller4determines whether a user's password has been received from the host2(step S101). When the password has not been received (NO in step S101), the controller4returns to step S101and determines again whether the password has been received.

On the other hand, when the password has been received (YES in step S101), the controller4generates a KEK by using the password (step S102). The controller4generates, for example, a hash value of the password as the KEK. Consequently, the controller4can encrypt a DEK and also decrypt the encrypted DEK by using the KEK.

Next, the controller4determines whether an I/O command has been received from the host2(step S103). When the I/O command has not been received (NO in step S103), the controller4returns to step S103and determines again whether the I/O command has been received.

On the other hand, when the I/O command has been received (YES in step S103), the controller4branches the process according to the type of the received I/O command (step S104). When the received I/O command is a read command (read command in step S104), the controller4executes a read process (step S105). The read process is a process for acquiring data in accordance with the read command and transmitting the data to the host2. A detailed procedure of the read process will be described later with reference to a flowchart ofFIG.13.

When the received I/O command is a write command (write command in step S104), the controller4executes a write process (step S106). The write process is a process for storing user data received along with the write command into the NAND flash memory5by performing deduplication and encryption. A detailed procedure of the write process will be described later with reference to a flowchart ofFIG.14.

After the read process in step S105is executed or the write process in step S106is executed, the controller4returns to step S103. Consequently, the controller4can continue a process in accordance with a read command or a write command that will be received.

Through the above control process, the controller4can generate a KEK for each user to be used to encrypt and decrypt the DEK, and perform a read process in accordance with a read command and a write process in accordance with a write command. The procedures from step S101to step S102may be performed at any timing before a procedure for decrypting the encrypted DEK in the read process in step S105(step S204inFIG.13described later) and a procedure for encrypting the DEK in the write process in step S106(step S310inFIG.14described later).

FIG.13is a flowchart illustrating an example of a procedure of the read process executed by the controller4. The read process corresponds to step105of the control process described above with reference to the flowchart ofFIG.12.

The controller4uses the logical-to-physical address conversion table21to determine a physical address corresponding to a logical address specified by the read command (step S201). The controller4reads encrypted data from the determined physical address in the NAND flash memory5(step S202).

The controller4acquires an encrypted DEK corresponding to the logical address specified by the read command from the encrypted DEK table23(step S203). The controller4decrypts the encrypted DEK with the KEK corresponding to the user (step S204). The KEK is generated by using the password entered by the user using the host2. The encrypted DEK can be decrypted with only the KEK used for encrypting the DEK to generate the encrypted DEK. Thus, when a wrong password is received from the host2, or when the encrypted DEK cannot be correctly decrypted with the KEK, the controller4may determine that the access is illegal and stop the read process.

The controller4can perform the procedures in steps S201-S202and the procedures in steps S203-S204in parallel, in various embodiments. The controller4may perform the procedures in step S203and step S204after performing the procedures in step S201and step S202, in some other embodiments. The controller4may perform the procedures in step S201and step S202after performing the procedures in step S203and step S204, in some yet other embodiments.

Next, the controller4decrypts the read encrypted data with the DEK (step S205). The controller4transmits plaintext user data obtained through the decryption to the host2(step S206).

Through the read process, the controller4can read the encrypted data from the NAND flash memory5according to the read command and transmit plaintext user data obtained by decrypting the encrypted data to the host2. A DEK obtained by decrypting an encrypted DEK with a KEK unique to each user is used to decrypt the encrypted data. Thus, encrypted data is not decrypted in illegal access in which a KEK of a corresponding user cannot be obtained. Therefore, it can prevent plaintext user data from being leaked due to illegal access.

FIG.14is a flowchart illustrating an example of a procedure of the write process executed by the controller4. The write process corresponds to step S106of the control process described above with reference to the flowchart ofFIG.12.

The controller4receives user data to be written into the NAND flash memory5from the host2(step S301). The controller4calculates a hash value of the user data (step S302).

The controller4uses the calculated hash value and the physical address versus hash value table22to determine whether the received user data is duplicated data of plaintext data (stored data) corresponding to the encrypted data stored in the NAND flash memory5(step S303). That is, the controller4determines whether data having the same pattern as that of the received user data has been encrypted and stored in the NAND flash memory5.

When the user data is duplicated data of the stored data (YES in step S303), the controller4generates a DEK by using the user data (step S304). The controller4generates, for example, a hash value of the user data as the DEK. The controller4updates the logical-to-physical address conversion table21such that the logical address specified by the write command is associated (that is, mapped) with the physical address in which the encrypted data corresponding to the stored data is written (step S305). Consequently, a single physical address in which the encrypted data is written can be associated with a plurality of logical address.

When the user data is not duplicated data of the stored data (NO in step S303), the controller4generates a DEK by using the user data (step S306). The controller4encrypts the user data with the DEK (step S307), and writes the encrypted user data (encrypted data) into the NAND flash memory5(step S308). The controller4updates the logical-to-physical address conversion table21such that the logical address specified by the write command is associated (that is, mapped) with the physical address in which the encrypted data is written (step S309). The controller4updates the physical address versus hash value table22(step S310). More specifically, when there is an entry including the physical address in which the encrypted data is written in the physical address versus hash value table22, the controller4sets the hash value of the user data calculated in step S302in a hash value field of the entry.

After the logical-to-physical address conversion table21is updated in step S305or the physical address versus hash value table22is updated in step S310, the controller4encrypts the DEK with the KEK corresponding to the user (step S311). The KEK is generated by using the password entered by the user using the host2. The controller4stores the encrypted DEK (step S312). More specifically, when there is no entry in the encrypted DEK table23including the logical address (that is, the logical address specified by the write command) corresponding to the user data, the controller4adds an entry including the logical address and the encrypted DEK to the encrypted DEK table23. When there is an entry including the logical address corresponding to the user data in the encrypted DEK table23, the controller4sets the encrypted DEK obtained in step S310in an encrypted DEK field of the entry.

Through the write process, the controller4skips the process of encrypting the user data and the process of writing the encrypted data into the NAND flash memory5when the user data received along with the write command is duplicated data of the stored data such that deduplication can be achieved.

The controller4uses user data to generate a DEK regardless of whether the user data is duplicated data of stored data. Consequently, encrypted data obtained by encrypting the user data with the DEK can be shared by a plurality of users who have requested writing of the user data having the same pattern.

The controller4encrypts a DEK with a KEK unique to each user and stores the encrypted DEK. Therefore, it is necessary to decrypt a stored encrypted DEK with a KEK for each user to decrypt encrypted data. Therefore, a user can keep user data obtained by decrypting the encrypted data with the DEK confidential by using the KEK (or a password for deriving the KEK).

Second Embodiment

In the first embodiment, a DEK is generated by using user data to be written into the NAND flash memory5. On the other hand, in the second embodiment, the DEK is generated by using the user data to be written into the NAND flash memory5and a key derivation key (KDK) unique to each SSD.

The controller4(more specifically, the DEK generation unit124) can generate a certain DEK only when corresponding user data is present. Therefore, the controller4cannot generate the DEK when the corresponding user data is not present.

However, for example, a user with knowledge of hashes can generate a DEK corresponding to user data on the host2. Thus, there may be an operational vulnerability that the DEK is leaked due to the user's inadequacy.

Thus, the SSD3according to the second embodiment uses not only user data but also a KDK unique to each SSD to generate a DEK. Consequently, the strength of encryption of user data using the DEK can be increased.

A configuration of the SSD3according to the second embodiment is the same as that of the SSD3of the first embodiment, and only a configuration for generating a DEK by further using a KDK is different between the second embodiment and the first embodiment. Hereinafter, description will focus on differences from the first embodiment.

FIG.15is a block diagram illustrating a configuration example of an information processing system1that includes the SSD3of the second embodiment. The SSD3of the second embodiment further includes a one-time programmable memory (OTP memory)15in addition to the configuration of the SSD3of the first embodiment.

The OTP memory15includes a plurality of memory elements (that is, memory cells) in each of which data can be written only once. Each memory element of the OTP memory15is an irreversible memory element in which data can be written only once. As the OTP memory15, for example, an electric fuse (e-fuse) is used, but the OTP memory15is not limited thereto.

The OTP memory15stores a KDK15A used to generate a DEK. The KDK15A is a key unique to the SSD3. That is, a plurality of SSDs use their own unique KDKs. The KDK15A is stored in the OTP memory15, and thus it is possible to prevent the KDK15A from being leaked. Hereinafter, the KDK15A will also be referred to as a device key15A.

FIG.16is a block diagram illustrating an example of a write operation in the SSD3. When the write control unit121receives a write command, the DEK generation unit124uses the device key15A and user data received along with the write command, to generate a DEK. Specifically, the DEK generation unit124generates the DEK by executing a key derivation function (KDF) with the device key15A as a KDK and a hash value of the user data as an index. The DEK generation unit124sends the generated DEK to the data encryption/decryption unit127and the DEK encryption/decryption unit126.

An operation of each of the other units is the same as that in the first embodiment. A read operation is the same as that in the first embodiment.

With the above configuration, the SSD3can increase the strength of encryption of user data using a DEK.

As described above, according to the first and second embodiments, it is possible to improve storage efficiency while maintaining the confidentiality of data for each user. The NAND flash memory5stores first encrypted data obtained by encrypting first data with a first DEK. When second data received from the host2along with a write request (for example, a write command) is the same as the first data and a first user is using the host2, the controller4encrypts the first DEK with a first KEK associated with the first user to acquire a first encrypted DEK, and stores the first encrypted DEK. When the second data is the same as the first data and a second user different from the first user is using the host2, the controller4encrypts the first DEK with a second KEK associated with the second user to acquire a second encrypted DEK, and stores the second encrypted DEK. When the second data is different from the first data and the first user is using the host2, the controller4uses the second data to generate a second DEK, encrypts the second data with the second DEK to acquire second encrypted data, writes the second encrypted data into the NAND flash memory5, encrypts the second DEK with the first KEK to acquire a third encrypted DEK, and stores the third encrypted DEK. When the second data is different from the first data and the second user is using the host2, the controller4uses the second data to generate the second DEK, encrypts the second data with the second DEK to acquire the second encrypted data, writes the second encrypted data into the NAND flash memory5, encrypts the second DEK with a second KEK to acquire a fourth encrypted DEK, and stores the fourth encrypted DEK.

When the first data stored in the NAND flash memory5is the same as the second data received along with the write request, the second data encrypted with the first DEK is same as the first encrypted data, and thus the controller4is not required to write the second data into the NAND flash memory5such that deduplication can be achieved.

When the first data and the second data are the same as each other and the first user is using the host2, the controller4encrypts the first DEK with the first KEK associated with the first user, and stores the encrypted first DEK. In this case, it can be said that the first data (=second data) obtained by decrypting the first encrypted data in the NAND flash memory5is kept confidential by the first user associated with the first KEK for decrypting the encrypted first DEK.

When the first data and the second data are the same as each other and the second user different from the first user is using the host2, the first DEK is encrypted to be stored with the second KEK associated with the second user. In this case, it can be said that the first data (=second data) obtained by decrypting the first encrypted data in the NAND flash memory5is kept confidential by the second user associated with the second KEK for decrypting the encrypted first DEK.

As described above, the SSD3can improve storage efficiency while maintaining the confidentiality of data for each user.

Each of the various functions described in the first and second embodiments may be implemented by a circuit (processing circuit). Examples of the processing circuit include a programmed processor such as a central processing unit (CPU). The processor executes each of the described functions by executing a computer program (instruction group) stored in a memory. The processor may be a microprocessor including an electric circuit. Examples of the processing circuit also include a digital signal processor (DSP), an application specific integrated circuit (ASIC), a microcontroller, a controller, and other electric circuit components. Each of components other than the CPU described in the embodiments may also be implemented by the processing circuit.

While certain embodiments have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions. Indeed, the novel embodiments described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the embodiments described herein may be made without departing from the spirit of the inventions. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the inventions.