Method of processing commands and storage device

Abstract

This application relates to a method for processing commands and a storage device. The method for processing commands includes: in response to receiving a read command or write command to access a first namespace, processing the read command or write command according to the state of the first namespace; wherein the state of the namespace includes an unlocked state and a locked state; the unlocked state includes a passwordless unlocked state and a password-protected unlocked state; if the first namespace is in a passwordless unlocked state, processing the read command or write command to move data in the physical address space corresponding to the first namespace; if the first namespace is in a password-protected unlocked state or a locked state, not processing the read command or write command, generating and sending a prompt message to the host indicating that the read command or write command processing failed.

Description

Technical Field

[0001] This application generally relates to the field of data processing technology. More specifically, this application relates to methods for managing data encryption and decryption keys, methods for processing commands, controllers, and storage devices. Background Technology

[0002] Figure 1A A block diagram of a solid-state storage device (SSD) is shown. The SSD 102 is coupled to a host computer to provide storage capabilities. The host computer and the SSD 102 can be coupled in various ways, including but not limited to connections via SATA (Serial Advanced Technology Attachment), SCSI (Small Computer System Interface), SAS (Serial Attached SCSI), IDE (Integrated Drive Electronics), USB (Universal Serial Bus), PCIe (Peripheral Component Interconnect Express), NVMe (NVM Express), Ethernet, Fibre Channel, and wireless communication networks. The host computer can be an information processing device capable of communicating with the storage device via the above methods, such as a personal computer, tablet computer, server, laptop computer, network switch, router, cellular phone, or personal digital assistant. Storage device 102 (hereinafter referred to as storage device) includes interface 103, control unit 104, one or more NVM chips 105 and DRAM (Dynamic Random Access Memory) 110.

[0003] The aforementioned NVM chip 105 includes common storage media such as NAND flash memory, phase-change memory, FeRAM (Ferroelectric RAM), MRAM (Magnetic Random Access Memory), and RRAM (Resistive Random Access Memory).

[0004] The aforementioned interface 103 can be adapted to exchange data with the host via methods such as SATA, IDE, USB, PCIe, NVMe, SAS, Ethernet, and Fibre Channel.

[0005] The aforementioned control unit 104 is used to control data transmission between interface 103, NVM chip 105, and DRAM 110, and also for memory management, host logical address to flash physical address mapping, erase leveling, bad block management, etc. Control unit 104 can be implemented in various ways, including software, hardware, firmware, or combinations thereof. For example, control unit 104 can be in the form of an FPGA (Field-programmable gate array), ASIC (Application Specific Integrated Circuit), or a combination thereof. Control unit 104 may also include a processor or controller, in which software executes to manipulate the hardware of control unit 104 to process I / O (Input / Output) commands. Control unit 104 can also be coupled to DRAM 110 and can access data in DRAM 110. FTL tables and / or cached I / O command data can be stored in DRAM.

[0006] The control unit 104 issues commands to the NVM chip 105 in accordance with the interface protocol of the NVM chip 105 to operate the NVM chip 105, and receives the command execution results output from the NVM chip 105. Known NVM chip interface protocols include "Toggle" and "ONFI".

[0007] In storage device 102, an FTL (Flash Translation Layer) is used to maintain mapping information from logical addresses (LBAs) to physical addresses. Logical addresses constitute the storage space of the solid-state storage device as perceived by upper-layer software such as the operating system. Physical addresses are the addresses used to access the physical storage units of the solid-state storage device. In related technologies, address mapping can also be implemented using intermediate address formats. For example, a logical address can be mapped to an intermediate address, and then the intermediate address can be further mapped to a physical address. The table structure that stores the mapping information from logical addresses to physical addresses is called the FTL table. The FTL table is important metadata in the storage device. The data items in the FTL table record the address mapping relationships in the storage device, unit by unit.

[0008] See Figure 1BThe control components include a host interface 1041, a host command processing unit 1042, a storage command processing unit 1043, a media interface controller 1044, and a storage media management unit 1045. The host interface 1041 receives I / O commands from the host. The host command processing unit 1042 generates storage commands based on the I / O commands and provides them to the storage command processing unit 1043. Each storage command can access a storage space of the same size, such as 4KB. The data unit recorded in the NVM chip corresponding to the data accessed by a storage command is called a data frame. A physical page records one or more data frames. For example, if the size of a physical page is 17664 bytes and the size of a data frame is 4KB, then one physical page can store four data frames.

[0009] The storage media management unit 1045 maintains the logical address to physical address translation for each storage command. For example, the storage media management unit 1045 includes an FTL table (explained below). For a read command, the storage media management unit 1045 outputs the physical address corresponding to the logical address (LBA) accessed by the storage command. For a write command, the storage media management unit 1045 allocates an available physical address and records the mapping between the accessed logical address (LBA) and the allocated physical address. The storage media management unit 1045 also maintains functions required for managing the NVM chip, such as garbage collection and wear leveling.

[0010] The storage command processing unit 1043, based on the physical address provided by the storage media management unit 1045, operates the media interface controller 1044 to send a storage media access command to the NVM chip 105.

[0011] With the continuous improvement of data storage technology, high-capacity solid-state storage (SSD) devices are widely used. To enhance data security and independence, it is often necessary to store different types of data in relatively independent spaces or to store data from different users in relatively independent spaces. To meet this requirement of storing different types of data or data from different users in different namespaces, multiple namespaces (NS) can be created within the SSD. This involves dividing the SSD's memory space into multiple independent logical spaces, each of which is a namespace. For the host, each namespace corresponds to an independent disk, presented in disk form, with its logical address being a contiguous range. For the SSD, each namespace contains several logical addresses, which can be contiguous or non-contiguous. Generally, an SSD has at least one namespace by default. Users can create namespaces with different characteristics according to their needs, i.e., creating several different namespaces on one SSD for use by the same or different users. Summary of the Invention

[0012] With the continuous improvement of data storage technology, in the use of solid-state storage devices, in addition to considering storing different types of data or data from different users in different namespaces, it is also necessary to consider the security and privacy of the data stored in each namespace. For example, some namespaces are used to store data that needs to be read and written frequently, while other namespaces are used to store more important data that is not suitable for reading and writing. Furthermore, the types of data may change; for instance, data that originally needed to be read and written frequently may become data that is not suitable for reading and writing, and data that was originally not suitable for reading and writing may become data that needs to be read and written. Also, each user has a corresponding namespace to store data, and users do not want unauthorized access to or management of their namespaces. Moreover, users not only want only themselves to be able to access or manage their own namespaces, but also want their namespaces to be visible in some situations for their own operation, and hidden in other situations to avoid the covetousness of others. Therefore, in order to improve the security and privacy of the data corresponding to the namespace, it is necessary to provide the function of encrypting and managing each namespace. However, the existing NVMe protocol defines the namespace and its functions, but does not define the function of encrypting and managing each namespace. Therefore, how to implement the function of encrypting and managing each namespace has become an urgent problem to be solved.

[0013] To meet the above requirements, one of the objectives of this application is to provide namespace-level encryption management functionality. This involves setting independent encryption states (e.g., locked and unlocked states) for each namespace, and responding with corresponding functions under different encryption states. For example, in the locked state, I / O commands cannot be processed, while in the unlocked state, I / O commands can be processed. Furthermore, different encryption states can be used to dynamically hide namespaces, preventing the operating system and ordinary users from seeing namespaces in the locked state, while administrators can see namespaces in all states. This improves the security of storage devices and reduces the probability of unauthorized human intervention.

[0014] Furthermore, in existing storage technologies, the encryption or decryption key for storage space is closely related to the set user password and generally changes with the user password. Since the solution provided in this application embodiment has a user password function for the namespace, users may need to change / delete / add user passwords. When data has already been written to the namespace, changing the user password (canceling the password or creating a new user) requires first reading the written data and decrypting it using the key corresponding to the previous user password. Then, the decrypted data needs to be encrypted and stored in the namespace using the key corresponding to the new user password. Since the namespace capacity can be very large (several TB), this operation is extremely time-consuming (may take several hours), resulting in a poor user experience. To solve this problem, the solution provided in this application embodiment severs the association between the password and the encryption or decryption key, providing encryption and decryption functions for data in the namespace while meeting low latency requirements.

[0015] Furthermore, another objective of this application is to provide password management functionality for namespaces, enabling users to set passwords for a namespace, or to set the same or different passwords for different namespaces, thereby setting access and processing permissions for the namespaces and thus improving security.

[0016] Furthermore, this application utilizes relatively simple predefined commands (different from the NVMe protocol) for namespace management and password management, avoiding the use of complex protocols and improving command processing efficiency.

[0017] Based on a first aspect of this application, a method for managing a first namespace according to the first aspect of this application is provided, comprising receiving a first command; responding to the first command indicating a first namespace, processing the first command according to the state of the first namespace, and changing or maintaining the state of the first namespace.

[0018] Based on a second aspect of this application, a method for encrypting or decrypting a first management data key according to the second aspect of this application is provided, comprising obtaining first random data (TRNG_Data_2), a storage device identification code (chip ID), and second random data (LOC_TRNG_2); obtaining an encryption key or decryption key (last_rk) corresponding to one or more namespaces in the storage device based on the first random data (TRNG_Data_2), the storage device identification code (chip ID), and the second random data (LOC_TRNG_2); and maintaining the encryption key or decryption key corresponding to the namespace unchanged in response to adjusting the user password of the namespace.

[0019] The method for encrypting and decrypting a first management data key according to the second aspect of this application provides a method for encrypting and decrypting a second management data key according to the second aspect of this application, further comprising: storing the encryption key or decryption key (last_rk) in a buffer memory of the storage device.

[0020] According to the first or second management data encryption / decryption key method of the second aspect of this application, a third management data encryption / decryption key method according to the second aspect of this application is provided, wherein any two namespaces in the storage device correspond to different encryption or decryption keys; or multiple namespaces in the storage device correspond to the same encryption or decryption key.

[0021] According to the third method for encrypting and decrypting management data keys according to the second aspect of this application, a fourth method for encrypting and decrypting management data keys according to the second aspect of this application is provided, wherein the user passwords corresponding to any two namespaces are the same; or the user passwords corresponding to the multiple namespaces are all different.

[0022] According to one of the first to fourth methods for managing data encryption and decryption keys according to the second aspect of this application, a fifth method for managing data encryption and decryption keys according to the second aspect of this application is provided, in response to receiving an IO command as a write command and indicating a first namespace, invoking the encryption key corresponding to the first namespace to encrypt the data to be written by the write command.

[0023] According to one of the methods for the first to fourth management data encryption and decryption keys of the second aspect of this application, a method for the sixth management data encryption and decryption key according to the second aspect of this application is provided, in response to receiving an IO command as a read command and indicating a first namespace, calling the decryption key corresponding to the first namespace to decrypt the data read according to the read command.

[0024] According to one of the methods for first to sixth management data encryption / decryption keys according to the second aspect of this application, a method for seventh management data encryption / decryption keys according to the second aspect of this application is provided. In response to receiving multiple IO commands indicating multiple first namespaces having the same encryption key or decryption key, the same encryption key or decryption key is used to encrypt or decrypt the data to be accessed by each IO command; or in response to receiving multiple IO commands indicating multiple first namespaces with different encryption keys or decryption keys, the encryption key or decryption key corresponding to each first namespace is invoked to encrypt or decrypt the data to be accessed by the corresponding IO command.

[0025] According to the method for encrypting and decrypting management data keys according to the second aspect of this application, an eighth method for encrypting and decrypting management data keys according to the second aspect of this application is provided, which, in response to receiving a password management command indicating a first namespace, performs user password management on the first namespace according to the password management command, and keeps the encryption key or decryption key of the first namespace unchanged.

[0026] According to the method for the eighth management data encryption and decryption key of the second aspect of this application, a method for the ninth management data encryption and decryption key of the second aspect of this application is provided, which, in response to the password management command, sets a password for the first namespace and keeps the encryption key or decryption key of the first namespace unchanged.

[0027] According to the method for the eighth management data encryption / decryption key of the second aspect of this application, a method for the tenth management data encryption / decryption key of the second aspect of this application is provided, which, in response to the password management command being a password modification command, modifies the user password of the first namespace while keeping the encryption key or decryption key of the first namespace unchanged.

[0028] According to the method for encrypting and decrypting management data keys according to the eighth aspect of the second aspect of this application, an eleventh method for encrypting and decrypting management data keys according to the second aspect of this application is provided, in response to the password management command being a password deletion command, deleting the user password of the first namespace, and keeping the encryption key or decryption key of the first namespace unchanged.

[0029] According to the method for the eighth management data encryption / decryption key of the second aspect of this application, a method for the twelfth management data encryption / decryption key of the second aspect of this application is provided, which, in response to the password management command being a password authentication command, authenticates the user password of the first namespace while keeping the encryption key or decryption key of the first namespace unchanged.

[0030] According to the method for encrypting and decrypting management data keys according to the eighth aspect of the second aspect of this application, a method for encrypting and decrypting management data keys according to the thirteenth aspect of the second aspect of this application is provided, wherein in response to the password management command being a cancellation authentication command, the user password authentication for the first namespace is cancelled, and the encryption key or decryption key for the first namespace remains unchanged.

[0031] According to the first management data encryption / decryption key method of the second aspect of this application, a fourteenth management data encryption / decryption key method according to the second aspect of this application is provided, wherein a second namespace is created in response to receiving an NS creation command, and an encryption key or decryption key is set for the second namespace, wherein the data encryption key is the same as or different from the encryption key or decryption key of other namespaces in the storage device.

[0032] According to one of the methods for the first to fourteenth management data encryption and decryption keys of the second aspect of this application, a method for the fifteenth management data encryption and decryption key of the second aspect of this application is provided, which obtains first random data (TRNG_Data_2), storage device identification code (chip ID) and second random data (LOC_TRNG_2), including: obtaining the first random data (TRNG_Data_2), storage device identification code (chip ID) and second random data (LOC_TRNG_2) from a one-time programmable device.

[0033] According to one of the methods for encrypting and decrypting management data according to the first to fourteenth aspects of the second aspect of this application, a method for encrypting and decrypting management data according to the sixteenth aspect of the second aspect of this application is provided. This method obtains an encryption key or decryption key (last_rk) corresponding to one or more namespaces in the storage device based on the first random data (TRNG_Data_2), the storage device identification code (chip ID), and the second random data (LOC_TRNG_2). The method includes: performing a hash operation on the first random data (TRNG_Data_2) to obtain a first hash value (TRNG_Hash_2); performing a hash operation on the storage device identification code (chip ID) and the second random data (LOC_TRNG_2) to obtain a second hash value (Loc_TID_Hash); and encrypting the first hash value (TRNG_Hash_2) and the second hash value (Loc_TID_Hash) to obtain an encryption key or decryption key (last_rk) corresponding to one or more namespaces.

[0034] Based on a third aspect of this application, a method for a first processing command according to the third aspect of this application is provided, comprising: in response to obtaining a first read command to access a first namespace, wherein the first namespace is in an unlocked state, obtaining a first decryption key corresponding to the first namespace; accessing a storage medium to obtain first ciphertext data according to the first read command, and decrypting the first ciphertext data using the first decryption key to obtain first decrypted data as data to be read by the first read command.

[0035] According to the method of the first processing command of the third aspect of this application, a method of the second processing command of the third aspect of this application is provided, in response to obtaining a first write command to access a first namespace, wherein the first namespace is in an unlocked state, obtaining a first encryption key corresponding to the first namespace; encrypting the first plaintext data to be written by the first write command according to the first encryption key, and writing the encrypted first encrypted data into a storage medium.

[0036] According to the method of the first or second processing command of the third aspect of this application, a method of the third processing command according to the third aspect of this application is provided, in response to obtaining a second read command to access a second namespace, wherein the second namespace is in an unlocked state, obtaining a second decryption key corresponding to the second namespace, wherein the second decryption key is the same as or different from the first decryption key; accessing a storage medium to obtain second ciphertext data according to the second read command, and decrypting the second ciphertext data using the second decryption key to obtain second decrypted data as the data to be read by the second read command.

[0037] According to the method of the third processing command of the third aspect of this application, a method of the fourth processing command of the third aspect of this application is provided, in response to obtaining a second write command to access a second namespace, wherein the second namespace is in an unlocked state, obtaining a second encryption key corresponding to the second namespace, wherein the second encryption key is the same as or different from the first encryption key; encrypting the second plaintext data to be written by the second write command according to the second encryption key, and writing the encrypted second encrypted data into a storage medium.

[0038] A method for a fifth processing command according to a third aspect of this application is provided, wherein the first decryption key is the same as or different from the first encryption key; and the second decryption key is the same as or different from the second encryption key.

[0039] According to one of the methods of the first to fifth processing commands of the third aspect of this application, a method of the sixth processing command according to the third aspect of this application is provided, in response to obtaining the first read command or the first write command, wherein the first namespace is in a password-unlocked state or a locked state, generating a first feedback message of failure to access the first namespace, and sending the first feedback message to the host.

[0040] According to the method of the sixth processing command of the third aspect of this application, a method of the seventh processing command of the third aspect of this application is provided, in response to obtaining a first user password input by a user and the first read command, wherein the first namespace is in a password-unlocked state, obtaining a first password key corresponding to the first namespace, verifying the first user password according to the first password key; in response to passing the verification, decrypting the first ciphertext data using the first decryption key to obtain the first decrypted data.

[0041] According to the method of the seventh processing command of the third aspect of this application, a method of the eighth processing command of the third aspect of this application is provided, in response to failure of the verification, generating the first feedback information and sending the first feedback information to the host.

[0042] According to the method of the seventh processing command of the third aspect of this application, a method of the ninth processing command of the third aspect of this application is provided, in response to obtaining the first user password and the first write command, wherein the first namespace is in a password-unlocked state, obtaining the first password key, and verifying the first user password according to the first password key; in response to passing the verification, encrypting the first plaintext data according to the first encryption key to obtain the first encrypted data, and writing the first encrypted data into a storage medium.

[0043] According to the method of the ninth processing command of the third aspect of this application, a method of the tenth processing command of the third aspect of this application is provided, in response to failure of the verification, generating the first feedback information and sending the first feedback information to the host.

[0044] According to one of the methods of the first to tenth processing commands of the third aspect of this application, a method of the eleventh processing command according to the third aspect of this application is provided, in response to obtaining the second read command or the second write command, wherein the second namespace is in a password-unlocked state or a locked state, generating a second feedback message indicating failure to access the second namespace, and sending the second feedback message to the host.

[0045] According to one of the methods of the eleventh processing command of the third aspect of this application, a method of the twelfth processing command of the third aspect of this application is provided, in response to obtaining a second user password input by a user and a second read command, wherein the second namespace is in a password-unlocked state, obtaining a second password key corresponding to the second namespace, verifying the second user password according to the second password key; in response to passing the verification, decrypting the second ciphertext data using the second decryption key to obtain the second decrypted data.

[0046] A method according to the thirteenth processing command of the third aspect of this application is provided, in response to failure of the verification, generating the second feedback information and sending the second feedback information to the host.

[0047] According to the eleventh processing command method of the third aspect of this application, a fourteenth processing command method according to the third aspect of this application is provided, in response to obtaining the second user password and the second write command, wherein the second namespace is in a password-unlocked state, obtaining the second password key, and verifying the second user password according to the second password key; in response to passing the verification, encrypting the second plaintext data according to the second encryption key to obtain the second encrypted data, and writing the second encrypted data into a storage medium.

[0048] A method according to the fourteenth processing command of the third aspect of this application is provided, wherein in response to failure of the verification, the second feedback information is generated and the second feedback information is sent to the host.

[0049] According to one of the methods of the first to fifteenth processing commands of the third aspect of this application, a method for the sixteenth processing command of the third aspect of this application is provided, wherein the first password key is the same as or different from the second password key.

[0050] According to the method of the sixteenth processing command of the third aspect of this application, a method of the seventeenth processing command of the third aspect of this application is provided, wherein in response to both the first namespace and the second namespace being in a passwordless unlocked state, the first password key and the second password key are the same; in response to one of the first namespace and the second namespace being in a passwordless unlocked state and the other being in a password-enabled unlocked state, the first password key and the second password key are different; in response to both the first namespace and the second namespace being in a password-enabled unlocked state, and the user passwords corresponding to the first namespace and the second namespace being the same, the first password key and the second password key are the same; in response to both the first namespace and the second namespace being in a password-enabled unlocked state, and the user passwords corresponding to the first namespace and the second namespace being different, the first password key and the second password key are different.

[0051] According to one of the methods of the first to seventeenth processing commands of the third aspect of this application, a method of the eighteenth processing command of the third aspect of this application is provided, in response to obtaining a password management command for managing a first namespace, wherein the first namespace is in an unlocked state, setting a user password, modifying a user password, or deleting a user password for the first namespace according to the password management command, while keeping the first encryption key or the first decryption key unchanged.

[0052] According to the method of the eighteenth processing command of the third aspect of this application, a method of the nineteenth processing command of the third aspect of this application is provided, in response to obtaining the password management command, wherein the first namespace is in an unlocked state, the password authentication of the first namespace is canceled according to the password management command, and the first encryption key or the first decryption key remains unchanged.

[0053] The method according to the eighteenth or nineteenth processing command of the third aspect of this application provides a method according to the twentieth processing command of the third aspect of this application, in response to obtaining the password management command, wherein the first namespace is in a locked state, performing password authentication for the first namespace according to the password management command, and keeping the first encryption key or the first decryption key unchanged.

[0054] According to the method of the first to twentieth processing commands of the third aspect of this application, a method of the twenty-first processing command of the third aspect of this application is provided, in response to obtaining a garbage collection command, identifying data to be collected according to the garbage collection command, allocating corresponding storage space for the data to be collected, and moving the data to be collected to the storage space, wherein the data to be collected is moved directly without encryption or decryption.

[0055] Based on a fourth aspect of this application, a first controller according to the fourth aspect of this application is provided, the controller including a host interface for interacting with a host and processing circuitry; the processing circuitry is used to implement one of the methods for managing data encryption / decryption keys as described in the second aspect of this application, or one of the methods for processing commands as described in the third aspect of this application.

[0056] According to a first controller of a fourth aspect of this application, a second controller according to a fourth aspect of this application is provided, the processing circuit including a host command processing unit and a storage command processing unit; the host command processing unit is used to parse the first command and instruct the storage command processing unit according to the parsing result; the storage command processing unit is used to execute the operation corresponding to the first command according to the instruction, and to change or maintain the state of a first namespace. According to a second controller for managing data encryption / decryption keys of a third aspect of this application, a third controller for managing data encryption / decryption keys of a third aspect of this application is provided, the operation indicated by the first command includes: a data migration operation, a namespace management operation, and a namespace password management operation.

[0057] According to one of the first to third controllers of the fourth aspect of this application, a fourth controller according to the fourth aspect of this application is provided, the controller further comprising an encryption unit and a decryption unit for encrypting and decrypting data.

[0058] Based on a fifth aspect of this application, a storage device according to a fifth aspect of this application is provided, including a storage medium and a controller, the controller being configured to implement one of the methods for managing data encryption / decryption keys as described in the second aspect of this application, or one of the methods for processing commands as described in the third aspect of this application. Attached Figure Description

[0059] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings. Figure 1A This is a block diagram of a current-technical solid-state storage device; Figure 1B This is a schematic diagram of the structure of a control component in the prior art; Figure 2 This is a flowchart of a method for managing namespaces according to an embodiment of this application; Figure 3 This is a flowchart of a method for processing I / O commands according to an embodiment of this application; Figure 4 This is a controller structure diagram for processing NVMe read commands according to an embodiment of this application; Figure 5 This is a controller structure diagram for processing NVMe write commands according to an embodiment of this application; Figure 6 This is a flowchart of a method for processing NS management commands according to an embodiment of this application; Figure 7 This is a controller structure diagram for processing NS management commands according to an embodiment of this application; Figure 8 This is a flowchart of a method for processing password management commands according to an embodiment of this application; Figure 9 It is a namespace state transition diagram; Figure 10 This is a controller structure diagram for processing password management commands according to an embodiment of this application; Figure 11 This is a flowchart of a method for processing a first display command according to an embodiment of this application; Figure 12 This is a flowchart of a method for processing a second display command according to an embodiment of this application; Figure 13 It is a namespace state change diagram in an application scenario; Figure 14 This is a namespace state change diagram in another application scenario; Figure 15 It is a namespace state change diagram based on the display command; Figure 16 It is a namespace state change diagram based on NS management commands and password management commands; Figure 17a This is a schematic flowchart of a method for managing encryption and decryption keys according to an embodiment of this application; Figure 17b This is a schematic flowchart of a method for generating data encryption / decryption keys according to an embodiment of this application; Figure 18 This is a schematic diagram illustrating the relationship between data encryption / decryption keys and password keys according to an embodiment of this application. Detailed Implementation

[0060] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0061] Figure 2 This application illustrates a method for managing a namespace, including steps S101, S102, and S103, which will be described in detail below.

[0062] Step S101: Receive the first command. Combined with... Figure 1B The first command refers to the host command originating from host interface 1041. This first command includes NVMe commands conforming to the NVMe protocol, NS management commands for managing namespaces, and password management commands for managing namespace passwords. The specific processing methods for these commands will be explained in detail below.

[0063] In step S102, in response to the first command indicating a first namespace, the first command is processed according to the state of the first namespace. For example, the first command indicating a first namespace may include a parameter that identifies the namespace to be accessed or managed by the first command. In this document, an NS ID parameter is used, and the NS ID corresponding to each namespace is globally unique, so an NS ID can be used to uniquely identify a namespace. That is, in response to the first command containing one or more NS IDs, it indicates that the first command wants to access or manage one or more namespaces; thus, the host command processing unit 1042 can further execute the first command.

[0064] For example, each namespace created on an SSD not only has an NSID, but different namespaces can have the same or different states. Each time the SSD powers on, it determines the state of each namespace by running firmware and stores the state of each namespace in a cache. This can be done, for example, by using a namespace state table to record the relationship between each namespace's NSID and its state. This namespace state table contains multiple entries, each recording the relationship between a namespace's NSID and its state.

[0065] Step S103: Change or maintain the state of the first namespace. For example, after receiving the first command from the host, the control unit determines the NSID of at least one namespace to be accessed or managed by the first command, and queries the corresponding state based on the NSID of each namespace. The execution of the first command is related to the state of the namespace. For example, if the first command is an I / O command, the I / O command can only be executed when the namespace is in a specific state, and cannot be executed in other states. Based on the processing result of the first command, the state of the first namespace is changed or maintained. If the first command is executed, the state of the first namespace is changed from one state to another; if the first command is not executed, the state of the first namespace remains unchanged. For example, maintaining the state of the first namespace while processing an I / O command does not affect the execution of subsequent I / O commands; or, when executing a cancellation authentication command, the state of the first namespace will be changed to a locked state, thus locking the first namespace and preventing data access.

[0066] As mentioned above, the first command includes NVMe commands, which in turn include commands for accessing namespaces to move data between the host and the SSD. The following section will provide a detailed explanation of the IO command processing procedure. Figure 3 This application illustrates a method for managing namespaces according to an embodiment of the present application, including steps S201, S202, S203, and S204, which will be described in detail below.

[0067] Step S201: Receive IO command. For example, an IO command from the host can be received through the host interface 1041. The IO command indicates the first namespace that the host wants to access. For example, the IO command may contain the NS ID of the namespace to be accessed.

[0068] Step S202: Query the status of the first namespace. For example, based on the NS ID contained in the IO command in step 201, query the status corresponding to that NS ID in the namespace status table. In one embodiment, the namespace status table is shown in Table 1.

[0069] Table 1

[0070] Table 1 contains two entries, Entry 0 and Entry 1. Each entry has two columns: one for recording the NS ID and the other for recording the state of the namespace corresponding to the NS ID. For example, the namespace state includes both unlocked and locked states. Entry 0 records the state of namespace NS0, and Entry 1 records the state of NS1. Entry 0 records the state of namespace NS0 as unlocked, and Entry 1 records the state of namespace NS1 as locked. For simplicity, in this paper, "namespace in unlocked state" is also referred to as "namespace in unlocked state," and "namespace in locked state" is also referred to as "namespace in locked state."

[0071] In step S203, in response to the first namespace being in an unlocked state, an IO command is executed to move data in the physical address space corresponding to the first namespace. For example, for a read command, data is moved from the NVM to the host; for a write command, data is moved from the host to the NVM. In response to the first namespace being in a locked state, such as a locked state, the IO command is not executed, and a message indicating IO command processing failure can be returned to the host interface, such as a permission error message. For example, if the current IO command points to namespace NS0, according to Table 1, namespace NS0 is in an unlocked state, so the current IO command continues to be executed; if the current IO command points to namespace NS1, according to Table 1, NS1 is in a locked state, so the IO command is not executed. Based on this, users can protect a namespace by setting its state to a locked state, preventing unauthorized access.

[0072] Step S204: Keep the state of the first namespace unchanged, that is, keep the information of the corresponding entry in the namespace state table unchanged.

[0073] The following section further explains the method for processing NVMe commands in conjunction with the controller architecture. Figure 4 A controller for managing namespaces according to an embodiment of this application is illustrated, used for processing read commands; it includes a host interface, a host command processing unit, a storage command processing unit, a media interface controller, a decryption unit, and a DMA transfer unit. For ease of understanding, Figure 4 The document also showcases the host, DRAM, and off-chip memory (in this article, off-chip memory refers to data memory outside the controller). This can be combined with... Figure 1B understand Figure 4 The content displayed.

[0074] The host interface sends an NVMe (read) command to the host command processing unit, as shown in process (1.1). The host command processing unit receives the NVMe command, performs a preliminary judgment (e.g., determines if the NVMe command is related to a namespace; this process is prior art and therefore not shown in the diagram), and sends it to the NS status judgment unit. The unit then queries the namespace status table in DRAM to check the status of the namespace corresponding to the namespace NS ID indicated by the read command. For example, if the current NVMe command indicates namespace NS1, then according to the namespace status table (e.g., ... Figure 4 As shown), if namespace NS1 is locked, a permission error message is returned to the host via the host interface, as shown in procedure (1.9). If the current NVMe command indicates namespace NS0, then according to the namespace status table (e.g., ... Figure 4 As shown in the figure), if namespace NS0 is in an unlocked state, the NVMe command continues to be executed. The NVMe command enters the NVMe command parsing unit, represented as process (1.2). The NVMe command parsing unit parses the NVMe command, determines that the NVMe command is a read command, and then further processes the read command, such as address resolution and generating DMA commands based on the read command (these read command processing processes are existing technologies and are therefore not shown in the figure). The NVMe command parsing unit also notifies the data read / write control unit of the storage command processing unit in the form of a storage command, represented as process (1.3). The data read / write control unit processes the storage command and interacts with the media interface controller, represented as process (1.4). The data read / write control unit also instructs the key management unit to obtain the decryption key of the namespace indicated by the read command, represented as process (1.5); then the key management unit sends the decryption key to the decryption unit, represented as process (1.6). For example, if the read command indicates namespace NS0, when reading data from namespace NS0, the decryption key of namespace NS0 is also obtained accordingly, and the decryption unit decrypts the data read from namespace NS0 based on the decryption key. The media interface controller performs data transfer, moving data from off-chip memory to DRAM. The DMA transfer unit executes DMA commands, moving data decrypted by the decryption unit to host memory through the host interface, as shown in processes (1.7) and (1.8).

[0075] As can be seen from the above process, the data stored in the storage medium is encrypted; the key management unit and the decryption unit are used to obtain the key and decrypt the data, thereby ensuring the security of the data.

[0076] The above explains the process of reading commands. The following describes the process of writing commands. Figure 5 A controller for managing namespaces according to an embodiment of this application is shown for processing write commands. Figure 5and Figure 4 The differences include the inclusion of an encryption unit, which is used to encrypt data from the host.

[0077] The host interface sends an NVMe (write) command to the host command processing unit, as shown in process (2.1). The host command processing unit receives the NVMe command, and the NS status determination unit queries the namespace status table in DRAM to check the status of the namespace corresponding to the NS ID of the NVMe command. For example, if the current NVMe command indicates NS1, then according to the namespace status table (such as...) Figure 5 As shown), if namespace NS1 is locked, a permission error message is returned to the host via the host interface, as indicated in procedure (2.9). If the current NVMe command indicates NS0, then according to the namespace status table (e.g., ... Figure 5 As shown), if namespace NS0 is unlocked, the NVMe command continues to be executed. The NVMe command enters the NVMe command parsing unit, represented as process (2.2). The NVMe command parsing unit parses the NVMe command and determines that it is a write command. The NVMe command parsing unit also notifies the data read / write control unit of the storage command processing unit in the form of a storage command, represented as process (2.3). On one hand, the data read / write control unit instructs the key management unit to obtain the encryption key for the namespace indicated by the write command, represented as process (2.4). For example, if the write command indicates namespace NS0, the key management unit obtains the encryption key for namespace NS0. The key management unit sends the encryption key to the encryption unit, represented as process (2.5). On the other hand, the DMA transfer unit executes the DMA command to move data from the host to DRAM, represented as process (2.6); the DMA transfer unit and the encryption unit interact, represented as process (2.7), so that the encryption unit encrypts the data transferred from the DMA transfer unit to DRAM. On the other hand, the data read / write control unit sends one or more media interface commands to the media interface controller, as shown in process (2.8); finally, the media interface controller further moves the encrypted data in the DRAM to the off-chip NAND Flash memory according to the media interface commands, as shown in process (2.9). To ensure data security, the encryption unit encrypts the data. The encryption keys for different namespaces may be different, therefore a key management unit is needed for key management.

[0078] For example, the encryption key and decryption key for a namespace may be the same or different.

[0079] Figure 4 and Figure 5The NS status judgment unit, NVMe command parsing unit, data read / write control unit, key management unit, decryption unit, and encryption unit in the application can be implemented in hardware or software, and this application does not impose any restrictions on this. Furthermore, although in Figure 4 and Figure 5 The application distinguishes between the host command processing unit and the storage command processing unit. However, in some embodiments, modules such as the NS status judgment unit, NVMe command parsing unit, data read / write control unit, and key management unit can also be implemented independently by the host command processing unit or the storage command processing unit. This application does not impose any restrictions on this.

[0080] The above section introduced the handling of IO commands based on the NVMe protocol. Next, we will introduce NS management commands. NS management commands include NS creation commands and NS deletion commands. Unlike NVMe commands, NS management commands are custom commands that can be defined by the controller designer.

[0081] Figure 6 This paper illustrates a method for processing NS management commands according to an embodiment of this application. As an example, NS management commands include NS creation commands and NS deletion commands. For ease of understanding, the processing procedures for NS creation commands and NS deletion commands are briefly described below.

[0082] (1) For the received NS management command which is an NS creation command, the processing procedure is as follows: Step S301: Receive NS management commands, which include NS creation commands and NS deletion commands.

[0083] Step S302: If the current NS management command does not specify a first namespace, it means the current command is an NS creation command. In other words, the special feature of an NS creation command is that it does not specify a namespace, or in other words, it does not have an NS ID parameter. This is because the namespace has not yet been established and a corresponding NS ID has not been assigned.

[0084] Step S303: Create a namespace, including allocating an NS ID for the namespace, creating a corresponding second namespace based on the NS ID, and recording the correspondence between the logical address of the second namespace and its NS ID.

[0085] Step S304: Record the status of the created namespace, for example, record that the created namespace is in an unlocked state. Specifically, the unlocked state can be further divided into a passwordless unlocked state and a password-protected unlocked state. In one embodiment, the namespace status table is shown in Table 2.

[0086] Table 2

[0087] Table 2's namespace state table includes three entries: entry 0, entry 1, and entry 2. Each entry has two columns: one for recording the NS ID and the other for recording the state of the namespace corresponding to the NS ID. The namespace states include three types: unlocked without a password, unlocked with a password, and locked with a password. Entrance 0 records the state of namespace NS0, entry 1 records the state of namespace NS1, and entry 2 records the state of namespace NS2. Specifically, the state of namespace NS0 recorded in entry 0 is unlocked without a password, the state of namespace NS1 recorded in entry 1 is unlocked with a password, and the state of namespace NS2 recorded in entry 2 is locked with a password. For ease of identification, the unlocked without a password is denoted as S0, the unlocked with a password as S1, and the locked with a password as S2; in the following text, the locked with a password will also be referred to as the locked state.

[0088] Since the newly created namespace has not yet been password-protected by the user, its status can be set to unlocked without a password. A namespace in the unlocked without a password state can have a default password set by the system, while a namespace in the unlocked with a password state or the locked with a password state has a user-set password.

[0089] In step S305, in response to the successful creation of the namespace, a default password is assigned to the newly created namespace. The default password is provided by the system and is different from the user-set password.

[0090] (2) For the received NS management command being the NS delete command, the processing procedure is as follows: In step S402, the first command is parsed to determine that the first command is an NS delete command that indicates the first namespace. That is, the NS delete command contains the NS ID of the namespace to be deleted.

[0091] Step S403: Query the status of the first namespace.

[0092] Step S404: Verify the password entered by the user. If the verification is successful, proceed to step S405.

[0093] Step S405: Delete or retain the first namespace based on its status.

[0094] For example, if the current NS delete command indicates namespace NS0, and according to Table 2, namespace NS0 is in a password-free unlocked state, then namespace NS0 will be deleted.

[0095] For example, if the current NS delete command indicates namespace NS1, and according to Table 2, namespace NS1 is in a password-protected unlocked state, then when deleting namespace NS1, the user password of namespace NS1 will also be deleted.

[0096] For example, if the current NS delete command points to namespace NS2, as shown in Table 2, namespace NS2 is in a password-locked state. Since it is impossible to delete a locked namespace, the NS delete command will not be processed.

[0097] Therefore, the NS delete command will execute successfully on a namespace that is unlocked; it will fail on a namespace that is locked. To help users understand the execution status of the NS delete command, further feedback can be sent to the host indicating whether the deletion was successful or failed. Alternatively, users can be notified in other ways, such as using the first display command described later.

[0098] In one embodiment, the password verification in step S404 includes: matching the first password entered by the user with a second password stored in the first namespace, where the second password is either a default password (for namespaces in a password-free unlock state) or a user password (for namespaces in a password-enabled unlock state); if the first password and the second password match successfully, it indicates an authorized user's operation, and step S405 continues; if the first password and the second password fail to match, it indicates an unauthorized user's operation, the NS delete command is stopped, and a permission error message is returned. In one application scenario, multiple verification attempts can be set. If multiple verifications fail, the first namespace is locked, prohibiting further operations on the first namespace.

[0099] For example, if password verification is required in step S404, the first password for password verification can be carried on the NS delete command (as a parameter of the NS delete command), or it can be carried on another command sent by the host at the same time as or after sending the delete NS command. There is no limitation here.

[0100] The following section further explains the method for processing NS management commands in conjunction with the controller structure. Figure 7 A controller for managing namespaces according to an embodiment of this application is shown, which is used to process NS management commands. Wherein... Figure 4 , Figure 5The same parts will not be described in detail. The password verification unit is indicated by a dashed box, meaning that the password verification unit is an optional unit. In addition, besides being implemented in the host command processing unit, in other embodiments, the password verification unit can also be implemented in the storage command processing unit. The password verification unit and the NS state determination unit can be implemented in hardware or software, and this application does not impose any restrictions on this.

[0101] For the NS creation command, the NS creation command received from the host is forwarded to the host command processing unit via the host interface, as shown in process (3.1). The host command processing unit directly forwards the NS creation command to the storage command processing unit, as shown in process (3.3). The storage command processing unit creates a namespace according to the NS management command, including: allocating an NSID, recording the correspondence between the NS ID and the logical address of the namespace, determining the status of the created namespace, and setting the namespace password to the default password. After processing, the storage command processing unit synchronizes the information of the created namespace to the host command processing unit, as shown in process (3.5). The aforementioned namespace information includes the namespace size, NSID, and other information. In one embodiment, the storage command processing unit can modify the namespace status by updating one or more entries in the namespace status table in DRAM, such as... Figure 7 As shown, after the NS is created, an entry 3 can be added to the namespace status table. This entry 3 contains the NSID and status of the newly created namespace. For example, the newly created namespace is "NS3, unlocked without password", which is represented by process (3.4).

[0102] For the NS delete command, the NS delete command received from the host is forwarded to the host command processing unit via the host interface, as shown in process (3.1). The NS status judgment unit queries the namespace status table in DRAM to check the status of the namespace corresponding to the NS ID of the NS delete command. For example, if the current NS delete command indicates the namespace NS2, then the namespace status table (such as...) is queried. Figure 7 As shown in the diagram), if namespace NS2 is found to be locked, an error message is returned to the host via the host interface, as shown in procedure (3.9). If the current NS delete command indicates NS3, then the namespace status table (e.g., ...) is queried. Figure 7As shown in the figure, if the namespace NS3 is found to be in a passwordless unlock state, the host command processing unit forwards the NS delete command to the storage command processing unit, which is represented as process (3.3). The storage command processing unit deletes the namespace according to the NS delete command, and at the same time deletes the corresponding entry in the namespace status table, such as deleting the last entry 3 "NS3 passwordless unlock (S0)" in the table, which is represented as process (3.4). In one embodiment, after the processing is completed, the storage command processing unit can also synchronize the namespace deletion information to the host command processing unit, which is represented as process (3.5).

[0103] like Figure 7 The document also shows a password verification unit used to verify the password entered by the user when executing the NS delete command, and to provide feedback information to the host through the host interface based on the verification result. For example, if the verification is successful, the NS delete command is executed and a successful verification message is provided; if the verification fails, the NS delete command is stopped and a failed verification message is provided. Figure 7 In this embodiment, the NS status judgment unit and the password verification unit belong to the host command processing unit. In other embodiments, these modules can also be implemented independently by the storage command processing unit, or implemented by the host command processing unit and the storage command processing unit in a division of labor.

[0104] The above introduced the handling methods of NS management commands. Next, we will introduce password management commands. Password management commands include: password setting commands, password modification commands, password deletion commands, password authentication commands, and authentication cancellation commands. Password management commands are also custom commands. Figure 8 A password management command processing method according to an embodiment of this application is illustrated. Figure 8 As shown, the password management command processing flow includes steps S501 to S508, which will be explained in detail below.

[0105] Step S501: Receive a password management command from the host. The password management command also indicates a first namespace, meaning the password management command contains an NS ID. For example, a password management command indicating NS0 means that the namespace to be managed by the password management command is namespace NS0.

[0106] Step S502: Query the status of the first namespace. For example, query based on the namespace status table. Based on the status of the first namespace, proceed to step S503 or step S506.

[0107] In one scenario, the process proceeds to step S503. Responding to the unlocked state of the first namespace, a password is set, modified, deleted, or password authentication is canceled for the first namespace. Then, step S504 is executed to perform password verification, specifically verifying the user password for the first namespace. For detailed password verification operations, please refer to [link / reference]. Figure 6 Step S404 is executed. Finally, step S505 is executed to change or maintain the state of the first namespace.

[0108] In another scenario, the process jumps to step S506. Responding to the locked state of the first namespace, password verification is performed on the first namespace to unlock it. It's important to note that "password verification" and "password authentication" are not the same concept. For example, a "password authentication command" is a password management command, while "password verification" is the step required by the password authentication command to verify the user's password. Then, step S507 is executed to verify the user password for the first namespace. For specific password verification operations, please refer to [link / reference needed]. Figure 6 Step S404 is executed. Finally, step S508 is executed, and in response to successful password verification, the state of the first namespace is changed.

[0109] like Figure 8 In this code, steps S503 and S506 are parallel steps and have no sequential relationship. Step S504 is indicated by a dashed box, meaning that the password verification step in step S504 is not mandatory for all password management commands. For example, the password cancellation command, password deletion command, and password modification command can configure password verification steps. The password setting command can omit the password verification configuration step. Specifically, the selection can be based on business logic. Step S507 is indicated by a solid box, meaning that the password authentication command requires password verification. Furthermore, in other embodiments, steps S504 and S507 can be executed before step S502, i.e., password verification is performed first, and then the status of the first namespace is queried. Moreover, the operations in steps S505 and S508 that change the status of the first namespace can be implemented after the corresponding password management command is executed, or during the execution of the corresponding password management command.

[0110] The querying of the first namespace's state in step S502, and the changing or maintaining of the first namespace's state in steps S506 and S507, indicate that different namespace states result in different password management commands that can be responded to; or in other words, executing different password management commands requires different namespace states. In one embodiment, password management commands include: password setting commands, password modification commands, password deletion commands, password authentication commands, and authentication cancellation commands. To reveal the migration and change patterns of namespace states, Figure 9The state transition diagram of the namespace is shown.

[0111] like Figure 9 As shown, after the first namespace is created, it is in a passwordless unlocked state (S0). In this state, it can respond to password setting commands, allowing the user to set a password. After setting a password, the first namespace is in a password-enabled unlocked state (S1). In this state, it can respond to password modification and password deletion commands. After modifying the password, the first namespace remains in the password-enabled unlocked state (S1). After deleting the password, the first namespace reverts to a passwordless unlocked state (S0).

[0112] Additionally, in the password-unlocked state (S1), the first namespace can also respond to the deauthentication command used to lock the first namespace, causing the state of the first namespace to change from the password-unlocked state (S1) to the password-locked state (S2). In the locked state, the first namespace can respond to the password authentication command, and after successful password authentication, the first namespace changes from the password-locked state (S2) to the password-unlocked state (S1).

[0113] In one embodiment, the passwordless unlock state (S0) and the password-enabled unlock state (S1) are collectively referred to as the unlock state. In the unlock state, the first namespace can respond to the IO commands and NS management commands described above. In the locked state (S2), the first namespace cannot respond to the IO commands and NS management commands described above. A password authentication command is required to unlock the first namespace before it can respond to IO commands, NS management commands, and other password management commands. The significance is that by locking the first namespace, unauthorized operations can be prevented from being performed on it.

[0114] Using the example in Table 2, for instance, if the current password management command is a password setting command, indicating namespace NS0, and according to step S502, the status of namespace NS0 is found to be a passwordless unlock state, then in step S504, in response to the password setting command, the user-input password is set as the user password for namespace NS0. In step S505, the status of NS0 is changed to a password-enabled unlock state.

[0115] For example, if the current password management command is a password setting command, specifying namespace NS1, then according to step S502, the status of namespace NS1 is found to be a password-unlocked state. Figure 9 The state transition diagram shown indicates that the password unlock state cannot respond to the password setting command, so it does not respond to the password setting command. At this time, a status error message can be sent to the host.

[0116] For example, if the current password management command is a password change command, indicating namespace NS1, then in step S502, if the status of namespace NS1 is found to be a password-unlocked state, then according to... Figure 9 The state transition diagram shown indicates that in step S503, in response to the password modification command, a new user password is set for namespace NS1 to replace the old user password. In step S505, the state of namespace NS1 remains in the password-unlocked state.

[0117] For example, if the current password management command is a password deletion command, indicating namespace NS1, then in step S502, if the status of namespace NS1 is found to be a password-unlocked state, then according to... Figure 9 The state transition diagram shown indicates that in step S503, in response to the password deletion command, the user password for namespace NS1 is deleted. In step S505, the state of namespace NS1 is changed to a passwordless unlocked state.

[0118] For example, if the current password management command is a password deletion command, indicating namespace NS0, in step S502, the status of namespace NS0 is found to be unlocked without a password. According to... Figure 9 The state transition diagram shown indicates that the password-free unlock state cannot respond to the password deletion command, and therefore does not respond to the password deletion command. At this time, a state error message can be sent to the host.

[0119] For example, if the current password management command is a password authentication command, indicating namespace NS2, and in step S502, the status of namespace NS2 is found to be locked, then... Figure 9 The state transition diagram, in step S506, responds to the password authentication command. When the password authentication is successful, in step S508, the state of namespace NS2 is changed to the password-unlocked state. In other words, changing the state of a namespace from locked to unlocked is the result of responding to the password authentication command.

[0120] For example, if the current password management command is a cancel authentication command, indicating namespace NS1, in step S502, the status of namespace NS1 is found to be a password-unlocked state. Figure 9 The state transition diagram described above responds to the cancellation authentication command in step S503 and changes the state of namespace NS1 to a locked state in step S505. In other words, changing the state of a namespace from unlocked to locked is the result of responding to the cancellation authentication command.

[0121] The conditions required to execute a password setting command are: the namespace it points to must be in a password-free unlocked state; the conditions required to execute a password modification or password deletion command are: the namespace it points to must be in a password-enabled unlocked state; the conditions required to execute a password authentication command are: the namespace it points to must be in a locked state; and the conditions required to execute a deauthentication command are: the namespace it points to must be in a password-enabled unlocked state. If the current namespace state does not meet the conditions for executing the above password management commands, a command execution failure message can be returned to the host.

[0122] In the above password verification steps, in response to the password management command (password modification command), the second password entered by the user is matched with the saved first password. If the match is successful, it indicates that the user is authorized. Then, the first password is updated according to the new password entered by the user. The first password is the user password set by the user.

[0123] In one embodiment, the namespace in the passwordless unlock state still has a default password. In the above password verification step, in response to the password management command being a password deletion command, the second password entered by the user is matched with the saved first password. If the match is successful, it indicates that the user is an authorized user, and then the first password is updated to the default password.

[0124] Figure 10 An apparatus for managing namespaces according to an embodiment of this application is shown for processing password management commands.

[0125] like Figure 10 As shown, the password management command received from the host via the host interface is forwarded to the host command processing unit, as represented by process (4.1). The NS status judgment unit in the host command processing unit queries the namespace status table in DRAM. If the password management command does not match the namespace status it indicates, a status error message is returned to the host via the host interface, as represented by process (4.9). Whether there is a match or not can be determined based on... Figure 9 The state transition diagram is used for judgment. For example, if the password setting command indicates namespace NS1, but namespace NS1 is not in the passwordless unlock state, the password setting command does not match the state of the namespace it indicates. The host command processing unit returns a state error message to the host through the host interface.

[0126] If the password management command matches the namespace state it indicates, then optionally, the password entered by the user can be verified by the password verification unit. If the verification fails, an authorization error message is returned to the host via the host interface. Similar to the foregoing, the password verification unit is an optional unit, indicated by dashed lines; in other embodiments, the password verification unit can be implemented in the stored command processing unit.

[0127] The host command processing unit forwards the password management command to the storage command processing unit, as shown in process (4.3). The storage command processing unit processes the password management command, changing or maintaining the state of the namespace in the namespace state table in DRAM, as shown in process (4.4). In one embodiment, after the storage command processing unit completes its processing, it also synchronizes the relevant namespace information to the host command processing unit, as shown in process (4.5). For example, when the cancellation authentication command is executed, the corresponding namespace becomes locked, and the storage command processing unit sends a notification to the host command processing unit that the corresponding namespace state has become locked.

[0128] The above describes the processing methods and apparatus for NVMe commands, NS management commands, and password management commands. The NVMe commands include a first display command, and the password management commands include a second display command. Both the first and second display commands are used by the host to display namespaces, showing the user the available namespaces and their status. The first display command is an `identify` command defined by the NVMe protocol. Since the NVMe protocol does not define encrypted management of namespaces, after receiving the first display command, the SSD controller performs an operation: querying the status of each namespace in the SSD and only feeding back information about unlocked namespaces to the host, not information about locked namespaces. Therefore, the host can only display information about unlocked namespaces, not locked namespaces. Furthermore, since the solution provided in this application embodiment implements encrypted management of each namespace through password management commands, a portion of the namespaces in the storage device are locked (encrypted). To display the locked namespaces, this application designs a second display command using password management commands. After receiving the second display command, the SSD controller queries the status of each namespace in the SSD and feeds back the information of all namespaces to the host, so that the information of all namespaces is displayed on the host, including both unlocked and locked namespaces, thereby compensating for the shortcomings of the first display command. In addition, the significance of setting up the first and second display commands also includes: providing the first display command to general users and the second display command to users with management privileges. This division of permissions not only ensures general use but also provides a certain level of security.

[0129] Figure 11 This demonstrates the processing flow of the first display command. For example... Figure 11The process begins with step S601, receiving a first display command; then step S602, querying the status of each namespace; and finally step S603, reporting back to the host interface the namespaces in the unlocked state. For example (based on Table 2), after receiving the first display command, the NS IDs of namespaces NS0 and NS1 are reported back to the host interface, and the status of namespace NS0 can be reported simultaneously as unlocked without a password, and the status of namespace NS1 as unlocked with a password. The host interface forwards the information to the host, which then displays the information according to its display program, for example, displaying two drive letters corresponding to namespaces NS0 and NS1 respectively.

[0130] The first display command can be executed after responding to NS management commands or password management commands, and is used to promptly report the current namespace status to the host. For example, combined with... Figure 7 Before namespace NS3 is created, the first display command is executed, which returns the NS IDs of namespaces NS0 and NS1. After namespace NS3 is created, the first display command is executed again, which returns the NS IDs of namespaces NS0, NS1, and NS3.

[0131] Figure 12 The processing flow of the second display command is demonstrated. For example... Figure 12 As shown, first, step S701 is executed to receive the second display command; then step S702 is executed to query the status of all namespaces; finally, step S703 is executed to return the NS IDs and statuses of all namespaces. For example (based on Table 2), after receiving the second display command, the NS IDs of namespaces NS0, NS1, and NS2 are returned, and the status of the namespaces can also be returned simultaneously. After receiving the feedback signal, the host can call the display program to display the namespaces, showing the three drive letters and the status of each drive letter. For example, it can show that drive NS0 and drive NS1 are in the unlocked state without a password, drive NS1 and drive NS2 are in the unlocked state with a password, and drive NS2 and drive NS2 are in the locked state.

[0132] Based on the first and second display commands mentioned above, namespaces can be dynamically hidden, meaning that ordinary users can only view unlocked namespaces, while authorized users can view all namespaces.

[0133] The above details the processing methods of various host commands and the circuit structure of related controllers. The key to this application lies in the judgment, maintenance, and modification of namespace states. The following section reviews the above content in the context of specific application scenarios to provide a deeper understanding of namespace state changes. Figures 13-16It demonstrates specific application scenarios, where NS1, NS2, etc. represent various namespaces; different fill patterns represent different states of the namespace; and the vertical axis represents the state change process of a namespace over time.

[0134] Figure 13 This demonstrates an application scenario where, before power-down, the states of namespaces NS1, NS2, NS3, and NS4 are respectively: unlocked without a password, unlocked with a password, unlocked with a password, and unlocked without a password. After the power-down process, upon power-up, each namespace retains its pre-power-down state. In particular, namespaces NS2 and NS3 retain their previous states after power-up.

[0135] Figure 14 Another application scenario is demonstrated, in which, before power-down, the states of namespaces NS0, NS1, NS2, NS3, and NS4 are respectively: unlocked without password, unlocked with password, unlocked with password, and unlocked without password. After power-down, upon power-up, namespaces NS1 and NS4 remain in the unlocked without password state, while namespaces NS2 and NS3 become locked with password.

[0136] according to Figure 14 Application scenarios, combined Figure 9 The state transition graph requires authentication of namespaces NS2 and NS3 before they can transition to a password-protected unlock state. In other words, in... Figure 14 In this application scenario, after power-on, namespaces NS2 and NS3 cannot be viewed via the first display command. Namespaces NS2 and NS3 are in a protected state, preventing unauthorized operations by unauthorized users and thus improving namespace security.

[0137] From a product design perspective, the system can be designed to change the namespace from a password-unlocked state to a password-locked state upon power-up, or it can be designed to leave the namespace in its original state upon power-up.

[0138] Figure 15This demonstrates another application scenario, showing the response of namespaces to the first and second display commands. The states of namespaces NS1, NS2, NS3, and NS4 are respectively: unlocked without password, unlocked with password, unlocked with password, and locked with password. When responding to the first display command based on NVMe, information about namespaces NS1, NS2, and NS3 is returned for the host to display. When responding to the second display command based on password management, information about namespaces NS1, NS2, NS3, and NS4 is returned for the host to display. Therefore, the second display command can be used to view namespaces in a password-locked state. Furthermore, depending on business needs, the status of namespaces can be viewed using either the first or second display commands.

[0139] Figure 16 This demonstrates an application scenario showcasing the responses of various namespaces to NS management and password management commands. Namespace NS0, initially unlocked without a password, is deleted after responding to the NS delete command. Namespace NS1, initially unlocked without a password, transitions to a password-enabled unlocked state after responding to the password set command. Namespace NS2, initially unlocked with a password, transitions to a passwordless unlocked state after responding to the password delete command. Namespace NS3, initially unlocked with a password, remains password-enabled after responding to the password change command. Upon further responding to the cancel authentication command, it transitions to a password-locked state. Namespace NS4, initially locked with a password, transitions to a password-enabled unlocked state after responding to the password authentication command. Additionally, namespace NS5 is created in response to the NS create command, and is initially unlocked without a password. Furthermore, namespaces NS1, NS2, NS3, and NS4 can respond to IO commands and maintain their own states.

[0140] The above content explained the method of managing namespaces from the perspective of interface control. The following describes a method for managing data encryption and decryption keys according to an embodiment of this application, analyzed and explained from the perspective of cryptographic management. It should be noted that the data encryption and decryption keys in this document are a collective term for both encryption and decryption keys.

[0141] Figure 17a A flowchart illustrating a method for managing data encryption / decryption keys according to this application is shown. Referring to Figure 17, the method includes: Step S801: Obtain the first random data (TRNG_Data_2), the storage device identification code (chip ID), and the second random data (LOC_TRNG_2). Based on the first random data (TRNG_Data_2), the storage device identification code (chip ID), and the second random data (LOC_TRNG_2), obtain the encryption key or decryption key (last_rk) corresponding to one or more namespaces in the storage device.

[0142] Step S802: In response to adjusting the user password of the namespace, the encryption key or decryption key corresponding to the namespace remains unchanged.

[0143] For each namespace, symmetric encryption algorithms can be used for data encryption and decryption, such as the Advanced Encryption Standard (AES). Alternatively, asymmetric encryption algorithms can be used, meaning the encryption and decryption keys for each namespace can be the same or different. For example, if the encryption and decryption keys are the same, the encryption or decryption key can be obtained using the following method.

[0144] As an example Figure 17b A flowchart illustrating the method for generating data encryption / decryption keys according to this application is shown.

[0145] First, the first random data (TRNG_Data_2) is obtained from the first one-time programmable device, and the first random data (TRNG Data_2) is hashed to obtain the first hash value (TRNG_Hash_2[127:0]).

[0146] Then, the storage device identification code (chip ID) and the second random data (LOC_TRNG_2) are obtained from the second one-time programmable device, and a hash operation is performed on the storage device identification code (chip ID) and the second random data (LOC_TRNG_2) to obtain the second hash value (Loc_TID_Hash[255:0]).

[0147] Finally, the first hash value (TRNG_Hash_2[127:0]) and the second hash value (Loc_TID_Hash[255:0]) are encrypted to obtain the data encryption / decryption key or the encryption key (last_rk) corresponding to the first namespace in the storage device.

[0148] The encryption algorithm used is the SM4 algorithm. SM4 is a block cipher standard, released by the State Cryptography Administration on March 21, 2012. The relevant standard is "GM / T 0002-2012 'SM4 Block Cipher Algorithm'". SM4 is mainly used for data encryption, with both the block length and key length being 128 bits. Optionally, encryption algorithms such as AES can also be applied to the embodiments according to this application.

[0149] In this embodiment, the hash operation uses the SM3 algorithm. SM3 is a cryptographic hash function standard. The SM3 algorithm used in this embodiment is, for example, the one issued by the State Cryptography Administration on March 21, 2012, with the relevant standard being "GM / T 0004-2012 'SM3 Cryptographic Hash Algorithm'", or the one implemented by the State Cryptography Administration on March 1, 2017, with the relevant standard being "GB / T 32905-2016 Information Security Technology SM3 Cryptographic Hash Algorithm". SM3 is mainly used for digital signature and verification, message authentication code generation and verification, random number generation, etc., and its security and efficiency are comparable to SHA-256. Optionally, hash algorithms such as MD5 and SHA can also be applied to transform the first random data according to this embodiment.

[0150] The first random data (TRNG Data_2) is transformed using the SM3 algorithm to obtain a first hash value (TRNG_Hash_2[127:0]). In this embodiment, the first hash value is the first 128 bits of the first random data. More specifically, the first hash value is not limited to the first 128 bits of the first random data. Optionally, the SM3 algorithm can transform the data to a preset length. For example, the preset length is 256 bits, etc. The preset length can be configured according to requirements, and this application does not limit the preset length.

[0151] In this embodiment, a user password setting function is configured for each namespace, allowing users to manage user passwords for each namespace, such as setting, modifying, deleting, or canceling password authentication. According to the method of this application, if a user modifies the password set in the first namespace (including changing the default password to a new user password, or changing an old user password to a new one), the encryption key or decryption key (last_rk) corresponding to the first namespace remains unchanged. The significance of this method lies in improving user experience because, in existing technical solutions, the keys for encrypting and decrypting user data are associated with the user-set password. If a user changes the password for a namespace during use, according to existing solutions, it is necessary to read and decrypt all data in that namespace using the old encryption key or decryption key, then encrypt this data using the new encryption key or decryption key generated from the new password, and rewrite it into the namespace. When the data volume is large, the time consumed by this process is unacceptable to users. In the technical solution of this application, when the password changes, the password key used to verify the password changes accordingly and is stored in off-chip memory (the application of the password key is prior art and will not be elaborated here); while the encryption key or decryption key remains unchanged. Therefore, even if the password changes, since the encryption key or decryption key remains unchanged, there is no need to repeatedly decrypt and encrypt user data as in existing technologies, thereby greatly improving processing efficiency and user experience.

[0152] In one embodiment, the encryption key or decryption key (last_rk) is stored in the buffer memory (e.g., DRAM) of the storage device. The data stored in the buffer memory is lost when the storage device loses power, thereby ensuring the security of the key.

[0153] A storage device can have multiple namespaces, and one or more namespaces can share the same encryption or decryption key (last_rk). That is, for a storage device containing multiple namespaces, it can use a single encryption or decryption key (last_rk) to encrypt or decrypt data in all namespaces, or it can have multiple different encryption or decryption keys, ensuring that any two namespaces have different encryption or decryption keys; or multiple namespaces can share the same encryption or decryption key.

[0154] In one embodiment, when an I / O command indicating a first namespace is received, if the I / O command is a read command, the encryption key or decryption key is used to decrypt the data retrieved from the first namespace. If the I / O command is a write command, the encryption key or decryption key is used to encrypt the data moved into the first namespace.

[0155] Furthermore, when multiple IO commands are received, and multiple first namespaces are specified, if these first namespaces have the same encryption key or decryption key, the same encryption key or decryption key is used to encrypt or decrypt the data corresponding to these first namespaces; if these first namespaces have different encryption keys or decryption keys, the encryption key or decryption key corresponding to each first namespace is called to encrypt or decrypt the data corresponding to it.

[0156] Furthermore, when a password management command that specifies the first namespace is received, regardless of the type of the password management command or the operation performed on the first namespace based on the type of the password management command (i.e., setting a password, modifying a password, deleting a password, authenticating a password, or canceling password authentication), the encryption key or decryption key of the first namespace remains unchanged.

[0157] In addition, when the NS creation command is received, a second namespace is created, and an encryption key or decryption key is set for the second namespace. The second namespace can be set with the same encryption key or decryption key as other namespaces, or it can be set with an encryption key or decryption key that is different from other namespaces.

[0158] For example, if the encryption or decryption key of the second namespace is the same as the encryption or decryption keys of other namespaces in the storage device, then the encryption or decryption key of the second namespace can be set based on the encryption or decryption keys of the other namespaces. If the encryption or decryption key of the second namespace is different from the encryption or decryption keys of other namespaces in the storage device, then a new encryption or decryption key needs to be generated for the second namespace. For example, multiple sets of one-time programmable devices (a first one-time programmable device and a second one-time programmable device) can be set in the storage device, with each namespace corresponding to a set of one-time programmable devices. The encryption or decryption key of each namespace is obtained by performing a hash operation on the data stored in the one-time programmable device corresponding to each namespace. In another example, a one-time programmable device can be set up in the storage device to store the first random data, and another one-time programmable device can be set up to store the chip ID and the second random data. Since each namespace only uses 128 bits of data from the first and second random numbers when generating encryption or decryption keys, and the storage capacity of each one-time programmable device is generally a few KB or tens of KB, the number of bits in the first and second random numbers is much smaller than the capacity of the one-time programmable device. In other words, two one-time programmable devices are sufficient to meet the needs of multiple namespaces. When generating encryption or decryption keys for different namespaces, different bits of data from the first and second random numbers can be used.

[0159] Figure 18 It demonstrates the process of generating password keys and encryption or decryption keys (e.g., encryption and decryption keys can be the same). In fact, Figure 17b yes Figure 18 Part of it. Figure 18 In this process, the generation of the password key and the generation of the encryption key or decryption key share the first hash value (TRNG_Hash_2[127:0]) obtained by converting the first random data (TRNG_Data_2). The generation process of the password key will be explained in detail below.

[0160] The password keys include: the original key (C_Pin_Hash), the first-level key (C_TRNG_Hash_1), and the second-level key (C_TRNG_Hash_2).

[0161] The method for generating the original key (C_Pin_Hash) includes: obtaining the user password and a one-time programmable third random data (LOC_TRNG_1); converting the concatenated user password and the one-time programmable third random data using a hash algorithm to obtain the user password hash value (Loc_THash[127:0]). Obtaining the default password and converting it using a hash algorithm to obtain the default password hash value (UPIN_Hash[127:0]). Encrypting the user password hash value (Loc_THash[127:0]) and the default password hash value (UPIN_Hash[127:0]) to obtain the original key (C_Pin_Hash).

[0162] Regarding the conversion method using a hash algorithm, the SM3 algorithm can be used; alternatively, the SM4 algorithm can be used for encryption.

[0163] The method for generating the primary key (C_TRNG_Hash_1) includes: obtaining the user password and storage device identification code, or obtaining the default password and storage device identification code. A hash algorithm is used to convert the concatenated user password and storage device identification code, or a hash algorithm is used to convert the concatenated default password and storage device identification code, to obtain a fourth hash value (UID_Hash[127:0]). Truly random data (TRNG_Data_1) is obtained. The truly random data (TRNG_Data_1) is converted using a hash algorithm to obtain the primary key hash value (TRNG_Hash_1[127:0]). The fourth hash value (UID_Hash[127:0]) and the primary key hash value (TRNG_Hash_1[127:0]) are encrypted to obtain the primary key (C_TRNG_Hash_1).

[0164] It's important to note that the generation process of the first-level key (C_TRNG_Hash_1) yields truly random data (TRNG_Data_1). The aforementioned one-time programmable data is stored in a one-time programmable (OTP) memory, which can only be written to (programmed) once during its lifetime and cannot be modified afterward. For example, if a user programs the OTP memory to have a value of 0xFFFFFFFE, that value will remain 0xFFFFFFFE forever and cannot be rewritten to any other value. The truly random data (TRNG_Data_1), on the other hand, is generated by a hardware random number generator, used to generate random numbers based on physical processes rather than computer programs. Such devices are typically based on microscopic phenomena that generate low-level, statistically random "noise" signals, such as thermodynamic noise, the photoelectric effect, and quantum phenomena. These physical phenomena are theoretically completely unmeasurable and uncontrollable, thus possessing excellent randomness. A random number generator consists of a transducer, an amplifier, and an analog-to-digital converter. The transducer converts certain effects of the aforementioned microscopic phenomena into electrical signals, the amplifier amplifies the amplitude of these electrical signals to a macroscopic level, and the analog-to-digital converter converts the output into binary numbers. By repeatedly sampling these random signals, a series of random numbers are generated.

[0165] The method for generating the secondary key (C_TRNG_Hash_2) includes: encrypting the hash value of the primary key (TRNG_Hash_1 [127:0]) and the first hash value (TRNG_Hash_2 [127:0]) to obtain the secondary key (C_TRNG_Hash_2).

[0166] As can be seen from the above password key generation process, the encryption key or decryption key and the password key share the same first hash value (TRNG_Hash_2[127:0]), thereby reducing hardware consumption and cost. Furthermore, although the first hash value (TRNG_Hash_2[127:0]) is shared, it is generated by a one-time programmable device and is not affected by the user's password. Therefore, the encryption key or decryption key will not change due to changes in the user's password.

[0167] As an example, in addition to managing the encryption or decryption keys of the namespace as described above, the controller can also process received commands. In this embodiment, the received commands can be host commands sent by the host to the SSD through the host interface, or other commands. Host commands include IO commands (further divided into read commands and write commands), NS management commands, and password management commands. Furthermore, in this embodiment, since user passwords can be set for each namespace, the namespace's state is divided into unlocked state (further divided into password-protected unlocked state and passwordless unlocked state) and locked state based on the namespace's user password settings.

[0168] For example, for a read command, the method includes the following steps: in response to obtaining a first read command to access a first namespace, obtaining a first decryption key corresponding to the first namespace; accessing the storage medium according to the first read command to obtain first ciphertext data, and decrypting the first ciphertext data using the first decryption key to obtain first decrypted data as the data to be read by the first read command. For a write command, the method includes the following steps: in response to obtaining a first write command to access a first namespace, obtaining a first encryption key corresponding to the first namespace; encrypting the first plaintext data to be written by the first write command according to the first encryption key, and writing the encrypted first encrypted data into the storage medium.

[0169] For example, when the first namespace is in an unlocked state, the host has permission to access the first namespace. That is, the host can access the first namespace in the storage device according to IO commands, and during the access to the first namespace, the host can use the first encryption key or the first decryption key corresponding to the first namespace to encrypt or decrypt the data to be accessed.

[0170] Storage devices may typically have multiple namespaces, and the same encryption or decryption key can be used for different namespaces, or different encryption or decryption keys can be used.

[0171] For example, for a second namespace different from the first namespace, and the second namespace is in an unlocked state, the method for processing commands includes: in response to receiving a second read command to access the second namespace, obtaining a second decryption key corresponding to the second namespace, wherein the second decryption key is the same as or different from the first decryption key; accessing the storage medium according to the second read command to obtain second ciphertext data, and decrypting the second ciphertext data using the second decryption key to obtain second decrypted data as the data to be read by the second read command. In response to receiving a second write command to access the second namespace, obtaining a second encryption key corresponding to the second namespace, wherein the second encryption key is the same as or different from the first encryption key; encrypting the second plaintext data to be written by the second write command according to the second encryption key, and writing the encrypted second encrypted data into the storage medium.

[0172] As can be seen from the above method embodiments, the second decryption key may be the same as or different from the first decryption key, and the second encryption key may be the same as or different from the first encryption key.

[0173] In one application scenario, the first namespace is in a locked state or a password-unlocked state. In response to obtaining the first read command or the first write command, wherein the first namespace is in a password-unlocked state or a locked state, a first feedback message indicating failure to access the first namespace is generated and sent to the host.

[0174] For example, reasons for failure to access the first namespace include: 1. The first namespace is locked and therefore cannot respond to any I / O commands. 2. The first namespace is in a password-protected unlocked state, requiring password verification before I / O commands can be responded to.

[0175] In this embodiment, user password verification is not an operation required for every host command received, but rather determined based on the information sent by the host. For example, in response to receiving the first user password and the first read command, wherein the first namespace is in a password-unlocked state, the first password key corresponding to the first namespace is obtained, and the first user password is verified using the first password key. In response to passing the verification, the first ciphertext data is decrypted using the first decryption key to obtain the first decrypted data. In response to failing the verification, the aforementioned first feedback information is generated.

[0176] The acquisition of the user's initial password and the first read command can be achieved by simultaneously receiving both; or by receiving the first read command first, followed by the first user password; or by receiving the first user password first, followed by the first read command. In one implementation scenario, the SSD can proactively request the host to provide the initial password after receiving the first read command.

[0177] Similarly, in response to obtaining the first user password and the first write command, wherein the first namespace is in a password-unlocked state, the first password key is obtained, and the first user password is verified according to the first password key; in response to passing the verification, the first plaintext data is encrypted according to the first encryption key to obtain the first encrypted data, and the first encrypted data is written to the storage medium. In response to failing the verification, the aforementioned first feedback information is generated.

[0178] For the second namespace, which is different from the first namespace, the way it responds to IO commands is the same as that of the first namespace, so it will not be described again. It should be noted that the first password key and the second password key can be the same or different.

[0179] For example, if both the first and second namespaces are in a passwordless unlocked state, since the first and second namespaces can have the same default password, the first password key generated based on the default password can be the same as the second password key.

[0180] For example, if one of the first namespace and the second namespace is in a passwordless unlock state and the other is in a password-enabled unlock state, the first password key and the second password key are different because the namespace in the passwordless unlock state has a default password, while the namespace in the password-enabled unlock state has a user password that has been set by the user.

[0181] For example, if both the first namespace and the second namespace are in a password-protected unlocked state, since the user passwords corresponding to the first namespace and the second namespace can be the same or different (completely determined by the user's preset), the first password key and the second password key can be the same or different.

[0182] In this embodiment, the host can use the first encryption key or the first decryption key corresponding to the first namespace to encrypt or decrypt the data to be accessed during the process of accessing the first namespace. It can also manage the user passwords of the first namespace. For example, it can set, modify, delete or cancel password authentication for the first namespace based on password management commands.

[0183] The namespace has two states: unlocked (further divided into password-protected and passwordless unlocked states) and locked. Different namespace states respond to different password management commands. However, regardless of the password management command, the first encryption key or first decryption key corresponding to the first namespace remains unchanged. For example, if the first namespace is in the unlocked state, a user password can be set, modified, or deleted according to the password management commands. These password management commands are password setting, password modification, and password deletion commands. In the unlocked state, the first namespace can respond to these commands. While responding to these commands, the first encryption key or first decryption key of the first namespace remains unchanged.

[0184] In addition, in the unlocked state, the first namespace can also respond to the cancel password authentication command, thus canceling password authentication for the first namespace. Similarly, while responding to the aforementioned cancel password authentication command, the first encryption key or the first decryption key of the first namespace remains unchanged.

[0185] Furthermore, if the first namespace is locked, it can respond to the password authentication command to perform password authentication for itself. Similarly, while responding to the above password authentication command, the first encryption key or the first decryption key of the first namespace remains unchanged.

[0186] For example, the password key and the encryption or decryption key are not related. Therefore, no matter how a user changes their password (resulting in a password change), it will not affect the encryption or decryption key. When accessing data, it is not necessary to first perform a decryption operation using the key corresponding to the user's password before the change, and then perform a encryption operation using the key corresponding to the user's password after the change. This provides encryption and decryption functions for data in the namespace while meeting the requirement of low latency. In addition, password management operations do not change the encryption and decryption keys, ensuring the isolation between the user password and the encryption or decryption key.

[0187] In addition, this application also provides a controller, the overall structure of which can be seen from [reference needed]. Figure 1B The control component 104, specifically, refers to Figure 1B The controller may include a host command processing unit and a storage command processing unit. The host command processing unit is used to parse the first command and instruct the storage command processing unit according to the parsing result. The storage command processing unit is used to execute the operation corresponding to the first command according to the instruction, and to change or maintain the state of the first namespace. The controller described above can process NVMe commands, NS management commands, and password management commands to implement this application. Figures 2-18The method steps of various embodiments are described above. Since the relevant methods and circuit structures have been described in detail above, they will not be repeated here. Specifically, the internal structure and processing of the controller can be found in [reference needed]. Figure 4 , Figure 5 , Figure 7 and Figure 10 .

[0188] In addition, embodiments of this application also provide a storage device, namely, as Figure 1A , Figure 1B The storage device 102 shown includes an interface 103, a control unit 104, one or more NVM chips 105, and DRAM 110. The control unit includes control unit 104, which processes first commands from the host to implement the present application. Figures 2-18 The method steps of various embodiments are described in detail above, and since the relevant methods and circuit structures have been described in detail, they will not be described in detail here.

[0189] It should be noted that, for the sake of brevity, this application describes some methods and their embodiments as a series of actions and combinations thereof. However, those skilled in the art will understand that the solution of this application is not limited to the order of the described actions. Therefore, based on the disclosure or teachings of this application, those skilled in the art will understand that some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art will understand that the embodiments described in this application can be considered as optional embodiments, that is, the actions or modules involved are not necessarily essential for the implementation of one or more solutions of this application. In addition, depending on the solution, the description of some embodiments in this application also has different emphases. In view of this, those skilled in the art will understand that parts not described in detail in a certain embodiment of this application can also be referred to the relevant descriptions of other embodiments.

[0190] In terms of specific implementation, based on the disclosure and teachings of this application, those skilled in the art will understand that the several embodiments disclosed in this application can also be implemented in other ways not disclosed herein. For example, regarding the various units in the electronic device or device embodiments described above, this document has divided them based on logical functions, but in actual implementation, there may be other ways of division. As another example, multiple units or components can be combined or integrated into another system, or some features or functions in a unit or component can be selectively disabled. Regarding the connection relationship between different units or components, the connection discussed above in conjunction with the accompanying drawings can be a direct or indirect coupling between units or components. In some scenarios, the aforementioned direct or indirect coupling involves a communication connection utilizing an interface, wherein the communication interface can support electrical, optical, acoustic, magnetic, or other forms of signal transmission.

[0191] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application. Clearly, those skilled in the art can make various alterations and variations to this application without departing from its spirit and scope. Thus, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for processing commands, characterized in that, include: In response to receiving a read command or write command to access the first namespace, the read command or write command is processed according to the state of the first namespace; wherein, the state of the namespace includes an unlocked state and a locked state; the unlocked state includes an unlocked state without a password and an unlocked state with a password; If the first namespace is in a password-free unlocked state, the read command or write command is executed to move the data in the physical address space corresponding to the first namespace. If the first namespace is in a password-unlocked or locked state, the read or write command will not be processed, and a message indicating that the read or write command processing failed will be generated and sent to the host.

2. The method according to claim 1, characterized in that, In response to receiving a first read command to access the first namespace, wherein the first namespace is in a password-free unlocked state, a first decryption key corresponding to the first namespace is obtained; the storage medium is accessed according to the first read command to obtain first ciphertext data, and the first ciphertext data is decrypted using the first decryption key to obtain first decrypted data as the data to be read by the first read command.

3. The method according to claim 1 or 2, characterized in that, In response to receiving a first write command to access the first namespace, wherein the first namespace is in a password-free unlocked state, a first encryption key corresponding to the first namespace is obtained; the first plaintext data to be written by the first write command is encrypted according to the first encryption key, and the encrypted first encrypted data is written to the storage medium.

4. The method according to claim 2 or 3, characterized in that, in, In response to obtaining the first user password and the first read command or the first write command input by the user, wherein the first namespace is in a password-unlocked state, the first password key corresponding to the first namespace is obtained, and the first user password is verified according to the first password key; In response to passing the verification, a first decryption key corresponding to the first namespace is obtained; the storage medium is accessed according to the first read command to obtain the first ciphertext data, and the first ciphertext data is decrypted using the first decryption key to obtain the first decrypted data; or a first encryption key corresponding to the first namespace is obtained; and the first plaintext data to be written by the first write command is encrypted according to the first encryption key.

5. The method according to any one of claims 2-4, characterized in that, In response to receiving a second read command to access a second namespace, wherein the second namespace is in a password-free unlocked state, a second decryption key corresponding to the second namespace is obtained, wherein the second decryption key is the same as or different from the first decryption key; Access the storage medium according to the second read command to obtain the second ciphertext data, and use the second decryption key to decrypt the second ciphertext data to obtain the second decrypted data as the data to be read by the second read command.

6. The method according to claim 5, characterized in that, in, In response to both the first namespace and the second namespace being in a password-free unlocked state, the first password key is the same as the second password key; In response to one of the first namespace and the second namespace being in a passwordless unlock state and the other being in a password-enabled unlock state, the first password key and the second password key are different; In response to the fact that both the first namespace and the second namespace are in a password-unlocked state, and the user passwords corresponding to the first namespace and the second namespace are the same, the first password key is the same as the second password key; In response to the fact that both the first namespace and the second namespace are in a password-unlocked state, and the user passwords corresponding to the first namespace and the second namespace are different, the first password key and the second password key are different.

7. The method according to any one of claims 1-6, characterized in that, in, In response to receiving a password management command for managing a first namespace, wherein the first namespace is in an unlocked state, a user password is set, modified, or deleted for the first namespace according to the password management command, while keeping the first encryption key or the first decryption key unchanged.

8. The method according to claim 7, characterized in that, in, In response to receiving the password management command, wherein the first namespace is in an unlocked state, the password authentication for the first namespace is canceled according to the password management command, while the first encryption key or the first decryption key remains unchanged.

9. The method according to claim 7 or 8, characterized in that, in, In response to receiving the password management command, wherein the first namespace is in a locked state, password authentication is performed on the first namespace according to the password management command, while keeping the first encryption key or the first decryption key unchanged.

10. A storage device, characterized in that, It includes a storage medium and a controller, the controller being used to implement the method as claimed in any one of claims 1 to 9.

Images