Erasure Coding for a Single-Image Memory

Abstract

Generate an erasure code for data in the following manner: calculate the size and bytes of an erasure code block, calculate the number of stripes for the erasure code, and generate each stripe for each block of the erasure code such that for each block, the stripes alternate in a pattern, and save the hash value. Repair a portion of the data in the following manner: for each block of the portion of the data, calculate the stripes of the block, identify each of the following hash values as a bad block for which the hash value of the block of the portion of the data does not match the saved hash value of the block, and for each identified bad block, generate a repair block for the bad block based on the stripes of the block and the corresponding block of the data in the erasure coding of the data.

Description

Technical Field

[0001] The present disclosure generally relates to the field of computers, and more particularly to apparatuses, methods, and readable media for data protection. Background Art

[0002] The Internet of Things (“IoT”) generally refers to a system of devices that can communicate over a network. These devices can include everyday items such as toasters, coffee makers, thermostat systems, washing machines, dryers, lights, cars, and so on. Network communication can be used for device automation, data capture, providing alerts, setting personalization, and many other applications. Summary of the Invention

[0003] This “Summary of the Invention” is provided to introduce some concepts in a simplified form that will be further described below in the “Detailed Description”. This “Summary of the Invention” is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0004] Briefly, the disclosed technology generally relates to data protection. In one example of the technology, an erasure code for data is generated as follows: calculate the size and bytes of an erasure code block, calculate the number of stripes for the erasure code, and generate each stripe for each block of the erasure code such that the stripes alternate in a pattern, and save the hash value of each block of the data. In some examples, a portion of the data is repaired as follows: for each block of the portion of the data, calculate the stripe of the block, check the hash value of each block of the portion of the data against the saved hash value of the block, identify each such hash value as a bad block for which the hash value of the block of the portion of the data does not match the saved hash value of the block, and for each identified bad block, generate a repair block for the bad block based on the stripe of the block and the corresponding block of the data in the erasure code for the data, e.g., if there are fewer than or equal to the number of bad blocks defined by the selected fault tolerance in the stripe.

[0005] After reading and understanding the drawings and the specification, other aspects and applications of the disclosed technology will be understood. Brief Description of the Drawings

[0006] Non-limiting and non-exhaustive examples of the present disclosure are described with reference to the accompanying drawings. In the drawings, unless otherwise noted, the same reference numerals refer to the same components in each of the drawings. These drawings are not necessarily drawn to scale.

[0007] For a better understanding of the present disclosure, reference will be made to the following “Detailed Description” which should be read in conjunction with the drawings, in which:

[0008] Figure 1is a block diagram showing an example of a suitable environment in which aspects of the present technology may be employed;

[0009] Figure 2 is a block diagram showing an example of a suitable computing device in accordance with aspects of the disclosed technology;

[0010] Figure 3 is a block diagram showing an example of a system for data security;

[0011] Figure 4 is showing Figure 3 an example of a device controller of;

[0012] Figure 5 is an example data flow for a process of generating an erasure code for data;

[0013] Figure 6 is an example data flow for a process of repairing at least a portion of data; and

[0014] Figure 7 is an example data flow for a process of updating an erasure code in response to a change in data in accordance with aspects of the present disclosure. DETAILED DESCRIPTION

[0015] The following description provides specific details of descriptions of various examples for thoroughly understanding and implementing the technology. Those skilled in the art will understand that the technology can be implemented without many of these details. In some cases, well-known structures and functions are not shown or described in detail to avoid unnecessarily obscuring the description of examples of the technology. The terms used in this disclosure are intended to be interpreted in the broadest reasonable manner even when used in conjunction with the detailed description of some examples of the technology. Although certain terms may be emphasized below, any term that is intended to be interpreted in a restricted manner will be explicitly and specifically defined in the "Detailed Description" section. Throughout the specification and claims, unless the context indicates otherwise, the following terms take at least the meanings explicitly associated herein. The meanings determined below do not necessarily limit the terms but merely provide illustrative examples of the terms. For example, each of the terms "based on" and "based upon" is not exclusive and is equivalent to the term "based, at least in part, on" and includes options based on other factors, some of which may not be described herein. As another example, the term "via" is not exclusive and is equivalent to the term "at least in part via" and includes selections via additional factors, some of which may not be described herein. The meaning of "in" includes "in" and "on". The phrase "in one embodiment" or "in one example" as used herein, although it may, does not necessarily refer to the same embodiment or example. The use of special text numerical indicators does not imply the existence of lower-valued numerical indicators. For example, the statement "a widget selected from a group including a third foo and a fourth bar" does not, by itself, imply the existence of at least three foo nor the existence of at least four bar elements. Unless multiple references are explicitly excluded, singular references are for clarity of reading only and include plural references. Unless explicitly stated otherwise, the term "or" is the inclusive "or" operator. For example, the phrase "A or B" means "A, B, or A and B". As used herein, the terms "component" and "system" are intended to encompass various combinations of hardware, software, or hardware and software. Thus, for example, a system or component can be a process, a process executed on a computing device, a computing device, or a portion thereof.

[0016] Briefly, the disclosed technology generally relates to data protection. In one example of the technology, an erasure code for data is generated as follows: calculating the size and bytes of an erasure code block, calculating the number of stripes for the erasure code, and generating each stripe for each block of the erasure code such that the stripes alternate in a pattern, and saving the hash value of each block of the data. In some examples, a portion of the data is repaired as follows: for each block of the portion of the data, calculating the stripe of the block, checking the hash value of each block of the portion of the data against the saved hash value of the block, identifying each such hash value as a bad block for which the hash value of the block of the portion of the data does not match the saved hash value of the block, and for each identified bad block, generating a repair block for the bad block based on the stripe of the block and the corresponding block of the data in the erasure code for the data, e.g., if there are fewer than or equal to the number of bad blocks defined by the selected fault tolerance in the stripe.

[0017] An erasure coding scheme can be used to generate erasure coded blocks that can be used to restore flash memory from a large number of consecutive corruptions. In some examples, an area (region) of the memory is selected for the erasure code. In one of these examples, a single erasure code stripe consists of a set of data blocks and one or more erasure code blocks that are used to recover lost or corrupted data blocks in the erasure code stripe. In some examples, the stripes are arranged consecutively. In other examples, the stripes are in a "checkerboard" pattern within the region for the erasure code. In some examples, each region is protected by a certain number of stripes by allocating the first block of each stripe to the region before allocating the second block of any stripe, and then allocating the second block of each stripe before allocating the third block of any stripe, such that each stripe is interleaved with the other stripes. Thus, in this example, any block in a single stripe is separated from all other stripes by a single block. In this way, erasure coded blocks can be generated that can be used for recovery in case of corruption.

[0018] Exemplary Device / Operating Environment

[0019] Figure 1 is a diagram of an environment 100 in which aspects of the present technology can be implemented. As shown, environment 100 includes a computing device 110 and a network node 120 that are connected via a network 130. Even though Figure 1 specific components of environment 100 are shown, in other examples, environment 100 may also include additional and / or different components. For example, in certain examples, environment 100 may also include network storage devices, maintenance managers, and / or other suitable components (not shown). Figure 1The computing device 110 shown can be in various positions, including indoors, in the cloud, etc. For example, the computer device 110 can be on the client side, server side, etc.

[0020] As Figure 1 shown, the network 130 can include one or more network nodes 120. The one or more network nodes 120 interconnect multiple computing devices 110 and connect the computing devices 110 to an external network 140 (e.g., the Internet or an intranet). For example, the network node 120 can include a switch, a router, a hub, a network controller, or other network elements. In some examples, the computing devices 110 can be organized into racks, action zones, groups, sets, or other suitable partitions. For example, in the example shown, the computing devices 110 are grouped into three host groups, which are respectively identified as the first, second, and third host groups 112a - 112c. In the example shown, each of the host groups 112a - 112c is operatively coupled to a corresponding network node 120a - 120c, which are commonly referred to as "top-of-rack" or "TOR" network nodes. Then, the TOR network nodes 120a - 120c can be operatively coupled to additional network nodes 120 to form a hierarchical, flat, mesh, or other suitable type of topology computer network that allows communication between the computing devices 110 and the external network 140. In other examples, multiple host groups 112a - 112c can share a single network node 120. The computing device 110 can actually be any type of general-purpose or special-purpose computing device. For example, these computing devices can be user devices, such as desktop computers, laptop computers, tablet computers, display devices, cameras, printers, or smart phones. However, in a data center environment, these computing devices can be server devices, such as application server computers, virtual computing host computers, or file server computers. Additionally, the computing device 110 can be configured individually to provide computing, storage, and / or other suitable computing services.

[0021] In some examples, one or more of the computing devices 110 are IoT devices, devices that include part or all of IoT support services, devices that include part or all of an application backend, etc., as discussed in more detail below.

[0022] Exemplary Computing Device

[0023] Figure 2FIG. 0 is a diagram illustrating one example of a computing device 200 in which aspects of the present technology may be implemented. The computing device 200 may in fact be any type of general-purpose or special-purpose computing device. For example, the computing device 200 may be a user device, such as a desktop computer, laptop computer, tablet computer, display device, camera, printer, or smart phone. Similarly, the computing device 200 may also be a server device, such as an application server computer, virtual computing host computer, or file server computer. For example, the computing device 200 may be Figure 1 an example of the computing device 110 or network node 120 of Figures 3-5 shown or referred to in Figure 2 as discussed in more detail below. As shown in Figure 2 , the computing device 200 includes a processing circuit 210, an operating memory 220, a storage controller 230, a data storage memory 250, an input interface 260, an output interface 270, and a network adapter 280. Each of these previously listed components of the computing device 200 includes at least one hardware element.

[0024] The computing device 200 includes at least one processing circuit 210 configured to execute instructions, such as instructions for implementing the workloads, processes, or techniques described herein. The processing circuit 210 may include a microprocessor, a microcontroller, a graphics processor, a coprocessor, a field-programmable gate array, a programmable logic device, a signal processor, or any other circuit suitable for processing data. The processing circuit 210 is an example of a core. The above instructions, as well as other data (e.g., data sets, metadata, operating system instructions, etc.), may be stored in the operating memory 220 during the runtime of the computing device 200. The operating memory 220 may also include any one of a variety of data storage devices / components, such as volatile memory, semi-volatile memory, random access memory, static memory, cache, buffer, or other media for storing runtime information. In one example, the operating memory 220 does not retain information when the computing device 200 is powered off. Instead, as part of a boot or other loading process, the computing device 200 may be configured to transfer instructions from a non-volatile data storage component (e.g., the data storage component) to the operating memory 220. In some examples, other forms of execution may be employed, such as execution directly from the data storage component, e.g., execute in place (XIP).

[0025] The operating memory 220 may include a fourth-generation double data rate (DDR4) memory, a third-generation double data rate (DDR3) memory, other dynamic random access memories (DRAMs), high bandwidth memories (HBMs), hybrid memory cube memories, 3D stacked memories, static random access memories (SRAMs), magnetoresistive random access memories (MRAMs), pseudo-static random access memories (PSRAMs), or other memories, and such memories may include one or more memory circuits that are integrated onto a DIMM, SIMM, SODIMM, known good die (KGD), or other packaging. Such an operating storage module or device may be organized according to channels, ranks, and banks. For example, the operating storage device may be coupled to the processing circuit 210 via a memory controller 230 in a channel. An example of the computing device 200 may include one or two DIMMs per channel, with each channel having one or two ranks. The operating memory within a rank may operate with a shared clock, shared address, and command bus. Also, the operating storage device may be organized into several memory banks, and the memory banks may be considered arrays addressed by rows and columns. Based on this organization of the operating memory, a physical address within the operating memory may be referenced by a tuple of channel, rank, bank, row, and column.

[0026] Notwithstanding the above discussion, the operating memory 220 specifically does not include or contain a communication medium, any communication media, or any signal per se.

[0027] The memory controller 230 is configured to interface the processing circuit 210 to the operating memory 220. For example, the memory controller 230 may be configured to interface commands, addresses, and data between the operating memory 220 and the processing circuit 210. The memory controller 230 may also be configured to abstract or otherwise manage certain aspects of memory management from or for the processing circuit 210. Although the memory controller 230 is shown as a single memory controller separate from the processing circuit 210, in other examples, multiple memory controllers may be employed, the (one or more) memory controllers may be integrated with the operating memory 220, etc. Further, the (one or more) memory controllers may be integrated into the processing circuit 210. These and other variations are possible.

[0028] In the computing device 200, the data storage memory 250, input interface 260, output interface 270, and network adapter 280 are interfaced to the processing circuit 210 via a bus 240. Although Figure 2Bus 240 is shown as a single passive bus, but other configurations (such as a bus collection, a collection of point-to-point links, input / output controllers, bridges, other interface circuits, or any collection thereof) may also be suitably used to interface data storage memory 250, input interface 260, output interface 270, or network adapter 280 to processing circuit 210.

[0029] In computing device 200, data storage memory 250 is employed for long-term non-volatile data storage. Data storage memory 250 may include any one of a variety of non-volatile data storage devices / components, such as non-volatile memory, disks, disk drives, hard disk drives, solid state drives, or any other medium that can be used for non-volatile storage of information. However, data storage memory 250 specifically does not include or contain a communication medium, any communication medium, or any signal itself. In contrast to operating memory 220, data storage memory 250 is employed by computing device 200 for non-volatile long-term data storage, rather than for runtime data storage. In some examples, performance counter 475 may also be configured to measure the latency from a core to a target (such as from MCU 462 to SRAM 458).

[0030] In addition, computing device 200 may include or be coupled to any type of processor-readable medium, such as processor-readable storage media (e.g., operating memory 220 and data storage memory 250) and communication media (e.g., communication signals and radio waves). Although the term processor-readable storage media includes operating memory 220 and data storage memory 250, the term "processor-readable storage media" throughout the specification and claims, whether used in the singular or plural, is defined herein to specifically exclude and not include communication media, any communication medium, or any signal itself. However, the term "processor-readable storage media" does include processor caches, random access memory (RAM), register memory, and the like.

[0031] The computing device 200 also includes an input interface 260 that can be configured to enable the computing device 200 to receive input from a user or from other devices. Additionally, the computing device 200 includes an output interface 270 that can be configured to provide output from the computing device 200. In one example, the output interface 270 includes a frame buffer, a graphics processor, a graphics processor or accelerator, and is configured to render a display for presentation on a separate visual display device (such as a monitor, a projector, a virtual computing client computer, etc.). In another example, the output interface 270 includes a visual display device and is configured to render and present a display for viewing. In yet another example, the input interface 260 and / or the output interface 270 can include a Universal Asynchronous Receiver / Transmitter (“UART”), a Serial Peripheral Interface (“SPI”), an Inter-Integrated Circuit (“I2C”), General-Purpose Input / Output (GPIO), etc. Additionally, the input interface 260 and / or the output interface 270 can include or be interfaced to any number or type of peripheral devices.

[0032] In the illustrated example, the computing device 200 is configured to communicate with other computing devices or entities via a network adapter 280. The network adapter 280 can include a wired network adapter, such as an Ethernet adapter, a Token Ring adapter, or a Digital Subscriber Line (DSL) adapter. The network adapter 280 can also include a wireless network adapter, such as a Wi-Fi adapter, a Bluetooth adapter, a ZigBee adapter, a Long Term Evolution (LTE) adapter, SigFox, LoRa, a power line, or a 5G adapter.

[0033] Although the computing device 200 is shown as having certain components configured in a particular arrangement, these components and arrangements are merely one example of a computing device that can employ the technology. In other examples, the data storage memory 250, the input interface 260, the output interface 270, or the network adapter 280 can be directly coupled to the processing circuit 210, or can be coupled to the processing circuit 210 via an input / output controller, a bridge, or other interface circuitry. Other variations of the technology are possible.

[0034] Some examples of the computing device 200 include at least one memory (e.g., the operating memory 220) suitable for storing runtime data and at least one processor (e.g., the processing circuit 210) suitable for executing processor-executable code that, in some examples, causes the computing device 200 to perform actions in response to execution.

[0035] Exemplary System

[0036] Some examples of the present disclosure are used in the context of a multi-core microcontroller included in an IoT device and operating as a device controller for the IoT device. Examples of the present disclosure can also be used in other suitable contexts. The following discusses special examples of the present disclosure used in the context of a multi-core microcontroller included in an IoT device and operating as a device controller for the IoT device. Figure 4 Discuss special examples of the present disclosure used in the context of a multi-core microcontroller included in an IoT device and operating as a device controller for the IoT device.

[0037] Figure 3 FIG. 6 is a block diagram illustrating an example of a system (300). The system 300 may include a network 330, and an IoT support service 351, IoT devices 341 and 342, and an application backend 313, all of which are connected to the network 330.

[0038] The term "IoT device" refers to a device intended to utilize IoT services. An IoT device can actually include any device connected to a network to use IoT services, including for telemetry collection or any other purpose. An IoT device includes any device that can be connected to a network to utilize IoT services. In various examples, an IoT device can communicate with the cloud, a peer, or a local system, or a peer and a local system and the cloud, or in any other suitable manner. IoT devices can include everyday items such as toasters, coffee makers, thermostat systems, washing machines, dryers, lights, cars, etc. IoT devices can also include various devices in, for example, a "smart" building, including lights, temperature sensors, humidity sensors, occupancy sensors, etc. IoT services for IoT devices can be used for device automation, data capture, providing alerts, personalization of settings, and many other applications.

[0039] The term "IoT support service" refers to a device, at least a part of a device, or multiple devices, such as a distributed system, to which an IoT device is connected over a network in some examples to obtain IoT services. In some examples, the IoT support service is an IoT hub. In some examples, the IoT hub is excluded, and the IoT device communicates directly or through one or more intermediaries with the application backend without including the IoT hub, and software components in the application backend operate as the IoT support service. The IoT device receives IoT services via communication with the IoT support service. In some examples, the IoT support service can be embedded inside the device or in the local infrastructure.

[0040] The application backend 313 refers to a device or multiple devices, such as a distributed system, that perform actions enabling data collection, storage, and / or actions based on IoT data, including user access and control, data analysis, data display, data storage control, automated operations based on IoT data, etc. The application backend 313 can also be one or more virtual machines deployed in a public or private cloud. In some examples, at least some of the actions performed by the application backend can be executed by an application running in the application backend 313.

[0041] Each IoT device in IoT devices 341 and 342 and / or a device including IoT support service 351 and / or the application backend 313 can include Figure 2 an example of the computing device 200. The term "IoT support service" is not limited to a particular type of IoT service, but rather refers to a device with which an IoT device communicates after being provisioned for at least one IoT solution or IoT service. That is, the term "IoT support service" used throughout the specification and claims is generic to any IoT solution. The term "IoT support service" refers to the part of the IoT solution / IoT service with which the provisioned IoT device communicates. In some examples, communication between an IoT device and one or more application backends occurs with the IoT support service as an intermediary. Figure 3 and the corresponding description in the specification of Figure 3 illustrate an example system for illustrative purposes, which does not limit the scope of the present disclosure.

[0042] One or more of the IoT devices in IoT devices 341 and 342 can include a device controller 345, which can operate to control the IoT device. Each device controller 345 can include multiple execution environments. The device controller 345 can be a multi-core microcontroller. In some examples, the device controller 345 is an integrated circuit having multiple cores, such as at least one central processing unit (CPU) and at least one microcontroller (MCU).

[0043] Network 330 may include one or more computer networks, including wired and / or wireless networks, where each network may be, for example, a wireless network, a local area network (LAN), a wide area network (WAN), and / or a global network such as the Internet. On a set of interconnected LANs, including LANs based on different architectures and protocols, routers serve as links between the LANs to enable messages to be sent from one to another. Additionally, communication links within a LAN typically include twisted pair or coaxial cables, while communication links between networks may utilize analog telephone lines, dedicated digital lines including all or part of T1, T2, T3, and T4, integrated services digital network (ISDN), digital subscriber line (DSL), wireless links including satellite links, or other communication links known to those skilled in the art. Further, remote computers and other related electronic devices may be remotely connected to a LAN or WAN via a modem and a temporary telephone link. Network 330 may include various other networks, such as one or more networks using local network protocols such as 6LoWPAN, ZigBee, etc. Some IoT devices may be connected to the user device via a network different from other IoT devices in network 330. In essence, network 330 includes any communication method by which information can travel between the IoT support service 351, the IoT devices 341 and 342, and the application backend 313. Although each device or service is shown as being connected to network 330, this does not mean that each device communicates with every other device shown. In some examples, some of the devices / services shown only communicate with some other devices / services shown via one or more intermediate devices. Additionally, although network 330 is shown as one network, in some examples, network 330 may instead include multiple networks that may or may not be connected to each other, where some devices are shown as communicating with each other via one of the multiple networks, while other devices are shown as communicating with each other using different networks among the multiple networks.

[0044] As an example, IoT devices 341 and 342 are devices intended to utilize the IoT services provided by the IoT support service 351.

[0045] System 300 may include more or fewer devices than those shown by way of example only Figure 3 than those shown.

[0046] Exemplary Device

[0047] Figure 4 is a block diagram showing an example of the device controller 445. The device controller 445 may act as Figure 3An example of the device controller 345 is adopted. The device controller 445 may include a security complex 451, a CPU 453, a direct memory access (DMA) block 454, a trust zone (TZ) DMA block 455, a flash memory 456, a radio block 457, a secure static random access memory (SRAM) 458, interfaces, an MCU 461, an MCU 462, a main advanced extensible interface (AXI) bus 463, a secondary AXI bus 464, bridges 465 and 466, an AXI to the advanced peripheral bus (APB) bridge for each peripheral device 467, an interface 471, a GPIO 472, an analog-to-digital converter (ADC) 473, a real-time clock (RTC) 474, and a performance counter 475.

[0048] In some examples, the device controller 445 enables the device including the device controller 445 to operate as an IoT device (such as Figure 3 the IoT devices 341 or 342). In some examples, the device controller 445 is a multi-core microcontroller. In some examples, the device controller 445 runs a high-level operating system. In some examples, the device controller 445 may have at least 4MB of RAM and at least 4MB of flash memory and may be a single integrated circuit. In some examples, the device controller 445 provides not only network connectivity but also various other functions, including hardware and software security, a monitored operating system, cryptographic functions, peripheral control, telemetry, etc. Additionally, the device controller 445 may include: techniques for allowing the device controller 445 to be booted in a secure manner, techniques for allowing the device controller 445 to be updated securely, techniques for ensuring that appropriate software runs on the device controller 445, techniques for allowing the device controller 445 to operate correctly as an IoT device, etc.

[0049] In some examples, the security complex 451 includes a core security complex (CSC), which is the hardware root of trust in the device controller 445. In some examples, the core security complex is directly connected to the secure MCU in the security complex 451. In some examples, the secure MCU in the security complex 451 has a very high level of trust, but is less trusted than the core security complex in the security complex 451. In some examples, the security complex 451 drives the entire system when booted.

[0050] In some examples, the CPU 453 runs a high-level operating system. In some examples, the CPU 453 has two independent execution environments: a "secure world" execution environment and a "normal world" execution environment. The term "secure world" is widely used to refer to a trusted environment and is not limited to special security functions. In certain examples, the "secure world" execution environment of the CPU 453 is also part of the system's trusted computing base. For example, in some examples, the "secure world" execution environment of the CPU 453 can have unrestricted access to reprogrammable hardware protection mechanisms, such as a firewall in some examples. However, in some examples, the "secure world" execution environment of the CPU 453 does not have access to the interior of the core security complex of the security complex 451 and relies on the security MCU of the security complex 451 for special security-sensitive operations.

[0051] The radio block 457 can provide Wi-Fi communication. The main AXI bus 463 and the secondary AXI bus 464 can be buses that connect the components shown. In some examples, the bridges 465, 466, and 467 bridge the components shown. The RTC block 474 can operate as a real-time clock. In some examples, all components in the device controller 345 can read from the RTC block 474, but not all components have write access to the RTC block 474. The device controller 445 can include various forms of memory, including flash memory and SRAM, such as flash memory 456 and secure SRAM 458.

[0052] In some examples, the IO subsystem 1 461 and the IO subsystem 2 462 are I / O subsystems for general I / O connectivity. In some examples, each of the IO subsystem 1 461 and the IO subsystem 2 462 includes an MCU.

[0053] The DMA block 454 can be used to manage data movement for the "normal world" execution environment of the CPU 453. The trust zone (TZ) DMA block 455 can be used to manage data movement for the "secure world" execution environment of the CPU 453. In some examples, each IO subsystem also has its own DMA block. Each DMA block can be configured to support data movement between cores, peripherals, other components, etc.

[0054] Each core can have a two-way mailbox to support inter-processor communication. The performance counter 475 can be configured to count read requests, write requests, and data type requests for performance monitoring. In some examples, the performance counter 475 can also be configured to measure the latency from a core to a target (such as from the MCU 462 to the SRAM 458).

[0055] In some examples, the interface at block 459 includes two Inter - Integrated Circuit Sound (I2S) interfaces: one for audio input and one for audio output. In other examples, other configurations of the interface may be employed, and in various examples, block 459 may include any suitable interface.

[0056] In some examples, the MCU in the security complex 451 has a very high level of trust, but is less trusted than the core security complex in the security complex 451. In these examples, the MCU in the security complex 451 controls one or more functions associated with a very high level of trust. In one example, the MCU in the security complex 451 controls power for the device controller 445 and / or the IoT device.

[0057] In some examples, the "secure world" execution environment of the CPU 453 is also part of the system's trusted computing base. For example, in certain examples, the "secure world" runtime ("secure world" RT) of the CPU 453 has unrestricted access to reprogram hardware protection mechanisms (such as a firewall in some examples). However, in some examples, the "secure world" RT does not have access to the interior of the core security complex of the security complex 451, but relies on the MCU in the security complex 451 for special security - sensitive operations.

[0058] The "normal world" execution environment of the CPU 453 can be configured to have limited access to on - chip resources such as memory. In some examples, various security and quality standards (e.g., relatively high standards) can be enforced for code running in this environment, but it is less trusted than code running on the MCU in the security complex 451 or code running in the "secure world" of the CPU 453.

[0059] In some examples, the MCUs 461 and 462 are less trusted than the MCU in the security complex 451 and less trusted than the CPU 453. In some examples, the radio block 457 may include a core which, in some examples, may be an MCU. The radio block 457 can provide Wi - Fi functionality and connectivity to the Internet and cloud services (such as IoT services). In some examples, the radio block 457 can provide communication via Bluetooth, Near - Field Communication (NFC), ZigBee, Long - Term Evolution (LTE), and / or other connectivity technologies. In some examples, the core in the radio block 457 does not have any access to unencrypted secrets and is not able to compromise the execution of the CPU 453.

[0060] In some examples, each independent execution environment is managed by a single software component that executes in a separate execution environment referred to as the "parent" of the execution environment. In such an example, one exception can be that the root of hardware trust (the core security complex of the security complex 451 in this example) has no parent. In a particular example, each parent executes in an environment that is at least as trustworthy as the environment it manages. In other examples, other suitable security means can be employed. The management operations can include: booting and restoring the target environment, monitoring and handling resets in the target environment, and configuring access policies for the target environment. In some cases, certain management operations are performed by components other than the parent. For example, in some examples, the "normal world" of the CPU 453 is the environment that manages the MCUs 461 and 462 but receives assistance from the "secure world" of the CPU 453.

[0061] For example, in some examples, the MCU of the security complex 451 manages the "secure world" RT of the CPU 453, the components in the "secure world" RT in the CPU 453 manage the "normal world" OS of the CPU 453, the components in the "normal world" OS of the CPU 453 manage the "normal world" user mode of the CPU 453, and the "normal world" user mode services of the CPU 453 manage the MCUs 461 and 462 and the cores in the radio block 457.

[0062] In some examples, not only are independent execution environments managed by software components from more trustworthy execution environments, but different functions are assigned to different independent execution environments, where more sensitive functions are assigned to more trustworthy independent execution environments. In a particular example, an independent execution environment that is less trustworthy than the assigned independent execution environment has restricted access to that function. In this way, in some examples, independent execution environments implement defense in depth based on a hierarchy of trust.

[0063] For example, in some examples, the core security complex of the security complex 451 is at the top of the hierarchy and is assigned to secrets (e.g., encryption keys), the security MCU in the security complex 451 is the next in the hierarchy and is assigned for power control, the secure world RT of the CPU 453 is the next in the hierarchy and is assigned for storage and write access to the real-time clock (RTC), the normal world OS of the CPU 453 is the next in the hierarchy and is assigned to Wi-Fi, the normal world user mode applications of the CPU 453 are the next in the hierarchy and are assigned to applications, and the MCUs 461 and 462 are at the bottom of the hierarchy and are assigned to peripherals. In other examples, functions are assigned to independent execution environments in different ways.

[0064] In some examples, for instance, when there is software - implementation support for their handling, each level of the trust hierarchy, except for the bottom (i.e., least - trusted) level, has control by accepting or rejecting requests from less - trusted levels, and can rate - limit or audit requests from less - trusted levels, and can verify requests from lower levels to, for example, ensure that the requests are correct and genuine. Additionally, as previously mentioned, in some examples, each level of the hierarchy, except for the top (i.e., most - trusted) level, has a parent that is responsible for managing the lower (i.e., less - trusted) levels, including monitoring whether the software at the lower levels is operating properly.

[0065] Some examples of device controllers can be multi - core microprocessors that include, for example, at least one CPU and at least one microcontroller, and a flash memory with multiple memory banks as previously described. In some examples, the multi - core processor can be an integrated circuit with multiple cores. In some examples, the multi - core processor can be used to provide functionality to the connected devices. In some examples, the device controller can provide network connectivity to the connected devices and can also provide various other functions such as hardware and software security, a monitored operating system, cryptographic functions, peripheral control, telemetry, etc. Additionally, the device controller can include techniques for allowing the device controller to boot in a secure manner, techniques for allowing the device to be updated securely, techniques for ensuring that “appropriate” software runs on the device, techniques for allowing the device to operate correctly as an IoT device, etc. The security complex 451 can include the hardware root of trust of the device controller as the basis for the security functions provided by the device controller.

[0066] In some examples, the flash memory 456 is an external NOR flash memory that includes a flash memory controller and parallel dual - quad - channel serial common interface (QSPI) NOR flash devices (two memory banks in this example), where each flash memory bank is a separate integrated circuit accessed via a separate channel. However, the present disclosure is not limited to this, and any suitable memory configuration and / or suitable memory bank can be employed.

[0067] During normal boot, the processor may boot in a secure manner starting with the secure complex, which includes a hardware root of trust for device controllers. In some examples, the first boot loader is read from the ROM, and the public key may be used by the secure complex 451 to verify that the first boot loader has been properly digitally signed. In some examples, verifying the signature of the first boot loader is an encryption operation performed in hardware. In some examples, the first boot loader is not loaded until and unless the digital signature of the first boot loader is verified, and access to all flash memory banks is blocked. In some examples, once the signature of the first boot loader is verified, the first boot loader is loaded, and access to all flash memory banks is allowed. In some examples, in addition to verifying the first boot loader, further verification may be required to grant access to all flash memory banks. This can be used to prevent, for example, loading valid but older code with vulnerabilities.

[0068] In some examples, to allow access to allow verification of the memory bank can be done as follows. The secure complex 451 may read into a portion of one of the unrestricted memory banks, such as the first memory bank in some examples. In some examples, this portion of the flash may be 16 kb, 52 kb, etc. Then, a hardware block in the secure complex 451 may compare the loaded portion of the unrestricted flash memory bank with a special hardware fuse, and the verification is not successful unless the loaded portion matches the fuse. In some examples, the hardware key may also be used to verify that the code is trusted code. The portion of the unrestricted part of the flash compared against the hardware fuse using the hardware block in the secure complex 451 can be used to prevent loading previously valid but now older code with vulnerabilities. As the corresponding unrestricted part of the flash is changed, the fuse can be blown to prevent such older code from being subsequently verified and to prevent access to secrets stored in the secure part of the flash, where the corresponding unrestricted part of the flash is the part to be examined against the hardware fuse to be updated.

[0069] In some examples, the flash 456 is a single-image memory. In some examples, the flash 456 has one memory bank. In some examples, the flash 456 has two memory banks and / or other (one or more) intervals in the memory, but is still a single-image memory where the intervals are not accessible.

[0070] In some examples, an erasure coding scheme, such as the examples described herein, is used to protect flash memory 456 from damage. Although the erasure coding scheme is described herein with respect to flash memory 456, the erasure coding scheme can also be used with any suitable memory or collection of data. In some examples, the erasure coding scheme described herein may be particularly beneficial for embedded devices that have a single-image memory and do not have sufficient space to store a complete backup, for which it is desired to protect against a large number of consecutive damages, accidental overwrites, etc. In some examples, the erasure coding scheme is used with flash memory to prevent flash memory damage.

[0071] In some examples, different erasure coding schemes are used for each different application and / or each piece of software to perform dynamic erasure coding on the respective applications and / or pieces of firmware, with flexibility based on the size of each application and / or piece of firmware being coded.

[0072] In some examples, an erasure coding scheme can be used in which the memory is erasure-coded based on fixed-size contiguous stripes, and if the memory size is not evenly divisible by the stripe size, partial stripes may be left.

[0073] In some examples, an erasure coding scheme can be used in which the memory is erasure-coded based on fixed-size non-contiguous stripes, and if the memory size is not evenly divisible by the stripe size, partial stripes may be left. For example, in some examples, the erasure coding scheme can use stripes in a "checkerboard" or interleaved pattern, where each area to be protected is divided by the number of stripes, e.g., by interleaving the stripes to strip the data (i.e., the stripes are not continuous segments of data, but are composed of blocks of data from different areas of the area to be protected).

[0074] In this way, in some examples, an area of size R can be composed of stripes of size S, which will result in R / S (or N) stripes, where each stripe is composed of a certain number of data blocks of size D. Thus, in these examples, the area will be composed of the first of the N data blocks of size D (each data block being the "first" data block of a stripe) and then the second data block of each stripe (and so on). Thus, in these examples, any block within a stripe is separated from N blocks belonging to other stripes.

[0075] For example, in one example, there is a 16 MB memory, where 8 MB of the memory is dedicated to an application, using 8k data blocks and 64 kb stripes, the 8 MB of the application can be erasure-coded. Thus, in this example, there are 8 MB / 64 kb stripes, i.e., 133 stripes.

[0076] In some examples, the offset of each stripe is calculated and the stripes are stitched together based on the calculated offsets and then input into an erasure coding algorithm. In this example, this "stitching" does not involve moving the data itself but rather calculating the offsets. In this way, in this example, the memory can recover from up to one MB of contiguous corruption. However, in some examples, the amount of corruption from which recovery can be made depends on the number of erasure coding blocks generated (e.g., the selected fault tolerance model). Also, in some examples, although adjustments are made to prevent corruption of contiguous portions of the memory, this does not prevent tolerance of random corruption. For example, some cases of random corruption can be prevented by the disclosed techniques.

[0077] In some examples, the hash value or checksum of each individual data block that is being erasure coded is stored. In some examples, the checksum or hash value is not stored in the data itself but rather in a separate block hash value partition, file, or other data structure that tracks the hash values.

[0078] Fault tolerance can be selected where greater fault tolerance requires greater overhead. For example, in some examples, the erasure coding algorithm tolerates two bad blocks per stripe instead of one, which has greater overhead compared to the case where the algorithm tolerates one bad block per stripe. In some examples, a tradeoff is made between fault tolerance and overhead.

[0079] If there are partial stripes, e.g., stripes with a worth of data less than the full stripe, the partial stripes can be disposed of in different ways in different examples. In some examples, phantom blocks can be used where the remaining blocks are zeros that are not actually stored. The fault tolerance of this scheme may be lower, e.g., because a partial stripe can only tolerate an amount of contiguous corruption associated with the selected fault tolerance mechanism. Alternatively, for greater fault tolerance, a full backup of the partial stripe can be retained.

[0080] In some examples, in erasure code generation, the inputs are the amount of memory being erasure coded, the erasure coding scheme to be used, the stripe size, the block size, how to dispose of any partial stripes, and the fault tolerance (i.e., how many bad blocks per stripe can be recovered from it).

[0081] In some examples, after receiving the inputs, for all data that does not have partial stripes, the number of stripes is counted and each stripe is generated based on the calculated offsets as described above to generate each stripe and provide the stripes to the erasure coding algorithm. If the memory is byte-addressable NOR flash, pointers can be used to directly read the addresses based on the calculated offsets.

[0082] In some examples, hash values are also calculated. In some examples, the hash values are calculated from another mechanism, and the hash values that are calculated and stored from another mechanism can be reused with erasure coding.

[0083] The erasure coding generation process was discussed above. If corruption occurs, the generated erasure codes can be used to repair the corrupted data based on the erasure coding repair process. The repair process can be initiated based on the detected corruption in the memory, which can occur in various ways in various examples. In some examples, corruption is detected in some way for a file or executable binary (such as via hash value or signature verification), which may cause the initiation of the repair process.

[0084] In some examples, during the repair process, bad blocks are first determined by checking the blocks against the hash values. In some examples, along a known corrupted flash range, for each block in the flash range, the stripe where the block is located is calculated, all the addresses in the stripe are found, and for these blocks, the hash values of the blocks are checked against the known hash values. In some examples, for each mismatched hash value, the corresponding block is declared to be bad for the stripe.

[0085] Next, in some examples, the number of bad blocks is compared with the fault tolerance. If the number of bad blocks is zero, then in some examples, the process proceeds to the next stripe. In some examples, if there is one or more bad blocks and the number of bad blocks is greater than the fault tolerance, then the stripe cannot be repaired. In some examples, if there is one or more bad blocks and the number of bad blocks is less than or equal to the fault tolerance, then the bad blocks are repaired, for example, by invoking the selected erasure coding scheme with the stripe data and erasure coding blocks.

[0086] In some examples, to repair the bad blocks, the populated stripe is passed through the erasure coding algorithm with an indication of which block is bad, and a pointer to the erasure coding blocks for the stripe is also passed to the algorithm. In some examples, the algorithm then returns the repaired blocks. In some examples, the hash value of the repaired block is recalculated, and it is determined whether the hash value matches the stored hash value for the block. In some examples, if there is a mismatch, then the repair fails or the stored block hash value is bad.

[0087] In some examples, each block in the range is repaired in this way or skipped because it is not corrupted. Once completed, in some examples, it can be confirmed whether the range is still corrupted. For example, in one example, if a range is found to be corrupted based on a mismatched signature, the range can be sent to the entity that initially performed the signature check, and then that entity can check to determine whether the range is still corrupted, for example, by re-running the signature check and confirming that it is now verified.

[0088] When the data content of a memory protected by erasure coding changes, the erasure code can also be updated. First, in some examples, the changed range of memory is input. In some examples, for each block, the erasure coded data is regenerated using the same process as described above for erasure code generation. In some examples, each generated erasure coded block is overwritten with a new block.

[0089] In other examples, each block in the range is compared to the stored block hash value. In these examples, as the blocks are overwritten, only blocks with different hash values have their erasure coded data regenerated. In some examples, blocks with matching hash values are skipped, e.g., if the data of the blocks within the stripe has not changed, then the erasure coded blocks of the stripe are not updated.

[0090] Exemplary Process

[0091] For the sake of clarity, the processes described herein are described in terms of operations performed in a particular order by specific devices or components of the system. However, it should be noted that other processes are not limited to the stated sequences, devices, or components. For example, certain actions may be performed in a different order, performed in parallel, omitted, or supplemented by additional actions or features, regardless of whether such order, parallelism, actions, or features are described herein. Similarly, any technology described in this disclosure may be incorporated into the described processes or other processes, regardless of whether the technology is specifically described in conjunction with the processes. The disclosed processes may also be performed on or by other devices, components, or systems, regardless of whether such devices, components, or systems are described herein. These processes may also be implemented in a variety of ways. For example, they may be embodied in an article, for example, as processor-readable instructions stored in a processor-readable storage medium, or as computer-implemented processes. As an alternative example, these processes may be encoded as processor-executable instructions and transmitted via a communication medium.

[0092] Figure 5 is an example data flow for a process (570) for generating erasure codes.

[0093] In the example shown, step 571 occurs first. In some examples, the size and bytes of the erasure code are calculated. As shown, step 572 occurs next in some examples. In some examples, the number of stripes for the erasure code is calculated.

[0094] As shown, step 573 occurs next in some examples. At step 573, in some examples, each stripe for each block of the erasure code is generated such that the stripes alternate in a pattern. As shown, step 574 occurs next in some examples. At step 574, in some examples, the hash value of each block of data is saved.

[0095] The process can then proceed to a return box where other processing is resumed.

[0096] Figure 6 is an example data flow of a process (680) for repairing at least a portion of data.

[0097] In the example shown, step 681 occurs first. At step 681, in some examples, for each block of this portion of the data, the stripes of the block are calculated. As shown, step 682 occurs next in some examples. At step 682, in some examples, the hash value of each block of this portion of the data is checked against the saved hash value for the block.

[0098] As shown, step 683 occurs next in some examples. At step 683, in some examples, each such hash value for which the hash value of the block of this portion of the data does not match the saved hash value for the block is identified as a bad block. As shown, step 684 occurs next in some examples. At step 684, in some examples, for each identified bad block, a repair block for the bad block is generated based on the stripes of the block of data and the corresponding block in the erasure coding for the data.

[0099] The process can then proceed to a return box where other processing is resumed.

[0100] Figure 7 is an example data flow of a process (790) for updating an erasure code in response to a change in data.

[0101] In the example shown, step 791 occurs first. At step 791, in some examples, the changed range in the data is received. As shown, step 792 occurs next in some examples. At step 792, in some examples, which blocks within this range of the data have changed are determined.

[0102] As shown, step 793 occurs next in some examples. At step 793, in some examples, the erasure code for the blocks of data that have changed is regenerated. As shown, step 794 occurs next in some examples. At step 794, in some examples, the hash value of each regenerated block is saved.

[0103] Then, the process can proceed to a return box where other processing is resumed.

[0104] Conclusion

[0105] Although the above "Detailed Description" describes some examples of the present technology and describes the expected best mode, the technology can be implemented in many ways regardless of how detailed it is described above in the text. The details can vary in implementation while still being encompassed by the technology described herein. As described above, special terms used when describing certain features or aspects of the present technology should not be construed as implying that the term is redefined herein to be limited to any specific feature, characteristic, or aspect associated with the term. In general, the terms used in the following claims should not be construed as limiting the technology to the specific examples disclosed herein unless the "Detailed Description" specifically defines such terms. Thus, the actual scope of the technology includes not only the disclosed examples but also all equivalent ways of practicing or implementing the technology.

Claims

1. An apparatus for data protection, comprising: a device including at least one memory adapted to store runtime data for the device and at least one processor adapted to execute processor-executable code, the processor-executable code, upon execution, enabling the device to perform actions, the actions including: generating an erasure code for the data while keeping the data un-striped, the erasure code having a size and bytes: calculating the size and bytes of the erasure code; calculating the number of stripes for the erasure code; generating each stripe for each block of the erasure code such that the stripes alternate in a pattern; and obtaining the saved hash value of each block of the data; and repairing at least a portion of the data as follows: for each block of the portion of the data, calculating the stripe of the block and determining the hash value of the block; checking the hash value of each block of the portion of the data against the saved hash value of the block; identifying each hash value as a bad block for which the hash value of the block of the portion of the data does not match the saved hash value of the block; and for each identified bad block, generating a repair block for the bad block based on the stripe of the block and the corresponding block of the data in the erasure code for the data.

2. The apparatus according to claim 1, wherein the data within a region is divided into stripes, wherein each stripe is composed of blocks, and the blocks are interleaved with blocks from other stripes.

3. The apparatus according to claim 1, wherein obtaining the saved hash value of each block of the data includes saving the hash value of each block of the data in a block hash value partition separate from the data and retrieving the saved hash value from the block hash value partition.

4. The apparatus according to claim 1, wherein the stripes have an equal fixed size.

5. The apparatus according to claim 1, wherein the stripes have an equal fixed size plus a partial stripe smaller than the fixed size.

6. The apparatus according to claim 1, wherein generating the repair block for the bad block based on the strip of the blocks and the corresponding blocks of the data in the erasure code for the data comprises: Stitching the stripes together based on the calculated offset and applying an erasure coding algorithm to the stitched-together stripes.

7. The apparatus according to claim 1, the actions further including: updating the erasure code in response to a change in the data.

8. The apparatus according to claim 7, wherein updating the erasure code includes: receiving the range in the data that has changed; determining which blocks within the range of the data have changed; and regenerating the erasure code for each block determined to have changed within the range of the data.

9. The apparatus according to claim 8, wherein determining which blocks within the range of the data have changed is done by: for each block within the range of the data, calculating the hash value of the block and comparing the calculated hash value with the stored hash value for the block.

10. A method for data protection, comprising: Via at least one processor, generate an erasure code for the data while keeping the data un-striped, including generating each stripe for each block of the erasure code such that the stripes alternate in a pattern, and further including generating a saved hash value for each block of the data; And Repair at least a portion of the data, wherein repairing the at least a portion of the data includes: For each block of the portion of the data, calculate the stripe of the block and determine the hash value of the block; Check the hash value of each block of the portion of the data against the saved hash value of the block; Identify each hash value as a bad block for which the hash value of the block of the portion of the data does not match the saved hash value of the block; and For each identified bad block, generate a repair block for the bad block based on the stripe of the block and the corresponding block of the data in the erasure code for the data.

11. The method according to claim 10, wherein the erasure code has a size and bytes, and wherein generating the erasure code further includes: Calculating the size and bytes of the erasure code; Calculating the number of stripes for the erasure code; And Obtaining the saved hash value of each block of the data.

12. The method according to claim 10, wherein repairing the at least a portion of the data includes: For each block of the portion of the data, calculate the stripe of the block and determine the hash value of the block; Check the hash value of each block of the portion of the data against the saved hash value of the block; Identify each hash value as a bad block for which the hash value of the block of the portion of the data does not match the saved hash value of the block; and For each identified bad block, generate a repair block for the bad block based on the stripe of the block and the corresponding block of the data in the erasure code for the data.

13. The method according to claim 10, further including: Updating the erasure code in response to a change in the data.

14. The method according to claim 13, wherein updating the erasure code includes: Receiving the range in the data that has changed; Determining which blocks in the range of the data have changed; And Regenerating the erasure code for each block determined to have changed in the range of the data.

15. A processor-readable storage medium having processor-executable code stored thereon, the processor-executable code enabling actions when executed by at least one processor, the actions including: Generate an erasure code for the data while keeping the data un-striped, the erasure code having a size and bytes, as follows: Calculate the size and bytes of the erasure code; Calculate the number of stripes for the erasure code; Generate each stripe for each block of the erasure code such that the stripes alternate in a pattern; And Obtain the saved hash value of each block of the data; And Repair at least a portion of the data, where repairing the at least a portion of the data includes: For each block of the portion of the data, calculate the stripe of the block and determine the hash value of the block; Check the hash value of each block of the portion of the data against the saved hash value of the block; Identify as a bad block each hash value for which the hash value of the block of the portion of the data does not match the saved hash value of the block; and For each identified bad block, generate a repair block for the bad block based on the stripe of the block and the corresponding block of the data in the erasure code for the data.

16. The processor-readable storage medium according to claim 15, wherein repairing the portion of the data includes: For each block of the portion of the data, calculate the stripe of the block and determine the hash value of the block; Check the hash value of each block of the portion of the data against the saved hash value of the block; Identify as a bad block each hash value for which the hash value of the block of the portion of the data does not match the saved hash value of the block; and For each identified bad block, generate a repair block for the bad block based on the stripe of the block and the corresponding block of the data in the erasure code for the data.

17. The processor-readable storage medium according to claim 15, wherein the action further includes: Update the erasure code in response to a change in the data.

18. The processor-readable storage medium according to claim 17, wherein updating the erasure code includes: Receive the range in the data that has changed; Determine which blocks in the range of the data have changed; And Regenerate the erasure code for each block determined to have changed in the range of the data.

Images