Detection of Compromised Storage Device Firmware

Abstract

The present invention is entitled "Detection of Compromised Storage Device Firmware". The present invention discloses an apparatus, system and method for detecting compromised firmware in a non-volatile storage device. Monitor the control bus of the non-volatile storage device. The non-volatile storage device includes a processor and electronic components coupled to the control bus. Analyze the signal traffic on the control bus to find events and / or triggers related to storage operations initiated by the processor on the control bus. The storage operation includes one or more commands for at least one of the electronic components. If the delay of the storage operation meets the warning threshold, the host firmware is notified that it is compromised.

Description

Background Art

[0001] Non-volatile storage devices, including memory devices, store a variety of data of varying sensitivity levels. Such data may become a target for individuals or entities attempting to obtain, view, copy, alter, manipulate, or destroy the data. This means that the security of the non-volatile storage device and its electronic components and circuits, as well as all firmware executed within the non-volatile storage device, may be of the highest priority. The firmware of the non-volatile storage device may be compromised by malware or software viruses.

[0002] The means and mechanisms used by those who attempt to access and manipulate or control sensitive data of non-volatile storage devices continue to advance. Traditional malware or software viruses may use very sophisticated techniques to corrupt firmware and then avoid detection. It would be valuable to provide one or more mechanisms within a non-volatile storage device that cannot be compromised and can reliably identify when and if one or more firmware images of a non-volatile storage device have been compromised.

[0003] Therefore, there is a need for a solution that reliably detects potential security threats and can take steps to alert the owner of a non-volatile storage device. Summary of the invention

[0004] The present disclosure relates to a method for detecting a compromised firmware image (including a storage controller firmware image). First, a control bus of a non-volatile storage device is monitored. The non-volatile storage device includes a processor and a plurality of electronic components coupled to the control bus. Then, signal traffic on the control bus is analyzed to find events related to storage operations initiated by the processor on the control bus. The storage operation includes one or more commands for at least one of the plurality of electronic components. The latency of the storage operation is measured. If it is determined that the latency of the storage operation meets a warning threshold, the host firmware is notified that it is compromised.

[0005] The present disclosure also relates to a device for detecting a compromised storage controller firmware image. The device includes a communication bus, a memory, a processor, and a communication module. The memory is coupled to the communication bus and is configured to store a repository for storing a storage security firmware image, a warning threshold, and delay data. The processor is coupled to the communication bus and is configured to execute the storage security firmware image. The storage security firmware image includes a monitor, a detector, and a reporter. The monitor is configured to generate delay data of a target storage operation. The target storage operation is identified based on signal traffic on the communication bus. The detector is configured to determine an anomaly based on the delay data of the target storage operation. The reporter is configured to signal a host in response to the detector identifying an anomaly indicating a compromised storage controller firmware image. The communication module is coupled to the communication bus and is configured to communicate the anomaly to the host.

[0006] Finally, the present disclosure relates to a system for detecting a compromised storage controller firmware image. The system includes a non-volatile memory array, a storage controller, a host interface manager, and a memory interface manager. The non-volatile memory array is configured to store data in memory cells. The storage controller includes an internal communication bus, a storage processor, a volatile memory, an error correction code (ECC) manager, a direct memory access (DMA) manager, a flash conversion manager, a main memory buffer manager, and a security chip. The storage processor is coupled to the internal communication bus.

[0007] A volatile memory is coupled to the internal communication bus and is configured to store a storage controller firmware image. An ECC manager is coupled to the internal communication bus and is configured to encode and decode data stored on and retrieved from the non-volatile memory array. A DMA manager is coupled to the internal communication bus and is configured to transfer data between a host and a storage controller. A flash translation manager is coupled to the internal communication bus and is configured to translate logical block addresses into physical block addresses within the non-volatile memory array and manage a cache of address mapping tables.

[0008] A main memory buffer manager is coupled to the internal communication bus and is configured to manage the main memory buffer within the volatile memory of the host. A security chip is coupled to the internal communication bus and is configured to monitor the signal traffic on the internal communication bus to detect anomalies indicating that the storage controller firmware image is compromised. A host interface manager is coupled to the external communication bus and is configured to communicate between the host and the storage controller and maintain a secure communication channel between the host and the security chip. A memory interface manager is coupled to the internal communication bus and to an external communication bus that is coupled to a non-volatile memory array for reading data and writing data to the non-volatile memory array. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] To easily identify the discussion of any particular element or act, the most significant digit or digits in a reference number refer to the figure number that first introduces the element.

[0010] Figure 1 A storage system 100 is shown according to one embodiment.

[0011] Figure 2 A storage device 200 is shown according to one embodiment.

[0012] Figure 3 is a block diagram of a host and a storage device according to one embodiment.

[0013] Figure 4is a block diagram of a host and a storage device according to one embodiment.

[0014] Figure 5 A storage system 500 is shown according to one embodiment.

[0015] Figure 6 A security chip 600 according to one embodiment is shown.

[0016] Figure 7 A detector 700 is shown according to one embodiment.

[0017] Figure 8 A method for detecting a compromised storage controller firmware image 800 is shown according to one embodiment.

[0018] Fig. 9 is an example block diagram of a computing device 900 that may be used in conjunction with certain embodiments. DETAILED DESCRIPTION

[0019] Disclosed herein is a non-volatile storage device, memory device, and / or memory device controller that can track latency of various internal firmware operations (including storage operations) and detect suspicious events in this data that indicate potential threats.

[0020] The solution disclosed in the present invention addresses security threats. Certain embodiments can alert the host when such threats are detected. The host can perform further analysis, initiate additional tests, or implement host-level countermeasures.

[0021] One indication of correct behavior of memory firmware operations (including storage operations) is the latency measurement of the operations. "Latency" refers to the period of time from the start of an operation to the time the operation stops, completes, or encounters an error condition, usually characterized as a delay. Latency can be measured in time units such as nanoseconds, microseconds, milliseconds, seconds, minutes, hours, days, weeks, etc.

[0022] It may be valuable to monotonically track latency statistics for memory firmware. However, a host processor may not be able to track these internal metrics. Alternatively or in addition, compromised firmware may report erroneous latency metrics to avoid detection. In some implementations, measurement and anomaly detection alert capabilities may be assigned to the memory firmware itself, as the firmware has access to latency information for various internal operations. "Anomaly" means something that is different, unusual, special, or not easily categorized, something anomalous, a deviation from general rules or behavior. ("Anomaly", Merriam-Webster.com, Merriam-Webster, 2020, web. Modified, accessed May 14, 2020.)

[0023] The solution disclosed in the present invention can monitor, follow or track various events and operations, including storage operations. Among the related operations that can be tracked by the solution disclosed in the present invention, the following operations are included:

[0024] Power-off process

[0025] Logical to physical conversion

[0026] Reset process

[0027] Exception process

[0028] · Computational algorithms, if implemented in the device

[0029] Machine Learning (ML) Training

[0030] Security operations (e.g., key manipulation)

[0031] Main memory buffer (HMB) initialization

[0032] Anomaly detection based on these properties can be calibrated in the lab and / or modified in the field based on specific device workloads and physical properties. Another option is that the collected latency data can be reported back to the storage company server for further analysis and comparison of the large amount of data collected from various storage devices in the field.

[0033] Figure 1 is a schematic block diagram illustrating one embodiment of a storage system 100 including a storage device according to the solution disclosed in the present invention. A "storage device" refers to any hardware, system, subsystem, circuit, component, module, non-volatile memory medium, hard drive, storage array, device or apparatus that is configured, programmed, designed or engineered to store data for a period of time and retain the data in the storage device while the storage device does not use power from a power source. Examples of storage devices include, but are not limited to, hard drives, flash memories, MRAM memories, solid-state storage devices, just a bunch of disks (JBOD), just a bunch of flash (JBOF), external hard drives, internal hard drives, etc.

[0034] "Non-volatile storage device" refers to any hardware, device, component, element, or circuit that is configured to retain a mutable physical property used to represent a binary value of zero or one after main power is removed. Examples of non-volatile storage devices include, but are not limited to, hard disk drives (HDDs), solid-state drives (SSDs), non-volatile memory media, etc.

[0035] The storage system 100 may include a plurality of hosts 300 connected by a network 108. One host 300 may include a user application 104, a storage client 106, and a storage device 200. The storage device 200 may include a storage controller 102 and one or more memory dies 110 coupled via a bus 112 (the bus 112 may include a data bus). The storage controller 102 may include a flash translation layer 120. The bus 114 (which may include a data bus) may couple the storage device 200 to the storage client 106.

[0036] Bus 112 and / or bus 114 may include a communication bus. A "communication bus" refers to the hardware, software, firmware, logic, control lines, and one or more associated communication protocols configured to enable a transmitter to send data to a receiver. A communication bus may include a data bus and / or a control bus.

[0037] "Control bus" refers to a communication bus used to exchange one or more of data, address information, control signals, clock signals, etc. between two electronic circuits, components, chips, dies, and / or systems. A control bus may include one or more control lines, may be configured to operate as a parallel bus or a serial bus, and may include hardware, one or more control lines, software, firmware, logic, and / or communication protocols for operating the control bus. Typically, a control bus sends control signals to one or more memory dies to manage operations on the memory die.

[0038] In certain embodiments, the control bus sends control signals such as write enable ("WE" or WE#), chip enable ("CE" or "CE#), read enable ("RE" or Re), clock signals, select signals ("DQS"), command latch enable ("CLE"), address latch enable ("ALE"), storage operation commands in the form of operation codes ("OP" codes), and addressing information for the storage operations being communicated.

[0039] In some embodiments, the control bus may not transmit data related to storage operations, such as write data or read data. Instead, write data and read data may be transmitted via the data bus. In some embodiments, the control bus and the data bus together may form a communication bus between a transmitter and a receiver. "Signal" refers to an electrical signal (wired or wireless) sent from one component, circuit, driver, device, manager or controller to another component, circuit, driver, device, manager or controller.

[0040] "Data bus" refers to a communication bus used to exchange one or more of the data bits between two electronic circuits, components, chips, dies, and / or systems. A data bus may include one or more signal lines / control lines. A transmitter such as a controller may send data signals in parallel (operating as a parallel bus) or in series (operating as a serial bus) via one or more control lines of the data bus. A data bus may include hardware, one or more control lines, software, firmware, logic, and / or communication protocols for operating the data bus.

[0041] Exemplary data buses may include an 8-bit bus with 8 control lines, a 16-bit bus with 16 control lines, a 32-bit bus with 32 control lines, a 64-bit bus with 64 control lines, etc. The control lines may exclusively carry communication data, exclusively carry address data, exclusively carry control data, or any combination of these types of data.

[0042] In one embodiment, a single data bus may be shared by multiple components such as memory dies. When multiple chips or memory dies share a data bus, the data may be accessed or transmitted in parallel by a single memory die or by all memory dies based on signals on the chip enable control line.

[0043] The data bus may be operated and configured according to industry standards or based on proprietary protocols and designs. Multiple control lines of the data bus may be used in parallel, and data may be latched into a latch of a target component according to a clock signal, a data strobe signal ("DQS"), or a clock such as a strobe signal. In certain embodiments, the control bus and the data bus together may form a communication bus between a transmitter and a receiver. "Firmware" refers to logic embodied as processor executable instructions stored on a volatile memory medium and / or a non-volatile memory medium.

[0044] "Host" means any circuit, chip, processor, computing device, computer device, computer module, computer subsystem, or computer system configured to send and receive storage commands. Examples of hosts include, but are not limited to, computers, laptops, mobile devices, appliances, virtual machines, enterprise servers, desktop computers, tablet computers, mainframes, etc.

[0045] The host 300 and / or the storage controller 102 may each include one or more processors. A "circuit" refers to a circuit having at least one discrete circuit, a circuit having at least one integrated circuit, a circuit having at least one application-specific integrated circuit, a circuit forming a general-purpose computing device configured by a computer program (e.g., a general-purpose computer configured by a computer program that at least partially executes the processes or devices described herein, or a microprocessor configured by a computer program that at least partially executes the processes or devices described herein), a circuit forming a memory device (e.g., in the form of random access memory), or a circuit forming a communication device (e.g., a modem, a communication switch, an optoelectronic device).

[0046] "Logic" refers to machine memory circuits, non-transitory machine-readable media, and / or circuits through which material and / or material energy configurations include control and / or program signals and / or settings and values ​​(such as resistance, impedance, capacitance, inductance, current / voltage levels, etc.) that can be applied to affect the operation of the device. Magnetic media, electronic circuits, electrical and optical memory (volatile and non-volatile), and firmware are examples of logic. Logic specifically excludes pure signals or software itself (however, it does not exclude machine memory that includes software and thereby forms a configuration of things).

[0047] "Command" means an instruction sent from one device, component, module, manager or controller to another device, component, module, manager or controller that is configured to cause a predetermined action or operation. "Storage command" means any command related to a storage operation. Examples of storage commands include, but are not limited to, read commands, write commands, maintenance commands, configuration commands, management commands, diagnostic commands, test mode commands, countermeasure commands, and any other command that a storage controller may receive from a host or issue to another component, device or system. Generally speaking, a storage command is a command issued from a host or host device or another component or device to a storage device or memory device. Storage commands typically initiate one or more storage operations.

[0048] The storage system 100 includes at least one storage device 200, which includes a storage controller 102 and one or more memory dies 110 connected by a bus 112. In some embodiments, each storage device 200 may include two or more memory dies 110, such as flash memory, nano random access memory ("nano RAM or NRAM"), magnetoresistive RAM ("MRAM"), dynamic RAM ("DRAM"), phase change RAM ("PRAM"), etc. In other embodiments, the data storage device 200 may include other types of non-volatile and / or volatile data storage, such as dynamic RAM ("DRAM"), static RAM ("SRAM"), magnetic data storage, optical data storage, and / or other data storage technologies. "Memory" refers to any hardware, circuit, component, module, logic, device, or apparatus that is configured, programmed, designed, arranged, or engineered to retain data. Some types of memory require the availability of a constant power supply to store and maintain data. Other types of memory retain and / or store data when power is not available.

[0049] A "memory die" refers to a small block of semiconductor material on which a given functional circuit is fabricated. Integrated circuits are typically mass-produced on a single wafer of electronic grade silicon (EGS) or other semiconductors such as GaAs by processes such as photolithography. The wafer is cut (sliced) into many pieces, each containing a copy of the circuit. Each of these pieces is called a die. (Search Wikipedia.com for die (integrated circuit) on October 9, 2019, accessed November 18, 2019). In one embodiment, a memory die is a die that includes functional circuits for operating as a nonvolatile memory medium and / or a nonvolatile memory array.

[0050] The storage device 200 may be a component within the host 300, as depicted here, and may be connected using a bus 114, such as a Peripheral Component Interconnect Express ("PCI-e") bus, a Serial Advanced Technology Attachment ("Serial ATA") bus, etc. In another embodiment, the storage device 200 is external to the host 300 and connected to a Universal Serial Bus ("USB") connection, an Institute of Electrical and Electronics Engineers ("IEEE") 1394 bus ("FireWire"), etc. In other embodiments, the storage device 200 is connected to the host 300 using a Peripheral Component Interconnect Express ("PCI") bus that uses an external electrical or optical bus extension or bus network solution, such as InfiniBand or PCI Express Advanced Switching ("PCIe-AS"), etc.

[0051] In various embodiments, the storage device 200 may be in the form of a dual in-line memory module ("DIMM"), a daughter card, or a micromodule. In another embodiment, the storage device 200 is a component within a rack-mounted blade. In another embodiment, the storage device 200 is contained within a package that is directly integrated onto a higher-level component (e.g., a motherboard, a laptop computer, a graphics processor). In another embodiment, the various components comprising the storage device 200 are directly integrated onto the higher-level component without the need for an intermediate package. Figure 2 The storage device 200 is described in more detail.

[0052] In another embodiment, the data storage device 200 may be connected to the host 300 via a data network, rather than being directly connected to the host 300 as a DAS. For example, the data storage device 200 may include a storage area network ("SAN") storage device, a network attached storage ("NAS") device, a network share, etc. In one embodiment, the storage system 100 may include a data network, such as the Internet, a wide area network ("WAN"), a metropolitan area network ("MAN"), a local area network ("LAN"), a token ring, a wireless network, a fiber channel network, a SAN, a NAS, an ESCON, etc., or any combination of networks. The data network may also include a network from the IEEE 802 family of network technologies, such as Ethernet, a token ring, Wi-Fi, Wi-Max, etc. The data network may include servers, switches, routers, cables, radios, and other equipment for facilitating networking between the host 300 and the data storage device 200.

[0053] The storage controller 102 manages the memory die 110. A "storage controller" refers to any hardware, device, component, element, or circuit configured to manage data operations and / or storage operations on a non-volatile storage medium, and may include one or more processors, programmable processors (e.g., FPGAs), ASICs, microcontrollers, etc. The storage controller may take the form of a processing circuit, a microprocessor or processor, and a computer-readable medium storing computer-readable program code executable by a (micro)processor (e.g., software or firmware), logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers, etc.

[0054] In some embodiments, the storage controller is configured to store data on and / or read data from a non-volatile storage medium, to transfer data to / from one or more non-volatile storage devices, etc. In addition to the specific functions described herein, the storage controller may have various functions.

[0055] For example, the storage controller may format the non-volatile memory media to ensure that the memory operates correctly, mark bad memory cells, and allocate spare cells to replace future failed cells. Portions of the memory cells may be used to hold firmware to operate the storage controller and implement other features.

[0056] An example of firmware or a module within firmware is a flash translation manager. In operation, when a host device needs to read data from or write data to a non-volatile memory medium, the host device can provide a logical block address to which data is to be read / written, and the storage controller uses the flash translation manager to translate the logical block address into a physical block address in the non-volatile memory medium.

[0057] The memory controller may also perform various memory management functions such as, but not limited to, wear leveling (distributing writes to avoid wearing out specific memory blocks that could otherwise be written to repeatedly) and garbage collection (moving only valid data pages to another memory block after a memory block is full so the entire memory block can be erased and reused).

[0058] A "memory cell" refers to a type of storage medium that is configured to represent one or more binary values ​​through a determinable physical property of the storage medium when the storage medium is sensed, read, or detected to determine which binary value(s) are ultimately stored in the memory cell. Memory cell and storage cell are used interchangeably herein.

[0059] "Storage operations" refer to operations performed on, within, in, or in connection with a non-volatile storage device and / or non-volatile storage medium. Examples of storage operations include, but are not limited to, power-on reset operations, firmware initialization operations, data refresh operations, data cleanup operations, garbage collection operations, erase operations, maintenance operations, test mode operations, program storage operations, read scan operations, main memory buffer access operations, main memory buffer maintenance operations, cache access operations, cache maintenance operations, memory address translation lookup operations, memory address translation cache swap / paging operations, etc. Other examples of storage operations include, but are not limited to, reading data from a memory cell (or sensing the state of a memory cell), writing data to (or programming data to) a memory cell, and / or erasing data stored in a memory cell.

[0060] The storage system 100 includes at least one host 300 connected to the storage device 200. A plurality of hosts 300 may be used, and may include servers, storage controllers of a storage area network ("SAN"), workstations, personal computers, laptop computers, handheld computers, supercomputers, computer clusters, network switches, routers or appliances, databases or storage appliances, data acquisition or data capture systems, diagnostic systems, test systems, robots, portable electronic devices, wireless devices, etc. In another embodiment, the host 300 may be a client, and the storage device 200 may operate autonomously to service data requests sent from the host 300. In this embodiment, the host 300 and the storage device 200 may be connected using a computer network, a system bus, direct attached storage (DAS), or other communication means suitable for connection between a computer and an autonomous storage device 200.

[0061] The depicted embodiment shows a user application 104 in communication with a storage client 106 as part of a host 300. In one embodiment, a user application 104 is a software application that operates on a storage client 106 or in conjunction with a storage client.

[0062] "Storage Client" means any hardware, software, firmware, or logical component or module configured to communicate with a storage device in order to use storage services. Examples of storage clients include, but are not limited to, an operating system, a file system, a database application, a database management system ("DBMS"), a server application, a server, a volume manager, a kernel-level process, a user-level process, an application, a mobile application, a thread, a process, etc.

[0063] The storage clients 106 manage files and data and utilize the functions and features of the memory controller 102 and the associated memory die 110. Representative examples of storage clients include, but are not limited to, servers, file systems, operating systems, database management systems ("DBMS"), volume managers, and the like. The storage clients 106 communicate with the storage controller 102 within the storage device 200. In some embodiments, the storage clients 106 may include remote storage clients operating on the host 300 or otherwise accessible via the network 108. The storage clients may include, but are not limited to, operating systems, file systems, database applications, server applications, kernel-level processes, user-level processes, applications, and the like.

[0064] The storage client 106 may present a logical address space 116 to the host 300 and / or the user application 104. The logical address space 1166 may include a plurality (e.g., a range) of logical addresses. A logical address refers to any identifier used to reference a memory resource (e.g., data), including but not limited to: a logical block address (LBA), a cylinder / head / sector (CHS) address, a file name, an object identifier, an inode, a universally unique identifier (UUID), a globally unique identifier (GUID), a hash code, a signature, an index entry, a range, an extent, etc. A logical address does not indicate the physical location of data on a storage medium, but is an abstract reference to the data.

[0065] "Logical block address" refers to a value used in a block storage device to associate a logical address with each of n logical blocks available for user data storage across storage media. In some block storage devices, the logical block address (LBA) for each volume or partition may range from 0 to n. In a block storage device, each LBA maps directly to a specific data block, and each data block maps to a specific set of physical sectors or physical data block addresses (physical block addresses) on the physical storage medium. "LBA" refers to the abbreviation of logical block address. "Physical block address" refers to address information that uniquely identifies the physical location of a data block relative to all other data blocks of a non-volatile memory array.

[0066] In one embodiment, a device driver for the host 300 (and / or storage client 106) may maintain metadata 118 for the storage client 106, such as within a logical to physical address mapping structure, to map logical addresses of the logical address space 116 to storage locations on the memory die 110. In another embodiment, such metadata 118 may be stored and maintained by the storage controller 102. The device driver may be configured to provide storage services to one or more storage clients 106.

[0067] The storage controller 102 may include a flash translation layer 120. A "flash translation layer" refers to logic in a non-volatile storage device, chip, or component (such as a flash memory device) that includes a logical to physical address translation that provides an abstraction of the logical block addresses used by the storage client (e.g., host) and the physical block addresses at which the storage controller stores data. The logical to physical translation layer maps logical block addresses (LBAs) to the physical addresses of data stored on the solid-state storage medium. The mapping allows data to be referenced in the logical block address space using logical identifiers (such as block addresses). The logical identifier does not indicate the physical location of the data on the solid-state storage medium, but is an abstract reference to the data.

[0068] The flash translation layer 120 receives the processed data and one or more control signals to determine the flash translation layer 120 queue depth. The flash translation layer 120 can determine the appropriate physical addresses to send data and commands to the memory die 110 and the volatile memory. In certain embodiments, the storage client 106 can include the flash translation layer 120 and can manage metadata 118 associated with the flash translation layer 120. In one embodiment, the flash translation layer 120 also receives data output from the memory die 110.

[0069] In one embodiment, the storage system 100 includes one or more clients connected to one or more hosts 300 via one or more computer networks 108. The host 300 may be a server, a storage controller of a SAN, a workstation, a personal computer, a laptop computer, a handheld computer, a supercomputer, a computer cluster, a network switch, a router or an appliance, a database or storage appliance, a data acquisition or data capture system, a diagnostic system, a test system, a robot, a portable electronic device, a wireless device, etc. The network 108 may include the Internet, a wide area network ("WAN"), a metropolitan area network ("MAN"), a local area network ("LAN"), a token ring, a wireless network, a fiber channel network, a SAN, a network attached storage device ("NAS"), ESCON, etc., or any combination of networks. The network 108 may also include a network from the IEEE 802 family of network technologies, such as Ethernet, token ring, WiFi, WiMax, etc.

[0070] The network 108 may include servers, switches, routers, cables, radios, and other equipment for facilitating networking of hosts 300 or hosts 300 and clients. In one embodiment, the storage system 100 includes multiple hosts 300 communicating as peer entities over the network 108. In another embodiment, the storage system 100 includes multiple storage devices 200 communicating as peer entities over the network 108. Those skilled in the art will recognize that other computer networks include one or more computer networks and related equipment with single or redundant connections between one or more clients, or other computers with one or more storage devices 200 connected to one or more hosts. In one embodiment, the storage system 100 includes two or more storage devices 200 connected to a remote host 300 over the network 108, without being directly connected to a local host 300 or integrated within the local host.

[0071] In one embodiment, the storage client 106 communicates with the storage controller 102 through a host interface including an input / output (I / O) interface. For example, the storage device 200 may support the Non-Volatile Memory Express (NVMe) interface standard, also known as the Non-Volatile Memory Host Controller Interface Specification (NVMHCIS).

[0072] In certain embodiments, the storage medium of the memory device is divided into volumes or partitions. Each volume or partition may include multiple sectors. Traditionally, a sector is 512 bytes of data. One or more sectors are organized into blocks (interchangeably referred to as blocks and data blocks herein). "Data block" refers to the storage space of the minimum physical amount on the physical storage medium accessible and / or addressable using a storage command. The physical storage medium can be a volatile memory medium, a non-volatile memory medium, a persistent storage device, a non-volatile storage device, a flash memory storage medium, a hard disk drive, etc.

[0073] Some conventional storage devices divide the physical storage medium into volumes or logical partitions (also called partitions). Each volume or logical partition may include multiple sectors. One or more sectors are organized into blocks (also called data blocks).

[0074] In some storage systems (such as In storage systems that interface with UNIX, Linux or similar operating systems, data blocks are referred to as clusters. In other storage systems (such as storage systems that interface with UNIX, Linux or similar operating systems), data blocks are simply referred to as blocks.

[0075] A data block or cluster represents the smallest physical amount of storage space on a storage medium managed by a storage controller. A block storage device may associate n data blocks available for user data storage across physical storage media with logical block addresses (LBAs) numbered 0 to n.

[0076] In some block storage devices, the logical block address range of each volume or logical partition may be from 0 to n. In conventional block storage devices, a logical block address is directly mapped to one and only one data block.

[0077] In one example embodiment, a data block includes eight 4KB sectors. In some storage systems (such as those that interface with UNIX, Linux, or similar operating systems), data blocks are called clusters. In other storage systems (such as those that interface with UNIX, Linux, or similar operating systems), data blocks are simply called blocks. A block or data block or cluster represents the smallest physical amount of storage space on a storage medium managed by a storage manager (such as a storage controller, storage system, storage unit, storage device, etc.).

[0078] In some embodiments, the storage controller 102 may be configured to store data on one or more asymmetric write-once storage media, such as solid-state storage memory cells within the memory die 110. The memory die 110 may be divided into memory partitions that may be erased as groups (e.g., erase blocks) to account for the asymmetric nature of the memory die 110, among others. Thus, modifying a single block of data in-place may involve erasing the entire physical erase block containing the data, and rewriting the modified data to the physical erase block along with the original unchanged data. A "physical erase block" refers to the smallest unit of storage that may be erased at a given time within a given memory die (e.g., due to the wiring of the storage cells on the memory die). This may result in inefficient write amplification that may excessively wear out the memory die 110.

[0079] A "memory block" refers to a group of memory cells organized so that storage operations can be performed on the group of memory cells in parallel. The organization of the group of memory cells can be implemented at a physical level or a logical level. Therefore, in one embodiment, a memory block may include physical pages, such as word lines, logical pages including physical pages across planes and / or memory dies, physical erase blocks including a group of physical pages, logical erase blocks (LEBs) including a group of logical pages, etc. A memory block may be referred to herein as a "block," "memory block," "metablock," or LEB.

[0080] Therefore, in some embodiments, the storage controller 102 may be configured to write data offsite. As used herein, writing data "offsite" refers to writing data to one or more different media storage locations, rather than overwriting the data "in place" (e.g., overwriting the original physical location of the data). Modifying data offsite can avoid write amplification because existing valid data on the erase block with the data to be modified does not need to be erased and re-copied. In addition, writing data offsite can remove erase from the delay path of many storage operations (e.g., erase delay is no longer part of the path of the write operation). The management of data blocks by the storage manager includes addressing specific data blocks specifically for read operations, write operations, or maintenance operations.

[0081] The block storage device may associate n blocks available for user data storage across the storage medium with logical block addresses numbered from 0 to n. In some block storage devices, the logical block addresses for each volume or partition may range from 0 to n. These storage devices may emulate conventional block storage interfaces to maintain compatibility with block storage clients 106.

[0082] In one embodiment, the storage controller 102 provides a block I / O emulation layer, which is used as a block device interface or API. In this embodiment, the storage client 106 communicates with the storage device through the block device interface. In one embodiment, according to the block device interface, the block I / O emulation layer receives commands and logical addresses from the storage client 106. Therefore, the block I / O emulation layer provides storage device compatibility with the block storage client 106.

[0083] In one embodiment, storage client 106 communicates with storage controller 102 through a host interface including a direct interface. In this embodiment, the storage devices directly exchange information specific to non-volatile storage devices.

[0084] Storage devices using a direct interface may store data in the memory die 110 using various organizational structures including, but not limited to, blocks, sectors, pages, logical blocks, logical pages, erase blocks, logical erase blocks, ECC codewords, logical ECC codewords, or in any other format or structure that is conducive to the technical characteristics of the memory die 110.

[0085] The storage controller 102 receives logical addresses and commands from the storage clients 106 and performs corresponding operations associated with the memory die 110. The storage controller 102 may support block I / O emulation, direct interface, or both.

[0086] Figure 2 is a block diagram of an exemplary memory device 200. The memory device 200 may include a memory controller 102 having a flash translation layer 120 and a memory array 218. Each memory die 110 in the memory array 218 may include a die controller 202, at least one non-volatile memory array 210 in a three-dimensional array, and a read / write circuit 214.

[0087] A "memory array" refers to a group of memory cells (also referred to as memory cells) organized into an array structure having rows and columns. The memory array can be addressed using row identifiers and column identifiers. A "nonvolatile memory array" refers to a group of nonvolatile memory cells (also referred to as memory cells or nonvolatile memory cells) organized into an array structure having rows and columns. The memory array can be addressed using row identifiers and column identifiers.

[0088] Those skilled in the art recognize that the memory array may include the group of memory cells within a plane, the group of memory cells within a memory die, the group of memory cells within a group of planes, the group of memory cells within a group of memory dies, the group of memory cells within a memory package, the group of memory cells within a group of memory packages, or have other known memory cell group architectures and configurations.

[0089] A memory array may include a group of memory cells at multiple organizational levels within a storage or memory system. In one embodiment, memory cells within a plane may be organized into a memory array. In one embodiment, memory cells within multiple planes of a memory die may be organized into a memory array. In one embodiment, memory cells within multiple memory dies of a memory device may be organized into a memory array.

[0090] The non-volatile memory array 210 is addressable by word lines via a row decoder 212 and is addressable by bit lines via a column decoder 216. A "word line" refers to a structure within a memory array that includes a group of memory cells. The memory array is configured so that the operating memory cells of the word line are read or sensed during a read operation. Similarly, the memory array is configured so that the operating memory cells of the word line are read or sensed during a read operation. The read / write circuit 214 includes a plurality of sense blocks SB1, SB2, ..., SBp (sense circuits) and allows a page of memory cells to be read or programmed in parallel. In some embodiments, each memory cell across a row of the memory array together forms a physical page.

[0091] A physical page may include memory cells along a row of a memory array for a single plane or for a single memory die. In one embodiment, a memory die includes a memory array consisting of two planes of equal size. In one embodiment, a physical page of one plane of a memory die includes four data blocks (e.g., 16KB). In one embodiment, a physical page of a memory die (also referred to as a "die page") includes two planes each having four data blocks (e.g., 32KB).

[0092] Commands and data are transmitted between the host 300 and the storage controller 102 via the bus 114, and between the storage controller 102 and one or more memory dies 110 via the bus 112. The storage controller 102 may include Figure 1 Describe the logic module in more detail.

[0093] The non-volatile memory array 210 may be two-dimensional (2D—arranged in a single manufacturing plane) or three-dimensional (3D—arranged in multiple manufacturing planes). The non-volatile memory array 210 may include one or more arrays of memory cells, the one or more arrays including a 3D array. In one embodiment, the non-volatile memory array 210 may include a monolithic three-dimensional memory structure (3D array) in which multiple memory levels are formed above (and not in) a single substrate such as a wafer, without an intermediate substrate. The non-volatile memory array 210 may include any type of non-volatile memory that is integrally formed in an array of memory cells having one or more physical levels of active areas disposed above a silicon substrate. The non-volatile memory array 210 may be in a non-volatile solid-state drive having circuitry associated with the operation of the memory cells, whether the associated circuitry is above or within the substrate.

[0094] The word lines may include segments of a layer containing memory cells, which are disposed in a layer above the substrate.Multiple word lines may be formed on a single layer with the aid of trenches or other non-conductive isolation features.

[0095] The die controller 202 cooperates with the read / write circuits 214 to perform memory operations on the memory cells of the non-volatile memory array 210, and includes a state machine 204, an address decoder 206, and a power control 208. The state machine 204 provides chip level control of memory operations.

[0096] The address decoder 206 provides an address interface between the address interface used by the host or memory controller 102 to the hardware addresses used by the row decoder 212 and the column decoder 216. The power control 208 controls the power and voltage supplied to the various control lines during memory operations.

[0097] The power control 208 and / or the read / write circuit 214 may include drivers for word lines, source gate select (SGS) transistors, drain gate select (DGS) transistors, bit lines, substrate (in a 2D memory structure), charge pumps, and source lines. In certain embodiments, the power control 208 may detect a sudden power loss and take preventive measures. The power control 208 may include various first voltage generators (e.g., drivers) to generate the voltages described herein. In one approach, the sense block may include a bit line driver and a sense amplifier.

[0098] In some implementations, some of the components may be combined. In various designs, one or more of the components other than the non-volatile memory array 210 (alone or in combination) may be considered to be at least one control circuit or storage controller that is configured to perform the techniques described herein. For example, the control circuit may include any one of the die controller 202, the state machine 204, the address decoder 206, the column decoder 216, the power control 208, the sense blocks SB1, SB2, ..., SBp, the read / write circuit 214, the storage controller 102, etc., or a combination thereof.

[0099] In one embodiment, the host 300 is a computing device (e.g., a laptop, desktop computer, smart phone, tablet computer, digital camera) that includes one or more processors, one or more processor-readable storage devices (RAM, ROM, flash memory, hard drive, solid-state memory) that store processor-readable code (e.g., software) for programming the storage controller 102 to perform the methods described herein. The host may also include additional system memory, one or more input / output interfaces and / or one or more input / output devices that communicate with the one or more processors, and other components known in the art.

[0100] Typically, associated circuitry is involved to operate and communicate with the memory cells. As a non-limiting example, a memory device may have circuitry for controlling and driving the memory cells to implement functions such as programming and reading. The associated circuitry may be on the same substrate as the memory cells and / or on a separate substrate. For example, a memory controller for memory read-write operations may be located on a separate memory controller chip and / or on the same substrate as the memory cells.

[0101] Those skilled in the art will recognize that the techniques and apparatus disclosed herein are not limited to the two-dimensional and three-dimensional exemplary structures described, but encompass all related memory structures within the spirit and scope of the present technology as described herein and as understood by those skilled in the art.

[0102] Figure 3328. A non-volatile memory system suitable for implementing certain embodiments is shown in FIG. 329. A host 300 stores data in and retrieves data from a storage device 200. The storage device 200 may be embedded in the host 300, or may be in the form of a card or other removable drive, such as a solid state disk (SSD) removably connected to the host 300 via a mechanical connector and / or an electrical connector. The host 300 may be any of a plurality of fixed or portable devices, such as a personal computer, a mobile phone, a personal digital assistant (PDA), etc. The host 300 communicates with the storage device via a communication channel 328.

[0103] The storage device 200 includes a storage controller 102 and a memory die 110. Figure 3 As shown, the storage controller 102 includes a processor 316 and a controller memory 306. The processor 316 may include a microprocessor, a microcontroller, an application-specific integrated circuit (ASIC), a field programmable gate array, a logic digital circuit, or other logic processing capabilities now known or later developed. "Processor" refers to any circuit, component, chip, die, package, or module configured to receive, interpret, decode, and execute machine instructions. Examples of processors may include, but are not limited to, a central processing unit, a general-purpose processor, a special-purpose processor, a graphics processing unit (GPU), a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a system on a chip (SoC), a virtual processor, a processor core, etc.

[0104] Processor 316 may include a storage processor. Storage device 200 may include one or more storage processors. "Storage processor" refers to a processor configured to manage and control storage operations on, in, or between non-volatile storage devices and / or electronic components. In certain embodiments, a storage processor may be referred to as a central processing unit (CPU), an ASIC, a controller, a core, a physical core, etc.

[0105] The controller memory 306 may include volatile memory such as random access memory (RAM 318) and / or non-volatile memory, and processor executable instructions 322 for handling memory management. RAM 318 may include one or more of any of a variety of types of RAM, such as static RAM (SRAM) or dynamic RAM (DRAM). "Volatile memory" refers to an abbreviation for volatile memory media. In certain embodiments, volatile memory refers to volatile memory media and logic, controllers, one or more processors, one or more state machines, and / or other peripheral circuits that manage volatile memory media and provide access to volatile memory media. "Non-volatile memory" refers to a type of storage or memory device, component, or means that retains stored data when power is cut off or removed from non-volatile memory.

[0106] "Volatile memory medium" means any hardware, device, component, element, or circuit configured to maintain a mutable physical property for representing a binary value of zero or one for which, upon removal of primary power or unless primary power is used to refresh the represented binary value, the mutable physical property will revert to a default state that no longer represents the binary value. Examples of volatile memory medium include, but are not limited to, dynamic random access memory (DRAM), static random access memory (SRAM), double data rate random access memory (DDR RAM), or other random access solid-state memory.

[0107] Although volatile memory media is referred to herein as "memory media," in various implementations, volatile memory media may be more generally referred to as volatile memory.

[0108] In certain embodiments, data stored in the volatile memory medium is addressable at a byte level, meaning that the data in the volatile memory medium is organized into bytes (8 bits) of data, each byte having a unique address, such as a logical address.

[0109] "Non-volatile memory medium" refers to any hardware, device, component, element, or circuit configured to retain a changeable physical property representing a binary value of zero or one after primary power is removed.

[0110] As discussed in more detail below, the storage device 200 may include functionality for memory management. In operation, the processor 316 may execute memory management instructions (which may reside in instructions 322) for operating the memory management functionality. The memory management functionality may control the assignment of one or more portions of the memory die 110 within the storage device 200.

[0111] The memory die 110 may include a non-volatile memory medium such as flash memory. One or more memory types may be included in the memory die 110. The memory may include a non-volatile memory array 210. In an embodiment where the memory die 110 includes flash memory as the non-volatile memory, the non-volatile memory array 210 may be composed of flash memory cells of the same type or flash memory cells of different types. For example, the non-volatile memory array 210 may be composed of both single-level cell (SLC) type flash memory and multi-level cell (MLC) type flash memory, with each cell having a capacity of two or more bits to take advantage of the higher write speed of SLC flash memory and the higher density of MLC flash memory. Different combinations of flash memory types are also contemplated for the non-volatile memory array 210. In addition, the memory die 110 may also include volatile memory, such as any of a variety of forms of random access memory (RAM 324).

[0112] The non-volatile memory array 210 of the memory die 110 may include physical blocks of flash memory, each of which is composed of a group of pages, wherein a physical block (also called an erase block) of flash memory is a group of pages, and a page is the smallest write unit in the memory. The physical blocks in the memory include operating blocks represented as logical blocks of the storage client (such as the file system 312). The storage device 200 may be in the form of a portable flash drive, an integrated solid-state drive, or any of a variety of known flash drive formats. In other embodiments, the storage device 200 may include a single type of flash memory with one or more partitions.

[0113] Reference again Figure 3 , the host 300 may include a processor 302 running one or more user applications 104. When data is to be stored on the storage device 200 or retrieved from the storage device, the user application 104 communicates with the file system 312 through one or more operating system application programming interfaces (APIs) 308. The file system 312 may be a software module that executes on the processor 302 and manages files in the storage device 200. The file system 312 manages data clusters in a logical address space. The file system 312 may be a circuit, software, or a combination of circuits and software. Therefore, the file system 312 may be a stand-alone chip or software that can be executed by the processor of the host 300. The storage device driver 314 on the host 300 converts instructions from the file system 312 for transmission between the host 300 and the storage device 200 through a communication channel 328. The interface for communicating through the communication channel 328 may be any one of a plurality of known interfaces, such as NVMe, Universal Flash Storage (UFS), and the like. The host 300 utilizes a file system data structure to maintain a logical address range of all logical block addresses (LBAs) that have been assigned by the host 300 to data.

[0114] In addition to the user data 330 and the file system data structures generated by the host that can be stored in the flash memory on the storage device 200, the storage device itself also stores and maintains an address mapping table 326, a logical to physical mapping table, or other data structures that track the logical addresses provided by the host file system and the physical addresses of the storage device to store data. The main logical to physical mapping table (sometimes referred to as the address mapping table 326) can be stored in the non-volatile memory array 210. A copy of a portion of the address mapping table 326 can be cached in the RAM 318 in the storage device 200 as a mapping table cache 320 to access the logical to physical mapping information faster. "Mapping table cache" refers to a data structure configured to associate LBAs and / or LBA ranges with physical block addresses and / or physical block address ranges. In one embodiment, the mapping table cache can store a portion of the address mapping table so as to access the relevant entries of the address mapping table faster.

[0115] The storage controller 102 may manage the exchange of portions of the address mapping table between the non-volatile memory array 210 and the address mapping table 326 and between the RAM 318 and the mapping table cache 320. Within the storage device 200, the storage controller 102 may function as a processor or manager. The controller memory 306 may store instructions 322 that, when executed by the storage controller 102, configure the device to receive a first logical address associated with a first read command, wherein a first segment of the mapping table cache 320 includes the first logical address. A "read command" refers to a storage command that reads data from a memory cell. The storage device 200 may also receive a second logical address associated with a second read command, wherein a second segment of the address mapping table 326 includes the second logical address.

[0116] The memory controller 102 may also manage the storage of a copy of the address mapping table 310 or portions of the address mapping table 310 residing in the main memory buffer 304 to the memory die 110 non-volatile memory array 210 (e.g., a refresh operation or a swap operation). In one embodiment, the memory controller 102 may retrieve the stored copy of the address mapping table 326 or a portion thereof from the non-volatile memory array 210 during an initialization operation (including a main memory buffer initialization operation). An "initialization operation" refers to any operation, process, method, procedure, and / or sequence of steps performed in series or in parallel to prepare a device, module, circuit, component, subsystem, or system to begin performing normal operations.

[0117] Figure 44 is a block diagram of exemplary components of a host 402 and a memory device 404 (or storage device). The host 402 includes a main memory buffer 406, which may include one or more submission queues 408, one or more completion queues 410, a data buffer 412, at least a portion of an address mapping table 414, and other memory 416. The memory device 404 includes a storage controller 418 and NAND 420 (e.g., memory die).

[0118] The main memory buffer 406 facilitates interaction, communication, and operation between the host 402 and the memory device 404. A "main memory buffer" ("HMB") refers to a volatile memory in the host that is allocated to store a portion of the address mapping table, as an alternative to or in addition to the volatile memory in the non-volatile memory device. For example, some non-volatile memory devices may not have volatile memory, or may have a very small amount of available volatile memory, and the HMB may serve the same or similar function as the volatile memory in the non-volatile memory device.

[0119] As another example, even if the non-volatile storage device includes volatile memory, the HMB can be used as a cache, cache level, or "overflow" memory for the address mapping table, so more entries of the address mapping table can be stored in volatile memory (i.e., stored in the volatile memory of the non-volatile storage device and the HMB of the host). This can improve performance because storing more entries of the address mapping table can reduce the need to access the address mapping table in a slower memory / storage device such as non-volatile memory.

[0120] As data is written or moved into the memory die of the memory device, the mapping in the logical to physical address mapping (address mapping table 414) (stored in the volatile memory of the memory device 404 and / or in the main memory buffer 406) may be updated (e.g., due to garbage collection, bad block replacement, etc.). The updated address mapping table 414 is ultimately stored in the NAND 420 so that these updates will be preserved after a power loss.

[0121] The storage controller 418 includes a host interface manager 422 , a command extractor 424 , a queue manager 426 , a command executor 428 , a memory interface manager 430 , a data transfer scheduler 432 , an ECC manager 434 , and a DMA manager 436 .

[0122] The host interface manager 422 manages the communication and interaction between the host 402 and the memory device 404. A "host interface manager" refers to hardware, firmware, software, circuits, components, modules, logic, devices, or means that are configured, programmed, designed, arranged, or engineered to support communication, interact with, and communicate between a host and peripheral devices such as memory devices and / or non-volatile storage devices.

[0123] In certain embodiments, the command extractor 424 of the storage controller 418 can extract some or all storage commands from the submission queue 408 and queue them for further processing. If the storage command is successfully retrieved without error, the command extractor 424 can then send the queued command to the queue manager 426. The queue manager 426 can manage the host submission queue 408 and / or the completion queue 410.

[0124] The DMA manager 436 is configured to perform data transfers between the host 402 and the memory device 404. The queue manager 426 is configured to post completion entries to the completion queue 410 while also handling related pointers. The ECC manager 434 is configured to correct data retrieved from the NAND memory array NAND 420. The memory interface manager 430 is configured to control and access the NAND memory array NAND 420.

[0125] Figure 4 Also shown is a communication interface between a host 402 and a memory device 404. In a first embodiment ( Figure 4 In the second embodiment (not shown), the communication interface between the host device and the memory device is simplex, where communication to the memory device and communication from the memory device are on the same path. Figure 4 ), the communication interface between the host 402 and the memory device 404 is duplex, with a separate ingress path 440 and a separate egress path 442. From the perspective of the memory device 404, the ingress path 440 includes incoming requests from the host 402 to the memory device 404. Conversely, from the perspective of the memory device 404, the egress path 442 includes outgoing requests from the memory device 404 to the host 402.

[0126] Incoming requests (requests from the host 402 to the memory device 404) can be divided in different ways, such as incoming read requests and incoming write requests. For example, the host 402 can send a read request to read a memory portion in the memory device 404 or a write request to write to a memory portion in the memory device 404 via an ingress path. Similarly, the memory device 404 can send a read request to a memory portion in the host 402 or a write request to write to a memory portion in the host 402 via an egress path.

[0127] Each read request or write request may include a form of a storage operation. Each storage operation may include multiple sub-steps or operations to be performed in order to service the requested operation and / or complete the storage operation. For example, a read request may be received with reference to an LBA in a portion of an address mapping table that is not currently loaded in a main memory buffer or a memory of the storage controller 418, so that a new portion may be swapped into the memory and / or main memory buffer of the storage controller 418 to convert the LBA into a physical block address to service the read request. These steps may have a determined duration, predictable latency, and therefore such storage operations may be considered predictable storage operations.

[0128] The storage controller 418 can move data between the main memory buffer 406 and the volatile memory and NAND 420 memory to satisfy a write or read request. In addition, to service a write command or a read command, the storage controller 418 can swap one or more entries from the address mapping table 414. Such swap operations can be tracked along with the main memory buffer 406 initialization operations. The storage controller 418 can include a control path 438 that can handle various aspects of the submission queue 408, such as fetching commands from the submission queue 408.

[0129] The command executor 428 is configured to select the next pending command from the command manager 426 for further execution. There may be several queues from which to select. The data transfer scheduler 432 is configured to schedule one or more types of data transfers. As an example, read data may arrive from different memory arrays in parallel. The data transfer scheduler 432 may arbitrate from different data transfers.

[0130] A storage operation may include various stages, some of which may be performed by memory device 404 . Figure 4 The blocks shown illustrate various modules and / or processors associated with different stages of command processing. In certain embodiments, Figure 4 The illustrated blocks may be implemented using one or more processors with various combinations of additional circuitry, firmware images, and / or logic. Figure 4The blocks shown may be collectively or individually considered to be electronic components. "Electronic component" refers to any basic discrete device or physical entity in an electronic system used to affect electrons or their associated fields. ("Electronic component" on Wikipedia on April 18, 2020, accessed on May 15, 2020).

[0131] Figure 5 A storage system 500 is shown according to one embodiment. Storage system 500 includes a storage controller 502, a non-volatile memory array 504, a host interface manager 506, a memory interface manager 508, and a host 510.

[0132] The storage controller 502 can be used as Figure 1 and Figure 2 In some embodiments, the storage controller 502 may include at least one of a host interface manager 506 and a memory interface manager 508, but in other embodiments, these functional components may be incorporated into the storage system 500 as separate elements. The storage controller 502 may include a security chip 600.

[0133] The non-volatile memory controller 504 may be configured to store data in the memory cells. The non-volatile memory array 504 may be used as Figure 2 The non-volatile memory array 210 introduced in operates efficiently. The non-volatile memory array 504 may receive processed data from the memory interface manager 508 and may return data output.

[0134] The storage controller 502 includes an internal communication bus 512, a storage processor 514, a volatile memory 516 containing a storage controller firmware image 518 (SCFW), an ECC manager 520, a DMA manager 522, and a flash translation manager 524 (FTM) and a main memory buffer manager 526 (HMBM).

[0135] An "internal communication bus" refers to a communication bus that is connected or coupled to a device or component at a point within a device, housing, or compartment that includes the device or component. In certain embodiments, the internal communication bus includes local interconnections between two or more electronic components, including point-to-point interconnections, and can be implemented within a printed circuit board.

[0136] Examples of internal communication buses and / or associated protocols include, but are not limited to, Advanced eXtensible Interface (AXI), ARM Advanced Microcontroller Bus Architecture (AMBA), System Management Bus (SMBus, SMB), Inter-Integrated Circuit (I2C), GENz, I3C, Peripheral Component Interconnect Express (PCIe) bus, etc.

[0137] In one embodiment, the internal communication bus may include a single bus or a combination of two or more buses. For example, in one embodiment, the internal communication bus may include a central bus (e.g., an Advanced Microcontroller Bus Architecture ("AMBA"), a high performance bus ("AHB") multilayer matrix bus) for a data path and an Advanced Peripheral Bus ("APB") for a command path.

[0138] The storage processor 514 can be used as Figure 3 506, the memory interface manager 508, the DMA manager 522, and the ECC manager 520. In one embodiment, the internal communication bus 512 can be configured so that the storage processor 514 cannot communicate with the security chip 600. The storage processor 514 can be configured to retrieve and execute a storage controller firmware image 518 stored on the volatile memory 516, which is also coupled to the internal communication bus 512.

[0139] The storage processor 514 may receive control signals regarding workload from other components coupled to the internal communication bus 512. These workload attributes may include the percentage of read storage commands received, the percentage of write storage commands received, queue depth, the percentage of storage commands to non-sequential or random addresses, the average transfer length of data associated with storage commands, initiator counts, port counts, input / output per second (IOPS) metrics, and the like.

[0140] The storage controller firmware image 518 serves as logic for managing and operating the storage controller 502. A "storage controller firmware image" refers to a firmware image configured to manage, control, and operate a storage component or device. A "firmware image" refers to a set of firmware organized into a set of organized data (such as files). A firmware image generally refers to firmware that is configured to be used and operated within a computing device and stored on a storage medium. In some embodiments, a firmware image conforms to a predefined firmware image layout defined by a manufacturer, a manufacturer alliance, an industry standard, etc.

[0141] The storage controller firmware image 518 may be defined by the manufacturer of the storage controller 502 and / or the memory device 404 / storage device 200. The storage controller firmware image 518 may be periodically replaced or augmented to provide additional features or improvements. The storage controller firmware image 518 may be altered by malicious actors to include software viruses or malware. Initial versions and versions provided during updates of the storage controller firmware image 518 or during normal operation present such security risks. Modern efforts to install malware or software viruses within the storage controller firmware image 518 may include features to avoid detecting that the storage controller firmware image 518 has been compromised, the storage controller firmware image 518 becoming a compromised firmware.

[0142] Embodiments of the disclosed solution avoid being compromised when the storage controller firmware image 518 is compromised because the security chip 600 is independent and separate from the storage processor 514 or the volatile memory 516 and is not integrated with or in direct communication with the storage processor or the volatile memory. In one embodiment, the storage processor 514 may not be aware that the security chip 600 is coupled to the internal communication bus 512.

[0143] The security chip 600 may include a separate component installed in the storage controller 502 and / or the memory device 404 and coupled to the internal communication bus 512. A "security chip" refers to a dedicated hardware component configured to include a processor and a non-volatile memory that is configured, programmed, designed, arranged, or engineered to provide a specific security feature or function. In one embodiment, the security chip is manufactured in a trusted environment and is configured to interact with other electronic components only under a high security protocol, and has limited or no access to the internal components of the security chip (including any firmware that can be programmed into the security chip in a trusted environment).

[0144] The ECC manager 520 may be configured to encode and decode data stored on and retrieved from the non-volatile memory array 504. An "ECC manager" refers to any hardware, software, firmware, circuit, component, module, logic, device, or apparatus that is configured, programmed, designed, arranged, or engineered to encode data received from a host and to decode and error correct data read from non-volatile memory. The ECC manager may use one or more types of error detection and / or error correction techniques, including but not limited to adding and checking parity data, such as a cyclic redundancy check (CRC), BCH parity data, LDPC codes, and the like.

[0145] The DMA manager 522 may also be coupled to the internal communication bus 512 to implement a data path. The DMA manager 522 may be coupled to the host interface manager 506 and configured to transfer data between the host 510 and the storage controller 502. A "DMA manager" refers to any hardware, software, firmware, circuit, component, module, logic, device, or apparatus configured, programmed, designed, arranged, or engineered to manage data transfers between a memory location on a host and a memory location on a client such as a memory buffer on a peripheral device. In one embodiment, the memory location of the host is a main memory buffer.

[0146] Flash translation manager 524 may be coupled to internal communication bus 512 independently or as part of volatile memory 516, as shown. "Flash translation manager" refers to logic in a non-volatile storage device that includes logical to physical address translation, which provides an abstraction of logical block addresses used by storage clients and physical block addresses where storage controllers store data. The logical to physical translation layer maps logical block addresses (LBAs) to physical addresses of data stored on solid-state storage media.

[0147] In some embodiments, an address mapping table is used to manage the mapping. The mapping allows data to be referenced in a logical block address space using a logical identifier (such as a block address). The logical identifier does not indicate the physical location of the data on the solid-state storage medium, but is an abstract reference to the data. An "address mapping table" refers to a data structure that associates a logical block address with the physical address of data stored on a non-volatile memory array. Alternatively or in addition, an address mapping table may be referred to as a logical to physical address mapping.

[0148] The table may be implemented as an index, a map, a b-tree, a content addressable memory (CAM), a binary tree, a hash table, etc. The address mapping table may be interchangeably referred to as a group allocation table (GAT), a logical to physical address mapping, etc.

[0149] The flash conversion manager 524 can manage or act as Figure 1 The flash translation manager 524 may be configured to translate logical block addresses into physical block addresses within the non-volatile memory array 504 and manage caches of address mapping tables or portions thereof (such as the address mapping table 310 and the address mapping table 326).

[0150] The main memory buffer manager 526 may be coupled to the internal communication bus 512, either independently or as part of the volatile memory 516, as shown. A "main memory buffer manager" refers to any hardware, firmware, software, circuit, component, module, logic, device, or means configured, programmed, designed, arranged, or engineered to manage and operate one or more main memory buffers.

[0151] The main memory buffer manager 526 may be configured to manage main memory buffers within the volatile memory of the host 510, such as the main memory buffer 304. For example, the main memory buffer manager 526 may implement a main memory buffer initialization operation. The main memory buffer manager 526 may also move data between the main memory buffer and the volatile memory 516 or the non-volatile memory array 504 (e.g., address mapping table swap). The main memory buffer manager 526 may also update or read data from the submission queue 408, the completion queue 410, the data buffer 412, the address mapping table 414, and / or other memory 416.

[0152] The host interface manager 506 may be coupled to the external communication bus 528 and configured to communicate between the host 510 and the storage controller 502. In one embodiment, the host interface manager 506 may maintain a secure communication channel 536 between the host 510 and the security chip 600. An "external communication bus" refers to a communication bus that is connected or coupled to a device or component from a point external to the device or component.

[0153] "Secure communication channel" refers to a set of one or more protocols, software, hardware and / or firmware components, modules or devices that are configured to work together or individually to communicate commands, responses and / or data between a sending device and a receiving device in a secure manner. In one embodiment, a secure communication channel includes a method of transmitting data that is resistant to eavesdropping and tampering. ("Secure channel" on Wikipedia, November 2, 2019, modified, accessed November 12, 2019).

[0154] In certain embodiments, the secure communication channel includes an out-of-band channel, which is a separate physical or logical communication channel between the sender and the receiver. The out-of-band channel may include separate physical connections and wires with different interfaces, or separate logical channels using a shared physical communication bus, but the communication bus and protocol are configured so that the sender and receiver can communicate in an authenticated and secure manner.

[0155] In some embodiments, the host interface manager 506 can operate as described for the host interface manager 422. The host interface manager 506 can be configured to handle delays in sending and reporting sent and received data and commands. The host interface manager 506 can send incoming data for non-volatile memory array 504 processing to the memory interface manager 508 via the internal communication bus 512.

[0156] The external communication bus 530 couples the memory interface manager 508 to the non-volatile memory array 504 .

[0157] The memory interface manager 508 may be coupled to the internal communication bus 512 and to the external communication bus 530 coupled to the non-volatile memory array 504 for reading data and writing data to the non-volatile memory array 504. A "memory interface manager" or "flash interface manager" refers to any hardware, firmware, software, circuit, component, module, logic, device, or means configured, programmed, designed, arranged, or engineered to support, interact with, and communicate between a memory controller and one or more memory dies or memory chips.

[0158] In some embodiments, the memory interface manager 508 may operate as described for the memory interface manager 430. Control signals from the host interface manager 506 may be sent to the memory interface manager 508 via the internal communication bus 512. Data from the host interface manager 506 may be sent via a data path including the DMA manager 522 and the ECC manager 520. The memory interface manager 508 may interact with the control signals on the internal communication bus 512 to determine the non-volatile memory array 504 and / or volatile memory 516 addresses to which to direct data and commands. Indirect tables, such as the address mapping table 310 and the address mapping table 326, may store address locations of various components of the non-volatile memory array 504 and the volatile memory 516 for use by the memory interface manager 508.

[0159] The path from the host interface manager 506 to the DMA manager 522, to the ECC manager 520, and from there to the memory interface manager 508 may be considered a data path. The ECC manager 520 may be coupled to the internal communication bus 512 as part of the data path.

[0160] The security chip 600 may be coupled to the internal communication bus 512 and may be configured to monitor the signal traffic 532 on the internal communication bus 512 and detect anomalies that indicate that the storage controller firmware image 518 has been compromised. "Signal traffic" refers to one or more signals, messages, commands, instructions, or events communicated between a sender and one or more receivers on a communication bus.

[0161] In one embodiment, the security chip 600 may not operate until the host 510 sends a firmware monitoring request to the security chip 600. The security chip 600 may receive the firmware monitoring request from the host 510 via the external communication bus 528. The security chip 600 may receive the firmware monitoring request from the host 510 via the external communication bus 528 and via a control bus that may be incorporated into the internal communication bus 512. "Firmware monitoring request" refers to a request for a receiving device or logic or component ("receiver") to monitor one or more groups of firmware. Specifically, the firmware monitoring request may include configuration information, parameters and / or preferences that the receiver is to implement when performing firmware monitoring. For example, in one embodiment, the firmware monitoring request may include data required for the receiver to establish a secure communication channel between the receiver and the entity that issued the firmware monitoring request. The security chip 600 may operate independently of the storage processor 514 and the firmware executed on the storage processor 514.

[0162] In response to the firmware monitoring request, a secure communication channel 536 may be established between the security chip 600 and the host 510. In one embodiment, the host 510 may communicate directly with the security chip 600 to provide the security chip 600. In other words, the host 510 may provide commands and instructions to the security chip 600 for monitoring the abnormality of the storage controller 502. In another embodiment, the host 510 engages the host interface manager 506 to establish a secure communication channel. For example, the host 510 may coordinate with the security chip 600 to use a separate communication channel as the secure communication channel 536. In one embodiment, the host 510 follows the security protocol and data model (SPDM) on the management component transfer protocol (MCTP) architecture / protocol to establish a secure communication channel 536 with the security chip 600.

[0163] The secure communication channel 536 may be configured to be inaccessible to firmware executing on the storage processor 514. In one embodiment, the secure communication channel 536 may be implemented as a separate signal line.

[0164] It should be noted that although Figure 5 A separate physical link / connection is shown, but the host 510 and the security chip 600 can use the external communication bus 528 and still establish a secure communication channel 536 by using encryption and / or separate channel or device addresses. For example, the secure communication channel 536 can also be implemented as a dedicated bus secure communication channel 538 to the host 510 through the internal communication bus 512 and the external communication bus 528.

[0165] The firmware monitoring request may include designations regarding which storage operations are to be observed for anomalies. Certain anomalies may indicate a compromised storage controller firmware image. The firmware monitoring request may designate certain storage operations as target storage operations. For example, a main memory buffer initialization operation may be designated as a target storage operation, while other storage operations may not be so designated. A "target storage operation" is any storage operation for which a compromised firmware image affects the time interval at which the storage operation is performed. The impact of a compromised firmware image on the time interval may be direct or indirect.

[0166] When the security chip is manufactured and the storage security firmware image is installed, the target storage operation may be specified in this way. Alternatively or in addition, the target storage operation may be specified by the host by including a list of target storage operations in a firmware monitoring request before, during, or after establishing a secure communication channel with the security chip. "Storage security firmware image" refers to a firmware image configured to manage, control, and operate a security component or device that is designed, configured, or calibrated to provide security for a storage device or component and / or monitor the activity of a storage device to prevent security vulnerabilities or other security failures. "Compromised firmware" refers to firmware or firmware images that have been changed, modified, and / or altered without the knowledge or permission of the manufacturer, developer, owner, or licensee of the firmware or firmware image.

[0167] "Monitor" refers to any hardware, firmware, software, circuit, component, module, logic, device, or apparatus that is configured, programmed, designed, arranged, or engineered to monitor, monitor, sense, detect, track, record, and / or observe certain activities or operations. In one embodiment, a monitor may detect certain signals, triggers, commands, or other activities that indicate or are related to storage operations within a storage controller. "Trigger" refers to any suitable event and / or set of circumstances that relate to a particular storage operation and / or technology and that can be used to measure the start event of a storage operation. "Start event" refers to an event that is designated as indicating a suitable starting point for a time measurement to perform a storage operation.

[0168] The security chip 600 can be configured to notify the host 510 that the firmware has been compromised based on one or more target storage operations. In one embodiment, the security chip 600 can be a separate component on a printed circuit board including the storage processor 514 and the volatile memory 516. The internal communication bus 512 can be configured so that the storage processor 514 cannot communicate with the security chip 600.

[0169] In some embodiments, the security chip 600 may receive a firmware monitoring request from a host (e.g., or in other embodiments, a security module). In other words, the host providing the security chip 600 may be one of the host 300 or the host 402, or may be a host of a different kind or type. In one embodiment, the host may be one of a security module and a computing device external to the system.

[0170] In such embodiments, the host may include another module, submodule, system, or subsystem separate from the host that initiates storage operations with the memory device 404. For example, in one embodiment, the host may include the security circuit 534.

[0171] “Security Module” means any hardware, circuit, component, module, logic, device or apparatus that is configured, programmed, designed, arranged or engineered to monitor, manage, maintain, preserve or protect one or more electronic components from intrusion, malware, viruses or the like.

[0172] The security module may also be responsible for other cryptographic features, functions, and digital keys related to the operation of the system that the security module is determined to protect and serve. In one embodiment, the host 510 may be coupled to the security circuit 534 via a secure communication channel 536. An example of a security circuit 534 may be a separate chip or subsystem that provides multiple security functions for the system, including encryption, decryption, digital key management, etc.

[0173] Figure 6 A security chip 600 is shown according to one embodiment. The security chip 600 includes a communication bus 602, a memory 604, a processor 606, and a communication module 608.

[0174] The communication bus 602 may be similar to Figure 5 The internal communication bus 512 introduced in FIG. The communication bus 602 may be coupled to the memory 604 and the processor 606 through the communication module 608 as shown, or may be directly coupled to each part, or some combination thereof (eg, using an internal communication bus).

[0175] "Communication module" refers to any hardware, software, firmware, circuit, electronic component, module, logic, device or apparatus that is configured, programmed, designed, arranged or engineered to manage, direct and / or control analog or digital communication between two electronic components. The communication module can use a variety of signal transmission media, including wired interconnection and wireless interconnection (such as Bluetooth, radio frequency (RF) or Wi-fi technology (e.g., radio or chip)). Memory 604 also includes non-volatile memory 610 and volatile memory 612. Volatile memory 612 contains a storage security firmware image 614. Storage security firmware image 614 includes a monitor 616 with an analyzer 618 and a tracker 620, a reporter 622 and a detector 700.

[0176] The memory 604 can be coupled to the communication bus 602. The memory 604 can store the secure firmware image 614, the alert threshold 628, and a repository 624 including delay data 626.

[0177] Processor 606 may be coupled to communication bus 602. Processor 606 may be configured to execute storage security firmware image 614. Processor 606 is one example of a storage processor that may be used in various embodiments of the claimed solution.

[0178] The communication module 608 may be coupled to the communication bus 602. The communication bus 602 may be configured to communicate the anomaly to the host. The communication module 608 may include a security module 632. The security module 632 may be configured to establish a secure communication channel 634 between the host and the communication module 608. For example, the security module 632 may communicate with the host to negotiate a security key and encryption protocol for communicating with the host via the secure communication channel 634.

[0179] The secure communication channel 634 may be similarly described as Figure 5 Functions as described for secure communication channel 536 and dedicated bus secure communication channel 538. In one embodiment, communication module 608 may be configured to communicate only with the host.

[0180] The non-volatile memory 610 also includes a repository 624 of latency data 626, an alert threshold 628, and a target storage operation 630. A "repository" refers to any data source or data set including data or content. In one embodiment, the repository resides on a computing device. In another embodiment, the repository resides on a remote computing or remote storage device. The repository may include a file, a folder, a directory, a set of files, a set of folders, a set of directories, a database, an application, a software application, the content of a text message, the content of an email, the content of a calendar entry, etc. In one embodiment, the repository includes unstructured data. In one embodiment, the repository includes structured data, such as a table, an array, a queue, a lookup table, a hash table, a heap, a stack, etc. The repository can store data in any format, including binary, text, encrypted, unencrypted, proprietary formats, etc.

[0181] "Latency data" refers to data that identifies or can be used to determine the latency of an associated activity, event, or operation (such as a storage operation). "Alert threshold" refers to a predefined threshold type such that when a value, rating, or condition satisfies the alert threshold, the system, device, or method is configured to signal a problem, error, anomaly, or the possibility of a problem, error, or abnormal condition. In certain embodiments, the system, device, or method may respond to the satisfaction of the alert threshold by actively alerting another system, host, controller, processor, circuit, module, etc. The communication module 608 includes a security module 632.

[0182] The storage security firmware image 614 accesses and updates latency data 626, alert thresholds 628, and target storage operations 630 as needed based on monitored storage operations and / or instructions from the host. The storage security firmware image 614 includes a monitor 616, a reporter 622, and a detector 700. The monitor 616 generates latency data 626 of target storage operations 630 identified based on signal traffic on the communication bus 602.

[0183] Monitor 616 may include an analyzer 618 configured to detect events in signal traffic traveling through communication bus 602. "Analyzer" refers to any hardware, software, firmware, circuit, component, module, logic, device, or means configured, programmed, designed, arranged, or engineered to analyze, inspect, and / or review signal traffic or other operations and detect events associated with or indicative of storage operations.

[0184] These events detected by monitor 616 can be peculiar to target storage operation 630. Monitor 616 can also include tracker 620. Tracker 620 can be configured to measure the time interval between start event and stop event. In one embodiment, start event and stop event are associated with target storage operation differently. In other words, the type and property of start event and stop event make monitor 616 clearly identify that event is associated with target storage operation. "Tracker" refers to any hardware, firmware, software, circuit, component, module, logic, equipment or device configured, programmed, designed, arranged or engineered to monitor, pay attention to, track, record and / or observe the time lapse between two events (such as start event and stop event).

[0185] "Event" means a signal, sign, message, activity, behavior, or characteristic, or a change in a signal, sign, message, activity, behavior, or characteristic, that indicates that something has occurred. Events may trigger other activities, or may include activities or behaviors that are being observed or anticipated. Certain events may be of interest in the future. The occurrence of an event may signal or trigger other actions.

[0186] Examples of events include, but are not limited to, reading or writing a particular register or memory address location, raising or lowering a signal on a particular control line, the presence or absence of a particular command, opcode, or sequence of commands or opcodes. In certain embodiments, an event may comprise an aggregation or combination of two or more other events.

[0187] Monitor 616 is in communication with detector 700 Detector 700 can be configured to determine anomalies based on latency data 626 of one or more of target storage operations 630 .

[0188] “Detector” means any hardware, software, firmware, circuit, component, module, logic, device, or apparatus configured, programmed, designed, arranged, or engineered to analyze, inspect, and / or review signal traffic or other operations and detect events associated with or indicative of storage operations.

[0189] The detector 700 may communicate with the reporter 622. "Reporter" means any hardware, firmware, software, circuit, component, module, logic component, device, or means that is configured, programmed, designed, arranged, or engineered to report, notify, signal, alert, or otherwise communicate a message to another circuit, component, module, device, or system.

[0190] If detector 700 determines that an anomaly is present, detector 700 may signal reporter 622. Reporter 622 may then signal the host in response to detector 700 identifying the anomaly, thereby detecting a potentially compromised storage controller firmware image.

[0191] The host may specify any one or more of a plurality of different storage operations as target storage operations. Target storage operations 630 may include flash logic block address translation operations, firmware initialization operations, main memory buffer initialization operations, main memory buffer release operations, power-down operations, and power-on reset operations.

[0192] "Firmware initialization operations" refer to initialization operations related to or otherwise associated with firmware or firmware images, and steps and / or operations that should be performed to prepare the firmware for normal operation. "Power-on reset operations" refer to operations that may include several steps or operations taken by a storage controller, its electronic components, or other electronic components in preparation for restoring power. A power-on reset operation may be initiated after a system or component has been powered off for an undefined period of time or after a system or component has been powered off for a relatively short period of time to reset the system or component.

[0193] “Flash memory logical block address translation operation” refers to an operation involving the flash memory translation layer. Specifically, the flash memory logical block address translation operation may include an operation of reading, writing or managing data or metadata related to the operation of the flash memory translation layer from the flash memory translation layer.

[0194] A "main memory buffer initialization operation" refers to an operation involving one or more main memory buffers. Specifically, a main memory buffer initialization operation may include multiple steps or operations performed in preparing the main memory buffer for use and serving the needs of a non-volatile storage device and / or a host. Typically, a main memory buffer initialization operation is performed when the main memory is first created, allocated, configured, assigned, or associated with a non-volatile storage device or a portion thereof. In the case where the main memory buffer includes one or more dedicated hardware components, the main memory buffer initialization operation may be initiated when the hardware component receives stable power.

[0195] A "main memory buffer release operation" refers to an operation involving one or more main memory buffers. Specifically, a main memory buffer release operation may include multiple steps or operations completed in preparation for terminating, closing, deallocating, releasing, or otherwise stopping the use of one or more main memory buffers. Typically, a main memory buffer release operation is performed when a host attempts to recover non-volatile memory occupied by a main memory buffer. There may be various reasons for releasing a main memory buffer, including the removal of a non-volatile storage device, a request from the host for more non-volatile storage space, a command from a user, a signal initiated by the non-volatile storage device as part of a removal process, etc.

[0196] A "power-down operation" refers to an operation that may include multiple steps or actions taken by a memory controller, its electronic components, or other electronic components in preparation for removing power.

[0197] Target storage operation 630 may be performed by a storage processor such as Figure 5 The communication module 608 may be coupled to the communication bus in a manner that no communication channel exists or is available between the communication module 608 and the storage processor.

[0198] Figure 7 FIG. 7 shows a detector 700 according to one embodiment. The detector 700 may be Figure 6 Other logic modules introduced in (e.g., modules within the storage security firmware image 614) receive information about the delay data 626 and the storage operation 704.

[0199] Storage operations 704 are storage operations for which monitor 616 has detected and measured events. Storage operations 704 viewed by detector 700 may include predictable storage operations 706, semi-predictable storage operations 708, and unpredictable storage operations. In certain embodiments, the storage operations detected by monitor 616 may be predictable storage operations, semi-predictable storage operations, or unpredictable storage operations. In one aspect, anomaly detector 710 may be configured to distinguish unpredictable storage operations from semi-predictable storage operations. If a storage operation is neither a predictable storage operation 706 nor a semi-predictable storage operation 708, in one embodiment, detector 700 may ignore and skip 712 the storage operation. In another embodiment, as anomaly detector 710 collects more latency data 626, anomaly detector 710 may mark certain unpredictable storage operations as semi-predictable storage operations rather than unpredictable storage operations.

[0200] "Predictable storage operations" refer to storage operations that are reliably completed within a predefined time interval within an acceptable tolerance level on either boundary of the time interval. "Unpredictable storage operations" refer to storage operations that are completed within an undefined and unpredictable time interval. Examples of unpredictable storage operations may include certain maintenance storage operations. "Semi-predictable storage operations" refer to storage operations that are completed within variable time intervals within an acceptable tolerance level on either boundary of the time interval. Semi-predictable storage operations are storage operations that are sustained or completed within a partially predictable time interval. Semi-predictable storage operations have a certain degree of variation with each iteration.

[0201] The detector 700 may first perform a predictable storage operation check 702 to determine whether the received storage operation 704 is a predictable storage operation 706. The predictable storage operation 706 may be reviewed by a threshold checker 714. If the delay meets the alert threshold for the predictable storage operation, then it may be determined that the delay data 626 related to these storage operations 704 includes anomalies.

[0202] For example, in one embodiment, an example of a predictable storage operation may be a flash memory logical block address conversion operation. Specifically, a flash memory logical block address conversion operation may be an operation that uses a logical block address to determine a physical block address. This type of operation performed by the flash memory translation layer may be so common and well understood that a time interval may be defined for the operation and configured as an alert threshold. For example, a conversion from a logical block address (LBA) to a physical block address (PBA) may take several microseconds (e.g., 3 to 5 microseconds). Therefore, the alert threshold for such an operation may be set to 10 microseconds, which means that an LBA to PBA conversion that takes more than 10 microseconds may be considered suspicious by the threshold checker 714 and may cause the detector 700 to register an alert 716. In this way, the threshold checker 714 checks for anomalies in the behavior of the flash memory translation layer.

[0203] Those skilled in the art will recognize that the alert thresholds may be set based on a particular type of predictable storage operation, a class of predictable storage operations, and / or a plurality of predictable storage operations. For example, a flash logical block address translation operation may be defined as including swapping a portion of an address mapping table from a mapping table cache or other near-processor volatile memory to a slower, larger capacity volatile memory or non-volatile memory in order to cache a portion of the address mapping table corresponding to an expected LBA for a time margin.

[0204] Other examples of predictable storage operations may include, but are not limited to, power-down operations, power-on reset operations, time to load a storage controller firmware image, firmware initialization operations, initialization operations, main memory buffer initialization operations, and the like.

[0205] Semi-predictable storage operations are those that may experience latency variations due to factors other than the completion of the storage operation steps. An example of a semi-predictable storage operation may include a write storage operation, in which the storage controller firmware image writes a page (logical or physical) to the memory array. The write storage operation time delay may be affected by ambient temperature, the age of the storage block to which the data is being written, and / or a variety of other factors. These effects may make it unreliable to set an alert threshold for the write storage operation that the detector 700 can apply in every case. Therefore, rather than checking such semi-predictable storage operations by the threshold checker 714, they are viewed by the anomaly detector 710.

[0206] Anomaly detector 710 includes logic to account for variations and variances in different latency metrics that may result in different instances of storage operations. Advantageously, anomaly detector 710 can access data in log 718 and latency data 626 in repository 624 to perform analysis of semi-predictable storage operations.

[0207] An "anomaly detector" refers to a device, component, circuit, system, logic, chip, or circuit configured to identify, mark, signal, record, or annotate an anomaly based on one or more of a given set of inputs, historical data, etc. In response to one or more of the delay data 626 and / or historical data satisfying one or more logical operations of the anomaly detector 710, the semi-predictable storage operation 708 may be considered to include an anomaly. To detect anomalies, the anomaly detector 710 may include logic that implements a support vector machine (SVM) linear variant method such as a single-class SVM, a Gaussian mixture model (GMM) method, a density-based variant detection method, a replicator neural network, a cluster-based variant detection method, and / or a K-means detection method. The anomaly detector 710 may analyze a delay data set over a historical time period.

[0208] "Historical time period" refers to a time period in the past. The historical time period may include any time interval, including nanoseconds, microseconds, milliseconds, seconds, minutes, hours, days, weeks, months, and years. In addition, the historical time period may be defined by an initial event and subsequent events or a time period since an initial event. For example, the historical time period may be defined to start when a product is first put into use, or a chip sort test sequence is initiated, or a first request is accepted, and end after a specific time interval that may include the current time. In addition, the historical time period may end when a specific event occurs, such as an error condition or the completion of a storage operation.

[0209] The manufacturer of the security chip may configure or tune the logic of the anomaly detector 710 during manufacturing, after the security chip is operated in the field, or in response to a signal from a host providing the security chip. In addition, when the anomaly detector 710 views the latency data 626 of the storage operation over a historical time period, the anomaly detector 710 may adjust its logic (e.g., adjust the weighted values ​​in the neural network) to more accurately analyze the latency data and more accurately identify anomalies. Such tuning may enable the anomaly detector 710 to determine that the storage operation 704 received by the detector 700 is a semi-predictable storage operation. In addition, the anomaly detector 710 may determine that the target storage operation exhibits an anomaly indicating that the operation is being performed by compromised firmware.

[0210] If the threshold checker 714 and / or the anomaly detector 710 determines that an anomaly exists or an alert threshold is met, an alert 716 may be sent to the host. The detected anomaly and the associated latency data 626 may also be stored in the log 718 for future use, such as by the anomaly detector 710.

[0211] Figure 8 A method for detecting a compromised storage controller firmware image 800 according to one embodiment is shown. At block 802, a security chip monitors a control bus of a non-volatile storage device. The non-volatile storage device includes a processor coupled to the control bus and a plurality of electronic components each coupled to the control bus.

[0212] At block 804, the security chip analyzes signal traffic on the control bus. The security chip looks for events of storage operations initiated by the processor on the control bus. The storage operations include one or more commands for at least one electronic component of the plurality of electronic components.

[0213] At box 806, the security chip measures the latency of the storage operation. At box 808, the security chip determines that the latency of the storage operation meets the warning threshold. At box 810, in response to the storage operation meeting the warning threshold in box 808, the security chip notifies the host firmware that it has been compromised.

[0214] In one embodiment, detecting a storage operation includes: monitoring signal traffic between a processor and one or more of the plurality of electronic components; determining that the signal traffic is associated with a target storage operation; identifying a start event for the target storage operation; and identifying a stop event for the target storage operation. A "stop event" refers to an event that is designated as an appropriate stopping point for a measurement of time for execution of a storage operation.

[0215] In one embodiment, measuring the delay further comprises measuring a time interval between the start event and the stop event, and designating the time interval as the delay of the target storage operation. The delay of the target storage operation may be stored by the security chip.

[0216] Fig. 9 is an example block diagram of a computing device 900 that may incorporate embodiments of the present solution. Fig. 9 Only machine systems that perform various aspects of the technical process described herein are shown, and do not limit the scope of the claims. Those of ordinary skill in the art will recognize other variations, modifications, and substitutions. In certain embodiments, computing device 900 includes data processing system 902, communication network 918, communication network interface 914, input device 910, output device 908, etc.

[0217] like Fig. 9As depicted, data processing system 902 may include one or more processors 906 and a storage subsystem 904. Examples of processors may include, but are not limited to, a central processing unit, a general purpose processor, a special purpose processor, a graphics processing unit (GPU), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SoC), a virtual processor, a processor, and the like.

[0218] The one or more processors 906 communicate with a number of peripheral devices via a bus subsystem 922. These peripheral devices may include input devices 910, output devices 908, a communication network interface 914, and a storage subsystem 904. In one embodiment, the storage subsystem 904 includes one or more storage devices and / or one or more memory devices.

[0219] In one embodiment, storage subsystem 904 includes volatile memory 912 and non-volatile memory 916. Volatile memory 912 and / or non-volatile memory 916 may store computer-executable instructions that, alone or together, form logic 920 that, when applied to and executed by processor 906, implement embodiments of the processes disclosed herein.

[0220] Input devices 910 include devices and mechanisms for inputting information into data processing system 902. These may include keyboards, keypads, touch screens incorporated into graphical user interfaces, audio input devices such as voice recognition systems, microphones, and other types of input devices. In various embodiments, input devices 910 may be embodied as a computer mouse, trackball, trackpad, joystick, wireless remote control, drawing tablet, voice command system, eye tracking system, etc. Input devices 910 typically allow a user to select objects, icons, control areas, text, etc. that appear on a graphical user interface via commands such as clicking a button.

[0221] Output devices 908 include devices and mechanisms for outputting information from data processing system 902. These may include graphical user interfaces, speakers, printers, infrared LEDs, etc., as known in the art. In some embodiments, the graphical user interface is directly coupled to bus subsystem 922 via a wired connection. In other embodiments, the graphical user interface is coupled to data processing system 902 via communication network interface 914. For example, the graphical user interface may include a command line interface on a separate computing device 900 such as a desktop computer, server, or mobile device.

[0222] The communication network interface 914 provides an interface to a communication network (e.g., communication network 918) and devices external to the data processing system 902. The communication network interface 914 can be used as an interface for receiving data from other systems and transmitting data to other systems. Embodiments of the communication network interface 914 can include an Ethernet interface, a modem (telephone, satellite, cable, ISDN), a (asynchronous) digital subscriber line (DSL), FireWire, USB, a wireless communication interface such as Bluetooth or WiFi, a near field communication wireless interface, a cellular interface, etc.

[0223] The communication network interface 914 may be coupled to the communication network 918 via an antenna, cable, etc. In some embodiments, the communication network interface 914 may be physically integrated on a circuit board of the data processing system 902, or in some cases may be implemented in software or firmware such as a "soft modem".

[0224] Computing device 900 may include logic to enable communications over a network using protocols such as HTTP, TCP / IP, RTP / RTSP, IPX, UDP, and the like.

[0225] The volatile memory 912 and the non-volatile memory 916 are examples of tangible media configured to store computer-readable data and instructions to implement various embodiments of the processes described herein. Other types of tangible media include removable memory (e.g., pluggable USB memory devices, mobile device SIM cards), optical storage media such as CD-ROMs, DVDs, semiconductor memories such as flash memories, non-transitory read-only memories (ROMS), battery-backed volatile memories, networked storage devices, etc. The volatile memory 912 and the non-volatile memory 916 can be configured to store basic programming and data constructs that provide the functionality of the disclosed processes and other embodiments thereof that fall within the scope of the present disclosure.

[0226] Logic 920 implementing one or more portions of an embodiment of the present solution may be stored in volatile memory 912 and / or non-volatile memory 916. Logic 920 may be read from volatile memory 912 and / or non-volatile memory 916 and executed by processor 906. Volatile memory 912 and non-volatile memory 916 may also provide a repository for storing data used by logic 920.

[0227] The volatile memory 912 and the non-volatile memory 916 may include multiple memories including a main random access memory (RAM) for storing instructions and data during program execution and a read-only memory (ROM) in which read-only non-transitory instructions are stored. The volatile memory 912 and the non-volatile memory 916 may include a file storage subsystem that provides persistent (non-volatile) storage for program and data files. The volatile memory 912 and the non-volatile memory 916 may include a removable storage system such as a removable flash memory.

[0228] Bus subsystem 922 provides a mechanism for enabling the various components and subsystems of data processing system 902 to communicate with each other as intended. Although communication network interface 914 is schematically depicted as a single bus, some implementations of bus subsystem 922 may utilize multiple different busses.

[0229] It will be apparent to one of ordinary skill in the art that the computing device 900 may be a device such as a smart phone, a desktop computer, a laptop computer, a rack-mounted computer system, a computer server, or a tablet computer device. As is known in the art, the computing device 900 may be implemented as a collection of multiple networked computing devices. In addition, the computing device 900 will typically include operating system logic (not shown), the type and nature of which are known in the art.

[0230] Terms used herein should be given their ordinary meaning in the relevant art, or the meaning dictated by their usage in context, but where an explicit definition is provided, that is meant to control.

[0231] In the present disclosure, different entities (which may be variously referred to as "units", "circuits", "other components", etc.) may be described or stated as being "configured" to perform one or more tasks or operations. The expression - [the entity] is configured to [perform one or more tasks] - is used herein to refer to a structure (i.e., a physical tool such as an electronic circuit). More specifically, the expression is used to indicate that the structure is arranged to perform the one or more tasks during operation. A structure can be said to be "configured to" perform some tasks even if the structure is not currently in operation. A "credit allocation circuit" configured to allocate credits to multiple processor cores is intended to cover, for example, an integrated circuit having circuits that perform this function during operation even if the integrated circuit under consideration is not currently in use (e.g., a power source is not connected to it). Therefore, an entity described or listed as "configured to" perform some tasks refers to a physical entity, such as a device, circuit, memory, etc. that stores program instructions that can be executed to achieve the task. The phrase is not used herein to refer to intangible things.

[0232] The term “configured to” is not intended to mean “configurable to.” For example, an unprogrammed FPGA would not be considered “configured to” perform some specific function, although it may be “configurable to” perform that function after being programmed.

[0233] As used herein, the term "based on" is used to describe one or more factors that influence a determination. The term does not exclude the possibility that other factors may influence the determination. That is, a determination may be based only on the specified factors or on the specified factors as well as other unspecified factors. With reference to the phrase "determining A based on B," the phrase specifies that B is a factor used to determine A or influence the determination of A. The phrase does not exclude that the determination of A may also be based on some other factor, such as C. The phrase is also intended to cover embodiments in which A is determined based solely on B. As used herein, the phrase "based on" is synonymous with the phrase "based at least in part on."

[0234] As used herein, the phrase "in response to" describes one or more factors that trigger an effect. The phrase does not exclude the possibility that additional factors may influence or otherwise trigger the effect. That is, the effect may be responsive only to those factors, or may be responsive to the specified factors as well as other unspecified factors. With reference to the phrase "in response to B performing A," the phrase specifies that B is the factor that triggers the performance of A. The phrase does not exclude that performing A may also be responsive to some other factor, such as C. The phrase is also intended to cover embodiments in which A is performed only in response to B.

[0235] As used herein, unless otherwise indicated, the terms "first," "second," and the like are used as labels for the nouns that precede them, and do not imply any type of ordering (e.g., spatial, temporal, logical, etc.). For example, in a register file having eight registers, the terms "first register" and "second register" may be used to refer to any two of the eight registers, rather than, for example, just logical registers 0 and 1.

[0236] When used in the claims, the term "or" is used as an inclusive or rather than an exclusive or. For example, the phrase "at least one of x, y, or z" means any one of x, y, and z, and any combination thereof.

Claims

1. A method comprising: A security chip monitors a control bus of a non-volatile memory device, the non-volatile memory device comprising a processor coupled to the control bus and a plurality of electronic components each coupled to the control bus; The security chip analyzes signal traffic on the control bus to find an event of a storage operation initiated by the processor on the control bus, the storage operation comprising one or more commands for at least one electronic component of the plurality of electronic components; The security chip measures a delay of the storage operation; The security chip determines that the delay of the storage operation meets a warning threshold; as well as In response to the storage operation satisfying the warning threshold, the security chip notifies the host firmware that it is compromised; and It also includes: In response to the delay satisfying an alert threshold for the storage operation, determining that the delay for the storage operation comprises an anomaly and that the storage operation comprises a predictable storage operation; as well as Responsive to the delay satisfying an anomaly detector for the storage operation, it is determined that the delay of the storage operation comprises an anomaly and that the storage operation comprises a semi-predictable storage operation.

2. The method of claim 1 , wherein detecting the storage operation comprises: monitoring signal traffic between the processor and one or more of the plurality of electronic components; determining that the signal traffic is associated with a target storage operation; as well as identifying a start event of the target storage operation; and A stop event of the target storage operation is identified.

3. The method of claim 2, wherein measuring the delay further comprises measuring a time interval between the start event and the stop event, and designating the time interval as the delay of the target storage operation, the method further comprising storing the delay of the target storage operation.

4. The method of claim 1 further comprises receiving a firmware monitoring request from the host at a security chip coupled to the control bus, the security chip operating independently of the processor and independently of firmware executed on the processor, the security chip being configured to notify the host that firmware has been compromised based on one or more target storage operations.

5. The method of claim 4, wherein in response to receiving the firmware monitoring request, a secure communication channel is established between the security chip and the host, the secure communication channel being configured to be inaccessible to the firmware executed on the processor.

6. The method of claim 4, wherein the firmware monitoring request specifies one or more storage operations as target storage operations.

7. The method of claim 1 , wherein the anomaly detector comprises logic to implement one of: Support Vector Machine (SVM) linear variant method; Gaussian mixture model (GMM) method; Density-based variant detection methods; Replicator neural network; Cluster-based variant detection methods; and K-means detection method.

8. An apparatus comprising: Communication bus; a memory coupled to the communication bus, the memory configured to store a storage security firmware image, an alert threshold, and a repository including delay data; A processor, the processor being coupled to the communication bus, the processor being configured to execute the storage security firmware image, the storage security firmware image comprising: a monitor configured to generate latency data for target storage operations, the target storage operations identified based on signal traffic on the communication bus; a detector configured to determine an anomaly based on the latency data of the target storage operation; and a reporting program configured to signal a host in response to the detector identifying the anomaly indicative of a compromised storage controller firmware image; and a communication module coupled to the communication bus and configured to communicate the anomaly to the host; and Wherein the detector comprises an anomaly detector, wherein the anomaly detector is configured to: Analyze latency datasets over historical time periods; tuning the anomaly detector based on the analyzed delay data set; determining that the target storage operation comprises a semi-predictable storage operation; determining that the latency data for the target storage operation indicates the anomaly; and The exception and the delay data are recorded.

9. The apparatus of claim 8, wherein the monitor comprises: an analyzer configured to detect, based on a trigger, an event in signal traffic traveling through the communication bus, the event being characteristic of the target storage operation; A tracker is configured to measure a time interval between a start event and a stop event, the start event and the stop event being distinctively associated with the target storage operation.

10. The apparatus of claim 8, wherein the communication module comprises a security module configured to establish a secure communication channel between the host and the communication module.

11. The apparatus of claim 8, wherein the target storage operation comprises one of a flash logic block address translation operation, a firmware initialization operation, a main memory buffer initialization operation, a main memory buffer release operation, a power-down operation, and a power-on reset operation.

12. The apparatus of claim 8, wherein the anomaly indicates the compromised storage controller firmware image.

13. The apparatus of claim 8, wherein the communication module is configured to communicate only with the host.

14. The apparatus of claim 8, wherein the target storage operation is initiated by a storage processor coupled to the communication bus, and the communication module is coupled to the communication bus such that there is no communication channel between the communication module and the storage processor.

15. A system comprising: a non-volatile memory array configured to store data in its memory cells; and A storage controller, the storage controller comprising: Internal communication bus; a storage processor coupled to the internal communication bus; a volatile memory coupled to the internal communication bus and configured to store a storage controller firmware image; an error correction code (ECC) manager coupled to the internal communication bus and configured to encode and decode data stored on and retrieved from the non-volatile memory array; a direct memory access (DMA) manager coupled to the internal communication bus and configured to transfer data between a host and the memory controller; a flash translation manager coupled to the internal communication bus and configured to translate logical block addresses into physical block addresses within the nonvolatile memory array and to manage a cache of an address mapping table; a main memory buffer manager coupled to the internal communication bus and configured to manage a main memory buffer within a volatile memory of the host; and a security chip coupled to the internal communication bus and configured to monitor signal traffic on the internal communication bus to detect anomalies indicative of a compromised storage controller firmware image; a host interface manager coupled to an external communication bus and configured to communicate between the host and the storage controller and maintain a secure communication channel between the host and the security chip; and a memory interface manager coupled to the internal communication bus and to an external communication bus coupled to the non-volatile memory array for reading data and writing data to the non-volatile memory array, and The storage processor is configured to execute the storage controller firmware image, and the storage controller firmware image includes: a monitor configured to generate latency data for a target storage operation, the target storage operation being identified based on signal traffic on the internal communication bus; a detector configured to determine an anomaly based on the latency data of the target storage operation; and a reporting program configured to signal the host in response to the detector identifying the anomaly indicative of a compromised storage controller firmware image; and Wherein the detector comprises an anomaly detector, wherein the anomaly detector is configured to: Analyze latency datasets over historical time periods; tuning the anomaly detector based on the analyzed delay data set; determining that the target storage operation comprises a semi-predictable storage operation; determining that the latency data for the target storage operation indicates the anomaly; and The exception and the delay data are recorded.

16. The system of claim 15, wherein the security chip is a separate component on a printed circuit board, the printed circuit board including the storage processor and the volatile memory, and the internal communication bus is configured such that the storage processor cannot communicate with the security chip.

17. The system of claim 15, further comprising a secure communication channel connecting the security chip to the host.

18. The system of claim 15, wherein the host comprises one of a secure circuit and a computing device external to the system.

Images