Storage controller, client system, and method of operating a storage controller

Abstract

A storage controller, a client system, and a method of operating a storage controller are disclosed. The client system includes a client host device and a client storage device including a storage controller and a storage memory. The storage controller includes a host interface, a processor configured to control read and write operations to the storage memory, and a homomorphic encryption and decryption accelerator configured to: based on receiving a read request from the client host device, perform homomorphic encryption on first plaintext data read from the storage memory to generate first homomorphic ciphertext data, and provide the first homomorphic ciphertext data to the client host device through the host interface; and based on receiving a write request from the client host device, perform homomorphic decryption on second homomorphic ciphertext data received through the host interface to generate second plaintext data, and write the second plaintext data into the storage memory.

Description

[0001] This application claims priority to Korean Patent Application No. 10-2020-0088104, filed on July 16, 2020, with the Korean Intellectual Property Office, the entire disclosure of which is incorporated herein by reference. Technical Field

[0002] The disclosure relates to homomorphic encryption and decryption technologies, and more specifically, to a storage controller for performing homomorphic encryption and decryption, a system including the storage controller, and a method for operating the storage controller. Background Technology

[0003] Homomorphic encryption and decryption are encryption techniques that enable operations such as computation, searching, and analysis while the data is encrypted. Recently, with the leakage of personal information becoming a problem, the importance of homomorphic encryption and decryption has been further emphasized. However, the size of homomorphically encrypted ciphertext data can be tens of times larger than the original plaintext data, and the computational complexity of operations supported by homomorphic encryption and decryption is also very high. Furthermore, security issues can arise during the transmission of plaintext or ciphertext data using homomorphic encryption. Summary of the Invention

[0004] A storage controller, a system including the storage controller, and a method for operating the storage controller are provided, which can enhance security and reduce the burden associated with the transmission of homomorphic ciphertext data.

[0005] According to an example embodiment, a client system includes: a client host device; and a client storage device, including a storage controller and a storage memory. The storage controller includes: a host interface; a processor configured to control read and write operations to the storage memory; and a homomorphic encryption and decryption accelerator configured to: perform homomorphic encryption on first plaintext data read from the storage memory based on a read request received from the client host device to generate first homomorphic ciphertext data, and provide the first homomorphic ciphertext data to the client host device through the host interface; and perform homomorphic decryption on second homomorphic ciphertext data received through the host interface based on a write request received from the client host device to generate second plaintext data, and write the second plaintext data into the storage memory.

[0006] According to an example embodiment, a storage controller includes: a host interface; a processor configured to control read and write operations for a storage memory; and a homomorphic encryption and decryption accelerator configured to: perform homomorphic encryption on first plaintext data read from the storage memory to generate first homomorphic ciphertext data based on a read request received from a client host device, and provide the first homomorphic ciphertext data to the client host device through the host interface; and perform homomorphic decryption on second homomorphic ciphertext data received through the host interface to generate second plaintext data based on a write request received from the client host device, and write the second plaintext data into the storage memory.

[0007] According to an example embodiment, a method of operating a storage controller includes: receiving a read request from a host device by a homomorphic encryption and decryption accelerator; based on the read request received from the host device for transferring data stored in the storage memory to a server system, reading data from the storage memory by the homomorphic encryption and decryption accelerator via a first path that performs homomorphic encryption; and based on a read request received from the host device that is not for transferring the data to the server system, reading data from the storage memory by the homomorphic encryption and decryption accelerator via a second path that does not perform homomorphic encryption. Attached Figure Description

[0008] The above and other aspects, features and advantages of the disclosed embodiments will become more apparent from the following description taken in conjunction with the accompanying drawings.

[0009] Figure 1 This is a block diagram illustrating a system according to an example embodiment.

[0010] Figure 2 It is shown Figure 1 A block diagram of an embodiment of the client storage device shown.

[0011] Figure 3 It is shown Figure 2 A block diagram of an embodiment of the storage controller shown.

[0012] Figure 4 It is used to describe Figure 3 The diagram shows the process by which the processor controls the data transmission path.

[0013] Figure 5 It is shown Figures 2 to 4 A block diagram of an embodiment of the homomorphic encryption and decryption accelerator is shown.

[0014] Figure 6 It is shown Figure 5 A block diagram of an embodiment of the random number generator shown.

[0015] Figure 7 It is shown Figure 5A block diagram of an embodiment of the encryption circuit shown.

[0016] Figure 8 It is shown Figure 5 A block diagram of an embodiment of the decryption circuit shown.

[0017] Figure 9 It is shown Figure 1 A block diagram of an embodiment of the server-side storage device shown.

[0018] Figure 10 It is shown Figure 9 A block diagram of an embodiment of the storage controller.

[0019] Figure 11 It is shown Figure 10 A block diagram of an embodiment of a homomorphic operation accelerator.

[0020] Figure 12 Is it showing that the operation includes Figure 1 A flowchart illustrating an embodiment of a method for a storage controller in a client storage device.

[0021] Figure 13 This is a block diagram illustrating a client system according to an example embodiment.

[0022] Figure 14 This is a block diagram illustrating multiple client systems and server systems, including a storage controller, according to an example embodiment. Detailed Implementation

[0023] Exemplary embodiments will be described more fully below with reference to the accompanying drawings, in which exemplary embodiments are illustrated. In the drawings, the same reference numerals always refer to the same elements. Repeated descriptions may be omitted.

[0024] Example embodiments include a storage controller that performs homomorphic encryption, homomorphic decryption, and homomorphic operations, a system including the storage controller, and a method for operating the storage controller. In this case, the security of the system performing homomorphic encryption is enhanced because the public key, private key, and other parameters used to perform homomorphic encryption are not leaked outside the client storage device. Furthermore, by minimizing the number of transmissions of homomorphic ciphertext data with increased size, the overhead associated with transmitting homomorphic ciphertext data can be reduced.

[0025] Figure 1 This is a block diagram illustrating a system according to an example embodiment.

[0026] Reference Figure 1 System 1000 includes client system 300, server system 500, and network 700. System 1000 performs homomorphic encryption and decryption technology.

[0027] Homomorphic encryption and decryption refers to encryption techniques that support the representation of the same result by performing encryption after performing operations on plaintext and by performing operations after encrypting each piece of plaintext. Homomorphic encryption and decryption techniques satisfy the following equation (1).

[0028] Equation 1

[0029] OP(E(PD))=E(OP(PD))

[0030] In Equation 1, PD is the plaintext data obtained by converting plaintext into data, E() is the function that performs encryption, and OP() is the function that performs the operation. When the operation corresponds to addition or multiplication, homomorphic encryption and decryption techniques can satisfy Equation 2 or Equation 3 below.

[0031] Equation 2

[0032] E(PD1) + E(PD2) = E(PD1 + PD2)

[0033] Equation 3

[0034] E(PD1)×E(PD2)=E(PD1×PD2)

[0035] Client system 300 and server system 500 communicate with each other via network 700. Client system 300 can request data from server system 500 or transmit data to server system 500, and server system 500 can also request data from client system 300 or transmit data to client system 300.

[0036] In some embodiments, the data transmitted between the client system 300 and the server system 500 via the network 700 is homomorphic ciphertext data encrypted using homomorphic encryption and decryption techniques. The client system 300 can homomorphically encrypt plaintext data to generate homomorphic ciphertext data and transmit the homomorphic ciphertext data to the server system 500. The server system 500 can receive and store the homomorphic ciphertext data from the client system 300, and then perform homomorphic operations on the homomorphic ciphertext data. The server system 500 can transmit the homomorphic ciphertext data, on which homomorphic operations have been performed, back to the client system 300, and the client system 300 can generate plaintext data by performing homomorphic decryption on the transmitted homomorphic ciphertext data.

[0037] The client system 300 includes a client storage device 330, a client host device 350, and a client dynamic random access memory (DRAM) 370. The client storage device 330 includes a storage controller (SCON) 3000 and a storage memory (SMEM) 3500. The client host device 350 controls the client storage device 330, and the storage controller 3000 controls the client DRAM 370 and the storage memory 3500 under the control of the client host device 350.

[0038] Server system 500 includes server-side storage device 530, server-side host device 550, and server-side DRAM 570. Server-side storage device 530 includes SCON 5000 and SMEM 5500. Server-side host device 550 controls server-side storage device 530, and storage controller 5000 controls server-side DRAM 570 and storage memory 5500 under the control of server-side host device 550.

[0039] Homomorphic encryption and decryption techniques possess mathematically provable security. In some embodiments, homomorphic encryption, homomorphic decryption, and homomorphic operations based on homomorphic encryption and decryption techniques can be defined based on finite rings according to lattice problems. In this case, since algorithms for efficiently solving homomorphic encryption and decryption techniques are currently unknown, the security of homomorphic ciphertext data can be guaranteed when plaintext data is encrypted using homomorphic encryption and decryption techniques to generate homomorphic ciphertext data.

[0040] However, the public key, private key, and other parameters required for homomorphic encryption and decryption by the client system 300 can be temporarily stored in the client storage device 330, client host device 350, and client DRAM 370 included in the client system 300. In this case, the security of the homomorphic ciphertext data is compromised due to issues with the implementation of the homomorphic encryption and decryption technology, rather than the homomorphic encryption and decryption technology itself. This problem also occurs when the server system 500 performs homomorphic operations on the homomorphic ciphertext data.

[0041] However, according to the example embodiment, the client system 300 and server system 500 perform homomorphic encryption, homomorphic decryption, or homomorphic operations within the storage controllers 3000 and 5000 that implement homomorphic encryption and decryption techniques. In this case, because the public key, private key, and other parameters used to perform homomorphic encryption and decryption are not leaked outside the client storage device 330, the security of the system 1000 used to perform homomorphic encryption and decryption can be enhanced. This will be described in more detail below.

[0042] Figure 2 It is shown Figure 1A block diagram of an embodiment of the client storage device shown.

[0043] Reference Figure 2 The client storage device 330 includes a storage controller 3000, a storage memory 3500, and a connector 3800.

[0044] The storage controller 3000 controls the client storage device 330 as a whole under the control of the client host device 350. In some embodiments, the storage controller 3000 controls read and write operations on the storage memory 3500 or the client DRAM 370. However, the scope of the example embodiments is not limited thereto.

[0045] In some embodiments, the storage controller 3000 can control homomorphic encryption and decryption, memory error control operations, randomizer, read level control, and other signal processing operations.

[0046] Memory error control operations refer to operations that control programming errors, programming / erasing errors of data stored in the memory 3500, errors due to leakage of charge stored in the floating gate, and read errors. A randomizer refers to operations that mitigate reliability degradation caused by reverse pattern dependence or coupling phenomena when the data stored in the memory 3500 exhibits a regular or continuous pattern. Read level control refers to operations that control errors occurring according to the method of reading data stored in the memory 3500. Other signal processing operations may include encoding and modulation to improve the reliability of the memory 3500. However, the scope of the example embodiment is not limited thereto. Homomorphic encryption and decryption operations will be described later.

[0047] In some embodiments, when a read request is issued from the client host device 350, the storage controller 3000 can read the requested data from the storage memory 3500 or the client DRAM 370, and when a write request is issued from the client host device 350, the storage controller 3000 can write the requested data into the storage memory 3500 or the client DRAM 370. In some embodiments, the storage controller 3000 may be connected to the client host device 350.

[0048] Storage memory 3500 or client DRAM 370 stores write data transferred from client host device 350 under the control of storage controller 3000. In some embodiments, storage memory 3500 may include a plurality of non-volatile memories. For example, each of the plurality of non-volatile memories may include EEPROM (Electrically Erasable Programmable Read-Only Memory), PRAM (Phase Change Random Access Memory), RRAM (Resistive Random Access Memory), NFGM (Nano Floating Gate Memory), PoRAM (Polymer Random Access Memory), Magnetic Random Access Memory (MRAM), Ferroelectric Random Access Memory (FRAM), or similar memory. In some embodiments, client DRAM 370 may include a plurality of DRAMs as volatile memories.

[0049] The storage controller 3000 also includes a homomorphic encryption and decryption accelerator 3200. The homomorphic encryption and decryption accelerator 3200 can generate homomorphic ciphertext data by performing homomorphic encryption on plaintext data, and generate plaintext data by performing homomorphic decryption on the homomorphic ciphertext data. This will be described in more detail below.

[0050] Figure 3 It is shown Figure 2 A block diagram of an embodiment of the storage controller shown.

[0051] Reference Figure 2 and Figure 3 The storage controller 3000 includes a storage interface 3100, a homomorphic encryption and decryption accelerator 3200, a host interface 3300, a processor (central processing unit) (CPU) 3400, a dynamic random access memory (DRAM) controller 3550, a static random access memory (SRAM) 3600, and a main bus 3700.

[0052] Storage interface 3100 performs communication between storage controller 3000 and storage memory 3500. Host interface 3300 performs communication between storage controller 3000 and client host device 350. Main bus 3700 performs communication between components 3100, 3200, 3300, 3400, 3550, and 3600 included in storage controller 3000. Homomorphic encryption and decryption accelerator 3200 can generate homomorphic ciphertext data by performing homomorphic encryption on plaintext data, or generate plaintext data by performing homomorphic decryption on homomorphic ciphertext data.

[0053] exist Figure 3 In this embodiment, the homomorphic encryption and decryption accelerator 3200 is shown as a module separate from the host interface 3300, but the scope of the example embodiment is not limited thereto. In some embodiments, the homomorphic encryption and decryption accelerator 3200 may be implemented within the host interface 3300.

[0054] The processor 3400 controls read and write operations to the storage memory 3500, and can perform the operations described above. Figure 2 The memory error control, randomizer, read level control, and other signal processing operations described herein are not limited thereto.

[0055] Memory error control, randomizers, read level control, and other signal processing operations can be implemented and executed as separate modules from processor 3400. In some embodiments, processor 3400 can control the data transmission path between storage memory 3500 and client host device 350 during read and write operations. This will be described in more detail below.

[0056] Figure 4 It is used to describe Figure 3 The diagram shows the process by which the processor controls the data transmission path.

[0057] exist Figure 4 The diagram shows components 3100, 3200, 3300, 3400, 3550, 3600, and 3700 of the storage controller 3000. Each of components 3100, 3200, 3300, 3400, 3550, 3600, and 3700 is associated with... Figure 3 The components shown are the same components, but their positions have been changed for ease of description. Path A (PATHA) and path B (PATHB) are shown.

[0058] Reference Figures 2 to 4 Path A and Path B represent data transmission paths between storage memory 3500 and client host device 350. However, the scope of the example embodiment is not limited thereto. Path A represents the data transmission path via storage interface 3100, SRAM 3600, DRAM controller 3550, processor 3400, and host interface 3300. Path B represents the data transmission path further via components 3100, 3300, 3400, 3550, and 3600 on Path A, as well as the homomorphic encryption and decryption accelerator 3200.

[0059] In other words, path A can be a transmission path that does not go through the homomorphic encryption and decryption accelerator 3200, while path B can be a transmission path that goes through the homomorphic encryption and decryption accelerator 3200.

[0060] In some embodiments, path A may include a situation where data transmitted from storage memory 3500 remains in storage controller 3000 and is not transmitted to client host device 350. Alternatively, path A may also include a situation where data transmitted from client host device 350 remains in storage controller 3000 and is not transmitted to storage memory 3500.

[0061] In some embodiments, path B may be a path generated when the client host device 350 issues a read request to the storage controller 3000 for the purpose of transferring data stored in the storage memory 3500 to an external location of the client storage device 330. Conversely, path A may be a path generated when the client host device 350 issues a read request to the storage controller 3000 for a purpose other than transferring data stored in the storage memory 3500 to an external location of the client storage device 330.

[0062] In some embodiments, path B may be a path generated when the client host device 350 issues a write request to the storage controller 3000 for the purpose of writing data received from outside the client storage device 330 into the storage memory 3500. Conversely, path A may be a path generated when the client host device 350 issues a write request to the storage controller 3000 for a purpose other than writing data received from outside the client storage device 330 into the storage memory 3500.

[0063] In some embodiments, path B may pass through the homomorphic encryption and decryption accelerator 3200 in components 3100, 3200, 3300, 3400, 3550, and 3600 in a sequence that precedes the host interface 3300, which performs communication between the storage controller 3000 and the client host device 350. In this case, the homomorphic encryption and decryption accelerator 3200 may be adjacent to the host interface 3300 on path B.

[0064] Figure 5 It is shown Figures 2 to 4 A block diagram of an embodiment of the homomorphic encryption and decryption accelerator is shown.

[0065] Reference Figure 5 The homomorphic encryption and decryption accelerator 3200 includes an encryption circuit (EC) 3210, a key generation circuit (KGC) 3230, a decryption circuit (DC) 3250, and a parameter generation circuit (PGC) 3270.

[0066] Encryption circuit 3210 receives plaintext data PDIN from an external source, receives public key PUBK from key generation circuit 3230, and receives parameter PARAM from parameter generation circuit 3270. Encryption circuit 3210 generates homomorphic ciphertext data CDOUT by performing homomorphic encryption on plaintext data PDIN based on public key PUBK and parameter PARAM.

[0067] The key generation circuit 3230 generates the public key PUBK used in homomorphic encryption and the private key SECK used in homomorphic decryption.

[0068] The decryption circuit 3250 receives homomorphic ciphertext data CDIN from an external source and receives a private key SECK from the key generation circuit 3230. Based on the private key SECK, the decryption circuit 3250 generates plaintext data PDOUT by performing homomorphic decryption on the homomorphic ciphertext data CDIN.

[0069] The parameter generation circuit 3270 generates parameter PARAMs used in homomorphic encryption and homomorphic decryption processes. In some embodiments, the parameter PARAMs used in homomorphic encryption may be different from those used in homomorphic decryption. In some embodiments, the number of parameter PARAMs may be multiple, but the scope of the example embodiments is not limited thereto. Therefore, in embodiments, the homomorphic encryption and decryption accelerator 3200 may be configured to: perform homomorphic encryption on plaintext data read from storage memory 3500 to generate homomorphic ciphertext data based on a read request received from client host device 350, and provide the homomorphic ciphertext data to client host device 350 through host interface 3300; and perform homomorphic decryption on the homomorphic ciphertext data received through host interface 3300 to generate plaintext data based on a write request received from client host device 350, and write the plaintext data into storage memory 3500.

[0070] In some embodiments, the parameters PARAM can be generated based on the homomorphic encryption scheme employed by the homomorphic encryption and decryption accelerator 3200. Homomorphic encryption schemes can be classified from various perspectives. For example, a homomorphic encryption scheme can be one of partial homomorphic encryption, slightly homomorphic encryption, and full homomorphic encryption. Partial homomorphic encryption may support only some operations between ciphertexts, slightly homomorphic encryption may support a limited number of operations between ciphertexts, and full homomorphic encryption may support an unlimited number of operations between ciphertexts. However, in some embodiments, the homomorphic encryption scheme may be one of digital homomorphic encryption and bitwise homomorphic encryption.

[0071] In some embodiments, the parameter PARAM may include parameters related to encoding, decoding, multi-message packing, homomorphic encryption, homomorphic decryption, and key generation; however, the scope of the example embodiments is not limited thereto. In some embodiments, the parameter PARAM may also include parameters related to digital adjustment or key switching.

[0072] The parameter generation circuit 3270 may also include a random number generator (RNG) 3275. This will be described in more detail below.

[0073] Figure 6 It is shown Figure 5 A block diagram of an embodiment of the random number generator shown.

[0074] Reference Figure 6 The random number generator 3275 includes a linear feedback shift register ring oscillator (LFSR RNG) 3271 and a random number provider 3273. In some embodiments, the LFSR RNG 3271 may include a shift register and an XOR logic gate.

[0075] The LFSR RNG 3271 generates a 32-bit output signal LOUT representing values ​​from 0 to 2^32 and transmits the generated 32-bit output signal LOUT to the random number provider 3273. In some embodiments, the LFSR RNG 3271 can be based on FTP (File Transfer Protocol) connection time, inter-processor communication (IPC) time, external temperature, interface (i.e., Figure 3 The output signal LOUT is generated by any one or any combination of the link times of the host interface 3300 or storage interface 3100 shown.

[0076] The random number provider 3273 generates random numbers based on the output signal LOUT. In some embodiments, the random number provider 3273 can generate values ​​"-1", "0", or "1" as random numbers. In some embodiments, the random number provider 3273 can generate random numbers when the output signal LOUT is greater than or equal to 0 and less than 1 / 3 × 2. 32 -1 is generated when the output signal LOUT is greater than or equal to 1 / 3 × 2. 32 And less than 2 / 3 × 2 32 When a "0" is generated, and the output signal LOUT is greater than or equal to 2 / 3 × 2 32 And less than 3 / 3×2 32 The example instance generates a "1", but the scope of the example instance is not limited thereto.

[0077] In some embodiments, the random number generator 3275 may include a reference lookup table (RLUT) 3272.

[0078] Figure 7 It is shown Figure 5 A block diagram of an embodiment of the encryption circuit shown.

[0079] Reference Figure 7 The encryption circuit 3210 includes polynomial multipliers (PM1 and PM2) 3213-1 and 3213-2, polynomial adders (PA1, PA2 and PA3) 3217-1, 3217-2 and 3217-3, and encoder (ENC) 3211.

[0080] Encryption circuit 3210 receives plaintext data PDIN, public key PUBK, and parameter PARAM. In some embodiments, the number of public keys PUBK can be multiple, and the public keys may include a first public key PK1 and a second public key PK2. In some embodiments, parameter PARAM can be input to polynomial multipliers 3213-1 and 3213-2 and polynomial adders 3217-1, 3217-2, and 3217-3. However, the scope of the example embodiments is not limited thereto.

[0081] Polynomial multiplier 3213-1 receives the first public key PK1 and parameter PARAM, and provides the result of performing polynomial multiplication to polynomial adder 3217-1. Polynomial multiplier 3213-2 receives the second public key PK2 and parameter PARAM, and provides the result of performing polynomial multiplication to polynomial adder 3217-2.

[0082] Polynomial adder 3217-1 receives parameters PARAM and the result data executed by polynomial multiplier 3213-1, and provides the result of the polynomial addition operation as first homomorphic ciphertext data CT1. Polynomial adder 3217-2 receives parameters PARAM and the result data executed by polynomial multiplier 3213-2, and provides the result of the polynomial addition operation to polynomial adder 3217-3. Encoder 3211 receives plaintext data PDIN and encodes it, and provides the encoded result data to polynomial adder 3217-3. Polynomial adder 3217-3 receives the result of the operation performed by polynomial adder 3217-2 and encoder 3211, and provides the result of the polynomial addition operation as second homomorphic ciphertext data CT2.

[0083] In other words, the first homomorphic ciphertext data CT1 and the second homomorphic ciphertext data CT2 can be generated according to Equations 4 and 5 below.

[0084] Equation 4

[0085] CT1 = PK1 × PARAM1 + PARAM2

[0086] Equation 5

[0087] CT2=PK2×PARAM1+PARAM3+INC(PDIN)

[0088] In equations 4 and 5, INC() is the encoding function. PARAM1, PARAM2, and PARAM3 are random numbers included in the parameter PARAM.

[0089] Figure 8 It is shown Figure 5 A block diagram of an embodiment of the decryption circuit shown.

[0090] Reference Figure 8 The decryption circuit 3250 includes a polynomial multiplier (PM3) 3251, a polynomial adder (PA4) 3253, and a decoder (DEC) 3255.

[0091] The decryption circuit 3250 receives homomorphic ciphertext data CDIN and a private key SECK. In some embodiments, the number of homomorphic ciphertext data CDINs can be multiple, and the homomorphic ciphertext data CDINs can include first homomorphic ciphertext data CT1 and second homomorphic ciphertext data CT2.

[0092] The polynomial multiplier 3251 receives the first homomorphic ciphertext data CT1 and the private key SECK, and provides the result of the polynomial multiplication operation to the polynomial adder 3253.

[0093] The polynomial adder 3253 receives the second homomorphic ciphertext data CT2 and the result of the operation performed by the polynomial multiplier 3251, and provides the result of the polynomial addition operation to the decoder 3255.

[0094] Decoder 3255 receives and decodes the result of the operation performed by polynomial adder 3253, and provides the decoded result data as plaintext data PDOUT. That is, plaintext data PDOUT can be generated according to Equation 6 below.

[0095] Equation 6

[0096] PDOUT = DEC(CT1 × SECK + CT2)

[0097] In Equation 6, DEC() is the decoding function.

[0098] Figure 9 It is shown Figure 1 A block diagram of an embodiment of the server-side storage device shown.

[0099] Reference Figure 9 The server-side storage device 530 includes SCON 5000, SMEM 5500 and connector 5800.

[0100] The storage controller 5000 controls the server-side storage device 530 as a whole under the control of the server-side host device 550. In some embodiments, the storage controller 5000 controls read and write operations on the storage memory 5500 or the server-side DRAM 570. However, the scope of the example embodiments is not limited thereto. In some embodiments, the storage controller 5000 can control homomorphic operations. The storage controller 5000 can control number-theoretic transformations (NTT), inverse number-theoretic transformations (INTT), matrix-vector multiplication, modular polynomial multiplication, and modular polynomial addition. In some embodiments, an NTT operation can be an operation performed by performing homomorphic multiplication on each homomorphic ciphertext data. A matrix-vector multiplication can be an operation performed by performing pointwise multiplication on the data generated by the NTT operation. An INTT operation can be performed based on the result of performing pointwise multiplication. A modular polynomial multiplication can be an operation performed by performing homomorphic multiplication on each homomorphic ciphertext data. A modular polynomial addition can be an operation performed by performing homomorphic addition on each homomorphic ciphertext data.

[0101] In some embodiments, when a read request is issued from the server-side host device 550, the storage controller 5000 can read the requested data from the storage memory 5500 or the server-side DRAM 570, and when a write request is issued from the server-side host device 550, the storage controller 5000 can write the requested data into the storage memory 5500 or the server-side DRAM 570.

[0102] In some embodiments, the storage controller 5000 can be connected to the server-side host device 550 via connector 5800.

[0103] The storage memory 5500 or the server-side DRAM 570 stores the write data transferred from the server-side host device 550 under the control of the storage controller 5000.

[0104] The storage controller 5000 also includes a homomorphic operation accelerator 5200. The homomorphic operation accelerator 5200 can perform homomorphic operations between homomorphic ciphertext data and generate homomorphic ciphertext data on which the homomorphic operation was performed as the result of the homomorphic operation. This will be described in more detail below.

[0105] Figure 10 It is shown Figure 9 A block diagram of an embodiment of the storage controller.

[0106] Reference Figure 9 and Figure 10The storage controller 5000 includes a storage interface 5100, a homomorphic operation accelerator 5200, a host interface 5300, a processor (central processing unit) (CPU) 5400, a DRAM controller 5550, an SRAM 5600, and a main bus 5700.

[0107] Storage interface 5100 performs communication between storage controller 5000 and storage memory 5500. Host interface 5300 performs communication between storage controller 5000 and server host device 550. Main bus 5700 performs communication between components 5100, 5200, 5300, 5400, 5550 and 5600 included in storage controller 5000.

[0108] Homomorphic operation accelerator 5200 receives homomorphic ciphertext data. Homomorphic operation accelerator 5200 can perform homomorphic operations between the received homomorphic ciphertext data and generate homomorphic ciphertext data on which the homomorphic operations were performed as the result of the homomorphic operation. In some embodiments, homomorphic operation accelerator 5200 can further receive a ciphertext operation level. The ciphertext operation level represents the maximum number of multiplication operations that can be performed between homomorphic ciphertext data without bootstrapping processing.

[0109] The processor 5400 controls read and write operations to the storage memory 5500, and can perform the operations described above. Figure 9 The NTT, INTT, matrix-vector multiplication, modular polynomial multiplication, and modular polynomial addition are described. However, the scope of the example embodiments is not limited thereto. NTT, INTT, matrix-vector multiplication, modular polynomial multiplication, and modular polynomial addition can be performed independently by separate modules different from processor 5400.

[0110] Figure 11 It is shown Figure 10 A block diagram of an embodiment of a homomorphic operation accelerator.

[0111] Reference Figure 11 The homomorphic operation accelerator 5200 includes a dedicated processor (dedicated central processing unit) (dedicated CPU) 5210, a dedicated memory (dedicated SRAM) 5220, an NTT circuit 5230 and an INTT circuit 5240, a matrix-vector multiplication circuit 5250, a modular polynomial multiplication circuit 5260 and a modular polynomial addition circuit 5270.

[0112] The dedicated processor 5210 generally controls components 5220, 5230, 5240, 5250, 5260, and 5270 of the homomorphic operation accelerator 5200. The dedicated processor 5210 may be implemented separately from the processor 5400 included in the memory controller 5000 within the homomorphic operation accelerator 5200. In some embodiments, the dedicated processor 5210 may be a digital signal processor (DSP). In this case, the dedicated processor 5210 may perform floating-point operations in parallel with a higher level. However, the scope of the exemplary embodiments is not limited thereto. The dedicated processor 5210 may be one of a microprocessor, an application processor, or an ARM processor.

[0113] The dedicated memory 5220 temporarily stores the result data based on the operations performed by the NTT circuit 5230, the INTT circuit 5240, the matrix-vector multiplication circuit 5250, the modular polynomial multiplication circuit 5260, and the modular polynomial addition circuit 5270.

[0114] The NTT circuit 5230, INTT circuit 5240, matrix-vector multiplication circuit 5250, modular polynomial multiplication circuit 5260, and modular polynomial addition circuit 5270 can perform homomorphic operations between homomorphic ciphertext data, or can perform operations in intermediate steps to perform homomorphic operations.

[0115] Figure 12 Is it showing that the operation includes Figure 1 A flowchart illustrating an embodiment of a method for a storage controller in a client storage device.

[0116] Reference Figure 1 and Figure 12 In the method of operating the storage controller 3000, a request is received from the client host device 350 (S1000).

[0117] The request received from the client host device 350 may be a read request or a write request. However, the scope of the example embodiment is not limited thereto. In some embodiments, the request received from the client host device 350 may be a request for controlling programming errors, programming / erasing errors of data stored in the memory 3500, errors occurring due to leakage of charge stored in the floating gate, and read errors. Memory error control operation refers to operations that control programming errors, programming / erasing errors of data stored in the memory 3500, errors occurring due to leakage of charge stored in the floating gate, and read errors. Randomizer refers to operations that mitigate reliability degradation caused by reverse pattern dependence or coupling phenomena when the data stored in the memory 3500 exhibits a regular pattern or a continuous pattern. Read level control refers to operations that control errors occurring according to the method of reading data stored in the memory 3500. Other signal processing operations may include coded modulation for improving the reliability of the memory 3500.

[0118] When a request from the client host device 350 is a read request for the purpose of transferring data stored in the storage memory 3500 to the server system 500, data is read from the storage memory 3500 via a first path (e.g., path B) that performs homomorphic encryption. When a request from the client host device 350 is not a request for transferring data stored in the storage memory 3500 to the server system 500, data is read from the storage memory 3500 via a second path (e.g., path A) that does not perform homomorphic encryption (S2000).

[0119] In some embodiments, the second path (e.g., path A) may include a situation where data transmitted from the storage memory 3500 remains in the storage controller 3000 and is not transmitted to the client host device 350. Alternatively, the second path may also include a situation where data transmitted from the client host device 350 remains in the storage controller 3000 and is not transmitted to the storage memory 3500.

[0120] In some embodiments, the first path (e.g., path B) may be a path generated when the client host device 350 issues a read request to the storage controller 3000 for the purpose of transferring data stored in the storage memory 3500 to an external location of the client storage device 330. Conversely, path A may be a path generated when the client host device 350 issues a read request to the storage controller 3000 for a purpose other than transferring data stored in the storage memory 3500 to an external location of the client storage device 330.

[0121] In some embodiments, the first path (e.g., path B) may pass through the homomorphic encryption and decryption accelerator 3200 among components 3100, 3200, 3300, 3400, 3550, and 3600 in a sequence that precedes the host interface 3300, which performs communication between the storage controller 3000 and the client host device 350. In this case, the homomorphic encryption and decryption accelerator 3200 may be adjacent to the host interface 3300 on the first path.

[0122] As mentioned above, the size of homomorphic ciphertext data can be tens of times larger than the size of plaintext data. Therefore, when the storage controller 3000 performs functions other than homomorphic encryption and decryption performed by the homomorphic encryption and decryption accelerator 3200, the storage controller 3000 performs these other functions in the state of plaintext data rather than homomorphic ciphertext data, thereby reducing the cost of data transmission within the storage controller 3000.

[0123] Figure 13 This is a block diagram illustrating a client system according to an example embodiment.

[0124] Reference Figure 13 The client system 7000 includes a processor 7100, a request management circuit 7200, a memory device 7300, a connection circuit 7400, a user interface 7500, and a power supply 7600. The client system 7000 can be any mobile system or computing system.

[0125] The processor 7100 controls the overall operation of the client system 7000, executes the operating system, applications, etc., and performs various computing functions such as calculations or tasks.

[0126] The connection circuit 7400 communicates with an external device. In some embodiments, the connection circuit 7400 may be configured to perform one or more of the following communication methods: WiFi, WiFi Direct, Ethernet, Bluetooth, BLE (Bluetooth Low Energy), SPP (Serial Port Protocol), Zigbee, infrared communication, radio control, UWM (Ultra Wideband), Wireless USB, and NFC (Near Field Communication).

[0127] Memory device 7300 may include a memory controller and non-volatile memory. In some embodiments, the memory controller may be... Figures 1 to 4 , Figure 9 and Figure 10 The storage controller shown is 3000 or 5000, and the non-volatile memory can be... Figure 1 , Figure 2 and Figure 9The storage memory shown is 3500 or 5500. In some embodiments, the non-volatile memory can be implemented as EEPROM, flash memory, MRAM (magnetic RAM), spin-torque MRAM, FeRAM (ferroelectric RAM), PRAM (phase change RAM), RRAM (resistive RAM), nanotube RRAM, polymer RAM, nanofloating gate memory, holographic memory, molecular electronic memory device, or insulator resistance change memory.

[0128] User interface 7500 may include one or more input devices (such as a keyboard, buttons, microphone, and touchscreen) and / or one or more output devices (such as speakers and display devices). In some embodiments, a user can input or inspect plaintext through user interface 7500.

[0129] The 7600 power supply can provide the operating voltage for the customer's 7000 system.

[0130] Figure 14 This is a block diagram illustrating multiple client systems and server systems, including a storage controller, according to an example embodiment.

[0131] Reference Figure 14 System 9000 may include homomorphic encryption processing server system 9100, database 9300, communication network 9500, and client systems (client 1, client 2, and client 3) 9700-1, 9700-2, and 9700-3.

[0132] The homomorphic encryption processing server system 9100 and client systems 9700-1, 9700-2 and 9700-3 may include Figure 2 and Figure 3 The homomorphic encryption and decryption accelerator shown is... Figure 8 and Figure 9 Any one or any combination of the homomorphic operation accelerators shown.

[0133] Client systems 9700-1, 9700-2, and 9700-3 are computing devices or communication terminals with communication functions, and may be mobile phones, smartphones, tablet PCs, mobile internet devices (MIDs), internet tablets, Internet of Things (IoT) devices, or wearable computers, but the scope of the example embodiments is not limited thereto.

[0134] The 9500 communication network includes local area networks (LANs), wide area networks (WANs), the Internet (WWW), wired / wireless data communication networks, telephone networks, and wired / wireless television communication networks.

[0135] The wireless communication network may be one of 3G, 4G, 5G, 3GPP (3rd Generation Partnership Project), LTE (Long Term Evolution), WIMAX (Global Microwave Access Interoperability), WiFi (Wi-Fi), Bluetooth communication, infrared communication, ultrasonic communication, visible light communication (VLC), and Li-Fi (LiFi), but the scope of the example embodiments is not limited thereto.

[0136] As described above, the storage controller, the system including the storage controller, and the method of operating the storage controller according to the example embodiment perform homomorphic encryption, homomorphic decryption, and homomorphic operations. In this case, because the public key, private key, and other parameters used in performing homomorphic encryption are not leaked to the outside of the client storage device, the security of the system performing homomorphic encryption can be enhanced. Furthermore, by minimizing the number of transmissions of homomorphic ciphertext data with increased size, the burden associated with transmitting homomorphic ciphertext data can be reduced.

[0137] The storage controller according to the example embodiment, as well as the client system and server system including the storage controller, can be widely used in various application areas that employ homomorphic encryption technology. Furthermore, the example embodiment can be more usefully applied to computers, laptops, cellular phones, smartphones, MP3 players, personal digital assistants (PDAs), portable multimedia player (PMP) devices, digital TVs, digital cameras, portable game consoles, navigation devices, wearable devices, IoT (Internet of Things) devices, IoE (Internet of Everything) devices, electronic systems (such as e-books), virtual reality (VR) devices, and augmented reality (AR) devices that employ homomorphic encryption technology.

[0138] The foregoing is illustrative of exemplary embodiments and should not be construed as limiting them. Although some exemplary embodiments have been described, those skilled in the art will readily understand that many modifications are possible in the exemplary embodiments without substantially departing from the novel teachings and advantages of the exemplary embodiments. Therefore, all such modifications are intended to be included within the scope of the exemplary embodiments as defined in the claims. It should be understood that the foregoing is illustrative of various exemplary embodiments and should not be construed as limiting to the disclosed exemplary embodiments, and modifications to the disclosed exemplary embodiments and other exemplary embodiments are intended to be included within the scope of the appended claims.

Claims

1. A customer system, the customer system comprising: Client host device; And client-side storage devices, including storage controllers and storage memories, The storage controller includes: Host interface; The processor is configured to control read and write operations to the storage memory; and Homomorphic encryption and decryption accelerators are configured to: read first plaintext data from storage memory via a first path based on a read request for transmitting data to a server system. The storage controller is configured to read the first plaintext data via a second path, different from the first path, based on a read request that is not intended to transmit the data to the server system. The second path does not use homomorphic encryption and decryption accelerators.

2. The customer system according to claim 1, wherein, The first path uses homomorphic encryption and decryption accelerators.

3. The customer system according to claim 1, wherein, The homomorphic encryption and decryption accelerator is adjacent to the host interface on the first path.

4. The customer system according to claim 1, wherein, Homomorphic encryption and decryption accelerators include: The encryption circuit is configured to perform homomorphic encryption. The decryption circuit is configured to perform homomorphic decryption. The key generation circuit is configured to generate public and private keys; and The parameter generation circuit is configured to generate parameters.

5. The customer system according to claim 4, wherein, The encryption circuit is also configured as follows: Receive the first plaintext data; Receive the public key from the key generation circuit; and Receive parameters from the parameter generation circuit.

6. The customer system according to claim 5, wherein, The parameters are related to encoding, decoding, multi-message packing, homomorphic encryption, homomorphic decryption, and key generation.

7. The customer system according to claim 4, wherein, The decryption circuit is also configured as follows: Receive second homomorphic ciphertext data; and Receive the private key from the key generation circuit.

8. The customer system according to claim 4, wherein, The parameter generation circuit is also configured to generate parameters used in homomorphic encryption and homomorphic decryption.

9. The customer system according to claim 8, wherein, The parameter generation circuit is also configured to determine the parameters based on the homomorphic encryption scheme used in homomorphic encryption and homomorphic decryption.

10. The customer system according to claim 9, wherein, Homomorphic encryption schemes include one of the following: partially homomorphic encryption, slightly homomorphic encryption, and fully homomorphic encryption.

11. The customer system according to claim 4, wherein, The parameter generation circuit includes a linear feedback shift register and a reference lookup table.

12. A storage controller, the storage controller comprising: Host interface; The processor is configured to control read and write operations to the storage memory; as well as Homomorphic encryption and decryption accelerators are configured to: read first plaintext data from storage memory via a first path based on a read request for transmitting data to a server system. The storage controller is configured to read the first plaintext data via a second path, different from the first path, based on a read request that is not intended to transmit the data to the server system. The second path does not use homomorphic encryption and decryption accelerators.

13. The storage controller according to claim 12, wherein, The first path uses homomorphic encryption and decryption accelerators.

14. The storage controller according to claim 12, wherein, The homomorphic encryption and decryption accelerator is adjacent to the host interface on the first path.

15. A method of operating a storage controller, the method comprising: The homomorphic encryption and decryption accelerator receives the read request from the host device; Based on a read request received from the host device for transferring data stored in the storage memory to the server system, the data is read from the storage memory by the homomorphic encryption and decryption accelerator through a first path that performs homomorphic encryption; as well as Based on a read request received from the host device that is not for transmitting the data to the server system, the storage controller reads the data from the storage memory via a second path that does not perform homomorphic encryption.

16. The method according to claim 15, wherein, The first path uses homomorphic encryption and decryption accelerators, and The second path is the transmission path that does not use homomorphic encryption and decryption accelerators.

17. The method according to claim 15, wherein, The storage controller includes a host interface for communicating with the host device, and Among them, the homomorphic encryption and decryption accelerator is adjacent to the host interface on the first path.

18. The method according to claim 17, wherein, Homomorphic encryption and decryption accelerators include: The encryption circuit is configured to perform homomorphic encryption. The decryption circuit is configured to perform homomorphic decryption. The key generation circuit is configured to generate public and private keys; and The parameter generation circuit is configured to generate parameters.

Images