Method and system for partial erase of flash memory

Abstract

Data can be purged from a memory device in a manner that is localized to a particular partition of the memory device having two or more partitions. A logical memory block can be unmapped from a physical memory block of a first storage partition of the memory device. The unmapped physical memory block of the first storage partition can be listed in a local unmapped block list uniquely associated with the first storage partition. A local purge command can be received from a host device. At least a portion of the unmapped physical memory block listed only in the local unmapped block list can be purged in response to the local purge command.

Description

[0001] Cross-references to related applications

[0002] This application claims the benefit of U.S. Provisional Patent Application No. 63 / 075,435, entitled “RAPID PURGE”, filed on September 8, 2020, the description of which is incorporated herein by reference in its entirety. Background Technology

[0003] Computing devices may include multiple subsystems that communicate with each other via a bus or other interconnect. Such computing devices can be, for example, portable computing devices (“PCDs”), such as laptops or handheld computers, cellular phones or smartphones, portable digital assistants, portable game consoles, etc. Communication subsystems may be included within the same integrated circuit chip or on different chips. A “system-on-a-chip” or “SoC” is an example of such a chip that integrates many components to provide system-level functionality.

[0004] For example, a SoC may include one or more types of processors, such as a central processing unit (“CPU”), a graphics processing unit (“GPU”), a digital signal processor (“DSP”), and a neural processing unit (“NPU”). An SoC may include other subsystems, such as a transceiver or “modem” providing wireless connectivity, main memory or system memory, one or more cache memories, etc. Some subsystems may include a processing engine capable of performing memory transactions with the memory. System memory in PCDs and other computing devices typically includes dynamic random access memory (“DRAM”). In addition to, or in lieu of, DRAM, computing devices may include non-volatile memory, such as flash memory.

[0005] Computing devices can "delete" data, such as when a user requests the deletion of a file, or when an application deletes temporary data it no longer needs. However, deleting data in this way does not physically remove the data from memory. Instead, deleting data in this way only causes the memory controller to demap a logical address, which the host (e.g., a processing engine) uses to identify the data from a physical address that identifies the data's physical location in memory. This demapping, combined with a process called "garbage collection," allows the physical location to be reused. However, it is still possible for a hacker or other party to retrieve deleted or otherwise demapped data (e.g., during a window after deletion but before garbage collection).

[0006] Since confidential or other sensitive data is often stored in the memory of PCDs and other computing devices, it is desirable to prevent the retrieval of demapped data. "Wipeout" is a term commonly used to refer to the physical removal of data from memory in a manner that prevents data retrieval. Wipeout of flash memory is challenging because features known as write balancing and garbage collection often result in multiple copies of data distributed around different physical "blocks." Flash memory can be wiped by sending a wipe command to the flash memory device from the host. In response to the wipe command, the flash memory device can wipe all demapped blocks in the flash memory device. Flash memory can also be wiped by performing a so-called "factory reset," where all blocks of the memory are demapped, followed by a wipe operation on the demapped blocks. Wipeout of flash memory in this way can be time-consuming, which can be inconvenient or, conversely, undesirable for the user. Summary of the Invention

[0007] Systems, methods, computer-readable media, and other examples for erasing data from memory devices are disclosed.

[0008] An exemplary method for erasing data from a memory device may include unmapping logical memory blocks from physical memory blocks of a first memory partition among a plurality of memory partitions of the memory device. The exemplary method may also include listing the unmapped physical memory blocks of the first memory partition in a list of locally unmapped blocks uniquely associated with the first memory partition. The exemplary method may further include receiving a local wipe command from a host device. The exemplary method may also include, in response to the local wipe command, clearing at least a portion of the unmapped physical memory blocks listed only in the list of locally unmapped blocks.

[0009] An exemplary system for erasing data from a memory device may include a data storage medium and a controller coupled to the data storage medium. The controller may be configured to demap logical memory blocks from physical memory blocks of a first storage partition among a plurality of storage partitions of the data storage medium. The controller may also be configured to list demapped physical memory blocks of the first storage partition in a local list of demapped blocks uniquely associated with the first storage partition. The controller may also be configured to receive a local erasure command from a host device. The controller may further be configured to, in response to a local erasure command, erasure at least a portion of the demapped physical memory blocks listed only in the local list of demapped blocks.

[0010] Another exemplary system for erasing data from a memory device may include components for demapping logical memory blocks from physical memory blocks of a first memory partition among a plurality of memory partitions of the memory device. The exemplary system may also include components for listing the demapped physical memory blocks of the first memory partition in a list of locally demapped blocks uniquely associated with the first memory partition. The exemplary system may also include components for receiving a local wipe command from a host device. The exemplary system may further include components for clearing at least a portion of the demapped physical memory blocks listed only in the list of locally demapped blocks in response to the local wipe command.

[0011] An exemplary computer-readable medium for clearing data from a memory device may include a non-transitory computer-readable medium having instructions stored thereon in a computer-executable form. When executed by a processor, the instructions can configure the processor to demap logical memory blocks from physical memory blocks in a first memory partition of a plurality of memory partitions of the memory device.

[0012] These instructions can also configure the processor to list the demapped physical memory blocks of the first memory partition in a locally demapped block list uniquely associated with the first memory partition. The instructions can also configure the processor to receive a local clear command from the host device. These instructions can also clear at least a portion of the demapped physical memory blocks listed only in the locally demapped block list in response to the local clear command. Attached Figure Description

[0013] In the accompanying drawings, unless otherwise specified, the same reference numerals refer to the same parts throughout the various views. For reference numerals with letter characters, such as "102A" or "102B", the letter characters can distinguish two similar parts or elements appearing in the same drawing. When the reference numerals in all drawings are intended to include all parts having the same reference numeral, the letter characters used for the reference numerals may be omitted.

[0014] Figure 1 This is a memory mapping for a memory device according to an exemplary embodiment.

[0015] Figure 2 This is a block diagram of a system for clearing data from a memory device according to an exemplary embodiment.

[0016] Figure 3 This is a flowchart of a method for clearing data from a memory device according to an exemplary embodiment.

[0017] Figure 4 This is a diagram of a key packaging scheme according to an exemplary embodiment.

[0018] Figure 5 This is a flowchart of another method for clearing data from a memory device according to an exemplary embodiment.

[0019] Figure 6 This is a key hierarchy diagram according to an exemplary embodiment.

[0020] Figure 7 This is a block diagram of a portable computing device according to an exemplary embodiment.

[0021] Figure 8 This is a conceptual diagram of a local clearing command according to an exemplary embodiment. Detailed Implementation

[0022] As used herein, the word “exemplary” means “serving as an example, instance, or illustration.” The word “illustrative” may be used as a synonym for “exemplary” in this document. Any aspect described herein as “exemplary” is not necessarily to be construed as being more preferred or advantageous than other aspects.

[0023] like Figure 1 As illustrated, memory map 100 represents storage space in a memory device (not shown). Memory map 100 may include partitions 102, such as first partition 102A, second partition 102B, etc., up to the Nth partition 102N. The terms "first," "second," etc., are used herein only to help refer to different elements and should not be construed as implying any location, order, sequence, etc. Any number (N) of partitions 102 may exist. Figure 1 The memory map 100 is depicted conceptually and is not intended to indicate actual memory addresses.

[0024] Data can be stored in partition 102 at a location that may be referred to herein as block 104. That is, each block 104 has a physical block address (“PBA”), which can be used to write data to block 104 (that is, physically store data therein) or read data from block 104 (that is, physically retrieve data from there). The block 104 shown is intended only as an example, and there can be any number of blocks 104 in any partition 102.

[0025] Memory mapping 100 may also include areas related to the management of blocks 104 in the first partition 102A to the Nth partition 102N: a global list of used blocks 106, a global list of garbage blocks 108, and a global list of free blocks 110. Block "management" refers to the process of making blocks 104 available for data storage, such as when data is stored in blocks 104, or after data is deleted. Block management also involves moving information identifying blocks 104 (such as block addresses) from one of the lists 106 to 110 to another list within the same list. For the reasons described below, used blocks may also be referred to as mapped blocks, and garbage blocks may also be referred to as unmapped blocks.

[0026] exist Figures 1 to 2 In the exemplary embodiment shown, memory mapping 100 may further include regions related only to the management of blocks 104 in the first partition 102A: a local used block list 112 and a local garbage block list 114. A local free block list 116 may also be included. That is, although in the illustrated embodiment, the global used block list 106, the global garbage block list 108, and the global free block list 110 are associated with all partitions 102A to 102N, in the illustrated embodiment, the local used block list 112, the local garbage block list 114, and the local free block list 116 are associated only with the first partition 102A. However, in other embodiments, such memory mapping may omit the local free block list 116 and instead use the global free block list 110. A potential problem is that in embodiments utilizing the local free block list 116, excessive use of the local sweep function described below may prematurely wear down memory locations, while in embodiments omitting the local free block list 116 and utilizing only the global free block list 110, wear leveling can mitigate such wear.

[0027] like Figure 2 As shown, in system 200, flash memory device 202 is coupled to host system 204. Host system 204 may be, for example, a computing device or a part thereof, such as a processor subsystem, processing engine, etc.

[0028] In the illustrated embodiment, flash memory device 202 has memory block management features and can therefore be a type of memory device commonly referred to as "managed". Examples of managed memory devices include general-purpose flash memory ("UFS"), embedded multimedia cards ("eMMC"), non-volatile fast memory ("NVMe"), etc. Therefore, in other embodiments of the system, the memory device can be any of the foregoing or other non-volatile, managed memory types. Flash memory device 202 may include controller 206. Controller 206 can provide functions associated with a memory controller of a solid-state storage (e.g., flash memory) driver, including, for example, memory block management. Controller 206 can be configured to perform conventional functions associated with a memory controller of a flash memory driver (such as aspects associated with writing and reading data), as well as functions associated with clearing unmapped blocks, as described below. Conventional aspects of flash memory device 202, which are well understood by those skilled in the art, will not be described in detail herein.

[0029] Flash memory device 202 may also include flash memory data storage medium 208. As will be understood by those skilled in the art, flash memory data storage medium 208 may include (not shown for clarity) one or more dies, each die having one or more planes, each plane having a number of blocks (typically on the order of thousands, but may be any number), and each block having a number of pages (typically on the order of tens, but may be any number).

[0030] When host system 204 starts up, in response to a write request (command) issued by host system 204, data can be stored in flash memory device 202. The write command may include one or more logical block addresses (“LBAs”), which identify the location in the host or “logical” address space where host system 204 requests data storage. When data is to be stored in flash memory device 202, controller 206 generates a mapping between each LBA and one or more LBAs. This mapping (of block 104) can be stored in mapping table 210 associated with flash translation layer (“FTL”) 212, through which controller 206 is configured (e.g., via software or firmware). A mapped block 104 can also be referred to as a “used” block 104, meaning that block 104 is in use. Controller 206 can add the LBA of each mapped block 104 to a global list of used blocks 106. Figure 1 )middle.

[0031] Flash memory device 202 may also have a host interface 214 and a flash memory physical interface 216, which may include a portion of controller 206. Under the control of controller 206, data as the subject of a write request may be stored in storage medium 208 at a location corresponding to the mapped PBA. Those skilled in the art will readily understand the details of how data can be transferred from host system 204 to storage medium 208 and stored therein under the control of controller 206 (e.g., via host interface 214 and flash memory physical interface 216), and therefore will not be described herein.

[0032] Host system 204 can use LBAs to address data as objects of read and write commands. Although not shown for clarity, the portion of host system 204 that allocates and deals with LBAs based on software operations in applications or other operations is generally referred to as the file system. The file system may be part of the operating system of host system 204.

[0033] Typically, flash storage medium 208 is not rewritable. Instead, data can only be stored in block 104 that has already been erased. Figure 1 The erased block can also be considered to be in a "free" state. The erased block 104 can be listed in the global free list 110. Figure 1 In embodiments where the flash storage medium is rewritable, blocks can be listed in a global free list 110 without first erasing them. When generating the mapping described above in response to a write command, the controller 206 can select a PBA from the global free list 110.

[0034] As those skilled in the art will understand, the physical locations in storage medium 208 have a finite lifespan. That is, after a certain number of accesses (e.g., erase and program flash memory commands), each location will be worn down to the point where it may no longer function properly. To mitigate this "wear-out" effect, the flash memory controller can run a process called wear leveling. According to wear leveling, the controller 206 can attempt to distribute data evenly across all blocks 104 to avoid some blocks 104 wearing out more than others. Wear leveling, like the mapping described above, is another function of FTL 212.

[0035] From the perspective of host system 204, data stored in flash memory device 202 can be deleted. To delete data in this manner, host system 204 can issue a write command or an erase command to flash memory device 202. The write command or erase command may include one or more LBAs identifying the location from which host system 204 requests data to be deleted. In response to the write command or erase command, controller 206 can remove the mapping between one or more PBAs and LBAs from mapping table 210. For clarity, the command issued by host system 204 that causes controller 206 to remove such mappings (e.g., a write command or an erase command) may be referred to in this disclosure as an "unmapping" command. Controller 206 may also demap each unmapped block 104 ( Figure 1 The PBA is moved from the global used block list 106 to the global garbage block list 108.

[0036] During what is commonly referred to as garbage collection, controller 206 may sometimes move data (pages) from blocks 104 listed in the global used block list 106 to other blocks 104 and update mapping table 210 accordingly. The purpose of such data movement is to remove some of the blocks 104 from use so that those blocks 104 no longer in use can be erased and then reused to store new data. When a block 104 no longer contains data in use, controller 206 may move the PBA of that block 104 from the global used block list 106 to the global garbage block list 108. Controller 206 may erase blocks 104 listed in the global garbage block list 108 and move the PBA of the erased blocks 104 to the global free block list 110. Like the mapping described above, garbage collection is another function of FTL 212. Controller 206 may perform garbage collection in the background (i.e., during periods when the host system 204 is not interacting with the flash memory device 202).

[0037] For security reasons, it may be desirable to prevent the retrieval of demapped data (i.e., invalid or no longer used data) from storage medium 208. Although the demapping described above prevents host system 204 from accessing the data (addressed by LBA), such demapping does not affect the physical state of the data in storage medium 208. Without the erasure-related features described below, hackers or other parties could potentially use software tools (i.e., software other than the file system of host system 204) to retrieve the demapped data from storage medium 208.

[0038] Terms such as “sanitizing” and “erasing” typically refer to the physical removal of demapped data from memory to prevent data retrieval. Performing such operations on flash memory can be challenging because, among other reasons, the operations of features such as wear leveling and garbage collection described above can result in multiple copies of the same data distributed around storage medium 208.

[0039] Managed flash memory devices (such as UFS devices) can implement erase commands, which may be referred to herein as global erase commands to distinguish them from the local erase commands described below. In response to a global erase command issued by host system 204, controller 206 can erase all demapped blocks 104. Managed flash memory devices can also implement format cell commands. In response to a format cell command issued by host system 204, controller 206 can erase all demapped blocks 104 (e.g., in response to an erase command) and then write various data values ​​(such as all zeros, all one, random numbers, etc.) to the erased blocks 104 to mask any remaining physical representation of the originally stored data. Controller 206 can move the PBA of erased block 104 from the global garbage block list 108 to the global free block list 110.

[0040] When the global garbage block list 108 contains a number of unmapped blocks 104, clearing them in response to a global clear command or formatting cell command in the manner described above can be time-consuming. A global clear operation as described above can take, for example, several hours. To provide a clearing operation faster than a global clear operation, in addition to, or as an alternative to, the global clear features described above, the device 202 may have the following local clearing features.

[0041] At least one of the partitions 102, which may be referred to as a "special" partition or a "local" partition, may have one or more characteristics that differ from the other partitions 102. In the illustrated embodiment, the first partition 102A may be a special or local partition, such as... Figure 1 The boundary is depicted by a medium-thick line. In the illustrated embodiment, the first partition 102A is characterized by a local list of used blocks 112, a local list of garbage blocks 114, and a local list of free blocks 116. As mentioned above, in some embodiments, the local list of free blocks 116 may be omitted. In the illustrated embodiment, partitions 102 other than the first partition 102A do not include such local lists of used blocks, local lists of garbage blocks, or local lists of free blocks.

[0042] Special or local partitions, such as the first partition 102A in the illustrated embodiment, can be, for example, a replay protection memory block (“RPMB”). An RPMB is an authenticated access partition. When an entity’s authentication is successful, that entity (e.g., host system 204) can be authorized to access only authenticated access partitions, such as RPMBs. However, in other embodiments, a special partition can be any partition of the storage medium (sometimes also referred to as a logical unit).

[0043] To provide local cleanup features, controller 206 can be configured (e.g., via software or firmware) to respond to local cleanup commands received from host system 204 in a manner similar to how controller 206 responds to global cleanup commands as described above. However, in the exemplary embodiment, this is different from cleaning all blocks 104 listed in the global garbage block list 108. Figure 1 Unlike a global cleanup operation, a local cleanup operation only cleans up blocks 104 listed in a local garbage block list 114. Therefore, in this exemplary embodiment, unlike a global cleanup operation that can clean up blocks 104 in any partition from the first partition 102A to the Nth partition 102N, a local cleanup operation can clean up blocks 104 only in the first partition 102A and not any blocks in any partition from the second partition 102B to the Nth partition 102N. A local cleanup operation may include the controller 206 erasing all blocks 104 listed in the local garbage block list 114. A local cleanup operation may also include the controller writing various data values ​​(such as all zeros, all ones, random numbers, etc.) to those erased blocks 104 to mask any remaining physical representation of the original stored data. The controller 206 may move the PBA of the erased block 104 from the local garbage block list 114 to the global free block list 110 (or, in some embodiments, to the local free block list 116). Because local cleanup operations are limited to specific partitions (e.g., the first partition 102A in this exemplary embodiment), local cleanup operations can be completed in a significantly shorter amount of time than global cleanup operations.

[0044] Controller 206 can be configured to perform garbage collection in the first partition 102A in a manner similar to that described above, where controller 206 can generally perform garbage collection in partition 102. That is, controller 206 may sometimes move data (pages) from blocks 104 listed in the local used block list 112 to other blocks 104 in the first partition 102A and update mapping table 210 accordingly to remove some of the blocks 104 in the first partition 102A from use. When a block 104 listed in the local used block list 112 no longer contains data in use, controller 206 may move the PBA of that block 104 from the local used block list 112 to the local garbage block list 114. Controller 206 may erase blocks 104 listed in the local garbage block list 114 and move the PBAs of those erased blocks 104 to the global free block list 110 (or, in some embodiments, to the local free block list 116).

[0045] Note that although both garbage collection and sweeping operations involve erasing block 104, garbage collection typically results in erasing only a small portion of the unmapped blocks 104 at a time. In contrast, sweeping operations can erase all unmapped blocks 104: a global sweep operation can erase all unmapped blocks 104 listed in the global garbage block list 108, and a local sweep operation can erase only the unmapped blocks 104 listed in the local garbage block list 114.

[0046] Except that block management operations associated with the first partition 102A can use the local used block list 112 and the local garbage block list 114 instead of the global used block list 106 and the global garbage block list 108, write operations for the first partition 102A can be performed in a manner similar to that described above with respect to any partition 102. In some embodiments, the local free block list 116 can be used instead of the global free block list 110, or as a supplement to the global free block list 110. Thus, in response to receiving a write request (command) from the host system 204, the controller 206 can select one or more blocks 104 (identified by PBAs) listed in the global free block list 110, generate a mapping between each LBA and one or more PBAs, store one or more mappings in the mapping table 210, store the data as the subject of the write request in the storage medium 208, and add the PBA of each mapped block 104 to the local used block list 112. As described above, in the exemplary embodiment, a prerequisite or condition for completing a write operation or other access in the first partition 102A is successful authentication of the host system 204. However, in other embodiments, the special partition may not be an authenticated access block, and therefore in such other embodiments, authentication may not be required for the host system to access the special partition.

[0047] exist Figure 3 The diagram illustrates a method 300 for clearing data from a memory device having two or more storage partitions. As indicated by box 302, the LBA can demap from a physical memory block of a storage partition of the memory device. This storage partition can be, for example, as described above regarding... Figure 2 The described special partition (e.g., first partition 102A). As indicated by box 304, the demapped physical memory blocks of this storage partition may be listed in a local demapped block list uniquely associated with that storage partition. As indicated by box 306, a local clear command may be received from the host device. As indicated by box 308, in response to the local clear command, demapped physical memory blocks listed only in the local demapped block list may be cleared. That is, demapped physical memory blocks listed in any other demapped block list (such as a global demapped block list) may not be cleared in response to this local type of clear command. In some embodiments, method 300 may be provided in addition to a method (not shown) that can clear demapped physical memory blocks listed in a global demapped block list covering all partitions of the storage device. It should be understood that although boxes 302 to 308 have been described above in an exemplary order that helps guide the reader through an example of method 300, the actions described above in conjunction with boxes 302 to 308 may occur in any order that produces the same or similar results.

[0048] Conveniently, the partial purge feature can actually be used to purge encrypted data stored in partitions 102B to Nth partition 102N. This feature is sometimes referred to as cryptographic purge. Although the partial purge operation may actually only purge data block 104 in the first partition 102A, in embodiments where data block 104 in the first partition 102A is used to store key information associated with the encrypted data stored in data block 104 in any of the partitions 102B to Nth partition 102N, purging the key information effectively purges the encrypted data associated with the key information. Figure 1 In the diagram, the dashed arrows conceptually indicate the encryption of data in some exemplary data blocks 104 from the second partition 102B to the Nth partition 102N using key information from other exemplary data blocks 104 in the first partition 102A. The encryption key can be stored in encrypted form using a technique sometimes called key wrapping.

[0049] like Figure 4 As shown, the key packaging scheme 400 can involve several types of keys and several operations or functions. This can be implemented in host system 204 ( Figure 2 A key wrapping scheme 400 is provided. A key derivation function 402 can operate on inputs including a seed 403 (i.e., a randomly generated number), a unique hardware key 404, and a user certificate (or context) to produce a key-wrapped key 406. A key generator 408 can produce a (random) stored encryption key 410. A key wrapping function 412 can operate on inputs including the key-wrapped key 406 and the stored encryption key 410 to produce a wrapped stored encryption key 414. The wrapped stored encryption key 414 and the seed 403 can be stored in block 104 in the form of a binary large object or "blob". The "key information" mentioned above can include the wrapped stored encryption key 414, the seed 403 of that key 414, or other information capable of recovering encrypted data. In an exemplary embodiment, all data stored in block 104 in partitions 102B to 102N can be encrypted by a key (e.g., in the form of a key block) stored in block 104 in the first partition 102A. In such embodiments, clearing the first partition 102A containing the key information effectively (or from an cryptographic perspective) clears all partitions 102A to 102N, since data cannot be retrieved without the key information. As mentioned above, clearing only the first partition 102A is likely much faster than clearing all partitions 102A to 102N.

[0050] exist Figure 5The diagram illustrates a method 500 for erasing data from a memory device having two or more storage partitions. As indicated by box 502, data can be encrypted using a corresponding key to form encrypted data units. As indicated by box 504, key information can be stored in a first storage partition. This first storage partition can be, for example, as described above, compared to some other (second, third, etc.) storage partitions of the memory device. Figure 2 The special partition described (e.g., first partition 102A). As indicated in box 506, encrypted data units may be stored in another (second) storage partition of the memory device.

[0051] As indicated in box 508, logical memory blocks associated with a key can be unmapped from physical memory blocks storing key information (box 504). As indicated in box 510, unmapped physical memory blocks of the first storage partition can be listed in a locally unmapped block list uniquely associated with the first storage partition. As indicated in box 512, a local clear command can be received from the host device. As indicated in box 514, in response to the local clear command, only unmapped physical memory blocks listed in the locally unmapped block list (and therefore including unmapped physical memory blocks in which key information is stored) can be cleared. That is, unmapped physical memory blocks listed in any other unmapped block list (such as a global unmapped block list) may not be cleared in response to the local clear command. In some embodiments, method 500 may be provided in addition to a method (not shown) that can clear unmapped physical memory blocks listed in a global unmapped block list covering all partitions of the memory device. It should be understood that although boxes 502 to 514 have been described above in an exemplary order that helps guide the reader through the example of method 500, the actions described above in conjunction with boxes 502 to 514 may occur in any order that produces the same or similar results.

[0052] exist Figure 6 In the key hierarchy 600, it is illustrated that the key mentioned above can be of any type. For example, the key mentioned above can be any of the following: user key 602 (e.g., first user key 602A associated with a first user, second user key 602B associated with a second user, etc.); application-specific key 604 (e.g., first application-specific key 604A associated with a first application, second application-specific key 604B associated with a second application, etc.); or folder key 606 (e.g., first folder key 606A associated with a first folder of the first application, second folder key 606B associated with a second folder of the first application, etc.).

[0053] It can be resolved by the host system 204 ( Figure 2 The key management system (not shown) maintains a key hierarchy 600 in a special partition of the storage device described above. Each user key 602 can be unique to the user of the application on the host system 204. The key management system can use the user key 602 to wrap the application-specific key 604, and can use the application-specific key 604 to wrap the folder key 606. When the application deletes a folder protected by the folder key 606, the key management system can generate a new application-specific key 604 and repackage all associated folder keys 606. When a different user needs to access the application, the key management system can use that user's user key 602 to wrap the application-specific key 604. When a user no longer needs to access the application, the key management system can remove that user's user key 602 from the special partition where the keys are stored. Removing a key from the special partition can include unmapping the block containing the key. The key management system can clear the special partition (thus clearing all unmapped keys) in the manner described above. The key management system can clear the special partition at any time (such as, for example, hourly, daily, or when a block containing a key is unmapped).

[0054] In some embodiments, such as those utilizing a local free block list instead of a global free block list, a clearing count feature may be included. (See again...) Figure 2 The key management system (not shown) of the host system 204 can be based on flash storage medium 208 ( Figure 2 The frequency of erasing a special partition is determined by the number of lifetime erase cycles that can be performed and the total number of erase operations that the special partition has undergone. Flash memory device 202 may include a erase counter 218. Each time controller 206 performs a erase operation on the special partition, controller 206 may increment the erase counter 218. In response to a partial erase command received from host system 204, controller 206 may not only perform the erase operation but also return the erase count or value in the erase counter 218 to host system 204. Based on this erase count (or a erase count combined with other information, such as the number of lifetime erase cycles that the flash memory device can perform), the key management system may determine when to initiate the next erase operation.

[0055] like Figure 7 As shown, exemplary embodiments of a system and method for erasing data from a memory device can be provided in a portable computing device (“PCD”) 700. For clarity, in Figure 7Data buses or other data communication interconnects are not shown. Some exemplary interconnects are described for the context, some of which may represent communication via such buses or interconnects. However, it should be understood that, more generally, the various elements described below can communicate with each other via one or more buses or systems interconnected.

[0056] PCD 700 may include SoC 702. SoC 702 may include CPU 704, GPU 706, DSP 707, analog signal processor 708, or other processors. CPU 704 may include multiple cores, such as first core 704A, second core 704B, etc., up to Nth core 704N.

[0057] Display controller 710 and touchscreen controller 712 may be coupled to CPU 704. A touchscreen display 714 external to SoC 702 may be coupled to display controller 710 and touchscreen controller 712. PCD 700 may also include a video decoder 716 coupled to CPU 704. Video amplifier 718 may be coupled to video decoder 716 and touchscreen display 714. Video port 720 may be coupled to video amplifier 718. Universal Serial Bus (“USB”) controller 722 may also be coupled to CPU 704, and USB port 724 may be coupled to USB controller 722. Subscriber identification module (“SIM”) card 726 may also be coupled to CPU 704.

[0058] One or more memories may be coupled to CPU 704. The one or more memories may include both volatile and non-volatile memories. Examples of volatile memories include static random access memory (“SRAM”) 728 and dynamic RAM (“DRAM”) 730 and 731. Such memories may be external to SoC 702, such as DRAM 730, or internal to SoC 702, such as DRAM 731. A DRAM controller 732 coupled to CPU 704 may control the writing of data to and from DRAM 730 and 731. In other embodiments, such a DRAM controller may be included within a processor, such as CPU 704.

[0059] PCD 700 may include a flash memory device 733, such as a chip coupled to SoC 702. The flash memory device 733 may be coupled to CPU 704 via, for example, an input / output (“I / O”) interface 735. The I / O interface 735 may include a bus (such as a Peripheral Component Interconnect Fast (“PCIe”) bus) or any other type of interconnect with CPU 704. The flash memory device 733 may be as described above. Figure 2An example of a described flash memory device 202. Although in this embodiment, the flash memory device 202 includes a controller 206 ( Figure 2 However, in other embodiments, such a controller may be included in the SoC. The CPU 704 and related components may be configured to provide the host system functions described above.

[0060] A stereo audio CODEC 734 can be coupled to an analog signal processor 708. Additionally, an audio amplifier 736 can be coupled to the stereo audio CODEC 734. A first stereo speaker 738 and a second stereo speaker 740 can be coupled to the audio amplifier 736 accordingly. Furthermore, a microphone amplifier 742 can be coupled to the stereo audio CODEC 734, and a microphone 744 can be coupled to the microphone amplifier 742. An FM radio tuner 746 can be coupled to the stereo audio CODEC 734. An FM antenna 748 can be coupled to the FM radio tuner 746. Additionally, stereo headphones 750 can be coupled to the stereo audio CODEC 734. Other devices that can be coupled to the CPU 704 include one or more digital (e.g., CCD or CMOS) cameras 752.

[0061] The modem or RF transceiver 754 can be coupled to the analog signal processor 708 and the CPU 704. The RF switch 756 can be coupled to the RF transceiver 754 and the RF antenna 758. In addition, the keypad 760, the mono headset 762 with a microphone, and the vibrator device 764 can be coupled to the analog signal processor 708.

[0062] The SoC 702 may have one or more internal or on-chip thermal sensors 770A and may be coupled to one or more external or off-chip thermal sensors 770B. An analog-to-digital converter (“ADC”) controller 772 can convert the voltage drop generated by the thermal sensors 770A and 770B into a digital signal. A power supply 774 and a power management integrated circuit (“PMIC”) 776 can power the SoC 702.

[0063] Firmware or software may be stored in any of the memories described above (such as DRAM 730 or 731, SRAM 728, etc.), or may be stored in local memory that is directly accessible to processor hardware on which the software or firmware can be executed. Execution of such firmware or software can control aspects of any of the methods described above or configure aspects of any of the systems described above. Any such memory or other non-transitory storage medium having firmware or software stored therein in a computer-readable form for execution by the processor hardware can be an example of a "computer-readable medium," as the term is understood in the patent dictionary.

[0064] The local wipe commands described above can be included in a set of commands covered by flash memory standards such as the UFS standard. In addition to the global wipe commands described above, local wipe commands can be included in (e.g., UFS) command sets. Figure 8 Example 800 of a local wipe command is shown conceptually. As described above, a special or local partition can be an RPMB. Unlike a global wipe command, which may not take any arguments, a local wipe command can take arguments specifying a region within the local partition (i.e., a subset of RPMB blocks). For example, the host can set the value of the arguments to identify any of the following: a first region spanning blocks 0 to 2 of the RPMB (RMPB region_0); a second region spanning blocks 3 to 7 of the RPMB (RMPB region_1); a third region spanning blocks 8 to 9 of the RPMB (RMPB region_2); a fourth region spanning blocks 10 to 14 of the RPMB (RMPB region_3), and so on. Figure 8 The regions shown are merely examples, and using the local wipe command arguments, a host can define any group of blocks as such a region. In response to a local wipe command received from the host, a flash memory device such as a UFS device can wipe only those blocks identified by the value of the argument in the local wipe command. In this way, the host can wipe all blocks or only a subset of blocks in a local partition (e.g., RPMB).

[0065] Alternative embodiments will become apparent to those skilled in the art. Therefore, although selected aspects have been illustrated and described in detail, it should be understood that various substitutions and modifications can be made therein.

[0066] Implementation examples are described in the following numbered clauses:

[0067] 1. A method for erasing data from a memory device, comprising:

[0068] Demap logical memory blocks from physical memory blocks in the first memory partition of a memory device with respect to multiple memory partitions;

[0069] List the demapped physical memory blocks of the first storage partition in the local demapped block list that is uniquely associated with the first storage partition;

[0070] Receive a partial clear command from the host device; and

[0071] In response to a local clear command, at least a portion of the demapped physical memory blocks listed in the local demapped block list are cleared.

[0072] 2. The method according to Clause 1, wherein the memory device is non-volatile.

[0073] 3. The method according to any one of Clauses 1 to 2, wherein the first storage partition is an authenticated access partition.

[0074] 4. The method according to any one of Clauses 1 to 3, wherein the first storage partition is a replay protection memory block.

[0075] 5. The method according to any one of Clauses 1 to 4 further includes listing the cleared physical memory blocks in a local free block list, wherein the local free block list is uniquely associated with the first storage partition.

[0076] 6. The method according to any one of Clauses 1 to 5, wherein a global demapped block list and a global free block list are associated with a plurality of storage partitions other than a first storage partition, and further comprising receiving a global clear command from a host device, and clearing all demapped physical memory blocks listed in the global demapped block list in response to the global clear command.

[0077] 7. The method according to any one of clauses 1 to 6 further includes:

[0078] Multiple encrypted data units are formed using multiple corresponding keys;

[0079] Key information associated with multiple keys is stored in the first storage partition; and

[0080] Multiple encrypted data units are stored in a second storage partition across multiple storage partitions;

[0081] Demapping logical memory blocks from physical memory blocks in the first storage partition includes: demapping logical memory blocks associated with multiple keys from physical memory blocks storing key information;

[0082] Clearing the demapped physical memory blocks listed in the local demapped block list includes clearing the physical memory blocks that store key information.

[0083] 8. The method according to any one of clauses 1 to 7 further comprises:

[0084] In response to a partial clear command, a clear count is provided to the host system; and

[0085] Increment the cleanup count in response to a local cleanup command.

[0086] 9. The method according to any one of Clauses 1 to 8, wherein receiving a partial clear command includes receiving an instruction to clear a portion of a demapped physical memory block.

[0087] 10. A system for erasing data from a memory device, comprising:

[0088] Data storage media; and

[0089] A controller, coupled to the data storage medium, is configured to:

[0090] Demap the logical memory block from the physical memory block of the first storage partition of the multiple storage partitions of the data storage medium;

[0091] List the demapped physical memory blocks of the first storage partition in the local demapped block list that is uniquely associated with the first storage partition;

[0092] Receive a partial clear command from the host device; and

[0093] In response to a local clear command, at least a portion of the demapped physical memory blocks listed in the local demapped block list are cleared.

[0094] 11. The system according to Clause 10, wherein the data storage medium is non-volatile.

[0095] 12. The system according to any one of Clauses 10 to 11, wherein the first storage partition is an authenticated access partition.

[0096] 13. The system according to any one of Clauses 10 to 12, wherein the first storage partition is a replay protection memory block.

[0097] 14. The system according to any one of Clauses 10 to 13, wherein the controller is further configured to list cleared physical memory blocks in a local free block list, wherein the local free block list is uniquely associated with the first storage partition.

[0098] 15. The system according to any one of Clauses 10 to 14, wherein a global demapped block list and a global free block list are associated with a plurality of storage partitions other than a first storage partition, and the controller is further configured to: receive a global clear command from a host device and, in response to the global clear command, clear all demapped physical memory blocks listed in the global demapped block list.

[0099] 16. The system according to any one of clauses 10 to 15, wherein the controller is further configured to:

[0100] Multiple encrypted data units are formed using multiple corresponding keys;

[0101] Key information associated with multiple keys is stored in the first storage partition; and

[0102] The encrypted data units are stored in the second storage partition of the multiple storage partitions;

[0103] The controller is configured to demap logical memory blocks from the physical memory blocks of the first storage partition by demapping logical memory blocks associated with the plurality of keys from the physical memory blocks storing the key information.

[0104] The controller is configured to clear the demapped physical memory blocks listed in the local demapped block list by clearing the physical memory blocks storing the key information.

[0105] 17. The system according to any one of clauses 10 to 16, wherein the controller is further configured to:

[0106] In response to a partial clear command, a clear count is provided to the host system; and

[0107] Increment the cleanup count in response to a local cleanup command.

[0108] 18. The system according to any one of Clauses 10 to 17, wherein the local clear command includes an indication of the portion of the demapped physical memory block to be cleared.

[0109] 19. A system for erasing data from a memory device, comprising:

[0110] A component used to demap logical memory blocks from physical memory blocks in the first storage partition of a memory device's multiple storage partitions;

[0111] A component for listing the demapped physical memory blocks of the first storage partition in a list of locally demapped blocks uniquely associated with the first storage partition;

[0112] Components for receiving partial clear commands from the host device; and

[0113] A component used to clear at least a portion of the demapped physical memory blocks listed in a local demapped block list in response to a local clear command.

[0114] 20. The system according to Clause 19, wherein the memory device is non-volatile.

[0115] 21. The system according to any one of Clauses 19 to 20, wherein the first storage partition is an authenticated access partition.

[0116] 22. The system according to any one of Clauses 19 to 21, wherein the first storage partition is a replay protection memory block.

[0117] 23. The system according to any one of Clauses 19 to 22 further includes means for listing cleared physical memory blocks in a local free block list, wherein the local free block list is uniquely associated with the first storage partition.

[0118] 24. The system according to any one of Clauses 19 to 23, wherein a global demapped block list and a global free block list are associated with a plurality of storage partitions other than a first storage partition, the receiving component is further configured to receive a global clear command from the host device, and the clearing component is further configured to clear all demapped physical memory blocks listed in the global demapped block list in response to the global clear command.

[0119] 25. The system according to any one of clauses 19 to 24 further includes:

[0120] A component used to form multiple encrypted data units using multiple corresponding keys;

[0121] A component for storing key information associated with multiple keys in a first storage partition; and

[0122] A component used to store multiple encrypted data units in a second storage partition of multiple storage partitions;

[0123] The component for demapping logical memory blocks from physical memory blocks of the first storage partition includes: a component for demapping logical memory blocks associated with multiple keys from physical memory blocks storing key information;

[0124] The component for clearing demapped physical memory blocks listed in the local demapped block list includes a component for clearing physical memory blocks storing key information.

[0125] 26. The system according to any one of clauses 19 to 25 further includes:

[0126] A component for providing a cleanup count to the host system in response to a partial cleanup command; and

[0127] A component used to increment the clear count in response to a local clear command.

[0128] 27. The system according to any one of Clauses 19 to 26, wherein the local clear command includes an indication of the portion of the demapped physical memory block to be cleared.

[0129] 28. A computer-readable medium for erasing data from a memory device, comprising a non-transitory computer-readable medium having stored thereon instructions in a computer-executable form, the instructions, when executed by a processor, configuring the processor to:

[0130] Demap logical memory blocks from physical memory blocks in the first memory partition of a memory device with respect to multiple memory partitions;

[0131] List the demapped physical memory blocks of the first storage partition in the local demapped block list that is uniquely associated with the first storage partition;

[0132] Receive a partial clear command from the host device; and

[0133] In response to a local clear command, at least a portion of the demapped physical memory blocks listed in the local demapped block list are cleared.

[0134] 29. The computer-readable medium as described in Clause 28, wherein the memory device is non-volatile.

[0135] 30. The computer-readable medium according to any one of Clauses 28 to 29, wherein the first storage partition is an authorized access partition.

[0136] 31. The computer-readable medium according to any one of Clauses 28 to 30, wherein the first storage partition is a replay-protected memory block.

[0137] 32. The computer-readable medium according to any one of clauses 28 to 31, wherein the instructions also configure the processor to list cleared physical memory blocks in a local free block list, wherein the local free block list is uniquely associated with the first memory partition.

[0138] 33. A computer-readable medium according to any one of Clauses 28 to 32, wherein a global demapped block list and a global free block list are associated with a plurality of storage partitions other than a first storage partition, and the instructions also configure the processor to receive a global clear command from a host device and, in response to the global clear command, clear all demapped physical memory blocks listed in the global demapped block list.

[0139] 34. A computer-readable medium according to any one of clauses 28 to 33, wherein the instructions also configure the processor to:

[0140] Multiple encrypted data units are formed using multiple corresponding keys;

[0141] Key information associated with multiple keys is stored in the first storage partition; and

[0142] The encrypted data units are stored in the second storage partition of the multiple storage partitions;

[0143] The instruction configures the processor to demap the logical memory block associated with the plurality of keys from the physical memory block storing the key information, thereby demapping the logical memory block from the physical memory block of the first storage partition.

[0144] The instruction configures the processor to clear the demapped physical memory blocks listed in the local demapped block list by configuring the processor to clear the physical memory blocks storing the key information.

[0145] 35. The computer-readable medium according to clauses 28 to 34, wherein the partial clearing command includes an indication of the portion of a demapped physical memory block to be cleared.

[0146] 36. A managed flash memory device, comprising:

[0147] Multiple partitions, at least one of the multiple partitions has a locally demapped list of blocks uniquely associated with it, and multiple partitions other than at least one of the multiple partitions have a globally demapped list of blocks associated with them.

[0148] The managed flash memory devices are configured as follows:

[0149] Receive a local clear command from the host device, and in response to the local clear command, clear at least a portion of the demapped physical memory blocks listed only in the local demapped block list; and

[0150] Receive a global clear command from the host device, and in response to the global clear command, clear all unmapped physical memory blocks listed in the global unmapped block list.

[0151] 37. The managed flash memory device as described in Clause 36, wherein at least one of the plurality of partitions comprises a replay protection memory block.

Claims

1. A method for erasing data from a memory device, comprising: Demapping logical memory blocks from physical memory blocks of multiple memory partitions of the memory device, wherein each of the multiple memory partitions comprises multiple physical memory blocks; The list of locally demapped blocks associated only with the first storage partition among the plurality of storage partitions lists demapped physical memory blocks that are only within the first storage partition, which is a replay protection memory block. The global unmapped block list lists all unmapped physical memory blocks for all memory partitions in the plurality of memory partitions of the memory device. Receive a global clear command from the host device; In response to the global clear command, clear the demapped physical memory blocks listed in the global demapped block list; The host device generates a local clear command to clear only the demapped physical memory blocks within the first storage partition that are listed in the local demapped block list associated only with the first storage partition; Receive the partial clear command from the host device; In response to the local clear command, only the demapped physical memory blocks listed in the local demapped block list associated only with the first storage partition are cleared; as well as The local free block list lists the cleared physical memory blocks of the first storage partition, wherein the local free block list is associated only with the first storage partition.

2. The method of claim 1, wherein the memory device is non-volatile.

3. The method according to claim 1, further comprising: Multiple encrypted data units are formed using multiple corresponding keys; The key information associated with the plurality of keys is stored in the first storage partition; as well as The plurality of encrypted data units are stored in the second storage partition of the plurality of storage partitions; Demapping logical memory blocks from physical memory blocks of the first storage partition includes: demapping logical memory blocks associated with the plurality of keys from physical memory blocks storing the key information; Clearing the demapped physical memory blocks listed in the demapped block list of the locality includes clearing the physical memory blocks storing the key information.

4. The method according to claim 1, further comprising: In response to the local clear command, a clear count is provided to the host device; as well as The clearing count is incremented in response to the local clearing command.

5. The method of claim 1, wherein receiving the partial clear command includes receiving an indication of the portion of the demapped physical memory block to be cleared.

6. A system for erasing data from a memory device, comprising: A data storage medium, wherein the data storage medium includes a plurality of storage partitions and each of the plurality of storage partitions includes a plurality of physical memory blocks; as well as A controller, coupled to the data storage medium, is configured to: Demapping logical memory blocks from physical memory blocks of the plurality of storage partitions of the data storage medium; The list of locally demapped blocks associated only with the first storage partition among the plurality of storage partitions lists demapped physical memory blocks that are only within the first storage partition, which is a replay protection memory block. The global unmapped block list lists all unmapped physical memory blocks for all memory partitions in the plurality of memory partitions of the memory device. Receive a global clear command from the host device; In response to the global clear command, clear the demapped physical memory blocks listed in the global demapped block list; The host device generates a local clear command to clear only the demapped physical memory blocks within the first storage partition that are listed in the local demapped block list associated only with the first storage partition; Receive the partial clear command from the host device; In response to the local clear command, only the demapped physical memory blocks listed in the local demapped block list associated only with the first storage partition are cleared; as well as The local free block list lists the cleared physical memory blocks of the first storage partition, wherein the local free block list is associated only with the first storage partition.

7. The system of claim 6, wherein the data storage medium is non-volatile.

8. The system of claim 6, wherein the controller is further configured to: Multiple encrypted data units are formed using multiple corresponding keys; The key information associated with the plurality of keys is stored in the first storage partition; as well as The plurality of encrypted data units are stored in the second storage partition of the plurality of storage partitions; The controller is configured to demap logical memory blocks from the physical memory blocks of the first storage partition by being configured to demap logical memory blocks associated with the plurality of keys from physical memory blocks storing the key information; The controller is configured to clear the demapped physical memory blocks listed in the locally demapped block list by clearing the physical memory blocks storing the key information.

9. The system of claim 6, wherein the controller is further configured to: In response to the local clear command, a clear count is provided to the host device; and The clearing count is incremented in response to the local clearing command.

10. The system of claim 6, wherein the local clear command includes an indication of the portion of the demapped physical memory block to be cleared.

11. A system for erasing data from a memory device, comprising: A component for demapping logical memory blocks from physical memory blocks of a plurality of memory partitions of the memory device, wherein each of the plurality of memory partitions includes a plurality of physical memory blocks; A component for listing, in a list of locally demapped blocks associated only with a first storage partition among the plurality of storage partitions, demapped physical memory blocks that are only within the first storage partition, which is a replay-protected memory block; A component for listing all demapped physical memory blocks of all memory partitions in the plurality of memory partitions of the memory device in a global demapped block list; A component used to receive global clear commands from the host device; A component for clearing demapped physical memory blocks listed in the global demapped block list in response to the global clear command; A component for generating a local clear command by the host device to clear only the demapped physical memory blocks within the first storage partition that are listed in the local demapped block list associated only with the first storage partition. Components for receiving the local clearing command from the host device; A component for responding to the local clear command to clear only the demapped physical memory blocks listed in the local demapped block list associated only with the first storage partition; as well as A component for listing the cleared physical memory blocks of the first storage partition in a local free block list, wherein the local free block list is associated only with the first storage partition.

12. The system of claim 11, wherein the memory device is non-volatile.

13. The system according to claim 11, further comprising: A component used to form multiple encrypted data units using multiple corresponding keys; A component for storing key information associated with the plurality of keys in the first storage partition; as well as A component for storing multiple encrypted data units in a second storage partition of the multiple storage partitions; The component for demapping logical memory blocks from physical memory blocks of the first storage partition includes: a component for demapping logical memory blocks associated with the plurality of keys from physical memory blocks storing the key information; The component for clearing the demapped physical memory blocks listed in the demapped block list of the locality includes: a component for clearing the physical memory blocks storing the key information.

14. The system of claim 11, further comprising: A component for providing a clearing count to the host device in response to the local clearing command; as well as A component for incrementing the clearing count in response to the local clearing command.

15. The system of claim 11, wherein the local clear command includes an indication of the portion of the demapped physical memory block to be cleared.

16. A non-transitory computer-readable medium for erasing data from a memory device, comprising a non-transitory computer-readable medium having stored thereon instructions in a computer-executable form, the instructions, when executed by a processor, configuring the processor to: Demapping logical memory blocks from physical memory blocks of multiple memory partitions of the memory device, wherein each of the multiple memory partitions comprises multiple physical memory blocks; The list of locally demapped blocks associated only with the first storage partition among the plurality of storage partitions lists demapped physical memory blocks that are only within the first storage partition, which is a replay protection memory block. The global unmapped block list lists all unmapped physical memory blocks for all memory partitions in the plurality of memory partitions of the memory device. Receive a global clear command from the host device; In response to the global clear command, clear the demapped physical memory blocks listed in the global demapped block list; The host device generates a local clear command to clear only the demapped physical memory blocks within the first storage partition that are listed in the local demapped block list associated only with the first storage partition; Receive the local clear command from the host device; in response to the local clear command, clear only the demapped physical memory blocks listed in the demapped block list of the locality associated only with the first storage partition; as well as The local free block list lists the cleared physical memory blocks of the first storage partition, wherein the local free block list is associated only with the first storage partition.

17. The non-transitory computer-readable medium of claim 16, wherein the memory device is non-volatile.

18. The non-transitory computer-readable medium of claim 16, wherein the instructions further configure the processor to: Multiple encrypted data units are formed using multiple corresponding keys; The key information associated with the plurality of keys is stored in the first storage partition; as well as The plurality of encrypted data units are stored in the second storage partition of the plurality of storage partitions; The instructions wherein the processor is configured to demap the logical memory block from the physical memory block of the first storage partition by configuring the processor to demap the logical memory block associated with the plurality of keys from the physical memory block storing the key information; The instructions therein configure the processor to clear the demapped physical memory blocks listed in the local demapped block list by configuring the processor to clear the physical memory blocks storing the key information.

19. The non-transitory computer-readable medium of claim 16, wherein the local clear command includes an indication of the portion of the demapped physical memory block to be cleared.

Images