A trusted system for decentralized data storage

Abstract

Certain aspects of the present disclosure provide techniques for proving possession of data in a storage device participating in a distributed data storage network. An exemplary storage device includes a storage circuit system and a trusted circuit. The storage circuit system is configured to store a plurality of data blocks. The trusted circuit typically has a private signature key securely stored thereon. The trusted circuit is typically configured to calculate a hash of the data stored in the plurality of data blocks and generate an anonymous digital signature for the data stored in the plurality of data blocks based at least in part on the private signature key and the calculated hash. The trusted circuit can be inserted into a write path of the storage circuit system so that data written to the storage circuit system is processed by the trusted circuit.

Description

[0001] introduction

[0002] Aspects of the present disclosure relate to distributed, decentralized data storage systems, and more particularly, to trusted storage devices that can prove possession of data in a decentralized data storage system.

[0003] Blockchains can be used in various decentralized systems, including, for example, cryptocurrency systems, to provide a ledger of transactions occurring within those decentralized systems. Typically, a blockchain can include a chain of blocks, where the most recent block includes information about transactions that occurred and a reference to an immediate predecessor block, which can be a hash of the previous block. Because the reference to an immediate predecessor block can be a value derived from the immediate predecessor block, verification of transactions in the blockchain can be performed by ensuring that the hash of the block resolves to the same value as the value stored as a reference to the immediate predecessor block of a subsequent block in the blockchain. If the calculated hash value of a block does not match the hash value of that block in a subsequent block in the blockchain, verification of the blockchain may fail.

[0004] In some cases, blockchains can be used in distributed storage networks, where various storage devices on various computing devices can contribute storage capacity to the distributed storage network. In such cases, blockchains can be used to track data storage and / or retrieval transactions. Typically, a data storage transaction may specify that a particular data segment of a specific size be stored on one or more storage devices in the distributed storage network. However, the blockchain itself may not guarantee that the data segment specified in the storage transaction is actually stored on a given device, and that the storage device storing the data has not reallocated the space allocated for the data segment due to the storage of other data in the distributed storage network.

[0005] Therefore, there is a need for technology to prove data possession in distributed storage networks. Summary of the Invention

[0006] Certain embodiments provide a storage device. The storage device generally includes a storage circuit system and a trusted circuit. The storage circuit system is configured to store a plurality of data blocks. The trusted circuit generally has a private signature key securely stored thereon. The trusted circuit is generally configured to calculate a hash of the data stored in the plurality of data blocks and generate an anonymous digital signature for the data stored in the plurality of data blocks based at least in part on the private signature key and the calculated hash. The trusted circuit can be inserted into the write path of the storage circuit system so that data written to the storage circuit system is processed by the trusted circuit.

[0007] Certain embodiments provide a method for generating a signature for data stored on a storage device participating in a distributed data storage network. The exemplary method generally includes detecting a request to write data to one or more data blocks in storage circuitry of the storage device. A hash is calculated for the data to be written to the one or more data blocks. An anonymous digital signature for the data to be written to the one or more blocks is generated based, at least in part, on a private signing key securely stored in trusted circuitry of the storage device and the calculated hash. The anonymous digital signature is output from the storage device.

[0008] Certain embodiments provide a method for verifying the existence of data stored on a storage device participating in a distributed data storage network. The exemplary method generally includes receiving a request from a requesting device at a trusted circuitry of the storage device for a signature of data stored in a range of memory addresses in the storage circuitry of the storage device, the request including a challenge value. A hash of the data stored in the memory address range is retrieved and signed using the challenge value. The signed hash is output to the requesting device.

[0009] Other embodiments provide a processing system configured to perform the aforementioned methods and the methods described herein; a non-transitory computer-readable medium comprising instructions that, when executed by one or more processors of the processing system, cause the processing system to perform the aforementioned methods and the methods described herein; a computer program product implemented on a computer-readable storage medium comprising code for performing the aforementioned methods and the methods further described herein; and a processing system comprising components for performing the aforementioned methods and the methods further described herein.

[0010] The following description and the associated drawings set forth in detail certain illustrative features of one or more implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The accompanying drawings depict certain aspects of one or more embodiments and, therefore, should not be considered to limit the scope of the disclosure.

[0012] Figure 1 A storage device having trusted circuitry for generating an anonymous signature for data stored on the storage device is shown, the trusted circuitry being inserted into a write path of storage circuitry of the storage device.

[0013] Figure 2 Exemplary operations are shown for generating an anonymous signature for data stored in a storage device based on a hash of the data stored on the storage device and a private signature key securely stored in a trusted circuit on a write path of storage circuitry inserted into the storage device.

[0014] Figure 3An exemplary hash address map is shown that includes a mapping of memory address ranges to calculated hashes of data stored within the memory address ranges.

[0015] Figure 4 Example operations for verifying the presence of data at a memory address in a storage device based on a hash address map are shown.

[0016] Figure 5 An exemplary system is shown that may implement embodiments of the present disclosure.

[0017] To facilitate understanding, identical reference numerals have been used, where possible, to designate identical elements that are common to the figures. It is contemplated that elements and features of one embodiment may be beneficially incorporated in other embodiments without further recitation. DETAILED DESCRIPTION

[0018] Aspects of the present disclosure provide apparatus, methods, processing systems, and computer-readable media for proving possession of data in a decentralized data storage system via trusted circuitry in a storage device.

[0019] In a decentralized data storage system, various devices can write data to and read data from participants in the decentralized data storage system. Typically, when data is written to the decentralized data storage system, a blockchain or other distributed ledger can be maintained, including information about the data written to the decentralized data storage system (e.g., the size of the data written to the decentralized data storage system in terms of the number of bits, the number of data blocks of a given size, etc.; the hash of the data written to the decentralized data storage system; and other information). As discussed, because a blockchain is typically structured as a set of blocks, where each block references the previous block based on the hash of the previous block, the blockchain can immutably store a ledger of information identifying each transaction in the decentralized storage system. This ledger can be immutable because if any information in a block changes, the hash of that block also changes; therefore, changing a record in the blockchain may require modifying a large number of blocks, which is infeasible. These characteristics have led to blockchain being used in the infrastructure supporting various cryptocurrencies.

[0020] A challenge in a decentralized data storage system is to prove that any given participating device in the decentralized data storage system holds data purportedly written to that participating device, as shown by records in the blockchain, such that a client device writing data to the decentralized data storage system can be assured that the data will be retrievable on demand. In other words, as part of participating in the decentralized data storage system, any participant in the decentralized data storage system can be required to persist the data and not change the purpose of the storage block storing the data until the owner of the data deletes the data from the decentralized data storage system.

[0021] Various techniques can be used to ensure that data written to a decentralized data storage system is secure. In a decentralized data storage system operated by a single provider, an assumption can be made that the data exists based on trust in that single provider. However, in a decentralized data storage system where data is stored on storage devices with unknown ownership, this assumption may not hold true. In a decentralized data storage system where data is stored on storage devices with unknown ownership, one technique may include periodically retrieving data from the decentralized data storage system. However, because client devices attempting to verify the existence of the data may periodically retrieve large amounts of data for no other purpose than to verify that the data still exists in the decentralized data storage system, this may waste significant network bandwidth and processing cycles. In another example, random fragments of data may be periodically retrieved. However, retrieving random data fragments may not guarantee that the data actually exists intact. To minimize the probability of data loss, larger amounts of data may be retrieved from the decentralized data storage system, which may still involve the use of significant bandwidth and processing cycles.

[0022] Another technique for ensuring the security of data written to a decentralized data storage system may involve various cryptographic techniques to prove the existence of the data. Concise non-interactive zero-knowledge proofs do not require any interaction between the provider and the verifier; instead, various cryptographic proofs can be used to prove the existence of data in a decentralized data storage system, such as proofs of replication that mathematically prove the existence of a certain number of copies of the data, or proofs of space-time that provide continuous storage. However, these proofs can be computationally expensive. A cryptographic proof can represent a computation as an arithmetic circuit of addition and multiplication gates, and involve one or more operations whose computational cost is similar to the computational cost of public key encryption for each gate of the circuit. Because a cryptographic proof involves a public key cryptographic operation on a gate-by-gate basis, the time and amount of computational resources required to generate the proof can be significant (e.g., for a 1000-bit input and a one-million-gate operation circuit, more than two minutes of computation time).

[0023] Decentralized data storage systems can form the technical foundation of cryptocurrencies, and the aforementioned technical issues of ensuring / verifying storage security are crucial in such systems. Filecoin is an exemplary cryptocurrency in which any participant can contribute storage capacity to a storage network, and any client can store data in the storage capacity contributed by participants in the storage network. The Filecoin network operates a storage market and a retrieval market. The storage market allows clients to pay storage miners to store data, while the retrieval market allows clients to retrieve data by paying retrieval miners to deliver the data. Regardless of whether the request is for data storage or retrieval, clients place bid orders, and miners place ask orders. The network matches orders in a decentralized and verifiable manner, allowing data to be written to and retrieved from the storage network.

[0024] Any participant in the storage network can store client data. Clients may want to ensure that data can be retrieved as needed, so providers that already store client data (e.g., in response to the network previously matching client bid orders with provider ask orders) may be expected to store the data in a durable manner. That is, for a given amount of storage space required to store client data, participants storing client data may be expected to dedicate at least that amount of storage space to that client. Furthermore, while the provider remains under contract to store client data, that dedicated space is not repurposed for any other purpose.

[0025] To prove the existence of client data in the storage network and ensure that the agreed storage space is not reused, a proof system can be constructed using concise, non-interactive zero-knowledge proofs known as Proof of Replication and Proof of Spacetime. Participants in the storage network can present Proof of Replication to the client, mathematically proving to the client that the provider has stored a certain number of copies of the client's data. Proof of Spacetime can be used to prove that a certain amount of data has been continuously stored for a certain period of time. However, generating these concise, non-interactive zero-knowledge proofs can be a computationally expensive process.

[0026] Various aspects of the present disclosure provide techniques for efficiently proving the existence of data stored in a distributed storage system using trusted circuitry in a storage device. In some embodiments, the trusted circuitry in the storage device can be inserted into the write path of the storage circuitry system that stores the data and can be configured to generate a hash and signature of the data written to the data block in the storage circuitry system when the data is written to the storage circuitry system. In this way, various aspects of the present disclosure can generate data that can be used to prove the storage of data in the storage device and provide that the data is stored in the storage device during the write process rather than on demand. When a client device requests proof that data is stored on the storage device, the trusted circuitry can provide a previously calculated hash rather than reading the data from the storage circuitry system and generating proof of the data's presence in the storage circuitry on demand. By doing so, because the proof does not need to be calculated each time a proof of existence is requested, various aspects of the present disclosure can reduce the power utilization and processing time involved in proving the existence of data stored in the distributed storage system.

[0027] Furthermore, when proving the current existence of data stored in a distributed storage system, a match between the hash of a block in the blockchain, which can be periodically updated to ensure signature freshness, and the hash returned by the storage device in response to a proof-of-existence request, can prove that the data is currently stored in the distributed storage system. Consequently, the distributed data storage system can be made more computationally efficient, power utilization of devices participating in the distributed data storage system can be reduced, and battery life of mobile devices participating in the distributed data storage system can be improved.

[0028] Furthermore, as mentioned above, some cryptocurrencies are built upon this type of decentralized storage system solution. Traditional storage devices typically lack the proof generation capabilities needed to generate proofs for stored data. Therefore, certain embodiments of the present disclosure relate to storage devices that possess these described features and their proof generation efficiency advantages, thereby enabling them to become trusted devices. This enables them to participate in the overall storage solution upon which cryptocurrencies are built.

[0029] Example storage device having trusted circuitry for proving the existence of data stored on the storage device

[0030] Figure 1An exemplary storage device 100 according to various aspects of the present disclosure is shown, the storage device having a trusted circuit 110 for generating an anonymous signature for data stored on the storage device, the trusted circuit being inserted into a write path of a storage circuit system of the storage device. The storage device 100 may represent a hard disk drive, a solid-state drive, a non-volatile random access memory (NVRAM) device, or other storage device that can permanently store data. As shown, the storage device 100 includes the trusted circuit 110, the storage circuit system 120, and a write path 130 over which data is transferred for persistent storage to the storage circuit system 120.

[0031] Trusted circuit 110 generally represents a circuit, such as a processor, that can generate signatures and hashes of data written to one or more data blocks 122A-L (collectively, 122) in storage circuit system 120, for use in proving the existence of the data stored on storage device 100. As shown, trusted circuit 110 can be inserted into a write path 130 of storage circuit system 120. Because trusted circuit 110 can be inserted into write path 130, trusted circuit 110 can detect write events to storage circuit system 120 and, upon detecting these write events, generate signatures and hashes of the data written to storage circuit system 120. As shown, trusted circuit 110 includes a key repository 112, a hash map repository 114, and an attestation generator 116.

[0032] The key repository 112 generally represents the data storage circuitry on which the private signature key associated with the storage device 100 is permanently stored. To ensure that the storage device 100 uses the same key to generate anonymous digital signatures, the private signature key can be permanently stored (e.g., "burned") in the key repository 112 during manufacture. In some aspects, the private signature key can be a key from a set of keys associated with the same public key, which can allow the storage device 100 to generate anonymous digital signatures using a key that identifies the storage device 100 as a device from a particular class of devices without revealing information about the storage device 100 itself. For example, the private signature keys stored in the key repository 112 can be keys generated using an Enhanced Privacy Identifier (EPID) algorithm or other algorithms in which a large set of private signature keys are associated with the same public key.

[0033] Hash map repository 114 generally represents data storage circuitry in which a mapping between hashed versions of data and the memory address ranges where the data is stored can be maintained. As discussed in further detail below, an entry in hash map repository 114 can be generated when a write event occurs, and a hash can be retrieved from hash map repository 114 when an external device requests verification that data is stored on storage device 100. In some aspects, hash map repository 114 can be configured as a lookup table (LUT) in which a hash is associated with a starting memory address (e.g., the memory address of a data block 122 in storage circuitry 120 at which the initial portion of the data represented by the hash is stored) and an ending memory address (e.g., the memory address of a data block 122 in storage circuitry 120 at which the final portion of the data represented by the hash is stored).

[0034] The attestation generator 116 is generally configured to generate an anonymous digital signature that proves that data is stored in the storage circuit system 120 and, upon request, verify the existence of data written to the storage circuit system 120. As discussed, because the trusted circuit 110 is inserted into the write path 130 of the storage circuit system 120, the attestation generator 116 can be configured to detect the occurrence of a write event to the storage circuit system 120 and, when such data is written to the storage circuit system 120, generate an anonymous digital signature and hash of the data included in the write event. The generated anonymous digital signature can then be output from the storage device to be recorded in a public blockchain, stored externally to the storage device 100, to record that the data associated with the given hash has been stored on the storage device 100. For example, the public blockchain can be associated with or part of a cryptocurrency that records transactions (e.g., storage and / or retrieval), and the cryptocurrency is issued when the completion of such a transaction is proven in the public blockchain.

[0035] Typically, to generate an anonymous digital signature proving that data was stored in storage circuitry 120, trusted circuitry 110 may generate a hash of the data written to storage circuitry 120. Various techniques may be used to generate these hashes. For example, cryptographic hash algorithms such as MD5, MD6, or SHA may be used to generate hashes of the data written to storage circuitry 120. Typically, these hash algorithms are one-way algorithms, where a hash can be generated from a data set, but the data cannot (in practice) be recovered from the hash. Furthermore, these hash algorithms generate different hashes for different data sets input into the algorithm; any change in the input data set will result in a different hash being generated. The hash generated for the data written to storage circuitry 120 may then be signed using a private signing key stored in key repository 112, and the anonymous digital signature may be output from the storage device, as described above. In some aspects, to further ensure the robustness of the signed hash, the number of the memory blocks to which the data was written may also be included in the anonymous digital signature proving to storage circuitry 120 that the data was stored. By including the total number of storage blocks on which the data was written in the anonymous digital signature that proves the storage of the data to the storage circuitry 120, discarding data blocks may cause the storage device to be unable to subsequently generate a hash over the same number of blocks. As a result, the hash may not match the original hash generated when the data was written, and this mismatch may indicate to the client device that the storage device 100 failed to retain the data written thereto.

[0036] In some aspects, when generating an anonymous digital signature for data written to storage circuitry 120, attestation generator 116 may use one or more additional data fragments to ensure the "freshness" of the anonymous digital signature. That is, the anonymous digital signature may be regenerated from time to time so that providing a signed hash to a blockchain or to a requesting client device participating in the distributed data storage system can indicate that the anonymous digital signature accurately reflects the current state of the data stored in storage device 100, rather than some previous state that may or may not reflect the current state of the data stored in storage device 100. To ensure the "freshness" of the anonymous digital signature, in one aspect, attestation generator 116 may use a clock or other time reference (e.g., from a host system) to obtain the current time. Both the timestamp and the hash corresponding to the current time may be signed using a private key in key repository 112 and output to another device in the distributed data storage system. Because other devices in the distributed data storage system can access the corresponding public key of the private key in the key repository 112, the other devices can verify the signed timestamp and hashed signature, and based on the verified signature, timestamp and threshold (which can account for clock inaccuracies, drift, clock desynchronization, etc. between different devices in the distributed data storage system), if the timestamp is within the threshold, the anonymous digital signature is determined to be "fresh".

[0037] In another aspect, the current state of a blockchain (e.g., a blockchain associated with or part of a cryptocurrency) that records transactions of data written to a distributed data storage system can be used to ensure the "freshness" of an anonymous digital signature. To use the current state of the blockchain to ensure the "freshness" of the anonymous digital signature, proof generator 116 can retrieve the latest block from the blockchain. For example, proof generator 116 can request the latest block in the blockchain from another data repository, which can be located locally or remotely from the computing system in which storage device 100 is installed. Upon receiving or retrieving the latest block in the blockchain, proof generator 116 can use the private signing key stored in key repository 112 to sign information related to the latest block in the blockchain (e.g., the contents of the latest block in the blockchain, a hash of the latest block in the blockchain, etc.) and the hash of the data written to storage circuit system 120. The signed information related to the latest block of the blockchain and the signed hash of the data written to the storage circuit system 120 can be output to the participating devices in the distributed data storage system, and these participating devices can confirm whether the anonymous digital signature is "fresh" or "stale" (e.g., outdated) by verifying the signature of the signed latest block of the blockchain and identifying the age of the signed latest block of the blockchain relative to the actual latest block of the blockchain.

[0038] Storage device 100 may not be the only storage device to which data is written. For example, when a larger data object is written to a distributed data storage system, participants in the distributed data storage system may be able to provide data chunks to store portions of the larger data object. Consequently, multiple write operations may be performed on multiple storage devices to write the larger data object to the distributed storage system. However, because these individual portions of the larger data object are not independent write events but rather parts of a single write event, an anonymous digital signature is generated for the larger data object and stored on the blockchain to prove that the larger data object was written to one or more storage devices (including storage device 100) in the distributed data storage system.

[0039] To generate a single anonymous digital signature certifying the completion of a write operation to a larger data object, each participating storage device in the distributed data storage system may generate a triple of (m, n, σ), where m represents the hash of a portion of the larger data object being written to the distributed data storage system, n represents the number of larger data objects provided to the storage device, and σ represents a separate signature generated for the portion m of the blockchain and the number n of larger data objects provided to the storage device. To generate a combined anonymous digital signature for each participating storage device in the distributed storage system, the triples (m, n, σ) from each device may be combined into a single representation. For example, assume that the larger data object being written is written to storage device 100 and another storage device, thereby generating the triples (m1, n1, σ1) and (m2, n2, σ2). To generate a single anonymous digital signature to be written to the blockchain, a hash of m1||m2 (e.g., a hash of the concatenation of the values ​​m1 and m2) may be generated, and a hash of the sum of n1 and n2 (e.g., a hash of the total number of data blocks written to the distributed data storage system) may be generated. The hash of m1||m2 and the hash of n1+n2 can be signed using the private signing key stored in the key repository 112 to generate a single anonymous digital signature, and the single anonymous digital signature can be output to the blockchain to prove the completion of the write operation on the larger data object.

[0040] In some aspects, signatures for different data segments (and different storage devices) stored in storage circuitry 120 can be combined. For example, signatures can be combined when the timestamps associated with different signatures are within a threshold amount of time of each other. In another example, when the signatures are associated with a challenge value, such as data derived from the current state of a blockchain in which information about the data write event is stored, the signatures can be combined when the challenge values ​​are the same (e.g., referencing the same state of the blockchain). To generate a combined anonymous digital signature from a first signature associated with first data written to storage circuitry 120 and a second signature associated with second data written to storage circuitry 120, the information carried in the signatures (such as a hash of the blockchain or Merkle tree and the multiple data blocks associated with the first and second signatures) can be concatenated, and the concatenated data can be signed using a private signing key stored in key repository 112.

[0041] Trusted circuitry 110 is typically configured to verify the presence of data in storage circuitry 120 upon request from a participating device in the distributed data storage system. Typically, a participating device in the distributed data storage system may send a challenge to storage device 100, including a challenge value to be used when signing a hash of the data requested for verification. The challenge may also include information identifying the location of the data in the storage device, such as a memory address. Trusted circuitry 110 may use a hash address map stored in hash map repository 114 to determine whether a hash has been pre-calculated for the memory address. In some aspects, the hash may be associated with a starting memory address and an ending memory address associated with a particular memory block in storage circuitry 120. If the address included in the challenge is within an address range in the hash address map, the trusted circuitry may generate a response to the challenge using the hash associated with the address range. The response may include, for example, a hash associated with the address range, signed using the challenge value provided to trusted circuitry 110 by a participating device in the distributed data storage system requesting verification of the data stored in storage device 100.

[0042] However, if the memory address is not associated with an address range already stored in the hash address map, a hash may need to be calculated for the data stored at the memory address specified in the challenge. To generate the hash, the trusted circuit 110 may read the data at the memory address specified in the challenge (and, in some aspects, read data near the memory address specified in the challenge). The data read from the memory address in the storage circuit system 120 may be hashed and signed (e.g., using a private signature key stored in the key repository 112 and / or a challenge value included in the request to verify the presence of the data in the storage device 100), and the signed hash may be returned to the participating device in the distributed data storage system requesting verification of the data at the memory address. In some aspects, a new entry may be added to the hash address map to allow subsequent requests to verify the presence of data at the specified memory address to be completed without reading the data from the data block 122 in the storage circuit system 120.

[0043] In order to maintain the mapping and ensure that the mapping includes hashes corresponding to the latest state of data stored in storage circuit system 120, entries in the mapping may be invalidated due to data being deleted or updated. Generally, when a write event is intercepted on write path 130, proof generator 116 may check the memory addresses specified in the write event to determine whether a mapping for these memory addresses exists in the hash address map. If the memory address specified in the write event is within the address range associated with the hash in the hash address map, the entry associated with the address range in the hash address map may be deleted.

[0044] Storage circuitry 120 generally represents circuitry that can store data in storage device 100. As shown, storage circuitry 120 includes a plurality of data blocks 122A through 122L (although it should be understood that storage circuitry 120 can include any number of storage blocks and the illustration of data blocks 122A through 122L is merely illustrative). Each data block 122 represents a discrete portion of storage circuitry 120 that can store data. For example, data block 122 can represent one or more cells in a solid-state memory device, each cell capable of storing any number of bits (e.g., a single-level cell capable of storing one bit in the cell; a double-level cell capable of storing two bits in the cell; a triple-level cell capable of storing three bits in the cell, etc.), or a sector in a track of a storage medium such as in a hard drive. Each data block 122 can be associated with a memory address or a range of memory addresses. Read operations involving memory addresses associated with data blocks 122A through 122L may cause data to be retrieved from the appropriate data blocks 122A through 122L, and write operations involving memory addresses associated with data blocks 122A through 122L may cause data to be written to the appropriate data blocks 122A through 122L. As described above, when data is written to data blocks 122 in storage circuitry 120, trusted circuitry 110 may generate an anonymous digital signature for the data written to data blocks 122.

[0045] Example computer implementation using trusted circuitry to generate an anonymous digital signature for data written to a storage device Implementation method

[0046] Figure 2 FIGURE 1 illustrates a method that can be used by a trusted circuit (e.g., a storage device) according to aspects of the present disclosure. Figure 1 1 and 2. Example operations 200 of the embodiment of the present invention are performed by a trusted circuit 110 (shown) to generate an anonymous digital signature of data written to a storage device. As discussed, these anonymous digital signatures can be output to be stored in a blockchain associated with a distributed data storage system, where information about the data write transaction is saved so that other participating devices in the distributed data storage system can see that the data was written to the distributed data storage system. For example, the blockchain can be associated with or part of a cryptocurrency that records transactions (e.g., storage and / or retrieval), and the cryptocurrency is issued when such a transaction is proven to be completed in the blockchain. Participating devices in the distributed data storage system can use the hash included in the anonymous digital signature to verify the existence of the data in the storage device, as discussed above and below with reference to Figure 4 Furthermore, these anonymous digital signatures can be signed using one of multiple private signing keys associated with a given public key, which can prevent other identification of a specific device storing specific data in the distributed data storage system.

[0047] As shown, operations 200 begin at block 210, where the trusted circuit detects a request to write data to one or more data blocks in the storage circuitry. As discussed, because the trusted circuit can be inserted into the write path, the trusted circuit can detect the request to write data to one or more data blocks in the storage circuitry. Therefore, the trusted circuit can detect signaling transmitted to the storage circuitry on the write path, and the detection of the signaling can trigger the execution of operations 200.

[0048] In some aspects, a request to write data to one or more data blocks in a storage circuit system may include the data to be written, the memory address of the data to be written, the size of the data to be written, and / or other information that can be used to generate a signature that verifies that the write operation of the data specified in the request was completed. The data included in the request can be unencrypted or encrypted. For example, when multiple copies of data are to be written, each copy can be encrypted using a different key. This can cause the storage device to allocate space for each of the multiple copies of the data to be written, as each copy can have the same size but appear to have different content. In another scenario, when data being written to a distributed data storage system originates from two different participants sharing the same root node in a blockchain that certifies transactions in the distributed data storage system, the use of encrypted data from each of the different participants can force the storage of separate copies of the data, which can prevent data loss from data stored in a subtree of a subtree of the root node. To protect the privacy of the data, the trusted circuitry may not receive any information about the key used to encrypt the data to be written and may treat the data as a raw bitstream from which a hash is to be generated.

[0049] At block 220, the trusted circuitry calculates a hash of the data of the one or more data blocks to be written to the memory circuitry. The hash may be calculated using various one-way hashing algorithms, in which a compressed representation of the data of the one or more data blocks to be written to the memory circuitry is generated, but the data cannot be recovered from the hash. Furthermore, the one-way hashing algorithm may be designed such that any change to the data (no matter how small) will result in a different hash being generated, thereby minimizing the problem of "hash collisions," in which different input data resolve to the same hash.

[0050] At block 230, the trusted circuit generates an anonymous digital signature for the data to be written to the one or more data blocks in the storage circuit system. Typically, to generate the anonymous digital signature, the trusted circuit may sign a hash calculated for the data and the number of the data block in which the data is stored using a private signature key stored in the trusted circuit system (e.g., burned into the trusted circuit during manufacturing, saved to the trusted circuit during a firmware update, etc.). In some aspects, the anonymity of the digital signature may be ensured based on cryptographic properties of the private signature key. For example, the private signature key may be a key from a large group of keys that share the same public key, the public key being used to verify the signature of data signed using any key in the large group of keys, and the public key may be associated with a large class of devices (e.g., mass storage devices) from which individual members of the large class cannot be identified. Because the public key is not associated with any particular private signature key assigned to a particular device, the anonymity of the storage device including the trusted circuit that generates the anonymous digital signature may be ensured. Furthermore, because the hash can be encrypted using a private signing key, the hash itself can be protected in transit and at rest, which can prevent other parties from learning information about the data (e.g., through side channel information leaked from the hash).

[0051] In some aspects, generating an anonymous digital signature for data to be written to one or more data blocks in a storage circuit system may include combining signatures from multiple storage devices. To generate the anonymous digital signature across multiple storage devices, information about what was written to each of the multiple storage devices may be aggregated. For example, within the entire blockchain, each storage device may be associated with its own Merkle subtree or hash tree. The Merkle subtree associated with a storage device may represent all data write operations performed on that storage device. Thus, aggregating information across storage devices where different portions of a larger data object are written may include generating a hash on the Merkle subtree associated with each storage device. To this end, hashes of the Merkle subtrees may be concatenated, and the concatenation of these hashes may be signed using a private signature key stored in the trusted circuit system. The number of data blocks used to store the data object in each of the multiple storage devices may also be concatenated, and the concatenation of the number of data blocks may also be signed using a private signature key stored in the trusted circuit system.

[0052] In some aspects, generating the anonymous digital signature may include combining signatures determined to be combinable by the trusted circuitry of the storage device. These signatures may include, for example, signatures generated for transactions with timestamps within a threshold amount of time of each other or for transactions associated with the same challenge value (e.g., the same state of the blockchain at the time the transaction was generated). To combine the signatures, the trusted circuitry may concatenate the hash and the number of blocks in each signature and sign the concatenated hash and the concatenated number of blocks. The signed concatenated hash and the signed concatenated number of blocks may be output as the anonymous digital signature generated for the data written to the storage circuitry.

[0053] At block 240, the anonymous digital signature is output to the blockchain. Outputting the anonymous digital signature to the blockchain verifies the completion of the request to write data to one or more blocks in the storage circuitry of the storage device. As discussed, the anonymous digital signature can be generated based at least in part on a hash of the data written to the storage circuitry of the storage device. Because the hash can be recovered from the digital signature, the hash can be used by any participating device in the distributed data storage system to verify the existence of the data in the distributed data storage system.

[0054] For example, a device generating a write request may receive a pointer (e.g., a memory address) identifying the location of the data in the distributed data storage system (or, if distributed across multiple devices in the distributed data storage system, multiple pointers identifying the locations of the data in different storage devices). As discussed in further detail below, this pointer can be used to retrieve a hash of the data from the storage device. If the retrieved hash matches the hash included in the digital signature in the blockchain, the participating devices in the distributed data storage system can verify that the data claimed to have been written to the distributed data storage system actually exists at the specified address in the distributed data storage system.

[0055] Exemplary hash address mapping and verification of stored data in storage circuitry

[0056] Figure 3 Illustrated is an exemplary hash address map 300 that may be used, in part, to verify the presence of data stored in storage circuitry of a memory device, in accordance with aspects of the present disclosure.

[0057] The hash address map 300 may be stored in, for example, Figure 1 The hash map repository 114 is shown and can be used by a proof generator of a trusted circuit (e.g., Figure 110) is used by the attestation generator 116 of the trusted circuit 110 shown in FIG. 10 to satisfy a challenge or verification request for data stored in a storage device. As shown, the hash address map 300 includes a plurality of entries. Each entry in the hash address map includes a hash value of the data associated with the entry, a start address and an end address of the storage circuit system where the data associated with the entry is stored. In this example, each entry may span 256 (0x100) data blocks; however, it should be appreciated that entries in the hash address map 300 may include hashes spanning any number of data blocks.

[0058] As discussed, when a participating device in a distributed data storage system generates a challenge to verify the presence of data in the distributed data storage system, the participating device may send a query including the address where the data is expected to be located to the storage device where the data is expected to be located. The trusted circuitry may use the memory address included in the challenge to search the hash address map 300 for a hash associated with the memory address range where the memory address included in the challenge is located. If a match is found, the trusted circuitry may return a hash (which may be signed using some other information included in the challenge) without performing a read operation on the memory blocks in the storage circuitry of the storage device. For example, assume that the challenge specifies that the data is located within the memory address range starting at 0x00000701 and ending at 0x00000800. Because entries for the memory address range 0x00000701 and 0x00000800 exist in the map 300, the trusted circuitry may return the hash "6da88215dc51" without reading the data located between the starting and ending memory addresses specified in the challenge. Because the hash of data located at a specified memory address can be retrieved without reading the data located at that memory address, outputting the hash to the requesting device can omit the processing overhead involved in reading the data from the storage circuit system at the storage device and generating the hash of the read data, thereby improving the efficiency of the operations involved in generating and returning proof of storage in a distributed data storage system.

[0059] Figure 4 FIGURE 1 illustrates a method that can be used by a trusted circuit (e.g., a storage device) according to aspects of the present disclosure. Figure 1 1. Example operations 400 are shown of trusted circuitry 110) performed to verify the existence of data stored on a storage device in a distributed data storage system.

[0060] As shown, operations 400 may begin at block 410, where a request for a signature of data stored within a range of memory addresses in the storage circuitry of a storage device is received. The request may include a challenge value that the trusted circuitry may use to sign a hash of the data purportedly stored at the memory address in the storage circuitry of the storage device.

[0061] At block 420, the trusted circuit determines a hash address mapping (e.g., Figure 3 As discussed, a hash address map may include multiple entries in a hash address mapping table, wherein each entry associates a range of memory addresses with a hash of the data located at the memory address.

[0062] If, at block 420, the trusted circuit finds an entry in the hash address map with the memory address range identified in the request, operation 400 may proceed to block 430. At block 430, a hash is retrieved from the hash address map. The retrieved hash is typically associated with the memory address range specified in the request.

[0063] Otherwise, if at block 420 , the trusted circuitry does not find an entry in the hashed address map associated with the memory address range identified in the request, operations 400 may proceed to block 440 .

[0064] At block 440, the trusted circuit generates a hash of the data stored in the memory address range specified in the request. In some aspects, after generating the hash of the data stored in the specified range of memory addresses, the trusted circuit may add an entry to a hash address map to facilitate quickly satisfying future verification requests, which may reduce the amount of processing cycles and bandwidth required to process verification requests. The entry to the hash address map may include the generated hash, a starting memory address at the earliest memory address of the memory address range specified in the request, and an ending memory address at the final memory address of the memory address range specified in the request.

[0065] Operation 400 may proceed from block 430 or block 440 to block 450, where the hash is signed using a challenge value included in the request. The challenge value may include, for example, a value derived from the current state of a blockchain that attests to transactions performed in a distributed data storage system, a key generated by the requesting device, or other information that can be used to sign the hash and the number of data blocks used to generate the hash. For example, the blockchain may be associated with or part of a cryptocurrency that records transactions (e.g., storage and / or retrieval), and the cryptocurrency may be issued when completion of such transactions is attested in the blockchain.

[0066] The signed hash is output to the requesting device at block 460. The requesting device may be, for example, a laptop computer, a desktop computer, a mobile device, or other computing device from which data may be offloaded for storage in the distributed data storage system and from which a request may be issued to prove that the data exists on a storage device in the distributed data storage system.

[0067] Exemplary processing equipment

[0068] Figure 5 shows a method that can be configured to perform the methods described herein including Figure 2 and / or Figure 4 An exemplary processing system 500 is described in connection with various aspects of the method.

[0069] The processing system 500 or components thereof may be implemented or embodied in a server computer, a desktop computer, a workstation, a tablet computer, a smartphone, a smart wearable device, an Internet of Things (IoT) device, an edge processing device, a personal digital assistant, a digital camera, a digital phone, an entertainment device, a medical device, an autonomous vehicle control device, a data storage device, a controller device, a host device, or other type of device that processes data.

[0070] The processing system 500 includes a communication interface 510, a processing circuit 520 (eg, at least one processor and / or other suitable circuitry), and a storage medium 530 (eg, a non-volatile memory). These components may be accessed through Figure 5 5. The signaling bus 540, generally represented by the connecting lines in FIG. , or other suitable components, are coupled to each other and / or placed in electrical communication with each other. Depending on the specific application and overall design constraints of the processing circuit 520, the signaling bus 540 may include any number of interconnecting buses and bridges. The signaling bus 540 links the various elements together so that each of the communication interface 510, the processing circuit 520, and the storage medium 530 is coupled to each other and / or in electrical communication with each other. The signaling bus 540 may also link various other circuits (not shown), such as timing sources, peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further.

[0071] The communication interface 510 provides a component for communicating with other devices or apparatuses via a transmission medium. In some specific implementations, the communication interface 510 includes a circuit system and / or programming (e.g., a program) suitable for facilitating the bidirectional transmission of information relative to one or more devices in the system. In some embodiments, the communication interface 510 can be configured for wired-based communication. For example, the communication interface 510 can be a bus interface, a send / receive interface, or some other type of signal interface, including a driver, a buffer, or other circuit systems for outputting and / or obtaining signals (e.g., outputting signals from an integrated circuit and / or receiving signals into an integrated circuit). The communication interface 510 is used as an example of a component for receiving and / or a component for transmitting.

[0072] Storage medium 530 may represent one or more computer-readable, machine-readable, and / or processor-readable devices for storing programming, such as processor-executable code or instructions (e.g., software, firmware), electronic data, databases, or other digital information. Storage medium 530 may also be used to store data manipulated by processing circuitry 520 when executing programming. Storage medium 530 may be any available medium that can be accessed by a general-purpose or special-purpose processor, including portable or fixed storage devices, optical storage devices, and various other media capable of storing, containing, or carrying programming.

[0073] By way of example and not limitation, storage medium 530 may include a magnetic storage device (e.g., a hard disk, a floppy disk, a magnetic stripe), an optical disk (e.g., a compact disk (CD) or a digital versatile disk (DVD)), a smart card, a flash memory device (e.g., a card, stick, or key drive), RAM, ROM, PROM, EPROM, EEPROM, ReRAM, registers, a removable disk, and any other suitable medium for storing software and / or instructions that can be accessed and read by a computer. Storage medium 530 may be implemented in an article of manufacture (e.g., a computer program product). As an example, a computer program product may include a computer-readable medium in packaging material. In view of the above, in some implementations, storage medium 530 may be a non-transitory (e.g., tangible) storage medium. For example, storage medium 530 may be a non-transitory computer-readable medium that stores computer executable code, which includes code for performing the operations described herein.

[0074] Storage medium 530 may be coupled to processing circuit 520 such that processing circuit 520 can read information from and write information to storage medium 530. That is, storage medium 530 may be coupled to processing circuit 520 such that storage medium 530 is at least accessible to processing circuit 520, including examples in which at least one storage medium is integral to processing circuit 520 and / or examples in which at least one storage medium is separate from processing circuit 520 (e.g., residing in device 500, external to device 500, distributed across multiple entities, etc.).

[0075] The programming stored by storage medium 530, when executed by processing circuit 520, causes processing circuit 520 to perform one or more of the various functional and / or procedural operations described herein. For example, storage medium 530 may include programming configured to coordinate operations at one or more hardware blocks of processing circuit 520, as well as to utilize communication interface 510 to communicate wirelessly using its corresponding communication protocol.

[0076] At least some of the processing circuitry described herein is generally adapted for processing, including execution of programming stored on a storage medium, such as storage medium 530. As used herein, the terms "code" or "programming" should be broadly interpreted to include, but are not limited to, instructions, instruction sets, data, code, code segments, program code, programs, programming, subroutines, software modules, applications, software applications, software packages, routines, subroutines, objects, executables, threads of execution, procedures, functions, and the like, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise.

[0077] At least some of the processing circuits described herein are arranged to obtain, process, and / or send data, control data access and storage, issue commands, and control other desired operations. For example, in at least one example, the processing circuitry may include circuitry configured to implement desired programming provided by appropriate media.

[0078] For example, the processing circuit can be implemented as one or more processors, one or more controllers, and / or other structures configured to perform executable programming. Examples of processing circuits may include general-purpose processors, digital signal processors (DSPs), ASICs, field programmable gate arrays (FPGAs), or other programmable logic components, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor may include a microprocessor, as well as any conventional processor, controller, microcontroller, or state machine. The processing circuit may also be implemented as a combination of computing components, such as a controller and a microprocessor, a plurality of microprocessors, a combination of one or more microprocessors in combination with an ASIC and a microprocessor, or any other number of variations. These examples of processing circuits are for illustration, and other suitable configurations within the scope of the present disclosure may also be envisioned.

[0079] According to one or more aspects of the present disclosure, the processing circuit 520 may be adapted to perform any or all features, processes, functions, operations, and / or routines of any or all methods described herein. For example, the processing circuit 520 may be configured to perform Figure 2 and / or Figure 4 As used herein, the term "adapted to" in relation to processing circuitry 520 may refer to processing circuitry 520 being configured, employed, implemented, and / or programmed to perform a particular process, function, operation, and / or routine in accordance with the various features described herein. Processing circuitry 520 may be a dedicated processor, such as a processor for implementing a processor in conjunction with a processor. Figure 2 and / or Figure 4 The processing circuit 520 is used as an example of a means for processing.

[0080] According to at least one example of the apparatus 500, the processing circuit 520 may include one or more of the following: a circuit / module 521 for detecting a request to write data; a circuit / module 522 for calculating a hash on the data; a circuit / module 523 for generating an anonymous digital signature from the data, for example, using the calculated hash; a circuit / module 524 for outputting the anonymous digital signature; a circuit / module 525 for receiving a request for a signature; a circuit / module 526 for retrieving the hash; a circuit / module 527 for signing the hash; and a circuit / module 528 for outputting the signed hash. It should be noted that these are merely some examples, and other examples are possible based on the various aspects described herein.

[0081] As described above, the program stored by the storage medium 530, when executed by the processing circuit 520, causes the processing circuit 520 to perform one or more of the various functions and / or processing operations described herein. For example, the program may cause the processing circuit 420 to execute and / or control the processing described herein. Figure 2 and / or Figure 4 The various functions, steps and / or processes described.

[0082] like Figure 5 As shown, storage medium 530 may include one or more of the following: code 531 for detecting a request to write data; code 532 for calculating a hash on the data; code 533 for generating an anonymous digital signature for the data; code 534 for outputting the anonymous digital signature; code 535 for receiving a request for a signature; code 536 for retrieving the hash; code 537 for signing the hash; and code 538 for outputting a signed hash. It is noted that these are merely examples, and other examples are possible based on the various aspects described herein.

[0083] In at least some examples, the various circuits / modules in 520 and other processing elements described herein may include means for performing the various functions described herein, including functions implemented by various codes stored in storage medium 530 .

[0084] Example Clauses

[0085] Item 1: A storage device comprising: a storage circuit system configured to store a plurality of data blocks; and a trusted circuit having a private signature key securely stored thereon, the trusted circuit configured to: calculate a hash for data stored in the plurality of data blocks, and generate an anonymous digital signature for the data stored in the plurality of data blocks based at least in part on the private signature key, the calculated hash, and the number of the plurality of data blocks storing the data; wherein the trusted circuit is inserted into a write path of the storage circuit system such that data written to the storage circuit system is processed by the trusted circuit.

[0086] Clause 2: The storage device of clause 1, wherein the trusted circuitry is configured to generate an anonymous digital signature further based on a time at which the digital signature was generated.

[0087] Clause 3: A storage device according to any one of clauses 1 or 2, wherein the trusted circuit is further configured to: derive a challenge value related to a latest state of a blockchain associated with the data stored in the plurality of data blocks; and generate a second anonymous signature based on the private signature key and the challenge value.

[0088] Clause 4: The storage device of clause 3, wherein the blockchain is associated with a cryptocurrency.

[0089] Clause 5: The storage device of any of clauses 1 to 4, wherein the trusted circuitry is further configured to maintain a mapping between memory address ranges associated with a plurality of data blocks and the calculated hash.

[0090] Clause 6: The storage device of clause 5, wherein the trusted circuit is further configured to: receive a request from a requesting device to verify the presence of data at a memory address; determine that the memory address is within a range of memory addresses associated with a plurality of data blocks; and return the calculated hash to the requesting device.

[0091] Clause 7: A storage device according to any one of clauses 5 or 6, wherein the trusted circuit is further configured to: receive a request from a requesting device to verify the existence of data at a memory address; determine that the memory address is outside a memory address range associated with multiple data blocks; read the data stored at the memory address from the storage circuit system; generate a second anonymous digital signature for the data stored at the memory address based on a hash and a signing key of the data stored at the memory address; and return the second anonymous digital signature to the requesting device.

[0092] Clause 8: The storage device of clause 7, wherein the trusted circuitry is further configured to: generate a second mapping that associates the memory address and the hash of the data stored at the memory address.

[0093] Clause 9: The storage device of any of clauses 7 or 8, wherein the signing key comprises the private signing key.

[0094] Clause 10: The storage device of any of clauses 7 to 9, wherein the signing key comprises a challenge value included in a request to verify the presence of data at the memory address.

[0095] Clause 11: A storage device according to any one of clauses 5 to 10, further comprising: detecting, on the write path to the storage circuit system, a write request for an address in the memory address range associated with the plurality of data blocks; and based on detecting the write request, deleting a mapping between the memory address range associated with the plurality of data blocks and the calculated hash.

[0096] Clause 12: A storage device according to any one of clauses 1 to 11, wherein the trusted circuit is further configured to: receive a first digital signature for first data to be stored in the storage circuit system and a second digital signature for second data to be stored in the storage circuit system; determine, based on information associated with the first digital signature and the second digital signature, that the first digital signature and the second digital signature are combinable; and generate a combined signature for the first digital signature and the second digital signature based on the determination that the first digital signature and the second digital signature are combinable.

[0097] Clause 13: A storage device according to clause 12, wherein to determine that the first digital signature and the second digital signature are combinable, the trusted circuit is configured to: determine that the difference between the timestamp associated with the first digital signature and the timestamp associated with the second digital signature is less than a first threshold amount, and determine that the timestamp associated with the first digital signature and the timestamp associated with the second digital signature are within a second threshold amount of a current timestamp.

[0098] Clause 14: A storage device according to any of clauses 12 or 13, wherein to determine that the first digital signature and the second digital signature are composable, the trusted circuit is configured to determine that a challenge value associated with the first digital signature and a challenge value associated with the second digital signature are the same challenge value.

[0099] Clause 15: The storage device of any one of clauses 1 to 14, wherein the data stored in the plurality of data blocks comprises encrypted data.

[0100] Clause 16: A method comprising: detecting a request to write data to one or more data blocks in a storage circuit system of a storage device; computing a hash of the data to be written to the one or more data blocks; generating an anonymous digital signature for the data to be written to the one or more data blocks based at least in part on a private signature key stored in trusted circuitry of the storage device and the computed hash; and outputting the anonymous digital signature to a blockchain to attest to the completion of the request to write the data to the one or more data blocks in the storage circuit system of the storage device.

[0101] Clause 17: The method of clause 16, further comprising: deriving a challenge value associated with a latest state of the blockchain associated with the data stored in the one or more data blocks; and generating a second anonymous signature based on the private signing key and the challenge value.

[0102] Clause 18: The method of clause 17, wherein the blockchain is associated with a cryptocurrency.

[0103] Clause 19: The method of any one of clauses 16 to 18, further comprising: generating a mapping between the calculated hash and a memory address range comprising memory addresses associated with one or more data blocks; and submitting the mapping to a hash map repository.

[0104] Clause 20: The method of clause 19, further comprising: receiving a request from a requesting device to verify the presence of data at a memory address; determining that the memory address is within a memory address range specified in a mapping; and returning to the requesting device a calculated hash associated with the memory address range including the memory address associated with the one or more data blocks.

[0105] Clause 21: A method according to any one of clauses 16 to 20, further comprising: receiving a first digital signature for first data to be stored in the storage circuit system and a second digital signature for second data to be stored in the storage circuit system; determining, based on information associated with the first digital signature and the second digital signature, that the first digital signature and the second digital signature are combinable; and generating a combined signature for the first digital signature and the second digital signature based on the determination that the first digital signature and the second digital signature are combinable.

[0106] Clause 22: A method comprising: receiving, from a requesting device at a trusted circuit system of a storage device, a request for a signature for data stored within a memory address range in the storage circuit system of the storage device, the request including a challenge value; retrieving a hash of the data stored in the memory address range; signing the hash using the challenge value; and outputting the signed hash to the requesting device.

[0107] Clause 23: A system comprising: a memory storing executable instructions; and a processor configured to execute the executable instructions to perform the operations of any one of clauses 16 to 22.

[0108] Clause 24: A system comprising: means for performing the operations of any of clauses 16 to 22.

[0109] Clause 25: A computer-readable medium storing instructions that, when executed by a processor, perform the operations of any one of clauses 16 to 22.

[0110] Additional aspects

[0111] Aspects of the subject matter described herein can be implemented in any suitable NAND flash memory, such as 3D NAND flash memory, and other types of semiconductor memory devices. Semiconductor memory devices include volatile memory devices, such as DRAM or SRAM devices, NVM devices, such as ReRAM, EEPROM, flash memory (which can also be considered a subset of EEPROM), ferroelectric random access memory (FRAM), and MRAM, as well as other semiconductor elements capable of storing information. Each type of memory device can have different configurations. For example, a flash memory device can be configured in a NAND configuration or a NOR configuration. The memory device can be formed from any combination of passive and / or active elements. By way of non-limiting example, passive semiconductor memory elements include ReRAM device elements, which in some embodiments include resistivity switching memory elements such as antifuses, phase change materials, and the like, and optionally include steering elements such as diodes. By way of further non-limiting example, active semiconductor memory elements include EEPROM and flash memory device elements, which in some embodiments include elements having charge storage regions, such as floating gates, conductive nanoparticles, or charge storage dielectric materials.

[0112] A plurality of memory elements can be configured so that they are connected in series or so that each element can be accessed individually. By way of non-limiting example, a flash memory device (NAND memory) in a NAND configuration typically comprises memory elements connected in series. A NAND memory array can be configured so that the array is composed of a plurality of strings of memory, wherein the string is composed of a plurality of memory elements that share a single bit line and are accessed as a group. Alternatively, the memory elements can be configured so that each element can be accessed individually, such as a NOR memory array. NAND and NOR memory configurations are exemplary, and memory elements can be configured in other ways. The semiconductor memory elements located in and / or above the substrate can be arranged in two or three dimensions, such as a two-dimensional memory structure or a three-dimensional memory structure.

[0113] An associated circuit system is typically required to operate and communicate with the memory element. As a non-limiting example, a memory device may have circuits for controlling and driving the memory element to implement functions such as programming and reading. The associated circuit system may be located on the same substrate as the memory element and / or on a separate substrate. For example, a controller for memory read-write operations may be located on a separate controller chip and / or on the same substrate as the memory element. Those skilled in the art will recognize that the subject matter described herein is not limited to the two-dimensional and three-dimensional exemplary structures described, but encompasses all relevant memory structures within the spirit and scope of the subject matter as described herein and as understood by those skilled in the art.

[0114] The examples set forth herein are provided to illustrate certain concepts of the present disclosure. The devices, equipment, or components shown above may be configured to perform one or more of the methods, features, or steps described herein. Those of ordinary skill in the art will understand that these are merely exemplary in nature, and that other examples may fall within the scope of the present disclosure and the appended claims. Based on the teachings herein, those skilled in the art will understand that the aspects disclosed herein may be implemented independently of any other aspects, and that two or more of these aspects may be combined in various ways. For example, any number of aspects set forth herein may be used to implement a device or a method may be practiced. Furthermore, in addition to or in place of one or more aspects set forth herein, other structures, functions, or structures and functions may be used to implement such a device or such a method may be practiced.

[0115] Aspects of the present disclosure have been described below with reference to schematic flow charts and / or schematic block diagrams of methods, devices, systems, and computer program products according to embodiments of the present disclosure. It should be understood that each box of the schematic flow charts and / or schematic block diagrams, and the combination of boxes in the schematic flow charts and / or schematic block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor or other programmable data processing device of a computer to produce a machine, so that the instructions executed by the processor or other programmable data processing device create a component for implementing the functions and / or actions specified in one or more boxes of the schematic flow charts and / or schematic block diagrams.

[0116] The subject matter described herein may be implemented in hardware, software, firmware, or any combination thereof. Thus, the terms "function," "module," and the like as used herein may refer to hardware, which may also include software and / or firmware components for implementing the features described. In an exemplary embodiment, the subject matter described herein may be implemented using a computer-readable medium having computer-executable instructions stored thereon, which, when executed by a computer (e.g., a processor), controls the computer to perform the functions described herein. Examples of computer-readable media suitable for implementing the subject matter described herein include non-transitory computer-readable media, such as disk memory devices, chip memory devices, programmable logic devices, and application-specific integrated circuits. In addition, the computer-readable medium implementing the subject matter described herein may be located on a single device or computing platform, or may be distributed across multiple devices or computing platforms.

[0117] It should also be noted that in some alternative embodiments, the functions shown in the blocks may not occur in the order shown in the figures. For example, in fact, two blocks shown in succession may be executed substantially simultaneously, or these blocks may sometimes be executed in the opposite order, depending on the functions involved. Other steps and methods that are equivalent to one or more blocks or portions thereof in function, logic, or effect can be envisioned. Although various arrow types and line types can be used in flow charts and / or block diagrams, it should be understood that these arrow types and line types do not limit the scope of the corresponding embodiments. For example, an arrow can indicate a waiting or monitoring period of unspecified duration between the enumerated steps of the depicted embodiment.

[0118] The various features and processes described above can be used independently of each other, or can be combined in various ways. All possible combinations and sub-combinations are intended to fall within the scope of this disclosure. In addition, certain methods, events, states, or process blocks may be omitted in some specific implementations. The methods and processes described herein are not limited to any particular sequence, and the blocks or states associated therewith may be performed in other appropriate sequences. For example, the tasks or events described may be performed in an order different from that specifically disclosed, or multiple may be combined in a single block or state. The exemplary tasks or events may be performed serially, in parallel, or in some other suitable manner. Tasks or events may be added to or deleted from the disclosed exemplary embodiments. The exemplary systems and components described herein may be configured differently than described. For example, elements may be added, removed, or rearranged compared to the disclosed exemplary embodiments.

[0119] Those skilled in the art will understand that information and signals may be represented using any of a variety of different techniques and technologies. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the above specification may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

[0120] The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any aspect described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other aspects. Likewise, the term "aspect" does not require that all aspects include the discussed feature, advantage, or mode of operation.

[0121] Although the above description contains many specific embodiments of the present invention, these should not be interpreted as limiting the scope of the invention, but as examples of its specific embodiments. Therefore, the scope of the present invention should not be determined by the illustrated embodiments, but should be determined by the appended claims and their equivalents. In addition, "one embodiment", "embodiment" or similar language mentioned throughout this specification means that the specific features, structures or characteristics described in conjunction with the embodiment are included in at least one embodiment of the present disclosure. Therefore, the phrases "in one embodiment", "in an embodiment" and similar language appearing throughout this specification may, but do not necessarily, all refer to the same embodiment, but refer to "one or more but not all embodiments", unless otherwise expressly stated.

[0122] The terms used herein are only for the purpose of describing specific aspects and are not intended to limit these aspects. As used herein, the singular forms "one", "an" and "the" are also intended to include plural forms (that is, one or more), unless the context clearly indicates otherwise. The enumerated project list does not mean that any or all projects in the project are mutually exclusive and / or mutually inclusive, unless otherwise clearly stated. It should also be understood that, unless otherwise clearly stated, the terms "comprise", "comprises", "includes", "includes", "has" and their variations used herein mean "including but not limited to". That is, these terms can specify the existence of stated features, integers, steps, operations, elements or parts, but do not exclude the existence or addition of one or more other features, integers, steps, operations, elements, parts or their groups. In addition, it should be understood that the word "or" has the same meaning as the Boolean operator "OR", that is, it includes the possibility of "or" and "both", and is not limited to "exclusive or" ("XOR"), unless otherwise clearly stated. It should also be understood that the symbol " / " between two adjacent words has the same meaning as "or", unless otherwise clearly stated. Furthermore, phrases such as "connected to," "coupled to," or "in communication with" are not limited to direct connections unless expressly stated otherwise.

[0123] Any reference to an element using names such as "first", "second", etc. herein does not generally limit the quantity or order of those elements. On the contrary, these designations can be used as a convenient method to distinguish two or more elements or element instances in this article. Therefore, the reference to the first and second elements does not mean that only two elements can be used there, or that the first element must be before the second element in some way. In addition, unless otherwise indicated, a group of elements may include one or more elements. In addition, the term "at least one of A, B or C" or "A, B, C or any combination thereof" or "one or more of A, B and C" used in the specification or claims refers to "A or B or C or any combination of these elements". For example, this term can include A, or B, or C, or A and B, or A and C, or A and B and C, or 2A, or 2B, or 2C, or 2A and B, etc. As another example, "one or more of A, B or C" is intended to cover A, B, C, AB, AC, BC and ABC, and multiples of identical components (for example, any list including AA, BB or CC). Likewise, "one or more of A, B, and C" is intended to encompass A, B, C, AB, AC, BC, and ABC, as well as multiples of the same component. Similarly, as used herein, a phrase referring to a list of items linked with "and / or" refers to any combination of items. As an example, "A and / or B" is intended to encompass A alone, B alone, or A and B together. As another example, "A, B, and / or C" is intended to encompass A alone, B alone, C alone, A and B together, A and C together, B and C together, or A, B, and C together.

[0124] As used herein, the term "determining" encompasses various actions. For example, "determining" may include arithmetic, calculation, processing, deriving, investigating, searching (e.g., searching in a table, database, or another data structure), ascertaining, etc. Furthermore, "determining" may include receiving (e.g., receiving information), accessing (e.g., accessing data in a memory), etc. Furthermore, "determining" may include resolving, selecting, choosing, establishing, etc.

[0125] Therefore, the appended claims are not intended to be limited to the embodiments shown herein, but are intended to be given the full scope consistent with the language of the claims. Within the claims, unless otherwise specified, reference to an element in the singular is not intended to mean "one and only one", but rather "one or more". Unless otherwise specifically stated, the term "some" refers to one or more. Pursuant to 35 U.S.C. § 112 (f), no claim element will be interpreted unless the phrase "device for..." is used to explicitly describe the element, or the phrase "step for..." is used to describe the element in the case of a method claim. All structural equivalents and functional equivalents of the elements throughout the various aspects described in this disclosure that are known or later known to those of ordinary skill in the art are expressly incorporated herein by reference and are intended to be covered by the claims. In addition, regardless of whether this disclosure is explicitly described in the claims, the content disclosed herein is not intended to be contributed to the general public.

Claims

1. A storage device, comprising: storage circuitry configured to store a plurality of data blocks; and A trusted circuit securely storing a private signing key, the trusted circuit being configured to: computing a hash of data to be stored in one or more data blocks of the plurality of data blocks, and generating an anonymous digital signature for the data to be stored in the one or more data blocks based on the number of the one or more data blocks in which the data is to be stored and based at least in part on the private signature key and the calculated hash; wherein the generated anonymous digital signature proves the completion of the write operation of the data indicating that the data is stored in the one or more data blocks and prevents identification of the storage device, wherein the trusted circuit is inserted into the write path of the storage circuit system so that data written to the storage circuit system is processed by the trusted circuit, and The generated anonymous digital signature is output to the blockchain. 2 . The storage device of claim 1 , wherein the trusted circuit is configured to generate the anonymous digital signature further based on a time when the digital signature was generated.

3. The storage device of claim 1 , wherein the trusted circuit is further configured to: deriving a challenge value associated with a most recent state of a blockchain associated with the data stored in the plurality of data blocks; and A second anonymous signature is generated based on the private signature key and the challenge value.

4. The storage device of claim 3, wherein the blockchain is associated with a cryptocurrency. 5 . The storage device of claim 1 , wherein the trusted circuitry is further configured to maintain a first mapping between memory address ranges associated with the plurality of data blocks and the calculated hashes.

6. The storage device of claim 5 , wherein the trusted circuit is further configured to: receiving a request from a requesting device to verify the presence of data at a memory address; determining that the memory address is within the memory address range associated with the plurality of data blocks; and The calculated hash is returned to the requesting device.

7. The storage device of claim 5 , wherein the trusted circuit is further configured to: receiving a request from a requesting device to verify the presence of data at a memory address; determining that the memory address is outside the memory address range associated with the plurality of data blocks; reading data stored at the memory address from the memory circuitry; generating a second anonymous digital signature for the data stored at the memory address based on a hash of the data stored at the memory address and a signature key; as well as The second anonymous digital signature is returned to the requesting device.

8. The storage device of claim 6, wherein the trusted circuitry is further configured to generate a second mapping that associates the memory address with the hash of the data stored at the memory address.

9. The storage device of claim 6, wherein the private signing key is permanently stored on the trusted circuit.

10. The storage device of claim 6, wherein the signing key comprises a challenge value included in the request to verify the presence of data at the memory address.

11. The storage device according to claim 5, further comprising: detecting, on the write path to the memory circuitry, a write request to an address in the memory address range associated with the plurality of data blocks; as well as Based on detecting the write request, the first mapping between the memory address range associated with the plurality of data blocks and the calculated hash is deleted.

12. The storage device of claim 1 , wherein the trusted circuit is further configured to: receiving a first digital signature for first data to be stored in the storage circuitry and a second digital signature for second data to be stored in the storage circuitry; determining, based on information associated with the first digital signature and the second digital signature, that the first digital signature and the second digital signature are combinable; and Based on determining that the first digital signature and the second digital signature are combinable, a combined signature of the first digital signature and the second digital signature is generated.

13. The storage device of claim 12, wherein to determine that the first digital signature and the second digital signature are combinable, the trusted circuit is configured to: determining that a timestamp associated with the first digital signature and a timestamp associated with the second digital signature differ by an amount less than a first threshold amount, and It is determined that the timestamp associated with the first digital signature and the timestamp associated with the second digital signature are within a second threshold amount of a current timestamp.

14. The storage device of claim 12, wherein to determine that the first digital signature and the second digital signature are composable, the trusted circuitry is configured to determine that a challenge value associated with the first digital signature and a challenge value associated with the second digital signature are the same challenge value.

15. The storage device of claim 1, wherein the data stored in the plurality of data blocks comprises encrypted data.

16. A method for generating a signature, the method comprising: detecting a request to write data to one or more data blocks of a plurality of data blocks in storage circuitry of a storage device; calculating a hash of the data to be written to the one or more data blocks; generating an anonymous digital signature for the data to be written to the one or more data blocks based on the number of the one or more data blocks in which the data is to be stored and based at least in part on a private signature key stored in trusted circuitry of the storage device and the calculated hash; as well as The anonymous digital signature is output to a blockchain to prove the completion of the request to write the data to the one or more data blocks in the storage circuit system of the storage device and to prevent identification of the storage device, wherein the generated anonymous digital signature prevents identification of the storage device, and wherein the trusted circuit is inserted into a write path of the storage circuit system so that the data written to the storage circuit system is processed by the trusted circuit.

17. The method according to claim 16, further comprising: deriving a challenge value associated with a most recent state of a blockchain associated with the data stored in the one or more data blocks; as well as A second anonymous signature is generated based on the private signature key and the challenge value.

18. The method of claim 17, wherein the blockchain is associated with a cryptocurrency.

19. The method according to claim 16, further comprising: generating a mapping between the calculated hash and a memory address range including memory addresses associated with the one or more data chunks; as well as The mapping is committed to a hash map repository.

20. The method according to claim 19, further comprising: receiving a request from a requesting device to verify the presence of data at a memory address; determining that the memory address is within the memory address range specified in the mapping; as well as The calculated hash associated with the memory address range including the memory addresses associated with the one or more data blocks is returned to the requesting device.

21. The method according to claim 16, further comprising: receiving a first digital signature for first data to be stored in the storage circuitry and a second digital signature for second data to be stored in the storage circuitry; determining, based on information associated with the first digital signature and the second digital signature, that the first digital signature and the second digital signature are combinable; and Based on a determination that the first digital signature and the second digital signature are combinable, a combined signature of the first digital signature and the second digital signature is generated.

22. A storage device, comprising: storage circuitry configured to store a plurality of data blocks; and A trusted circuit securely storing a private signing key, the trusted circuit being configured to: calculating a hash of data to be stored in one or more data blocks of the plurality of data blocks; as well as generating an anonymous digital signature for the data to be stored in the one or more data blocks based at least in part on the private signing key, the calculated hash, and the one or more data blocks in which the data is to be stored; receiving a first digital signature for first data to be stored in the storage circuitry and a second digital signature for second data to be stored in the storage circuitry; determining, based on information associated with the first digital signature and the second digital signature, that the first digital signature and the second digital signature are combinable, wherein to determine that the first digital signature and the second digital signature are combinable, the trusted circuitry is configured to determine that a challenge value associated with the first digital signature and a challenge value associated with the second digital signature are the same challenge value; as well as Based on determining that the first digital signature and the second digital signature are combinable, generating a combined signature of the first digital signature and the second digital signature, wherein the generated anonymous digital signature proves the completion of the write operation of the data indicating that the data is stored in the one or more data blocks and prevents identification of the storage device, and The trusted circuit is inserted into a write path of the storage circuit system, so that data written to the storage circuit system is processed by the trusted circuit.

Images