Memory system and operating method thereof

Abstract

A memory system and an operating method thereof are provided. The storage system includes a host configured to generate a hash value for a first command, merge the hash value and a random value, and provide a signature for the merged data and the first command; and a storage device configured to store the random value corresponding to a first command in a first buffer, provide the random value to a host, receive the first command and a signature from the host, store the signature in a second buffer, verify the signature, and in response to completion of the verification, provide the random value to the host. The random value is deleted from the first buffer and the first command is executed.

Description

[0001] This application is based on and claims the benefit of priority from Korean Patent Application No. 10-2023-0092596 filed on July 17, 2023, and Korean Patent Application No. 10-2023-0163779 filed on November 22, 2023, in the Korean Intellectual Property Office, the disclosures of which are incorporated herein in their entirety by reference. Technical Field

[0002] The inventive concept relates to a storage system, and more particularly, to a storage system capable of authenticating a command and an operating method thereof. Background Art

[0003] When the host provides commands to the storage device, an attacker can steal the commands by monitoring the transmission path between the host and the storage device.

[0004] By providing stolen commands to the storage device, an attacker can gain access to an area of ​​the host that the attacker wants to access, and therefore, security of communication between the host and the storage device is required. Summary of the invention

[0005] The inventive concept provides a storage system capable of generating a signature for a command and verifying the signature to authenticate the command.

[0006] According to some aspects of the inventive concept, a storage system is provided, comprising: a host, configured to: generate a hash value for a first command, merge the hash value and a random value, and provide a signature for the merged data and the first command; and a storage device, configured to: store the random value corresponding to the first command in a first buffer, provide the random value to the host, receive the first command and the signature from the host, store the signature in a second buffer, verify the signature, and in response to completion of the verification, delete the random value from the first buffer and execute the first command.

[0007] According to other aspects of the inventive concept, a method for operating a storage system is provided, the method comprising: in a storage device, providing a random value stored in a first buffer to a host; in the host, generating a signature based on a first command and the random value; in the host, providing the first command and the signature to the storage device; in the storage device, storing the signature in a second buffer; in the storage device, verifying the signature based on the random value; and in the storage device, executing the first command based on the verification result.

[0008] According to other aspects of the inventive concept, a storage system is provided, comprising: a storage device configured to provide a random value, and verify a signature based on a received command and signature, and execute the command when the verification is completed; and a host configured to receive the random value, generate a signature based on the random value and the command, and provide the command and signature to the storage device. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Example embodiments will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings.

[0010] Figure 1 is a diagram of a storage system according to some example embodiments.

[0011] Figure 2 is a diagram of a command signature generator according to some example embodiments.

[0012] Figure 3 is a diagram of a signature verification circuit and a random number generator according to some example embodiments.

[0013] Figure 4 is a diagram of a nonvolatile memory according to some example embodiments.

[0014] Figure 5 is a block diagram of a storage system according to some example embodiments.

[0015] Figure 6 2 is a diagram illustrating an operating method of a memory system according to some example embodiments.

[0016] Figure 7 2 is a diagram illustrating an operating method of a memory system according to some example embodiments.

[0017] Figure 8 2 is a diagram illustrating an operating method of a memory system according to some example embodiments.

[0018] Fig. 9 is a diagram of a memory controller according to some example embodiments.

[0019] Fig.10 is a diagram of a host according to some example embodiments.

[0020] Fig.11 2 is a diagram illustrating an operating method of a memory system according to some example embodiments.

[0021] Fig.12 is a diagram of a data structure of a universal UPIU (UFS (Universal Flash Storage) Protocol Information Unit) according to some example embodiments.

[0022] Fig.13 is a diagram of a data structure of a command UPIU according to some example embodiments.

[0023] Fig.14 is a diagram of a data structure of a response UPIU according to some example embodiments.

[0024] Fig.15 is a diagram of a data structure of a data output UPIU according to some example embodiments.

[0025] Fig.16 is a diagram of a data structure of a data input UPIU according to some example embodiments.

[0026] Fig.17 is a diagram of a data structure of a ready to transmit (RTT) UPIU according to some example embodiments.

[0027] Fig.18 is a diagram of the structure of a write buffer command according to some example embodiments.

[0028] Fig.19 is a diagram of a UFS system according to some example embodiments.

[0029] Fig. 20 is a diagram of a memory device according to some example embodiments. DETAILED DESCRIPTION

[0030] Hereinafter, some example embodiments are described with reference to the accompanying drawings.

[0031] Figure 1 is a diagram of a storage system according to some example embodiments.

[0032] Reference Figure 1 , the storage system 1 may include a host 10 and a storage device 20 . The storage device 20 may include a storage controller 200 and a non-volatile memory (NVM) 100 .

[0033] The storage system 1 may be a fixed computing system (such as a server, a desktop computer, a self-service machine) or a subsystem of a fixed computing system, but is not limited thereto. In some example embodiments, the storage system 1 may be a portable computing system (such as a mobile phone, a wearable device, a laptop computer) or a subsystem of a portable computing system, but is not limited thereto. In some example embodiments, the storage system 1 may be a subsystem included in any system different from an independent computing system (such as a home appliance, an industrial device, and a vehicle), but is not limited thereto.

[0034] The host 10 may generate a plurality of commands, and may provide the plurality of commands to the storage device 20. The host 10 may include a command signature generator 300. The command signature generator 300 may generate a signature for at least one of the plurality of commands. For example, the command signature generator 300 may generate a hash value for the command, merge the hash value with a random value, and generate a digital signature for the merged data based on at least one of a secret key (or, a private key) and a public key. Here, the digital signature may be referred to as a signature.

[0035] The storage device 20 may include a storage medium for storing data according to a request from the host 10. As an example, the storage device 20 may include at least one of a solid state drive (SSD), an embedded memory, and a removable external memory. When the storage device 20 is an SSD, the storage device 20 may be a device that complies with the NVM Express (NVMe) standard. When the storage device 20 is an embedded memory or an external memory, the storage device 20 may be a device that complies with the Universal Flash Storage (UFS) or Embedded Multimedia Card (eMMC) standard. The host 10 and the storage device 20 may each generate and send a data packet according to the standard protocol used.

[0036] When the NVM 100 of the memory device 20 includes a flash memory, the flash memory may include a 2D NAND (NAND) memory array or a 3D (or vertical) NAND (VNAND) memory array. As another example, the memory device 20 may include various other types of NVM. For example, the memory device 20 may include a magnetic RAM (MRAM), a spin-transfer torque MRAM, a conductive bridge RAM (CBRAM), a ferroelectric RAM (FeRAM), a phase change RAM (PRAM), a resistive RAM (ReRAM), and / or other various types of memory.

[0037] The memory controller 200 may include a random value buffer 210 and a signature verification circuit 220 .

[0038] The random value buffer 210 may store a random value corresponding to each command received from the host 10. The random value may be stored in the random value buffer 210 from the time when the command is received from the host 10 to the time when the command is processed. After the command is processed, the random value may be deleted from the random value buffer 210.

[0039] The signature verification circuit 220 may verify a signature corresponding to a command from the host 10. Specifically, the signature verification circuit 220 may generate a digest to be compared by performing decryption on the signature based on at least one of a public key and a private key. The signature verification circuit 220 may verify the signature by generating a hash value for the command received from the host 10, merging the hash value with a random value corresponding to the command, and comparing the merged data with the digest to be compared. When the verification succeeds, the storage controller 200 may execute the command. For example, when the command is a write command, the storage controller 200 may store the data received from the host 10 in the NVM 100. When the command is a read command, the storage controller 200 may read data from the NVM 100, and may provide the read data to the host 10.

[0040] According to some example embodiments, the security of each command may be enhanced by authenticating the command itself.

[0041] According to some example embodiments, since the storage controller 200 performs verification based on the merged data of the hash value and the random value of the command, when the random value is deleted, the verification of the command may fail. When the storage controller 200 deletes the random value of the command that has been authenticated, even if the same command is received again, the verification of the re-received command may fail. Therefore, the provided security performance can effectively counter a replay attack or a brute force attack that steals transmission information between the host 10 and the storage device 20.

[0042] Figure 2 is a diagram of a command signature generator 300 according to some example embodiments. Figure 1 describe Figure 2 The command signature generator 300 may be implemented in any computing system. For example, each component of the command signature generator 300 may be implemented by a hardware module designed by logic synthesis, a software module executed by at least one core, a processing unit including at least one core and a software module, and a combination thereof.

[0043] The command signature generator 300 may be included in the above reference Figure 1 Alternatively, the command signature generator 300 may be located at a location remote from the host 10 and may be included in a certificate authority (CA) server that generates a certificate. The CA server may generate a signature for a command and provide the signature for the command to the host 10.

[0044] The command signature generator 300 may receive a command CMD and a random value RND, and may provide a signature SIG.

[0045] The command signature generator 300 may include a hash circuit 310 , a scrambling circuit 320 , a signature generator 330 , and a key generator 340 .

[0046] The key generator 340 may generate a key pair including a secret key sKEY and a public key pKEY. For example, the key generator 340 may include a random number generator and may generate a key pair based on a random number. In some example embodiments, the key generator 340 may be omitted and the command signature generator 300 may receive at least one key in the key pair from the outside.

[0047] The hash circuit 310 may receive the command CMD and generate a digest DIG for the command CMD. The digest DIG may represent a hash value generated based on a hash algorithm such as a secure hash algorithm (SHA).

[0048] The scrambling circuit 320 may combine the digest DIG with the random value RND to generate a combined digest S_DIG. For example, the scrambling circuit 320 may perform an exclusive OR (XOR) operation on the digest DIG and the random value RND. The length of the digest DIG may be the same as or different from the length of the random value RND.

[0049] The signature generator 330 may receive the secret key sKEY from the key generator 340, and may generate a signature SIG for the digest DIG based on the secret key sKEY. The signature SIG may be generated based on any signature algorithm (e.g., based on at least one of the elliptic curve digital signature algorithm (ECDSA), a hash-based message authentication code, and an RSA algorithm). In some example embodiments, Figure 2 As shown in , the signature generator 330 may receive a public key pKEY, and may generate a signature SIG based on the secret key sKEY and the public key pKEY.

[0050] In some example embodiments, the command signature generator 300 may further include a circuit that generates the command CMD and the signature SIG in the form of a digital envelope and provides the generated digital envelope.

[0051] In some example embodiments, the command signature generator 300 may further include an encryption circuit, and the encryption circuit may perform additional encryption on the signature SIG and may output the encrypted signature SIG.

[0052] Although it is described above that the command signature generator 300 generates the signature SIG for the command CMD, the command signature generator 300 may receive an additional signature from the CA server to provide a certificate chain including a plurality of signatures for the command CMD.

[0053] Figure 3 is a diagram of a signature verification circuit 220 and a random number generator 230 according to some example embodiments. Figure 3The signature verification circuit 220 may be included in the memory controller 200. The signature verification circuit 220 may verify the signature received from the host 10, and the memory controller 200 may execute the command based on the verification result of the signature.

[0054] Reference Figure 3 The signature verification circuit 220 may receive the command CMD and the signature SIG, and may verify the signature SIG based on at least one of the public key pKEY and the symmetric secret key sKEY, thereby authenticating the command CMD.

[0055] The signature verification circuit 220 may include a hash circuit 221 , a scrambling circuit 222 , a signature generator 223 , and a comparison circuit 224 .

[0056] The hash circuit 221 may generate a digest DIG′ for the command CMD based on a hash algorithm. The scramble circuit 222 may generate a combined digest S_DIG′ by combining the digest DIG′ with the random value RND.

[0057] The signature generator 223 may generate a signature SIG' for the combined digest S_DIG' based on the secret key sKEY. The signature SIG' may be generated based on any signature algorithm (for example, at least one of an ECDSA-based, a hash-based message authentication code, and an RSA algorithm). The signature generator 223 may generate a signature SIG' based on the secret key sKEY. Figure 2 The signature generator 330 may generate the signature SIG' using the same signature algorithm. In some example embodiments, the signature generator 223 may receive the public key pKEY, and may generate the signature SIG' based on the secret key sKEY and the public key pKEY.

[0058] The signature verification circuit 220 may receive Figure 2 The signature SIG generated by the command signature generator 300. In some example embodiments, the signature verification circuit 220 may further include a decoding circuit, and the decoding circuit may obtain the signature SIG by decoding the encrypted signature SIG.

[0059] The comparison circuit 224 can be Figure 2 The command signature generator 300 receives the signature SIG and Figure 3 The validity information VLD is generated by comparing the signature SIG' generated by the signature generator 223. The validity information VLD may be information indicating that the command CMD is valid.

[0060] For example, when the validity information VLD indicates that the command CMD is valid, the storage controller 200 may determine the command CMD as a reliable command and may execute the command CMD. When the validity information VLD indicates that the command CMD is invalid, the storage controller 200 may request a new signature from the host 10 without executing the command CMD. In some example embodiments, when the validity information VLD indicates that the command CMD is invalid, the storage controller 200 may provide the host with information indicating that the execution of the command CMD has failed or information indicating that the execution of the command CMD is not feasible.

[0061] Figure 4 is a block diagram of an NVM 100 according to some example embodiments.

[0062] Reference Figure 4 , the NVM 100 may include a memory cell array 110 and a peripheral circuit 120, and the peripheral circuit 120 may include a page buffer circuit 121, a control logic circuit 122, a voltage generator 123, and a row decoder 124. Figure 4 Although not shown, the peripheral circuit 120 may further include a data input / output (I / O) circuit or an I / O interface. In addition, the peripheral circuit 120 may further include column logic, a pre-decoder, a temperature sensor, a command decoder, an address decoder, and the like.

[0063] The memory cell array 110 may be connected to the page buffer circuit 121 through the bit lines BL, and may be connected to the row decoder 124 through the word lines WL, the string selection lines SSL, and the ground selection lines GSL. The memory cell array 110 may include a plurality of memory cells, for example, the memory cells may be flash memory cells. In some example embodiments, the plurality of memory cells may be general NAND flash memory cells, and may be resistive memory cells such as ReRAM, PRAM, or MRAM.

[0064] In some example embodiments, the memory cell array 110 may include a three-dimensional memory cell array, wherein the three-dimensional memory cell array may include a plurality of NAND strings, and each NAND string may include memory cells vertically stacked on a substrate and connected to word lines, respectively. U.S. Patent Publication Nos. 7,679,133, 8,553,466, 8,654,587, 8,559,235, and U.S. Patent Application Publication No. 2011 / 0233648 are all incorporated herein by reference, and describe suitable configurations for three-dimensional memory arrays arranged in multiple levels in which word lines and / or bit lines are shared between levels. However, the inventive concept is not limited thereto. In some example embodiments, the memory cell array 110 may include a two-dimensional memory cell array, and the two-dimensional memory cell array may include a plurality of NAND strings arranged in row and column directions.

[0065] The control logic circuit 122 may output various control signals (such as a voltage control signal CTRL_vol, a row address X-ADDR, and a column address Y-ADDR) for programming data into the memory cell array 110, reading data from the memory cell array 110, or erasing data stored in the memory cell array 110 based on the command CMD, the address ADDR, and the control signal CTRL. Therefore, the control logic circuit 122 may generally control various operations in the NVM 100.

[0066] The voltage generator 123 may generate various types of voltages for performing a program operation, a read operation, and an erase operation on the memory cell array 110 based on the voltage control signal CTRL_vol. Specifically, the voltage generator 123 may generate a word line voltage VWL (e.g., a program voltage, a read voltage, a pass voltage, an erase verification voltage, or a program verification voltage). In addition, the voltage generator 123 may also generate a string selection line voltage and a ground selection line voltage based on the voltage control signal CTRL_vol.

[0067] The row decoder 124 may select one of a plurality of memory blocks in response to a row address X-ADDR, may select one of the word lines WL of the selected memory block, and may select one of the string selection lines SSL. The page buffer circuit 121 may select some of the bit lines BL in response to a column address Y-ADDR. Specifically, the page buffer circuit 121 operates as a write driver or a sense amplifier according to an operation mode.

[0068] The page buffer circuit 121 may include a plurality of page buffers PB respectively connected to the plurality of bit lines BL.

[0069] Figure 5 is a block diagram of a storage system according to some example embodiments.

[0070] Reference Figure 5 , the storage system 1 may include a host 10 and a storage device 20. The host 10 may include a host controller 11 and a host memory 12. The storage device 20 may include a storage controller 200 and an NVM 100.

[0071] The host memory 12 may be used as a buffer memory for temporarily storing data to be transmitted to or from the storage device 20. Although not shown, the host memory 12 may include a secure memory, and the secure memory may store the data referred to above. Figure 2 The secure memory may be located outside the host 10 and may be included in the security device 540 or may be a part of the buffer memory 550 .

[0072] In some example embodiments, the host controller 11 and the host memory 12 may be implemented as separate semiconductor chips. Alternatively, in some example embodiments, the host controller 11 and the host memory 12 may be integrated into the same semiconductor chip. As an example, the host controller 11 may be any one of a plurality of modules provided in an application processor, and the application processor may be implemented as a system on chip (SoC). In addition, the host memory 12 may be an embedded memory provided in the application processor, or may be an NVM or a memory module placed outside the application processor.

[0073] The host controller 11 may manage an operation of storing data stored in the host memory 12 in the storage device 20, or may manage an operation of storing data of the storage device 20 in the host memory 12. The host controller 11 may include a command signature generator 300. Figure 1 and Figure 2 As described above, the command signature generator 300 may generate a signature based on the command and the random value received from the memory controller 200 , and may provide the command and the signature to the memory controller 200 .

[0074] The memory controller 200 may include a host interface (IF or I / F) 510, a memory interface 520, a processor 530, a security device 540, and a buffer memory 550. Here, the buffer memory 550 may be referred to as a system memory.

[0075] The host interface 510 may transmit and receive data packets to and from the host 10. Data packets transmitted from the host 10 to the host interface 510 may include commands, data to be written to the NVM 100, or data to be written to a storage space (e.g., the buffer memory 550) in the storage controller 200, and data packets transmitted from the host interface 510 to the host 10 may include responses to commands or data read from the NVM 100.

[0076] The memory interface 520 may transmit data to be written to the NVM 100 or may receive data read from the NVM 100. The memory interface 520 may be implemented to comply with a standard convention such as Toggle or Open NAND Flash Interface (ONFI).

[0077] The processor 530 may also include a hardware accelerator designed to perform predefined operations at high speed, an I / O interface that provides a communication channel with external components of the processor 530, and the like. In some example embodiments, the components of the processor 530 may be integrated into a single chip or a single die, and the processor 530 may be referred to as a SoC. In some example embodiments, the components of the processor 530 may be integrated into two or more chips included in one package, and the processor 530 may be referred to as a system-in-package (SiP). The processor 530 may be referred to as a micro control unit (MCU).

[0078] The security device 540 may store a signature or a random value for a command. In some example embodiments, the security device 540 may store a key (e.g., Figure 2 The security device 540 may store the unique data of the storage device 20 in a non-volatile manner. In some example embodiments, the security device 540 may include Figure 3 The signature verification circuit 220 and the random number generator 230 are provided.

[0079] The buffer memory 550 may temporarily store data used by the processor 530. For example, the buffer memory 550 may temporarily store data read from the security device 540 or the NVM 100, or may temporarily store data to be written to the security device 540 or the NVM 100. In addition, the buffer memory 550 may temporarily store instructions executed by the processor 530. In some example embodiments, the buffer memory 550 may include a volatile memory that provides a relatively fast operating speed, such as a dynamic random access memory (DRAM) or a static random access memory (SRAM).

[0080] The flash translation layer (FTL) 560 may perform various functions such as address mapping, wear leveling, and garbage collection. Address mapping is an operation of changing a logical address received from the host 10 into a physical address for storing data in the NVM 100. Wear leveling may be implemented by, for example, a firmware technique for balancing erase counts of physical blocks, and wear leveling is a technique for preventing excessive degradation of a specific block or reducing the possibility of excessive degradation of a specific block by allowing blocks in the NVM 100 to be used consistently. Garbage collection is a technique for ensuring available capacity within the nonvolatile memory 100 by copying valid data of a block to a new block and then erasing the existing block.

[0081] Figure 6 2 is a diagram illustrating an operating method of a memory system according to some example embodiments.

[0082] Reference Figure 6, the host 10 may provide a command CMD to the storage device 20 ( S601 ). The command CMD may be a specific command used by a predetermined or optionally desired vendor to access data stored in the storage device 20 .

[0083] The storage device 20 may generate a random value RND corresponding to the command CMD ( S602 ). The random value RND may be a unique value for the command CMD.

[0084] The storage device 20 may provide a request REQ (e.g., REQ[SIG]) for a signature SIG of the command CMD and a random value RND to the host 10 (S603). In some example embodiments, when the signature SIG for the command CMD is not stored in the storage device 20 or verification of the signature SIG stored in the storage device 20 fails, the storage device 20 may provide the request REQ and the random value RND to the host 10. Therefore, in some example embodiments, the storage device 20 may provide the request REQ and the random value RND to the host 10 based on the fact that the signature SIG corresponding to the command CMD does not exist in the storage device 20 (e.g., refer to Fig. 9 The random value RND is provided to the host 10 and a signature SIG for the command CMD is requested.

[0085] The host 10 may generate a hash value HASH[CMD] for the command CMD ( S604 ). Specifically, the host 10 may generate a digest for the command CMD based on various hash algorithms.

[0086] The host 10 may combine the hash value HASH[CMD] with the random value RND to generate a combined digest HASH[CMD]+RND (S605). The combined digest may be referred to as combined data.

[0087] The host 10 may generate a signature SIG (eg, SIG[HASH[CMD]+RND]) for the combined digest HASH[CMD]+RND (S606). Specifically, the host 10 may generate the signature SIG based on at least one of a public key and a secret key.

[0088] The host 10 may provide the signature SIG to the storage device 20 ( S607 ).

[0089] The storage device 20 may verify the signature SIG (S608). Specifically, the storage device 20 may generate a merged digest (eg, Figure 3 The storage device 20 may generate a signature for the combined digest based on at least one of the public key and the private key (eg, Figure 3The storage device 20 may verify the signature SIG by comparing the generated signature SIG′ with the signature SIG received from the host 10.

[0090] When the verification of the signature SIG succeeds, the storage device 20 may delete the random value RND stored in the storage device 20 (S609). Since the random value RND unique to the command CMD is deleted, the verification of the command CMD may fail even if the same command CMD is received from an attacker later. Therefore, the security of the command CMD may be improved. In some example embodiments, when the storage device 20 receives the same command from the host 10 more than a reference number of times, the storage device 20 may delete the random value for the command. In some example embodiments, when the storage device 20 receives the same command from the host 10 more than a reference number of times, the storage device 20 may delete the signature SIG from the buffer memory 550.

[0091] When verification of the signature SIG succeeds, the storage device 20 may execute the command CMD ( S610 ). For example, when the command CMD is a write command, data may be stored in the NVM 100 , and when the command CMD is a read command, data may be read from the NVM 100 .

[0092] When the execution of the command CMD is completed, the storage device 20 may provide a response to the command CMD to the host 10 ( S611 ).

[0093] Figure 7 2 is a diagram illustrating an operating method of a memory system according to some example embodiments.

[0094] Reference Figure 7 , the host 10 may provide a command CMD to the storage device 20 (S701). In some example embodiments, the command CMD may be a command requesting the generation of a random value RND. In some example embodiments, the command CMD may be a special command used by a predetermined or optionally desired vendor to access data stored in the storage device 20. In some example embodiments, the storage device 20 may provide the random value RND to the host 10 before receiving the command CMD from the host 10.

[0095] The storage device 20 may generate a random value RND in response to the command CMD received from the host 10 (S702). The storage device 20 may provide the random value RND to the host 10 (S703).

[0096] The host 10 may generate a hash value HASH[CMD] with respect to the command CMD to be provided to the storage device 20 (S704). Operations S705 and S706 may be the same as operations S605 and S606, respectively.

[0097] The host 10 may provide the command CMD and the signature SIG to the storage device 20 (S707). Figure 6 Differently, the host 10 may include the command CMD and the signature SIG in the same data packet and may provide the data packet to the storage device 20. That is, the host 10 may provide both the command CMD and the signature SIG to the storage device 20. The command CMD may be a special command used by a predetermined or optionally desired vendor to access data stored in the storage device 20.

[0098] Operations S708 to S711 may be the same as operations S608 to S611 , respectively.

[0099] exist Figure 7 In the embodiment, the storage device 20 provides a request REQ for a signature SIG to the host 10 (S603). Figure 6 Differently, the host 10 may provide the signature SIG to the storage device 20 in response to a command CMD received from the host 10 instead of a request REQ, thereby increasing the authentication speed. For example, the host 10 may provide the signature to the storage device 20 in response to the host receiving a random value RND from the storage device 20.

[0100] Figure 8 2 is a diagram illustrating an operating method of a memory system according to some example embodiments.

[0101] Reference Figure 8 ,and Figure 7 Differently, after providing the signature SIG to the storage device 30 (S712), the host 10' may provide the command CMD to the storage device 30 (S713). That is, the host 10' may include the signature SIG and the command CMD in different data packets and may provide the different data packets to the storage device 30 discontinuously in time.

[0102] Fig. 9 is a diagram of a memory controller 200 according to some example embodiments.

[0103] Reference Fig. 9 , the storage controller 200 may include a host interface 510 , a security device 540 , and a buffer memory 550 .

[0104] The host interface 510 may include storage submission queues (SQs) 511 and storage completion queues (CQs) 512 .

[0105] The storage submission queue 511 may store commands CMD1 and CMD2 received from the host 10. In some example embodiments, the storage submission queue 511 may store unprocessed commands. The storage submission queue 511 may have the form of a circular queue.

[0106] The storage completion queue 512 may store information about processed commands among commands CMD1 and CMD2 received from the host 10. In some example embodiments, the storage controller 200 may provide a response notifying the host 10 that processing of the command has been completed based on the information stored in the storage completion queue 512.

[0107] The buffer memory 550 may include a first storage buffer (sBUFFER1) 551 and a second storage buffer (sBUFFER2) 552. The first storage buffer 551 may store random values ​​RND1 and RND2 (e.g., first and second random values ​​RND1 and RND2) corresponding to commands CMD1 and CMD2, respectively (e.g., first and second commands CMD1 and CMD2), and the second storage buffer 552 may store signatures SIG1 and SIG2 (e.g., first and second signatures SIG1 and SIG2) corresponding to commands CMD1 and CMD2, respectively. Since the random value is a unique value for the command, the first and second random values ​​RND1 and RND2 may be different from each other. Since the signatures are generated based on different random values, the first and second signatures SIG1 and SIG2 may be different from each other. Fig. 9 The first storage buffer 551 may correspond to Figure 1 A random value buffer 210 is provided.

[0108] The security device 540 may include a signature verification circuit 220 and a random number generator 230. The random number generator 230 may generate random values ​​RND1 and RND2 corresponding to the commands CMD1 and CMD2 stored in the storage submission queue 511, and may store the random values ​​RND1 and RND2 in the first storage buffer 551. The random values ​​RND1 and RND2 may be provided to the host 10, and the host 10 may generate signatures SIG1 and SIG2 based on the random values ​​RND1 and RND2, respectively. The signatures SIG1 and SIG2 received from the host 10 may be stored in the second storage buffer 552.

[0109] The signature verification circuit 220 may verify the signatures SIG1 and SIG2, and may delete the commands stored in the storage submission queue 511 according to the verification result. For example, when the verification of the first signature SIG1 fails, the first command CMD1 is unreliable, and thus the first command CMD1 stored in the storage submission queue 511 may be deleted. In addition, the storage controller 200 may provide information indicating that the verification of the first command CMD1 has failed to the host 10.

[0110] In some example embodiments, the random values ​​RND1 and RND2 and at least some of the signatures SIG1 and SIG2 stored in the first storage buffer 551 and the second storage buffer 552 may be deleted according to the verification results of the signatures SIG1 and SIG2. For example, when the verification of the first signature SIG1 is successful, the first random value RND1 may be deleted from the first storage buffer 551, and / or the first signature SIG1 may be deleted from the second storage buffer 552. Optionally, when the verification of the signatures SIG1 and SIG2 is performed, regardless of the verification result, the signature whose verification has been performed and / or the random value corresponding to the signature may be deleted. For example, when the verification of the first signature SIG1 is performed, regardless of the verification result, the first signature SIG1 may be deleted from the second storage buffer 552, and / or the first random value RND1 may be deleted from the first storage buffer 551.

[0111] Fig.10 is a diagram of a host 10 according to some example embodiments.

[0112] Reference Fig.10 , the host 10 may include a host memory 12 , a host submission queue (SQh) 15 , and a host completion queue (CQh) 16 .

[0113] The host memory 12 may include a first host buffer ( hBUFFER1 ) 13 and a second host buffer ( hBUFFER2 ) 14 .

[0114] The first host buffer 13 may store the first random value RND1 and the second random value RND2 received from the storage device 20. The second host buffer 14 may store the first signature SIG1 and the second signature SIG2 generated by the command signature generator 300. Since the random value is a unique value for the command, the first random value RND1 and the second random value RND2 may be different from each other. Since the signatures are generated based on different random values, the first signature SIG1 and the second signature SIG2 may be different from each other.

[0115] The host submission queue 15 may store the first command CMD1 and the second command CMD2 generated by the host 10. When a response to a command is received from the storage device 20, a command corresponding to the response may be deleted from the host submission queue 15.

[0116] The host completion queue 16 may store information about the processed command. When a response to a command is received from the storage device 20 , information of the command corresponding to the response may be stored in the host completion queue 16 .

[0117] According to some example embodiments, when verification of a command fails in the storage device 20, the command is not deleted from the host submission queue 15 and may be provided again to the storage device 20. According to some example embodiments, when a command is not processed but verification of the command fails, the command may be deleted from the host submission queue 15.

[0118] Fig.11 is a diagram illustrating an operating method of a storage system according to some example embodiments. Fig.11 In the embodiment, the host 10 and the storage device 20 may be assumed to comply with the UFS standard.

[0119] Reference Fig.11 In the command execution failure process (S1110), the authentication for the command may fail. Specifically, in the command execution failure process S1110, the host 10 may provide a command UFS protocol information unit (UPIU) (eg, command UPIU [CMD]) including a vendor command CMD to the storage device 20 (S1111). Fig.13 The storage device 20 may verify the vendor command CMD, and may provide a response UPIU (eg, response UPIU [FAIL]) including information FAIL indicating that verification of the command has failed to the host 10 based on the verification result (S1112). Fig.14 Describe the response UPIU in detail.

[0120] In the random value exchange process S1120, the host 10 may provide a command UPIU (e.g., command UPIU [RND REQ]) including a request for a random value RND REQ to the storage device 20 (S1121). The storage device 20 may generate a random value RND corresponding to the command CMD in response to the command UPIU (S1122). The storage device 20 may provide a data in UPIU (e.g., data in UPIU [RND]) including the random value RND to the host 10 (S1123). Fig.16 The data input UPIU is described in detail. The storage device 20 may provide a response UPIU indicating the end of the random value exchange process S1120 to the host 10 (S1124).

[0121] The host 10 may generate a hash value HASH[CMD] for the command CMD, and may merge the hash value HASH[CMD] with the random value RND to generate a merged digest HASH[CMD]+RND (S1130). The host 10 may generate a signature SIG (e.g., SIG[HASH[CMD]+RND]) for the merged digest HASH[CMD]+RND based on at least one of the private key and the public key (S1140).

[0122] In the signature exchange process S1150, the host 10 may provide a command UPIU (eg, command UPIU [WR CMD]) including a write command WR CMD to the storage device 20 (S1151). The storage device 20 may provide a ready to transmit (RTT) UPIU indicating that data is ready to be received to the host 10 (S1152). Fig.17 The RTT UPIU is described in detail. The host 10 may provide a data output UPIU (eg, data output UPIU [SIG]) including a signature SIG to the storage device 20 (S1153). Fig.15 The data output UPIU is described in detail. When the reception of the signature SIG is completed, the storage device 20 may provide a response UPIU to the host 10 (S1154).

[0123] In the command execution process S1160, the authentication of the command CMD may succeed. Specifically, in the command execution process S1160, the host 10 may provide the command UPIU including the command CMD to the storage device 20 (S1161). The command CMD may be the same as the command CMD provided to the storage device 20 in operation S1111. The storage device 20 may verify the signature SIG (S1162). Specifically, the storage device 20 may generate a merged digest by merging the hash value of the command CMD with the random value RND. The storage device 20 may generate a signature (e.g., a signature) for the merged digest based on at least one of a public key and a private key. Figure 3 The storage device 20 may generate a verification result for the signature SIG by comparing the generated signature SIG' with the signature SIG received from the host 10. After verification, the storage device 20 may Fig. 9 The first storage buffer 551 deletes the random value RND (S1163). Therefore, although the same command CMD is provided by an attacker later, the verification of the command CMD may fail and the command CMD is not processed, thereby improving security. When the verification result is successful, the storage device 20 may execute the command CMD (S1164). When the execution of the command CMD is completed, the storage device 20 may delete the command CMD from the storage submission queue 511, and may store information about the command CMD in the storage completion queue 512. The storage device 20 may provide a response UPIU indicating that the execution of the command CMD has been completed to the host 10 (S1165). In response to the response UPIU, the host 10 may delete the command CMD stored in the host submission queue 15, and may store information about the command CMD in the host completion queue 16.

[0124] Fig.12 is a diagram of a data structure of a generic UPIU according to some example embodiments.

[0125] Specifically, refer to Fig.12 , a general UPIU may have a data structure including a transaction type field, a flag field, a logical unit number (LUN) field, a task tag field, an initiator identification (ID) field, a command set type field, an inquiry function, a task management function field, a response field, a status field, a total extra header (EHS) length field, a device information field, a data segment length field (the transaction type field, the flag field, the logical unit number (LUN) field, the task tag field, the initiator ID field, the command set type field, the inquiry function, the task management function field, the response field, the status field, the total extra header (EHS) length field, the device information field, and the data segment length field are referred to as a header herein), a transaction specific field, an extra header field, a header end-to-end cyclic redundancy check (E2ECRC) field, a data segment field, and a data E2ECRC field. The length of the header may be, but is not limited to, 12 bytes (e.g., bytes 0 to 11). The UPIU may have a minimum length of 32 bytes and a maximum length of 65600 bytes, but is not limited thereto.

[0126] The transaction type field may indicate the type of request or response included in the data structure. Specifically, the transaction type may include a transaction code, and the transaction code may define the content, function, or purpose of the UPIU. The flag field may have different values ​​according to the transaction type.

[0127] The LUN field may include the logical unit number of the target device to which the request is being provided. The target device may be, for example, Figure 1 The storage device 20, and the storage area of ​​the storage device 20 can be matched to at least one logical unit number.

[0128] The task tag field may be a value corresponding to the task request and may be a value that increases each time a new task request is generated. When multiple UPIUs are generated for one task request, all UPIUs may have the same task tag field value. For example, the task tag field may consist of 8 bits.

[0129] The command set type field may indicate a command set type associated with a command UPIU and a response UPIU. The command UPIU may be a UPIU provided by the host 10 to the storage device 20, and the response UPIU may be a UPIU provided by the storage device 20 to the host 10.

[0130] The query function and task management function fields may be fields used to define the query function in the query request UPIU and the query response UPIU, and may be fields used to define the task management function in the task management request UPIU.

[0131] When a response is required from storage device 20, the response field may indicate whether the requested function was successful.

[0132] When the UPIU is a response UPIU, the status field may include a small computer system interface (SCSI) status.

[0133] The Total EHS Length field may indicate the length of the additional header in the UPIU. The length of the additional header may be a multiple of 4 bytes.

[0134] The device information field may provide information about the storage device 20 (ie, information about the device level) within the response UPIU.

[0135] The data segment length field may indicate the number of valid bytes of the data segment in the UPIU.

[0136] The transaction specific fields (eg, bytes 12 to 31) may be additional fields required by a specific transaction code.

[0137] When the Total EHS Length field has a non-zero value, additional header fields (eg, bytes k to j+3, where k is a positive integer greater than 31 and j is a positive integer greater than 32) may be present and may have a length corresponding to a multiple of 4 bytes.

[0138] The data segment field may have a length corresponding to a multiple of 4 bytes and may include a data payload.

[0139] The header E2ECRC field may include CRC data for correcting errors in the header, and the data E2ECRC field may include CRC data for correcting errors in the data segment.

[0140] Fig.13 is a diagram of a data structure of a command UPIU according to some example embodiments. Figure 1 , Fig.11 and Fig.12 To describe Fig.13 .

[0141] The command UPIU may be a data packet provided by the host 10 to the storage device 20. Fig.12 and Fig.13 , the transaction code of command UPIU can be xx00 0001b, but is not limited to this.

[0142] exist Fig.11 In the example, the host 10 may provide a command UPIU including a request REQ for a random value RND to the storage device 20 (S1121). The request REQ for the random value RND may be included in one of a flag field, a command set type field, an auxiliary field, and a command descriptor block (CDB) field.

[0143] The command UPIU may include an expected data transfer length field (eg, bytes 12 to 15). The expected data transfer length field may indicate the length of the write data to be sent. Fig.11 In operation S1151, the expected data transmission length field of the write command WR CMD may indicate the length of the signature SIG.

[0144] The command UPIU may include a CDB field (e.g., CDB[0] to CBD

[15] of bytes 16 to 31). The CDB field may include an opcode of the command. The command UPIU may correspond to a write command UPIU or a read command UPIU according to the opcode. For example, the CDB field may include Fig.18 The Write Buffer command or Fig.11 The CDB field may include a logical address.

[0145] Fig.14 is a diagram of a data structure of a response UPIU according to some example embodiments. Figure 1 and Fig.12 describe Fig.14 .

[0146] The response UPIU may be a data packet provided by the storage device 20 to the host 10. Fig.12 and Fig.14 , the transaction code in response to UPIU can be xx10 0001b, but is not limited to this.

[0147] The response UPIU may include a remaining transfer count field. The remaining transfer count field may indicate the number of unit sizes (eg, number of bytes) that are not transmitted to the host 10.

[0148] The response UPIU may include a sensing data field and a sensing data length field. The sensing data field may be a field indicating whether an error of a previously executed command has occurred. When the previously executed command has been successfully executed, the sensing data field may be 0. The sensing data length field may be a field indicating the length of valid sensing data. In some example embodiments, the response UPIU may also include a reserved field).

[0149] exist Fig.11 In the embodiment, the storage device 20 may provide a response UPIU including failure information FAIL indicating that verification of the command has failed to the host 10 (S1112). The failure information FAIL may be included in a flag field, a command set type field, an auxiliary field, a response field, a status field, a sensing data length field, or a sensing data field.

[0150] Fig.15is a diagram of a data structure of a data output UPIU according to some example embodiments. Figure 1 and Fig.12 describe Fig.15 .

[0151] The data output UPIU may be a data packet provided by the host 10 to the storage device 20. Fig.12 and Fig.15 , the transaction code of data output UPIU can be xx00 0010b, but is not limited to this.

[0152] The data output UPIU may include a data buffer offset field, a data transfer count field, and a data field (e.g., data [0] to data [length - 1] of bytes k to k + length - 1, where k is a positive integer greater than 31). In some example embodiments, the data output UPIU may also include a reserved field.

[0153] The data buffer offset field may include an offset of an area in which the data payload included in the current data output UPIU is stored among the areas in which the entire data is transmitted. Specifically, the host 10 may provide data to the storage device 20 by using a plurality of data output UPIUs, and the data buffer offset field may include an offset of an area in which the data included in the current data output UPIU is stored. For example, as described above in Fig.11 As described in , when the signature SIG is included in the data output UPIU, the data buffer offset field may include an offset of an area in which the signature SIG is stored in the second host buffer 14 .

[0154] The Data Transfer Count field may indicate the number of bytes sent from the current Data Output UPIU.

[0155] The data field may include a data payload. For example, as shown above in Fig.11 As described in, when the signature SIG is included in the data output UPIU, the signature SIG may be included in the data field.

[0156] Fig.16 is a diagram of a data structure of a data input UPIU according to some example embodiments. Figure 1 and Fig.12 describe Fig.16 .

[0157] The data input UPIU may be a data packet provided by the storage device 20 to the host 10. Fig.12 and Fig.16 , the transaction code for data input into UPIU can be xx10 0010b, but is not limited to this.

[0158] The data input UPIU may include a data buffer offset field, a data transfer count field, and a data field (e.g., data[0] to data[length-1] of bytes k to k+length-1, where k is a positive integer greater than 31). In some example embodiments, the data input UPIU may also include a reserved field.

[0159] The data buffer offset field may include an offset of an area where the data payload including the current data in the UPIU is stored among the areas where the entire data is transmitted. Specifically, the storage device 20 may provide data to the host 10 by using a plurality of data input UPIUs, and the data buffer offset field may include an offset of an area where the data including the current data input UPIU is stored. For example, as described above in Fig.11 As described in, when the random value RND is included in the data input UPIU, the data buffer offset field may include an offset of an area in which the random value RND is stored in the first storage buffer 551.

[0160] The Data Transfer Count field may indicate the number of bytes sent from the current Data Input UPIU.

[0161] The data field may include a data payload. For example, as shown above in Fig.11 As described in, when the random value RND is included in the data input UPIU, the random value RND may be included in the data field.

[0162] Fig.17 is a diagram of a data structure of an RTT UPIU according to some example embodiments. Figure 1 and Fig.12 describe Fig.17 .

[0163] The RTT UPIU may be a data packet provided by the storage device 20 to the host 10. Fig.12 and Fig.17 , the transaction code of RTTUPIU can be xx00 0001b, but is not limited to this.

[0164] The RTT UPIU may include a data buffer offset field and a data transfer count field. In some example embodiments, the RTT UPIU may also include a reserved field).

[0165] The data buffer offset field may include an offset of an area where the data payload including the data output UPIU corresponding to the RTT UPIU is stored among an area where the entire data is transmitted. Specifically, when the storage device 20 provides the RTT UPIU to the host 10, the host 10 may provide the data output UPIU to the storage device 20 in response to the RTT UPIU. Therefore, the storage device 20 can determine the location of the data to be provided through the RTT UPIU. For example, as described above in Fig.11 As described in , when the signature SIG is included in the data output UPIU, the data buffer offset field of the RTT UPIU may include an offset of an area in which the signature SIG is stored in the second host buffer 14 .

[0166] The data transfer count field may indicate the number of bytes sent from the data buffer offset.

[0167] Fig.18 is a diagram of the structure of a write buffer command according to some example embodiments.

[0168] The write buffer command can be included in the Fig.13 The write buffer command may include an opcode field, a mode field, a buffer ID field, a buffer offset field, and a parameter list length field. In some example embodiments, the write buffer command may also include a reserved field and a control field (eg, 00h).

[0169] The opcode field of the write buffer command may be 3Bh, but is not limited thereto.

[0170] The mode field may include a value that specifies the function of the command. For example, it may include a value that corresponds to the function specified by the vendor.

[0171] The Buffer ID field may include a value that specifies a buffer corresponding to a logical unit (LU). For example, the Buffer ID field may have a value that specifies Fig.19 The value of LU 2211.

[0172] The buffer offset field may include a value that specifies the offset byte of the buffer from which the data is to be sent.

[0173] The Parameter List Length field may include a value that specifies the maximum number of bytes of data to be sent.

[0174] Fig.19 is a diagram of a UFS system 2000 according to some example embodiments. The UFS system 2000 may be a system conforming to the UFS standard promulgated by the Joint Electronic Device Engineering Council (JEDEC), and includes a UFS host 2100 , a UFS device 2200 , and a UFS interface 2300 . Figures 1 to 18The above description of the storage system 1 may also be applied in conjunction with Fig.19 The following descriptions are applied to the extent they do not conflict Fig.19 UFS system 2000.

[0175] Reference Fig.19 , the UFS host 2100 may be connected to the UFS device 2200 through the UFS interface 2300. The UFS host 2100 may be implemented as a part of an application processor (AP).

[0176] The UFS host 2100 may include a UFS host controller 2110, an application 2120, a UFS driver 2130, a host memory 2140, and a UFS interconnect (UIC) layer 2150. The UFS device 2200 may include a UFS device controller 2210, an NVM 2220, a storage interface 2230, a device memory 2240, a UIC layer 2250, and a regulator 2260. The NVM 2220 may include a plurality of memory cells 2221. Although each memory cell 2221 may include a V-NAND flash memory having a 2D structure or a 3D structure, each memory cell 2221 may include other kinds of NVMs such as PRAM and / or RRAM. The UFS device controller 2210 may be connected to the NVM 2220 through a storage interface 2230. The storage interface 2230 may be configured to comply with a standard protocol such as Toggle or ONFI.

[0177] The application 2120 may represent a program that wants to communicate with the UFS device 2200 to use the functions of the UFS device 2200. The application 2120 may send an input-output request (IOR) to the UFS driver 2130 for an input / output (I / O) operation on the UFS device 2200. The IOR may represent a data read request, a data storage (or write) request, and / or a data erase (or discard) request, without being limited thereto.

[0178] The UFS driver 2130 may manage the UFS host controller 2110 through a UFS-Host Controller Interface (UFS-HCI). The UFS driver 2130 may convert the IOR generated by the application 2120 into a UFS command defined by the UFS standard, and send the UFS command to the UFS host controller 2110. One IOR may be converted into a plurality of UFS commands. Although the UFS command may be basically defined by the SCSI standard, the UFS command may be a command dedicated to the UFS standard.

[0179] The UFS host controller 2110 may transmit the UFS command converted by the UFS driver 2130 to the UIC layer 2250 of the UFS device 2200 through the UIC layer 2150 and the UFS interface 2300. The UFS host controller 2110 may include a command signature generator 2112 and a UFS host register 2111. During transmission of the UFS command, the UFS host register 2111 of the UFS host controller 2110 may be used as a command queue (CQ).

[0180] The UIC layer 2150 on the UFS host 2100 side may include a Mobile Industry Processor Interface (MIPI) M-PHY 2151 and a MIPI UniPro 2152 , and the UIC layer 2250 on the UFS device 2200 side may also include a MIPI M-PHY 2251 and a MIPI UniPro 2252 .

[0181] The UFS interface 2300 may include a line configured to transmit a reference clock signal REF_CLK, a line configured to transmit a hardware reset signal RESET_n for the UFS device 2200 , a line pair configured to transmit a pair of differential input signals DIN_T and DIN_C, and a line pair configured to transmit a pair of differential output signals DOUT_T and DOUT_C.

[0182] The frequency of the reference clock signal REF_CLK provided from the UFS host 2100 to the UFS device 2200 may be one of 19.2 MHz, 26 MHz, 38.4 MHz, and 52 MHz, without being limited thereto. The UFS host 2100 may change the frequency of the reference clock signal REF_CLK during operation (i.e., during a data transmission / reception operation between the UFS host 2100 and the UFS device 2200). The UFS device 2200 may generate clock signals having various frequencies according to the reference clock signal REF_CLK provided from the UFS host 2100 by using a phase-locked loop (PLL). In addition, the UFS host 2100 may set a data rate between the UFS host 2100 and the UFS device 2200 by using the frequency of the reference clock signal REF_CLK. That is, the data rate may be determined according to the frequency of the reference clock signal REF_CLK.

[0183] The UFS interface 2300 may support multiple lanes, each of which may be implemented as a pair of differential lines. For example, the UFS interface 2300 may include at least one receiving lane and at least one transmitting lane. Fig.19In the embodiment, a pair of lines configured to transmit a pair of differential input signals DIN_T and DIN_C may constitute a receiving path, and a pair of lines configured to transmit a pair of differential output signals DOUT_T and DOUT_C ​​may constitute a transmitting path. Fig.19 , but the number of transmit paths and the number of receive paths may be changed.

[0184] The receiving path and the transmitting path may transmit data based on a serial communication scheme. Due to the structure in which the receiving path is separated from the transmitting path, full-duplex communication between the UFS host 2100 and the UFS device 2200 may be realized. That is, while receiving data from the UFS host 2100 through the receiving path, the UFS device 2200 may transmit data to the UFS host 2100 through the transmitting path. In addition, control data (e.g., commands) from the UFS host 2100 to the UFS device 2200 and user data to be stored in the NVM 2220 of the UFS device 2200 or read from the NVM 2220 of the UFS device 2200 by the UFS host 2100 may be transmitted through the same path. Therefore, between the UFS host 2100 and the UFS device 2200, in addition to a pair of receiving paths and a pair of transmitting paths, there may be no need to further provide a separate path for data transmission.

[0185] The UFS device controller 2210 of the UFS device 2200 may control all operations of the UFS device 2200. The UFS device controller 2210 may manage the NVM 2220 by using a logical unit (LU) 2211 as a logical data storage unit. The number of LUs 2211 may be 8, without being limited thereto. The UFS device controller 2210 may include an FTL, and convert a logical data address (e.g., a logical block address (LBA)) received from the UFS host 2100 into a physical data address (e.g., a physical block address (PBA)) by using address mapping information of the FTL. A logical block configured to store user data in the UFS system 2000 may have a size within a predetermined or optionally desired range. For example, the minimum size of a logical block may be set to 4 kilobytes.

[0186] When a command from the UFS host 2100 is applied to the UFS device 2200 through the UIC layer 2250 , the UFS device controller 2210 may perform an operation in response to the command and transmit a completion response to the UFS host 2100 when the operation is completed.

[0187] As an example, when the UFS host 2100 intends to store user data in the UFS device 2200, the UFS host 2100 may send a data storage command to the UFS device 2200. When a response ("Ready to Transfer" response) indicating that the UFS host 2100 is ready to receive user data (ready to transfer) is received from the UFS device 2200, the UFS host 2100 may send the user data to the UFS device 2200. The UFS device controller 2210 may temporarily store the received user data in the device memory 2240, and store the user data temporarily stored in the device memory 2240 at a selected location of the NVM 2220 based on the address mapping information of the FTL.

[0188] As another example, when the UFS host 2100 intends to read user data stored in the UFS device 2200, the UFS host 2100 may send a data read command to the UFS device 2200. The UFS device controller 2210, which has received the command, may read the user data from the NVM 2220 based on the data read command, and temporarily store the read user data in the device memory 2240. During the read operation, the UFS device controller 2210 may detect and correct errors in the read user data by using an error correction code (ECC) engine (not shown) embedded therein. In addition, the UFS device controller 2210 may send the user data temporarily stored in the device memory 2240 to the UFS host 2100. In addition, the UFS device controller 2210 may further include an advanced encryption standard (AES) engine (not shown). The AES engine may perform at least one of an encryption operation and a decryption operation on the data sent to the UFS device controller 2210 by using a symmetric key algorithm.

[0189] The UFS host 2100 may sequentially store commands to be transmitted to the UFS device 2200 in the UFS host register 2111, the UFS host register 2111 may be used as a common queue, and the UFS host 2100 may sequentially transmit the commands to the UFS device 2200. In this case, even when the previously transmitted command is still being processed by the UFS device 2200 (i.e., even before receiving a notification that “the previously transmitted command has been processed by the UFS device 2200”), the UFS host 2100 may transmit the next command waiting in the CQ to the UFS device 2200. Therefore, the UFS device 2200 may also receive the next command from the UFS host 2100 during the processing of the previously transmitted command. The maximum number of commands (or queue depth) that can be stored in the CQ may be, for example, 32. In addition, the CQ may be implemented as a circular queue in which the start and end of the command line stored in the queue are indicated by a head pointer and a tail pointer.

[0190] Each of the plurality of memory cells 2221 may include a memory cell array (not shown) and a control circuit (not shown) configured to control the operation of the memory cell array. The memory cell array may include a 2D memory cell array or a 3D memory cell array. The memory cell array may include a plurality of memory cells. Although each memory cell is a single-level cell (SLC) configured to store 1 bit of information, each memory cell may be a cell configured to store 2 bits or more of information (such as a multi-level cell (MLC), a triple-level cell (TLC), and a quad-level cell (QLC)). The 3D memory cell array may include a vertical NAND string in which at least one memory cell is vertically oriented and located on another memory cell.

[0191] Voltages VCC, VCCQ1, and VCCQ2 may be applied to the UFS device 2200 as power supply voltages. Voltage VCC may be a main power supply voltage for the UFS device 2200, and is in the range of 2.4V to 3.6V. Voltage VCCQ1 may be a power supply voltage for mainly supplying a low voltage to the UFS device controller 2210, and is in the range of 1.14V to 1.26V. Voltage VCCQ2 may be a power supply voltage for mainly supplying a voltage lower than voltage VCC and higher than voltage VCCQ1 to an I / O interface such as MIPI M-PHY 2251, and is in the range of 1.7V to 1.95V. The power supply voltage may be supplied to the respective components of the UFS device 2200 through the regulator 2260. The regulator 2260 may be implemented as a group of unit regulators respectively connected to different power supply voltages among the power supply voltages described above.

[0192] The UFS host controller 2110 may include a command signature generator 2112. The command signature generator 2112 may correspond to a command signature based on Figures 1 to 18 The command signature generator 300 is described.

[0193] The UFS host controller 2210 may include a signature verification circuit 2212. The signature verification circuit 2212 may correspond to a signature verification circuit based on Figures 1 to 18 The signature verification circuit 220 is described.

[0194] Fig. 20 is a diagram of a memory device 500 according to some example embodiments.

[0195] Reference Fig. 20, the memory device 500 may have a chip-to-chip (C2C) structure. At least one upper chip including a cell area and a lower chip including a peripheral circuit area PERI may be manufactured separately, and then, at least one upper chip and the lower chip may be connected to each other by a bonding method to realize the C2C structure. For example, the bonding method may mean a method in which a bonding metal pattern formed in the uppermost metal layer of the upper chip is electrically and / or physically connected to a bonding metal pattern formed in the uppermost metal layer of the lower chip. For example, in the case where the bonding metal pattern is formed of copper (Cu), the bonding method may be a Cu-Cu bonding method. Alternatively, the bonding metal pattern may be formed of aluminum (Al) or tungsten (W).

[0196] The memory device 500 may include at least one upper chip including a cell region. Fig. 20 As shown in , the memory device 500 may include two upper chips. However, the number of upper chips is not limited thereto. In the case where the memory device 500 includes two upper chips, a first upper chip including a first cell area CELL1, a second upper chip including a second cell area CELL2, and a lower chip including a peripheral circuit area PERI may be manufactured separately, and then the first upper chip, the second upper chip, and the lower chip may be connected to each other by a bonding method to manufacture the memory device 500. The first upper chip may be flipped and then connected to the lower chip by a bonding method, and the second upper chip may also be flipped and then connected to the first upper chip by a bonding method. Hereinafter, the upper and lower portions of each of the first upper chip and the second upper chip will be defined based on before each of the first upper chip and the second upper chip is flipped. In other words, in Fig. 20 In the embodiment, the upper portion of the lower chip may mean the upper portion defined based on the +Z axis direction, and the upper portion of each of the first upper chip and the second upper chip may mean the upper portion defined based on the -Z axis direction. However, the example embodiments of the inventive concept are not limited thereto. In some example embodiments, one of the first upper chip and the second upper chip may be flipped and then connected to the corresponding chip by a bonding method.

[0197] Each of the peripheral circuit region PERI, the first cell region CELL1, and the second cell region CELL2 of the memory device 500 may include an external pad bonding region PA, a word line bonding region WLBA, and a bit line bonding region BLBA.

[0198] The peripheral circuit region PERI may include a first substrate 610 and a plurality of circuit elements 620a, 620b, and 620c formed on the first substrate 610. An interlayer insulating layer 615 including one or more insulating layers may be disposed on the plurality of circuit elements 620a, 620b, and 620c, and a plurality of metal lines electrically connected to the plurality of circuit elements 620a, 620b, and 620c may be disposed in the interlayer insulating layer 615. For example, the plurality of metal lines may include first metal lines 630a, 630b, and 630c connected to the plurality of circuit elements 620a, 620b, and 620c and second metal lines 640a, 640b, and 640c formed on the first metal lines 630a, 630b, and 630c. The plurality of metal lines may be formed of at least one of various conductive materials. For example, the first metal lines 630a, 630b, and 630c may be formed of a material having a relatively high resistivity (eg, tungsten), and the second metal lines 640a, 640b, and 640c may be formed of a material having a relatively low resistivity (eg, copper).

[0199] In the present exemplary embodiment, the first metal lines 630a, 630b, and 630c and the second metal lines 640a, 640b, and 640c are shown and described. However, the exemplary embodiments of the inventive concept are not limited thereto. In a specific exemplary embodiment, at least one or more additional metal lines may be formed on the second metal lines 640a, 640b, and 640c. In this case, the second metal lines 640a, 640b, and 640c may be formed of aluminum, and at least some of the additional metal lines formed on the second metal lines 640a, 640b, and 640c may be formed of copper having a resistivity lower than the resistivity of the aluminum of the second metal lines 640a, 640b, and 640c.

[0200] The interlayer insulating layer 615 may be disposed on the first substrate 610 and may include an insulating material such as silicon oxide and / or silicon nitride.

[0201] Each of the first cell region CELL1 and the second cell region CELL2 may include at least one memory block. The first cell region CELL1 may include a second substrate 710 and a common source line 720. A plurality of word lines 730 (e.g., 731 to 738) may be stacked on the second substrate 710 in a direction (Z-axis direction) perpendicular to the top surface of the second substrate 710. A string selection line and a ground selection line may be disposed above and below the word line 730, and a plurality of word lines 730 may be disposed between the string selection line and the ground selection line. Similarly, the second cell region CELL2 may include a third substrate 810 and a common source line 820, and a plurality of word lines 830 (e.g., 831 to 838) may be stacked on the third substrate 810 in a direction (e.g., Z-axis direction) perpendicular to the top surface of the third substrate 810. Each of the second substrate 710 and the third substrate 810 may be formed of at least one of various materials, and may be, for example, a silicon substrate, a silicon germanium substrate, a germanium substrate, or a substrate having a single crystal epitaxial layer grown on a single crystal silicon substrate. A plurality of channel structures CH may be formed in each of the first cell region CELL1 and the second cell region CELL2 .

[0202] In some example embodiments, as shown in region "A1" as an alternative embodiment of region "A", the channel structure CH may be disposed in the bit line bonding region BLBA and may extend in a direction perpendicular to the top surface of the second substrate 710 to penetrate the word line 730, the string selection line, and the ground selection line. The channel structure CH may include a data storage layer, a channel layer, and a filling insulating layer. The channel layer may be electrically connected to the first metal line 750c and the second metal line 760c in the bit line bonding region BLBA. For example, the second metal line 760c may be a bit line and may be connected to the channel structure CH through the first metal line 750c. The bit line 760c may extend in a first direction (e.g., a Y-axis direction) parallel to the top surface of the second substrate 710.

[0203] In some example embodiments, as shown in region "A2" as an alternative embodiment of region "A", the channel structure CH may include a lower channel LCH and an upper channel UCH connected to each other. For example, the channel structure CH may be formed by a process of forming the lower channel LCH and a process of forming the upper channel UCH. The lower channel LCH may extend in a direction perpendicular to the top surface of the second substrate 710 to penetrate the common source line 720 and the lower word lines 731 and 732. The lower channel LCH may include a data storage layer, a channel layer, and a filling insulating layer, and may be connected to the upper channel UCH. The upper channel UCH may penetrate the upper word lines 733 to 738. The upper channel UCH may include a data storage layer, a channel layer, and a filling insulating layer, and the channel layer of the upper channel UCH may be electrically connected to the first metal line 750c and the second metal line 760c. As the length of the channel increases, it may be difficult to form a channel with a substantially uniform width due to the characteristics of the manufacturing process. The memory device 500 according to the present example embodiment may include channels having improved width uniformity due to a lower channel LCH and an upper channel UCH formed through processes performed sequentially.

[0204] In the case where the channel structure CH includes a lower channel LCH and an upper channel UCH as shown in region "A2", a word line located near the boundary between the lower channel LCH and the upper channel UCH may be a dummy word line. For example, word lines 732 and 733 adjacent to the boundary between the lower channel LCH and the upper channel UCH may be dummy word lines. In this case, data may not be stored in the memory cells connected to the dummy word lines. Optionally, the number of pages corresponding to the memory cells connected to the dummy word lines may be less than the number of pages corresponding to the memory cells connected to the general word lines. The level of the voltage applied to the dummy word line may be different from the level of the voltage applied to the general word line, and thus the effect of the inconsistent channel width between the lower channel LCH and the upper channel UCH on the operation of the memory device may be reduced.

[0205] At the same time, in the region "A2", the number of lower word lines 731 and 732 penetrated by the lower channel LCH may be less than the number of upper word lines 733 to 738 penetrated by the upper channel UCH. However, the example embodiments of the inventive concept are not limited thereto. In a specific example embodiment, the number of lower word lines penetrated by the lower channel LCH may be equal to or greater than the number of upper word lines penetrated by the upper channel UCH. In addition, the structural features and connection relationship of the channel structure CH disposed in the second cell region CELL2 may be substantially the same as the structural features and connection relationship of the channel structure CH disposed in the first cell region CELL1.

[0206] In the bit line bonding area BLBA, the first through electrode THV1 may be disposed in the first cell area CELL1, and the second through electrode THV2 may be disposed in the second cell area CELL2. Fig. 20 As shown in , the first through electrode THV1 may penetrate the common source line 720 and the plurality of word lines 730. In a specific example embodiment, the first through electrode THV1 may also penetrate the second substrate 710. The first through electrode THV1 may include a conductive material. Alternatively, the first through electrode THV1 may include a conductive material surrounded by an insulating material. The second through electrode THV2 may have the same shape and structure as the first through electrode THV1.

[0207] In some example embodiments, the first through electrode THV1 and the second through electrode THV2 may be electrically connected to each other through the first through metal pattern 772d and the second through metal pattern 872d. The first through metal pattern 772d may be formed at the bottom end of the first upper chip including the first cell region CELL1, and the second through metal pattern 872d may be formed at the top end of the second upper chip including the second cell region CELL2. The first through electrode THV1 may be electrically connected to the first metal line 750c and the second metal line 760c. The second through electrode THV2 may be electrically connected to the first metal line 850c and the second metal line 860c. The lower via 771d may be formed between the first through electrode THV1 and the first through metal pattern 772d, and the upper via 871d may be formed between the second through electrode THV2 and the second through metal pattern 872d. The first through metal pattern 772d and the second through metal pattern 872d may be connected to each other by a bonding method.

[0208] In addition, in the bit line bonding area BLBA, an upper metal pattern 652 may be formed in the uppermost metal layer of the peripheral circuit area PERI, and an upper metal pattern 792 having the same shape as the upper metal pattern 652 may be formed in the uppermost metal layer of the first cell area CELL1. The upper metal pattern 792 of the first cell area CELL1 and the upper metal pattern 652 of the peripheral circuit area PERI may be electrically connected to each other by a bonding method. In the bit line bonding area BLBA, the bit line 760c may be electrically connected to a page buffer included in the peripheral circuit area PERI. For example, some of the circuit elements 620c of the peripheral circuit area PERI may constitute a page buffer, and the bit line 760c may be electrically connected to the circuit element 620c constituting the page buffer through the upper bonding metal pattern 770c of the first cell area CELL1 and the upper bonding metal pattern 670c of the peripheral circuit area PERI.

[0209] Continue to refer to Fig. 20In the word line bonding area WLBA, the word lines 730 of the first cell region CELL1 may extend in a second direction (e.g., an X-axis direction) parallel to the top surface of the second substrate 710, and may be connected to a plurality of cell contact plugs 740 (741 to 747). The first metal line 750b and the second metal line 760b may be sequentially connected to the cell contact plugs 740 connected to the word lines 730. In the word line bonding area WLBA, the cell contact plugs 740 may be connected to the peripheral circuit region PERI through the upper bonding metal pattern 770b of the first cell region CELL1 and the upper bonding metal pattern 670b of the peripheral circuit region PERI.

[0210] The cell contact plug 740 may be electrically connected to a row decoder included in the peripheral circuit region PERI. For example, some of the circuit elements 620b of the peripheral circuit region PERI may constitute a row decoder, and the cell contact plug 740 may be electrically connected to the circuit element 620b constituting the row decoder through the upper bonding metal pattern 770b of the first cell region CELL1 and the upper bonding metal pattern 670b of the peripheral circuit region PERI. In some example embodiments, the operating voltage of the circuit element 620b constituting the row decoder may be different from the operating voltage of the circuit element 620c constituting the page buffer. For example, the operating voltage of the circuit element 620c constituting the page buffer may be greater than the operating voltage of the circuit element 620b constituting the row decoder.

[0211] Similarly, in the word line bonding area WLBA, the word lines 830 of the second cell area CELL2 may extend in a second direction (e.g., X-axis direction) parallel to the top surface of the third substrate 810, and may be connected to a plurality of cell contact plugs 840 (841 to 847). The cell contact plugs 840 may be connected to the peripheral circuit area PERI through the upper metal pattern of the second cell area CELL2 and the lower metal pattern, the upper metal pattern, and the cell contact plugs 748 of the first cell area CELL1.

[0212] In the word line bonding area WLBA, the upper bonding metal pattern 770b may be formed in the first cell area CELL1, and the upper bonding metal pattern 670b may be formed in the peripheral circuit area PERI. The upper bonding metal pattern 770b of the first cell area CELL1 and the upper bonding metal pattern 670b of the peripheral circuit area PERI may be electrically connected to each other by a bonding method. The upper bonding metal pattern 770b and the upper bonding metal pattern 670b may be formed of at least one of aluminum, copper, and tungsten.

[0213] In the external pad bonding area PA, a lower metal pattern 771e may be formed in a lower portion of the first cell area CELL1, and an upper metal pattern 872a may be formed in an upper portion of the second cell area CELL2. In the external pad bonding area PA, the lower metal pattern 771e of the first cell area CELL1 and the upper metal pattern 872a of the second cell area CELL2 may be connected to each other by a bonding method. Similarly, an upper metal pattern 772a may be formed in an upper portion of the first cell area CELL1, and an upper metal pattern 672a may be formed in an upper portion of the peripheral circuit area PERI. The upper metal pattern 772a of the first cell area CELL1 and the upper metal pattern 672a of the peripheral circuit area PERI may be connected to each other by a bonding method.

[0214] Common source line contact plugs 780 and 880 may be disposed in the external pad bonding area PA. Common source line contact plugs 780 and 880 may be formed of a conductive material such as a metal, a metal compound, and / or doped polysilicon. The common source line contact plug 780 of the first cell area CELL1 may be electrically connected to the common source line 720, and the common source line contact plug 880 of the second cell area CELL2 may be electrically connected to the common source line 820. The first metal line 750a and the second metal line 760a may be sequentially stacked on the common source line contact plug 780 of the first cell area CELL1, and the first metal line 850a and the second metal line 860a may be sequentially stacked on the common source line contact plug 880 of the second cell area CELL2.

[0215] The input / output pads 605, 805, and 806 may be disposed in the external pad bonding area PA. Fig. 20 , a lower insulating layer 601 may cover the bottom surface of the first substrate 610, and a first input / output pad 605 may be formed on the lower insulating layer 601. The first input / output pad 605 may be connected to at least one of a plurality of circuit elements 620a disposed in the peripheral circuit region PERI through a first input / output contact plug 603, and may be separated from the first substrate 610 by the lower insulating layer 601. In addition, a side insulating layer may be disposed between the first input / output contact plug 603 and the first substrate 610 to electrically isolate the first input / output contact plug 603 from the first substrate 610.

[0216] An upper insulating layer 801 covering the top surface of the third substrate 810 may be formed on the third substrate 810. A second input / output pad 805 and / or a third input / output pad 806 may be disposed on the upper insulating layer 801. The second input / output pad 805 may be connected to at least one of the plurality of circuit elements 620a disposed in the peripheral circuit region PERI through second input / output contact plugs 803 and 703, and the third input / output pad 806 may be connected to at least one of the plurality of circuit elements 620a disposed in the peripheral circuit region PERI through third input / output contact plugs 804 and 704.

[0217] In some example embodiments, the third substrate 810 may not be disposed in a region where the input / output contact plug is disposed. For example, as shown in region "B", the third input / output contact plug 804 may be separated from the third substrate 810 in a direction parallel to the top surface of the third substrate 810, and may penetrate the interlayer insulating layer 815 of the second cell region CELL2 so as to be connected to the third input / output pad 806. In this case, the third input / output contact plug 804 may be formed by at least one of various processes.

[0218] In some example embodiments, as shown in a region “B1” as an alternative embodiment of the region “B”, the third input / output contact plug 804 may extend in a third direction (e.g., Z-axis direction), and the diameter of the third input / output contact plug 804 may gradually increase toward the upper insulating layer 801. In other words, the diameter of the channel structure CH described in the region “A1” may gradually decrease toward the upper insulating layer 801, but the diameter of the third input / output contact plug 804 may gradually increase toward the upper insulating layer 801. For example, the third input / output contact plug 804 may be formed after the second cell region CELL2 and the first cell region CELL1 are bonded to each other by a bonding method.

[0219] In certain example embodiments, as shown in a region "B2" as an alternative embodiment of the region "B", the third input / output contact plug 804 may extend in a third direction (e.g., Z-axis direction), and the diameter of the third input / output contact plug 804 may gradually decrease toward the upper insulating layer 801. In other words, similar to the channel structure CH, the diameter of the third input / output contact plug 804 may gradually decrease toward the upper insulating layer 801. For example, the third input / output contact plug 804 may be formed together with the cell contact plug 840 before the second cell region CELL2 and the first cell region CELL1 are bonded to each other.

[0220] In certain example embodiments, the input / output contact plug may overlap the third substrate 810. For example, as shown in region "C", the second input / output contact plug 803 may penetrate the interlayer insulating layer 815 of the second cell region CELL2 in a third direction (e.g., Z-axis direction) and may be electrically connected to the second input / output pad 805 through the third substrate 810. In this case, the connection structure of the second input / output contact plug 803 and the second input / output pad 805 may be implemented by various methods.

[0221] In some example embodiments, as shown in a region "C1" as an alternative embodiment of the region "C", an opening 808 may be formed to penetrate the third substrate 810, and the second input / output contact plug 803 may be directly connected to the second input / output pad 805 through the opening 808 formed in the third substrate 810. In this case, as shown in the region "C1", the diameter of the second input / output contact plug 803 may gradually increase toward the second input / output pad 805. However, example embodiments of the inventive concept are not limited thereto, and in certain example embodiments, the diameter of the second input / output contact plug 803 may gradually decrease toward the second input / output pad 805.

[0222] In certain example embodiments, as shown in a region "C2" as an alternative embodiment of the region "C", an opening 808 penetrating the third substrate 810 may be formed, and a contact 807 may be formed in the opening 808. One end of the contact 807 may be connected to the second input / output pad 805, and the other end of the contact 807 may be connected to the second input / output contact plug 803. Therefore, the second input / output contact plug 803 may be electrically connected to the second input / output pad 805 through the contact 807 in the opening 808. In this case, as shown in the region "C2", the diameter of the contact 807 may gradually increase toward the second input / output pad 805, and the diameter of the second input / output contact plug 803 may gradually decrease toward the second input / output pad 805. For example, the second input / output contact plug 803 may be formed together with the cell contact plug 840 before the second cell region CELL2 and the first cell region CELL1 are bonded to each other, and the contact 807 may be formed after the second cell region CELL2 and the first cell region CELL1 are bonded to each other.

[0223] In a specific example embodiment, as shown in a region "C3" as an alternative embodiment of the region "C", a stopper 809 may be further formed on the bottom end of the opening 808 of the third substrate 810, compared to the example embodiment of the region "C2". The stopper 809 may be a metal line formed in the same layer as the common source line 820. Alternatively, the stopper 809 may be a metal line formed in the same layer as at least one of the word lines 830. The second input / output contact plug 803 may be electrically connected to the second input / output pad 805 through the contact 807 and the stopper 809.

[0224] Similar to the second input / output contact plug 803 and the third input / output contact plug 804 of the second cell region CELL2, a diameter of each of the second input / output contact plug 703 and the third input / output contact plug 704 of the first cell region CELL1 may gradually decrease toward the lower metal pattern 771e, or may gradually increase toward the lower metal pattern 771e.

[0225] Meanwhile, in some example embodiments, a slit 811 may be formed in the third substrate 810. For example, the slit 811 may be formed at a specific position of the external pad bonding area PA. For example, as shown in area "D", when viewed in a plan view, the slit 811 may be located between the second input / output pad 805 and the cell contact plug 840. Alternatively, when viewed in a plan view, the second input / output pad 805 may be located between the slit 811 and the cell contact plug 840.

[0226] In some example embodiments, as shown in region "D1" as an alternative embodiment of region "D", the slit 811 may be formed to penetrate the third substrate 810. For example, when the opening 808 is formed, the slit 811 may be used to prevent fine cracks in the third substrate 810 or reduce the possibility of fine cracks in the third substrate 810. However, example embodiments of the inventive concepts are not limited thereto, and in certain example embodiments, the slit 811 may be formed to have a depth ranging from about 60% to about 70% of the thickness of the third substrate 810.

[0227] In certain example embodiments, as shown in region "D2" as an alternative embodiment of region "D", a conductive material 812 may be formed in the slit 811. For example, the conductive material 812 may be used to discharge leakage current occurring when driving circuit elements in the external pad bonding region PA to the outside. In this case, the conductive material 812 may be connected to an external ground line.

[0228] In a specific example embodiment, as shown in a region "D3" as an alternative embodiment of the region "D", an insulating material 813 may be formed in the slit 811. For example, the insulating material 813 may be used to electrically isolate the second input / output pad 805 and the second input / output contact plug 803 disposed in the external pad bonding area PA from the word line bonding area WLBA. Since the insulating material 813 is formed in the slit 811, it is possible to prevent a voltage provided through the second input / output pad 805 from affecting a metal layer on the third substrate 810 disposed in the word line bonding area WLBA or reduce the possibility that a voltage provided through the second input / output pad 805 affects a metal layer on the third substrate 810 disposed in the word line bonding area WLBA.

[0229] Meanwhile, in certain example embodiments, the first to third input / output pads 605, 805, and 806 may be selectively formed. For example, the memory device 500 may be implemented to include only the first input / output pad 605 disposed on the first substrate 610, only the second input / output pad 805 disposed on the third substrate 810, or only the third input / output pad 806 disposed on the upper insulating layer 801.

[0230] In some example embodiments, at least one of the second substrate 710 of the first cell region CELL1 and the third substrate 810 of the second cell region CELL2 may be used as a sacrificial substrate and may be completely or partially removed before or after the bonding process. An additional layer may be stacked after the substrate is removed. For example, the second substrate 710 of the first cell region CELL1 may be removed before or after the bonding process of the peripheral circuit region PERI and the first cell region CELL1, and then, an insulating layer covering the top surface of the common source line 720 or a conductive layer for connection may be formed. Similarly, the third substrate 810 of the second cell region CELL2 may be removed before or after the bonding process of the first cell region CELL1 and the second cell region CELL2, and then, an upper insulating layer 801 covering the top surface of the common source line 820 or a conductive layer for connection may be formed.

[0231] Figure 4 The memory cell array 110 may be included in the first cell region CELL1 or the second cell region CELL2, and Figure 4 The peripheral circuit 120 may be included in the peripheral circuit region PERI.

[0232] Any element and / or functional block disclosed above may include a processing circuit system (such as hardware including logic circuits; a hardware / software combination (such as a processor that executes software); or a combination thereof) or be implemented in a processing circuit system (such as hardware including logic circuits; a hardware / software combination (such as a processor that executes software); or a combination thereof). For example, the processing circuit system may more specifically include, but is not limited to, a central processing unit (CPU), an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a system on a chip (SoC), a programmable logic unit, a microprocessor, an application specific integrated circuit (ASIC), etc. The processing circuit system may include an electrical component such as at least one of a transistor, a resistor, a capacitor, etc. The processing circuit system may include an electrical component such as a logic gate including at least one of an AND gate, an OR gate, a NAND gate, a NOT gate, etc.

[0233] While the inventive concepts have been particularly shown and described with reference to example embodiments thereof, it will be understood that various changes in form and details may be made therein without departing from the spirit and scope of the appended claims.

Claims

1. A storage system, comprising: The host is configured as: generating a hash value for the first command, Combining the hash value and the random value, and providing a signature for the combined data and the first command; as well as The storage device is configured as: storing the random value corresponding to the first command in a first buffer, providing the random value to a host, receiving a first command and the signature from a host, storing the signature in a second buffer, verifying the signature, and In response to the verification being completed, the random value is deleted from the first buffer and the first command is executed.

2. The storage system according to claim 1, wherein: The storage device is further configured to, in response to receiving the first command more than a reference number of times, delete the signature from the second buffer.

3. The storage system according to claim 1, wherein: The storage device is further configured to: provide the random value to the host and request the signature when the signature corresponding to the first command does not exist in the second buffer.

4. The storage system according to claim 1, wherein: The storage device is further configured to provide the random value to the host and request a new signature for the first command when verification of the signature stored in the second buffer corresponding to the first command fails.

5. The storage system according to any one of claims 1 to 4, wherein: The storage device includes: a storage submission queue configured to store a plurality of commands received from a host; and a storage completion queue configured to store information about processed commands among the plurality of commands, The storage device is further configured to: when verification of the signature fails, delete the first command from the storage submission queue, and in response to successful verification of the signature, execute the first command and then store information about the first command in the storage completion queue.

6. The storage system according to claim 5, in, The host includes a host buffer storing a plurality of random values ​​corresponding to the plurality of commands, and Wherein, the multiple random values ​​are different from each other.

7. The storage system according to claim 6, in, The host buffer is further configured to store a plurality of signatures corresponding to the plurality of commands, and Wherein, the multiple signatures are different from each other.

8. The storage system according to claim 7, in, The storage device is further configured to: in response to the completion of the execution of the first command, provide a response to the host, The host is further configured to: in response to receiving the response, delete at least one of the signature and the random value for the first command from the host buffer.

9. A method for operating a storage system, the method comprising: providing the random value stored in the first buffer from the storage device to the host; In the host, generating a signature based on the first command and the random value; providing a first command and the signature from a host to a storage device; In the storage device, storing the signature in a second buffer; In a storage device, verifying the signature based on the random value; as well as In the storage device, a first command is executed based on a result of the step of verifying.

10. The operating method according to claim 9, further comprising: In the storage device, the random value is deleted from the first buffer based on a result of the verification.

11. The operating method according to claim 9, further comprising: In the storage device, in response to receiving the first command more than a reference number of times, the signature is deleted from the second buffer.

12. The operating method according to claim 9, further comprising: In the storage device, based on the signature corresponding to the first command not existing in the second buffer, the random value is provided to the host and the signature is requested.

13. The operating method according to claim 9, further comprising: In the storage device, based on a failure of verification of the signature, a first command is deleted from a storage submission queue that stores a plurality of commands received from a host.

14. The operating method according to claim 13, wherein: The steps of executing the first command include: In the storage device, based on successful verification of the signature, executing a first command; and After the first command is executed, information about the first command is stored in a storage completion queue, and information about processed commands among the plurality of commands is stored in the storage completion queue.

15. The operating method according to any one of claims 9 to 14, further comprising: In the storage device, based on completion of execution of the first command, providing a response to the host; as well as In the host, based on the response, at least one of the signature and the random value for the first command is deleted.

16. A storage system comprising: A storage device configured to: provide a random value, verify the signature based on a received command and a signature, and execute the command when verification is complete; as well as The host is configured to: receive the random value, generate the signature based on the random value and the command, and provide the command and the signature to the storage device.

17. The storage system according to claim 16, wherein: The storage device includes: a storage queue configured to store a plurality of commands received from a host; a first buffer configured to store a plurality of random values ​​corresponding to the plurality of commands; and a second buffer configured to store a plurality of signatures corresponding to the plurality of commands, Wherein, the storage device is further configured to: when the verification of the signature succeeds, delete the random value corresponding to the command from the first buffer.

18. The storage system according to claim 17, wherein: The storage device is further configured to: in response to a failure in verification of the signature, provide the random value to a host and request a new signature for the command.

19. The storage system according to claim 17, wherein: The storage device is further configured to, in response to a failure in verification of the signature, delete the command from a storage queue.

20. The storage system according to claim 17, wherein: The storage device is further configured to: in response to the signature corresponding to the command not being present in the second buffer, provide the random value to the host and request the signature.

Images