Storage system and electronic device

Abstract

The invention discloses a storage system and electronic equipment. The storage system comprises a hardware security layer used for generating a private key processed by a multi-level key management mechanism; the encryption layer is used for receiving to-be-encrypted data and the private key, performing number-theory transformation on the to-be-encrypted data to obtain first data, performing polynomial multiplication calculation on the private key, the to-be-encrypted data and the first data to obtain second data, performing number-theory transformation and inverse transformation on the second data to obtain third data, and outputting encrypted data based on the third data; and the verification storage layer is used for performing secure storage on the encrypted data, performing data integrity verification on the stored data corresponding to the access request, corresponding to the access request after the verification is passed, and inputting the stored data into the encryption layer for processing after the verification is passed. By means of the mode, high-performance data encryption can be provided, and safety and privacy protection are ensured.

Description

Technical Field

[0001] The present application relates to the field of memory technology, and in particular to a storage system and an electronic device. Background Art

[0002] As digital transformation advances, data security and storage reliability have become critical. Currently, data security threats are becoming increasingly complex, regulatory compliance requirements are increasing, privacy protection needs are increasing, and traditional encryption mechanisms have high performance overhead. In addition, problems such as insufficient data integrity protection, limited fault recovery mechanisms, lack of early warning capabilities, and imperfect real-time monitoring also affect the reliability of storage systems. Summary of the invention

[0003] The storage system and electronic device provided in this application can provide high-performance data encryption to ensure security and privacy protection.

[0004] In a first aspect, the present application provides a storage system, which includes: a hardware security layer for generating a private key processed by a multi-level key management mechanism; an encryption layer for receiving data to be encrypted and a private key, and performing a number theoretic transformation on the data to be encrypted to obtain first data, and performing a polynomial multiplication calculation on the private key, the data to be encrypted and the first data to obtain second data, performing a number theoretic inverse transformation on the second data to obtain third data, and outputting encrypted data based on the third data; a verification storage layer for securely storing the encrypted data, and performing a data integrity verification on the stored data corresponding to the access request, responding to the access request after the verification passes, and inputting the stored data into the encryption layer for processing after the verification passes.

[0005] Among them, the encryption layer is also used to perform a modulus increase operation on the third data to obtain fourth data, and perform a number theory transformation on the fourth data to obtain fifth data, and perform a reproducibility operation on the fifth data to obtain sixth data, and perform an inverse number theory transformation on the sixth data to obtain seventh data, and perform a modulus decrease operation on the seventh data to obtain eighth data, and perform an accumulation operation and a scaling operation on the eighth data in sequence to output encrypted data.

[0006] Among them, the hardware security layer includes: a hardware encryption engine, which is used to perform key generation operations to generate private keys; a multi-level key management module, which is used to perform multi-level key management of private keys; among them, the hardware encryption engine and the multi-level key management module form a closed loop to continuously monitor and update the keys.

[0007] Among them, the storage system also includes: a maintenance module, which is used to analyze the performance data of the storage system, use machine learning models to predict faults, and issue maintenance warnings based on predicted faults; a bad block management module, which is used to use machine learning models to analyze the performance data of the storage system, automatically identify and mark bad blocks, and process the corresponding bad blocks; an error correction module, which is used to dynamically adjust error correction parameters according to the characteristics and storage density of the storage system; a copy management module, which is used to use a multi-copy mechanism to store the key data of the storage system and manage the consistency between multiple copies.

[0008] Among them, the error correction module includes: a parameter monitoring unit, which is used to collect parameters of the storage system in real time, and the parameters include at least one of the number of erase and write times, the original error rate, the temperature and voltage of the working environment, the storage density and the read voltage; a parameter adjustment unit, which is used to adjust the parameters based on the parameters using preset rules and / or machine learning models; a soft decision decoding unit, which is used to collect multi-level read voltages and channel quality information during the data reading process, and convert the multi-level read voltages and channel quality information into soft information, and use the soft information for decoding operations; a parameter sharing and synchronization unit, which is used to store error correction parameters and machine learning model parameters for use by all modules of the storage system, and to feed back to the corresponding modules of the storage system when the error correction parameters are adjusted.

[0009] The encryption layer further includes: a biometric encryption module, which is used to encrypt the error correction parameters that need to be stored in the parameter sharing and synchronization unit using biometric features; and a biometric decryption module, which is used to decrypt the encrypted error correction parameters.

[0010] Among them, the biometric encryption module is also used to collect biometrics, generate a biometric key based on the biometrics, encrypt the error correction parameters using the biometric key, and store the encrypted error correction parameters in the parameter sharing and synchronization unit.

[0011] Among them, the biometric decryption module is also used to collect biometrics, generate a biometric key based on the biometrics, use the biometric key to decrypt the encrypted error correction parameters, and synchronize the decrypted error correction parameters to the corresponding module stored in the storage system.

[0012] Among them, the biometric encryption module and the biometric decryption module are also used to collect biometric features, and perform feature extraction, feature quantification, and feature binarization on the biometric features in sequence to obtain mask data, and use the mask data and the confusion value to perform an XOR operation, and perform parity encoding on the XOR operation result, and use a pseudo-random number generator to generate a random key according to the parity encoding result, and calculate the hash value of the random key, and verify the random key, and use the verified random key as the biometric key.

[0013] In a second aspect, the present application provides an electronic device, which includes the storage system provided in the first aspect.

[0014] The beneficial effects of the present application are as follows: Different from the prior art, the storage system and electronic device provided by the present application, the hardware encryption engine can provide high-performance data encryption to ensure security and privacy protection. The use of a multi-level key management mechanism can ensure key security and prevent unauthorized access. During the encryption process, it supports a variety of encryption algorithms and strategies to adapt to different application scenarios and achieve flexible configuration. And integrated data integrity verification function to ensure data consistency and reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them: Figure 1 It is a structural diagram of an embodiment of a storage system provided by the present application; Figure 2 is a structural diagram of another embodiment of the storage system provided by the present application; Figure 3 It is a structural diagram of an embodiment of an error correction module provided by the present application; Figure 4 It is a structural diagram of an embodiment of an encryption layer provided by the present application; Figure 5 It is a structural schematic diagram of an embodiment of an electronic device provided by the present application. DETAILED DESCRIPTION

[0016] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It will be understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for ease of description, only some but not all structures related to the present application are shown in the drawings. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0017] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0018] See also Figure 1 , Figure 1 1 is a schematic diagram of a storage system according to an embodiment of the present application. The storage system 100 comprises: a hardware security layer 10, an encryption layer 20 and a verification storage layer 30. The storage system 100 may be an embedded storage system.

[0019] The hardware security layer 10 is used to generate a private key processed by a multi-level key management mechanism.

[0020] The encryption layer 20 is used to receive the data to be encrypted and the private key, and perform number theoretic transformation on the data to be encrypted to obtain first data, and perform polynomial multiplication calculation on the private key, the data to be encrypted and the first data to obtain second data, and perform inverse number theoretic transformation on the second data to obtain third data, and output encrypted data based on the third data.

[0021] Among them, the encryption layer 20 is also used to perform a modulus increase operation on the third data to obtain fourth data, and perform a number theory transformation on the fourth data to obtain fifth data, and perform a reproducibility operation on the fifth data to obtain sixth data, and perform an inverse number theory transformation on the sixth data to obtain seventh data, and perform a modulus decrease operation on the seventh data to obtain eighth data, and perform an accumulation operation and a scaling operation on the eighth data in sequence to output encrypted data.

[0022] The verification storage layer 30 is used to securely store the encrypted data and to perform data integrity verification on the stored data corresponding to the access request, respond to the access request after the verification passes, and input the stored data into the encryption layer 20 for processing after the verification passes.

[0023] In some embodiments, when the verification fails, the access request is denied.

[0024] In some embodiments, the hardware security layer 10 includes: a hardware encryption engine and a multi-level key management module. The hardware encryption engine is used to perform a key generation operation to generate a private key. The multi-level key management module is used to perform multi-level key management on the private key; wherein the hardware encryption engine and the multi-level key management module form a closed loop to continuously monitor and update the key.

[0025] In this embodiment, the hardware encryption engine can provide high-performance data encryption to ensure security and privacy protection. The multi-level key management mechanism can ensure key security and prevent unauthorized access. During the encryption process, multiple encryption algorithms and strategies are supported to adapt to different application scenarios and achieve flexible configuration. And the integrated data integrity check function ensures data consistency and reliability.

[0026] In this application, any access request will first be verified by the verification storage layer 30 for data integrity to ensure that the data has not been tampered with, and then the data will be returned to the hardware encryption layer 20 again.

[0027] The hardware encryption engine and key management system form a closed loop to continuously monitor and update keys, providing basic security. The process of data encryption, verification, and re-encryption forms a closed loop, which can continuously protect and process data. Data access needs to undergo integrity verification to form a closed loop to ensure that all accessed data is credible.

[0028] The storage system 100 is divided into a hardware security layer 10, an encryption layer 20 and a verification storage layer 30, each layer having its own unique function and cooperating with each other to improve the overall security.

[0029] Each closed loop means continuous monitoring and protection of data and keys, forming a strong security system. This layered structure allows flexible adjustment and expansion at each layer to adapt to different security needs.

[0030] Furthermore, the inventors of the present application have also found that the storage system 100 is becoming increasingly complex, and the reliability and stability of data storage are increasingly required. These systems usually operate in harsh environments and under high-intensity loads, which poses severe challenges to storage media. For example, the limitations of the storage media used for storage, the inherent physical properties of the storage media lead to data errors, bad blocks, limited erase and write times, and other issues, which directly affect the reliability and life of the system.

[0031] The data stored in the storage system 100, including operating systems, applications, user data, etc., are often crucial. Data loss or damage may cause system failure or even lead to security incidents. And the shortcomings of traditional security solutions: Traditional reliability security solutions, such as simple checksums, limited ECC capabilities, manual bad block management, etc., are difficult to meet the current requirements of high reliability and high stability. Based on this, the present application proposes the following embodiments.

[0032] See also Figure 2 , Figure 21 is a schematic diagram of the structure of another embodiment of the storage system provided by the present application. The storage system 100 also includes: a maintenance module 40, a bad block management module 50, an error correction module 60 and a copy management module 70. It can be understood that the storage system 100 includes the above-mentioned hardware security layer 10, encryption layer 20 and verification storage layer 30, which will not be described in detail here.

[0033] The maintenance module 40 is used to analyze the performance data of the storage system 100, use a machine learning model to predict faults, and issue maintenance warnings based on the predicted faults.

[0034] In some embodiments, various performance data of the storage medium are collected and analyzed, such as the number of erase and write times, error rate, voltage / temperature, etc. A machine learning model is used to predict potential failures, issue early warnings, and perform necessary maintenance operations.

[0035] For example, a performance monitoring system is established to regularly collect performance data of storage media. Technologies such as time series analysis and anomaly detection are used to predict potential storage failures. Operations such as data migration and bad block replacement are triggered in advance to avoid system downtime.

[0036] The bad block management module 50 is used to analyze the performance data of the storage system 100 using a machine learning model, automatically identify and mark bad blocks, and process the corresponding bad blocks.

[0037] In some embodiments, an intelligent bad block detection and management mechanism is adopted, and a machine learning algorithm is used to analyze the performance indicators of the storage medium (such as the number of erase and write times, error rate, etc.), automatically identify and mark bad blocks, and remove them from the available space.

[0038] Exemplarily, a bad block mapping table is established to dynamically update bad block information, and data migration and redirection technology is used to migrate data on the bad block to other available spaces.

[0039] The error correction module 60 is used to dynamically adjust error correction parameters according to the characteristics and storage density of the storage system 100 .

[0040] In some embodiments, more advanced ECC algorithms are used, such as LDPC (Low Density Parity Check Code) or BCH (Bose-Chowdhury-Hokungum Code), to provide stronger error correction capabilities and correct a wider range of types and numbers of data errors.

[0041] For example, according to the characteristics and storage density of NAND Flash, ECC parameters such as check bit length and error correction capability are dynamically adjusted. At the same time, soft decision decoding technology is considered to further improve the error correction effect.

[0042] The copy management module 70 is used to store key data of the storage system 100 using a multiple copy mechanism and to perform consistency management between multiple copies.

[0043] In some embodiments, a multi-copy mechanism (such as three copies) is used to store key data, and a distributed consistency protocol (such as Paxos and Raft) is introduced to ensure data consistency among multiple copies.

[0044] For example, an efficient replica writing and synchronization mechanism is implemented to reduce the performance overhead caused by consistency maintenance. Mechanisms such as version numbers or timestamps are used to detect and resolve data conflicts.

[0045] In this embodiment, the enhanced ECC algorithm and multi-copy mechanism significantly reduce the probability of data errors and ensure the integrity and accuracy of the data. The intelligent bad block management mechanism effectively avoids the impact of bad blocks on storage space, improves the utilization rate of storage media, and extends the storage life. The predictive maintenance mechanism warns and handles potential failures in advance, minimizes system downtime caused by storage failures, and improves system availability. The automated and intelligent management mechanism reduces manual intervention, reduces operation and maintenance costs, and improves management efficiency. The comprehensive reliability assurance mechanism enhances the robustness and risk resistance of the system and ensures the stable operation of the system in harsh environments.

[0046] In this application, "the ECC parameters, such as the check bit length and error correction capability, are dynamically adjusted according to the characteristics and storage density of NAND Flash. At the same time, soft decision decoding technology is considered to further improve the error correction effect." Please refer to the following embodiments for details.

[0047] See also Figure 3 , Figure 3 1 is a schematic diagram of the structure of an embodiment of an error correction module provided by the present application. The error correction module 60 comprises: a parameter monitoring unit 61 , a parameter adjustment unit 62 , a soft decision decoding unit 63 and a parameter sharing and synchronization unit 64 .

[0048] The parameter monitoring unit 61 is used to collect parameters of the storage system 100 in real time, and the parameters include at least one of the number of erase and write times, the original error rate, the temperature and voltage of the working environment, the storage density and the read voltage.

[0049] In some embodiments, a real-time monitoring module (parameter monitoring unit 61) is integrated in the storage controller, which is responsible for continuously collecting and analyzing the following parameters: the number of erase and write times, raw error rate, temperature and voltage, storage density and read voltage of the NAND Flash unit.

[0050] The number of erase and write cycles (P / E Cycles) of NAND Flash cells: reflects the degree of wear of the storage cells.

[0051] Raw Bit Error Rate (RBER): The error bit rate generated by a memory cell without error correction.

[0052] Temperature and voltage: Changes in the temperature and voltage of the working environment will affect the characteristics of NAND Flash.

[0053] Storage density (Cell Level): Different storage densities such as TLC (Triple Level Cell) and QLC (Quad Level Cell) have different error characteristics.

[0054] Read Voltage: You can adjust the read voltage to improve reading performance and accuracy.

[0055] Different from the related art, the present application is no longer a simple static parameter configuration, but a real-time, dynamic, data-driven parameter monitoring, providing an accurate basis for the subsequent dynamic adjustment of ECC parameters.

[0056] The parameter adjustment unit 62 is used to adjust the parameters based on the parameters using preset rules and / or machine learning models.

[0057] In some embodiments, rule-based adjustment: Based on the parameters monitored in real time, a set of rules are predefined for dynamically adjusting ECC parameters, for example: When the P / E cycles exceed a certain threshold, the ECC check bit length and error correction capability are increased.

[0058] When the RBER increases, the error correction algorithm is adjusted to improve the error correction efficiency.

[0059] When the temperature is too high or too low, adjust the ECC parameters to adapt to the environmental changes.

[0060] Different ECC schemes and parameters are used for different storage densities.

[0061] In some embodiments, dynamic adjustment based on machine learning: using a machine learning model (such as a neural network or a decision tree) to train historical monitoring data, learn the relationship between parameters and error rates, and predict future error rate trends, so as to adjust ECC parameters in advance.

[0062] Different from related technologies, this application upgrades the traditional "static configuration" to "dynamic adjustment" based on rules and machine learning. The addition of machine learning models makes parameter adjustment more forward-looking and adaptive. It can dynamically optimize ECC parameters according to actual conditions to maximize resource utilization. It significantly improves the reliability of the storage system 100 and extends the life of the storage medium.

[0063] The soft decision decoding unit 63 is used to collect multi-level read voltages and channel quality information during data reading, and convert the multi-level read voltages and channel quality information into soft information, and perform decoding operations using the soft information.

[0064] In some embodiments, for multi-level read voltages, when reading data, not only one read voltage is used, but multiple read voltages are used to obtain data information at different voltages.

[0065] For channel quality assessment: Analyze the channel quality of the storage unit through multiple reading results and quantify the channel reliability.

[0066] For soft information extraction: The multi-level read voltage and channel quality information are converted into soft information (eg, probability value or confidence value) for soft decision decoding.

[0067] For enhanced soft decision decoding algorithms: Use LDPC soft decision decoding or other advanced algorithms to utilize soft information for decoding and improve error correction capabilities.

[0068] Different from the related art, this application makes full use of the information provided by the multi-level read voltage to improve the accuracy of decoding. And introduces channel quality assessment to provide a more accurate basis for soft decision decoding. This application improves the error correction capability of ECC without adding additional hardware overhead, and effectively reduces the error rate under low voltage or high noise conditions.

[0069] The parameter sharing and synchronization unit 64 is used to store error correction parameters and machine learning model parameters for use by all modules of the storage system 100, and to feed back to the corresponding modules of the storage system 100 when the error correction parameters are adjusted.

[0070] In some embodiments, the parameter sharing and synchronization unit 64 establishes a global parameter storage area in the storage controller for storing current ECC parameters, machine learning model parameters, etc.

[0071] The parameter sharing and synchronization unit 64 has a synchronization update mechanism to ensure that each component in the multi-core or multi-channel storage system 100 can use the latest parameter settings.

[0072] The parameter sharing and synchronization unit 64 has dynamic adjustment notification. When the ECC parameters change, the system can promptly notify all related modules.

[0073] Different from the related art, the present application ensures parameter consistency of the entire storage system 100 , can ensure synchronous operation of multiple storage channels or cores, and further improves the reliability and performance of the storage system 100 .

[0074] In the embodiment, the intelligent adjustment of ECC parameters is realized through the machine learning model, making it more forward-looking and adaptive. And through real-time parameter monitoring, the state of NAND Flash can be more precisely grasped, so as to make more accurate adjustments. And the dynamic adjustment of ECC parameters avoids the waste of resources caused by static configuration and improves the overall efficiency of the system. And multi-level read voltage, channel quality assessment, soft information extraction and other technologies maximize the use of storage unit information and improve error correction capabilities. From monitoring, adjustment, decoding to parameter sharing, the solution builds a complete and highly coordinated reliability assurance system.

[0075] In an application scenario, in response to a data read and write operation, data reading and writing are performed. For example, data is read, and a read judgment is performed during the process. If it is determined that multi-level reading is required, a multi-level read voltage is obtained and a channel quality assessment is performed, and then soft information extraction is performed. If it is determined that a default read is performed, a default read voltage is obtained, and then soft information extraction is performed. Then, an ECC algorithm is selected according to real-time parameters, and soft decision decoding is performed. And it is determined whether the decoding is successful. If successful, the data is output. If unsuccessful, other decoding strategies are tried or a reread is requested.

[0076] See also Figure 4 , Figure 4 The encryption layer 20 provided in the present application is a schematic diagram of the structure of an embodiment of the encryption layer 20. The encryption layer 20 also includes: a biometric encryption module 21 and a biometric decryption module 22.

[0077] The biometric encryption module 21 is used to encrypt the error correction parameters to be stored in the parameter sharing and synchronization unit 64 using the biometric features.

[0078] The biometric decryption module 22 is used to decrypt the encrypted error correction parameters.

[0079] The biometric encryption module 21 is also used to collect biometrics, generate a biometric key based on the biometrics, encrypt the error correction parameters using the biometric key, and store the encrypted error correction parameters in the parameter sharing and synchronization unit 64. In some embodiments, after obtaining the biometric key, the global ECC parameters are obtained, and the encryption algorithm is selected, the global ECC parameters are encrypted using the biometric key, and a hash algorithm is selected to calculate the message authentication code, and the encrypted global ECC parameters and the message authentication code are stored in the parameter sharing and synchronization unit 64.

[0080] The biometric decryption module 22 is also used to collect biometrics, generate a biometric key based on the biometrics, decrypt the encrypted error correction parameters using the biometric key, and synchronize the decrypted error correction parameters to the corresponding module stored in the storage system 100. In some embodiments, after obtaining the biometric key, the encrypted global ECC parameters and message authentication code are obtained, and the decryption algorithm is selected, the encrypted global ECC parameters are decrypted using the biometric key, and the hash algorithm is selected to verify the message authentication code. If the verification is successful, the global ECC parameters are updated synchronously, and if the verification fails, error processing is performed.

[0081] Among them, the biometric encryption module 21 and the biometric decryption module 22 are also used to collect biometric features, and perform feature extraction, feature quantification, and feature binarization on the biometric features in sequence to obtain mask data, and use the mask data and the obfuscation value to perform an XOR operation, and perform parity encoding on the XOR operation result, and use a pseudo-random number generator to generate a random key according to the parity encoding result, and calculate the hash value of the random key, and verify the random key, and use the verified random key as the biometric feature key.

[0082] In this embodiment, a scheme for encrypting ECC global parameters (stored in parameter sharing and synchronization unit 64) using a biometric key scheme is used to ensure the confidentiality and integrity of the ECC parameters during storage, transmission and update. This scheme will combine biometric key generation capabilities and encryption technology to provide a more secure ECC parameter management mechanism.

[0083] The generated dynamic biometric key is used to encrypt the ECC parameters stored in the global parameter storage area (parameter sharing and synchronization unit 64). This ensures that: 1. Confidentiality: Only users with correct biometric input can decrypt and use the ECC parameters.

[0084] 2. Integrity: Any tampering with the encrypted ECC parameters will cause decryption failure, thus preventing malicious modification.

[0085] 3. Dynamicity: The keys are generated dynamically rather than stored statically, which improves security.

[0086] 4. Fine-grained access control: Different keys can be generated through different biometric inputs to achieve fine-grained access control of ECC parameters.

[0087] Exemplarily, the biometric key generation may include the following process: Key Generation Trigger: The key generation process for the biometric key is triggered in the following cases: At system startup: Generates the initial key at system startup.

[0088] Periodic update: regenerate the key at regular intervals (for example, after a certain number of erases or writes).

[0089] Before parameter update: before updating the global ECC parameters each time.

[0090] Key generation process: Obtain biometric input from the user (e.g., fingerprint, iris, facial image).

[0091] Feature extraction, quantization, binarization, and encoding / decoding processes using a biometric key scheme.

[0092] Generate encryption key `k`.

[0093] Key verification: Verify the decoded key with the key in the system to confirm the authenticity of the biometric.

[0094] Exemplarily, ECC global parameter encryption may include the following process: Parameter acquisition: Get the ECC parameters that need to be protected (such as check bit length, error correction algorithm identifier, soft decision decoding parameters, etc.) from the global parameter storage area.

[0095] Encryption algorithm selection: Select a symmetric encryption algorithm (such as AES, ChaCha20) to encrypt the ECC parameters, and use the biometric key `k` generated in the above process as the encryption key.

[0096] Encryption operation: Encrypt the ECC parameters with the biometric key `k` using the selected encryption algorithm.

[0097] Encrypted data storage: The encrypted ECC parameters are stored in the global parameter storage area, and a MAC (message authentication code) is stored to verify the integrity of the data.

[0098] A hashing algorithm such as SHA-256 or HMAC can be used to generate the MAC.

[0099] Exemplarily, ECC global parameter decryption may include the following process: Key Verification: Trigger the key verification process of the biometric key before the ECC parameters need to be used (such as reading data or making parameter adjustments).

[0100] Verify key: Verify whether the key is correct.

[0101] Parameter Decryption: Decrypt the encrypted ECC parameters stored in the global parameter storage area using the verified biometric key `k`.

[0102] Data integrity verification: Use the hash algorithm and the stored MAC to verify whether the decrypted data has been tampered with. If the verification fails, take necessary error handling measures, such as stopping the system operation or trying to re-acquire parameters.

[0103] Exemplarily, parameter synchronization and application may include the following process: Parameter synchronization: Synchronize the decrypted ECC parameters to the storage controller and all related modules.

[0104] Real-time application: The system performs data read and write operations and soft decision decoding according to the new ECC parameters.

[0105] In one application scenario, the specific process may be as follows: 1. System startup: Initialize the monitoring module, machine learning model, and global parameter storage area.

[0106] 2. Biometric key generation: At startup, the biometric key is triggered to generate the biometric key `k`.

[0107] 3. ECC parameter encryption: Get ECC parameters from the global parameter storage area, encrypt them using the key `k`, and generate MAC. Store the encrypted data and MAC back to the global parameter storage area.

[0108] 4. Parameter usage: When you need to use ECC parameters, perform the following operations: Trigger Biometric Key Biometric Key Verification to verify that the key `k'` is correct.

[0109] Decrypts the encrypted ECC parameters in the global parameter store using key `k'`.

[0110] Verify data integrity (MAC).

[0111] If the verification is successful, the decrypted ECC parameters are synchronized to all related modules.

[0112] If validation fails, stop the operation and try to re-acquire the parameters.

[0113] 5. Dynamic update: Regenerate the key `k` according to the preset policy or event trigger. Use the new key `k` to encrypt the ECC parameters and update the global parameter storage area.

[0114] 6. Loop operation: The above steps are repeated to ensure the continuous safety of ECC parameters.

[0115] Encryption scheme selection: Symmetric encryption: You can choose symmetric encryption algorithms such as AES-256 and ChaCha20 to ensure encryption and decryption efficiency.

[0116] Authenticated encryption: Authenticated encryption algorithms such as AES-GCM, ChaCha20-Poly1305 can be used to ensure data confidentiality and integrity.

[0117] Hash Algorithm: You can choose SHA-256 or HMAC-SHA256 to generate MAC for verifying data integrity.

[0118] In this embodiment, dynamic biometric keys are used to encrypt ECC parameters instead of static keys, which greatly improves security. In addition to encryption, MAC is also used to protect the integrity of the data and prevent tampering. Each encryption and decryption of ECC parameters triggers biometric authentication, which increases the auditability of the operation. Different keys can be generated through different biometric inputs to achieve fine-grained access control of ECC parameters.

[0119] The advantage of this application is that even if the storage medium is stolen, the attacker cannot decrypt the ECC parameters because a valid biometric key is required. Any tampering with the encryption parameters will be detected to prevent the parameters from being destroyed. The frequency of key generation and update can be adjusted as needed to meet different security requirements.

[0120] That is, the above embodiment provides a secure, dynamic and reliable way to protect ECC global parameters stored in embedded systems. By combining the biometric key generation capability and encryption technology of the biometric key, it ensures the confidentiality, integrity and traceability of the parameters and improves the overall security of the system. This will be an indispensable part of any high-security embedded system.

[0121] It can be applied to the following scenarios: High reliability embedded systems (such as industrial control, medical equipment, automotive electronics).

[0122] Large-capacity storage devices (such as solid-state drives (SSDs)).

[0123] Applications with extremely high requirements for data reliability (such as finance, aerospace).

[0124] The summary is as follows: "Intelligent Adaptive ECC and Soft Decision Decoding Enhanced Storage Reliability Solution" enables the storage system 100 to handle various challenges of NAND Flash storage media more intelligently and efficiently through real-time monitoring, intelligent adjustment, soft decision decoding enhancement and other means. This solution is highly innovative and can significantly improve the reliability and life of the storage system 100, and lay the foundation for the future development of storage technology.

[0125] The following is an introduction to the application scenario effects: 1. Financial-grade storage system: Data protection strength increased by 300%: comprehensive data encryption and protection mechanisms ensure data security.

[0126] Encryption performance overhead is reduced by 50%: Embedded eMMC hardware accelerates encryption to improve system performance.

[0127] System availability reaches 99.999%: High availability is ensured through an enhanced reliability assurance system.

[0128] Fault warning accuracy of 95%: Intelligent fault prediction and monitoring improves warning accuracy.

[0129] Data recovery time is reduced by 60%: Rapid fault recovery mechanism shortens data recovery time.

[0130] 2. Industrial control storage: Atomic write latency <100μs: Embedded eMMC optimized design ensures low-latency atomic write performance.

[0131] Power-off protection response <10μs: Built-in power-off protection mechanism to ensure data security.

[0132] UBER (Uncorrected Bit Error Rate) <10^-17: Advanced ECC algorithm to reduce data error rate.

[0133] MTBF (mean time between failures) > 2 million hours: high reliability design to extend equipment life.

[0134] In summary, by combining the characteristics of embedded eMMC storage, the new generation of high-reliability and secure storage platform can significantly improve data security, reliability and system performance, meet the needs of various application scenarios, and ensure the security and efficient storage of data.

[0135] See also Figure 5 , Figure 5 1 is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. The electronic device 500 includes a storage system 100. The storage system 100 is the storage system 100 in any of the above embodiments.

[0136] In the several embodiments provided in this application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only illustrative, for example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0137] If the integrated units in the above other embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), disk or optical disk and other media that can store program codes.

[0138] The above description is only an implementation method of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly used in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A storage system, characterized in that: The storage system comprises: A hardware security layer for generating private keys that are processed by a multi-layered key management mechanism; an encryption layer, for receiving data to be encrypted and the private key, performing a number-theoretic transformation on the data to be encrypted to obtain first data, performing a polynomial multiplication calculation on the private key, the data to be encrypted and the first data to obtain second data, performing a number-theoretic inverse transformation on the second data to obtain third data, and outputting encrypted data based on the third data; The verification storage layer is used to securely store the encrypted data and perform data integrity verification on the stored data corresponding to the access request, respond to the access request after the verification is passed, and input the stored data into the encryption layer for processing after the verification is passed.

2. The storage system according to claim 1, characterized in that: The encryption layer is also used to perform a modulus increase operation on the third data to obtain fourth data, perform a number theory transformation on the fourth data to obtain fifth data, perform a reproducibility operation on the fifth data to obtain sixth data, perform an inverse number theory transformation on the sixth data to obtain seventh data, perform a modulus decrease operation on the seventh data to obtain eighth data, perform an accumulation operation and a scaling operation on the eighth data in sequence, and output encrypted data.

3. The storage system according to claim 1, characterized in that: The hardware security layer includes: Hardware encryption engine, used to perform key generation operations to generate private keys; A multi-level key management module, used for performing multi-level key management on the private key; Among them, the hardware encryption engine and multi-level key management module form a closed loop to continuously monitor and update keys.

4. The storage system according to claim 1, characterized in that: The storage system further includes: The maintenance module is used to analyze the performance data of the storage system, use machine learning models to predict faults, and issue maintenance warnings based on the predicted faults; The bad block management module is used to analyze the performance data of the storage system using machine learning models, automatically identify and mark bad blocks, and process the corresponding bad blocks; An error correction module, used to dynamically adjust error correction parameters according to the characteristics and storage density of the storage system; The copy management module is used to store the key data of the storage system using a multi-copy mechanism and to perform consistency management between the multiple copies.

5. The storage system according to claim 4, characterized in that: The error correction module comprises: A parameter monitoring unit, used for collecting parameters of the storage system in real time, wherein the parameters include at least one of the number of erase and write times, the original error rate, the temperature and voltage of the working environment, the storage density and the read voltage; A parameter adjustment unit, configured to adjust the parameter based on the parameter using a preset rule and / or a machine learning model; A soft decision decoding unit, used for collecting multi-level read voltages and channel quality information during data reading, converting the multi-level read voltages and the channel quality information into soft information, and performing a decoding operation using the soft information; A parameter sharing and synchronization unit is used to store error correction parameters and the machine learning model parameters for use by all modules of the storage system, and to feed back to the corresponding modules of the storage system when the error correction parameters are adjusted.

6. The storage system according to claim 5, characterized in that: The encryption layer also includes: A biometric encryption module, used to encrypt error correction parameters to be stored in the parameter sharing and synchronization unit using biometric features; The biometric decryption module is used to decrypt the encrypted error correction parameters.

7. The storage system according to claim 6, characterized in that: The biometric encryption module is also used to collect biometric features, generate a biometric key based on the biometric features, encrypt the error correction parameters using the biometric key, and store the encrypted error correction parameters in the parameter sharing and synchronization unit.

8. The storage system according to claim 6, characterized in that: The biometric decryption module is also used to collect biometric features, generate a biometric key based on the biometric features, use the biometric key to decrypt the encrypted error correction parameters, and synchronize the decrypted error correction parameters to the corresponding module stored in the storage system.

9. The storage system according to claim 7, characterized in that: The biometric encryption module and the biometric decryption module are also used to collect the biometric features, and perform feature extraction, feature quantification, and feature binarization on the biometric features in sequence to obtain mask data, and use the mask data and the obfuscation value to perform an XOR operation, and perform parity coding on the XOR operation result, and use a pseudo-random number generator to generate a random key according to the parity coding result, and calculate the hash value of the random key, and verify the random key, and use the random key that has passed the verification as the biometric feature key.

10. An electronic device, characterized in that: The electronic device comprises the storage system according to any one of claims 1-9.

Images