Memory management method and storage device

Abstract

The invention provides a memory management method and a storage device. The method comprises the following steps: determining a plurality of candidate entity units which are dispersed in different memory areas in a memory module; detecting a system event, including a power-on event of the memory device; in response to a system event, selecting a first entity unit from the plurality of candidate entity units, and reading the first entity unit; obtaining read data corresponding to the read instruction sequence from the memory module; performing error detection on the read data to obtain error rate information of the read data; generating password information according to the error rate information; according to the password information, encrypting the original data to generate encrypted data; and storing the encrypted data to the second entity unit. Therefore, the data encryption efficiency of the storage device can be improved.

Description

Technical Field

[0001] The present invention relates to the field of storage technology, and in particular to a memory management method and a storage device. Background Art

[0002] In today's digital age, with the rapid development of information technology and the increasing value of big data, data security has become a core element that cannot be ignored in storage system design. Traditional mechanical hard disk drives (HDDs) and early solid-state drives (SSDs) are particularly vulnerable to unauthorized access and data leakage due to the lack of built-in security mechanisms. Especially in emerging application scenarios such as cloud computing and edge computing, these traditional storage media cannot meet the strict requirements for data integrity and confidentiality.

[0003] In order to cope with the above challenges, data encryption has become one of the mainstream ways to protect sensitive information. Among them, hardware-based encryption solutions are favored because they can provide high performance and high security. In this context, solid-state drives (Encrypted SSDs) with powerful encryption functions have emerged. They not only inherit the high-speed reading and writing characteristics of traditional SSDs, but also integrate advanced encryption algorithms and key management strategies to provide users with a fast and secure data storage platform.

[0004] Therefore, developing and optimizing high-quality encrypted SSDs has become a key focus for technical personnel in the storage field. Summary of the invention

[0005] The present invention provides a memory management method and a storage device, which can improve the above-mentioned problem and enhance the data encryption efficiency of the storage device.

[0006] An embodiment of the present invention provides a memory management method, which is used for a storage device, wherein the storage device includes a memory module, the memory module includes a plurality of physical units, and the memory management method includes: determining a plurality of candidate physical units among the plurality of physical units, wherein the plurality of candidate physical units are dispersed in different memory areas in the memory module; detecting a system event, wherein the system event includes a power-on event of the storage device; in response to the system event, selecting at least one of the plurality of candidate physical units as a first physical unit, and sending a read instruction sequence to the memory module to instruct the memory module to read the first physical unit; obtaining read data corresponding to the read instruction sequence from the memory module; performing error detection on the read data to obtain error rate information of the read data, wherein the error rate information reflects the bit error rate of the read data; generating password information based on the error rate information; encrypting original data based on the password information to generate encrypted data corresponding to the original data; and sending a write instruction sequence to the memory module to instruct the memory module to store the encrypted data in a second physical unit among the plurality of physical units.

[0007] The embodiment of the present invention further provides a storage device, which includes a connection interface, a memory module and a memory controller. The connection interface is used to connect to a host system. The memory controller is connected to the connection interface and the memory module. The memory module includes a plurality of physical units, and the memory controller is used to: determine a plurality of candidate physical units from the plurality of physical units, wherein the plurality of candidate physical units are dispersed in different memory areas in the memory module; detect a system event, wherein the system event includes a power-on event of the storage device; in response to the system event, select at least one of the plurality of candidate physical units as a first physical unit, and send a read instruction sequence to the memory module to instruct the memory module to read the first physical unit; obtain read data corresponding to the read instruction sequence from the memory module; perform error detection on the read data to obtain error rate information of the read data, wherein the error rate information reflects the bit error rate of the read data; generate password information according to the error rate information; encrypt the original data according to the password information to generate encrypted data corresponding to the original data; and send a write instruction sequence to the memory module to instruct the memory module to store the encrypted data in a second physical unit among the plurality of physical units.

[0008] Based on the above, the present invention can effectively improve the problem that the random numbers traditionally used to encrypt data are not random enough, thereby improving the data encryption efficiency of the storage device. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 is a schematic diagram of a data storage system according to an embodiment of the present invention;

[0010] Figure 2 is a schematic diagram of a memory controller according to an embodiment of the present invention;

[0011] Figure 3 is a schematic diagram of a management memory module according to an embodiment of the present invention;

[0012] Figure 4 is a schematic diagram of generating password information according to an embodiment of the present invention;

[0013] Figure 5 is a schematic diagram showing how to synchronously store encrypted data and unencrypted data in a second entity unit according to an embodiment of the present invention;

[0014] Figure 6 is a flowchart of a memory management method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0015] Reference will now be made in detail to exemplary embodiments of the present invention, examples of which are illustrated in the accompanying drawings. Whenever possible, the same reference numerals are used in the drawings and the description to refer to the same or like parts.

[0016] Figure 1 is a schematic diagram of a data storage system according to an embodiment of the present invention. Figure 1 , the data storage system 10 includes a host system 11 and a storage device 12. The storage device 12 can be connected to the host system 11 and can be used to store data from the host system 11. For example, the host system 11 can be a smart phone, a tablet computer, a notebook computer, a desktop computer, an industrial computer, a game console, a server, or a computer system disposed in a specific carrier (such as a vehicle, an aircraft, or a ship), and the type of the host system 11 is not limited thereto. In addition, the storage device 12 may include a solid state drive, a USB flash drive, a memory card, or other types of non-volatile storage devices.

[0017] The storage device 12 includes a connection interface 121, a memory module 122, and a memory controller 123. The connection interface 121 is used to connect the storage device 12 to the host system 11. For example, the connection interface 121 can support an embedded Multi-Media Card (embedded Multi-Media Card, eMMC), a universal flash storage (Universal Flash Storage, UFS), a fast peripheral component interconnect (Peripheral Component Interconnect Express, PCIExpress), a fast non-volatile memory (Non-Volatile Memory Express, NVM express), a serial advanced technology attachment (Serial Advanced Technology Attachment, SATA), a universal serial bus (Universal Serial Bus, USB) or other types of connection interface standards. Therefore, the storage device 12 can communicate with the host system 11 via the connection interface 121 (for example, exchange signals, instructions and / or data).

[0018] The memory module 122 is used to store data. For example, the memory module 122 may include one or more rewritable non-volatile memory modules. Each rewritable non-volatile memory module may include one or more memory cell arrays. The memory cells in the memory cell array store data in the form of voltage (also called threshold voltage). For example, the memory module 122 may include a single level cell (SLC) NAND type flash memory module, a multi level cell (MLC) NAND type flash memory module, a triple level cell (TLC) NAND type flash memory module, a quad level cell (QLC) NAND type flash memory module and / or other memory modules having the same or similar characteristics.

[0019] The memory controller 123 is connected to the connection interface 121 and the memory module 122. The memory controller 123 can be regarded as the control core of the storage device 12 and is used to control the storage device 12. For example, the memory controller 123 can be used to control or manage the entire or partial operation of the storage device 12. For example, the memory controller 123 may include a central processing unit (CPU), or other programmable general-purpose or special-purpose microprocessors, digital signal processors (DSP), programmable controllers, application-specific integrated circuits (ASIC), programmable logic devices (PLD) or other similar devices or combinations of these devices. In one embodiment, the memory controller 123 may include a flash memory controller.

[0020] The memory controller 123 may send a command sequence to the memory module 122 to access the memory module 122. For example, the memory controller 123 may send a write command sequence to the memory module 122 to instruct the memory module 122 to store data in a specific storage unit. For example, the memory controller 123 may send a read command sequence to the memory module 122 to instruct the memory module 122 to read data from a specific storage unit. For example, the memory controller 123 may send an erase command sequence to the memory module 122 to instruct the memory module 122 to erase the data stored in a specific storage unit. In addition, the memory controller 123 may also send other types of command sequences to the memory module 122 to instruct the memory module 122 to perform other types of operations, which are not limited by the present invention. The memory module 122 may receive the command sequence from the memory controller 123 and access the storage unit inside the memory module 122 according to the command sequence.

[0021] Figure 2 FIG. 1 is a schematic diagram of a memory controller according to an embodiment of the present invention. Figure 1 and Figure 2 The memory controller 123 includes a host interface 21, a memory interface 22 and a memory control circuit 23. The host interface 21 is used to connect to the host system 11 through the connection interface 121 to communicate with the host system 11. The memory interface 22 is used to connect to the memory module 122 to access the memory module 122.

[0022] The memory control circuit 23 is connected to the host interface 21 and the memory interface 22. The memory control circuit 23 may be used to control or manage the whole or part of the operation of the memory controller 123. For example, the memory control circuit 23 may communicate with the host system 11 through the host interface 21 and access the memory module 122 through the memory interface 22. For example, the memory control circuit 23 may include a control circuit such as an embedded controller or a microcontroller. In the following embodiments, the description of the memory control circuit 23 is equivalent to the description of the memory controller 123.

[0023] In one embodiment, the memory controller 123 may further include a buffer memory 24. The buffer memory 24 is connected to the memory control circuit 23 and used to cache data. For example, the buffer memory 24 may be used to cache instructions from the host system 11, data from the host system 11, and / or data from the memory module 122.

[0024] In one embodiment, the memory controller 123 may further include a decoding circuit (also called an error correction circuit) 25. The decoding circuit 25 is connected to the memory control circuit 23 and is used to perform encoding and decoding on the data to ensure the correctness of the data. For example, the decoding circuit 25 may support various encoding / decoding algorithms such as Low Density Parity Check Code (LDPC code), BCH code, Reed-Solomon code (RS code), Exclusive OR (XOR) code, etc.

[0025] In one embodiment, the memory controller 123 may further include an encryption circuit 26. The encryption circuit 26 is connected to the memory control circuit 23 and is used to perform encryption and decryption on data to ensure the confidentiality of the data. For example, after a certain data (also referred to as original data) is encrypted by the encryption circuit 26, a ciphertext (also referred to as encrypted data) corresponding to the original data may be formed. After the ciphertext (i.e., encrypted data) is decrypted by the encryption circuit 26, a plaintext (i.e., original data) corresponding to the ciphertext may be restored.

[0026] In one embodiment, the encryption circuit 26 may support a symmetric encryption algorithm, an asymmetric encryption algorithm, or other types of encryption / decryption algorithms. For example, the symmetric encryption algorithm may include AES (Advanced Encryption Standard)-256, etc., and the asymmetric encryption algorithm may include RSA (Rivest-Shamir-Adleman), etc., and the present invention is not limited thereto. In one embodiment, the memory controller 123 may also include other types of various circuit modules (such as a power management circuit, etc.), and the present invention is not limited thereto.

[0027] Figure 3 FIG. 1 is a schematic diagram of a management memory module according to an embodiment of the present invention. Figures 1 to 3 The memory module 122 includes a plurality of physical units 301 ( 1 ) to 301 (B). Each physical unit includes a plurality of storage cells and is used for non-volatile storage of data.

[0028] In one embodiment, a physical unit may include one or more physical programming units. In one embodiment, a physical programming unit may include multiple physical sectors. For example, the data capacity of a physical sector may be 512 bytes (Bytes, B), and a physical programming unit may include 32 physical sectors. However, the data capacity of a physical sector and / or the total number of physical sectors included in a physical programming unit can be adjusted according to practical needs, and the present invention is not limited thereto. In one embodiment, a physical programming unit can be regarded as a physical page. For example, the storage capacity of a physical programming unit may be 16 kilobytes, and the present invention is not limited thereto.

[0029] In one embodiment, a physical programming unit is a minimum unit for synchronously writing data in the memory module 122. For example, when a programming operation (also referred to as a write operation) is performed on a physical programming unit to write data to the physical programming unit, multiple memory cells in the physical programming unit may be synchronously programmed to store corresponding data. For example, when programming a physical programming unit, a write voltage may be applied to the physical programming unit to change the threshold voltage of at least some of the memory cells in the physical programming unit. For example, the threshold voltage of a memory cell may reflect the bit data stored in the memory cell.

[0030] In one embodiment, a physical erase unit may include a plurality of physical programming units. The plurality of physical programming units in a physical erase unit may be erased synchronously. For example, when performing an erase operation on a physical erase unit, an erase voltage may be applied to the plurality of physical programming units in the physical erase unit to change the threshold voltage of at least some of the storage cells in the physical programming units. By performing an erase operation on a physical erase unit, the data stored in the physical erase unit may be cleared.

[0031] In one embodiment, the memory control circuit 23 can logically associate the physical units 301(1)-301(A) and 301(A+1)-301(B) to the data area 31 and the idle area 32, respectively. The physical units 301(1)-301(A) in the data area 31 all store data (also called user data) from the host system 11. For example, any physical unit in the data area 31 can store valid data and / or invalid data. In addition, the physical units 301(A+1)-301(B) in the idle area 32 do not store data (e.g., valid data).

[0032] In one embodiment, if a physical unit does not store valid data, the physical unit can be associated with the idle area 32. In addition, the physical unit in the idle area 32 can be erased to clear the data in the physical unit. In one embodiment, the physical unit in the idle area 32 is also called an idle physical unit. In one embodiment, the idle area 32 is also called an idle pool.

[0033] In one embodiment, when data is to be stored, the memory control circuit 23 may select one or more physical cells from the idle area 32 and instruct the memory module 122 to store the data in the selected physical cells. After the data is stored in the physical cell, the physical cell may be associated with the data area 31. In other words, one or more physical cells may be used alternately between the data area 31 and the idle area 32.

[0034] In one embodiment, the memory control circuit 23 may configure a plurality of logical units 302(1)-302(C) to map the physical units (i.e., the physical units 301(1)-301(A)) in the data area 31. For example, a logical unit may correspond to a logical block address (LBA) or other logical management units. A logical unit may be mapped to one or more physical units.

[0035] In one embodiment, if a physical unit is currently mapped by any logical unit, the memory control circuit 23 can determine that the data currently stored in the physical unit includes valid data. Conversely, if a physical unit is not currently mapped by any logical unit, the memory control circuit 23 can determine that the physical unit does not currently store any valid data.

[0036] In one embodiment, the memory control circuit 23 may record the mapping relationship between the logical unit and the physical unit in at least one management table (also referred to as a logical-to-physical mapping table). In one embodiment, the memory control circuit 23 may instruct the memory module 122 to perform operations such as data reading, writing or erasing according to the information in the management table (i.e., the logical-to-physical mapping table).

[0037] In one embodiment, the memory control circuit 23 may predetermine a plurality of physical units (also referred to as candidate physical units) in the memory module 122. For example, the plurality of candidate physical units may be dispersed in different memory regions in the memory module 122. For example, the different memory regions may include at least one of different chips, different chip enable (CE) regions, and different planes in the memory module 122. In one embodiment, the different memory regions may also include different physical blocks (i.e., different physical erase units) and / or different physical pages (i.e., physical programming units) in the memory module 122.

[0038] In one embodiment, the memory control circuit 23 may detect system events. The system events may include a power-on event of the storage device 12. Alternatively, in one embodiment, the system events may also include a power-on event and / or other types of custom events. For example, the custom event may include that the usage status of the storage device 12 or the memory module 122 meets a specific condition (e.g., the read count, write count, and / or erase count of the memory module 122 reaches a critical value), etc., which is not limited by the present invention.

[0039] In one embodiment, when the system event is detected, in response to the system event, the memory controller 23 may select at least one of the plurality of candidate physical units as a specific physical unit (also referred to as a first physical unit). For example, the first physical unit may include Figure 3 At least one of the entity units 301(1)~301(B).

[0040] In one embodiment, in response to the system event, the memory controller 23 may select one of the candidate physical units as the first physical unit according to a rotation or other type of customized method. For example, the customized method may include selecting at least one physical unit from the candidate physical units located in different memory areas as the first physical unit each time, and the present invention is not limited thereto.

[0041] In one embodiment, after determining the first physical unit, the memory controller 23 may send a read instruction sequence to the memory module 11. The read instruction sequence may be used to instruct the memory module 122 to read the first physical unit. According to the read result of the memory module 122, the memory control circuit 23 may obtain read data corresponding to the read instruction sequence from the memory module 122. For example, assuming that the first physical unit is Figure 3 If the physical unit 301 (i) is read by the memory module 122, the read data may reflect the reading result of the physical unit 301 (i) by the memory module 122.

[0042] In one embodiment, after obtaining the read data, the memory control circuit 23 may perform error detection on the read data. The error detection is used to obtain error rate information of the read data. The error rate information may reflect the bit error rate (BER) of the read data. For example, the error rate information (i.e., bit error rate) may reflect the number of error bits in a preset number of the read data.

[0043] It should be noted that the error detection may be performed by the memory control circuit 23 or by the memory control circuit 23 in conjunction with the decoding circuit 25. However, in one embodiment, the error detection does not include error correction of the read data by the decoding circuit 25. For example, the error correction is used to correct errors (i.e., error bits) in the read data.

[0044] That is, in one embodiment, the memory control circuit 23 may only perform error detection on the read data to obtain the error rate information without performing the error correction on the read data, thereby saving power consumption of the storage device 12 .

[0045] In one embodiment, in response to the system event, the memory controller 23 may also turn off the error correction circuit (i.e., the decoding circuit 25). During the period when the error correction circuit (i.e., the decoding circuit 25) is in the off state, the memory controller 23 may perform a self-check operation to obtain the error rate information. For example, this self-check operation may be automatically started and performed in response to the system event to obtain the error rate information. For example, this self-check operation may include the above-mentioned determination of the first physical unit from a plurality of candidate physical units, reading the first physical unit to obtain the read data, and obtaining the error rate information corresponding to the read data, etc. In one embodiment, if the system event is not detected, the memory controller 23 may not perform the self-check operation to save system resources.

[0046] In one embodiment, according to the execution result of the self-test operation, the memory controller 23 may also transmit the error rate information to the host system 11 for use by the host system 11. For example, the host system 11 may encrypt data or perform other custom operations based on the error rate information. The following is a description of how to encrypt data based on the error rate information.

[0047] In one embodiment, after obtaining the error rate information, the memory control circuit 23 may generate cryptographic information based on the error rate information. Taking the AES-256 encryption algorithm as an example, the cryptographic information may include private-key information and initialization sequence information. The private-key information may carry information about the key used to perform encryption in the AES-256 encryption algorithm. The initialization sequence information may carry information about the initialization sequence (also called initialization vector) used to perform encryption in the AES-256 encryption algorithm. It should be noted that the information content of the cryptographic information may vary depending on different encryption algorithms, and the present invention is not limited thereto.

[0048] In one embodiment, after obtaining the password information, the encryption circuit 26 may encrypt the data (i.e., the original data) according to the password information to generate encrypted data corresponding to the original data. Taking the AES-256 encryption algorithm as an example, the encryption circuit 26 may encrypt the original data based on the AES-256 encryption algorithm according to the password information to generate the encrypted data. It should be noted that the encryption circuit 26 may also use other encryption algorithms to encrypt the original data, and the present invention is not limited thereto.

[0049] In one embodiment, after obtaining the encrypted data, the memory control circuit 23 may send a write instruction sequence to the memory module 122. The write instruction sequence may be used to instruct the memory module 122 to store the encrypted data in at least one physical unit (also referred to as the second physical unit). For example, assuming that the first physical unit is Figure 3The second entity unit can be Figure 3 , and i is different from j. Alternatively, in one embodiment, i may be equal to j.

[0050] It should be noted that in the aforementioned embodiment, the correctness of each data read from the first physical unit (or the bit error rate) will be affected by the current operating state of the memory module 122. For example, the operating state includes the read voltage applied to the first physical unit, the length of time for applying the read voltage, the critical voltage distribution of multiple storage units in the first physical unit, the ambient temperature and / or the clock frequency, etc., and the type of the operating state is not limited thereto. Therefore, at different time points, based on the current operating state of the memory module 122, the reading result for the first physical unit may be different. As a result, compared with a conventional pseudo-random number generator (PRNG) and / or a true random number generator (TRNG), the bit error rate of the read result can be closer to a true random number (i.e., it cannot be accurately predicted).

[0051] In addition, by distributing the plurality of candidate physical units in different memory regions (e.g., different chips, different chip enable (CE) regions, different planes, different physical blocks, and / or different physical pages) in the memory module 122, it is possible to avoid the randomness of the cryptographic information generated subsequently being reduced due to excessive data reading of a single or a small number of regions in the memory module 122. In other words, by distributing the plurality of candidate physical units in different memory regions (e.g., different chips, different chip enable (CE) regions, different planes, different physical blocks, and / or different physical pages) in the memory module 122, the randomness of the cryptographic information generated each time by reading the first physical unit can be further improved.

[0052] In one embodiment, the password information is obtained according to the bit error rate of the read data and the original data is encrypted based on the password information, which can improve the defects of the pseudo-random number generator (PRNG) and / or the true random number generator (TRNG), such as the random numbers generated are not random enough or even have regularity, thereby improving the subsequent data encryption efficiency and increasing the difficulty of cracking the encrypted data. As a result, the data storage security of the storage device 12 can be effectively improved.

[0053] In one embodiment, after obtaining the error rate information, the memory control circuit 23 may perform information processing on the error rate information to obtain reference information. For example, the memory control circuit 23 may perform logarithmic transformation processing on the error rate information to obtain the reference information. For example, the logarithmic transformation processing may include taking the natural logarithm and / or other logical operations on the error rate information.

[0054] In one embodiment, the reference information may conform to a preset data format, and the preset data format matches the encryption algorithm used to generate the password information. For example, assuming that the encryption algorithm is AES-256, the preset data format may match the AES-256 encryption algorithm. For example, the preset data format may be used to standardize the data length of the reference information to a preset length to meet the subsequent operation requirements for the AES-256 encryption algorithm. Then, the memory control circuit 23 may generate the password information based on the reference information.

[0055] In one embodiment, in the information processing, the memory control circuit 23 may first perform the logarithmic transformation process on the error rate information to obtain temporary information (also referred to as first temporary information). Then, the memory control circuit 23 may perform at least one of taking an absolute value, extracting at least part of the value after the decimal point, removing at least part of the value after the decimal point, value unit conversion, polynomial operation, hash operation, key derivation function and other custom processing on the first temporary information to obtain the reference information. The following is an example of using a hash operation to obtain the reference information, but the present invention is not limited to this. For example, the hash operation may use SHA-256 or SHA-3, etc., and the present invention is not limited to this.

[0056] In one embodiment, in the information processing, after obtaining the first temporary information, the memory control circuit 23 may perform a numerical conversion on the first temporary information to obtain another temporary information (also referred to as the second temporary information). For example, the second temporary information may be in the form of a string. After obtaining the second temporary information, the memory control circuit 23 may perform an encoding process on the second temporary information to obtain another temporary information (also referred to as the third temporary information). For example, the third temporary information may be of a byte type. After obtaining the third temporary information, the memory control circuit 23 may perform the hash operation on the third temporary information to obtain another temporary information (also referred to as the fourth temporary information). For example, the fourth temporary information may include a string consisting of hexadecimal characters. After obtaining the fourth temporary information, the memory control circuit 23 may perform information extraction or information filling on the fourth temporary information to obtain the reference information.

[0057] In one embodiment, if the data length of the string generated by the hash operation in the fourth temporary information is longer than the data length specified by the reference information, the memory control circuit 23 may extract the first N bytes (or the last N bytes, etc., which are not limited by the present invention) from the string generated by the hash operation through the information extraction operation to obtain the reference information. Taking the AES-256 encryption algorithm as an example, N here may be 32 (i.e., 256 bits or 64 hexadecimal characters). If other encryption algorithms are used, N may also be other values. Alternatively, in one embodiment, if the data length of the string generated by the hash operation in the fourth temporary information is shorter than the data length specified by the reference information, the memory control circuit 23 may add (i.e., fill) preset data to the string generated by the hash operation through the information filling operation to obtain the reference information.

[0058] In other words, even if one or more temporary data generated during information processing do not conform to the preset data format, the reference information conforming to the preset data format can still be obtained through the information extraction or information filling. Thereafter, the memory control circuit 23 can generate the password information according to the reference information.

[0059] Figure 4 is a schematic diagram of generating password information according to an embodiment of the present invention. Figure 4 , the memory control circuit 23 may obtain error rate information 41. For example, the error rate information 41 may reflect the bit error rate of the read data read from the first physical unit. For example, the error rate information 41 may include a numerical value or a data sequence to reflect the bit error rate of the read data. After obtaining the error rate information 41, the memory control circuit 23 may perform information processing 401 on the error rate information 41 to obtain reference information 42. For example, the information processing 401 includes taking a logarithm (for example, taking a natural logarithm), taking an absolute value, extracting at least part of the numerical value after the decimal point, removing at least part of the numerical value after the decimal point, numerical unit conversion, polynomial operation, hash operation and / or other custom processing. The specific operation details of the information processing 401 may be set according to the encryption algorithm adopted, and the present invention is not limited thereto. According to the result of the information processing 401, the memory control circuit 23 may obtain the reference information 42. Similar to the error rate information 41, the reference information 42 may approach a true random number (i.e., it cannot be accurately predicted).

[0060] In one embodiment, after obtaining the reference information 42, the memory control circuit 23 may generate the password information 43 according to the reference information 42. For example, taking the AES-256 encryption algorithm as an example, the password information 43 may include key information 431 and initialization sequence information 432.

[0061] In one embodiment, the memory control circuit 23 may perform a data conversion (also referred to as a first data conversion) 411 on the reference information 42 to obtain key information 431. For example, the key information 431 may carry information about a key used to perform encryption in the encryption algorithm used by the encryption circuit 26. In addition, the memory control circuit 23 may perform another data conversion (also referred to as a second data conversion) 412 on the reference information 42 to obtain initialization sequence information 432. For example, the initialization sequence information 432 may carry information about an initialization sequence (or initialization vector) used to perform encryption in the encryption algorithm used by the encryption circuit 26.

[0062] In one embodiment, the data format (e.g., data length) of the key information 431 may be different from the data format (e.g., data length) of the initialization sequence information 432. For example, taking the AES-256 encryption algorithm as an example, the data lengths of the key information 431 and the initialization sequence information 432 used in the AES-256 encryption algorithm may be "256" bits and "128" bits, respectively. However, the data formats of the key information 431 and / or the initialization sequence information 432 may be adjusted according to practical needs, and the present invention is not limited thereto.

[0063] It should be noted that in Figure 4 In the embodiment of the present invention, the information processing 401, the first data conversion 411 and the second data conversion 412 can be set or configured according to the encryption algorithm used by the encryption circuit 26. Therefore, the information processing 401, the first data conversion 411 and the second data conversion 412 can be used to generate the reference information 42, the key information 431 and the initialization sequence information 432 that match the encryption algorithm used by the encryption circuit 26.

[0064] In one embodiment, after obtaining the reference information, the memory control circuit 23 may also generate and enhance the security of the cryptographic information (e.g., key information) generated according to the reference information by adding a salt value, using more entropy sources, or using a more effective key derivation function (KDF). For example, the key derivation function may include at least one of PBKDF2 (Password-Based Key Derivation Function 2), bcrypt, and scrypt. PBKDF2 is a widely used key derivation function, which is an iterative version based on HMAC (Hash Message Authentication Code). Its main feature is that it allows the use of a salt value (salt) to increase the randomness of the derived key, and the calculation complexity can be increased by adjusting the number of iterations, thereby improving security.

[0065] In one embodiment, the memory control circuit 23 can also convert the cryptographic information originally generated by block encryption into cryptographic information in the form of a stream cipher through a counter (CTR) mode. For example, in the counter mode, the encryption circuit 26 encrypts a series of input data blocks (referred to as counts) and generates a series of output data. Then, by performing an exclusive OR (XOR) operation on each output data and the corresponding plaintext (i.e., the original data), the encrypted data can be obtained. In this way, the data reading and writing speed of the storage device 12 and the security of data storage can be improved. Alternatively, in one embodiment, the memory control circuit 23 can also generate the encrypted data through an XTS (XOR-based Twin encryption) mode. In addition, many other types of encryption technologies can be applied to the embodiments of the present invention, which will not be described one by one here.

[0066] In one embodiment, before storing the encrypted data in the second physical unit, the memory control circuit 23 may encode the encrypted data with an error correction code (ECC) to generate error correction data. The error correction data may be used to correct errors (i.e., error bits) in the encrypted data. For example, the error correction data may carry error correction information (e.g., an error correction code) corresponding to the encrypted data.

[0067] In one embodiment, after obtaining the encrypted data and the error correction data, the memory control circuit 23 may store the encrypted data in a data area of ​​the second physical unit. In addition, the memory control circuit 23 may store the password information and the error correction data in a spare area of ​​the second physical unit.

[0068] In one embodiment, the memory controller 23 may read the encrypted data from the data area in the second physical unit. In addition, the memory controller 23 may read the error correction data and the password information from the idle area in the second physical unit. Then, the memory controller 123 may restore the encrypted data to the original data according to the error correction data and the password information. For example, the decoding circuit 25 may decode the encrypted data read from the data area according to the error correction data to try to correct the errors in the read encrypted data. Then, the encryption circuit 26 may decrypt the corrected encrypted data according to the password information to restore the original data.

[0069] In one embodiment, after obtaining the encrypted data, the memory controller 23 may also store the encrypted data and the unencrypted data synchronously in the same physical unit (i.e., the second physical unit). For example, the unencrypted data is obtained from at least one physical unit (also referred to as the third physical unit) in the memory module 122 through a data consolidation operation, and the unencrypted data has not been encrypted by the encryption circuit 26. For example, the data consolidation operation may include a garbage collection (GC) operation. The third physical unit may include at least one physical unit that is determined as a source unit of valid data in the data consolidation operation. For example, the third physical unit may include Figure 3 At least one of the entity units 301(1)~301(A).

[0070] Figure 5 is a schematic diagram showing how to synchronously store encrypted data and unencrypted data in a second entity unit according to an embodiment of the present invention. Figure 5 , according to the password information (for example Figure 4 After obtaining the encrypted data 51 using the password information 43, the memory controller 23 may synchronously store the encrypted data 51 and the unencrypted data 52 into the same physical unit 501 (ie, the second physical unit).

[0071] In one embodiment, the memory controller 23 may collect (i.e., read) valid data from the third physical unit through a data consolidation operation. Then, the memory controller 23 may use the valid data collected (i.e., read) from the third physical unit and not encrypted by the encryption circuit 26 as the unencrypted data (e.g., unencrypted data 52).

[0072] In one embodiment, after obtaining the encrypted data, the memory controller 23 may determine whether the total data length of at least one encrypted data obtained satisfies (e.g., is the same as) the data storage capacity of one physical unit (e.g., the second physical unit). If the total data length of the encrypted data is less than the data storage capacity of one physical unit (e.g., the second physical unit), the memory controller 23 may store the encrypted data and the unencrypted data synchronously in the second physical unit. For example, the total data length of the encrypted data and the unencrypted data synchronously stored in the second physical unit may satisfy (e.g., be the same as) the data storage capacity of one physical unit (e.g., the second physical unit). However, if the total data length of the encrypted data is not less than (e.g., greater than) the data storage capacity of one physical unit (e.g., the second physical unit), the memory controller 23 may store the encrypted data in the second physical unit alone without additionally storing the unencrypted data in the second physical unit.

[0073] In one embodiment, if the encrypted data and the unencrypted data are synchronously stored in the same physical unit (i.e., the second physical unit), when the data is subsequently read from the second physical unit, part of the data read (i.e., the encrypted data) needs to be decrypted to restore the original data, while the other part of the data read (i.e., the unencrypted data) does not need to be decrypted. Thus, the utilization efficiency of a single physical unit can be improved, and part of the storage space of the physical unit can be avoided from being wasted due to insufficient amount of encrypted data to be stored.

[0074] Figure 6 is a flow chart of a memory management method according to an embodiment of the present invention. Figure 6 In step S601, a plurality of candidate entity units are determined from a plurality of entity units of a memory module, wherein the plurality of candidate entity units are dispersed in different memory areas of the memory module. In step S602, a system event is detected, wherein the system event includes a power-on event of a storage device. In step S603, in response to the system event, at least one of the plurality of candidate entity units is selected as a first entity unit, and a read instruction sequence is sent to the memory module to instruct the memory module to read the first entity unit. In step S604, read data corresponding to the read instruction sequence is obtained from the memory module. In step S605, error detection is performed on the read data to obtain error rate information of the read data, wherein the error rate information reflects a bit error rate of the read data. In step S606, password information is generated according to the error rate information. In step S607, original data is encrypted according to the password information to generate encrypted data corresponding to the original data. In step S608 , a write instruction sequence is sent to the memory module to instruct the memory module to store the encrypted data into a second physical unit among the plurality of physical units.

[0075] However, Figure 6 The steps in the above are described in detail, so I will not repeat them here. It is worth noting that Figure 6 Each step in the above process can be implemented as multiple program codes or circuits, and the present invention is not limited thereto. Figure 6 The method can be used in conjunction with the above exemplary embodiments or can be used alone, and the present invention is not limited thereto.

[0076] In summary, the memory management method and storage device proposed in the embodiment of the present invention can generate password information for encryption based on error rate information, such as reflecting slight changes in the current operating state of the memory module in the password information based on the error rate information to improve the randomness of the password information. In addition, by effectively dispersing and / or alternating the use of physical units in different memory areas to obtain corresponding error rate information, the randomness of the password information can be effectively improved. As a result, the problem that the random numbers traditionally used to encrypt data are not random enough can be effectively improved, thereby improving the data encryption efficiency and data storage security of the storage device.

[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A memory management method, characterized in that: For use in a storage device, wherein the storage device comprises a memory module, the memory module comprises a plurality of entity units, and the memory management method comprises: Determine a plurality of candidate entity units from the plurality of entity units, wherein the plurality of candidate entity units are dispersed in different memory areas in the memory module; detecting a system event, wherein the system event comprises a power-on event of the storage device; In response to the system event, selecting at least one of the plurality of candidate physical units as a first physical unit, and sending a read instruction sequence to the memory module to instruct the memory module to read the first physical unit; Obtain read data corresponding to the read instruction sequence from the memory module; performing error detection on the read data to obtain error rate information of the read data, wherein the error rate information reflects a bit error rate of the read data; Generate password information according to the error rate information; Encrypting the original data according to the password information to generate encrypted data corresponding to the original data; and A write command sequence is sent to the memory module to instruct the memory module to store the encrypted data in a second physical unit among the plurality of physical units. 2 . The memory management method according to claim 1 , wherein the error detection does not include error correction of the read data.

3. The memory management method according to claim 2, further comprising: In response to the system event, shutting down the error correction circuit; as well as During the period when the error correction circuit is in the off state, a self-check operation is performed to obtain the error rate information.

4. The memory management method according to claim 3, further comprising: According to the execution result of the self-check operation, the error rate information is transmitted to a host system connected to the storage device for use by the host system.

5. The memory management method according to claim 1, wherein the step of generating the password information according to the error rate information comprises: Performing logarithmic transformation on the error rate information to obtain reference information, wherein the reference information conforms to a preset data format, and the preset data format matches an encryption algorithm used to generate the password information; as well as The password information is generated according to the reference information.

6. The memory management method according to claim 5, wherein the step of performing the logarithmic transformation process on the error rate information to obtain the reference information comprises: Performing the logarithmic transformation process on the error rate information to obtain first temporary information; as well as Perform at least one of taking the absolute value, extracting at least part of the value after the decimal point, removing at least part of the value after the decimal point, numerical unit conversion, polynomial operation, hash operation, key derivation function and other custom processing on the first temporary information to obtain the reference information.

7. The memory management method according to claim 6, wherein the step of performing at least one of taking the absolute value, extracting at least part of the value after the decimal point, removing at least part of the value after the decimal point, the value unit conversion, the polynomial operation, the hash operation, the key derivation function and the other custom processing on the temporary information to obtain the reference information comprises: Performing numerical conversion on the first temporary information to obtain second temporary information; performing encoding processing on the second temporary information to obtain third temporary information; Performing the hash operation on the third temporary information to obtain fourth temporary information; as well as Information extraction or information filling is performed according to the fourth temporary information to obtain the reference information.

8. The memory management method according to claim 1, wherein in response to the system event, the step of selecting the at least one of the plurality of candidate entity units as the first entity unit comprises: In response to the system event, at least one of the candidate entity units is selected as the first entity unit in a rotation or customized manner from among the plurality of candidate entity units. 9 . The memory management method according to claim 1 , wherein the different memory regions include at least one of different dies, different chip enable regions, and different planes in the memory module.

10. The memory management method according to claim 1, wherein the step of sending the write instruction sequence to the memory module to instruct the memory module to store the encrypted data in the second physical unit among the plurality of physical units comprises: Synchronously storing the encrypted data and the unencrypted data in the second entity unit, The unencrypted data is obtained from a third entity unit among the plurality of entity units through a data consolidation operation, and the unencrypted data is not encrypted.

11. A storage device, characterized in that: include: A connection interface for connecting to a host system; Memory module; as well as a memory controller connected to the connection interface and the memory module, The memory module includes a plurality of physical units, and the memory controller is used to: Determine a plurality of candidate entity units from the plurality of entity units, wherein the plurality of candidate entity units are dispersed in different memory areas in the memory module; detecting a system event, wherein the system event comprises a power-on event of the storage device; In response to the system event, selecting at least one of the plurality of candidate physical units as a first physical unit, and sending a read instruction sequence to the memory module to instruct the memory module to read the first physical unit; Obtain read data corresponding to the read instruction sequence from the memory module; performing error detection on the read data to obtain error rate information of the read data, wherein the error rate information reflects a bit error rate of the read data; Generate password information according to the error rate information; Encrypting the original data according to the password information to generate encrypted data corresponding to the original data; as well as A write command sequence is sent to the memory module to instruct the memory module to store the encrypted data in a second physical unit among the plurality of physical units.

12. The memory device of claim 11, wherein the error detection does not include error correction of the read data.

13. The storage device according to claim 12, wherein the memory controller is further configured to: In response to the system event, shutting down the error correction circuit; and During the period when the error correction circuit is in the off state, a self-check operation is performed to obtain the error rate information.

14. The storage device according to claim 13, wherein the memory controller is further configured to: According to the execution result of the self-check operation, the error rate information is transmitted to the host system for use.

15. The storage device according to claim 11, wherein the operation of generating the password information according to the error rate information comprises: Performing logarithmic transformation on the error rate information to obtain reference information, wherein the reference information conforms to a preset data format, and the preset data format matches an encryption algorithm used to generate the password information; as well as The password information is generated according to the reference information.

16. The storage device according to claim 15, wherein the operation of performing the logarithmic transformation process on the error rate information to obtain the reference information comprises: Performing the logarithmic transformation process on the error rate information to obtain first temporary information; as well as Perform at least one of taking the absolute value, extracting at least part of the value after the decimal point, removing at least part of the value after the decimal point, numerical unit conversion, polynomial operation, hash operation, key derivation function and other custom processing on the first temporary information to obtain the reference information.

17. The storage device according to claim 16, wherein the operation of performing at least one of taking the absolute value, extracting at least part of the value after the decimal point, removing at least part of the value after the decimal point, the value unit conversion, the polynomial operation, the hash operation, the key derivation function, and the other custom processing on the temporary information to obtain the reference information comprises: Performing numerical conversion on the first temporary information to obtain second temporary information; performing encoding processing on the second temporary information to obtain third temporary information; Performing the hash operation on the third temporary information to obtain fourth temporary information; as well as Information extraction or information filling is performed according to the fourth temporary information to obtain the reference information.

18. The storage device according to claim 11, wherein in response to the system event, the operation of selecting the at least one of the plurality of candidate entity units as the first entity unit comprises: In response to the system event, at least one of the candidate entity units is selected as the first entity unit in a rotation or customized manner from among the plurality of candidate entity units.

19. The memory device of claim 11, wherein the different memory regions comprise at least one of different dies, different chip enable regions, and different planes in the memory module.

20. The storage device according to claim 11, wherein the operation of sending the write command sequence to the memory module to instruct the memory module to store the encrypted data in the second physical unit among the plurality of physical units comprises: Synchronously storing the encrypted data and the unencrypted data in the second entity unit, The unencrypted data is obtained from a third entity unit among the plurality of entity units through a data consolidation operation, and the unencrypted data is not encrypted.

Images