Encrypted storage protection system for solid state disk

Abstract

The invention belongs to the technical field of solid state disks, and provides a solid state disk encryption storage protection system. The system comprises a data selection module, a buffer area division module and an encryption protection module, the data selection module allows an application program to distinguish write-in data through marks, the solid state disk classifies the data into long-term data or low-level data according to the write-in data, and the buffer area division module divides a DRAM buffer area into a long-term support area and a non-support area. The encryption protection module stores two types of data respectively, manages data access by utilizing a buffer hit table and a list, writes original address information of the persistent data into an out-of-band area of the NAND memory when the encryption protection module is powered off, and recovers the data to an original position according to the information after power supply is recovered; according to the invention, the problem that the data in the DRAM buffer area is easy to lose and cannot be recovered after the solid state disk is powered off in the prior art can be solved.

Description

Technical Field

[0001] The present invention relates to the technical field of solid state hard disks, and in particular to a solid state hard disk encryption storage protection system. Background Art

[0002] In modern computing environments, solid-state storage devices (SSDs) are widely used due to their high-speed read and write capabilities and high durability. These devices are usually equipped with volatile random-access memory (VRAM) to temporarily store data to be written, thereby reducing write operations to non-volatile storage media (NVM), optimizing performance and extending device life. However, VRAM cannot retain data when power is interrupted, resulting in the risk of data loss.

[0003] To address this challenge, some high-end SSD designs integrate auxiliary power solutions, such as supercapacitors, to provide short-term power support after a power outage, ensuring that data in VRAM can be transferred to NVM, thereby protecting data from loss. However, due to the cost and technical limitations of supercapacitors, the power they provide is limited in duration and cannot be expanded indefinitely. Therefore, when faced with a large amount of data to be written, this solution may not be able to safely transfer all data in a short period of time, increasing the potential risk of critical data loss. Summary of the invention

[0004] In view of the above technical problems, the present invention provides a solid state hard disk encryption storage protection system to solve the problem in the prior art that data in the DRAM buffer is easily lost and cannot be recovered after the solid state hard disk is powered off.

[0005] Other features and advantages of the present invention will become apparent from the following detailed description, or may be learned in part by practice of the present invention.

[0006] According to one aspect of the present invention, a solid state hard disk encryption storage protection system is disclosed, the system comprising:

[0007] A data selection module, the data selection module is used to define a selective protection interface of the solid state drive, so that the application writes the written data containing the mark or the unmarked data into the solid state drive, and the solid state drive selectively classifies the written data as long-term data or low-level data according to whether the written data contains the mark;

[0008] A buffer area division module, the buffer area division module is used to divide the DRAM buffer area of ​​the solid state drive into a long-term support area and a non-support area, store the long-term data in the long-term support area, store the low-level data in the non-support area, and based on a buffer hit table and a buffer list, implement a read request and sequential write of the long-term data or the low-level data when the application executes data reading and writing, the long-term support area includes a log area and a write-ahead log area, the log area is used to store metadata of the management file system of the solid state drive, the write-ahead log area is used to store the write-ahead log of RocksDB, and the metadata and the write-ahead log are a type of the long-term data;

[0009] An encryption protection module is provided, wherein the encryption protection module is used to temporarily write the original address information of the long-term data into the out-of-band area of ​​one or more NAND memories that currently have the lowest latency and encrypt the original address information after the solid-state drive is powered off and its built-in capacitor is temporarily powered, and, after the solid-state drive is powered back on, check the out-of-band area of ​​each NAND memory and restore the corresponding long-term data to the original position based on the original address information checked.

[0010] Further, when data is read based on the buffer hit table, it includes:

[0011] The buffer hit table maintains a reference bit for each sector stored in the DRAM buffer, the reference bit being used to indicate whether data of the corresponding sector is currently stored in the long-term support area or the non-support area of ​​the DRAM buffer;

[0012] When the application executes a data read command, the reference bit corresponding to the target sector number provided by the command is found by scanning the buffer hit table. If the reference bit corresponding to the corresponding target sector number is found in the buffer hit table, the position of the corresponding data is located and the read operation is performed directly. If the corresponding target sector number is not found in the buffer hit table, the data is read from the NAND memory and loaded into the long-term support area or the non-support area of ​​the DRAM buffer.

[0013] Furthermore, when data is written based on the buffer list, it includes:

[0014] The buffer list is the index of each unit of the DRAM buffer. When the application executes a write command, the buffer unit of the target area is determined according to the buffer list, and the data is written to the corresponding buffer of the long-term support area or the non-support area. If the buffer space in the long-term support area or the non-support area is insufficient, based on the cache replacement strategy, the data that is least used within a set time is moved out of the long-term support area or the non-support area before the write operation is performed.

[0015] Furthermore, the buffer area division module is also used to: stop the refresh write operation and set the threshold write operation in the long-term support area, the refresh write operation is the operation of periodically writing the data in the long-term support area to the NAND memory, and the threshold write operation is the operation of writing all the data in the long-term support area to the NAND memory when the data in the long-term support area exceeds the threshold.

[0016] Furthermore, the buffer area division module is also used to: create a buffer pool, the buffer pool is composed of multiple buffers in the DRAM buffer, each buffer has a separate metadata structure, when the application executes a write command, allocates a free buffer from the buffer pool, writes the data to be written into the allocated buffer, and inserts the allocated buffer into the buffer list of the long-term support area or the non-support area according to whether the write data contains the mark or the unmarked mark.

[0017] The technical solution of the present invention has the following beneficial effects:

[0018] Based on the set marks and dividing the DRAM buffer area into a long-term support area and a non-support area, the data that needs to be protected can be purposefully written to the long-term support area, so that the solid-state drive can selectively write the original address information of the long-term data in the long-term support area to the NAND memory when the power is restored, which greatly reduces the amount of data recovery, simplifies the data recovery process, and ensures that important data is protected and recovered. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a structural block diagram of a solid state hard disk encryption storage protection system in an embodiment of this specification. DETAILED DESCRIPTION

[0020] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present invention will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present invention. However, those skilled in the art will appreciate that the technical solutions of the present invention may be practiced while omitting one or more of the specific details, or other methods, components, systems, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present invention.

[0021] In addition, the accompanying drawings are only schematic illustrations of the present invention. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor systems and / or microcontroller systems.

[0022] like Figure 1 As shown, the embodiment of this specification provides a solid state hard disk encryption storage protection system, the system includes a data selection module 101, a buffer area division module 102, and an encryption protection module 103, wherein:

[0023] The data selection module 101 is used to define a selective protection interface of the solid state drive so that an application writes marked or unmarked write data into the solid state drive, and the solid state drive selectively classifies the write data as long-term data or low-level data based on whether the write data contains the mark.

[0024] Among them, the solid-state drive used can be a ZNS solid-state drive, that is, a partitioned namespace solid-state drive. The ZNS solid-state drive divides the NAND flash memory into areas of fixed size and opens an interface to the application so that the application can control data placement.

[0025] The purpose of the data selection module 101 is to realize the write command transmission mark, that is, to set a new command interface for the solid-state drive so that the application on the computer or server can use the interface write command to pass the mark, for example, use the command Dword3 (CDW3) that is not used by the existing ZNS solid-state drive to represent the mark. When the solid-state drive receives a write request, it will directly detect CDW3 to determine whether the written data is long-term data. In this way, there is no need to perform a large amount of code modification for memory reading, which simplifies the operation.

[0026] The buffer area division module 102 is used to divide the DRAM buffer area of ​​the solid state drive into a long-term support area and a non-support area, store the long-term data in the long-term support area, store the low-level data in the non-support area, and based on the buffer hit table and the buffer list, implement the read request and sequential writing of the long-term data or the low-level data when the application executes data reading and writing.

[0027] After determining whether the written data is long-term data, the DRAM buffer area needs to be divided to store data with different protection requirements respectively. In this way, during the power-off protection period, the long-term data in the entire long-term support area can be protected in a targeted manner, that is, written to the non-volatile memory. In addition, since the application can determine the data placement location in the solid-state drive, that is, the area associated with each data is determined, it is necessary to manage the buffer by area, and the buffer hit table and buffer list are used here. First, the buffer hit table maintains a reference bit for each sector. When a read command is received from the application, the ZNS solid-state drive first scans the buffer hit table to find the requested sector with the sector number. In addition, the buffer unit associated with each area is maintained in a separate buffer list. The buffer list is a data structure for maintaining the buffer associated with each area. Therefore, based on the buffer hit table and the buffer list, the read request and sequential writing of the long-term data or the low-level data can be realized.

[0028] The encryption protection module 103 is used to temporarily write the original address information of the long-term data into the out-of-band area of ​​one or more NAND memories that currently have the lowest latency and encrypt it after the solid-state drive is powered off and its built-in capacitor is temporarily powered, and, after the solid-state drive is powered back on, check the out-of-band area of ​​each NAND memory and restore the corresponding long-term data to the original position based on the original address information checked.

[0029] After the solid state drive is set, the file management system based on the hard disk can realize automatic write operation after the power is cut off, such as the firmware program of the present system included in the ZNS solid state drive. Due to the limited capacitance, when the hard disk is suddenly powered off, it is necessary to quickly refresh the long-term data in the form of buffered data in the long-term support area to the NAND flash memory. However, in the case of power failure, if the physical address of the long-term data is concentrated in a specific NAND plane, the time required for refreshing will increase, which may cause incomplete data protection. Therefore, in the encryption protection module 103, the long-term data is temporarily written into multiple NAND planes to maximize parallelism, and after the hard disk is powered on again, the long-term data is copied back to the original position.

[0030] In particular, the original address of long-term data is stored in the out-of-band (OOB) area of ​​the NAND memory. Since each physical page of the NAND memory has an out-of-band area, the out-of-band area can be used to store additional information, such as bad block marks and ECC (error correction code), which is generally used mainly for error checking or recovery. Here, since the out-of-band area has sufficient space (usually 1 / 32 of the NAND plane data area) and there is no additional write delay, it is used as the original address for storing long-term data. In the event of a sudden power outage, the long-term data will be refreshed to the NAND chip that currently shows the lowest latency, rather than the original location specified by the computer program, and then the original address is stored in the out-of-band area for data recovery. When the power-off recovery mechanism of the solid-state drive is running, the out-of-band area is checked to determine whether the page is written to the address, and then the long-term data is restored to the original location using the address stored in the out-of-band area, thereby achieving data protection and recovery.

[0031] From the above, we can know that based on the set marks and dividing the DRAM buffer area into a long-term support area and a non-support area, the data that needs to be protected can be purposefully written to the long-term support area, so that the solid-state drive can selectively write the original address information of the long-term data in the long-term support area into the NAND memory when the power is restored, which greatly reduces the amount of data recovery, simplifies the data recovery process, and ensures that important data is protected and recovered.

[0032] In more detail, when the SSD is powered off, its built-in capacitor will be temporarily powered, and at this time, the encryption protection module 103 will temporarily write the original address information of the long-term data into the out-of-band area of ​​one or more NAND memories with the lowest latency, and encrypt it. The original address information of the long-term data is encrypted and stored in the out-of-band (OOB) area of ​​the NAND memory. Since each physical page has an out-of-band area, this area is usually used to store additional information, such as bad block marks and ECC (error correction code). Here, the out-of-band area is used to store the encrypted original address of the long-term data.

[0033] Data recovery: After the SSD is powered on again, the encryption protection module 103 will check the out-of-band area of ​​each NAND memory, and restore the corresponding long-term data to the original location based on the original address information checked. By storing the original address information in the out-of-band area and encrypting it, the security of the long-term data can be ensured even in the event of a sudden power outage, and the data can be correctly restored after the power is restored. The encryption method can be the SM4 block cipher algorithm, that is, a symmetric encryption algorithm, that is, a 128-bit key is generated for the data, and this key will be used in the encryption and decryption process.

[0034] In one embodiment, the long-term support area includes a log area and a write-ahead log area, the log area is used to store metadata of the management file system of the solid-state drive, and the write-ahead log area is used to store the write-ahead log of RocksDB, and the metadata and the write-ahead log are a type of long-term data.

[0035] Among them, the solid-state drive can be a ZNS solid-state drive, and its management file system is ZenFS. ZenFS is a disk file system for partitioned block devices. It is provided as a plug-in for RocksDB. It is a file system that transfers FTL functions to computers and uses ZNS solid-state drives running in user space. ZenFS uses log areas and data areas to manage file systems. The log area stores data related to maintaining the ZenFS file system, such as super blocks, area range mapping tables, and metadata such as range management. RocksDB is a key-value engine based on LSM trees. RocksDB uses a write buffer implemented in the form of a jump list. The write buffer improves performance by buffering I / O entering the storage. All write data is written to the write buffer and stores the pre-write log. The pre-write log is a log information of what modifications will be made to the data. It can restore data in the event of a sudden power outage, that is, restore the unexecuted modifications to the data by replaying these logs to achieve data recovery. Here, the reason for dividing the log area and the write-ahead log area is that the write-ahead log area mainly stores the write-ahead log, which records all changes to the data to be written, and is associated with most of the data that needs to be recovered. The log area is used to store the metadata and other log information of the file system. When the system is restarted or restored, the data in the write-ahead log area can be processed first to ensure the consistency and integrity of the data, while the log area contains other information that needs to be considered in the recovery process. By separating the write-ahead log area and the log area, the interference between them can be reduced, the performance of data access and writing can be improved, and parallel processing can be achieved to improve efficiency.

[0036] In one implementation, data reading management is implemented based on the buffer hit table. Specifically, when data is read based on the buffer hit table, the method includes:

[0037] The buffer hit table maintains a reference bit for each sector stored in the DRAM buffer, the reference bit being used to indicate whether data of the corresponding sector is currently stored in the long-term support area or the non-support area of ​​the DRAM buffer;

[0038] When the application executes a data read command, the reference bit corresponding to the target sector number provided by the command is found by scanning the buffer hit table. If the reference bit corresponding to the corresponding target sector number is found in the buffer hit table, the position of the corresponding data is located and the read operation is performed directly. If the corresponding target sector number is not found in the buffer hit table, the data is read from the NAND memory and loaded into the long-term support area or the non-support area of ​​the DRAM buffer.

[0039] In one embodiment, data storage management is implemented based on the buffer list. Specifically, when data is written based on the buffer list, the process includes:

[0040] The buffer list is the index of each unit of the DRAM buffer. When the application executes a write command, the buffer unit of the target area is determined according to the buffer list, and the data is written to the corresponding buffer of the long-term support area or the non-support area. If the buffer space in the long-term support area or the non-support area is insufficient, based on the cache replacement strategy, the data that is least used within a set time is moved out of the long-term support area or the non-support area before the write operation is performed.

[0041] In one embodiment, the buffer area division module is also used to: stop the refresh write operation and set the threshold write operation in the long-term support area, the refresh write operation is the operation of periodically writing the data in the long-term support area to the NAND memory, and the threshold write operation is the operation of writing all the data in the long-term support area to the NAND memory when the data in the long-term support area exceeds the threshold.

[0042] Among them, since the system of the present invention can ensure that important data is obtained, the refresh write operation in the long-term support area can be stopped, that is, the number of automatic writes to the NAND memory is reduced, which can significantly improve the I / O performance and the service life of the NAND memory. Only when there is a power outage or there is insufficient space in the long-term support area, the data in the long-term support area will be automatically written to the NAND memory.

[0043] In one embodiment, the buffer area division module is also used to: create a buffer pool, the buffer pool is composed of multiple buffers in the DRAM buffer, each buffer has a separate metadata structure, when the application executes a write command, allocates a free buffer from the buffer pool, writes the data to be written into the allocated buffer, and inserts the allocated buffer into the buffer list of the long-term support area or the non-support area according to whether the write data contains the mark or the unmarked mark.

[0044] Among them, the buffer pool in this embodiment is the concretization of the write buffer of RocksDB described above. The difference is that this embodiment introduces marking and long-term support areas, allowing the system to distinguish which data requires power failure protection, which ensures that critical data (such as write-ahead logs) will not be lost in the event of a power failure, thereby improving data persistence and consistency. In addition, by maintaining the buffer list of the long-term support area and the non-support area, the system can more accurately control the data write path and recovery strategy, thereby optimizing data flow and storage management.

[0045] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal system, or a network device, etc.) to deploy a system according to the exemplary implementation of the present invention.

[0046] It should be noted that although several modules are mentioned in the above detailed description, this division is not mandatory. In fact, according to an exemplary embodiment of the present invention, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules to be concretized.

[0047] Those skilled in the art will readily appreciate other embodiments of the invention after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art that are not disclosed in the present invention. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the claims.

Claims

1. A solid state hard disk encryption storage protection system, characterized in that: The system comprises: A data selection module, the data selection module is used to define a selective protection interface of the solid state drive, so that the application writes the written data containing the mark or the unmarked data into the solid state drive, and the solid state drive selectively classifies the written data as long-term data or low-level data according to whether the written data contains the mark; A buffer area division module, the buffer area division module is used to divide the DRAM buffer area of ​​the solid state drive into a long-term support area and a non-support area, store the long-term data in the long-term support area, store the low-level data in the non-support area, and based on a buffer hit table and a buffer list, implement a read request and sequential write of the long-term data or the low-level data when the application executes data reading and writing, the long-term support area includes a log area and a write-ahead log area, the log area is used to store metadata of the management file system of the solid state drive, the write-ahead log area is used to store the write-ahead log of RocksDB, and the metadata and the write-ahead log are a type of the long-term data; An encryption protection module is provided, wherein the encryption protection module is used to temporarily write the original address information of the long-term data into the out-of-band area of ​​one or more NAND memories that currently have the lowest latency and encrypt the original address information after the solid-state drive is powered off and its built-in capacitor is temporarily powered, and, after the solid-state drive is powered back on, check the out-of-band area of ​​each NAND memory and restore the corresponding long-term data to the original position based on the original address information checked.

2. A solid state hard disk encryption storage protection system according to claim 1, characterized in that: When data is read based on the buffer hit table, it includes: The buffer hit table maintains a reference bit for each sector stored in the DRAM buffer, the reference bit being used to indicate whether data of the corresponding sector is currently stored in the long-term support area or the non-support area of ​​the DRAM buffer; When the application executes a data read command, the reference bit corresponding to the target sector number provided by the command is found by scanning the buffer hit table. If the reference bit corresponding to the corresponding target sector number is found in the buffer hit table, the position of the corresponding data is located and the read operation is performed directly. If the corresponding target sector number is not found in the buffer hit table, the data is read from the NAND memory and loaded into the long-term support area or the non-support area of ​​the DRAM buffer.

3. The solid state hard disk encryption storage protection system according to claim 1, characterized in that: When writing data based on the buffer list, it includes: The buffer list is the index of each unit of the DRAM buffer. When the application executes a write command, the buffer unit of the target area is determined according to the buffer list, and the data is written to the corresponding buffer of the long-term support area or the non-support area. If the buffer space in the long-term support area or the non-support area is insufficient, based on the cache replacement strategy, the data that is least used within a set time is moved out of the long-term support area or the non-support area before the write operation is performed.

4. The solid state hard disk encryption storage protection system according to claim 1, characterized in that: The buffer area division module is also used to: stop the refresh write operation and set the threshold write operation in the long-term support area. The refresh write operation is an operation of periodically writing the data in the long-term support area to the NAND memory. The threshold write operation is an operation of writing all the data in the long-term support area to the NAND memory when the data in the long-term support area exceeds the threshold.

5. The solid state hard disk encryption storage protection system according to claim 1, characterized in that: The buffer area division module is also used to: create a buffer pool, the buffer pool is composed of multiple buffers in the DRAM buffer, each buffer has a separate metadata structure, when the application executes a write command, allocates a free buffer from the buffer pool, writes the data to be written into the allocated buffer, and inserts the allocated buffer into the buffer list of the long-term support area or the non-support area according to whether the write data contains the mark or the unmarked mark.

Images