Device controller, operating method thereof, and storage system

Abstract

An example device controller includes an authentication value generation circuit and an authentication verification circuit. The authentication value generation circuit is configured to generate a plurality of authentication values based on the plurality of shared keys and transmit the plurality of authentication values to the plurality of storage devices. The authentication verification circuit is configured to identify a plurality of target storage devices corresponding to an authentication command and group them into a target storage group based on receiving the authentication command from the host, and verify the authentication for the target storage group based on a plurality of authentication values of the plurality of target storage devices.

Description

[0001] Cross-reference to related applications

[0002] This application claims priority to Korean Patent Application No. 10-2024-0142311, filed on October 17, 2024, with the Korean Intellectual Property Office, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] This application relates to device controllers and storage systems. Background Technology

[0004] Recently, with the development of technologies with high data utilization (such as artificial intelligence (AI)), interest in high-capacity storage systems is increasing. Typically, when a storage device receives a device authentication request (e.g., an authentication command) from a host, the storage device performs a separate authentication process for each device by configuring a 1:1 protocol between the host and the storage device. In high-capacity storage systems comprising multiple storage devices, the repeated authentication process for each device can lead to delays in the authentication process or increased data overload in the system, resulting in overall system performance degradation. Summary of the Invention

[0005] This disclosure relates to a device controller, a method of operating such a device, and a storage system for efficiently performing device authentication in a high-capacity storage system comprising multiple storage devices.

[0006] This disclosure is not limited to the foregoing, and other concepts will be readily understood by those skilled in the art from the following description.

[0007] In some implementations, the device controller includes an authentication value generation circuit and an authentication verification circuit. The authentication value generation circuit is configured to generate multiple authentication values ​​based on multiple shared keys and send the multiple authentication values ​​to multiple storage devices. The authentication verification circuit is configured to receive an authentication command from a host, identify multiple target storage devices corresponding to the authentication command, group the multiple target storage devices into target storage groups, and verify authentication for the target storage groups based on the multiple authentication values ​​of the multiple target storage devices.

[0008] In some implementations, a method for operating a device controller includes generating multiple authentication values ​​based on multiple shared keys and sending the multiple authentication values ​​to multiple storage devices; identifying multiple target storage devices corresponding to the authentication command based on an authentication command received from a host; grouping the multiple target storage devices into target storage groups; verifying authentication for the target storage groups based on the multiple authentication values ​​received from the multiple target storage devices; and sending an authentication result message for the target storage groups to the host.

[0009] In some implementations, the storage system includes a host and a storage box including a device controller and multiple storage devices. The device controller of the storage box is configured to: generate multiple authentication values ​​based on multiple shared keys between the device controller and the multiple storage devices; distribute the multiple authentication values ​​to the multiple storage devices respectively; group the multiple target storage devices into a target storage group based on an authentication command received from the host; receive multiple authentication values ​​from the multiple target storage devices corresponding to the authentication command; verify authentication for the target storage group based on the multiple authentication values ​​of the multiple target storage devices; and send the authentication result of the target storage group to the host. The multiple authentication values ​​are generated based on multiple shared keys. Attached Figure Description

[0010] The embodiments will be more clearly understood through the following detailed description in conjunction with the accompanying drawings.

[0011] Figure 1 This is a diagram illustrating an example of device authentication operations in a storage box.

[0012] Figure 2 This is a diagram illustrating an example of device authentication operations in a storage box.

[0013] Figure 3 This is a block diagram of an example storage system.

[0014] Figure 4 This is a block diagram of an example storage device.

[0015] Figure 5 This is a block diagram of an example storage box.

[0016] Figure 6 This is a diagram illustrating an example of the operation of a device controller.

[0017] Figure 7 This is a flowchart illustrating an example of the device authentication method used for each storage group.

[0018] Figure 8 This is a flowchart illustrating an example of the device authentication method used for each storage group.

[0019] Figure 9 This is a flowchart illustrating an example of the device authentication method used for each storage group. Detailed Implementation

[0020] In the following description, embodiments are illustrated with reference to the accompanying drawings. While embodiments are shown with reference to the drawings and detailed description, they are not intended to be limited to any particular form. For example, it will be apparent to those skilled in the art that the embodiments are subject to various modifications.

[0021] A storage box can refer to a storage device set that includes a device controller and multiple storage devices (e.g., solid-state drives (SSDs)).

[0022] The target storage group can refer to a storage group that includes all the storage devices for which the host has requested authentication.

[0023] A sub-storage group can refer to a storage group that includes at least some of the storage devices among a number of storage devices for which the host has requested authentication.

[0024] Figure 1 This is a diagram illustrating an example of device authentication operations in a storage box.

[0025] refer to Figure 1 The storage box may include a device controller and multiple storage devices (e.g., a first storage device (storage device #1) to an eighth storage device (storage device #8)).

[0026] When a command requesting device authentication for a storage device (hereinafter referred to as the authentication command) is received from the host, the storage box can perform device authentication based on the authentication protocol used for each storage device. The authentication protocol used for each storage device (i.e., the 1:1 protocol between the device controller and the storage device) can refer to a protocol that shares a key with a unique value between the device controller and the storage device and performs the authentication process (e.g., authentication request (challenge) - response (response)) based on the unique key of each storage device.

[0027] The device controller can generate an authentication request (challenge) (hereinafter referred to as C) for a target storage device among the currently operating storage devices (e.g., one of the first authentication request (C#1) and the second authentication request (C#2) through the eighth authentication request (C#8)), and can send the authentication request to the target storage device when it receives an authentication command for the currently operating storage device from the host. The target storage device, having received the authentication request (C), can send its authentication value (V) to the device controller in response to the authentication request (C). The device controller verifies the authentication for the target storage device based on its authentication value (V), and repeats the above authentication process for other currently operating storage devices.

[0028] For example, in Figure 1 In this example, it is assumed that the first storage device (storage device #1) through the eighth storage device (storage device #8) are currently in operation. The device controller can send a first authentication request (C#1) to the first storage device (storage device #1) and, in response to the first authentication request (C#1), verify authentication for the first storage device (storage device #1) based on a first authentication value (V#1) received from the first storage device (storage device #1). The device controller can also perform the same authentication process for the second storage device (storage device #2) through the eighth storage device (storage device #8), performing authentication for each of the second storage device (storage device #2) through the eighth storage device (storage device #8).

[0029] Therefore, when the device controller performs the authentication process for each storage device based on the authentication protocol used for each storage device, the authentication process may be delayed, or the data overload in the storage box may increase due to repeated authentication processes, resulting in performance degradation of the entire storage box.

[0030] Figure 2 This is a diagram illustrating an example of device authentication operations in a storage box.

[0031] refer to Figure 2 The storage box 100 may include a device controller 110 and multiple storage devices (e.g., first storage device 120-1 (storage device #1) to eighth storage device 120-8 (storage device #8)).

[0032] Storage box 100 can perform device authentication based on the authentication protocol for each storage group when it receives a command (hereinafter referred to as the authentication command) requesting device authentication for a storage device from the host. The authentication protocol for each storage group (i.e., a 1:N protocol between the device controller and the storage devices, where N is a positive integer) refers to a protocol in which a shared key is used between device controller 110 and the multiple storage devices included in the storage group, and an authentication process (e.g., authentication request (challenge) - response (response)) is performed for each storage group based on the shared key. For example, device controller 110 can pre-generate authentication values ​​for multiple storage devices based on the shared key, and can send / distribute the authentication values ​​for multiple storage devices separately to the multiple storage devices. In the following authentication process, device controller 110 can perform device authentication for each storage group based on the authentication values.

[0033] In some implementations, when an authentication command is received from the host for the currently operating storage device, the device controller 110 can identify the target storage device corresponding to the authentication command (i.e., the currently operating storage device), identify it, and group it into a target storage group. The device controller 110 can send an authentication request (challenge) (hereinafter referred to as C) to the target storage device in the target storage group. The target storage device receiving the authentication request (C) can respond to the authentication request (C) by sending its authentication value to the device controller 110. The device controller 110 can then verify authentication for the target storage group based on the authentication value of the target storage device.

[0034] For example, in Figure 1 In this context, it is assumed that the first storage device (storage device #1), the third storage device (storage device #3), and the seventh storage device (storage device #7) are currently in operation. When an authentication command is received from the host for the currently operating storage device, the device controller 110 can identify the first storage device (storage device #1), the third storage device (storage device #3), and the seventh storage device (storage device #7) as the target storage device. The device controller 110 can group the first storage device (storage device #1), the third storage device (storage device #3), and the seventh storage device (storage device #7) into a target storage group. The device controller 110 can send an authentication request (C) to the first storage device (storage device #1), the third storage device (storage device #3), and the seventh storage device (storage device #7) in the target storage group. Device controller 110 can verify authentication for a target storage group based on a pre-stored shared key, a first authentication value (V#1) of the first storage device (storage device #1), a third authentication value (V#3) of the third storage device (storage device #3), and a seventh authentication value (V#7) of the seventh storage device (storage device #7).

[0035] Therefore, while authentication is being performed for each storage group, the storage controller 110 can simultaneously perform authentication for the target storage devices included in the target storage group. Furthermore, the device controller 110 can avoid repeating the authentication process for each storage device, thereby preventing authentication delays and data overload caused by duplicate authentication processes. See below for further details. Figures 3 to 9 Provide a detailed description.

[0036] Figure 3 This is a block diagram of an example storage system.

[0037] refer to Figure 3 The storage system 10 may include a storage box 100 and a host 200. The storage system 10 may include one of the devices for storing data, such as a mobile phone, smartphone, MP3 player, laptop computer, desktop computer, game console, TV, tablet PC, or in-vehicle infotainment system.

[0038] Host 200 can refer to a data processing device capable of processing data, such as a central processing unit (CPU), processor, microprocessor, or application processor (AP). Host 200 can execute an operating system (OS) and / or various applications. In some implementations, storage system 10 can be included in a mobile device, and host 200 can be implemented as an AP. In some implementations, host 200 can be implemented as a system-on-a-chip (SoC) and therefore can be embedded in an electronic device.

[0039] Host 200 can communicate with storage box 100 through various interfaces. For example, storage box 100 and host 200 can connect to each other according to the interface protocol defined in the Universal Flash Storage (UFS) standard. Therefore, storage box 100 may include a UFS device, and host 200 may include a UFS host. However, this disclosure is not limited thereto. Storage box 100 and host 200 can connect to each other according to various standard interfaces.

[0040] Host 200 can control data processing operations of storage box 100, such as data read operations or data write operations. Host 200 can send data and commands (CMDs) requesting data processing operations from storage box 100, and storage box 100 can execute data processing operations in response to commands (CMDs) and send a response (RES) indicating the result of the operation to host 200. Host 200 can send commands (CMDs) related to general operations of storage box 100, such as read commands and write commands. Host 200 can also send commands (CMDs) according to the authentication / security protocol of the interface with storage box 100, such as authentication commands for providing authentication / security functions of storage box 100. Storage box 100 can send data (Data) generated by performing operations in response to requests from host 200 or read from storage device 120 to host 200.

[0041] The host 200 can provide authentication / security functions for communication between the host 200 and the storage box 100. The host 200 can generate data and authentication commands requesting authentication for the storage device 120 and provide them to the storage box 100, and can perform operations for security functions based on the data and / or response (RES) provided from the storage box 100.

[0042] Storage box 100 can be manufactured as a set of storage devices including device controller 110 and multiple storage devices 120 of various types (e.g., first storage device 120-1 to nth storage device 120-n) according to the host interface for communicating with host 200.

[0043] Device controller 110 can respond to a request from host 200 to perform authentication verification on a storage group basis for multiple storage devices 120 included in storage enclosure 100. For example, device controller 110 can pre-generate authentication values ​​for multiple storage devices 120 based on a shared key generated using unique values, and can send / distribute the generated authentication values ​​to the multiple storage devices 120 respectively. When receiving an authentication command later from host 200, device controller 110 can simultaneously perform authentication verification for the target storage device based on the shared key and the authentication value received from the target storage device (i.e., device controller 110 can perform authentication verification for the target storage device on a storage group basis). See below for further details. Figures 5 to 9 Provide a detailed description.

[0044] The device controller 110 can be connected to multiple storage devices 120 (e.g., first storage device 120-1 to nth storage device 120-n) via multiple channels respectively.

[0045] Storage device 120 may include various types of storage devices, such as SSDs, MMCs, eMMCs, RS-MMCs, micro-MMC multimedia cards, SD, mini-SD and micro-SD secure digital cards, Universal Serial Bus (USB) storage devices, Universal Flash Memory (UFS) devices, PCMCIA cards, PCI cards, PCI Express (PCI-E) cards, Compact Flash (CF) cards, smart media cards, and Memory Sticks. For example, each of the plurality of storage devices 120 (e.g., first storage devices 120-1 to nth storage devices 120-n) may be configured as an SSD.

[0046] Storage device 120 can be manufactured in one of various types of packages. For example, storage device 120 can be manufactured in one of various types of packages, such as point-of-purchase (POP), system-in-package (SIP), system-on-a-chip (SOC), multi-chip package (MCP), chip-on-board (COB), wafer-level fabrication package (WFP), and wafer-level stacked package (WSP). See below for reference. Figure 4 Provide a description of the configuration of storage device 120.

[0047] Figure 4 This is a block diagram of an example storage device.

[0048] refer to Figure 4 Storage device 120 may include controller 121 and non-volatile memory (NVM) device 123. Controller 121 may receive commands from host 200 via device controller 110 of storage enclosure 100. Controller 121 may control NVM device 123 to write data to NVM device 123 in response to a write request command from host 200, or control NVM device 123 to read data stored in NVM device 123 in response to a read request command from host 200.

[0049] NVM device 123 may include multiple memory cells. For example, the multiple memory cells may include flash memory cells. In some embodiments, the multiple memory cells may include NAND flash memory cells. However, this disclosure is not limited thereto. In some embodiments, the multiple memory cells may include resistive memory cells, such as resistive RAM (ReRAM), phase-change RAM (PRAM), or magnetic RAM (MRAM).

[0050] Each memory cell may include a single-level cell (SLC) that stores one data bit, a multi-level cell (MLC) that stores two data bits, a three-level cell (TLC) that stores three data bits, or a four-level cell (QLC) that can store four data bits.

[0051] NVM device 123 may include multiple memory blocks, such as first block BLK1 to nth block BLKn, where n is an integer of 2 or greater. Each memory block may include multiple memory cells. Each memory block may include multiple pages. In some embodiments, a page may include a unit for storing data in NVM device 123 or retrieving data stored in NVM device 123. A memory block may include a unit for erasing data.

[0052] Controller 121 may receive the authentication value of the storage device in advance from the device controller 110 of the storage enclosure 100. Controller 121 may store the received authentication value of the storage device in the NVM device 123. When the device controller 110 later receives an authentication command for device authentication from the host 200, controller 121 may send the storage authentication value of the storage device to the device controller 110 in response to the authentication request from the device controller 110.

[0053] Figure 5 This is a block diagram of an example storage box.

[0054] refer to Figure 5 The device controller 110 may include a random number generator 111, an authentication value generation circuit 113, and an authentication verification circuit 115. Figure 5 In this context, it is assumed that the first storage device (storage device #1), the third storage device (storage device #3), and the seventh storage device (storage device #7) are currently in operation in storage box 100.

[0055] In some implementations, the random number generator 111 may generate multiple random numbers as multiple shared keys in response to receiving a control signal (e.g., a shared key generation signal) from the authentication value generation circuit 113. The multiple random numbers may include multiple shared keys shared between the device controller 110 included in the storage enclosure 100 and multiple storage devices 120. The random number generator 111 may send the generated multiple shared keys (i.e., the multiple random numbers) to the authentication value generation circuit 113.

[0056] In some embodiments, the authentication value generation circuit 113 may generate multiple authentication values ​​corresponding to multiple storage devices 120, based on multiple shared keys received from the random number generator 111 and device indices of the storage devices. In some embodiments, the authentication value generation circuit 113 may generate multiple authentication values ​​based on the following Equation 1.

[0057] [Equation 1]

[0058]

[0059] in It can refer to the authentication value of the i-th storage device (storage device #i), and This can refer to the device index of the storage device. For example, in the following text, assume that multiple shared keys (S, a, b) are indicated as (S, a, b) = (10, 1, 1). According to the following equation 1 (for example, The authentication value (e.g., first authentication value (V#1)) of the first storage device 121-1 (storage device #1) can be "12". According to the following equation 1 (e.g., The authentication value (e.g., second authentication value (V#2)) of the second storage device 121-2 (storage device #2) can be "16". According to the following equation 1 (e.g., The authentication value (e.g., third authentication value (V#3)) of the third storage device 121-3 (storage device #3) can be "22". According to the following equation 1 (e.g., The authentication value of the seventh storage device 121-7 (storage device #7) (for example, the seventh authentication value (V#7)) can be "66".

[0060] In some implementations, the authentication value generation circuit 113 can send the generated authentication value for each storage device to the corresponding storage device. For example, a first authentication value (V#1) corresponding to the first storage device 121-1 (storage device #1) can be sent to the first storage device 121-1 (storage device #1), a second authentication value (V#2) corresponding to the second storage device 121-2 (storage device #2) can be sent to the second storage device 121-2 (storage device #2), a third authentication value (V#3) corresponding to the third storage device 121-3 (storage device #3) can be sent to the third storage device 121-3 (storage device #3), a fourth authentication value (V#4) corresponding to the fourth storage device 121-4 (storage device #4) can be sent to the fourth storage device 121-4 (storage device #4), and a fifth authentication value (V#5) corresponding to the fifth storage device 121-5 (storage device #5) can be sent to the fifth storage device 121-5 (storage device #5). The sixth authentication value (V#6) corresponding to the sixth storage device 121-6 (storage device #6) can be sent to the sixth storage device 121-6 (storage device #6), the seventh authentication value (V#7) corresponding to the seventh storage device 121-7 (storage device #7) can be sent to the seventh storage device 121-7 (storage device #7), and the eighth authentication value (V#8) corresponding to the eighth storage device 121-8 (storage device #8) can be sent to the eighth storage device 121-8 (storage device #8).

[0061] In some implementations, in response to receiving an authentication command from host 200 requesting authentication for a storage device, authentication verification circuit 115 can identify the target storage device corresponding to the authentication command and group the identified target storage devices into target storage groups. For example, when receiving an authentication command from host 200 that includes an authentication request for the currently operating storage device, authentication verification circuit 115 can group the first storage device (storage device #1), the third storage device (storage device #3), and the seventh storage device (storage device #7) into a target storage group.

[0062] In some implementations, the authentication verification circuit 115 may send an authentication request (e.g., a challenge) to a target storage device included in the target storage group, and receive the authentication value of the target storage device as a response (e.g., a response) to it. For example, the authentication verification circuit 115 may send an authentication request (e.g., a challenge) to a first storage device (storage device #1), a third storage device (storage device #3), and a seventh storage device (storage device #7) included in the target storage group. The authentication verification circuit 115 may receive a first authentication value (V#1) (e.g., "12") as the authentication value of the first storage device (storage device #1), a third authentication value (V#3) (e.g., "22") as the authentication value of the third storage device (storage device #3), and a seventh authentication value (V#7) (e.g., "66") as the authentication value of the seventh storage device (storage device #7).

[0063] In some implementations, the authentication verification circuit 115 can perform authentication verification for a target storage group based on the received authentication value of the target storage device. That is, the authentication verification circuit 115 can calculate an estimated shared key (S', a', and b') for the target storage group based on the authentication value of the target storage device (and the device index of the storage device), and compare a pre-stored shared key (S, a, b) with the estimated shared key (S', a', b'). The authentication verification circuit 115 can perform authentication verification for the target storage group based on the comparison result. For example, the authentication verification circuit 115 can calculate the estimated shared key (S', a', b') based on a first authentication value (V#1) (e.g., 12), a third authentication value (V#3) (e.g., 22), and a seventh authentication value (V#7) (e.g., 66) using equations 2 to 4 (i.e., simultaneous first-order equations).

[0064] [Equation 2]

[0065]

[0066] [Equation 3]

[0067]

[0068] [Equation 4]

[0069]

[0070] The authentication verification circuit 115 can calculate the estimated shared key of the target storage group (e.g., (S', a', b') = (10, 1, 1)) using Equations 2 to 4 (i.e., simultaneous first-order equations) and verify authentication for the target storage group based on the comparison between the pre-stored shared key and the estimated shared key. When all the pre-stored shared keys (e.g., (S, a, b) = (10, 1, 1)) match the estimated shared key (e.g., (S', a', b')), i.e., S = S', a = a', and b = b', the authentication verification circuit 115 can send an authentication success message for the target storage group to the host 200. When one of the pre-stored shared keys (e.g., (S, a, b) = (10, 1, 1)) does not match the estimated shared key, the authentication verification circuit 115 can send an authentication failure message for the target storage group to the host 200.

[0071] In some implementations, when authentication for a target storage group fails, the authentication verification circuit 115 can perform additional operations to identify the target storage device that caused the authentication failure (i.e., a forged / modified storage device). See below for further details. Figure 6 Provide a detailed description.

[0072] In some implementations, device controller 110 can divide the target storage device into at least two or more sub-storage groups. Device controller 110 can perform authentication for each sub-storage group and send a message about the authentication result for each sub-storage group to host 200. See below for further details. Figure 8 Provide a detailed description.

[0073] In some implementations, device controller 110 can divide the target storage device into at least two or more sub-storage groups. Device controller 110 can assign priorities to the sub-storage groups according to predetermined criteria and perform authentication verification for each sub-storage group based on those priorities. Device controller 110 can send a message regarding the authentication result of each sub-storage group to host 200 based on the priority. The predetermined criteria can be determined based on at least one of the following: throughput of each sub-storage group, priority of processing tasks, and user selection. See below for further details. Figure 9 Provide a detailed description.

[0074] As described above, the device controller 110 of the storage box 100 can unify the management of authentication values ​​for multiple storage devices 120 and the verification of authentication for multiple storage devices 120, thereby maximizing the efficiency of the authentication process for multiple storage devices.

[0075] Additionally, the device controller 110 of storage enclosure 100 can simultaneously authenticate multiple storage devices for each storage group using authentication values ​​generated based on shared keys (e.g., S, a, b). When the target storage device to be authenticated changes during the authentication process (e.g., when the storage device in operation changes during the authentication process of the currently operating storage device), the device controller 110 can perform authentication on the changed target storage device at high speed.

[0076] For ease of reference Figure 5 The description includes a plurality of storage devices 120 included in storage box 100, shown as first storage device 120-1 (storage device #1) to eighth storage device 120-8 (storage device #8), but is not limited thereto. Storage box 100 may include a variety of numbers of storage devices 120.

[0077] Figure 6 This is a diagram illustrating an example of the operation of a device controller.

[0078] More specifically, Figure 6 This diagram illustrates the operation of device controller 110 (e.g., authentication verification circuit 115) to identify the target storage device (i.e., a counterfeit / modified storage device) of the target storage group that caused the authentication failure when authentication for the target storage group has failed. Figure 6 The target storage group includes a first storage device (storage device #1), a third storage device (storage device #3), and a seventh storage device (storage device #7), wherein it is assumed that the seventh storage device (storage device #7) is a counterfeit / modified storage device.

[0079] refer to Figure 6 When authentication for the target storage group fails, the authentication verification circuit 115 can identify the storage device (i.e., the counterfeit / modified storage device) among the target storage devices in the target storage group that caused the authentication failure based on the authentication value pre-stored in the authentication verification circuit 115.

[0080] In some implementations, the authentication verification circuit 115 can obtain an estimated shared key for the target storage group based on the verified authentication value and at least two of the following: the first authentication value (V#1) of the first storage device (storage device #1), the third authentication value (V#3) of the third storage device (storage device #3), and the seventh authentication value (V#7) of the seventh storage device (storage device #7). Based on the obtained estimated shared key, it can identify counterfeit / modified storage devices according to whether authentication has been successful. The authentication verification circuit 115 can, based on... Figure 5 The method of verifying authentication against the target storage group based on the estimated shared key is used to determine whether the authentication has been successful.

[0081] For example, the authentication verification circuit 115 can obtain the estimated shared key (S1, a1, b1) of the target storage group based on the first authentication value (V#1), the third authentication value (V#3), and the verified authentication value (k). The authentication verification circuit 115 can obtain the estimated shared key (S2, a2, b2) of the target storage group based on the third authentication value (V#3), the seventh authentication value (V#7), and the verified authentication value (k). The authentication verification circuit 115 can obtain the estimated shared key (S3, a3, b3) of the target storage group based on the first authentication value (V#1), the seventh authentication value (V#7), and the verified authentication value (k). In this case, when the estimated shared key (S1, a1, b1) matches the pre-stored shared key (S, a, b), but the estimated shared key (S2, a2, b2) and the estimated shared key (S3, a3, b3) do not match the pre-stored shared key (S, a, b), the authentication verification circuit 115 can identify the seventh storage device (storage device #7) as a counterfeit / modified storage device.

[0082] As described above, the authentication verification circuit 115 (or device controller 110) of the storage box 100 can authenticate each storage group at high speed. Furthermore, when authentication for each storage group fails, the authentication verification circuit 115 can identify the storage device that caused the authentication failure (i.e., a counterfeit / modified storage device), thereby enhancing device security.

[0083] Figure 7 This is a flowchart illustrating an example of the device authentication method used for each storage group.

[0084] More specifically, Figure 7 This is a diagram illustrating the authentication method used for each target storage group. A target storage group may refer to a storage group that includes all the multiple storage devices (i.e., target storage devices) for which host 200 has already made an authentication request.

[0085] refer to Figure 7 The device authentication method for each target storage group may include operations S100 to S170. This can be compared with reference... Figures 1 to 6 Description of overlapping references Figure 7 The description is replaced with a reference. Figures 1 to 6 The description.

[0086] In operation S100, the device controller 110 of the storage enclosure 100 can generate an authentication value for each storage device based on a shared key. For example, the device controller 110 can generate multiple authentication values ​​corresponding to multiple storage devices based on the shared key and the device index of the storage device.

[0087] In operation S110, the device controller 110 can send / distribute the generated multiple authentication values ​​to storage devices corresponding to the multiple authentication values ​​respectively.

[0088] In operation S120, host 200 can send an authentication command to device controller 110. Host 200 can directly indicate the device index of the storage device requesting authentication (i.e., the target storage device) through the authentication command, or indirectly indicate the storage device requesting authentication (e.g., the target storage device) through the authentication command (e.g., an authentication command requesting authentication for the storage device currently in operation).

[0089] In operation S130, the device controller 110 may, in response to receiving an authentication command from the host 200, identify the target storage device corresponding to the authentication command, and may group the identified target storage devices into target storage groups.

[0090] In operation S140, device controller 110 may send authentication requests (e.g., challenge) to target storage devices included in the target storage group.

[0091] In operation S150, the target storage device may send the authentication value (e.g., response) of each target storage device to the device controller 110 in response to an authentication request (e.g., a challenge).

[0092] In operation S160, device controller 110 can verify authentication for the target storage group based on the authentication value of the target storage device. In operation S170, device controller 110 can send an authentication result message for the target storage group to host 200. For example, device controller 110 can obtain an estimated shared key for the target storage group based on the authentication value of the target storage device. Device controller 110 can compare pre-stored shared keys with the obtained estimated shared key and can verify authentication for the target storage group based on the comparison result. When all pre-stored shared keys match the estimated shared key, device controller 110 can send an authentication success message for the target storage group to host 200. When one of the pre-stored shared keys does not match the estimated shared key, device controller 110 can send an authentication failure message for the target storage group to host 200.

[0093] Figure 8 This is a flowchart illustrating an example of the device authentication method used for each storage group.

[0094] More specifically, Figure 8 This diagram illustrates an authentication method for multiple storage devices based on sub-storage groups. A sub-storage group can refer to a storage group that includes at least some of the multiple storage devices (i.e., target storage devices) for which host 200 has requested authentication.

[0095] refer to Figure 8 The device authentication method for each sub-storage group may include operations S200 to S24m-4. This can be compared with reference... Figures 1 to 7 Description of overlapping references Figure 8 Replace the description with a reference. Figures 1 to 7 The description. It can be compared with the reference. Figure 7 The descriptions of operations S100 to S120 overlap with the references. Figure 8 The descriptions of operations S200 to S220 are replaced with references. Figure 7 The description.

[0096] In operation S230, the device controller 110 of the storage box 100 can, in response to receiving an authentication command from the host 200, identify the target storage device corresponding to the authentication command, and can group the identified target storage devices into multiple sub-storage groups. For example, when receiving an authentication command for n target storage devices from the host 200, the device controller 110 can generate multiple sub-storage groups by grouping the target storage devices into m groups (where m is a positive integer less than n) according to the operating environment of the storage box 100.

[0097] In operation S241-1, device controller 110 may send an authentication request (e.g., a challenge) to a target storage device included in the first sub-storage group.

[0098] In operation S241-2, the target storage devices included in the first sub-storage group can send the authentication value (e.g., response) of each target storage device to the device controller 110 in response to an authentication request (e.g., a challenge).

[0099] In operation S241-3, device controller 110 can verify authentication for the first sub-storage group based on the authentication value of the target storage device included in the first sub-storage group (sub-storage group #1). In operation S241-4, device controller 110 can send an authentication result message for the first sub-storage group to host 200. For example, device controller 110 can obtain an estimated shared key for the first sub-storage group based on the authentication value of the target storage device included in the first sub-storage group. Device controller 110 can compare a pre-stored shared key with the obtained estimated shared key and can verify authentication for the first sub-storage group based on the comparison result. When all pre-stored shared keys match the estimated shared key, device controller 110 can send an authentication success message for the first sub-storage group to host 200. When one of the pre-stored shared keys does not match the estimated shared key, device controller 110 can send an authentication failure message for the first sub-storage group to host 200. Although not explicitly stated in the original text for ease of description... Figure 8 As shown, however, the device controller 110 can sequentially verify the authentication for the second sub-storage group (sub-storage group #2) to the (m-1)th sub-storage group (sub-storage group #m-1) in the same manner as the authentication operation for the first sub-storage group described above (e.g., operations S241-1 to S241-4).

[0100] In operation S24m-1, device controller 110 can send an authentication request (e.g., a challenge) to a target storage device included in the m-th sub-storage group (sub-storage group #m).

[0101] In operation S24m-2, the target storage devices included in the m-th sub-storage group can respond to an authentication request (e.g., a challenge) by sending the authentication value (e.g., a response) of each target storage device to the device controller 110.

[0102] In operation S24m-3, device controller 110 can verify authentication for the m-th sub-storage group based on the authentication value of the target storage device included in the m-th sub-storage group. In operation S24m-4, device controller 110 can send an authentication result message for the m-th sub-storage group to host 200. For example, device controller 110 can obtain an estimated shared key for the m-th sub-storage group based on the authentication value of the target storage device included in the m-th sub-storage group. Device controller 110 can compare a pre-stored shared key with the obtained estimated shared key and can verify authentication for the m-th sub-storage group based on the comparison result. When all pre-stored shared keys match the estimated shared key, device controller 110 can send an authentication success message for the m-th sub-storage group to host 200. When one of the pre-stored shared keys does not match the estimated shared key, device controller 110 can send an authentication failure message for the m-th sub-storage group to host 200.

[0103] As described above, the device controller 110 of storage box 100 may not limit each storage group to the number of storage devices requested by host 200, and may perform authentication for each sub-storage group that includes a variety of numbers of storage devices.

[0104] Figure 9 This is a flowchart illustrating an example of the device authentication method used for each storage group.

[0105] More specifically, Figure 9 This is a diagram illustrating an authentication method for multiple storage devices based on sub-storage groups. A sub-storage group can refer to a storage group that includes at least some of the multiple storage devices (i.e., target storage devices) for which host 200 has requested authentication.

[0106] refer to Figure 9The device authentication method for each sub-storage group may include operations S300 to S35m-4. This can be compared with reference... Figures 1 to 8 Description of overlapping references Figure 9 Replace the description with a reference. Figures 1 to 8 The explanation can be compared with the reference. Figure 7 The descriptions of operations S100 to S120 overlap with the references. Figure 9 The descriptions of operations S300 to S320 are replaced with references. Figure 7 The description. It can be compared with the reference. Figure 8 The description of operation S230 overlaps with the reference. Figure 9 The description of operation S330 is replaced with the reference. Figure 8 The description.

[0107] In operation S340, the device controller 110 of the storage box 100 can assign priorities to multiple sub-storage groups according to predetermined criteria. The predetermined criteria can be determined based on at least one of the following: throughput of each sub-storage group, priority of the processing task, and user selection. It is assumed that the third sub-storage group (sub-storage group #3) has the highest priority and the first sub-storage group (sub-storage group #1) has the lowest priority among the multiple sub-storage groups. For example, the device controller 110 can first verify and authenticate the third sub-storage group with the highest priority, and finally verify and authenticate the first sub-storage group with the lowest priority.

[0108] In operation S351-1, device controller 110 may send an authentication request (e.g., a challenge) to a target storage device included in a third sub-storage group (assuming that in operation S340, the third sub-storage group has the highest priority among the multiple storage devices).

[0109] In operation S351-2, the target storage devices included in the third sub-storage group may, in response to an authentication request (e.g., a challenge), send the authentication value (e.g., a response) of each target storage device to the device controller 110.

[0110] In operation S351-3, device controller 110 can verify authentication for the third sub-storage group based on the authentication value of the target storage device included in the third sub-storage group (sub-storage group #3), according to the priority in operation S340. In operation S351-4, device controller 110 can send an authentication result message for the third sub-storage group to host 200. For example, device controller 110 can obtain an estimated shared key for the third sub-storage group based on the authentication value of the target storage device included in the third sub-storage group. Device controller 110 can compare a pre-stored shared key with the obtained estimated shared key and can verify authentication for the third sub-storage group based on the comparison result. When all pre-stored shared keys match the estimated shared key, device controller 110 can send an authentication success message for the third sub-storage group to host 200. When one of the pre-stored shared keys does not match the estimated shared key, device controller 110 can send an authentication failure message for the third sub-storage group to host 200. Although not explicitly stated in the original text for ease of description... Figure 9 As shown, however, the device controller 110 can verify authentication for other sub-storage groups in the same manner as the authentication operation for the third sub-storage group described above (e.g., operations S351-1 to S351-4), according to priority order.

[0111] In operation S35m-1, device controller 110 can send an authentication request (e.g., a challenge) to a target storage device included in the first sub-storage group (sub-storage group #1) (assuming that in operation S340, the first sub-storage group has the lowest priority among the multiple storage devices).

[0112] In operation S35m-2, the target storage devices included in the first sub-storage group can send the authentication value (e.g., response) of each target storage device to the device controller 110 in response to an authentication request (e.g., a challenge).

[0113] In operation S35m-3, device controller 110 can verify authentication for the first sub-storage group based on the authentication value of the target storage device included in the first sub-storage group, according to the priority in operation S340. In operation S35m-4, device controller 110 can send an authentication result message for the first sub-storage group to host 200. For example, device controller 110 can obtain an estimated shared key for the first sub-storage group based on the authentication value of the target storage device included in the first sub-storage group. Device controller 110 can compare a pre-stored shared key with the obtained estimated shared key and can verify authentication for the first sub-storage group based on the comparison result. When all pre-stored shared keys match the estimated shared key, device controller 110 can send an authentication success message for the first sub-storage group to host 200. When one of the pre-stored shared keys does not match the estimated shared key, device controller 110 can send an authentication failure message for the first sub-storage group to host 200.

[0114] As described above, the device controller 110 of the storage box 100 can perform authentication for each sub-storage group, which includes a variety of numbers of storage devices, based on the priority of each sub-storage group.

[0115] While this specification contains numerous details of specific embodiments, these should not be construed as limiting the scope of any invention or the scope that may be claimed, but rather as descriptions of features that may be specific to a particular invention. Some features described in the context of individual embodiments in this specification may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments. Furthermore, although features may be described above as functioning in certain combinations, in some cases, one or more features from the combination may be removed from the combination, and the combination may be for sub-combinations or variations thereof.

[0116] Although this disclosure has been specifically shown and described with reference to embodiments thereof, it should be understood that various changes in form and detail may be made therein without departing from the spirit and scope of the appended claims.

Claims

1. A device controller, comprising: The authentication value generation circuit is configured as follows: Multiple authentication values ​​are generated based on multiple shared keys, and Send the multiple authentication values ​​to multiple storage devices; and The authentication and verification circuit is configured as follows: Based on the authentication command received from the host, multiple target storage devices corresponding to the authentication command are identified. The plurality of target storage devices are divided into target storage groups, and The authentication is verified for the target storage group based on multiple authentication values ​​of the multiple target storage devices.

2. The device controller according to claim 1, wherein, The device controller includes a random number generator, wherein the random number generator is configured to: Based on the shared key generation signal received from the authentication value generation circuit, multiple random numbers are generated as the multiple shared keys, and The plurality of shared keys are sent to the authentication value generation circuit.

3. The device controller according to claim 1, wherein, The authentication value generation circuit is configured as follows: Based on the multiple shared keys and the device indexes of the storage devices, multiple authentication values ​​are generated, each corresponding to one of the multiple storage devices. The multiple authentication values ​​are sent to the multiple storage devices respectively.

4. The device controller according to claim 1, wherein, The authentication verification circuit is configured as follows: Based on multiple authentication values ​​of the multiple target storage devices, multiple estimated shared keys for the target storage group are obtained. The plurality of shared keys are compared with the plurality of estimated shared keys to obtain a comparison result, wherein the plurality of shared keys are pre-stored in the authentication and verification circuit. Based on the comparison results, the authentication is verified for the target storage group.

5. The device controller according to claim 4, wherein, The authentication verification circuit is configured to verify the authentication for the target storage group based on the comparison result by: Based on the match between all the shared keys and the estimated shared keys, an authentication success message for the target storage group is sent to the host. Based on the fact that the shared key among the plurality of shared keys does not match the plurality of estimated shared keys, an authentication failure message for the target storage group is sent to the host.

6. The device controller according to claim 1, wherein, The authentication verification circuit is configured as follows: The multiple target storage devices are divided into multiple sub-storage groups. Authentication is performed for each of the plurality of sub-storage groups, and The authentication result message of each of the plurality of sub-storage groups is sent to the host.

7. The device controller according to claim 6, wherein, The authentication verification circuit is configured as follows: Priorities are assigned to the multiple sub-storage groups based on multiple predetermined criteria, and The authentication is verified for the plurality of sub-storage groups according to the priority, wherein the plurality of predetermined criteria are determined based on at least one of the throughput of each sub-storage group, the priority of a plurality of processing tasks, and user selection.

8. The device controller according to claim 1, wherein, The authentication verification circuit is configured to respond to authentication failures against the target storage group: Based on the verified authentication value, the modified storage device among the plurality of target storage devices in the target storage group is identified, and the verified authentication value is pre-stored in the authentication verification circuit.

9. A method for operating a device controller, the method comprising: Multiple authentication values ​​are generated based on multiple shared keys; Send the multiple authentication values ​​to multiple storage devices; Based on the authentication command received from the host, identify multiple target storage devices corresponding to the authentication command; The plurality of target storage devices are grouped into target storage groups; Authentication is verified for the target storage group based on multiple authentication values ​​received from the multiple target storage devices. as well as The authentication result message of the target storage group is sent to the host.

10. The method according to claim 9, wherein, The method includes generating a signal based on a shared key and generating multiple random numbers as the multiple shared keys.

11. The method according to claim 9, wherein, Generating the multiple authentication values ​​based on the multiple shared keys and sending the multiple authentication values ​​to the multiple storage devices includes: Based on the multiple shared keys and the device indexes of the storage devices, multiple authentication values ​​are generated, each corresponding to one of the multiple storage devices. The plurality of authentication values ​​are sent to the plurality of storage devices corresponding to the plurality of authentication values ​​respectively.

12. The method according to claim 9, wherein, Verifying the authentication for the target storage group includes: Based on the multiple authentication values ​​of the multiple target storage devices, multiple estimated shared keys for the target storage group are obtained; Multiple pre-stored shared keys are compared with the multiple estimated shared keys to obtain a comparison result; and Based on the comparison results, the authentication is verified for the target storage group.

13. The method according to claim 12, wherein, Verifying the authentication for the target storage group based on the comparison results includes: Based on the matching of all pre-stored shared keys among the plurality of pre-stored shared keys with the plurality of estimated shared keys, an authentication success message for the target storage group is sent to the host, and An authentication failure message for the target storage group is sent to the host if the pre-stored shared key among the plurality of pre-stored shared keys does not match the plurality of estimated shared keys.

14. The method according to claim 9, wherein, The method includes: The plurality of target storage devices are divided into a plurality of sub-storage groups; Authentication is performed for each of the plurality of sub-storage groups; and The authentication result message of each of the plurality of sub-storage groups is sent to the host.

15. The method according to claim 14, wherein, Verifying the authentication for each of the plurality of sub-storage groups includes: Priorities are assigned to the multiple sub-storage groups based on multiple predetermined criteria, and The authentication is verified for the plurality of sub-storage groups according to the priority, wherein the plurality of predetermined criteria are determined based on at least one of the throughput of each sub-storage group, the priority of a plurality of processing tasks, and user selection.

16. The method of claim 14, wherein, The method includes: Based on the authentication failure for the target storage group, and based on multiple pre-stored verified authentication values, the modified storage device among the multiple target storage devices in the target storage group is identified.

17. A storage system, comprising: Host; and A storage enclosure, including a device controller and multiple storage devices, wherein the device controller of the storage enclosure is configured to: Multiple authentication values ​​are generated based on multiple shared keys between the device controller and the multiple storage devices; The multiple authentication values ​​are distributed to the multiple storage devices respectively; Based on the authentication command received from the host, multiple target storage devices are grouped into target storage groups, and the multiple target storage devices correspond to the authentication command. Receive multiple authentication values ​​from the multiple target storage devices; Based on the multiple authentication values ​​of the multiple target storage devices, verify authentication for the target storage group; and Send the authentication result of the target storage group to the host. The multiple authentication values ​​are generated based on the multiple shared keys.

18. The storage system according to claim 17, wherein, The device controller is configured to: Based on the multiple shared keys and the device indexes of the storage devices, the multiple authentication values ​​are generated, and the multiple authentication values ​​correspond to the multiple storage devices respectively.

19. The storage system according to claim 17, wherein, The device controller is configured to verify the authentication for the target storage group by: Based on the multiple authentication values ​​of the multiple target storage devices, multiple estimated shared keys for the target storage group are obtained, and The authentication result of the target storage group is generated based on the comparison results between the plurality of shared keys and the plurality of estimated shared keys.

20. The storage system according to claim 17, wherein, The device controller is configured to: The plurality of target storage devices are divided into a plurality of sub-storage groups; Authentication is performed for each of the plurality of sub-storage groups; as well as The authentication result message of each of the plurality of sub-storage groups is sent to the host.

Images