Encryption device, storage device and method for configuring parameters for encryption device

Abstract

The invention provides an encryption device, a storage device and a method for configuring parameters for the encryption device. The encryption device includes an encryption circuit that encrypts a plaintext including user data and outputs an initial ciphertext, and a parameter optimization circuit that generates an encryption parameter used when the initial ciphertext is generated in the encryption circuit. The parameter optimization circuit receives an operation scenario from an external evaluation device and generates the encryption parameter optimized in cooperation with a bootstrap parameter used in the external evaluation device based on the operation scenario.

Description

Technical Field

[0001] The exemplary embodiments of this disclosure described herein relate to semiconductor memory devices, and more specifically to encryption devices including parameter optimization circuitry, storage devices including encryption devices, and methods for configuring parameters for encryption devices. Background Technology

[0002] As communication technologies advance and electronic devices become more prevalent, continuous efforts are being made to maintain secure communication between electronic devices. Therefore, encryption and decryption technologies are used in most communication environments.

[0003] When a message encrypted with cryptographic technology is sent to a recipient, the recipient can decrypt the message to use it. However, if a third party launches an attack (hack) while the recipient is temporarily decrypting the message, there is a risk that the decrypted message could be easily leaked to that third party.

[0004] To address this problem, homomorphic encryption methods are being researched. According to homomorphic encryption, even if the encrypted information is not decrypted and operations are performed on the ciphertext, the result is the same as the encrypted value obtained after operating on the original text. Therefore, various operations can be performed without decrypting the ciphertext. Summary of the Invention

[0005] An exemplary embodiment of this disclosure provides an encryption device including a parameter optimization circuit that optimizes parameters used in encryption operations and parameters used in bootstrapping operations.

[0006] According to an example embodiment, an encryption device includes: an encryption circuit that encrypts plaintext including user data and outputs initial ciphertext; and a parameter optimization circuit that generates encryption parameters used in generating the initial ciphertext in the encryption circuit. The parameter optimization circuit receives an operation scenario from an external evaluation device and generates the encryption parameters based on the operation scenario, which are optimized in conjunction with bootstrap parameters used in the external evaluation device.

[0007] According to an example embodiment, a method for configuring parameters for an encryption device includes: receiving an operation scenario from an external evaluation device; calculating the system operation depth of the external evaluation device based on the operation scenario; determining a level of an initial ciphertext supporting the system operation depth and a number of bootstrap operations performed by the external evaluation device; and determining a range of the modulo approximate polynomial operation depth of the external evaluation device based on the level of the initial ciphertext and the number of bootstrap operations.

[0008] According to an example embodiment, a storage device includes: a storage unit comprising an array of storage cells for storing user data; and a storage controller that controls the storage unit to input and output the user data. The storage controller includes: an encryption circuit that encrypts the user data and outputs an initial ciphertext; and a parameter optimization circuit that determines encryption parameters to be used in the encryption circuit. The parameter optimization circuit receives an operational scenario from an evaluation device of a host computer and generates, based on the operational scenario, the encryption parameters that are optimized in conjunction with bootstrap parameters used in the evaluation device. Attached Figure Description

[0009] The above and other objects and features of this disclosure will become apparent from the detailed description of embodiments thereof with reference to the accompanying drawings.

[0010] Figure 1 This is a block diagram illustrating an electronic device according to an example embodiment.

[0011] Figure 2 It is shown Figure 1 A block diagram of the encrypted operating system to which the encryption device is connected.

[0012] Figure 3 It is shown in Figure 2 The diagram shows the encryption process performed in the encryption circuit.

[0013] Figure 4 This illustrates an example embodiment in Figure 2 The encryption operations performed in the evaluation circuit and by Figure 2 The diagram shows the bootstrap operation performed by the bootstrap circuit.

[0014] Figure 5 This illustrates an example embodiment. Figure 2 The table shows the operation scenarios.

[0015] Figure 6 It shows the parameter mapping table. Figure 2 The diagram shows the parameter optimization circuit.

[0016] Figure 7 It is shown Figure 6 The table is an example of a parameter mapping table.

[0017] Figure 8 It shows the use of Figure 2 The flowchart shows the method for determining encryption parameters and bootstrap parameters using a parameter optimization circuit.

[0018] Figure 9 It is a graph with a table showing the relationship between the number of bootstrapping operations based on Equation 3 and the time complexity.

[0019] Figure 10 This is a graph showing the range (or parameter pool) of the modular approximation polynomial operation depth determined based on Equation 8.

[0020] Figure 11 This is a block diagram illustrating a user device according to an example embodiment.

[0021] Figure 12 This illustrates an example embodiment. Figure 11 Block diagram of the storage controller. Detailed Implementation

[0022] Hereinafter, exemplary embodiments of the present disclosure will be described in detail and clearly to the extent that those skilled in the art can readily implement the inventive concept.

[0023] Figure 1 This is a block diagram illustrating an electronic device according to an example embodiment. (Reference) Figure 1 The electronic device 1000 may include an encryption device 1100, a processor 1200, an interface (I / F) 1300, and / or a memory 1400. The electronic device 1000 can send and receive data DATA with external devices. The data DATA can be transmitted in the form of an initial ciphertext CT.

[0024] Electronic device 1000 can be implemented as or included in various electronic devices. For example, electronic device 1000 may include drones, robotic devices such as advanced driver assistance systems (ADAS), smart TVs, smartphones, medical devices, mobile devices, video display devices, measuring devices, Internet of Things (IoT) devices, etc.

[0025] Encryption device 1100 can encrypt and / or decrypt data DATA received from outside electronic device 1000 or data DATA generated within electronic device 1000. Encryption device 1100 can maintain the security of data DATA by performing encryption operations based on an encryption algorithm. The encryption algorithm can be, for example, an algorithm that generates encrypted data using an encryption key. For example, the encryption algorithm may include a homomorphic encryption algorithm.

[0026] Processor 1200 can send data DATA to and receive data DATA from the outside of electronic device 1000 via interface (I / F) 1300. Processor 1200 can execute tasks and store the results of the tasks in memory 1400 (e.g., buffer memory). For example, processor 1200 may include multiple cores.

[0027] The memory 1400 can store various data required for the operation of the processor 1200. For example, the memory 1400 can be implemented as dynamic random access memory (DRAM), mobile DRAM, static RAM (SRAM), phase change RAM (PRAM), ferroelectric RAM (FRAM), resistive RAM, and / or magnetic RAM (MRAM).

[0028] Figure 2 This is a block diagram illustrating an encrypted operating system. Figure 1 The encryption device is connected to the encryption operating system or Figure 1 The encryption device is part of the encrypted operating system. (Reference) Figure 1 and Figure 2 The encrypted operating system 10 may include an electronic device 1000 and / or another electronic device 2000, the electronic device 1000 including an encryption device 1100 and the other electronic device 2000 including an evaluation device 2100. For example, the other electronic device 2000 may include a server.

[0029] Encryption device 1100 may include encryption circuit 1110. For example, encryption circuit 1110 may generate initial ciphertext CT by encrypting plaintext PT according to homomorphic encryption technology. Encryption device 1100 may generate initial ciphertext CT based on encryption parameter OE_PMT. For example, encryption parameter OE_PMT may include the level of initial ciphertext CT.

[0030] Evaluation device 2100 may include evaluation circuit 2110. For example, evaluation circuit 2110 may receive multiple initial ciphertext CTs from encryption circuit 1110. Evaluation circuit 2110 may perform at least one operation on the multiple initial ciphertext CTs without performing a decryption operation. The initial ciphertext CTs may include initial text, a message, and an error based on homomorphic encryption. The message may be valid bits excluding the error. Each time a multiplication operation is performed on the initial ciphertext CTs, the length of the initial text may decrease, and the length of the error may increase.

[0031] The bootstrap circuit 2120 can perform a bootstrap operation to reduce the error length of ciphertext whose error length has increased. For example, the evaluation circuit 2110 can send a first ciphertext CT1, whose error length has increased, to the bootstrap circuit 2120. The bootstrap circuit 2120 can then send a second ciphertext CT2, whose error length has been reduced from the first ciphertext CT1, back to the evaluation circuit 2110. The evaluation circuit 2110 can perform at least one operation based on the second ciphertext CT2 and ultimately output a third ciphertext CT3.

[0032] The bootstrap circuit 2120 can perform at least one bootstrap operation on the first ciphertext CT1 based on the bootstrap parameter OB_PMT. For example, the bootstrap parameter OB_PMT may include the number of bootstrap operations.

[0033] The parameter optimization circuit 1120 can simultaneously optimize the encryption operation of the encryption circuit 1110 and the bootstrap operation of the bootstrap circuit 2120 by generating encryption parameters OE_PMT and bootstrap parameters OB_PMT. For example, the parameter optimization circuit 1120 can receive the operation scenario OP_SNR from the evaluation circuit 2110. The parameter optimization circuit 1120 can generate the encryption parameters OE_PMT and bootstrap parameters OB_PMT based on the operation scenario OP_SNR. For example, the operation scenario OP_SNR may include the system operation depth (D). The system operation depth (D) may refer to the size of the operation path traversed by multiple initial ciphertext CTs in the evaluation circuit 2110.

[0034] The parameter optimization circuit 1120 can convert the operational complexity of the evaluation circuit 2110 for a homomorphic cryptographic operating system into time complexity based on the system operational depth (D). For example, the operational complexity (or system complexity) of the evaluation circuit 2110 can be expressed as in Equation 1.

[0035] [Equation 1]

[0036] In Equation 1, " "This refers to the depth of system operation." "This refers to the initial ciphertext level." "This refers to the number of bootstrapping operations." "" refers to the remaining level of the ciphertext after the bootstrapping operation. Referring to Equation 1, the maximum value of the system operation depth (D) is represented as the level of the initial ciphertext CT ( ) and the residual level of the first ciphertext CT1 after the bootstrap operation ( The sum of equations 1 and 2. The parameter optimization circuit 1120 can convert the operational complexity (or system complexity) of equation 1 into the time complexity as shown in equation 2.

[0037] [Equation 2]

[0038] In equation 2 concerning the time complexity equation, " "" refers to the time consumed for each operation included in the operation scenario OP_SNR (or for the rating). (The time consumed by multiplication operations between ciphertexts). "This refers to the number of bootstrapping operations." "This refers to the time allotted for each bootstrapping operation." "Can be with" "Inversely proportional. The more complex the bootstrap algorithm, the longer the bootstrap operation will take."

[0039] The parameter optimization circuit 1120 can determine the level of the initial ciphertext CT that minimizes Equation 2. ) and the number of bootstrap operations ( For example, parameter optimization circuit 1120 can calculate the level of the initial ciphertext CT that satisfies Equation 3. ) and the number of bootstrap operations ( ).

[0040] [Equation 3]

[0041] “ "This could refer to the level of the initial encrypted CT scan (" The remaining level after subtracting the level consumed during the bootstrap operation. During the bootstrap operation of bootstrap circuit 2120, a level of "" can be consumed. The operational depth of "". Due to the level The time for multiplication operations between ciphertexts is " Therefore, the operation time corresponding to the operation depth consumption during the bootstrapping operation can be " If the time required for other operations besides the time consumed by the depth of operation is defined as an arbitrary constant value (e.g., "Const."), then the time consumed by the bootstrap operation in the bootstrap circuit 2120 can be simplified as shown in Equation 4.

[0042] [Equation 4]

[0043] By substituting Equation 4 into Equation 3 and rearranging, Equation 3 can be simplified to Equation 5.

[0044] [Equation 5]

[0045] The parameter optimization circuit 1120 can be set as in Equation 6. ".

[0046] [Equation 6]

[0047] In Equation 6, " "" refers to the depth of operations consumed in the modulo approximation polynomial operation within the bootstrap operation (e.g., the depth of the modulo approximation polynomial operation). )). "" refers to the bootstrap operation excluding " Beyond the required remaining operational depth, the parameter optimization circuit 1120 can calculate the initial ciphertext CT level based on Equations 3, 5, and 6 according to Equation 7. ) and the number of bootstrap operations ( ).

[0048] [Equation 7]

[0049] The parameter optimization circuit 1120 can determine or calculate the level of the initial ciphertext CT that minimizes the value of Equation 7. ) and the number of bootstrap operations ( The parameter optimization circuit 1120 can be based on the level of the initial ciphertext CT determined to minimize the value of Equation 7. ) and the number of bootstrap operations ( ), to search for the depth of the modulo approximation polynomial operation that can achieve the required accuracy for evaluating circuit 2110 ( ), ). Depth of modulo approximate polynomial operations ( The range of ) can be represented by Equation 8.

[0050] [Equation 8]

[0051] The right side of Equation 8 refers to the number of bootstrap operations (in a given number of iterations). ) Lower module approximate polynomial operation depth ( The maximum value of ). The left side of Equation 8 can refer to the modulo approximate polynomial operation depth when the number of assumed bootstrap operations is one less than the determined number of bootstrap operations (a). When the modulus approximates the polynomial operation depth ( When the initial ciphertext CT level can become greater than the left side of Equation 8, the CT level can be increased. ) and the number of bootstrap operations ( This can optimize the operation of the evaluation circuit 2110. For ease of description, equations 2 to 8 are collectively referred to as the "time complexity equations".

[0052] The encryption parameter OE_PMT may include the level of the initial ciphertext CT determined by the parameter optimization circuit 1120. The bootstrap parameter OB_PMT may include the level of the initial ciphertext CT determined by the parameter optimization circuit 1120. ) and the number of bootstrap operations ( ).

[0053] Figure 3 It is shown in Figure 2A diagram illustrating the encryption process performed within the encryption circuit. (Reference) Figure 2 and Figure 3 The encryption circuit 1110 can encrypt the plaintext PT and output the initial ciphertext CT.

[0054] Encryption circuit 1110 can receive encryption parameters OE_PMT from parameter optimization circuit 1120. Encryption parameters OE_PMT may include the level of the initial ciphertext CT (…). The encryption circuit 1110 can receive the plaintext PT. For example, the plaintext PT may include information related to the electronic device 1000 or its user (e.g., the user's personal information).

[0055] Encryption circuit 1110 can generate initial ciphertext CT by combining random bits RB, plaintext PT, and error E based on encryption parameter OE_PMT. Initial ciphertext CT may include initial text PreT, message M, and error E. In initial ciphertext CT, error E can be set to be less than message M, and message M can be set to be less than initial text PreT.

[0056] Figure 4 This illustrates an example embodiment in Figure 2 The encryption operations performed in the evaluation circuit and by Figure 2 A diagram illustrating the bootstrap operation performed by the bootstrap circuit. (Reference) Figure 2 and Figure 4 The evaluation circuit 2110 can receive a first initial ciphertext CT_a and a second initial ciphertext CT_b from the encryption circuit 1110. However, this is exemplary, and the evaluation circuit 2110 can receive multiple initial ciphertexts CT from the encryption circuit 1110.

[0057] Evaluation circuit 2110 can perform encryption operations on the first initial ciphertext CT_a and the second initial ciphertext CT_b to generate the first ciphertext CT1. However, this is exemplary, and evaluation circuit 2110 can perform multiple encryption operations to generate the first ciphertext CT1. Compared to the initial ciphertexts CT_a and CT_b, in the first ciphertext CT1, the size of the initial text and the size of the message may be reduced, and the size of the error may be increased. In the first ciphertext CT1, the error E_c has increased to its maximum value, and encryption operations may no longer be performed on the first ciphertext CT1.

[0058] The bootstrap circuit 2120 can perform a bootstrap operation on a first ciphertext CT1 that no longer requires encryption. The bootstrap circuit 2120 can reduce the error E_c of the first ciphertext CT1 by removing the least significant bit (LSB) of the first ciphertext CT1 using the bootstrap operation. The bootstrap circuit 2120 can then send a second ciphertext CT2 with the reduced error E_c' to the evaluation circuit 2110. At this time, the bootstrap circuit 2120 can perform the bootstrap operation based on the bootstrap parameter OB_PMT determined by the parameter optimization circuit 1120.

[0059] Figure 5 This illustrates an example embodiment. Figure 2 A table of operational scenarios. (See reference) Figure 2 and Figure 5 The operation scenario OP_SNR can include multiple operations OP1 to OPn. Each of the multiple operations OP1 to OPn can be one of an addition operation, a multiplication operation, and / or an approximation operation. For example, a multiplication operation may introduce errors into the ciphertext, such as... Figure 4 The encryption operation is the same. Approximation operations can include at least one of addition and / or multiplication operations.

[0060] The parameter optimization circuit 1120 can receive the operation scenario OP_SNR from the evaluation circuit 2110. The parameter optimization circuit 1120 can check the encryption operation included in the operation scenario OP_SNR and calculate the system operation depth (D). The parameter optimization circuit 1120 can determine the encryption parameter OE_PMT and the bootstrap parameter OB_PMT by linking the encryption parameter OE_PMT and the bootstrap parameter OB_PMT based on the system operation depth (D).

[0061] Figure 6 It shows the parameter mapping table. Figure 2 The diagram shows the parameter optimization circuit. Figure 7 It is shown Figure 6 A table from an example embodiment of the parameter mapping table. See reference. Figure 6 and Figure 7 The parameter optimization circuit 1120 may include a parameter memory 1121. The parameter memory 1121 may store a parameter mapping table 1122.

[0062] The parameter optimization circuit 1120 can determine the encryption parameter OE_PMT and the bootstrap parameter OB_PMT based on the parameter mapping table 1122. For example, the parameter optimization circuit 1120 can store the parameter mapping table 1122 pre-calculated based on equations 1 to 8.

[0063] The parameter optimization circuit 1120 can receive the operation scenario OP_SNR from the evaluation circuit 2110. The parameter optimization circuit 1120 can confirm the encryption operation included in the operation scenario OP_SNR and calculate the system operation depth (D).

[0064] The parameter optimization circuit 1120 can determine the level of the initial ciphertext CT corresponding to the calculated system operating depth (D) based on the parameter mapping table 1122. ) and the number of bootstrap operations ( For example, in the first case (Case 1), when the system operating depth (D) is calculated as A1, the initial encrypted CT level ( ) and the number of bootstrap operations ( ) can be determined as B1 and C1. Similarly, in cases 2 to m (cases 2 to m), when the system operating depth (D) is calculated as A2 to Am respectively, the level of the initial ciphertext CT ( ) and the number of bootstrap operations ( () can be determined by parameter mapping table 1122.

[0065] The parameter optimization circuit 1120 can confirm the level of the initial encrypted CT determined based on the parameter mapping table 1122. ) and the number of bootstrap operations ( The corresponding modulo approximation polynomial operation depth ( The range (or parameter pool) of ). For example, in the first case (Case 1), the depth of the modulo approximation polynomial operation corresponding to B1 and C1 can be determined ( ) range (e.g., PL11) <d≤PL12)。

[0066] Figure 8 It shows the use of Figure 2 The flowchart shows the method for determining encryption parameters and bootstrap parameters using a parameter optimization circuit. Figure 9 It is a graph with a table showing the relationship between the number of bootstrapping operations based on Equation 3 and the time complexity. Figure 10 This is a graph showing the range (or parameter pool) of the modulo approximate polynomial operation depth determined based on Equation 8. (Reference) Figure 2 and Figure 8 The parameter optimization circuit 1120 generates the encryption parameter OE_PMT and the bootstrap parameter OB_PMT by linking the encryption parameter OE_PMT and the bootstrap parameter OB_PMT, which are optimized for encryption and bootstrap operations, based on the operation scenario OP_SNR.

[0067] In operation S110, the parameter optimization circuit 1120 (or encryption device 1100) can receive the operation scenario OP_SNR. For example, the parameter optimization circuit 1120 can receive the operation scenario OP_SNR from the evaluation circuit 2110 included in the evaluation device 2100.

[0068] In operation S120, the parameter optimization circuit 1120 (or encryption device 1100) can calculate the system operation depth (D) based on the operation scenario OP_SNR. For example, the operation scenario OP_SNR may include, for example, Figure 5 Information corresponding to the operations performed in the evaluation circuit 2110 shown. For example, the parameter optimization circuit 1120 can calculate the number of multiplication operations and / or approximation operations in the operation scenario OP_SNR as the system operation depth (D).

[0069] In operation S130, parameter optimization circuit 1120 (or encryption device 1100) can determine the level of the initial ciphertext CT that can support the system operation depth (D). ) and the number of bootstrap operations ( For example, the parameter optimization circuit 1120 can obtain the level of the initial encrypted CT by applying the system operating depth (D) to equations 1 through 3. ) and the number of bootstrap operations ( ).

[0070] As another example, the parameter optimization circuit 1120 can store parameter mapping tables 1122 (such as...) generated based on equations 1 through 7. Figure 7 The parameter optimization circuit 1120 can obtain the level of the initial ciphertext CT corresponding to the system operating depth (D) based on the parameter mapping table 1122. ) and the number of bootstrap operations ( ).

[0071] For example, refer to Figure 9 The parameter optimization circuit 1120 can obtain the number of bootstrap operations based on Equation 3. The relationship between time complexity and time complexity is shown in curve S130_1. The parameter optimization circuit 1120 can obtain the level of the initial ciphertext CT based on Equation 3. ) and the number of bootstrap operations ( The corresponding table S130_2 is used. The parameter optimization circuit 1120 can determine the number of bootstrap operations based on the curve S130_1. The time complexity is lowest when the number of bootstrapping operations is 3, and the level of the initial ciphertext CT is confirmed in the corresponding table S130_2 when the number of bootstrapping operations is 3. (e.g., 40).

[0072] In operation S140, the parameter optimization circuit 1120 (or encryption device 1100) can optimize the parameters based on the determined level of the initial ciphertext CT. ) and the number of bootstrap operations ( ), to determine the depth of the modulo approximation polynomial operation ( The range (or parameter pool) of the initial ciphertext CT. For example, the parameter optimization circuit 1120 can optimize the range (or parameter pool) of the initial ciphertext CT. ) and the number of bootstrap operations ( ) is applied to Equation 8 to obtain the depth of the modulo approximation polynomial operation ( The range depends on the required accuracy in the evaluation circuit 2110, and the depth of multiple modulo approximation polynomial operations ( ) can be included in the optimal value.

[0073] As another example, the parameter optimization circuit 1120 can be based on Equation 8, such as... Figure 7 The depth of the modulo approximation polynomial operation shown in the figure is ( The range of () is stored in parameter mapping table 1122. Parameter optimization circuit 1120 can obtain the level () of the initial ciphertext CT based on parameter mapping table 1122. ) and the number of bootstrap operations ( The corresponding modulo approximation polynomial operation depth ( ) range.

[0074] For example, refer to Figure 10 The parameter optimization circuit 1120 can obtain curve S140_1 based on equation 8, which shows the level of the initial encrypted CT. ) and the number of bootstrap operations ( The corresponding modulo approximation polynomial operation depth ( In graph S140_1, the parameter optimization circuit 1120 can obtain the number of times the bootstrap operation is performed. The optimal modulo approximation polynomial operation depth when ) is 3 ( ) range.

[0075] In operation S150, the parameter optimization circuit 1120 (or encryption device 1100) can perform operations from the optimal modulo approximation polynomial depth ( Select the final modulo approximation polynomial operation depth from the range that can support the required accuracy of the evaluation circuit 2110. For example, operation S150 can be selectively performed based on various existing optimal value selection methods.

[0076] In operation S160, the parameter optimization circuit 1120 (or encryption device 1100) can be based on the selected final modulus approximation polynomial operation depth ( The parameter optimization circuit 1120 outputs encryption parameters OE_PMT and bootstrap parameters OB_PMT. The parameter optimization circuit 1120 can send encryption parameters OE_PMT to the encryption circuit 1110. The parameter optimization circuit 1120 can send bootstrap parameters OB_PMT to the bootstrap circuit 2120. Since the encryption parameters OE_PMT and bootstrap parameters OB_PMT are set according to the system operating depth (D) of the evaluation circuit 2110, the evaluation circuit 2110 can perform optimal encryption operations based on the ciphertext received from the encryption circuit 1110 and / or the bootstrap circuit 2120.

[0077] Figure 11 This is a block diagram illustrating a user device according to an example embodiment. (Reference) Figure 11 User equipment 30 may include storage device 3000 and host 3500. Storage device 3000 and host 3500 can be connected via host interface 3201. Host interface 3201 may be a standard interface such as ATA, SATA, PATA, USB, SCSI, ESDI, IEEE 1394, IDE and / or card interface.

[0078] Storage device 3000 can be a storage device based on non-volatile memory. For example, storage device 3000 may include storage device 3100, storage controller 3200, and buffer memory 3300. Storage device 3100 may be a non-volatile memory such as flash memory or phase-change memory (PRAM). When storage device 3100 is flash memory, storage device 3000 may be a flash memory-based flash memory device. For example, storage device 3000 may be an SSD, UFS, and / or memory card, etc. Buffer memory 3300 may include volatile memory (e.g., DRAM).

[0079] Storage device 3100 can be connected to storage controller 3200 via storage interface 3202. Storage device 3100 may include storage cell array 3110 and peripheral circuitry. Peripheral circuitry may include all analog or digital circuitry required to store or retrieve data in the storage cell array.

[0080] The peripheral circuitry can receive external power from the memory controller 3200 and generate internal power at various levels. It can also receive commands, addresses, and data from the memory controller 3200 and store the data in the memory cell array according to control signals. Furthermore, the peripheral circuitry can read data stored in the memory cell array and provide the data to the memory controller 3200.

[0081] A storage cell array may include multiple storage blocks. Each storage block may have a vertical three-dimensional structure. Each storage block may include multiple storage cells. Multiple bits of data may be stored in each storage cell. For example, storage device 3100 may be a TLC flash memory capable of storing 3 bits of data in a single storage cell.

[0082] Due to its design and layout, the memory cell array 3110 can be located next to or above the peripheral circuitry. The structure where the memory cell array 3110 is located above the peripheral circuitry is called a COP (Cell-on-Periphery) structure. The memory cell array 3110 can be manufactured as a chip separate from the peripheral circuitry. The upper chip including the memory cell array 3110 and the lower chip including the peripheral circuitry can be connected to each other using a bonding method. This structure is called a C2C (Chip-to-Chip) structure.

[0083] The storage controller 3200 can be connected between the storage device 3100 and the host 3500. Furthermore, the storage controller 3200 can be connected between the buffer memory 3300 and the host 3500. The storage controller 3200 can control read or write operations on the storage device 3100 and / or the buffer memory 3300 in response to requests from the host 3500. The storage controller 3200 can receive host data from the host 3500 and provide host data to the storage device 3100 and / or the buffer memory 3300.

[0084] The storage controller 3200 may include a control unit and working memory. The control unit can control the overall operation of the storage controller 3200. For example, the control unit can control the flash translation layer (FTL) to perform address mapping operations. The control unit may be a commercially available or custom-made microprocessor.

[0085] The working memory can be a cache memory (e.g., SRAM). The working memory can be used as a buffer memory 3300 for temporary data storage. Furthermore, the working memory can be the drive memory of the memory controller 3200. The working memory can drive the FTL.

[0086] Buffer memory 3300 can be connected to memory controller 3200 via buffer interface 3203. For example, buffer memory 3300 can be used to temporarily store data to be stored in or read from memory device 3100. Furthermore, a cache area capable of storing cached data can be allocated to buffer memory 3300. Buffer memory 3300 can be implemented using DRAM and / or SRAM, etc. Buffer memory 3300 can be included in memory device 3100 or memory controller 3200.

[0087] The host 3500 may include a processor and host memory. The processor and host memory may be connected via an address / data bus. The host 3500 may be a personal digital assistant (PDA), a computer, a digital audio player, a digital camera, and / or a mobile phone, etc. The host memory may be non-volatile or volatile memory in the form of cache, ROM, PROM, EPROM, EEPROM, flash memory, SRAM, DRAM, etc.

[0088] Host memory can drive multiple software or firmware components. For example, host memory can drive the operating system (OS), applications, file systems, storage managers, and I / O drives.

[0089] The storage controller 3200 may include an encryption device 3220. The encryption device 3220 may include [missing information - likely related to encryption technology]. Figure 2 The encryption device 3220 has the same or similar configuration and characteristics as the encryption device 1100. The encryption device 3220 can encrypt user data stored in the storage unit array 3110. When a request for user data stored in the storage unit array 3110 is received from the host 3500, the storage device 3000 can send the ciphertext corresponding to the user data encrypted by the encryption device 3220 to the host 3500.

[0090] The host 3500 may include an evaluation device 3510. The evaluation device 3510 may include... Figure 2 The evaluation device 3510 has the same or similar configuration and characteristics as the evaluation device 2100. The evaluation device 3510 may include an evaluation circuit 3511 and / or a bootstrap circuit 3512. The evaluation circuit 3511 and the bootstrap circuit 3512 may include configurations and characteristics similar to those of the evaluation device 2100. Figure 2 The evaluation circuit 2110 and the bootstrap circuit 2120 have the same or similar configuration and characteristics.

[0091] The encryption device 3220 can receive an operational scenario from the evaluation circuit 3511. Based on the operational scenario, the encryption device 3220 can calculate the system operational depth of the evaluation circuit 3511. The encryption device 3220 can generate parameters to be used in the encryption device 3220 and the bootstrap circuit 2120 so that the encryption device 3220 and the bootstrap circuit 2120 can be optimized collaboratively with each other based on the system operational depth of the evaluation circuit 3511.

[0092] Figure 12 This illustrates an example embodiment. Figure 11 A block diagram of the storage controller. (See reference) Figure 12 The storage controller 3200 may include a host interface 3201, a storage interface 3202, a buffer interface 3203, a control unit 3210, and a working memory 3220.

[0093] although Figure 12Although not shown, the storage controller 3200 may also include various other components. For example, the storage controller 3200 may also include ECC circuitry, a command generation module, etc. The ECC circuitry can generate error correction codes (ECC) to correct failure bits or error bits in data received from the storage device 3100. The command generation module can generate commands (CMDs) for controlling memory operations based on requests from the host 3500.

[0094] The host interface 3201 provides an interface between the host 3500 and the storage controller 3200. Standard interfaces include various interface methods such as Advanced Technology Attachment (ATA), Serial ATA (SATA), External SATA (e-SATA), Small Computer Small Interface (SCSI), Serial Attached SCSI (SAS), Peripheral Component Interconnect (PCI), PCI Express (PCI-E), IEEE 1394, Universal Serial Bus (USB), Secure Digital (SD) card, Multimedia Card (MMC), Embedded Multimedia Card (eMMC), Universal Flash Memory (UFS), and Compact Flash Memory (CF) card interfaces.

[0095] The memory interface 3202 provides an interface between the storage device 3100 and the storage controller 3200. For example, data can be written to or received from the storage device 3100 via the memory interface 3202. The memory interface 3202 can provide commands and addresses to the storage device 3100. Furthermore, the memory interface 3202 can provide the storage controller 3200 with data read from the storage device 3100.

[0096] The buffer interface 3203 can provide an interface between the buffer memory 3300 and the storage controller 3200. For example, data temporarily stored in the buffer memory 3300 can be sent to and received from the buffer memory 3300 through the buffer interface 3203.

[0097] The control unit 3210 may include a central processing unit, a microprocessor, etc., and can control the overall operation of the storage controller 3200. The control unit 3210 can drive the firmware loaded in the working memory 3220 to control the storage controller 3200.

[0098] The encryption device 3220 may include encryption circuit 3221 and / or parameter optimization circuit 3222. Encryption circuit 3221 and parameter optimization circuit 3222 may include... Figure 2 The encryption circuit 1110 and the parameter optimization circuit 1120 have the same or similar configurations and characteristics.

[0099] The encryption circuit 3221 can encrypt user data stored in the storage unit array 3110. When a request for user data stored in the storage unit array 3110 is received from the host 3500, the encryption circuit 3221 can send the ciphertext corresponding to the requested user data to the host 3500.

[0100] The parameter optimization circuit 3222 can receive the operational scenario from the evaluation circuit 3511. Based on the operational scenario, the parameter optimization circuit 3222 can calculate the system operational depth of the evaluation circuit 3511. For example... Figures 2 to 10 As described, the parameter optimization circuit 3222 can generate parameters (e.g., encryption parameter OE_PMT and bootstrap parameter OB_PMT) to be used in the encryption device 3220 and the bootstrap circuit 2120 so that the encryption device 3220 and the bootstrap circuit 2120 can be optimized in a cooperative manner based on the system operation depth of the evaluation circuit 3511.

[0101] According to this disclosure, it is possible to simultaneously optimize the encryption operation of the encryption device and the bootstrapping operation of the evaluation device in a synergistic manner.

[0102] Although this disclosure has been described with reference to embodiments thereof, it will be apparent to those skilled in the art that various changes and modifications may be made to this disclosure without departing from the spirit and scope of the disclosure as set forth in the claims.

Claims

1. An encryption device, the encryption device comprising: An encryption circuit configured to encrypt plaintext including user data and output initial ciphertext; and A parameter optimization circuit is configured to receive an operational scenario from an external evaluation device and generate encryption parameters and bootstrap parameters. The encryption parameters are used in the encryption circuit to generate the initial ciphertext, and the bootstrap parameters are used in the external evaluation device. The parameter optimization circuit generates the encryption parameters that are optimized in conjunction with the bootstrap parameters based on the operating scenario.

2. The encryption device according to claim 1, wherein, The parameter optimization circuit is configured to calculate the system operation depth of the external evaluation device based on the operating scenario.

3. The encryption device according to claim 2, wherein, The parameter optimization circuit is configured as follows: The system complexity equation of the external evaluation device is converted into a time complexity equation, and The system operation depth is applied to the time complexity equation to determine the level of the initial ciphertext and the number of bootstrap operations of the bootstrap circuit included in the external evaluation device.

4. The encryption device according to claim 3, wherein, The parameter optimization circuit is configured as follows: The initial ciphertext level and the number of bootstrapping operations are applied to the time complexity equation, and Based on the required accuracy of the external evaluation device, the range of the modulo approximate polynomial operation depth of the external evaluation device is determined.

5. The encryption device according to claim 4, wherein, The parameter optimization circuit is configured to determine a final modulo approximation polynomial operation depth within the range of the modulo approximation polynomial operation depth that satisfies the accuracy required by the external evaluation device.

6. The encryption device according to claim 5, wherein, The parameter optimization circuit is configured to output the encryption parameters and the bootstrap parameters in tandem with each other, based on the final modulus approximation polynomial operation depth.

7. The encryption device according to claim 3, wherein, The parameter optimization circuit is configured as follows: Store a parameter mapping table pre-generated based on the time complexity equation, and The level of the initial ciphertext and the number of bootstrapping operations corresponding to the system operation depth are determined based on the parameter mapping table.

8. The encryption device according to claim 7, wherein, The parameter optimization circuit is configured to determine, based on the parameter mapping table, the range of the modulo approximate polynomial operation depth of the external evaluation device corresponding to the determined level of the initial ciphertext and the number of bootstrapping operations.

9. A method for configuring parameters for an encryption device, the method comprising: Receive operational scenarios from external evaluation devices; Calculate the system operation depth of the external evaluation device based on the described operation scenario; Determine the level of the initial ciphertext that supports the depth of system operation and the number of bootstrap operations performed by the external evaluation device; as well as The range of the modulo approximate polynomial operation depth of the external evaluation device is determined based on the level of the initial ciphertext and the number of bootstrapping operations.

10. The method according to claim 9, wherein, The calculation of the system operation depth includes determining the system operation depth based on the number of addition operations and approximation operations included in the operation scenario.

11. The method of claim 10, wherein, The determination of the level of the initial ciphertext and the number of bootstrapping operations include: The system complexity equation of the external evaluation device is converted into a time complexity equation; and The level of the initial ciphertext and the number of bootstrapping operations are determined by applying the system operation depth to the time complexity equation.

12. The method of claim 11, wherein, The range for determining the depth of the modulo approximate polynomial operation includes: The level of the initial ciphertext and the number of bootstrapping operations are applied to the time complexity equation, and Based on the required accuracy of the external evaluation device, the range of the depth of the modulo approximation polynomial operation of the external evaluation device is determined.

13. The method according to claim 9, further comprising: Determine the final modulo approximation polynomial operation depth within the range of the modulo approximation polynomial operation depths to satisfy the accuracy required by the external evaluation device.

14. The method according to claim 13, further comprising: Based on the final modulus approximate polynomial operation depth, encrypted parameters are output in coordination with the bootstrap parameters used in the external evaluation device.

15. The method of claim 11, wherein, The determination of the level of the initial ciphertext and the number of bootstrapping operations include: Store a parameter mapping table pre-generated based on the time complexity equation, and The level of the initial ciphertext and the number of bootstrapping operations are determined based on the parameter mapping table.

16. A storage device, the storage device comprising: The storage device includes an array of storage units for storing user data; and A storage controller, configured to control the storage device to input and output the user data, is provided. The storage controller includes: An encryption circuit, configured to encrypt the user data and output initial ciphertext; and A parameter optimization circuit, configured to determine the encryption parameters used in the encryption circuit, and The parameter optimization circuit is configured to receive an operation scenario from the host's evaluation device and generate, based on the operation scenario, the encryption parameters that are optimized in conjunction with the bootstrap parameters used in the evaluation device.

17. The storage device according to claim 16, wherein, The parameter optimization circuit is configured to calculate the system operating depth of the evaluation device based on the operating scenario.

18. The storage device according to claim 17, wherein, The parameter optimization circuit is configured as follows: The system complexity equation of the evaluation device is converted into a time complexity equation, and The system operation depth is applied to the time complexity equation to determine the level of the initial ciphertext and the number of bootstrap operations of the bootstrap circuit included in the evaluation device.

19. The storage device according to claim 18, wherein, The parameter optimization circuit is configured as follows: The level of the initial ciphertext and the number of bootstrapping operations are applied to the time complexity equation, and Based on the required accuracy of the evaluation device, the range of the modulo approximate polynomial operation depth of the evaluation device is determined.

20. The storage device according to claim 19, wherein, The parameter optimization circuit is configured to output the encryption parameters and the bootstrap parameters in a mutually coordinated manner, based on a modulo approximation polynomial operation depth selected within the range of the modulo approximation polynomial operation depth.

Images