Storage system

Abstract

One embodiment provides a storage system capable of enhancing the security of access to memory. According to this embodiment, the storage system includes non-volatile memory and a controller. The controller enables a first access right granted to at least a portion of a storage area of ​​the non-volatile memory, namely a first storage area, based on first user identification information, and sets a first period until the first access right becomes invalid. When the first period expires, the controller invalidates the first access right accordingly.

Description

[0001] This application is a divisional application of application number 202110931264.9, filed on August 13, 2021, entitled "Storage System".

[0002] Related applications

[0003] This application claims priority to Japanese Patent Application No. 2021-21773 (filed on February 15, 2021). This application incorporates the entire contents of that basic application by reference. Technical Field

[0004] Embodiments of the present invention relate to techniques for controlling a storage system having non-volatile memory. Background Technology

[0005] In recent years, storage systems with non-volatile memory have become widely used. One such storage system is the solid-state drive (SSD), which incorporates NAND flash memory. SSDs are used as the main storage in various computing devices.

[0006] To prevent data leakage, storage systems sometimes have a self-encryption function that automatically encrypts data during writing. Storage systems with self-encryption functionality are also known as self-encrypting drives (SED).

[0007] As one of the security standards that SEDs should follow, there are standards from the Trusted Computing Group (TCG). TCG standards, for example, specify data encryption and access control for each region of storage. Summary of the Invention

[0008] One implementation provides a storage system capable of enhancing the security of access to the storage.

[0009] According to one embodiment, the storage system includes non-volatile memory and a controller. The controller enables a first access right granted to first user identification information for at least a portion of a storage area of ​​the non-volatile memory, namely a first storage area, and sets a first period until the first access right becomes invalid. The controller invalidates the first access right when the first period has elapsed since the current time. Attached Figure Description

[0010] Figure 1 This is a block diagram illustrating an example configuration of an information processing system including the storage system of the first embodiment.

[0011] Figure 2This is a diagram illustrating an example of actions for validating and invalidating access rights granted to user identification information (user ID) in the storage system of the first embodiment.

[0012] Figure 3 This is a diagram illustrating an example of a storage area in the storage system of the first embodiment where access rights are controlled.

[0013] Figure 4 This is a diagram illustrating an example of the structure of a Temporary Authority table used in the storage system of the first embodiment.

[0014] Figure 5 This is a diagram illustrating an example of the relationship between the data encryption key (DEK) and authentication information used for data encryption and decryption in the storage system of the first embodiment.

[0015] Figure 6 This is a diagram illustrating an example of a read operation in the storage system of the first embodiment, corresponding to whether the access right corresponding to the user ID is valid.

[0016] Figure 7 This is a diagram illustrating an example of a write operation in the storage system of the first embodiment, corresponding to whether the access right corresponding to the user ID is valid.

[0017] Figure 8 This diagram illustrates an example of access control in a storage system according to the first embodiment, where multiple users use a single user ID.

[0018] Figure 9 This is a flowchart illustrating an example of the order in which permission setting processes are performed in the storage system of the first embodiment.

[0019] Figure 10 This is a flowchart illustrating an example of the order in which permission invalidation processing is performed in the storage system of the first embodiment.

[0020] Figure 11 This is a flowchart illustrating an example of the order in which user authentication processes are performed in the storage system of the first embodiment.

[0021] Figure 12 This is a flowchart illustrating an example of the order in which read instruction processing is performed in the storage system of the first embodiment.

[0022] Figure 13 This is a flowchart illustrating an example of the order in which write instructions are processed in the storage system of the first embodiment.

[0023] Figure 14This is a block diagram illustrating an example configuration of an information processing system including the storage system of the second embodiment. Detailed Implementation

[0024] The embodiments will now be described with reference to the accompanying drawings.

[0025] (First Implementation)

[0026] First, refer to Figure 1 The configuration of the information processing system 1 according to the first embodiment will be described. The information processing system 1 includes a host device 2 (hereinafter referred to as host 2) and a storage system 3.

[0027] Host 2 is an information processing device. Host 2 can be a storage server that stores large amounts of diverse data in storage system 3, or it can be a personal computer.

[0028] Storage system 3 is a semiconductor storage device configured to write data to and read data from non-volatile memory 6, such as NAND flash memory, and is also referred to as a storage device. Storage system 3 can be implemented, for example, as a solid-state drive (SSD) equipped with NAND flash memory. Hereinafter, the case of storage system 3 being implemented as an SSD will be mainly illustrated, but storage system 3 can also be implemented as a hard disk drive (HDD).

[0029] To prevent data leakage, storage system 3 has a self-encryption function that automatically encrypts data during writing. In other words, storage system 3 is a self-encrypting drive (SED). Storage system 3, for example, follows the Trusted Computing Group (TCG) standard and has the self-encryption functions defined under the TCG standard. The TCG standard specifies, for example, data encryption and access control for each region of the storage.

[0030] Storage system 3 can be used as storage for host 2. Storage system 3 can be built into host 2 or connected to host 2 via cable or network.

[0031] The interface used to connect host 2 and storage system 3 conforms to standards such as SCSI, Serial Attached SCSI (SAS), ATA, Serial ATA (SATA), PCI Express (PCIe) (registered trademark), Ethernet (registered trademark), Fibre channel, and NVM Express (NVMe) (registered trademark).

[0032] The host 2 includes, for example, a CPU 21, random access memory (RAM) 22, read-only memory (ROM) 24, and a controller 25. RAM 22 is, for example, static random access memory (SRAM). ROM 24 is, for example, NOR flash memory.

[0033] CPU 21 is a processor that controls the operation of various components within host 2. CPU 21 executes, for example, various programs loaded from ROM 24 into RAM 22. These programs include the Basic Input / Output System (BIOS), the Operating System (OS), and various application programs. The BIOS is a program used for hardware control.

[0034] The controller 25 functions as a circuit for communication between the controller and the storage system 3. Additionally, the controller 25 includes a power supply unit 251. The power supply unit 251 controls the power supplied to the storage system 3, for example, using power supplied to the host 2 from an external power source (not shown). Specifically, the power supply unit 251 supplies power to the storage system 3 during periods when the host 2 is operating (i.e., when the host 2 is in a powered-on state). During periods when the host 2 is not operating (i.e., when the host 2 is in a powered-off state), the power supply unit 251 does not supply power to the storage system 3.

[0035] The storage system 3 includes, for example, a memory controller 4, a power storage device 5, and non-volatile memory 6. The memory controller 4 can be implemented using circuitry such as a system-on-a-chip (SoC).

[0036] The energy storage device 5 functions as a power source in the event that the power supplied from the power supply unit 251 is cut off. The energy storage device 5 can be implemented, for example, as a button cell or a double-layer capacitor.

[0037] Non-volatile memory 6 comprises multiple blocks. Each block contains multiple pages. A block functions as the smallest unit for data erasure operations. A block is sometimes referred to as an "erase block" or a "physical block." Each page contains multiple memory cells connected to a single word line. A page functions as the unit for both data write and data read operations. Additionally, a single word line can also function as the unit for both data write and data read operations.

[0038] There is an upper limit to the number of program / erase cycles (P / E cycles) for each block, called the maximum number of P / E cycles. One P / E cycle for a block includes the erase operation to put all memory cells in the block into an erased state and the write operation to write data to each page of the block.

[0039] The memory controller 4 functions as a controller for controlling the non-volatile memory 6.

[0040] The memory controller 4 includes, for example, a host interface (host I / F) 11, a buffer 12, RAM 13, ROM 14, encryption circuitry 15, memory I / F 16, a real-time clock (RTC) 17, and a CPU 18. These host I / F 11, buffer 12, RAM 13, ROM 14, encryption circuitry 15, memory I / F 16, RTC 17, and CPU 18 can also be connected via bus 10.

[0041] RAM13 is, for example, SRAM. ROM14 is, for example, NOR flash memory. Alternatively, RAM13 may be installed outside the memory controller 4, in addition to RAM13, or RAM (e.g., DRAM) may be provided outside the memory controller 4. In this case, a control circuit configured to control access to the external RAM is provided in the memory controller 4.

[0042] The memory controller 4 can also function as a flash translation layer (FTL) configured to perform data management and block management of the non-volatile memory 6. The data management performed by this FTL includes: (1) management of mapping information representing the correspondence between logical addresses and physical addresses of the non-volatile memory 6; and (2) processing for hiding page-based read / write operations and block-based erase operations. Block management includes management of bad blocks, wear leveling, and garbage collection (GC). Furthermore, logical addresses are addresses used by the host 2 for addressing the storage system 3. Logical addresses are, for example, logical block addresses (LBAs). The following primarily illustrates the use of LBAs as logical addresses.

[0043] The management of the mapping between each LBA and each physical address is performed using a logical physical address translation table 132. The memory controller 4 uses the logical physical address translation table 132 to manage the mapping between each LBA and each physical address in units of a specific management size. The physical address corresponding to a certain LBA indicates the physical storage location within the non-volatile memory 6 where data is written to that LBA. The logical physical address translation table 132 can also be loaded from the non-volatile memory 6 into the RAM 13 when the memory system 3 is powered on.

[0044] Data writing to a page can be performed only once per P / E cycle. Therefore, the memory controller 4 will not write the updated data corresponding to a certain LBA to the physical memory location where the previous data corresponding to that LBA is stored, but to another physical memory location. Furthermore, the memory controller 4 invalidates the previous data by updating the logical physical address translation table 132 in a way that associates the LBA with that other physical memory location. Data referenced from the logical physical address translation table 132 (i.e., data associated with an LBA) is called valid data. Data not associated with any LBA is called invalid data. Valid data is data that may be read from the host 2 later. Invalid data is data that can no longer be read from the host 2.

[0045] The memory controller 4 manages at least one memory region obtained by logically dividing the memory regions of the non-volatile memory 6. The memory regions of the non-volatile memory 6 are, for example, allocated as a system region 31 and a user region 32.

[0046] In system area 31, for example, authentication information 311 and key information 312 are stored.

[0047] Authentication information 311 is used to verify the legitimacy of administrators and users using host 2. Hereinafter, the identification information corresponding to administrator privileges will be referred to as the Administrator ID, and the user identification information will be referred to as the User ID. Authentication information 311 may include, for example, authentication information for the Administrator ID and authentication information for each User ID.

[0048] A user ID is information used to identify a user who uses host 2 to access storage system 3. One user ID may be used by one user, for example. Alternatively, one user ID may be used by multiple users. For example, one user ID may be used by one user at one time and by another user at other times.

[0049] Authentication information for administrator IDs and user IDs can be provided, for example, using a Personal Identification Number (PIN) or a password. Authentication information 311 may also include the hash value of the PIN and the hash value of the password.

[0050] Key information 312 contains information related to the data encryption key (DEK). The DEK is used to encrypt data written to the non-volatile memory 6 and to decrypt data read from the non-volatile memory 6. Key information 312 may also include an encrypted DEK that encrypts the DEK. The encrypted DEK is obtained, for example, by encrypting the DEK with a key encryption key (KEK) generated using authentication information of the administrator ID and authentication information of each user ID.

[0051] Authentication information 311 and / or key information 312 may, for example, be loaded from non-volatile memory 6 into RAM 13 when storage system 3 starts up.

[0052] User area 32 is the area where user access is controlled using authentication information 311.

[0053] The host I / F11 functions as a circuit that receives various instructions from the host 2, such as I / O instructions, control instructions, and TCG instructions. I / O instructions may include write and read instructions. Control instructions may include unmapping instructions (trim instructions) and formatting instructions. Formatting instructions are used to unmapping the entire storage system 3. Additionally, TCG instructions may include instructions for requesting authentication of the storage system 3, setting changes related to access to the non-volatile memory 6, etc. Furthermore, the host I / F11 functions as a circuit that sends responses, data, control instructions, etc., corresponding to the received instructions to the host 2.

[0054] Buffer 12 is, for example, DRAM. Buffer 12 is a storage area that temporarily stores data to be written to and read from non-volatile memory 6. The storage area of ​​buffer 12 is allocated to areas used, for example, as a read buffer, write buffer, or garbage collection (GC) buffer.

[0055] The storage area of ​​RAM13 is allocated to, for example, the storage area of ​​firmware (FW) 131, the cache area of ​​logical-physical address translation table 132, and the storage area of ​​temporary permission table 133. The storage area of ​​RAM13 can also be allocated to buffer areas used as read buffers, write buffers, and GC buffers.

[0056] FW131 is a program used to control the operation of memory controller 4. FW131 is loaded into RAM 13, for example, from non-volatile memory 6 or ROM 14.

[0057] Logical-to-physical address translation table 132 manages the mapping between each LBA and each physical address of the non-volatile memory 6.

[0058] Temporary permission table 133 manages the validity or invalidation of access rights granted to a user ID to at least a portion of the storage area of ​​non-volatile memory 6, and the validity period until the access rights become invalid.

[0059] Encryption circuit 15 encrypts and decrypts user data. Encryption circuit 15 encrypts user data written to non-volatile memory 6 via memory I / F 16. Encryption circuit 15 decrypts user data read from non-volatile memory 6 via memory I / F 16. Encryption circuit 15 uses, for example, a DEK set by CPU 18 in encryption and decryption.

[0060] The memory I / F16 electrically connects the memory controller 4 to the non-volatile memory 6. The memory I / F16 is compatible with interface standards such as ToggleDDR and Open NAND Flash Interface (ONFI).

[0061] The memory I / F16 functions as a NAND control circuit that controls the non-volatile memory 6. The memory I / F16 can also be connected to multiple memory chips within the non-volatile memory 6 via multiple channels. By driving multiple memory chips in parallel, a wide bandwidth for accessing the entire non-volatile memory 6 can be achieved.

[0062] RTC17 is a clock that operates independently of whether power is supplied to the storage system 3 from an external source. RTC17 provides the current time based on requests from various components within the storage system 3 (e.g., CPU 18). RTC17 operates using the supplied power while power is being supplied to the storage system 3 from the power supply unit 251 of the host 2. Furthermore, when power is not being supplied to the storage system 3 from the power supply unit 251, RTC17 operates using power supplied from the energy storage device 5. That is, the energy storage device 5 supplies power to RTC17 when the power supply from the power supply unit 251 is cut off.

[0063] CPU 18 is a processor configured to control the various parts within memory controller 4. CPU 18 performs various processes by executing FW131, which is loaded from non-volatile memory 6 into RAM 13. FW131 is a control program containing a set of commands for causing CPU 18 to perform various processes. CPU 18 is capable of instruction processing, etc., for processing various instructions from host 2. The operation of CPU 18 is controlled by FW131 executed by CPU 18.

[0064] The functions of each part within the memory controller 4 can be implemented either by dedicated hardware within the memory controller 4, by CPU 18 executing FW131, or by a combination of these methods.

[0065] Next, a method for validating and invalidating access rights granted to the user to at least a portion of the storage area of ​​the non-volatile memory 6 will be described.

[0066] In the SED, for example, a first setting instruction issued with administrator privileges enables the first user's access right to the first area of ​​user area 32 within the non-volatile memory 6. Conversely, in the SED, a second setting instruction issued with administrator privileges disables the first user's access right to the first area. The first and second setting instructions are, for example, Set instructions from the TCG standard.

[0067] In methods that enable or disable access rights based on configuration commands issued by administrators, for example, due to errors in command execution, users who should be disabled might remain enabled. This situation poses a risk of data leakage and tampering.

[0068] For example, consider a scenario where you want to make access rights to storage system 3 granted to a member temporarily participating in a project valid only during their participation period. In this case, at the end of the participation period, the administrator (i.e., a user with administrator privileges) issues a setting command to invalidate the access rights, thereby appropriately controlling the member's access rights.

[0069] However, if the issued instructions are incorrect or the setting instructions are forgotten, a member whose access rights should have become invalid may still be able to access the non-volatile memory 6. This poses a risk of data leakage and tampering.

[0070] Therefore, in the information processing system 1 of this embodiment, when validating a user's access right, a validity period until the access right becomes invalid is also set. Specifically, for example, a setting instruction is imported to request the validity of the access right and to set the validity period until the access right becomes invalid. If the storage system 3 exceeds the set validity period at the current time, it automatically invalidates the access right. As described above, at the current time, even if no power is supplied to the storage system 3, power is obtained from the RTC 17, which is capable of operating with power supplied by the energy storage device 5.

[0071] Therefore, when the administrator should invalidate a user's access rights, there is no need to perform the operation of issuing the invalidation command. Thus, it is possible to avoid access rights that should be invalidated remaining valid due to command errors. Therefore, it is possible to prevent unintentional user access to non-volatile memory 6.

[0072] Storage system 3 allows access to non-volatile memory 6 to users with valid access rights and legitimate authentication information. This reduces the risk of data leakage and tampering, and enhances the security of access to non-volatile memory 6.

[0073] In order to perform the operations described above, the CPU 18 functions as, for example, the access control unit 181, the read control unit 182, and the write control unit 183. The CPU 18 performs these functions, for example, by executing FW 131.

[0074] Access control unit 181 controls access to at least a portion of the storage area of ​​non-volatile memory 6. Access control unit 181 uses, for example, a temporary permission table 133 in access control. Access control unit 181 uses temporary permission table 133 to manage the validity or invalidation of access rights granted to a user ID for at least a portion of the storage area of ​​non-volatile memory 6, and the validity period until the access right becomes invalid. Access control unit 181 uses temporary permission table 133 to, for example, make valid the access right (first access right) granted to a first user ID for at least a portion of the storage area of ​​non-volatile memory 6, and sets a first period until the first access right becomes invalid. Furthermore, if the set validity period expires at the current time, access control unit 181 invalidates the first access right.

[0075] Access control unit 181 receives an instruction associated with a user ID from host 2. The instruction may contain, for example, the associated user ID or information that can identify that user ID. Alternatively, access control unit 181 may retrieve the user ID associated with the instruction along with the instruction.

[0076] Access control unit 181 uses temporary permission table 133 to determine whether the access rights granted to the associated user ID are valid or invalid. Then, access control unit 181 decides whether the instruction can be executed based on the determination result. Specifically, if the access rights granted to the user ID are valid, access control unit 181 controls each unit within storage system 3 to execute processing corresponding to the instruction. Conversely, if the access rights granted to the user ID are invalid, access control unit 181 controls each unit within storage system 3 to, for example, notify host 2 of an error.

[0077] The following describes the case where the instruction received from host 2 is a request for authentication from an administrator or user. Furthermore, from this perspective, instructions requesting authentication from an administrator or user will also be referred to as authentication request instructions. Authentication request instructions contain information identifying the administrator (Administrator ID) or the user (User ID), and authentication information (such as a PIN).

[0078] Upon receiving an authentication request instruction from a user, access control unit 181 performs authentication processing corresponding to the authentication request instruction if the access right granted to the user ID is valid. If the access right granted to the user ID is invalid, access control unit 181 notifies host 2 of an error, for example. The authentication processing is used to verify the legitimacy of the authentication information contained in the authentication request instruction.

[0079] Next, we will explain the case where the instruction received from host 2 is an access instruction requesting access to non-volatile memory 6. Access instructions include, for example, read and write instructions. Access instructions can also be other instructions requesting access to non-volatile memory 6, such as unmapping instructions, formatting instructions, and verification instructions.

[0080] After successful user authentication, access control unit 181 accepts the access command associated with the user's user ID. Furthermore, if user authentication fails, access control unit 181 notifies host 2 of an error for the access command associated with the user's user ID.

[0081] Access control unit 181 accepts access instructions associated with a user ID, and if the access rights granted to the user ID are valid, executes processing corresponding to the access instruction. For example, if the access instruction is a read instruction, access control unit 181 causes read control unit 182 to execute processing corresponding to the read instruction. Furthermore, for example, if the access instruction is a write instruction, access control unit 181 causes write control unit 183 to execute processing corresponding to the write instruction.

[0082] Reference Figures 2 to 6 Examples of the specific operations of the access control unit 181, the read control unit 182, and the write control unit 183 will be explained.

[0083] Figure 2 This describes the actions used to validate and invalidate access rights granted to a user ID. Access rights granted to a user ID are validated after successful administrator authentication. Therefore, host 2 and storage system 3 first perform the authentication process for the administrator.

[0084] Specifically, first, host 2 sends an administrator authentication request instruction to storage system 3. Figure 2 (1)). The administrator's authentication request instruction may include, for example, the administrator ID and authentication information.

[0085] The access control unit 181 of storage system 3 receives an authentication request instruction. The access control unit 181 calculates the hash value of the authentication information contained in the authentication request instruction. A predefined hash function is used to calculate the hash value. The access control unit 181 obtains the hash value of the administrator's authentication information from authentication information 311. Figure 2(2)). If the calculated hash value matches the hash value of the obtained administrator authentication information, the access control unit 181 determines that the administrator's authentication is successful. Then, the access control unit 181 notifies the host 2 of the successful authentication. Figure 2 (3) in the middle.

[0086] If the calculated hash value differs from the hash value of the obtained administrator authentication information, the access control unit 181 determines that the administrator's authentication has failed. In this case, the access control unit 181 notifies host 2 of the authentication failure. Figure 2 (3) in the middle.

[0087] The following describes the actions for controlling access rights granted to a user ID to at least a portion of the storage area of ​​non-volatile memory 6. These access control actions are performed upon successful administrator authentication. These actions include actions to enable and invalidate access rights. The storage area of ​​the object whose access rights are controlled is also called the object area.

[0088] Figure 3 An example representing an object region. Access control unit 181 controls access rights to at least one memory region obtained by logically dividing the memory region of non-volatile memory 6. More specifically, access control unit 181 controls, for example, access rights to at least one region obtained by logically dividing user region 32 within non-volatile memory 6. Each region obtained by logically dividing user region 32 is also called a range. One range corresponds to one LBA range. Access control unit 181 controls, for example, the access rights assigned to administrator ID and user ID on a range basis.

[0089] exist Figure 3 In the example shown, Range1 is set in user area 32. Range1 corresponds to the LBA range from 0xF to 0xFF. Additionally, the access rights granted to Range 1 by the administrator ID "Admin" and user ID "TmpUser1" are enabled.

[0090] In this situation, the access control unit 181 controls access to Range1 so that an administrator with valid authentication information can access Range1. The access control unit 181 also controls access to Range1 so that a user using TmpUser1 with valid authentication information can access Range1. Furthermore, the access control unit 181 prevents users with user IDs other than TmpUser1 from accessing Range1.

[0091] Access control unit 181 uses temporary permission table 133 to control access rights.

[0092] Figure 4 This represents an example of the structure of temporary permission table 133. Temporary permission table 133 may include multiple entries corresponding to multiple user IDs. Each entry may include, for example, a user ID field, a temporary permission enable field, a start time field, and a validity period field.

[0093] In the entry corresponding to a user ID, the user ID field represents that user ID.

[0094] The temporary permission enable field indicates whether the access right granted to the corresponding user ID to at least a portion of the storage area (e.g., one interval) of the non-volatile memory 6 is valid or invalid. If the access right is valid, the temporary permission enable field is set to "true" for example. If the access right is invalid, the temporary permission enable field is set to "false" for example.

[0095] The Start Time field indicates the moment when the access rights granted to the corresponding user ID were valid. The start time field can be either a date or a date and time.

[0096] The validity period field indicates the period until the access rights granted to the corresponding user ID become invalid. The validity period can be represented by a date or date and time. Alternatively, the validity period can be a period starting from the time indicated in the start time field. This period can be expressed in any unit of time, such as year, month, or day. If the validity period indicated in the validity period field has expired at the current time, the access rights granted to the corresponding user ID are invalidated.

[0097] In the following description of temporary permissions table 133, the value shown in the User ID field will also be referred to simply as User ID. The same applies to the values ​​shown in the other fields.

[0098] exist Figure 4 In the example shown, the temporary permission corresponding to user ID "TmpUser1" is enabled as "true". The start time corresponding to user ID "TmpUser1" is "2020 / 10 / 1". The validity period corresponding to user ID "TmpUser1" is "2020 / 10 / 31". Therefore, the entry containing user ID "TmpUser1" indicates that the access rights granted to TmpUser1 are valid from October 1, 2020 to October 31, 2020.

[0099] The temporary permission for user ID "TmpUser2" is enabled as "false". No values ​​are set for the start time and validity period for user ID "TmpUser2" (null). Therefore, an entry containing user ID "TmpUser2" indicates that the access rights granted to TmpUser2 are invalid.

[0100] Additionally, the temporary permission corresponding to user ID "TmpUser3" is enabled as "false". No values ​​are set for the start time and validity period corresponding to user ID "TmpUser3". Therefore, an entry containing user ID "TmpUser3" indicates that the access rights granted to TmpUser3 are invalid.

[0101] Furthermore, an access count field and a maximum access count field can also be set in each entry of the temporary permission table 133. The access count field indicates the number of times the corresponding user ID accesses the non-volatile memory 6. The maximum access count field indicates the maximum number of times the corresponding user ID is allowed to access the non-volatile memory 6. In this case, the access control unit 181 invalidates the access right granted to the corresponding user ID, for example, if at least one of the following conditions is met: the validity period has expired at the current time or the access count has reached the maximum access count.

[0102] Alternatively, in each entry of the temporary permission table 133, fields for the number of accesses and the maximum number of accesses can be set instead of fields for the start time and validity period. In this case, if the number of accesses reaches the maximum number of accesses, the access control unit 181 invalidates the access rights granted to the corresponding user ID.

[0103] In addition, in each entry of the temporary permissions table 133, in addition to fields for start time and validity period, number of accesses and maximum number of accesses, various fields related to the conditions that invalidate the access rights granted to the corresponding user ID can also be set.

[0104] return Figure 2 After notifying the administrator of successful authentication, host 2 sends (issues) configuration commands to storage system 3 with administrator privileges. Figure 2(4)). This setting instruction is an instruction that requests to enable access rights granted to a user ID to at least a portion of the storage area of ​​the non-volatile memory 6, and sets a validity period until the access rights become invalid. The setting instruction includes the user ID, the target area, and the validity period. The target area is represented, for example, by interval identification information or LBA range (e.g., start LBA and size). In addition, the setting instruction may also include authentication information of the user ID. Furthermore, if the setting instruction does not include authentication information of the user ID, the host 2 sends another instruction containing authentication information of the user ID to the storage system 3.

[0105] Access control unit 181 receives the setting command. Access control unit 181 obtains the current time from RTC 17. Figure 2 (5)). Then, the access control unit 181 updates the temporary permission table 133 to enable the access rights to the object area granted by the user ID specified by the setting instruction. Figure 2 (6) In more specific terms, the access control unit 181 determines an entry in the temporary permission table 133 that contains the user ID specified by the setting instruction. Then, in the determined entry, the access control unit 181 (1) sets the temporary permission to "true", (2) sets the start time to the current time obtained from RTC17, and (3) sets the validity period specified by the setting instruction. Thus, the access right to the object area granted to the user ID is validated.

[0106] Access control unit 181 calculates the hash value of the user authentication information contained in the setting instruction. Access control unit 181 stores the calculated hash value of the user authentication information as part of authentication information 311 in non-volatile memory 6. Figure 2 (7)). The hash value of the stored user authentication information is used as the hash value of the valid user authentication information corresponding to the user ID for subsequent user authentication processing. In addition, if the hash value of the user authentication information corresponding to the user ID has already been stored in the non-volatile memory 6, the access control unit 181 replaces the stored hash value with the calculated hash value. This replacement is equivalent to a change of the user authentication information corresponding to the user ID.

[0107] Furthermore, the access control unit 181 uses the user authentication information contained in the setting command to encrypt the DEK used for accessing the target area, thereby obtaining the encrypted DEK. The access control unit 181 stores the obtained encrypted DEK as part of the key information 312 in the non-volatile memory 6. Figure 2 (8)). The DEK used for accessing the object region is used to encrypt data written to the object region and to decrypt encrypted data read from the object region.

[0108] Here, the method for encrypting the DEK using user authentication information is explained. First, the access control unit 181 generates a KEK using the user authentication information. Specifically, the access control unit 181 uses a secret parameter and a non-secret parameter as input values ​​to generate the KEK using a key derivation function (KDF). The secret parameter is, for example, the user authentication information. The non-secret parameter is, for example, a random number.

[0109] Next, the access control unit 181 uses the generated KEK to encrypt the DEK used for accessing the object area. Furthermore, the access control unit 181 stores the encrypted DEK as part of the key information 312 in the non-volatile memory 6. Later, when a user with a user ID wants to access the object area, the stored encrypted DEK is used. If the user with the user ID enters valid authentication information, the encrypted DEK is decrypted, and access to the object area using the DEK can proceed.

[0110] Figure 5 This example illustrates the relationship between DEK and authentication information. Here, we illustrate a scenario where access rights to Range1 for both the administrator and TmpUser1 are valid, and the administrator and the user using TmpUser1 have entered valid authentication information 501 and 511 respectively. Additionally, DEK52 is the DEK corresponding to Range1. The following sections will explain the administrator's access and the user's access using TmpUser1 separately.

[0111] (1) Administrator access

[0112] Access control unit 181 generates KEK 502 using the administrator's authentication information 501. Specifically, access control unit 181 generates KEK 502 using KDF, for example, the administrator's authentication information 501 and a random number as input values.

[0113] Next, the access control unit 181 decrypts the encrypted DEK311-A using the generated KEK502, thereby obtaining DEK52. Encrypted DEK311-A is the encrypted DEK obtained by encrypting DEK52 using KEK502. Encrypted DEK311-A is generated, for example, when the access right granted to Range1 by the administrator is validated, and is stored as part of the key information 312 in the non-volatile memory 6. The access control unit 181 sets the obtained DEK52 in the encryption circuit 15.

[0114] Therefore, when the read control unit 182 reads encrypted data 56 from the non-volatile memory 6 according to a read command associated with the administrator, it can decrypt the encrypted data 56 into plaintext data 55 by setting the encryption circuit 15 of DEK52. Furthermore, the write control unit 183 can encrypt the plaintext data 55 (i.e., the user data to be written) received along with the acceptance of a write command associated with the administrator by setting the encryption circuit 15 of DEK52, thus obtaining encrypted data 56.

[0115] (2) Access by the user using TmpUser1

[0116] Access control unit 181 generates KEK 512 using authentication information 511 of TmpUser1. Specifically, access control unit 181 generates KEK 512 using KDF, for example, authentication information 511 and a random number as input values.

[0117] Next, the access control unit 181 decrypts the encrypted DEK311-1 using the generated KEK512, thereby obtaining DEK52. Encrypted DEK311-1 is the encrypted DEK obtained by encrypting DEK52 using KEK512. Encrypted DEK311-1 is generated, for example, when the access right granted to Range1 by TmpUser1 is validated, and is stored as part of the key information 312 in the non-volatile memory 6. The access control unit 181 sets the obtained DEK52 in the encryption circuit 15.

[0118] Therefore, when the read control unit 182 reads encrypted data 56 from the non-volatile memory 6 according to the read command associated with TmpUser1, it can decrypt the encrypted data 56 into plaintext data 55 by setting the encryption circuit 15 of DEK52. Furthermore, the write control unit 183 can encrypt the plaintext data 55 (i.e., the user data to be written) received along with the acceptance of the write command associated with TmpUser1 by setting the encryption circuit 15 of DEK52, thus obtaining encrypted data 56.

[0119] return Figure 2 The access control unit 181 periodically, or when the storage system 3 starts in response to the start of power supply, determines whether the current time has exceeded the validity period of the valid access right. Specifically, the access control unit 181 obtains the current time from the RTC 17. Figure 2 (9)). The access control unit 181 obtains the validity period of the validated access right from the temporary permission table 133. Figure 2(10)). Then, the access control unit 181 determines whether the current time has exceeded the validity period of the valid access right. If the date or date and time when the access right becomes invalid is set as the validity period, the access control unit 181 compares the current time with the validity period expressed by the date or date and time, and determines whether the current time has exceeded the validity period.

[0120] Furthermore, when a validity period is set as the start time, the access control unit 181 obtains the start time and validity period of the valid access right from the temporary permission table 133. Using the start time and validity period, the access control unit 181 determines the end time at which the access right becomes invalid. The end time is, for example, represented by a date or date and time. Then, the access control unit 181 compares the current time with the end time to determine whether the current time has exceeded the validity period (i.e., the end time).

[0121] If the validity period of a valid access right has expired at the current time, the access control unit 181 updates the temporary permission table 133, thus invalidating the access right. Figure 2 (11)). For example, the access control unit 181 sets the temporary permission enablement in the corresponding entry to "false", sets the start time and validity period to null, and invalidates the access right. Thus, the access control unit 181 can control access to the object area by preventing access through the user ID corresponding to the access right that has expired. In addition, the access control unit 181 discards the encrypted DEK corresponding to the user ID whose access right has been invalidated from the key information 312 in the non-volatile memory 6.

[0122] Through the above actions, after successful administrator authentication, the access control unit 181, according to the configured instructions, validates the access rights granted to the user ID to the target area and sets a validity period until the access rights become invalid. Furthermore, if the validity period expires at the current time, the access control unit 181 automatically invalidates the access rights. Thus, the access control unit 181 can control access to the non-volatile memory 6 to ensure that the intended user can access it during the intended period. In other words, it can prevent unintentional users from accessing the non-volatile memory 6, and prevent users from accessing the non-volatile memory 6 during unintentional periods. Therefore, it can reduce the risk of data leakage and tampering, and strengthen the security of access to the non-volatile memory 6.

[0123] Figure 6 An example of a read operation corresponding to the validity or invalidation of access rights corresponding to a user ID is shown. A read access to storage system 3 using a user ID is performed after successful authentication of the user with that user ID. Therefore, host 2 and storage system 3 first perform processing for user authentication.

[0124] Specifically, first, host 2 sends a user authentication request instruction to storage system 3. Figure 6 (1)). Authentication request instructions may include, for example, the user ID and authentication information.

[0125] The access control unit 181 of storage system 3 uses temporary permission table 133 to determine whether the access right granted to the user ID is valid or invalid. Figure 6 (2) Specifically, the access control unit 181 determines the entry corresponding to the user ID in the temporary permission table 133. If the temporary permission of the determined entry is "true", the access control unit 181 determines that the access right granted to the user ID is valid. If the temporary permission of the determined entry is "false", the access control unit 181 determines that the access right granted to the user ID is invalid.

[0126] If the access rights granted to the user ID are invalid, the access control unit 181 notifies host 2 of the error. Figure 6 (3) in the middle.

[0127] If the access rights granted to the user ID are valid, perform the following actions.

[0128] First, the access control unit 181 calculates the hash value of the authentication information contained in the authentication request instruction. The access control unit 181 then obtains the hash value of the authentication information for the user ID from the authentication information 311. Figure 6 (4) In the access control unit 181, if the calculated hash value matches the hash value of the obtained user ID authentication information, the user's authentication is deemed successful.

[0129] Next, the access control unit 181 obtains the encryption DEK corresponding to the user ID from the key information 312. Figure 6 (5)). The access control unit 181 uses the authentication information contained in the authentication request instruction to decrypt the encrypted DEK, thereby obtaining the DEK. Regarding the decryption method of the encrypted DEK using authentication information, please refer to (5). Figure 5 As explained earlier, the access control unit 181 sets the DEK obtained through decryption in the encryption circuit 15. Figure 6 (6)). Then, the access control unit 181 notifies host 2 of successful authentication ( Figure 6 (7) in the middle.

[0130] Furthermore, if the calculated hash value differs from the hash value of the obtained user ID authentication information, the access control unit 181 determines that the user's authentication has failed. In this case, the access control unit 181 notifies the host 2 of the authentication failure. Figure 6(7) in the middle.

[0131] The following describes the actions taken by the access control unit 181 after it notifies the host 2 of the successful authentication of the user.

[0132] Upon being notified that the user's authentication was successful, host 2 sends a read command associated with the user's user ID to storage system 3. Figure 6 (8)). This read instruction is an instruction that requests to read data from the object area for which the user ID has been granted access rights.

[0133] Access control unit 181 receives a read command sent by host 2. Access control unit 181 uses temporary permission table 133 to determine whether the access right corresponding to the user ID associated with the read command is valid or invalid. Figure 6 (9)). If the access right corresponding to the user ID associated with the read command is invalid, the access control unit 181 notifies the host 2 of an error ( Figure 6 (10) in the middle.

[0134] If the access rights corresponding to the user ID associated with the read command are valid, the access control unit 181 will send the read command to the read control unit 182. Figure 6 (11) in the middle.

[0135] The read control unit 182 uses the logical physical address translation table 132 to determine the physical address corresponding to the LBA specified by the read instruction. Figure 6 (12)). Then, the read control unit 182 instructs the non-volatile memory 6 via the memory I / F 16 to read data from the determined physical address ( Figure 6 (13)). The non-volatile memory 6 reads the encrypted data from the determined physical address and sends it to the encryption circuit 15. Figure 6 (14) in the middle.

[0136] Encryption circuit 15 uses the set DEK to decrypt the encrypted data to obtain user data. Encryption circuit 15 then sends the user data to readout control unit 182. Figure 6 (15)). Additionally, user data can also be stored in buffer 12. The readout control unit 182 sends user data to the host 2 via host I / F 11. Figure 6 (16) in the middle.

[0137] Through the above actions, when the user has a valid user ID with access rights and authentication information corresponding to the user ID, the read control unit 182 can read the encrypted data corresponding to the read command sent by the host 2 from the non-volatile memory 6 (more specifically, the object area). Furthermore, the read control unit 182 can send the user data obtained by decrypting the read encrypted data to the host 2.

[0138] Conversely, if a user uses an invalid user ID or lacks authentication information corresponding to the user ID, the storage system 3 does not execute the processing corresponding to the read command associated with the user ID. Specifically, the access control unit 181 notifies the host 2 of an error for the read command associated with that user ID. Thus, the access control unit 181 can control the storage system 3 to prevent the execution of the processing corresponding to the read command.

[0139] Figure 7 This illustrates an example of a write operation corresponding to the validity or invalidation of access rights corresponding to a user ID. A write access to storage system 3 using a user ID is performed after successful authentication of the user with that user ID. Therefore, host 2 and storage system 3 first perform authentication processing for the user. The actions from host 2 sending an authentication request instruction to storage system 3 to storage system 3 notifying host 2 of the authentication result are as follows: [Refer to...] Figure 6 As stated above.

[0140] The following describes the actions taken by the access control unit 181 after it notifies the host 2 of the successful authentication of the user.

[0141] Upon being notified of successful user authentication, host 2 sends a write command associated with the user's user ID to storage system 3. Figure 7 (8)). As the write command is accepted by storage system 3, host 2 sends the user data of the write object to storage system 3. Figure 7 (8)). This write instruction is an instruction that requests the writing of user data into the object area that has access rights granted to the user ID.

[0142] Access control unit 181 accepts a write command sent by host 2. Along with accepting the write command, access control unit 181 receives user data of the object to be written from host 2. The received user data may also be stored in buffer 12. Access control unit 181 uses temporary permission table 133 to determine whether the access right corresponding to the user ID associated with the write command is valid or invalid. Figure 7 (9)). If the access right corresponding to the user ID associated with the write command is invalid, the access control unit 181 notifies the host 2 of an error ( Figure 7(10) in the middle.

[0143] If the access rights corresponding to the user ID associated with the write command are valid, the access control unit 181 sends the write command and user data to the write control unit 183. Figure 7 (11)). The write control unit 183 sends the user data to the encryption circuit 15 ( Figure 7 (12) in the middle.

[0144] Encryption circuit 15 encrypts user data using the set DEK. This yields encrypted data. Encryption circuit 15 then sends the encrypted data to non-volatile memory 6 via memory I / F 16. Figure 7 (13) in the middle.

[0145] Additionally, the write control unit 183 instructs the non-volatile memory 6 to write encrypted data via the memory I / F16. Figure 7 (14)). Thus, the encrypted data is written to the non-volatile memory 6 (more specifically, the object area with access rights corresponding to the user ID). Then, the write control unit 183 updates the logical physical address translation table 132 so that the correspondence between the physical address indicating that the encrypted data has been written and the LBA is updated. Figure 7 (15) in the middle.

[0146] Through the above actions, when the user has a valid user ID with access rights and has authentication information corresponding to the user ID, the write control unit 183 can encrypt the user data of the write object sent by the host 2 along with the write command and write it to the non-volatile memory 6.

[0147] Conversely, if a user uses an invalid user ID or lacks authentication information corresponding to the user ID, the storage system 3 does not execute the processing corresponding to the write command associated with the user ID. Specifically, the access control unit 181 notifies the host 2 of an error for a write command associated with that user ID. Thus, the access control unit 181 can control the storage system 3 to prevent the execution of the processing corresponding to the write command.

[0148] also, Figure 6 as well as Figure 7The actions shown are not limited to read and write instructions, but can be applied to various access instructions that generate access to the non-volatile memory 6. That is, when the access control unit 181 receives an access instruction associated with a user ID from the host 2, if the access right corresponding to the user ID is valid, it performs control to execute the processing corresponding to the access instruction. On the other hand, if the access right corresponding to the user ID is invalid, the access control unit 181 performs control to prevent the execution of the processing corresponding to the access instruction.

[0149] However, there are cases where multiple users use the same user ID.

[0150] Figure 8 This example illustrates access control for a user ID "TmpUser1" used by two users, user A and user B. Specifically, TmpUser1 is assigned to user A in period T1, not assigned to either user in period T2, and assigned to user B in period T3. Period T1 is from October 1, 2020 to October 31, 2020. Period T2 is from November 1, 2020 to November 30, 2020. Period T3 is from December 1, 2020 to December 31, 2020. Furthermore, the access rights granted to TmpUser1 are for Range1 within non-volatile memory 6.

[0151] First, if the administrator assigns TmpUser1 to user A during the first period T1, the administrator will notify user A of the authentication information "abcd" for TmpUser1. The administrator can also notify user A that user A has access to storage system 3 during the first period T1.

[0152] Based on the administrator's operation, host 2 sends a first setting instruction to storage system 3. This first setting instruction is used to grant TmpUser 1 access rights to Range1 valid from October 1, 2020 to October 31, 2020. Additionally, the first setting instruction includes TmpUser 1's authentication information "abcd".

[0153] According to the first setting instruction, the access control unit 181 of the storage system 3 changes the authentication information of TmpUser1 to "abcd". More specifically, the access control unit 181 calculates the hash value of the new authentication information "abcd". The access control unit 181 replaces the hash value of the authentication information of TmpUser1 stored as authentication information 311 with the calculated hash value of "abcd".

[0154] Then, the access control unit 181 makes TmpUser1's access right to Range1 valid.

[0155] Therefore, during the first period T1, user A is able to access Range1 using the authentication information "abcd" of TmpUser1, which was notified from the administrator. However, the authentication information "abcd" of TmpUser1 was not notified to user B from the administrator. Therefore, during the first period T1, user B cannot access Range1.

[0156] In cases where the deadline has passed (e.g., November 1, 2020), the access control unit 181 automatically invalidates TmpUser1's access right to Range1 and changes TmpUser1's authentication information "abcd" to the default authentication information "1234".

[0157] Therefore, during the second period T2, the access rights granted to TmpUser1 became invalid, so users A and B could not access Range1.

[0158] Next, during the third period T3, if the administrator assigns TmpUser1 to user B, the administrator will notify user B of the new authentication information "efgh" for TmpUser1. The administrator may also notify user B that user B has access to storage system 3 during the third period T3.

[0159] Based on the administrator's operation, host 2 sends a second configuration command to storage system 3. This second configuration command is used to grant TmpUser 1 access rights to Range1 from December 1, 2020 to December 31, 2020. Additionally, the second configuration command includes TmpUser 1's authentication information, "efgh".

[0160] Access control unit 181 changes TmpUser1's authentication information to "efgh" according to the second setting instruction. Furthermore, access control unit 181 activates TmpUser1's access right to Range1.

[0161] Therefore, in the third period T3, user B can access Range1 using the authentication information "efgh" of TmpUser1, which was notified by the administrator. Furthermore, since the authentication information of TmpUser1 changed from "abcd" to "efgh", user A cannot access Range1 in the third period T3. In other words, even if user A's access rights to TmpUser1, which were valid in the first period T1, are not known to have the authentication information of TmpUser1 in the third period T3, user A cannot access Range1. This prevents user A from unintentionally accessing Range1 in the third period T3.

[0162] Furthermore, in cases where the access control unit 181 has exceeded December 31, 2020 (e.g., January 1, 2021), it automatically invalidates TmpUser1's access right to Range1 and changes TmpUser1's authentication information "efgh" to the default authentication information "1234".

[0163] In this way, even when multiple users use a single user ID "TmpUser1", control can be exercised by validating and invalidating the access rights granted to TmpUser1 and by changing TmpUser1's authentication information. This ensures that only the user with the intended access can access the Range1 of the non-volatile memory 6 during the period specified by the administrator. Therefore, the risk of data leakage and tampering can be reduced, and the security of access to the non-volatile memory 6 can be strengthened.

[0164] In the comparative storage system, when the user ID expires, for example by discarding the DEK, the user data written to non-volatile memory is discarded. That is, by discarding the DEK, it is no longer possible to decrypt encrypted data that was encrypted using the DEK and written to non-volatile memory; therefore, the encrypted data is effectively discarded.

[0165] In contrast, in the storage system 3 of this embodiment, if the user ID's validity period has expired, the DEK is not discarded, but the encrypted DEK corresponding to that user ID is discarded. If the encrypted DEK is discarded, the DEK is no longer decrypted from the encrypted DEK.

[0166] In the storage system 3 of this embodiment, the DEK is not discarded even if the user ID's validity period has expired. Therefore, a newly granted user can use the previously used user ID and utilize the user data previously stored in the non-volatile memory 6.

[0167] For example, for Figure 8 The situation shown will be explained.

[0168] During the first period T1, user A is granted access to Range1 by TmpUser1. At this time, access control unit 181 encrypts the DEK of Range1 using the authentication information "abcd" of TmpUser1 (more specifically, using the KEK generated using the authentication information "abcd"), thereby generating an encrypted DEK. Access control unit 181 stores the generated encrypted DEK as part of key information 312 in non-volatile memory 6. User data corresponding to the write access of user A using TmpUser1 is encrypted using the DEK of Range1. This DEK is obtained by decrypting the encrypted DEK using the authentication information "abcd" (more specifically, using the KEK generated using the authentication information "abcd"). The encrypted data is written to Range1 in non-volatile memory 6. During the first period T1, the encrypted DEK is stored in non-volatile memory 6 as part of key information 312.

[0169] With the expiration of TmpUser1, the encryption DEK corresponding to TmpUser1 is invalidated. Therefore, during the second period T2, it is no longer possible to obtain a DEK from the encryption DEK corresponding to TmpUser1. Consequently, during the second period T2, the user using TmpUser1 cannot decrypt the encrypted data read from Range1.

[0170] Next, during the third period T3, access rights to Range1 are granted to user B for TmpUser1. At this time, the access control unit 181 encrypts Range1's DEK using TmpUser1's authentication information "efgh" (more specifically, using the KEK generated using the authentication information "efgh"), thereby generating an encrypted DEK. The access control unit 181 stores the generated encrypted DEK as part of the key information 312 in the non-volatile memory 6.

[0171] Based on the read command from user B using TmpUser1, encrypted data is read from Range1. Access control unit 181 decrypts the encrypted DEK using authentication information "efgh" (more specifically, using the KEK generated using authentication information "efgh") to obtain the DEK of Range1. The encrypted data read from Range1 is decrypted using the DEK of Range1.

[0172] The user data obtained through decryption can be encrypted using the DEK of Range1 and written to non-volatile memory 6 via a write access performed by user A, who was previously assigned access rights to TmpUser1. Therefore, user B, who has been newly assigned access rights to TmpUser1, can use TmpUser1, which was previously assigned to another user A, and utilize the user data that user A previously wrote to Range1.

[0173] Thus, in this embodiment, the storage system 3 does not discard the DEK when the validity period of TmpUser1 expires, but discards the encrypted DEK corresponding to TmpUser1. Therefore, the user newly granted access rights to TmpUser1 can utilize user data previously stored in the non-volatile memory 6 using TmpUser1 by other users.

[0174] Figure 9 This is a flowchart illustrating an example of the sequence of permission setting processes performed by CPU 18. The permission setting process is used to validate the access rights granted to a user ID to at least a portion of the storage area of ​​non-volatile memory 6.

[0175] First, CPU18 receives the administrator's authentication request instruction from host 2 (step S101). CPU18 calculates the hash value of the authentication information contained in the authentication request instruction (step S102).

[0176] CPU18 determines whether the calculated hash value is equal to the hash value of the administrator's authentication information (step S103). The administrator's authentication information or the hash value of the administrator's authentication information, for example, is stored as authentication information 311 in non-volatile memory 6.

[0177] If the calculated hash value is different from the hash value of the administrator's authentication information (no in step S103), CPU18 notifies host 2 of the administrator's authentication failure (step S104), and CPU18's processing returns to step S101.

[0178] If the calculated hash value is equal to the hash value of the administrator's authentication information (yes in step S103), CPU18 notifies host 2 of successful administrator authentication (step S105). CPU18 sets the variable num_err to 0 (step S106). num_err represents the number of errors associated with the setting instruction that occurred after successful administrator authentication. Then, CPU18 receives the setting instruction from host 2 (step S107). This setting instruction is used to grant user ID "TmpUserX" access rights to RangeX in non-volatile memory 6 valid until a specific expiration date.

[0179] CPU18 obtains the current time from RTC17 (step S108). CPU18 determines whether the accepted setting instruction has set the correct validity period (step S109). If the validity period is set as any of (1) a non-existent date or date and time, (2) a past date or date and time, and (3) a period exceeding a threshold, CPU18 determines that the setting instruction has not set the correct validity period.

[0180] If the correct validity period is not set in the setting instruction (No in step S109), CPU 18 increments num_err by 1 (step S110). Then, CPU 18 determines whether num_err is greater than or equal to n (step S111). n is an integer greater than or equal to 1. If num_err is less than n (No in step S111), CPU 18 notifies host 2 of the error (step S112), and CPU 18's processing returns to step S107. If num_err is greater than or equal to n (Yes in step S111), CPU 18 notifies host 2 of the error and the invalidation of authentication (step S113), and CPU 18's processing returns to step S101.

[0181] If the correct validity period is set in the setting instruction (yes in step S109), the CPU 18 updates the temporary permission table 133 based on the current time obtained from the RTC 17 and the setting instruction (step S114). Specifically, the CPU 18 determines from the temporary permission table 133 the entry containing the user ID shown in the setting instruction. Then, the CPU 18 enables the temporary permission for the determined entry by setting it to "true". The CPU 18 sets the start time of the determined entry to the current time. In addition, the CPU 18 sets the validity period of the determined entry to the validity period shown in the setting instruction. By updating the temporary permission table 133, the access right to RangeX granted to TmpUserX is valid with a time limit.

[0182] Next, CPU 18 uses the authentication information of TmpUserX contained in the setting instruction to calculate the hash value of the authentication information and saves it in non-volatile memory 6 (step S115). CPU 18 uses the authentication information of TmpUserX contained in the setting instruction to calculate KEK (step S116). Furthermore, CPU 18 uses KEK to encrypt the DEK of RangeX and saves it in non-volatile memory 6 (step S117), ending the permission setting process.

[0183] Through the above permission settings, after successful administrator authentication, CPU18 can, according to the set instructions, make the access rights granted to TmpUserX to RangeX effective for a limited time.

[0184] Figure 10 This is a flowchart illustrating an example of the sequence of permission invalidation processes performed by CPU 18. Permission invalidation is a process used to invalidate access rights that have exceeded their expiration date. CPU 18 performs permission invalidation processes, for example, in response to the start of power supply to storage system 3. Alternatively, CPU 18 may perform permission invalidation processes periodically (e.g., once a day, once a month).

[0185] CPU18 obtains the current time from RTC17 (step S201). Then, CPU18 sets the first entry of the temporary permission table 133 as an object entry (step S202).

[0186] Next, CPU18 determines whether the temporary permission enable of the object entry is "true" (step S203). If the temporary permission enable of the object entry is "false" (no in step S203), the access rights granted to the user ID of the object entry are invalid. Therefore, the processing of CPU18 proceeds to step S207.

[0187] If the temporary permission for the object entry is enabled as "true" (yes in step S203), CPU 18 determines whether the current time has exceeded the validity period shown in the object entry (step S204). If the current time has not exceeded the validity period shown in the object entry (no in step S204), CPU 18 proceeds to step S207. In this case, CPU 18 does not make any changes to the object entry. Therefore, the access rights granted to the user ID of the object entry remain valid.

[0188] Conversely, if the current time exceeds the validity period indicated by the object entry (yes in step S204), the CPU18 enables temporary permissions for the object entry, sets it to "false," and updates the temporary permission table 133 so that the start time and validity period become null (step S205). Additionally, the CPU18 discards the encrypted DEK corresponding to the user ID of the object entry from the non-volatile memory 6 (step S206). The CPU18 changes the authentication information 311 corresponding to the user ID of the object entry to authentication information pre-set by the administrator (i.e., default authentication information) (step S207), and the CPU18's processing proceeds to step S208. Thus, the access rights of a user ID that has exceeded its validity period can be invalidated, and the authentication information of that user ID can be changed.

[0189] Next, CPU 18 determines whether the object entry is the last entry in the temporary permission table 133 (step S208). If the object entry is not the last entry (no in step S208), CPU 18 sets the next entry in the temporary permission table 133 as the new object entry (step S209), and CPU 18's processing proceeds to step S203. That is, regarding the user ID of the new object entry, it is determined whether the access right needs to be invalidated; if so, processing to invalidate the access right is performed.

[0190] If the object entry is the last entry (yes in step S208), CPU18 ends the permission invalidation process.

[0191] Through the above permission invalidation process, CPU18 can invalidate the access rights granted to a user ID if the current validity period has expired. In this case, the administrator does not need to issue the invalidation command at the scheduled time. Therefore, it avoids the situation where the access rights of a user ID that should be invalidated remain valid due to command operation errors. Thus, it reduces the risk of data leakage and tampering, and enhances the security of access to non-volatile memory 6.

[0192] Figure 11 This is a flowchart illustrating an example of the sequence of user authentication processes executed by CPU 18. The user authentication process is used to authenticate a user using a user ID. CPU 18 is configured, for example, to execute the following steps at the start of power supply to storage system 3: Figure 9 The user authentication process is performed after the permission setting process, as illustrated in the flowchart. In other words, user authentication will not be performed before the permission setting process is completed.

[0193] First, CPU 18 receives an authentication request instruction from host 2 for user ID "TmpUserX" (step S301). CPU 18 then determines the entry in temporary permission table 133 corresponding to the user ID "TmpUserX" specified by the authentication request instruction (step S302).

[0194] CPU18 determines whether the temporary permission enable of the determined entry is "true" (step S303). If the temporary permission enable is "false" (no in step S303), since the access right granted to TmpUserX is invalid, CPU18 notifies host 2 of the error (step S304) and ends the user authentication process.

[0195] When the temporary permission is enabled as "true" (yes in step S303), the CPU 18 calculates the hash value of the authentication information contained in the authentication request instruction (step S305). Furthermore, the CPU 18 determines whether the calculated hash value is equal to the hash value of the authentication information of TmpUserX (step S306). The authentication information of TmpUserX, or the hash value of the authentication information of TmpUserX, is stored, for example, as authentication information 311 in the non-volatile memory 6.

[0196] If the calculated hash value is different from the hash value of TmpUserX's authentication information (no in step S306), CPU18 notifies host 2 that TmpUserX's authentication has failed (step S307) and ends the user authentication process.

[0197] If the calculated hash value is equal to the hash value of TmpUserX's authentication information (yes in step S306), CPU18 generates a KEK using the authentication information (step S308). CPU18 uses the generated KEK to decrypt the encrypted DEK (step S309). This encrypted DEK is data obtained by encrypting the DEK used to access RangeX within the non-volatile memory 6 using the KEK. RangeX is the object region for which TmpUserX has been granted access rights.

[0198] CPU18 sets the DEK obtained through decryption in the encryption circuit 15 (step S310). Then, CPU18 notifies host 2 that TmpUserX's authentication was successful (step S311), ending the user authentication process.

[0199] Through the above user authentication process, if authentication is requested for user ID "TmpUserX", and the access right granted to TmpUserX is invalid (i.e., if the temporary permission is enabled as "false"), then CPU 18 will not perform authentication processing for TmpUserX using the authentication information included in the authentication request, and will notify host 2 of the error. Therefore, for example, if a user using TmpUserX requests access to non-volatile memory 6 after the expiration date, CPU 18 can deny the access.

[0200] Furthermore, if authentication of the user ID "TmpUserX" is requested, and the access rights granted to TmpUserX are valid (i.e., if temporary permissions are enabled as "true"), then CPU 18 performs authentication processing on TmpUserX using the authentication information included in the authentication request. If authentication is successful, CPU 18 sets the DEK of RangeX, the object of the access rights granted to TmpUserX, in the encryption circuit 15. By using the encryption circuit 15 with the DEK set, CPU 18 can access RangeX according to the access instructions associated with TmpUserX. That is, CPU 18 encrypts data written to RangeX using the encryption circuit 15 and decrypts data read from RangeX.

[0201] On the other hand, in the event of authentication failure, CPU18 notifies host 2 of the authentication failure. As a result, the user using TmpUserX is changed, and after the authentication information of TmpUserX is changed, CPU18 is able to deny the previous user's access to RangeX.

[0202] Figure 12 This is a flowchart illustrating an example of the order in which read instructions are processed by CPU18. CPU18, for example, refers to... Figure 11 After the user authentication process has been explained, the read command is executed.

[0203] CPU 18 receives a read instruction from host 2 (step S401). Here, an example is given where the user ID of the user issuing the read instruction is "TmpUserX". That is, the read instruction is associated with TmpUserX. Furthermore, the object region for which access rights are granted to TmpUserX is RangeX.

[0204] CPU18 determines the entry corresponding to TmpUserX in the temporary permission table 133 (step S402). Then, CPU18 determines whether the temporary permission enable of the determined entry is "true" (step S403).

[0205] If the temporary permission is enabled as "false" (not in step S403), the CPU 18 notifies the host 2 of an error (step S404) and terminates the read instruction processing. That is, the CPU 18 does not perform the processing for reading data from the non-volatile memory 6 according to the read instruction, and terminates the read instruction processing.

[0206] If the temporary permission is enabled as "true" (yes in step S403), CPU 18 reads the data corresponding to the read instruction from non-volatile memory 6 (step S405). More specifically, CPU 18 uses the logical physical address translation table 132 to determine the physical address corresponding to the LBA specified by the read instruction. Then, CPU 18 reads the data from the determined physical address in non-volatile memory 6.

[0207] CPU 18 uses encryption circuit 15 with DEK configured to decrypt the read data (step S406). This DEK is based on... Figure 11 The DEK set in step S310 of the user authentication process described above. That is, the DEK is the DEK of RangeX, which becomes the object that grants access rights to TmpUserX. CPU18 sends the decrypted data to host 2 (step S407), ending the read instruction processing.

[0208] Through the above read instruction processing, when a read instruction associated with TmpUserX is received, if the access right granted to TmpUserX is invalid (i.e., if the temporary permission is enabled as "false"), CPU18 can not execute the read processing corresponding to the read instruction and instead notify host 2 of an error. Therefore, for example, if a user using TmpUserX requests read access to non-volatile memory 6 after the expiration date, CPU18 can refuse the read access.

[0209] In addition, if a read instruction associated with TmpUserX is received, and the access rights granted to TmpUserX are valid (i.e., if the temporary permission is enabled as "true"), then CPU18 reads the data corresponding to the read instruction from non-volatile memory 6 and can decrypt the read data.

[0210] Figure 13 This is a flowchart illustrating an example of the order in which write instructions are processed by CPU18. CPU18, for example, refers to... Figure 11 After the user authentication process has been explained, the write command is executed.

[0211] CPU 18 receives a write command from host 2 (step S501). Here, an example is given where the user ID of the user who issued the write command is "TmpUserX". That is, the write command is associated with TmpUserX. Furthermore, the object region for which access rights are granted to TmpUserX is RangeX. CPU 18 receives the user data of the write object sent along with the received write command from host 2 (step S502).

[0212] CPU18 determines the entry corresponding to TmpUserX in the temporary permission table 133 (step S503). Then, CPU18 determines whether the temporary permission enable of the determined entry is "true" (step S504).

[0213] If the temporary permission is enabled as "false" (not in step S504), the CPU 18 notifies the host 2 of an error (step S505) and terminates the write instruction processing. That is, the CPU 18 does not perform the processing for writing data to the non-volatile memory 6 according to the write instruction, and terminates the write instruction processing.

[0214] When the temporary permission is enabled as "true" (yes in step S504), the CPU 18 uses the encryption circuit 15 with the DEK set to encrypt the user data to be written (step S506). The DEK is, for example, referenced... Figure 11 The DEK set in step S310 of the user authentication process described above. That is, the DEK is the DEK of RangeX, which is the object that grants access rights to TmpUserX. CPU18 writes the encrypted user data to non-volatile memory 6 (step S507). Then, CPU18 updates the logical physical address translation table 132 to show the correspondence between the physical address and logical address of the written encrypted user data (step S508), and ends the write instruction processing.

[0215] Through the above write instruction processing, upon receiving a write instruction associated with TmpUserX, if the access rights granted to TmpUserX are invalid, CPU18 can not execute the write processing corresponding to the write instruction and instead notify host 2 of the error. Therefore, for example, if a user using TmpUserX requests write access to non-volatile memory 6 after the expiration date, CPU18 can reject the write access.

[0216] In addition, if a write command associated with TmpUserX is received, and the access rights granted to TmpUserX are valid, the CPU18 can encrypt the user data of the write object corresponding to the write command and write it to the non-volatile memory 6.

[0217] (Second Implementation)

[0218] In the first embodiment, an RTC 17 and an energy storage device 5 are provided in the storage system 3. In contrast, in the second embodiment, an RTC and an energy storage device are provided in the host unit 2.

[0219] The storage system 3 and host 2 in the second embodiment are configured the same as those in the first embodiment. The only difference between the second and first embodiments is that the RTC and the energy storage device are located in the host 2. The following mainly describes the differences from the first embodiment.

[0220] Figure 14 This section describes a configuration example of an information processing system 1 that includes the storage system 3 of the second embodiment. The storage system 3 of the second embodiment, compared to the storage system 3 of the first embodiment, does not include the RTC 17 and the power storage device 5. The host 2 of the second embodiment, in addition to the configuration of the host 2 of the first embodiment, also includes the RTC 26 and the power storage device 27.

[0221] RTC26 is a clock that operates regardless of whether power is supplied to the host 2 from an external source. RTC26 provides the current time based on requests from various components within the host 2 (e.g., CPU 21, controller 25). When power is supplied to the components within the host 2 from an external power source, RTC26 operates using the supplied power. Conversely, when no power is supplied to the components within the host 2 from an external power source, RTC26 operates using power supplied from the energy storage device 27.

[0222] The energy storage device 27 functions as a power source when the power supply from an external power source to the main unit 2 is cut off. Specifically, the energy storage device 27 can supply power to the RTC 26 when the power supply from the external power source is cut off. The energy storage device 27 is implemented as a button cell or a double-layer capacitor.

[0223] When the CPU 18 (more specifically, the access control unit 181) of the memory controller 4 needs to obtain the current time, it sends a request instruction to send the current time (hereinafter referred to as a time request instruction) to the host 2 via the host I / F 11. The controller 25 (or CPU 21) of the host 2, in response to receiving the time request instruction from the memory system 3, obtains the current time from the RTC 26. The controller 25 sends the obtained current time to the memory system 3. Thus, the CPU 18 of the memory system 3 is able to obtain the current time.

[0224] Furthermore, the storage system 3 of the second embodiment may also include the RTC17 and the energy storage device 5, just like the storage system 3 of the first embodiment. That is, the RTC17 and the energy storage device 5 may be provided in the storage system 3, and the RTC26 and the energy storage device 27 may be provided in the host 2.

[0225] The CPU 18 obtains the current time from its internal RTC 17, which provides an accurate current time. Alternatively, if the RTC 17 cannot provide an accurate current time due to power depletion from the power storage device 5, the CPU 18 sends a time request command to the host 2 to obtain the current time provided by the RTC 26 within the host 2. Thus, the CPU 18 can obtain the current time from either the RTC 17 in the storage system 3 or the RTC 26 in the host 2.

[0226] As explained above, the security of access to the storage device can be enhanced according to the first and second embodiments.

[0227] The memory controller 4 (more specifically, the access control unit 181) of the storage system 3 enables a first access right granted to the first user identification information for at least a portion of the storage area of ​​the non-volatile memory 6, and sets a first period until the first access right becomes invalid. If the first period expires at the current time, the memory controller 4 invalidates the first access right.

[0228] Therefore, if the first timeout period has expired, the first access right is invalidated, thus eliminating the need for the administrator to issue the instruction to invalidate the first access right at the scheduled time. This prevents access rights that should be invalidated from remaining valid due to instruction errors. Consequently, the risk of data leakage and tampering is reduced, enhancing the security of access to the non-volatile memory 6.

[0229] The various functions described in the first and second embodiments can each be implemented by a circuit (processing circuit). Examples of processing circuits include a programmed processor such as a central processing unit (CPU). This processor executes the described functions by executing a computer program (command set) stored in memory. The processor can also be a microprocessor containing circuitry. Examples of processing circuits also include digital signal processors (DSPs), application-specific integrated circuits (ASICs), microcontrollers, controllers, and other circuit components. Other components besides the CPU described in these embodiments can also be implemented by processing circuits.

[0230] Several embodiments of the present invention have been described, but these embodiments are provided by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other ways, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included within the scope and spirit of the invention, and are included within the scope of the invention as described in the claims and its equivalents.

[0231] Label Explanation

[0232] 1…Information processing system, 2…Host, 3…Storage system, 4…Memory controller, 5…Energy storage device, 6…Non-volatile memory, 11…Host I / F, 12…Buffer, 13…RAM, 14…ROM, 15…Encryption circuit, 16…Memory I / F, 17…RTC, 18…CPU, 131…FW, 132…Logical physical address translation table, 133…Temporary permission table, 181…Access control unit, 182…Read control unit, 183…Write control unit, 21…CPU, 22…RAM, 24…ROM, 25…Controller, 26…RTC, 27…Energy storage device, 251…Power supply unit, 31…System area, 32…User area, 311…Authentication information, 312…Key information.

Claims

1. A storage system comprising: Memory; Real-time clock; and The controller is configured as follows: Control access to the memory; Manage permission information regarding the first access right and first authentication information corresponding to the first identification information, wherein the first access right is granted by the first identification information; and The controller is used to set a first time limit based on the current time from the real-time clock. When the current time has exceeded the first time limit associated with the permission information, the first access right is invalidated, the permission information is updated, and the first authentication information corresponding to the first identification information is changed.

2. The storage system according to claim 1, The controller is further configured as follows: Receive a first command from the host, the first command requesting the validation of the first access right, and including the first identification information and information indicating the first duration; and According to the first command, the first time limit is set and the information in the permission information indicates that the first access right is valid is set.

3. The storage system according to claim 2, The controller is further configured as follows: Management is achieved by logically dividing the storage areas of the memory into one or more intervals, the one or more intervals including a first interval; Manage the permission information used to access the first interval; The current time is obtained from the real-time clock; If the current time obtained has not exceeded the first time limit, the first access right is made valid; as well as When the obtained current time has exceeded the first time limit, the first access right is invalidated, the permission information is updated to indicate that the access to the first interval is invalid, and the first authentication information is changed.

4. The storage system according to claim 3, The controller is further configured as follows: Receive a second command from the host, the second command being a command for accessing the first interval and associated with the first identification information; If the first access right is valid, perform the processing related to access to the first interval according to the second command; and If the first access right is invalid, the processing related to the access to the first interval according to the second command is not performed, and the host is notified of an error.

5. The storage system according to claim 4, The controller is further configured as follows: Receive a third command from the host, the third command containing second authentication information associated with the first identification information; If the first access right is valid, perform authentication processing using the first identification information and the second authentication information; and If the first access right is invalid, the authentication process using the first identification information with the second authentication information is not performed, and the host is notified of an error.

6. The storage system according to claim 5, The controller is further configured as follows: If the first access right is valid and the authentication process is successful, perform the processing related to access to the first interval according to the second command; and If the first access right is valid but the authentication process performed fails, the process related to the access to the first interval according to the second command is not performed, and the host is notified of an error.

7. The storage system according to claim 3, The controller is further configured as follows: Receive a third command from the host, the third command containing third authentication information associated with administrator identification information corresponding to administrator privileges; Perform authentication processing using the administrator identification information obtained from the third authentication information; and If the authentication process of the administrator identification information is successful, the first time limit and the information indicating that the first access right is valid are set according to the first command.

8. The storage system according to claim 1, further comprising: The energy storage device is configured to supply power to the real-time clock. The controller is further configured to obtain the current time from the real-time clock.

9. A storage system comprising: Memory; A real-time clock is configured to obtain the current time; and The controller is configured as follows: Receive a first command containing first identification information and first authentication information corresponding to the first identification information, and perform authentication processing on the first identification information; After receiving the first command, a second command is received, the second command containing second identification information and a first time limit for the second identification information, and when the authentication process for the first identification information has been successful, the access right to the second identification information is made valid; After receiving the second command, a third command is received, and when the access right is valid, access to the memory corresponding to the second identification information is granted. The controller makes the access right valid if the current time obtained from the real-time clock has not exceeded the first time limit, and invalidates the access right if the current time has exceeded the first time limit.

10. The storage system according to claim 9, The memory comprises one or more intervals obtained by logically dividing the storage region, and The third command is a request to access a storage area corresponding to a first interval in the interval, which is associated with the second identification information.

11. The storage system according to claim 9, The controller is further configured to perform authentication processing on the second identification information after the authentication processing on the first identification information.

12. The storage system according to claim 9, The first identification information is used for the administrator, and the second identification information is used for the user.

13. The storage system according to claim 9, The controller is further configured to periodically obtain the current time from the real-time clock.

14. The storage system according to claim 9, The controller is further configured to obtain the current time when the storage system has performed a restart process.

15. The storage system according to claim 9, The second identification information is shared by one or more users.

16. The storage system according to claim 15, The memory comprises one or more intervals obtained by logically dividing the storage region, and The third command is a request to access a storage area corresponding to a second interval in the interval, the second interval being associated with the second identification information. The storage area corresponding to the second interval is allowed to be accessed by a first user associated with the second identification information, but is prohibited from being accessed by a second user associated with the second identification information.

17. The storage system according to claim 9, The controller is further configured as follows: Manage permission information regarding the access right and second authentication information corresponding to the second identification information, wherein the access right is granted by the second identification information; The controller is used to set the first time limit based on the current time from the real-time clock. When the current time has exceeded the first time limit associated with the permission information, the access right is invalidated, the permission information is updated, and the second authentication information corresponding to the second identification information is changed.

18. The storage system according to claim 17, The controller is further configured as follows: The second command is received from the host, the second command requesting the validity of the access right and including the second identification information and information indicating the first duration; and When the authentication process for the first identification information is successful, the first time limit and the information indicating that the access right is valid in the permission information are set according to the second command.

19. The storage system according to claim 18, The controller is further configured as follows: Management is achieved by logically dividing the storage areas of the memory into one or more intervals, the one or more intervals including a first interval; Manage the permission information used to access the first interval; The current time is obtained from the real-time clock; If the current time has not exceeded the first time limit, the access right is made valid; as well as When the obtained current time has exceeded the first time limit, the access right is invalidated, the information about the access right is updated to indicate that the access to the first interval is invalid, and the second authentication information is changed.

20. The storage system according to claim 19, The controller is further configured as follows: The third command is received from the host. The third command is a command for accessing the first interval and is associated with the second identification information. If the access right is valid, perform the processing related to access to the first interval according to the third command; and If the access right is invalid, the processing related to the access to the first interval according to the third command is not performed, and the host is notified of an error.

Images