Data storage device with encryption and methods for doing so

Abstract

Storage device with: a storage unit (130) for storing data; a processor unit (120) for processing the data in accordance with an instruction received from an external device (105); and a key unit (140) for simultaneously processing an encryption corresponding to the command, while the processor unit (120) processes the data.

Description

BACKGROUND OF THE INVENTION 1. Technical Field

[0001] The present invention relates to a data storage device and methods for encrypting and decrypting data, and in particular relates to a device for processing a cryptographic key and methods for doing so. 2. Description of the related technology

[0002] In general, a storage device is a computer device that reads and writes data to a storage medium. A data storage device may contain moving parts, or it may have no significant moving parts. An example of a data storage device with moving parts is a conventional disk drive, in which a disk (i.e., a rotating disc) rotates and which has one or more heads that read and write the data. A data storage device without significant moving parts is generally called a solid-state drive.

[0003] A secure disk drive supports data encryption on the drive using partial or full disk encryption techniques, where an encryption key is used to encrypt data on a storage medium. In a conventional system, in response to a read or write command, encrypted data is retrieved from memory and decrypted, or data is encrypted and stored. As long as an encryption or security key can be stored on the secure disk drive, the encryption and decryption are handled by an external processor in a host device or by a microprocessor within the secure disk drive itself.Since the data, as specified in the read and write commands, must first be encrypted or decrypted before it can be processed, the software solutions for encryption and decryption have a high throughput and impact work performance.

[0004] WO 2008 / 026457 A1 discloses: A controller reads data from a recording medium or writes data to a recording medium. The controller has a plurality of processing sections to perform at least one encryption or decryption operation; a plurality of interface sections that are interfaces to the recording medium; and a control section that assigns one of the processing sections and one of the interface sections to each type of content to be read from the recording medium and to each type of content to be written to the recording medium. The controller encrypts or decrypts multiple pieces of content in parallel.

[0005] US 2002 / 0083317 A1 relates to a device for processing security communication packets for secret communication by means of a data packet and the method for doing so, and relates in particular to a technique for accelerating and reducing the delay in security processing.

[0006] US 2004 / 0250092 A1 discloses: A technology is provided to improve tamper resistance during the encryption of data to be backed up and during the input / output of data between a recording device and a host device. When the recording device issues an input / output command to a storage device to input / output data to be backed up, the recording device appends an ID to the command to identify which cryptographic input / output processing operation the command belongs to. Upon receiving a sequence command, the storage device receives the command if the ID has been assigned and verifies that the command was issued in the correct sequence. The sequence ID is used to identify a process system while properly managing the steps for executing commands.

[0007] US 2005 / 0086471 A1 discloses an information storage device with a non-volatile memory configured to store a master encryption key and includes a non-volatile magnetic memory configured to store encryption keys encrypted using the master encryption key and to store data encrypted with the encryption keys.

[0008] US 2006 / 0140408 A1 discloses: A system for encrypting and decrypting data that uses dual-port RAM for key storage to accelerate data processing operations. The key storage on the chip includes a dual-port storage device that allows keys to be loaded into memory simultaneously with key retrieval. Thus, an encryption or decryption algorithm can run while keys are being loaded into memory. SUMMARY

[0009] The present invention provides faster performance and greater security. Because encryption keys are generated and stored within the drive hardware, they never leave its boundaries and are never contained within an operating system or application software. Hardware encryption is more secure and easier to manage.

[0010] Further aspects and advantages of the present invention are partly presented in the following description, and partly will become clear from the description or can be experienced through application of the invention.

[0011] The invention is set out in the accompanying claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] These and / or other aspects and advantages of the present invention will become clearer and more easily understood through the following description of the embodiments in conjunction with the accompanying drawings. Fig. 1A and Fig. 1B are views depicting a storage device which, according to an embodiment of the present invention, is connected to a host device; Fig. 2A and Fig. 2B are views depicting a storage device which, according to an embodiment of the present invention, is connected to a host device; Fig. Figure 3 is a view depicting a section of a storage device according to an embodiment of the present invention; Fig. Figure 4 is a block diagram illustrating a storage device according to an embodiment of the present invention; Fig. Figure 5 is a view depicting a frame information system according to an embodiment of the present invention; Fig. Figure 6 is a view depicting a frame information system according to an embodiment of the present invention; Fig. Figure 7 is a view depicting a frame information system according to an embodiment of the present invention; Fig. Figure 8 is a view depicting a computer architecture comprising a storage device according to an embodiment of the present invention; Fig. Figure 9 is a view depicting a computer architecture comprising a storage device according to an embodiment of the present invention; Fig. Figure 10 is a view depicting a computer architecture comprising a storage device according to an embodiment of the present invention; Fig. Figure 11 is a view depicting a computer architecture comprising a storage device according to an embodiment of the present invention; Fig. Figure 12 is a flowchart illustrating a method for encrypting or decrypting data in a storage device according to an embodiment of the present invention; Fig. Figure 13 is a flowchart illustrating a method for encrypting or decrypting data in a control device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE EXECUTION FORMS

[0013] The embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, where the same reference numerals refer to the same elements throughout. The embodiments are described below to explain the present invention with reference to the figures.

[0014] Full disk encryption solutions use multiple security or encryption keys to encrypt different partitions. If an unauthorized user gains access to the computer, they will not have access to all files. Encrypting files and folders allows for different keys for different sections of the disk. Consequently, an unauthorized user cannot extract information from files and folders that are still encrypted.

[0015] The advantages of hardware encryption over purely program-based encryption include faster performance and greater security. Because encryption keys are generated and stored within the drive hardware, they never leave its boundaries and are never contained within an operating system or application software. Hardware encryption is more secure and easier to manage.

[0016] An “encryption key”, a “security key” or a “crypto key”, terms which are used interchangeably below, can be used in conjunction with the Advanced Encryption Standard (AES), or the Data Encryption Standard (DES) for encrypting and / or decrypting data, or with other suitable encryption systems.

[0017] The Fig. 1A, Fig. 1B, Fig. 2A and Fig. Figures 2B are views depicting secure storage devices 100 and 200 according to exemplary embodiments of the present invention.

[0018] Referring to the Fig. 1A and Fig. 1B comprises the secure storage device 100, an interface 110, a processor 120, a memory unit 130, and a key unit 140. The secure storage device 100 communicates with a host processor 108, which is located in a host device 105.

[0019] In Fig. In 1A, the secure storage device 100 is located outside the host device 105, which includes the host processor 108, and communicates via the interface 110. The secure storage device 100 can be detachably connected to the host device 105 via connectors in the host device 105.

[0020] In Fig. In 1B, the secure storage device 100 is located inside the host device 105 and communicates with the host processor 108 via interface 110. The secure storage device 100 can be installed in the host device 105. The host device 105 can have at least one other storage device installed within it.

[0021] A user operates the host device 105. The host device 105 communicates with the secure storage device 100, which encrypts and decrypts the data stored on the secure storage device 100. The user can enter a password upon startup or commissioning to access the secure storage device 100 in a locked state. Alternatively, the user can choose not to enter a password but can access the secure storage device 100 without restrictions in an unlocked state. In both the locked and unlocked states, the data is already encrypted. In the locked state, the user controls the security key by setting the password.

[0022] It is possible for a user to enter a password to create a document from data with different restrictions or encryption / decryption levels or areas stored in storage unit 130.

[0023] When locked, a lost password can be recovered using several techniques. A request / response sequence can be used to recover the lost password. Alternatively, password-protected encryption key files can be generated and stored in a secure location.

[0024] Processor 120 processes data in accordance with an instruction, e.g., a read / write instruction, received from host processor 108. Processor 120 can be a microprocessor, a microcontroller, a digital signal processor, a dedicated-purpose chip, or a general-purpose programmed chip.

[0025] Storage unit 130 stores data. Storage unit 130 can be a solid-state drive (SSD) for storing data. Storage unit 130 can be another type of storage device, such as flash memory, a module or package of multiple semiconductor memory chips, a memory card, etc. Alternatively, storage unit 130 can be another type of storage device, such as a conventional hard disk drive (HDD), an optical disc drive (ODD), etc. Storage unit 130 has a storage location (or physical storage space) for storing data or information.

[0026] The key unit 140 simultaneously performs encryption and decryption in accordance with the read / write command received from the host processor 108, while the processor unit 120 processes the data in response to the command received from the host processor 108. In an exemplary embodiment of the present invention, the key unit parses the command, recovering an address from the command, uses the address to locate a security key, and performs encryption or decryption of data corresponding to the read / write command. The key unit 140 can be a separate unit with memory for storing a security key list and a dedicated or general-purpose microprocessor for performing the security key retrieval and data encryption.

[0027] The instruction can contain a first instruction corresponding to the processing of the data by processor 110 and a second instruction corresponding to the encryption or decryption by key unit 140. Alternatively, the instruction can be interpreted simultaneously by processor 120 and key unit 140 in such a way that the data processing and encryption or decryption are performed concurrently.

[0028] The security key list is specific to storage unit 130. Storage unit 130 is divided into n areas, and each area has a unique security key assigned to it, which is used to encrypt and decrypt the data contained within it. The area can be defined by the manufacturer and consists of a data set. The security key list contains n security keys corresponding to the n areas of storage unit 130. The data in each area can have a fixed block size, for example, 64 bits, 128 bits, 192 bits, 256 bits, etc., and the security keys for each area can also have a block size of, for example, 64 bits, 128 bits, 192 bits, 256 bits, etc.An address parsed from the read / write command received from the host processor 108 can be used in conjunction with the security key list to determine the required security key for encryption and / or decryption of the data specified with the parsed address.

[0029] If the security key has been selected from the security key list using the parsed address from the read / write command received from the host processor 108, the key unit 140 uses the security key to encrypt and / or decrypt the data. The key unit 140 can use Advanced Encryption Standard (AES) or Data Encryption Standard (DES) to encrypt and / or decrypt the data, or it can use another suitable encryption system.

[0030] Key Unit 140 parses the address from the instruction and performs the encryption and / or decryption without using Processor 120. Therefore, Processor 120 can process the data as specified in the instruction while Key Unit 140 simultaneously performs the encryption or decryption. Key Unit 140 is capable of encrypting or decrypting the data without interrupting or requiring control from Processor 120, while Processor 120 is capable of processing the data without interrupting Key Unit 140. Neither Key Unit 140 nor Processor 120 has priority over the other, and neither Key Unit 140 nor Processor 120 interferes with the other.

[0031] Processor 120 processes the data, which may include performing an assignment operation to map a logical address to a corresponding physical address in memory unit 130 in accordance with the instruction. Processor 120 can perform further data processing following the encryption processing by key unit 140.

[0032] Processor 120 does not need to wait or delay data processing until Key Unit 140 has completed the encryption or decryption process. Processor 120 can perform part of the data processing during the encryption or decryption process by Key Unit 140. Processor 120 can prepare data processing during the encryption or decryption process by Key Unit 140 in such a way that Processor 120 can complete data processing in accordance with the instruction for Key Unit 140 to complete the encryption or decryption process.

[0033] The speed of processing encryption and data simultaneously is faster than the speed of processing them sequentially. The time required for simultaneous processing of encryption and data, which may be a single clock cycle or any other duration, is shorter than the time required for sequential processing.

[0034] Referring to Fig. 2A and Fig. 2B comprises the secure storage device 200, an interface 210, a processor 220, a storage unit 230, and a security unit 240, which includes a decoder unit 242, a key unit 244, and an encryption unit 246. The secure storage unit 200 communicates with a host processor 208, which is located in a host device 205.

[0035] At Fig. In 2A, the secure storage device 200 is located outside the host device 205, which includes the host processor 208, and communicates via interface 210. The secure storage device 200 can be detachably connected to the host device 205 via connectors in the host device 205.

[0036] At Fig. In 2B, the secure storage device 200 is located inside the host device 205 and communicates with the host processor 208 via interface 210. The secure storage device 200 can be installed in the host device 205. The host device 205 can have at least one other storage device installed within it.

[0037] A user operates the host device 205. The host device 205 communicates with the secure storage device 200, which recognizably encrypts or decrypts the data stored on the secure storage device 200. After startup or commissioning, the user can enter a password to access the secure storage device 200 in a locked state. Alternatively, the user can choose not to enter a password but can access the secure storage device 200 without restrictions in an unlocked state. In both the locked and unlocked states, the data has already been decrypted. In the locked state, the user controls the security key by setting the password.

[0038] It is possible for a user to enter a password to create a document from data with different restrictions or encryption / decryption levels or areas stored in storage unit 230.

[0039] When locked, a lost password can be recovered using several techniques. A prompt / response sequence can be used to recover the lost password. Alternatively, password-protected encryption key files can be generated and stored in a secure location.

[0040] The 220 processor processes data in accordance with an instruction, such as a read / write instruction, received from the 208 host processor. The 220 processor can be a microprocessor, a microcontroller, a digital signal processor, a dedicated chip, or a general-purpose programmed chip.

[0041] The storage unit 230 stores data. The storage unit 230 can be a solid-state drive (SSD) for storing data. The storage unit 230 can be another type of storage device, such as flash memory, a module or package of multiple semiconductor memory chips, a memory card, etc. Alternatively, the storage unit 230 can be another type of storage device, such as a conventional hard disk drive (HDD), an optical disc drive (ODD), etc. The storage unit 230 has a storage space (or physical storage space) for storing data or information.

[0042] The security unit 240 comprises a decoder unit 242, a key unit 244 and an encryption unit 246.

[0043] The decoder unit 242 parses address information from the instruction received from the host device 208 and selects a corresponding security key. The decoder unit 242, which can be a dedicated or general-purpose circuit, can receive the instruction from the interface 210 via the processor 220, or it can receive the instruction directly from the interface 210 and decode it.

[0044] The instruction can comprise a first instruction corresponding to the processing of data by processor 210 and a second instruction corresponding to encryption or decryption by decoder unit 242. Alternatively, the instruction can be interpreted simultaneously by processor 220 and decoder unit 242 to perform data processing and encryption or decryption concurrently.

[0045] Decoder unit 242 parses the command and determines an address from it. The address parsed from the read / write command received by host processor 208 can be used in conjunction with the key list stored in key unit 244 to determine the necessary security key for encrypting and / or decrypting the data specified at the parsed address.

[0046] In an exemplary embodiment of the present invention, the key unit 244 stores a list of security keys. The key unit 244 can be a separate storage unit containing the key list, or it can be arranged within the storage unit 230. The security key list is referenced to the storage unit 230. The storage unit 230 is divided into n areas, and each area has a unique security key assigned to it, which is used to encrypt and decrypt data contained therein. The area can be defined by the manufacturer and consists of a data set. The security key list contains n security keys corresponding to the n areas of the storage unit 230. The data in each area can have a fixed block size of, for example, 64 bits, 128 bits, 192 bits, 256 bits, etc., and the security key for each area can be, for example,64-bit, 128-bit, 192-bit, 256-bit, etc.

[0047] Decoder unit 242 can use the address to directly select the corresponding security key from the key list stored in memory unit 230, or decoder unit 242 can generate a key flag using the address parsed from the received command. This key flag can then be used to select the corresponding security key from the key list stored in memory unit 230. Decoder unit 242 can compare the address with a reference to generate the key flag used to select the security key for encrypting or decrypting the data.

[0048] The encryption unit 246 performs a decryption process to decrypt data in accordance with the selected cryptographic key. The encryption unit 246, which can be a dedicated, purpose-built, or general-purpose circuit, can be an Advanced Encryption System (AES) or a Data Encryption System (DES) cipher, or any suitable cipher.

[0049] When the security key stored in the security key list in the key unit 250 has been selected by the decoder unit 242 using the parsed address from the read / write command received from the host processor 208, the encryption unit 246 uses the security key to encrypt and / or decrypt data. The encryption unit 246 can use the Advanced Encryption System (AES) or the Data Encryption System (DES) to encrypt and / or decrypt the data, or it can use another encryption system, as applicable.

[0050] Decoder unit 242 parses the address from the instruction, and cipher unit 246 performs the encryption and / or decryption without using processor 220. Therefore, processor 220 can process the data as specified in the instruction while decoder unit 240 simultaneously selects the security key. Cipher unit 246 is capable of encrypting or decrypting the data without interrupting or requiring control from processor 220, while processor 220 is capable of processing the data without interrupting cipher unit 246. Neither decoder unit 242 nor processor 220 has priority over the other, and neither interferes with the other.

[0051] The processor 220 processes the data, which may include performing an assignment operation to map a logical address to a corresponding physical address in the memory unit 230 in accordance with the instruction. The processor 220 can perform further data processing following the encryption processing by the cipher unit 246. The processor 220 can output a signal to the host device 205 in accordance with the processed data and the encryption operation.

[0052] The processor 220 does not need to wait or delay data processing until the decoder unit 242 has completed the encryption or decryption process. The processor 220 can perform part of the data processing during the encryption or decryption process by the decoder unit 242. The processor 220 can prepare data processing during the encryption or decryption process by the decoder unit 242 in such a way that the processor 220 can complete the data processing in accordance with the instruction for the completion of the encryption or decryption process by the decoder unit 242.

[0053] The speed of processing encryption and data simultaneously is faster than the speed of processing them sequentially. The time required for simultaneous processing of encryption and data, which may be a single clock cycle or any other duration, is shorter than the time required for sequential processing.

[0054] The processor 220 and the decoder unit 242 simultaneously process the data and select the security key upon receiving the instruction. The host device 205 can communicate with a user to change the security keys by generating an interface signal corresponding to a user window. The decoder unit 242 can select the changed security keys. The decoder unit 242 selects one of the security keys independently of the processor 220 or the host processor 208.

[0055] Accordingly, the processor 220 does not perform any encryption or decryption, nor does it control the decoder unit 242 when selecting the security key from the key list stored in the memory unit 244. The processor 220 outputs a signal to the host device 205 in accordance with the processed data and the encryption operation. The processor 220 processes the data for a period of time during which the decoder unit 242 selects the security key and the encryption unit 246 performs the encryption operation. The processor 220 may output a signal generated from the processed data once the encryption unit 246 has completed the encryption operation. The decoder unit 242 generates a signal indicating to the processor 220 that an encryption operation is in progress.

[0056] Referring to Fig. Figure 3 shows a security unit 340, which represents an exemplary embodiment of the present invention. The decoder unit 242, the key unit 244 and the encryption unit 246 are made of Fig. 2 are described in more detail below with reference to the security unit 340, which comprises a decoder unit 242, a key unit 344 and an encryption unit 346.

[0057] Fig. The assembly comprises a decoder unit 242, a key unit 344, and an encryption unit 346. The decoder unit 342 receives a command and parses an address from the command. The address can be a logical block address (LBA). The address or LBA is used to select a security key from the key unit 344. The key unit 344 comprises key 1, key 2... key n. Each key corresponds to a region of the memory unit 230 of the exemplary embodiment from Fig. 2. The security key is used in the encryption unit 346, which can be an Advanced Encryption System (AES) or a Data Encryption System (DES) cipher, or any suitable cipher.

[0058] Referring to Fig. Figure 4 shows a block diagram of the storage device 400, which illustrates an exemplary embodiment of the present invention. The storage device 400 communicates with a processor 420 via a bus 415 and with an external device 405 via an interface 410. A serial ATA drive and interface, or any other suitable drive and interface standard, can be used. Any suitable processor or host capable of sending instructions and receiving data from external storage can be used. The processor 420 can include an additional memory unit, such as a ROM or RAM, for performing data processing.

[0059] Instead of the 420 processor, an instruction parser 441 parses an instruction in the conventional way, such as a read or write instruction, and extracts an address. The operation of the instruction parser 441 is described below. Fig. 5, Fig. 6 to Fig. 7 shown.

[0060] The address parsed by the instruction parser 441, which may be an LBA, is used by the LBA decoding unit 442 in conjunction with the keying unit 444 to generate a security key. The security key is used in the cipher unit 446 to encrypt or decrypt data stored in memory 430 on the storage device 400. After encryption or decryption, the data is passed to the processor 420 for processing. Because parsing, decoding, and encryption / decryption occur in a single hardware solution, the data is not passed to the processor 420 for encryption / decryption until it is forwarded to the processor 420 in response to the instruction.

[0061] Alternatively, the LBA decoding unit 442 can use the address to generate a key flag. The key flag is then passed to the cipher unit 446, which uses the key flag to select a security key from the key unit 444. The security key is then used by the cipher unit 446, as described above, to encrypt or decrypt data stored in memory 430.

[0062] The instruction parser 441 can send subcommands via bus 415 to the processor 420 and also to the LBA decoding unit 442. Upon receiving the instruction, the processor 420 and the LBA decoding unit 442 can simultaneously process data and select the security key.

[0063] Fig. Section 5 presents an example operation of the command parser 441. Fig. 4. The instruction parser 441 receives an instruction in the form of a frame from an external device, such as a host device 450, and parses the frame to determine an address specified within it. A conventional host-to-device frame information structure (FIS) in a Serial ATA hardware architecture implementation includes: a frame start (SOF) delimiter, a payload containing transport layer information, a cyclic redundancy check (CRC), and a frame end (EOF) delimiter. The FIS also includes a logical block address 500, which can be in the form of a cylinder, a head, and a sector, and includes a cylinder high and a cylinder low, as well as a cylinder high (exp) and a cylinder low (exp). Cylinder high includes the contents of a cylinder high register of memory unit 430, and cylinder low includes the contents of a cylinder low register of memory unit 430.Cyl high (exp) and Cyl low (exp) comprise the contents of extended address fields of memory unit 430. Logical block address 500 is parsed by the instruction parser 441 and used by the LBA decoding unit 442 with the key unit 444 to generate a security key or key flag.

[0064] Fig. Figure 6 represents a setup-to-host frame information structure (FIS) in a serial ATA hardware architecture implementation, which is accessed by a command parser 441 from Fig. 4 is used. The logical block address 600 can be in the form of a cylinder, a head, and a sector, and can include a cylinder high and a cylinder low, as well as a cylinder high (exp) and a cylinder low (exp). The logical block address 600 is parsed by the instruction parser 441 and used by the LBA decoding unit 442 with the key unit 444 to generate a security key or a key flag.

[0065] Fig. 7 represents another setup-to-host frame information structure (FIS) in a serial ATA hardware architecture implementation, which is accessed by a command parser 441 from Fig. 4 is used. The logical block address 700 can be in the form of a cylinder, a head, and a sector, and can include a cylinder high and a cylinder low, as well as a cylinder high (exp) and a cylinder low (exp). The logical block address 700 is parsed by the instruction parser 441 and used by the LBA decoding unit 442 with the key unit 444 to generate a security key or a key flag.

[0066] Fig. 8, Fig. 9, Fig. 10 to Fig. Figure 11 presents various examples of simplified computer architectures of embodiments of the present invention.

[0067] Referring to Fig. 8. The CPU 810 communicates using the procedure described below. Fig. 12 via a serial ATA interface 820 with an optical disk drive (ODD) 830. The ODD 830 may include a processor and a key unit, which, as above with reference to Fig. 1 described, in which encryption and decryption of data are used by the CPU 810. Optionally, the ODD 830 can have a processor, a key unit, a decoding unit, and an encryption unit, which, as described above with reference to Fig. 2 described, used in the encryption and decryption of data used by the CPU 810.

[0068] Referring to Fig. The CPU 910 communicates with a hard disk drive (HDD) 930 via a serial ATA interface 920. The HDD 930 can include a processor and a key unit, which, as described above with reference to Fig. 1 described, used in the encryption and decryption of data processed by the CPU 910. Optionally, the HDD 930 can include a processor, a key unit, a decoding unit, and an encryption unit, which, as described above with reference to Fig. 2 described, used in the encryption and decryption of data used by the CPU 910.

[0069] Referring to Fig. The CPU 1010 communicates with a multimedia card 1030 via a multimedia card controller 1020. The multimedia card 1030 can include a processor and a key unit, which, as described above with reference to Fig. 1 described, used in the encryption and decryption of data processed by the CPU 1010. Optionally, the Multimedia Card 1030 can include a processor, a key unit, a decoding unit, and an encryption unit, which, as described above with reference to Fig. 2 described, used in the encryption and decryption of data used by the CPU 1010.

[0070] Referring to Fig. The CPU 1110 communicates with a security digital interface 1120 and a security digital card (SD card) 1130 via a security digital interface 1120. The SD card 1130 can include a processor and a key unit, which, as described above with reference to Fig. 1 described in the encryption and decryption of data used by the CPU 1110. Optionally, the SD card 1130 can include a processor, a key unit, a decoding unit, and an encryption unit, as described above with reference to Fig. 2 described, used in the encryption and decryption of data used by the CPU 1110.

[0071] Fig. Figure 12 shows a flowchart of an embodiment of the present invention. For illustration, Fig. 12 using the control device 400 from Fig. As described in section 4, during operation S 1205, an instruction is received by the storage device 400. During operation S 1210, the instruction is parsed by the instruction parser 441. The logical block address (LBA) of the instruction is parsed, and the LBA is compared to the current LBA by the LBA decoding unit 442. If the LBA differs, the new LBA is subsequently used by the LBA decoding unit 442 during operation S 1215. If the LBA is the same, the current LBA and security key are subsequently used by the cipher unit 446 for encryption and decryption. During operation S 1220, the new LBA is used in the LBA decoding unit 442 to generate a suitable key flag.With the key flag generated by the LBA decoding unit 442, the security key is selected from the key unit 444 during operation S 1225 and then used by the cipher unit 446 for encrypting and decrypting data.

[0072] Similarly, the secure storage device receives 100 from Fig. 1. The secure storage device 100 receives an instruction. The processor 120 processes data in response to the instruction, and the key unit 140 simultaneously selects a security key using address information from the instruction. The key unit 140 uses the security key to encrypt or decrypt the data.

[0073] Similarly, the secure storage device receives 200 from Fig. 1. The secure storage device 200 receives a read / write request. The decoding unit 242 parses an address from the read / write request, which may be a logical block address, and generates a key flag corresponding to the logical block address. The keying unit 44 selects a security key using the key flag, and the encryption unit 246 uses the security key to encrypt or decrypt the data as specified by the read / write request. When the data is encrypted or decrypted, it is passed to the processor 220 for further processing, which includes forwarding the encrypted data to the host device 205 or writing the encrypted data to memory 230.

[0074] Fig. Figure 13 shows a flowchart of an embodiment of the present invention. For illustration, Fig. 13 using the storage device 100 from Fig. 1A and Fig.As described in Figure 1B, in operation S1305, storage device 100 receives an instruction from host device 105. The instruction is simultaneously forwarded to processor 120 and key unit 140. In operation S1310, processor 120 begins processing the data in accordance with the instruction. In operation S1215, key unit 140 performs encryption or decryption of the data. When the encryption and / or decryption is complete, processor 120 finishes processing the encrypted or decrypted data in operation S1220. Therefore, processor 120 begins processing the data while key unit 140 performs encryption or decryption, and when the encryption or decryption is complete, processor 120 finishes processing the encrypted or decrypted data.

[0075] The present invention can also be implemented as computer-readable code on a computer-readable medium. The computer-readable medium can comprise a computer-readable recording medium and a computer-readable transmission medium. The computer-readable recording medium is any data storage device that can store data as a program that can subsequently be read by a computer system. Examples of a computer-readable recording medium include read-only memory (ROM), main memory (RAM), CD-ROMs, magnetic tapes, floppy disks, and optical data storage devices. The computer-readable recording medium can also be distributed over a network of interconnected computer systems such that the computer-readable code is stored and executed in a distributed or decentralized manner. The computer-readable transmission medium can transmit carrier waves or signals (e.g., wired or wireless data transmission via the internet).Likewise, functional programs, codes and code segments to achieve the present invention can be easily designed by a programmer who is skilled in the relevant field of the present invention.

Claims

[1] Storage device with: a storage unit (130) for storing data; a processor unit (120) for processing the data in accordance with an instruction received from an external device (105); and a key unit (140) for simultaneously processing an encryption corresponding to the command, while the processor unit (120) processes the data. [2] Storage device according to claim 1, wherein the key unit (140) processes the encryption simultaneously without interrupting the processor unit (120). [3] Storage device according to claim 1, wherein the key unit (140) processes the encryption without control of the processor unit (120). [4] Storage device according to claim 1, wherein the processor unit (120) processes the data without interrupting the key unit (140). [5] Storage device according to claim 1, wherein the key unit (140) and the processor unit (120) communicate with each other after the key unit (140) has completed the encryption processing. [6] Storage device according to claim 1, wherein the key unit (140) and the processor unit (120) process the encryption and the data simultaneously, and the processing of the data differs from the processing of the encryption. [7] Storage device according to claim 1, wherein the processing of the data and the processing of the encryption have no priority, which consists in an order for sequentially performing the processing of the encryption and the data in accordance with the command. [8] Storage device according to claim 1, wherein the processing of the data and the processing of the encryption do not interfere with each other. [9] Storage device according to claim 1, wherein the processing of the data comprises processing an assignment operation to assign logical addresses to physical addresses in accordance with the instruction. [10] Storage device according to claim 1, wherein the processor unit (120) performs other processing of the data in accordance with a result of the processing of the encryption. [11] Storage device according to claim 1, wherein: An initial duration is needed to process the encryption and the data sequentially; A second duration is needed to process the encryption and the data simultaneously; and the second duration is shorter than the first duration. [12] Storage device according to claim 1, wherein the speed of simultaneous processing of the encryption and the data is faster than the speed of sequential processing of the encryption and the data. [13] Storage device with: a storage unit (230) for storing data; a processor unit (220) for processing the data in accordance with an instruction received from an external device (205); a key unit (244) for storing a large number of cryptographic keys; and a decoder unit (242) for selecting one of the crypto keys in accordance with address information from the command received from the external device (205), wherein the processor unit (220) and the decoder unit (242) each perform the processing of the data and the selection of the crypto key simultaneously upon receipt of the instruction. [14] Storage device according to claim 13, further comprising: a cipher unit (246) for performing an encryption operation to encrypt data in accordance with the selected crypto key. [15] Storage device according to claim 14, wherein: the processor unit (220) in accordance with the processed data and the encryption process sends a signal to the external device (205). [16] Storage device according to claim 14, wherein: the processor unit (220) which processes the data for a period of time in which the decoder unit (242) selects the crypto keys and the encryption unit (246) performs the encryption process. [17] Storage device according to claim 14, wherein: the processor unit (220) is allowed to output a signal generated from the processed data when the encryption unit (246) completes the encryption process. [18] Storage device according to claim 13, wherein the decoder unit (242) generates a signal indicating an encryption operation to the processor unit (220). [19] Storage device according to claim 13, wherein the decoder unit (242) compares the address information with a reference to generate a signal for selecting the crypto key for encrypting the data. [20] Storage device according to claim 13, wherein the decoder unit (242) generates a key flag that represents a selection of the one crypto key. [21] Storage device according to claim 13, wherein the plurality of crypto keys has a multiple of 64 bits. [22] Storage device according to claim 13, wherein the processor unit (220) does not perform an encryption operation of the decoder unit (242) in accordance with the instruction. [23] Storage device according to claim 13, wherein the decoder unit (242) has an instruction analysis unit (441) for analyzing an instruction from the external device (405) in order to obtain the address information in real time. [24] Storage device according to claim 13, wherein the decoder unit (242) has an address conversion unit to link the address information with the one crypto key corresponding to the address information in real time. [25] Storage device according to claim 13, wherein: an encryption process is completed in accordance with the selected cryptographic key; and The processor unit (220) outputs other data to the external device (205) in accordance with the processing data and the completion of the encryption process. [26] Storage device according to claim 13, further comprising: an interface unit (210) for receiving the command from the external device (205), wherein the processor unit (220) and the decoder unit (242) receive the instruction from the interface unit (242) to each perform the processing of the data and an encryption instruction in accordance with the received instruction. [27] Storage device according to claim 14, further comprising: a data bus (414) which is connected to the processor unit (420) and the decoder unit (442) to transmit the instruction to the respective processor unit (420) or decoder unit (442). [28] Storage device according to claim 27, wherein the data bus (414) has a first connection that is connected to the processor unit (420) and a second connection that is connected to the decoder unit (442). [29] Storage device according to claim 13, further comprising: a housing that can be connected to the external device (205) to accommodate the storage unit (230), the processor unit (220), the key unit (244) and the decoder unit (242), wherein the processor unit (220) and the decoder unit (242) are spaced apart from each other inside the housing. [30] Storage device according to claim 13, wherein the decoder unit (242) is not controlled by the processor unit (220) during the selection of the crypto key in the encryption process. [31] Storage device with: a processor unit (220) for performing data processing in accordance with an instruction received from an external device (205); a decoder unit (242) for performing a selection of crypto keys in accordance with address information from the command received from the external device (205), wherein the processor unit (220) and the decoder unit (242) each perform the processing of the data and a selection of the crypto keys simultaneously upon receipt of the instruction. [32] Storage system with: a host device (205) for generating a command; and a storage device (200) that can be linked to the host device (205), wherein the storage device (200) comprises: a storage unit (230) for storing data; a processor unit (220) for processing the data in accordance with the instruction received from an external device; a key unit (244) for storing a large number of cryptographic keys; and a decoder unit (242) for selecting one of the crypto keys in accordance with address information from the command received from the external facility, wherein the processor unit (220) and the decoder unit (242) each perform the processing of the data and the selection of the crypto key simultaneously upon receipt of the instruction. [33] Storage system with: a host device (205) for generating a command; and a storage device (200) that can be linked to the host device (205), wherein the storage device comprises: a processor unit (220) for performing data processing in accordance with an instruction received from an external device (208); a decoder unit (242; 342) for performing a selection of crypto keys in accordance with address information from the command received from the external device (208), wherein the processor unit (220) and the decoder unit (242; 342) each perform the processing of the data and a selection of the crypto keys simultaneously upon receipt of the instruction. [34] Storage system according to claim 33, wherein: The host device (205) generates an interface signal to correspond with a user window for changing the crypto key. [35] Storage system according to claim 34, wherein: the decoder unit (242; 342) performs a selection of the changed crypto key. [36] Storage device with: a key unit (244; 344) for storing a large number of cryptographic keys; and a decoder unit (242; 342) for selecting one of the crypto keys in accordance with address information obtained from an external facility (208); a storage unit (230) for storing data; and a control processor unit (220) for managing, reading and writing data from the storage unit using the selected crypto key, wherein the decoder unit (242) selects one of the crypto keys independently of the control processor unit (220), wherein the control processor unit (220) and the decoder unit (242) each perform the processing of the data and the selection of the crypto key simultaneously upon receipt of a command. [37] Solid-state drive with: a key unit (244) for storing a large number of crypto keys; and a decoder unit (242) for selecting one of the crypto keys in accordance with address information obtained from an external facility (205); a storage unit (230) for storing data; and a control processor unit (220) for managing, reading and writing data from the storage unit using the selected crypto key, wherein the decoder unit (242) selects one of the crypto keys independently of the control processor unit (220), wherein the control processor unit (220) and the decoder unit (242) each perform the processing of the data and the selection of the crypto key simultaneously upon receipt of a command. [38] A data system with: a host device (205) for generating a command; and a storage device (200) that can be linked to the host device (205), wherein the storage device (200) comprises: a key unit (244) for storing a large number of crypto keys; a decoder unit (242) for selecting one of the crypto keys in accordance with address information obtained from an external facility (208); a storage unit (230) for storing data; and a control processor unit (220) for managing, reading and writing data from the storage unit using the selected crypto key, wherein the decoder unit (242) selects one of the crypto keys independently of the control processor unit (220), wherein the control processor unit (220) and the decoder unit (242) each perform the processing of the data and the selection of the crypto key simultaneously upon receipt of the instruction. [39] Method for encrypting data with the following steps: Receiving an order; Parsing an address from the command; Obtaining a portion of a logical block address; Generating a key flag corresponding to the range of the logical block address; and Selecting a crypto key using the key flag. [40] Method for encrypting data with the following steps: Receiving a writing request; Parsing an address from the write request; Obtaining a portion of a logical block address; Generating a key flag corresponding to the range of the logical block address; Selecting a crypto key using the key flag; Using the crypto key to encrypt data; and Writing the encrypted data to a memory (230). [41] Method for decrypting data with the following steps: Receiving an order; Parsing an address from the command; Obtaining a portion of a logical block address; Generating a key identifier corresponding to the range of the logical block address; and Selecting a crypto key using the key flag. [42] Methods for decrypting data with the following steps: Receiving a read request; Parsing an address from the read request; Obtaining a portion of a logical block address; Generating a key flag corresponding to the range of the logical block address; Selecting a crypto key using the key flag; Using the crypto key to decrypt data; and Reading the encrypted data from a storage device (230). [43] Method for performing an encryption operation in a storage device comprising the steps: Receiving an order; and Simultaneous processing of data in accordance with the command and execution of a selection of crypto keys in accordance with the address information from the command. [44] A computer-readable medium for storing computer-readable codes as a program for carrying out a method for performing an encryption operation in a storage device (100; 200), wherein the method comprises: Receiving an order; and Simultaneous processing of data in accordance with the command and execution of a selection of crypto keys in accordance with the address information from the command.

Images