Memory system and control method

Abstract

To realize a memory system which is useful for effective use of a storage space and protection of user data.SOLUTION: A controller of a memory system includes a compression circuit, an encryption circuit, and a compression unit generation circuit. The compression unit generation circuit generates a first compression unit corresponding to a name space at a writing destination, which is calculated on the basis of first name space setting information showing setting of the name space at the writing destination. The first compression unit has a size satisfying restriction that an encryption key for encrypting data which should be written in the name space at the writing destination is not switched within the first compression unit.SELECTED DRAWING: Figure 7

Description

[Technical field]

[0001] An embodiment of the present invention relates to a memory system including a non-volatile memory and a control method for controlling the memory system. [Background technology]

[0002] In recent years, memory systems equipped with nonvolatile memories have become widespread. One such memory system is a solid-state drive (SSD) equipped with a NAND flash memory.

[0003] Recently, there has been a demand for a memory system that is useful for effectively utilizing the storage space of a non-volatile memory and for protecting user data stored in the memory system. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] US Patent Application Publication No. 2016 / 0011972 [Patent Document 2] US Patent Application Publication No. 2022 / 0377027 [Patent Document 3] US Patent Application Publication No. 2022 / 0377013 Summary of the Invention [Problem to be solved by the invention]

[0005] An object of the present invention is to provide a memory system and a control method that are useful for effectively utilizing the storage space of a non-volatile memory and protecting user data. [Means for solving the problem]

[0006] According to an embodiment, a memory system is connectable to a host. The memory system includes a non-volatile memory and a controller. The controller is configured to manage a plurality of namespaces used by the host to access the memory system and to control the non-volatile memory. The controller includes a compression circuit, an encryption circuit, and a compression unit generation circuit. The compression circuit is configured to compress write data received from the host. The encryption circuit is configured to generate encrypted data to be written to the non-volatile memory by encrypting the compressed data output from the compression circuit using an encryption key. The compression unit generation circuit is configured to generate a compression unit that is a unit for compressing the write data for each of the plurality of namespaces. In response to receiving a write command from the host specifying a namespace identifier of a write destination namespace, the compression unit generation circuit generates a first compression unit corresponding to the write destination namespace, the first compression unit being calculated based on first namespace setting information indicating a setting of the write destination namespace, and having a size that satisfies a constraint that an encryption key for encrypting data to be written to the write destination namespace does not switch within the first compression unit. The compression unit generation circuit sets the first compression unit in the compression circuit. [Brief description of the drawings]

[0007] [Figure 1] 1 is a block diagram showing an example of the configuration of an information processing system including a memory system according to a first embodiment. [Diagram 2] 2 is a block diagram showing an example of the configuration of each of a plurality of memory chips included in a nonvolatile memory of the memory system according to the first embodiment. [Diagram 3] FIG. 2 is a diagram showing an example of the configuration of a namespace used in the memory system according to the first embodiment. [Figure 4] FIG. 2 is a diagram showing an example of the configuration of a locking table used in the memory system according to the first embodiment. [Diagram 5] 3 is a diagram showing an example of setting a logical address range (LBA range) in the memory system according to the first embodiment; [Figure 6] FIG. 2 is a diagram showing an example of the relationship between a compression unit for compressing data and an encryption key for encrypting data. [Figure 7] 4A to 4C are diagrams showing examples of data write processing and data read processing executed in the memory system according to the first embodiment. [Figure 8] 4 is a diagram showing an example of namespace setting information managed in the memory system according to the first embodiment. [Figure 9] 5 is a flowchart showing the procedure of a data write process executed in the memory system according to the first embodiment. [Figure 10] 1 is a flowchart showing the procedure of a compression unit generation process executed in the memory system according to the first embodiment. [Figure 11] 11 is a flowchart showing the procedure of an encryption key switching unit calculation process executed in the memory system according to the first embodiment. [Figure 12] 6 is a flowchart showing the procedure of a data read process executed in the memory system according to the first embodiment. [Figure 13] 13A and 13B are diagrams showing examples of data write and read processes in a memory system according to a second embodiment. [Figure 14] FIG. 11 is a diagram showing a first example of a compression process for a plurality of write data items, which is executed in the memory system according to the second embodiment. [Figure 15] FIG. 11 is a diagram showing a second example of the compression process performed on a plurality of write data items in the memory system according to the second embodiment. [Figure 16] FIG. 11 is a diagram showing a third example of the compression process performed on a plurality of write data in the memory system according to the second embodiment. [Figure 17A] 10 is a flowchart showing some steps of a data write process executed in a memory system according to a second embodiment. [Figure 17B]10 is a flowchart showing the remaining steps of the data write process executed in the memory system according to the second embodiment. [Figure 18] 13A and 13B are diagrams showing examples of data write and read processes in a memory system according to a third embodiment. [Figure 19] FIG. 13 is a diagram showing a first example of a compression process for a plurality of write data items, which is executed in the memory system according to the third embodiment. [Figure 20] FIG. 13 is a diagram showing a second example of the compression process performed on a plurality of write data in the memory system according to the third embodiment. [Figure 21] FIG. 13 is a diagram showing a third example of a compression process performed on a plurality of write data items in the memory system according to the third embodiment. [Figure 22A] 11 is a flowchart showing some steps of a data write process executed in a memory system according to a third embodiment. [Figure 22B] 13 is a flowchart showing the remaining steps of the data write process executed in the memory system according to the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Hereinafter, an embodiment will be described with reference to the drawings. (First embodiment) 1 is a block diagram showing an example of the configuration of an information processing system 1 including a memory system 3 according to the first embodiment. The information processing system 1 includes a host 2 and a memory system 3. The host 2 and the memory system 3 can be connected via a bus 7.

[0009] The host 2 is an information processing device. The host 2 is, for example, a personal computer, a server computer, or a mobile terminal. The host 2 accesses the memory system 3. Specifically, the host 2 transmits a write command, which is a command for writing data, to the memory system 3. In addition, the host 2 transmits a read command, which is a command for reading data, to the memory system 3.

[0010] The memory system 3 is a storage device connectable to the host 2. The memory system 3 is realized by, for example, a solid-state drive (SSD). The memory system 3 includes a non-volatile memory. The memory system 3 writes data to the non-volatile memory. Also, the memory system 3 reads data from the non-volatile memory.

[0011] The communication between the memory system 3 and the host 2 is performed via a bus 7. The bus 7 is a transmission line that connects the host 2 and the memory system 3. The bus 7 is, for example, a PCI express TM (PCIe TM ) bus. The host 2 and the memory system 3 transmit and receive data, input / output (I / O) commands, and responses thereto via the PCIe bus. An I / O command is a command for writing data to a nonvolatile memory or reading data from a nonvolatile memory. An I / O command is, for example, a write command or a read command.

[0012] As a standard of a logical interface for connecting the host 2 and the memory system 3, for example, NVM express TM (NVMe TM) standard may be used. In the interface of the NVMe standard, a command and its response are transmitted and received between the host 2 and the memory system 3 using a pair of queues including at least one submission queue (SQ) and a completion queue (CQ) associated with the at least one submission queue (SQ). This pair of queues is called a submission queue / completion queue pair (SQ / CQ pair). The host 2 issues a command by storing the command in the submission queue (SQ), and checks whether the processing of the issued command is completed by processing the completion response stored in the completion queue (CQ). The memory system 3 receives a command from the host 2 by fetching the command stored in the submission queue (SQ), and notifies the host 2 that the processing of the command is completed by storing the completion response corresponding to the command whose processing has been completed in the completion queue (CQ).

[0013] Next, the configuration of the host 2 will be described.

[0014] The host 2 includes a processor 21 and a memory 22. The processor 21 and the memory 22 are interconnected via an internal bus 20.

[0015] The processor 21 is, for example, a CPU. The processor 21 executes software (host software) that is loaded into the memory 22 from the memory system 3 or another storage device connected to the host 2. The host software includes, for example, an operating system, a file system, and an application program.

[0016] The memory 22 is, for example, a volatile memory. The memory 22 is also referred to as a main memory, a system memory, or a host memory. The memory 22 is, for example, a dynamic random access memory (DRAM). A part of the storage area of ​​the memory 22 is used to store SQ / CQ pairs. Another part of the storage area of ​​the memory 22 is used as a data buffer. The data buffer stores write data to be written to the memory system 3 or read data transferred from the memory system 3.

[0017] Next, a description will be given of the internal configuration of the memory system 3. The memory system 3 includes a controller 4 and a non-volatile memory 5. The memory system 3 may further include a random access memory, for example, a dynamic random access memory (DRAM) 6.

[0018] The controller 4 is a memory controller. The controller 4 is, for example, a control circuit such as a system-on-a-chip (SoC). The controller 4 is electrically connected to the nonvolatile memory 5. The controller 4 processes each I / O command received from the host 2 to execute a data read process for reading data from the nonvolatile memory 5 and a data write process for writing data to the nonvolatile memory 5. As a physical interface connecting the controller 4 and the nonvolatile memory 5, for example, a Toggle NAND flash interface or an Open NAND flash interface (ONFI) is used. The functions of each part of the controller 4 can be realized by dedicated hardware, a processor that executes a program, or a combination of these.

[0019] An example of the nonvolatile memory 5 is, for example, a NAND type flash memory. The nonvolatile memory 5 may be a two-dimensional flash memory or a three-dimensional flash memory. The nonvolatile memory 5 includes, for example, a plurality of memory chips. The memory chips are also called memory dies. Each of the plurality of memory chips is realized, for example, as a NAND type flash memory die. Hereinafter, the memory chips are called NAND chips. FIG. 1 shows a case where the nonvolatile memory 5 includes 32 NAND chips #0 to #31.

[0020] The DRAM 6 is a volatile memory. A part of the storage area of ​​the DRAM 6 is used to store management data used by the controller 4, for example.

[0021] Next, the internal configuration of the controller 4 will be described. The controller 4 includes a host interface (host I / F) 401, a CPU 402, an encryption key management circuit 403, an error correction code (ECC) processing circuit 404, a DRAM interface (DRAM I / F) 405, a compression circuit 406, an expansion circuit 407, an encryption circuit 408, a decryption circuit 409, a buffer memory 410, and a non-volatile memory interface (non-volatile memory I / F) 411. The host interface 401, the CPU 402, the encryption key management circuit 403, the ECC processing circuit 404, the DRAM interface 405, the compression circuit 406, the expansion circuit 407, the encryption circuit 408, the decryption circuit 409, the buffer memory 410, and the non-volatile memory interface 411 are interconnected via an internal bus 400.

[0022] The host interface 401 is a communication interface circuit that executes communication with the host 2. The host interface 401 receives (fetches) various commands, such as a write command and a read command, from the host 2. Then, the host interface 401 transmits a response (e.g., a completion response) corresponding to the command processed by the controller 4 to the host 2.

[0023] The write command is a command that requests the memory system 3 to write user data (write data) to the non-volatile memory 5. The write command specifies, for example, a namespace identifier that identifies the write destination namespace, a write destination logical address (start LBA) within this write destination namespace, a size of the write data (number of LBAs) associated with this write command, and a data pointer that indicates the location in memory 22 where the write data is stored. The write destination namespace is the namespace where the write data should be written. The write destination logical address is the first logical address where the write data should be written.

[0024] The read command is a command that requests the memory system 3 to read user data (read target data) from the non-volatile memory 5. The read command specifies, for example, a namespace identifier that identifies a namespace, a logical address (start LBA) within this namespace, the size of the read target data (the number of LBAs), and a data pointer that indicates the position within the memory 22 to which the read target data should be transferred.

[0025] The CPU 402 is a processor that performs various processes by executing a control program (firmware) stored in the non-volatile memory 5 or a ROM (not shown).

[0026] The CPU 402, for example, as a flash translation layer (FTL), manages data stored in the non-volatile memory 5 and manages blocks included in the non-volatile memory 5. The management of data stored in the non-volatile memory 5 includes, for example, management of mapping information. The CPU 402 manages the mapping information using a logical-to-physical address translation table (L2P table). The mapping information is information indicating mapping between each logical address and each physical address of the non-volatile memory 5. The logical address is an address used by the host 2 to access the memory system 3. For example, a logical block address (LBA) is used as the logical address. The LBA is a logical address used to refer to data called a logical block. The size of the logical block that can be specified by the LBA is, for example, 512 bytes, 4 KiB, 8 KiB, or 16 KiB. The physical address is an address indicating a physical storage location in the non-volatile memory 5.

[0027] The CPU 402 also creates and manages a number of namespaces. Each of the multiple namespaces is a collection of logical addresses. The multiple namespaces are used to operate one memory system as if it were multiple memory systems. Each of the multiple namespaces is used by the host 2 to access the memory system 3. Each of the multiple namespaces is identified by a namespace identifier. The namespace identifier is an identifier used by the host 2 to specify the namespace to be accessed.

[0028] Furthermore, management of blocks contained in the non-volatile memory 5 includes management of bad blocks contained in the non-volatile memory 5, wear leveling, and garbage collection.

[0029] The encryption key management circuit 403 is a circuit that manages encryption keys. An encryption key is a key used to encrypt and decrypt write data. The encryption key management circuit 403 manages, for example, one or more encryption keys for each namespace. Details of the encryption key management circuit 403 will be described later with reference to FIG. 4.

[0030] The ECC processing circuit 404 executes an error correction encoding process when data is written to the nonvolatile memory 5. The error correction encoding process is a process of adding an error correction code (ECC) as a redundant code to data to be written to the nonvolatile memory 5. When data is read from the nonvolatile memory 5, the ECC processing circuit 404 executes an error correction decoding process. The error correction decoding process is a process of detecting and correcting errors in the data read from the nonvolatile memory 5 by using the ECC added to the data.

[0031] The DRAM interface 405 is a circuit that controls the DRAM 6. The DRAM interface 405 stores data in the DRAM 6. In addition, the DRAM interface 405 reads the data stored in the DRAM 6.

[0032] The compression circuit 406 is a circuit that compresses write data associated with a write command received from the host 2. The compression circuit 406 compresses the write data using a lossless compression algorithm. Hereinafter, data obtained by compressing the write data is referred to as compressed data. Examples of lossless compression algorithms include dictionary coding, entropy coding, a combination of dictionary coding and entropy coding, and the like.

[0033] The compressed data has a smaller size than the write data before compression. The larger the size of the write data compressed at one time by the compression circuit 406, the smaller the ratio of the size of the compressed data to the size of the write data. In other words, the larger the size of the write data compressed at one time by the compression circuit 406, the more efficiently the write data can be compressed. This is because the larger the size of the write data compressed at one time, the greater the amount of information that can be referenced in the compression process of the write data.

[0034] The size of the write data compressed at one time by the compression circuit 406 is called a compression unit. In other words, the compression unit is the unit by which the write data is compressed.

[0035] The decompression circuit 407 is a circuit that generates uncompressed data by decompressing compressed data.

[0036] The encryption circuit 408 is a circuit that encrypts compressed data. Hereinafter, data encrypted by the encryption circuit 408 will be referred to as encrypted data. The encryption circuit 408 encrypts the compressed data output from the compression circuit 406 using an encryption key managed by the encryption key management circuit 403, thereby generating encrypted data to be written to the nonvolatile memory 5. The generated encrypted data is subjected to error correction coding processing by the ECC processing circuit 404, and then written to the nonvolatile memory 5 via the nonvolatile memory interface 411.

[0037] The decryption circuit 409 is a circuit that decrypts encrypted data. The decryption circuit 409 decrypts the encrypted data read from the nonvolatile memory 5 using an encryption key managed by the encryption key management circuit 403. The encrypted data read from the nonvolatile memory 5 is data obtained by encrypting compressed data. The encrypted data read from the nonvolatile memory 5 is corrected for errors by the ECC processing circuit 404, and then transferred from the ECC processing circuit 404 to the decryption circuit 409. The decryption circuit 409 generates decrypted compressed data by decrypting the encrypted data, and transfers the generated compressed data to the decompression circuit 407.

[0038] The buffer memory 410 is a volatile memory that temporarily holds data. A part of the storage area of ​​the buffer memory 410 is used to temporarily store write data received from the host 2. Another part of the storage area of ​​the buffer memory 410 is used to temporarily store data read from the non-volatile memory 5.

[0039] The nonvolatile memory interface 411 is a circuit that controls the nonvolatile memory 5. The nonvolatile memory interface 411 is electrically connected to a plurality of NAND chips included in the nonvolatile memory 5.

[0040] Each NAND chip can operate independently. Therefore, the NAND chip functions as a unit capable of operating in parallel. The non-volatile memory interface 411 is connected to channels ch0, ch1, ..., ch7. The non-volatile memory interface 411 is connected to one or more NAND chips via each of channels ch0, ch1, ..., ch7. FIG. 1 illustrates a case in which four NAND chips are connected to each of channels ch0, ch1, ..., ch7. In this case, the non-volatile memory interface 411 is connected to NAND chips #0, #8, #16, and #24 via channel ch0. The non-volatile memory interface 411 is connected to NAND chips #1, #9, #17, and #25 via channel ch1. The non-volatile memory interface 411 is connected to NAND chips #7, #15, #23, and #31 via channel ch7. The NAND chips #0, #1, ..., #7 are treated as bank BNK0 by the controller 4. Similarly, NAND chips #8, #9, ..., #15 are treated as bank BNK1 by the controller 4. NAND chips #16, #17, ..., #23 are treated as bank BNK2 by the controller 4. NAND chips #24, #25, ..., #31 are treated as bank BNK3 by the controller 4. A bank is a unit in which multiple NAND chips operate in parallel through interleaving operation.

[0041] In the configuration of the nonvolatile memory 5 shown in Fig. 1, the controller 4 can write data in parallel to a maximum of 32 NAND chips (number of parallel writes = 32) by using 8 channels and interleaving between 4 banks. Each of the NAND chips #0 to #31 may have a multi-plane configuration having multiple planes. For example, if each of the NAND chips #0 to #31 includes two planes, the controller 4 can write data in parallel to a maximum of 64 planes (number of parallel writes = 64).

[0042] Next, the configuration of the NAND chip will be described below. Fig. 2 is a block diagram showing an example of the configuration of each of the multiple NAND chips included in the nonvolatile memory 5.

[0043] NAND chip #n is any NAND chip among NAND chips #0 to #31 (n is an integer from 0 to 31). NAND chip #n includes a memory cell array 51. Memory cell array 51 includes a plurality of blocks BLK0 to BLKq-1. Each of blocks BLK0 to BLKq-1 includes a plurality of pages (here, pages P0 to Pp-1). Each page includes a plurality of memory cells. Each of blocks BLK0 to BLKq-1 is a unit of a data erase operation for erasing data. Each of pages P0 to Pp-1 is a unit of a data write operation and a data read operation.

[0044] FIG. 3 is a diagram for explaining a plurality of name spaces managed in the memory system 3. As shown in FIG.

[0045] FIG. 3 illustrates an example in which the controller 4 manages namespaces NS1, NS2, and NS3. Each namespace is identified by a namespace identifier (NSID). Each namespace includes a set of multiple contiguous logical addresses (LBAs). The logical address space corresponding to each namespace starts from LBA0. Each namespace can be set to any size. The size of a namespace is represented by a value obtained by multiplying the number of LBAs included in the namespace by the data size per LBA included in the namespace. The data size per LBA is set individually for each namespace.

[0046] 3, the namespace NS1 is a namespace identified by a namespace identifier NSID1. The namespace NS1 includes a plurality of consecutive LBAs from LBA0 to LBA(x-1).

[0047] The namespace NS2 is a namespace identified by a namespace identifier NSID2. The namespace NS2 includes a plurality of consecutive LBAs from LBA0 to LBA(y-1).

[0048] The namespace NS3 is a namespace identified by a namespace identifier NSID3. The namespace NS3 includes a plurality of consecutive LBAs from LBA0 to LBA(z-1).

[0049] Next, management of the encryption key will be described. Fig. 4 is a diagram showing an example of the configuration of a locking table used in the memory system 3 according to the first embodiment.

[0050] The encryption key management circuit 403 uses a locking table 403-1 to manage one or more encryption keys for each namespace (i.e., for each NSID). The locking table 403-1 is a table that holds locking information. The locking information is information that indicates the correspondence between the NSID of each of a plurality of namespaces, one or more logical address ranges (LBA ranges) set in each namespace, and one or more encryption keys respectively associated with the one or more LBA ranges in each namespace.

[0051] FIG. 4 shows an example in which four LBA ranges (ranges Rx, Ry, Rz, Rw) are set in namespace NS1, one LBA range (range Rs) is set in namespace NS2, and one LBA range (range Rt) is set in namespace NS3.

[0052] Range Rx is a logical address range having consecutive logical addresses from LBA0 to LBAh-1 in namespace NS1. The encryption key associated with range Rx is, for example, encryption key Kx. In this case, data corresponding to any logical address belonging to range Rx is encrypted or decrypted using encryption key Kx.

[0053] Range Ry is an LBA range having consecutive logical addresses from LBAh to LBAi-1 in namespace NS1. The encryption key associated with range Ry is, for example, encryption key Ky. In this case, data corresponding to any logical address belonging to range Ry is encrypted or decrypted using encryption key Ky.

[0054] Range Rz is an LBA range having consecutive logical addresses from LBAi to LBAj-1 in namespace NS1. The encryption key associated with range Rz is, for example, encryption key Kz. In this case, data corresponding to any logical address belonging to range Rz is encrypted or decrypted using encryption key Kz.

[0055] Range Rw is an LBA range having consecutive logical addresses from LBAj to LBAx-1 in namespace NS1. The encryption key associated with range Rw is, for example, encryption key Kw. In this case, data corresponding to any logical address belonging to range Rw is encrypted or decrypted using encryption key Kw.

[0056] Range Rs is an LBA range having consecutive logical addresses from LBA0 to LBAy-1 in namespace NS2. That is, all logical addresses included in namespace NS2 are included in range Rs. An encryption key associated with range Rs is, for example, encryption key Ks. In this case, data corresponding to any logical address included in range Rs is encrypted or decrypted using encryption key Ks. Thus, data to be written to namespace NS2 is encrypted or decrypted using encryption key Ks.

[0057] Range Rt is an LBA range having consecutive logical addresses from LBA0 to LBAz-1 in namespace NS3. That is, all logical addresses included in namespace NS3 are included in range Rt. An encryption key associated with range Rt is, for example, encryption key Kt. In this case, data corresponding to any logical address belonging to range Rt is encrypted or decrypted using encryption key Kt. Thus, data to be written to namespace NS3 is encrypted or decrypted using encryption key Kt.

[0058] Next, an example of range setting in compliance with the TCG Opal standard will be described. Fig. 5 is a diagram showing an example of range setting in the memory system 3 according to the first embodiment.

[0059] In the TCG Opal standard, a namespace is associated with a namespace locking object called the namespace global range locking object. The namespace global range locking object is the first namespace locking object associated with a namespace. The namespace locking object is used to control access to the namespace and to manage the cryptographic keys associated with the namespace. In the following, the namespace global range locking object is simply referred to as the namespace global range, or global range.

[0060] For example, in the initial state immediately after the creation of the namespace NS1, the entire namespace NS1 is in a state associated with a global range. By the administrator assigning each of the LBA ranges, such as the ranges Ry, Rz, and Rw, to the global range of the namespace NS1, for example, different users can encrypt data with different encryption keys and store it in the namespace NS1. Here, the administrator specifies each LBA range by specifying the start LBA of each LBA range and the size (number of LBAs) of each LBA range. Each of the ranges Ry, Rz, and Rw is associated with a namespace non-global range locking object. The namespace non-global range locking object is used to perform access control for the corresponding LBA range and management of the encryption key associated with the corresponding LBA range. Hereinafter, it is simply referred to as a namespace non-global range or a non-global range.

[0061] Note that LBA ranges such as range Ry, range Rz, and range Rw are overlaid on the global range, so that the three areas of the global range that are overlaid by range Ry, range Rz, and range Rw are hidden by range Ry, range Rz, and range Rw, respectively.

[0062] Next, compression of write data and encryption of compressed data will be described. Fig. 6 is a diagram showing an example of the relationship between the compression unit for compressing data and the encryption key for encrypting data.

[0063] Here, compression and encryption are performed on 4KiB of write data d1 and 4KiB of write data d2. The LBA corresponding to 4KiB of d1 belongs to range Rx. Therefore, the encryption key to be used to encrypt 4KiB of write data d1 is encryption key Kx. On the other hand, the LBA corresponding to 4KiB of write data d2 belongs to range Ry. Therefore, the encryption key to be used to encrypt 4KiB of write data d2 is encryption key Ky.

[0064] First, referring to (a) of FIG. 6, a case where the write data d1 and the write data d2 are compressed together will be described. In order to compress 4KiB of write data d1 and 4KiB of write data d2 at once, the size of the compression unit in the compression circuit is set to 8KiB. The larger the compression unit size is set, the more efficiently the data can be compressed. Therefore, by compressing data in 8KiB compression units, the compression circuit can compress data more efficiently than when compressing data in 4KiB compression units.

[0065] The compressed data d' generated by the compression circuit is a mixture of the write data d1 and the write data d2. The encryption circuit then encrypts this compressed data d'. If the size of the compressed data d' is less than the encryption unit, the encryption circuit adds padding data to the compressed data d' and encrypts the data, thereby generating encrypted data D'.

[0066] However, the encryption key to be used for encrypting the write data d1 is encryption key Kx, and the encryption key to be used for encrypting the write data d2 is encryption key Ky. In other words, the two types of write data (d1, d2) included in the compressed data d' are data that should be encrypted using different encryption keys. For example, when the compressed data d' is encrypted using encryption key Kx, the encryption circuit encrypts data including the write data d2 that should be encrypted with encryption key Ky using encryption key Kx. On the other hand, when the compressed data d' is encrypted using encryption key Ky, the encryption circuit encrypts data including the write data d1 that should be encrypted with encryption key Kx using encryption key Ky.

[0067] For this reason, when two pieces of writing data that should be encrypted with different encryption keys are compressed together, one of the writing data will end up being encrypted with an encryption key different from the encryption key that should be used, which is undesirable from a security standpoint.

[0068] Next, with reference to (b) of FIG. 6, a case where the write data d1 and the write data d2 are compressed separately will be described. In order to compress the write data d1 and the write data d2 separately, the compression unit in the compression circuit is set to 4 KiB. The compression circuit first compresses the 4 KiB write data d1 to generate compressed data d1'. Then, the compression circuit compresses the 4 KiB write data d2 to generate compressed data d2'. In this way, since the compression circuit compresses data in 4 KiB compression units, the data is compressed in smaller compression units than in (a) of FIG. 6. For this reason, the efficiency of data compression tends to be lower than in the case of (a) of FIG. 6.

[0069] This compression generates compressed data d1' corresponding to the write data d1 and compressed data d2' corresponding to the write data d2.

[0070] The encryption circuit then performs encryption on the compressed data d1' and encryption on the compressed data d2'. If the size of the compressed data d1' is smaller than the encryption unit, the encryption circuit performs encryption on the data obtained by adding padding data to the compressed data d1'. If the size of the compressed data d2' is smaller than the encryption unit, the encryption circuit performs encryption on the data obtained by adding padding data to the compressed data d2'.

[0071] The encryption circuit uses the encryption key Kx to encrypt data including compressed data d1', thereby generating encrypted data D1'. Also, the encryption circuit uses the encryption key Ky to encrypt data including compressed data d2', thereby generating encrypted data D2'.

[0072] As a result, when two pieces of write data with different encryption keys to be used for encryption are compressed separately, it is possible to prevent data from being encrypted using an encryption key different from the encryption key to be used.

[0073] In this way, in a storage device that both compresses and encrypts user data (write data associated with a write command from host 2), a constraint arises in which "data with different encryption keys to be used for encryption must be separated into separate compression units."

[0074] This constraint can be met, for example, by fixing the compression unit to 4 KiB in cases where the encryption key is not changed at a granularity finer than 4 KiB.

[0075] However, depending on the settings of the destination namespace, even if the compression unit is set to a size larger than 4KiB, the constraint that "data with different encryption keys to be used for encryption is separated into separate compression units" can be satisfied.

[0076] In this embodiment, any one of the following three configurations can be applied.

[0077] First Configuration: The first configuration is a configuration for generating a compression unit suitable for a destination namespace based on namespace setting information indicating the settings of the destination namespace.

[0078] Second configuration: The second configuration is a configuration in which, when one encryption key is managed for each logical address range (LBA range), the compression unit can be expanded when the first logical address range (first LBA range) to which the logical address specified by the latest write command belongs matches the second logical address range (second LBA range) to which the logical address specified by the previous write command belongs.

[0079] Third configuration: The third configuration is a configuration that allows the compression unit to be expanded when a single encryption key is used for each namespace and the first namespace identifier specified by the most recent write command matches the second namespace identifier specified by the previous write command.

[0080] In a memory system that employs any of these configurations, the compression unit can be made larger while satisfying the constraint that "data with different encryption keys are separated into separate compression units." Therefore, a higher compression efficiency can be achieved than when using a configuration in which the compression unit is fixed at 4 KiB.

[0081] In the following, a case where the first configuration is applied to the memory system 3 according to the first embodiment will be described.

[0082] First, a data write process and a data read process will be described. Fig. 7 is a diagram showing an example of a data write process and a data read process executed in the memory system 3 according to the first embodiment.

[0083] Here, the controller 4 further includes a namespace setting information management circuit 421 and a compression unit generation circuit 422 in addition to the components described with reference to FIG.

[0084] The namespace setting information management circuit 421 is a circuit that manages namespace setting information corresponding to each of a plurality of namespaces managed in the memory system 3. The namespace setting information corresponding to a certain namespace includes, for example, information indicating the number of encryption keys used in the corresponding namespace and information indicating the data size per logical address included in the logical address space of the corresponding namespace. The data size per logical address is also referred to as LBA data size. The namespace setting information may include information indicating the number of LBA ranges included in the corresponding namespace instead of the number of encryption keys in the corresponding namespace. In addition, the namespace setting information management circuit 421 manages the minimum access granularity. The minimum access granularity is AlignmentGranularity defined in the TCG Opal SSC standard. The encryption key to be used for encryption does not switch within AlignmentGranularity. In other words, the size of the LBA range (the number of LBAs) is set to a size equal to or larger than AlignmentGranularity. AlignmentGranularity is a setting value common to a plurality of namespaces managed by the controller 4. That is, the AlignmentGranularity of these namespaces is set to the same value.

[0085] 7, the namespace setting information management circuit 421 may include a namespace setting information management circuit 421a used in data write processing and a namespace setting information management circuit 421b used in data read processing. When a write command specifying a namespace identifier (NSID) of a write destination namespace is received, the namespace setting information management circuit 421a selects namespace setting information (number of encryption keys, AlignmentGranularity, LBA data size) indicating the setting of the write destination namespace, and outputs the selected namespace setting information. When a read command specifying an NSID of a read target namespace is received, the namespace setting information management circuit 421b selects namespace setting information (number of encryption keys, AlignmentGranularity, LBA data size) indicating the setting of the read target namespace, and outputs the selected namespace setting information.

[0086] The compression unit generation circuit 422 is a circuit that generates compression units used by the compression circuit 406. As described above, a compression unit is a unit for compressing data. Specifically, a compression unit indicates the size of write data compressed by the compression circuit 406 at one time.

[0087] The compression unit generating circuit 422 generates a compression unit for each of a plurality of namespaces. The compression unit generating circuit 422 may include a compression unit generating circuit 422a used in a data write process and a compression unit generating circuit 422b used in a data read process.

[0088] When a write command specifying the NSID of the destination namespace is received, the compression unit generation circuit 422a generates a compression unit (also referred to as a first compression unit) corresponding to the destination namespace. The first compression unit is calculated based on the namespace setting information (also referred to as the first namespace setting information) of the destination namespace output from the namespace setting information management circuit 421a. The first compression unit is a compression unit having a size that satisfies the constraint that the encryption key for encrypting data to be written to the destination namespace does not switch within the first compression unit. Then, the compression unit generation circuit 422a sets the generated first compression unit in the compression circuit 406.

[0089] In this way, a first compression unit having a size that satisfies the constraint that the encryption key does not switch within the first compression unit is generated based on the first namespace setting information. This makes it possible to generate a compression unit that is suitable for setting the destination namespace.

[0090] The first compression unit is calculated, for example, in the following procedure.

[0091] The compression unit generation circuit 422a first calculates an encryption key switching unit based on the first namespace setting information. The encryption key switching unit is a unit by which the encryption key is switched in the write destination namespace.

[0092] Next, the compression unit generation circuit 422a obtains the LBA data size of the destination namespace from the first namespace setting information, and calculates the smaller size of the calculated encryption key switching unit and the obtained LBA data size as the first compression unit.

[0093] Specifically, the compression unit generation circuit 422a calculates the compression unit of the write destination namespace NS based on the first namespace setting information using the following expressions (1) and (2).

[0094] Encryption key switching unit = (1 key in NS)?∞ : AlignmentGranularity···Equation (1) Compression unit = min {NS encryption key switching unit, NS LBA data size} ··· Equation (2) As shown in formula (1), when the condition that there is one encryption key in NS is met, infinity (∞) is calculated as the encryption key switching unit. For example, when only the namespace global range is set in NS, the number of encryption keys used in NS is 1, so the condition that there is one encryption key in NS is met. In the case where sequential writes are performed on the entire destination namespace NS, infinity corresponds to the size of the destination namespace NS.

[0095] As shown in formula (1), if the condition that there is one encryption key in NS is not met, AlignmentGranularity is calculated as the encryption key switching unit. For example, if multiple LBA ranges are set in NS, the number of encryption keys used in NS is multiple, so the condition that there is one encryption key in NS is not met.

[0096] In this way, when there is one encryption key in the NS, the compression unit can, in principle, be as large as you want. However, if the compression unit is too large, the time required to expand the compressed data (expansion latency) increases, and random read performance decreases. For this reason, using formula (2), the maximum value of the compression unit is regulated to the LBA data size.

[0097] Here, an example of calculation of the compression unit will be described.

[0098] For example, assume that two namespaces (NS1, NS2) are managed by controller 4 and that the following settings are configured.

[0099] (1)(Shared namespace): AlignmentGranularity=4KiB (2)NS1: Multiple encryption keys are used within NS1, LBA data size = 4KiB (3)NS2: NS2 uses one encryption key, LBA data size = 16KiB In this case, in the case where the compression unit is fixed to 4 KiB, the compression unit is 4 KiB in both the namespace NS1 and the namespace NS2.

[0100] In this embodiment, Since the compression unit of NS1 = min {encryption key switching unit of NS1, LBA data size of NS1} = min {4KiB, 4KiB} = 4KiB, the compression unit of the namespace NS1 is 4KiB.

[0101] On the other hand, since the compression unit of NS2=min{encryption key switching unit of NS2, LBA data size of NS2}=min{∞, 16KiB}=16KiB, the compression unit of the namespace NS2 is 16KiB.

[0102] Thus, in this embodiment, a larger compression unit can be set for namespace NS2 compared to the case where the compression unit is fixed at 4 KiB, thereby obtaining a higher compression efficiency than the case where the compression unit is fixed at 4 KiB.

[0103] Next, for example, assume that two namespaces (NS1, NS2) are managed by the controller 4 and that the following settings are made.

[0104] (1)(Shared namespace): AlignmentGranularity=8KiB (2)NS1: Multiple encryption keys are used within NS1, LBA data size = 4KiB (3)NS2: Multiple encryption keys are used within NS2, LBA data size = 16KiB In this case, in the case where the compression unit is fixed to 4 KiB, the compression unit is 4 KiB in both the namespace NS1 and the namespace NS2.

[0105] In this embodiment, Since the compression unit of NS1=min{encryption key switching unit of NS1, LBA data size of NS1}=min{8KiB, 4KiB}=4KiB, the compression unit of the namespace NS1 is 4KiB.

[0106] On the other hand, since the compression unit of NS2=min{encryption key switching unit of NS2, LBA data size of NS2}=min{8KiB, 16KiB}=8KiB, the compression unit of the namespace NS2 is 8KiB.

[0107] Thus, in this embodiment, a larger compression unit can be set for namespace NS2 compared to the case where the compression unit is fixed at 4 KiB, thereby obtaining a higher compression efficiency than the case where the compression unit is fixed at 4 KiB.

[0108] The compression unit generation circuit 422a may calculate in advance a plurality of compression units corresponding to a plurality of namespaces, respectively, based on a plurality of namespace setting information corresponding to the plurality of namespaces, and may store the calculated plurality of compression units. In this case, when a write command is received from the host 2, the compression unit generation circuit 422a selects a compression unit corresponding to a write destination namespace identified by an NSID specified by the received write command from the plurality of compression units stored. Then, the compression unit generation circuit 422a sets the selected compression unit in the compression circuit 406.

[0109] When a read command specifying the NSID of the namespace to be read is received, the compression unit generation circuit 422b generates a compression unit corresponding to the namespace to be read based on the namespace setting information of the namespace to be read. The compression unit generation circuit 422b then sets the generated compression unit in the decompression circuit 407. The compression unit set in the decompression circuit 407 is used by the decompression circuit 407 to determine whether or not the size of the uncompressed data generated by the decompression circuit 407 matches the compression unit used when writing the uncompressed data, i.e., the compression unit used when compressing the write data corresponding to the uncompressed data.

[0110] Next, the data write process will be described. In response to receiving a write command from the host 2, which specifies the namespace identifier NSID indicating the write destination namespace and the write destination logical address, the controller 4 starts the data write process.

[0111] The CPU 402 of the controller 4 outputs the namespace identifier NSID and the logical address of the write destination to the encryption key management circuit 403, and outputs the namespace identifier NSID to the namespace setting information management circuit 421a. Furthermore, the CPU 402 obtains write data associated with the received write command from the memory 22 of the host 2, and outputs the obtained write data to the compression circuit 406.

[0112] The namespace setting information management circuit 421a identifies the namespace setting information corresponding to the NSID specified by the write command. The namespace setting information management circuit 421a outputs the identified namespace setting information to the compression unit generation circuit 422a. The output namespace setting information includes, for example, AlignmentGranularity, the number of encryption keys in the destination namespace, and the LBA data size in the destination namespace.

[0113] The compression unit generation circuit 422a generates a compression unit corresponding to the write destination namespace specified by the write command based on the output namespace setting information. The compression unit generation circuit 422a generates a compression unit based on the AlignmentGranularity, the number of encryption keys, and the LBA data size indicated by the namespace setting information. The compression unit generation circuit 422a sets the generated compression unit in the compression circuit 406.

[0114] As described above, the compression unit generation circuit 422a may calculate a plurality of compression units corresponding to a plurality of namespaces in advance and store the calculated plurality of compression units. In this case, the compression unit generation circuit 422a selects a compression unit corresponding to the destination namespace from the plurality of compression units stored, and sets the compression unit corresponding to the destination namespace in the compression circuit 406.

[0115] The compression circuit 406 compresses the received write data using the set compression unit. Since the compression unit satisfies the constraint that the encryption key does not change within the compression unit, the compression circuit 406 compresses data corresponding to one encryption key to generate compressed data. The compression circuit 406 outputs the generated compressed data to the encryption circuit 408.

[0116] The encryption circuit 408 uses an encryption key to encrypt the compressed data output from the compression circuit 406. The encryption circuit 408 obtains the encryption key from the encryption key management circuit 403. The encryption key management circuit 403 identifies the write destination namespace and the logical address range (LBA range) to which the write destination logical address belongs, based on the NSID and logical address specified by the received write command. The encryption key management circuit 403 then outputs an encryption key corresponding to the identified logical address range of the identified write destination namespace to the encryption circuit 408. The encryption circuit 408 encrypts the compressed data using the output encryption key to generate encrypted data. The generated encrypted data is subjected to error correction coding processing by the ECC processing circuit 404, and then written to the non-volatile memory 5.

[0117] Next, the data read process will be described. The controller 4 executes the data read process in response to receiving from the host 2 a read command specifying a namespace identifier NSID indicating the namespace to be read in which the data to be read is written, and a logical address to be read corresponding to the data to be read.

[0118] The controller 4 reads out encrypted data including the data to be read from the non-volatile memory 5. The read encrypted data is output to the decryption circuit 409 after errors are corrected by the ECC processing circuit 404. The decryption circuit 409 decrypts the encrypted data using a decryption key (here, the encryption key received from the encryption key management circuit 403). At this time, the encryption key management circuit 403 identifies the encryption key based on the NSID and logical address specified by the read command. The encryption key management circuit 403 outputs the identified encryption key to the decryption circuit 409. The decryption circuit 409 generates compressed data by decrypting the encrypted data. The decryption circuit 409 outputs the generated compressed data to the decompression circuit 407.

[0119] The namespace setting information management circuit 421b identifies the namespace setting information of the read target namespace based on the NSID specified by the received read command. The namespace setting information management circuit 421b outputs the identified namespace setting information to the compression unit generation circuit 422b.

[0120] The compression unit generation circuit 422b generates a compression unit corresponding to the namespace to be read based on the namespace setting information output from the namespace setting information management circuit 421b. The generated compression unit is the same as the compression unit used when writing data to this namespace. The compression unit generation circuit 422b outputs the generated compression unit to the decompression circuit 407.

[0121] The decompression circuit 407 decompresses the data (compressed data) decoded by the decoding circuit 409 to generate uncompressed data. Then, the read target data is extracted from the uncompressed data to generate read data to be transferred to the host 2. After generating the uncompressed data, the decompression circuit 407 determines whether the size of the generated uncompressed data matches the compression unit used when compressing the write data corresponding to this uncompressed data (i.e., the compression unit output from the compression unit generation circuit 422b).

[0122] If the size of the uncompressed data does not match the compression unit used when compressing the write data corresponding to this uncompressed data, the decompression circuit 407 notifies the CPU 402 that an error has occurred. Under the control of the CPU 402, the controller 4 executes a process (error process) such as executing the data read process again.

[0123] If the size of the uncompressed data matches the compression unit used when compressing the write data corresponding to this uncompressed data, the controller 4 sends the read target data extracted from the uncompressed data to the host 2 as read data.

[0124] Next, the namespace setting information will be described. Fig. 8 is a diagram showing an example of the namespace setting information managed in the memory system according to the first embodiment.

[0125] A plurality of pieces of namespace setting information corresponding to a plurality of namespaces managed by the controller 4 are managed in a management table 461 of the namespace setting information management circuit 421. Here, it is assumed that a namespace NS1, a namespace NS2, and a namespace NS3 are managed in the memory system 3.

[0126] For example, management table 461 holds the minimum access granularity, the number of encryption keys for namespace NS1, the number of encryption keys for namespace NS2, the number of encryption keys for namespace NS3, the LBA data size for namespace NS1, the LBA data size for namespace NS2, and the LBA data size for namespace NS3.

[0127] The minimum access granularity is a value indicating AlignmentGranularity, which is a common value for all namespaces managed by the controller 4.

[0128] If the namespace NS1 contains four LBA ranges, the number of encryption keys for the namespace NS1 is four.

[0129] If namespace NS2 contains only one global range, the number of encryption keys for namespace NS2 is one.

[0130] If namespace NS3 contains only one global range, the number of encryption keys for namespace NS3 is one.

[0131] The LBA data size of the namespace NS1 is, for example, 4 KiB.

[0132] The LBA data size of the namespace NS2 is, for example, 16 KiB.

[0133] The LBA data size of the namespace NS3 is, for example, 4 KiB.

[0134] The namespace setting information management circuit 421 outputs the minimum access granularity, the number of encryption keys for the namespace NS1, and the LBA data size for the namespace NS1 as the namespace setting information corresponding to the namespace NS1.

[0135] The namespace setting information management circuit 421 outputs the minimum access granularity, the number of encryption keys for the namespace NS2, and the LBA data size for the namespace NS2 as the namespace setting information corresponding to the namespace NS2.

[0136] The namespace setting information management circuit 421 outputs the minimum access granularity, the number of encryption keys for the namespace NS3, and the LBA data size for the namespace NS3 as the namespace setting information corresponding to the namespace NS3.

[0137] Next, the data write process will be described with reference to a flowchart shown in FIG 9, which is a flow chart showing the procedure of the data write process executed in the memory system according to the first embodiment.

[0138] When a write command is received from the host 2, the controller 4 receives write data from the host 2 (step S11). The write data is data associated with the write command received from the host 2. The controller 4 receives the write data based on a data pointer indicating a location in the memory 22 specified by the received write command.

[0139] The controller 4 determines whether or not a compression unit corresponding to the write destination namespace identified by the NSID specified by the received write command has already been generated (step S12). In a case where multiple compression units corresponding to multiple namespaces have been calculated in advance, the compression unit corresponding to the write destination namespace has already been generated.

[0140] If a compression unit corresponding to the write destination namespace has not yet been generated (No in S12), the controller 4 executes a compression unit generation process for generating a compression unit corresponding to the write destination namespace (step S13).

[0141] If a compression unit corresponding to the namespace of the write destination has already been generated (Yes in S12), the controller 4 skips the process of S13. Then, the controller 4 acquires the compression unit corresponding to the namespace of the write destination, which is held by the compression unit generation circuit 422.

[0142] The controller 4 sets the compression unit corresponding to the name space of the write destination in the compression circuit 406 (step S14).

[0143] The compression circuit 406 of the controller 4 compresses the write data for each compression unit using the compression unit set in S14 (step S15). The compression circuit 406 of the controller 4 compresses the write data to generate compressed data.

[0144] The encryption key management circuit 403 of the controller 4 identifies an encryption key corresponding to the write data, and outputs the identified encryption key to the encryption circuit 408. Then, the encryption circuit 408 of the controller 4 encrypts the compressed data generated in S15 using the encryption key output from the encryption key management circuit 403 (step S16).

[0145] The controller 4 writes the encrypted data generated by encrypting the compressed data in S16 to the non-volatile memory 5 (step S17). At this time, the controller 4 manages the storage location in the non-volatile memory 5 to which the encrypted data was written in S17 (step S18).

[0146] In this way, through the data write process, the controller 4 compresses and encrypts the write data before writing it to the non-volatile memory 5. This enables the controller 4 to realize efficient use of the storage space of the non-volatile memory 5 and protection of user data.

[0147] Next, the compression unit generation process will be described with reference to a flowchart shown in FIG 10. The compression unit generation process is executed in the memory system 3 according to the first embodiment.

[0148] The controller 4 executes an encryption key switching unit calculation process (step S131). The encryption key switching unit calculation process is a process for calculating an encryption key switching unit of the destination namespace based on the namespace setting information (AlignmentGranularity and the number of encryption keys) of the destination namespace. The encryption key switching unit is the unit by which encryption keys are switched in the destination namespace.

[0149] The controller 4 acquires the LBA data size of the write destination namespace from the namespace setting information of the write destination namespace (step S132).

[0150] The controller 4 generates the smaller size of the calculated encryption key switching unit or the acquired LBA data size as a compression unit (step S133).

[0151] Then, the controller 4 stores the generated compression unit as necessary (step S134).

[0152] In this way, the compression unit is generated based on the namespace setting information indicating the settings of the write destination namespace so as to satisfy the constraint that the encryption key does not switch within the compression unit.

[0153] Next, an encryption key switching unit calculation process will be described with reference to Fig. 11. The encryption key switching unit calculation process is a flowchart showing the steps of the encryption key switching unit calculation process executed in the memory system according to the first embodiment.

[0154] The controller 4 acquires AlignmentGranularity from the namespace setting information of the write destination namespace (step S1311). Next, the controller 4 acquires the number of encryption keys of the write destination namespace from the namespace setting information of the write destination namespace (step S1312).

[0155] The controller 4 determines whether or not the number of encryption keys in the write destination namespace is 1 (step S1313). In other words, the controller 4 determines whether or not only the namespace global range is set in the write destination namespace.

[0156] If the number of encryption keys in the write destination namespace is 1 (Yes in S1313), the controller 4 calculates infinity (for example, the size of the write destination namespace) as the encryption key switching unit for the write destination namespace (step S1314).

[0157] If the number of encryption keys in the write destination namespace is not 1 (No in S1313), the controller 4 calculates the AlignmentGranularity acquired in S21 as the encryption key switching unit for the write destination namespace (step S1315).

[0158] Next, the data read process will be described with reference to a flowchart shown in FIG 12. The data read process is executed in the memory system 3 according to the first embodiment.

[0159] The controller 4 receives a read command from the host 2, which specifies a namespace identifier NSID indicating the namespace to which the data to be read is written, and a logical address to which the data to be read corresponds (step S31).

[0160] The controller 4 reads the encrypted data including the data to be read from the non-volatile memory 5 (step S32).

[0161] The controller 4 obtains the encryption key corresponding to the encrypted data read in S32, and sets the encryption key in the decryption circuit 409 of the controller 4 (step S33). The decryption circuit 409 of the controller 4 uses the set encryption key to decrypt the encrypted data read out in S32 (step S34).

[0162] The decompression circuit 407 of the controller 4 decompresses the compressed data generated in S34 to generate uncompressed data (step S35).

[0163] The decompression circuit 407 of the controller 4 determines whether the size of the data decompressed in S35, i.e., the size of the uncompressed data, matches the compression unit used when compressing the write data corresponding to this uncompressed data (step S36).

[0164] If the size of the uncompressed data matches the compression unit used when compressing the write data corresponding to this uncompressed data (Yes in S36), the controller 4 extracts the read target data from this uncompressed data and sends the extracted read target data to the host 2 (step S37).

[0165] If the size of the uncompressed data does not match the compression unit used when compressing the write data corresponding to this uncompressed data (No in S36), the controller 4 executes a process (error processing) such as executing the data read process again (step S38).

[0166] In this way, the controller 4 reads the compressed and encrypted data from the non-volatile memory 5 through the data read process, decrypts and decompresses it, and then transmits it to the host 2.

[0167] As described above, according to the first embodiment, the controller 4 generates a compression unit corresponding to the destination namespace, which is calculated based on namespace setting information indicating the setting of the destination namespace. This compression unit has a size that satisfies the constraint that the encryption key for encrypting data to be written to the destination namespace does not switch within this compression unit.

[0168] Therefore, for each namespace, a compression unit suitable for the setting of that namespace can be generated. Therefore, depending on the setting of the namespace, it is possible to use a size larger than 4 KiB as the compression unit while satisfying the constraint that the encryption key does not switch within this compression unit. As a result, the effective capacity of the memory system 3 can be expanded without deteriorating security. The difference between the expanded effective capacity and the notified capacity of the memory system 3 can be used as, for example, an overprovisioning capacity. In this case, it is possible to obtain effects such as improved performance of the memory system 3, extended life of the memory system 3 by reducing the write amplification factor (WAF), and reduced power consumption by reducing the amount of writing to the non-volatile memory 5.

[0169] Second embodiment A second embodiment will be described. In the memory system 3 according to the second embodiment, the above-mentioned second configuration is applied. That is, in the memory system 3 according to the second embodiment, one encryption key is managed for each LBA range. Then, whether or not to expand the compression unit is determined based on whether or not the LBA range (also referred to as the first LBA range) to which the logical address specified by the latest write command received from the host 2 belongs matches the LBA range (also referred to as the second LBA range) to which the logical address specified by the immediately previous write command belongs.

[0170] In other words, the data compression unit is divided when the LBA range into which the data is to be written changes, so that data to be written to the same LBA range is compressed together and data to be written to different LBA ranges is compressed separately.

[0171] Some of the components included in the memory system 3 according to the second embodiment are the same as the components of the memory system 3 according to the first embodiment. Therefore, the memory system 3 according to the second embodiment will be described below, focusing on the differences from the memory system 3 according to the first embodiment.

[0172] FIG. 13 is a diagram illustrating an example of a data write process and a data read process in the memory system according to the second embodiment.

[0173] Here, the controller 4 of the memory system 3 according to the second embodiment further includes an LBA range checker 431.

[0174] The LBA range checker 431 is a logical address range check circuit that identifies an LBA range to which a logical address specified by a write command received from the host 2 belongs. The LBA range checker 431 identifies a destination LBA range based on the NSID and logical address (destination LBA) specified by the write command received from the host 2. The destination LBA range is the LBA range to which the logical address specified by the received write command belongs. The LBA range checker 431 outputs information indicating the identified LBA range to the compression unit generation circuit 432 and the encryption key management circuit 403.

[0175] The encryption key management circuit 403 is a circuit that manages a plurality of encryption keys that correspond to a plurality of LBA ranges in a one-to-one relationship, respectively. The encryption key management circuit 403 outputs the encryption key corresponding to the LBA range output from the LBA range checker 431 to the encryption circuit 408 or the decryption circuit 409.

[0176] Moreover, the controller 4 of the memory system 3 according to the second embodiment includes a compression unit generation circuit 432 instead of the compression unit generation circuit 422 of the first embodiment. The compression unit generation circuit 432 refers to each LBA range output from the LBA range checker 431, and judges whether or not the latest LBA range output by the LBA range checker 431 matches the immediately previous LBA range output from the LBA range checker 431. That is, the compression unit generation circuit 432 judges whether or not the LBA range to which the logical address specified by the latest write command received from the host 2 belongs matches the LBA range to which the logical address specified by the immediately previous write command received from the host 2 belongs.

[0177] When the LBA range to which the logical address specified by the latest write command received from the host 2 belongs matches the LBA range to which the logical address specified by the immediately previous write command received from the host 2 belongs, the compression unit generation circuit 432 expands the current size of the compression unit so that the write data associated with the latest write command received from the host 2 is compressed together with data including at least the write data associated with the immediately previous write command received from the host 2. In other words, the current size of the compression unit is expanded so that the write data associated with the latest write command and the data including at least the write data associated with the immediately previous write command received from the host 2 are included in the same compression unit. In this case, the current size of the compression unit is increased by the size of the write data associated with the latest write command.

[0178] On the other hand, if the LBA range to which the logical address specified by the latest write command received from the host 2 belongs does not match the LBA range to which the logical address specified by the immediately previous write command received from the host 2 belongs, the compression unit generation circuit 432 generates (confirms) the current size of the compression unit as a compression unit so that the write data associated with the latest write command received from the host 2 and the data including at least the write data associated with the immediately previous write command received from the host 2 are compressed separately, and sets the generated compression unit in the compression circuit 406. In other words, the current size of the compression unit is generated as the compression unit so that the write data associated with the latest write command and the data including at least the write data associated with the immediately previous write command received from the host 2 are included in different compression units.

[0179] In this way, by executing control to divide (determine) data compression units at the timing when the LBA range into which data is to be written switches, data that is to be written to the same LBA range can be compressed together, and data that is to be written to different LBA ranges can be compressed separately.

[0180] After the latest write command (CMDn) is received, the compression unit generation circuit 432 waits for the next write command (CMD(n+1)). When the next write command (CMD(n+1)) is received, the compression unit generation circuit 432 determines whether the LBA range to which the logical address specified by the received next write command (CMD(n+1)) belongs matches the LBA range to which the logical address specified by the immediately previous write command (CMDn) belongs.

[0181] In this way, compression of data including at least the write data associated with the most recent write command (CMDn) is not performed until the next write command (CMD(n+1)) is received. Also, when multiple write commands each specifying a logical address that belongs to the same LBA range are received, the compression unit may become too large.

[0182] Therefore, if the next write command (CMD(n+1)) is not received before a predetermined time has elapsed since the latest write command (CMDn) was received from the host 2, or if the extended compression unit reaches its upper limit, the compression unit generation circuit 432 generates (determines) the current size of the compression unit as the compression unit so that data including at least the write data associated with the latest write command (CMDn) and the write data associated with the next write command (CMD(n+1)) are compressed separately, and sets the generated compression unit in the compression circuit 406.

[0183] The compression unit holding circuit 433 is a circuit that holds each of the compression units generated by the compression unit generating circuit 433. As in the first embodiment, each compression unit held by the compression unit holding circuit 433 is used by the decompression circuit 407 to determine whether or not the size of the uncompressed data generated by the decompression circuit 407 matches the compression unit used when compressing the write data corresponding to this uncompressed data.

[0184] First, the data write process will be described. In the following, a write command that specifies a namespace identifier NSID indicating the namespace of the write destination and a logical address of the write destination will be described as an example, but the write command does not have to include an NSID. This is because in the second embodiment, it is sufficient that one encryption key is managed for each LBA range, and it is not necessary to use a namespace.

[0185] In response to receiving a write command from the host 2 specifying the namespace identifier NSID indicating the destination namespace and the destination logical address, the controller 4 retrieves the write data associated with the write command from the memory 22 of the host 2 and initiates the data write process.

[0186] The LBA range checker 431 identifies an LBA range to which a logical address specified by the received write command belongs. The LBA range checker 431 outputs information indicating the identified LBA range to the compression unit generation circuit 432. The LBA range checker 431 also outputs information indicating the identified LBA range and the NSID specified by the received write command to the encryption key management circuit 403.

[0187] The compression unit generation circuit 432 generates a compression unit to be used when compressing the received write data based on the information indicating the LBA range output by the LBA range checker 431. When the latest LBA range output by the LBA range checker 431 is the same as the previous LBA range output by the LBA range checker 431, the compression unit generation circuit 432 expands the current size of the compression unit so that the write data associated with the latest write command and data including at least the write data associated with the previous write command are included in the same compression unit. When the expanded compression unit reaches an upper limit, the compression unit generation circuit 432 generates the current size of the compression unit as a compression unit to be used for compressing the write data. In addition, when a predetermined time has passed since the latest write command was received without the next write command being received, the compression unit generation circuit 432 generates the current size of the compression unit as a compression unit to be used for compressing the write data.

[0188] If the latest LBA range is different from the previous LBA range, the compression unit generation circuit 432 generates the current size of the compression unit as a compression unit used to compress the write data so that the write data associated with the latest write command and data including at least the write data associated with the previous write command are included in different compression units.

[0189] The compression unit generation circuit 432 sets the generated compression unit in the compression circuit 406. Furthermore, the compression unit holding circuit 433 holds the compression unit generated by the compression unit generation circuit 432.

[0190] Then, the compression circuit 406 compresses the write data using the set compression unit to generate compressed data.

[0191] Furthermore, the encryption key management circuit 403 identifies an encryption key corresponding to the write data based on the LBA range output from the LBA range checker 431 , and outputs the identified encryption key to the encryption circuit 408 .

[0192] The encryption circuit 408 generates encrypted data by encrypting the compressed data generated by the compression circuit 406 using the encryption key output by the encryption key management circuit 403. The generated encrypted data is subjected to error correction coding processing by the ECC processing circuit 404, and then written to the non-volatile memory 5.

[0193] Next, the data read process will be described. The controller 4 executes the data read process in response to receiving from the host 2 a read command specifying a namespace identifier NSID indicating the namespace to be read in which the data to be read is written, and a logical address to be read corresponding to the data to be read.

[0194] The controller 4 reads out encrypted data including the data to be read from the non-volatile memory 5. The encrypted data read out from the non-volatile memory 5 is output to the decryption circuit 409 after errors are corrected by the ECC processing circuit 404. The decryption circuit 409 decrypts the encrypted data using a decryption key (here, the encryption key received from the encryption key management circuit 403). At this time, the LBA range checker 431 identifies an LBA range based on the NSID and logical address specified by the read command. Then, the LBA range checker 431 outputs information indicating the identified LBA range to the encryption key management circuit 403. The encryption key management circuit 403 identifies a decryption key based on the output LBA range. The encryption key management circuit 403 outputs the identified decryption key to the decryption circuit 409. The decryption circuit 409 generates compressed data by decrypting the encrypted data. The decryption circuit 409 outputs the generated compressed data to the decompression circuit 407.

[0195] The decompression circuit 407 decompresses the data (compressed data) decoded by the decode circuit 409 to generate uncompressed data. Then, the read target data is extracted from the uncompressed data to generate read data to be transferred to the host 2. After generating the uncompressed data, the decompression circuit 407 checks the size of the generated uncompressed data. In this case, the decompression circuit 407 determines whether the size of the generated uncompressed data matches the compression unit used when compressing the write data corresponding to this uncompressed data. For example, the compression unit used when compressing the write data corresponding to this uncompressed data may be notified to the decompression circuit 407 from the compression unit holding circuit 433. For example, the compression unit holding circuit 433 may hold information for identifying data included in the compression unit for each compression unit. This makes it possible to identify the compression unit used when compressing the write data corresponding to the uncompressed data generated by the decompression circuit 407 based on the NSID and logical address specified by the read command.

[0196] If the size of the uncompressed data does not match the compression unit used when compressing the write data corresponding to this uncompressed data, the decompression circuit 407 notifies the CPU 402 that an error has occurred. Under the control of the CPU 402, the controller 4 executes a process (error process) such as executing the data read process again.

[0197] If the size of the uncompressed data matches the compression unit used when compressing the write data corresponding to this uncompressed data, the controller 4 sends the read target data extracted from the uncompressed data to the host 2 as read data.

[0198] Next, a first example of data compression for a plurality of write data will be described. Fig. 14 is a diagram showing a first example of compression processing for a plurality of write data executed in a memory system according to the second embodiment. Here, it is assumed that the upper limit of the compression unit is greater than 8 KiB. It is also assumed that a write command CMD1, a write command CMD2, a write command CMD3, a write command CMD4, and a write command CMD5 are received from the host 2 in this order.

[0199] The write command CMD1, for example, specifies a logical address included in the LBA range Rx as the write destination LBA. The write data d1 associated with the write command CMD1 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d1 is the encryption key Kx associated with the LBA range Rx.

[0200] The write command CMD2, for example, specifies a logical address included in the LBA range Ry as the write destination LBA. The write data d2 associated with the write command CMD2 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d2 is the encryption key Ky associated with the LBA range Ry.

[0201] The write command CMD3, for example, specifies a logical address included in the LBA range Rz as the write destination LBA. The write data d3 associated with the write command CMD3 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d3 is the encryption key Kz associated with the LBA range Rz.

[0202] The write command CMD4, for example, specifies a logical address included in the LBA range Rz as the write destination LBA. The write data d4 associated with the write command CMD4 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d4 is the encryption key Kz associated with the LBA range Rz.

[0203] The write command CMD5, for example, specifies a logical address included in the LBA range Rw as the write destination LBA. The write data d5 associated with the write command CMD5 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d5 is the encryption key Kw associated with the LBA range Rw.

[0204] First, the controller 4 receives the first write command CMD1 from the host 2.

[0205] Next, the controller 4 receives a second write command CMD2 from the host 2. The write destination LBA of the write data d2 associated with the write command CMD2 belongs to the LBA range Ry, and the write destination LBA of the write data d1 associated with the immediately previous write command CMD1 belongs to the LBA range Rx. Therefore, the data compression units are separated at the boundary between the write data d1 and the write data d2 so that the write data d1 and the write data d2 are included in different compression units. As a result, a compression unit indicating 4KiB, which is the size of the write data d1, is used in the compression of the write data d1.

[0206] The controller 4 receives a third write command CMD3 from the host 2. The destination LBA of the write data d3 associated with the write command CMD3 belongs to the LBA range Rz, and the destination LBA of the write data d2 associated with the write command CMD2 belongs to the LBA range Ry. Therefore, the data compression units are separated at the boundary between the write data d2 and the write data d3 so that the write data d2 and the write data d3 are included in different compression units. As a result, a compression unit indicating 4KiB, which is the size of the write data d2, is used in the compression of the write data d2.

[0207] Next, the controller 4 receives a fourth write command CMD4 from the host 2. The write destination LBA of the data d4 associated with the write command CMD4 belongs to the same LBA range Rz as the LBA range to which the write destination LBA of the write data d3 associated with the write command CMD3 belongs. Therefore, the compression unit is expanded so that the write data d3 and the write data d4 are included in the same compression unit. In this case, the current size of the compression unit is expanded from 4 KiB, which is the size of the write data d3, to 8 KiB, which is the sum of the size of the write data d3 and the size of the write data d4.

[0208] The controller 4 receives a fifth write command CMD5 from the host 2. The destination LBA of the write data d5 associated with the write command CMD5 belongs to the LBA range Rw, and the destination LBA of the write data d4 associated with the write command CMD4 belongs to the LBA range Rz. Therefore, the data compression units are separated at the boundary between the write data d4 and the write data d5 so that the write data d4 and the write data d5 are included in different compression units. As a result, the expanded 8KiB compression unit is used in the compression of the data including the write data d3 and the write data d4. Then, the write data d3 and the write data d4 are compressed together.

[0209] Thereafter, when a predetermined time has elapsed without receiving a write command subsequent to the write command CMD5, the controller 4 performs compression on the write data d5 using a compression unit indicating 4 KiB.

[0210] Next, a second example of data compression for a plurality of write data will be described. Fig. 15 is a diagram showing a second example of compression for a plurality of write data executed in a memory system according to the second embodiment. Here, it is assumed that the upper limit of the compression unit is 16 KiB or more, and a plurality of write commands specifying logical addresses included in the same LBA range are received in succession.

[0211] The write command CMD11 specifies a logical address included in the LBA range Rz as the write destination LBA. The write data d11 associated with the write command CMD11 has a size of 4 KiB. The encryption key to be used in encrypting the write data d11 is the encryption key Kz.

[0212] The write command CMD12 specifies a logical address included in the LBA range Rz as the write destination LBA. The write data d12 associated with the write command CMD12 has a size of 4 KiB. The encryption key to be used in encrypting the write data d12 is the encryption key Kz.

[0213] The write command CMD13 specifies a logical address included in the LBA range Rz as the write destination LBA. The write data d13 associated with the write command CMD13 has a size of 4 KiB. The encryption key to be used in encrypting the write data d13 is the encryption key Kz.

[0214] The write command CMD14 specifies a logical address included in the LBA range Rz as the write destination LBA. The write data d14 associated with the write command CMD14 has a size of 4 KiB. The encryption key to be used in encrypting the write data d14 is the encryption key Kz.

[0215] The write command CMD15 specifies a logical address included in the LBA range Rw as the write destination LBA. The write data d15 associated with the write command CMD15 has a size of 4 KiB. The encryption key to be used in encrypting the write data d15 is the encryption key Kw.

[0216] First, the controller 4 receives a first write command CMD11 from the host 2.

[0217] Next, the controller 4 receives a second write command CMD12 from the host 2. The write destination LBA of the write data d12 associated with the write command CMD12 belongs to the same LBA range Rz as the LBA range to which the write destination LBA of the write data d11 associated with the write command CMD11 belongs. Therefore, the current size of the compression unit is expanded from 4 KiB, which is the size of the write data d11, to 8 KiB, which is the sum of the size of the write data d11 and the size of the write data d12, so that the write data d11 and the write data d12 are included in the same compression unit.

[0218] The controller 4 receives a third write command CMD13 from the host 2. The write destination LBA of the write data d13 associated with the write command CMD13 belongs to the same LBA range Rz as the LBA range to which the write destination LBA of the write data d12 associated with the write command CMD12 belongs. Therefore, the current size of the compression unit is expanded from 8 KiB to 12 KiB, which is the sum of the size of the write data d11, the size of the write data d12, and the size of the write data d13, so that the write data d11, the write data d12, and the write data d13 are included in the same compression unit.

[0219] Next, the controller 4 receives a fourth write command CMD14 from the host 2. The write destination LBA of the data d14 associated with the write command CMD14 belongs to the same LBA range Rz as the LBA range to which the write destination LBA of the write data d13 associated with the write command CMD13 belongs. Therefore, the compression unit is expanded from 12 KiB to 16 KiB, which is the sum of the size of the write data d11, the size of the write data d12, the size of the write data d13, and the size of the write data d14, so that the write data d11, the write data d12, the size of the write data d13, and the size of the write data d14 are included in the same compression unit.

[0220] The controller 4 receives a fifth write command CMD15 from the host 2. The write destination LBA of the write data d15 associated with the write command CMD15 belongs to the LBA range Rw, and the write destination LBA of the write data d14 associated with the write command CMD14 belongs to the LBA range Rz. Therefore, the compression units are separated at the boundary between the write data d14 and the write data d15 so that the write data d14 and the write data d15 are included in different compression units. As a result, a compression unit indicating 16 KiB is used for compression of data including the write data d11, the write data d12, the write data d13, and the write data d14. Then, the write data d11, the write data d12, the write data d13, and the write data d14 are compressed together.

[0221] Thereafter, when a predetermined time has elapsed without receiving a write command subsequent to the write command CMD5, the controller 4 performs compression on the write data d15 using a compression unit indicating 4 KiB.

[0222] Next, a third example of data compression for a plurality of write data will be described. FIG. 16 is a diagram showing a third example of compression for a plurality of write data executed in a memory system according to the second embodiment. Here, it is assumed that the upper limit of the compression unit is 16 KiB or more, and a plurality of write commands each specifying a logical address included in the same LBA range are continuously received. In this case, basically, the compression unit may be expanded so that all the write data associated with these write commands are included in the same compression unit, but control may be executed so that the write data associated with at least the last write command among these write commands is not compressed.

[0223] The write commands CMD11 to CMD15 shown in FIG. 16 are the same as the write commands CMD11 to CMD15 described with reference to FIG.

[0224] In FIG. 16, when the write command CMD15 is received, the controller 4 determines that the LBA range Rw to which the logical address specified by the write command CMD15 belongs is different from the LBA range Rz to which the LBA specified by the write command CMD14 belongs.

[0225] At this time, the compression unit generation circuit 422 subtracts 4 KiB from the compression unit indicating 16 KiB so that at least the write data d14 is not included in the same compression unit as the write data d11. At this time, not only the write data d14 but also other write data (for example, the write data d13, etc.) may be controlled so as not to be included in the same compression unit as the write data d11.

[0226] Then, the compression circuit 406 compresses the write data d11, the write data d12, and the write data d13 together to generate compressed data.

[0227] Moreover, the write data d14 is written to the non-volatile memory 5 without being compressed, after being encrypted by the encryption circuit 408.

[0228] In this way, when the LBA range to which the logical address specified by the latest write command (write command CMD15 in FIG. 16) received from the host 2 belongs does not match the LBA range to which the logical address specified by the immediately previous write command (write command CMD14 in FIG. 16) received from the host 2 belongs, the controller 4 performs control not to compress the write data (d14) associated with the immediately previous write command (write command CMD14) among the data (d11 to d14) including at least the write data (d14) associated with the immediately previous write command (write command CMD14). In a case where a plurality of write commands specifying the same LBA range are received consecutively from the host 2, a sufficiently large compression unit can be used. Therefore, even if the write data of at least one write command is not compressed, a sufficiently high compression efficiency can be obtained.

[0229] Next, the procedure of the data write process will be described. Fig. 17A is a flowchart showing a part of the procedure of the data write process executed in the memory system 3 according to the second embodiment. Fig. 17B is a flowchart showing the remaining procedure of the data write process executed in the memory system 3 according to the second embodiment.

[0230] First, the controller 4 receives write data d(i) from the host 2 (step S401). The write data d(i) is write data associated with the i-th write command received from the host 2.

[0231] The LBA range checker 431 of the controller 4 identifies the LBA range R(d(i)) to which the write destination LBA of the write data d(i) received in S401 belongs (step S402). The LBA range R(d(i)) is the LBA range to which the logical address specified by the i-th write command belongs.

[0232] The controller 4 determines whether or not the write data d(i+1) has been received within a predetermined time from the reception of the write data d(i) (step S403). The write data d(i+1) is write data associated with the (i+1)th write command received from the host 2. In other words, the controller 4 determines whether or not the (i+1)th write command has been received from the host 2 within a predetermined time from the reception of the i-th write command.

[0233] If the write data d(i+1) is received within a specified time from receiving the write data d(i), that is, if the i+1th write command is received within a specified time from receiving the i-th write command (Yes in S403), the controller 4 identifies the LBA range R(d(i+1)) to which the destination LBA of the write data d(i+1) belongs (step S404).

[0234] The controller 4 determines whether the LBA range R(d(i+1)) of the write data d(i+1) identified in S404 matches the LBA range R(d(i)) of the write data d(i) identified in S402 (step S405).

[0235] If the write data d(i+1) is not received within a predetermined time from the reception of the write data d(i) (No in S403), the controller 4 skips the steps of S404 and S405 and determines the compression unit (step S406). Then, the controller 4 generates the determined compression unit and outputs it to the compression circuit 406.

[0236] Also, if the LBA range R(d(i+1)) of the write data d(i+1) identified in S404 does not match the LBA range R(d(i)) of the write data d(i) identified in S402 (No in step S405), the controller 4 also determines the compression unit (step S406). Then, the controller 4 generates the determined compression unit and outputs it to the compression circuit 406.

[0237] The controller 4 compresses data having the size of the compression unit determined in S406, that is, data including at least the write data d(i) (step S407). For example, if the LBA range R(d(i)) of the write data d(i) matches the LBA range R(d(i-1)) of the write data d(i-1), the data including at least the write data d(i) is data including the write data d(i) and the write data d(i-1).

[0238] The controller 4 initializes the current size of the compression unit and returns the current size of the compression unit to the initial value (step S408). The initial value is, for example, 4 KiB.

[0239] The controller 4 encrypts the data compressed in S407 using the encryption key (step S409).

[0240] The controller 4 writes the data encrypted in S409 into the non-volatile memory 5 (step S410).

[0241] The controller 4 manages the storage location in the non-volatile memory 5 where the encrypted data was written in S410 (step S411).

[0242] The controller 4 increments i by 1 and sets i to i+1 (step S412).

[0243] The controller 4 determines whether or not the condition "Yes" in S403 is satisfied (step S413).

[0244] If the result in S403 is Yes (Yes in S413), the controller 4 returns to S403 and judges whether or not write data succeeding the already received write data has been received. Since i has already been incremented, in S403, the controller 4 judges whether or not the write data d(i+2) has been received within a predetermined time from the reception of the write data d(i+1).

[0245] If the result is No in S403 (No in S413), the controller 4 returns to S401 and receives write data subsequent to the data written in the nonvolatile memory 5. Since i has already been incremented, in S401 the controller 4 receives the first write data subsequent to the data written in the nonvolatile memory 5, that is, write data d(i+1).

[0246] On the other hand, if the LBA range R(d(i+1)) of the write data d(i+1) identified in S404 matches the LBA range R(d(i)) of the write data d(i) identified in S402 (Yes in step S405), the controller 4 expands the current size of the compression unit by the size of the write data d(i+1) so that data including at least the write data d(i) and the write data d(i+1) are included in the same compression unit (step S414 in FIG. 17B).

[0247] The controller 4 determines whether or not the current size of the compression unit expanded in S414 has reached the upper limit (step S415).

[0248] If the current size of the compression unit expanded in S414 reaches the upper limit (Yes in S415), the controller 4 determines the current size of the compression unit as the data compression unit (step S416). The controller 4 outputs the determined compression unit to the compression circuit 406.

[0249] The controller 4 compresses data having the size of the compression unit determined in S416, that is, data including at least the write data d(i) and the write data d(i+1) (step S417). For example, if the LBA range R(d(i)) of the write data d(i) matches the LBA range R(d(i-1)) of the write data d(i-1), the data including at least the write data d(i) is data including the write data d(i) and the write data d(i-1). Therefore, in this case, the write data d(i-1), the write data d(i), and the write data d(i+1) are compressed together.

[0250] The controller 4 initializes the current size of the compression unit, and returns the current size of the compression unit to the initial value (step S418).

[0251] The controller 4 encrypts the data compressed in S417 using the encryption key (step S419).

[0252] The controller 4 writes the data encrypted in S419 to the non-volatile memory 5 (step S420).

[0253] The controller 4 manages the storage location in the non-volatile memory 5 where the encrypted data was written in S420 (step S421).

[0254] The controller 4 increments i by 2 and sets i to i+2 (step S422). Then, the controller 4 returns to S401 and receives the write data subsequent to the data written in the nonvolatile memory 5.

[0255] If the compression unit expanded in S414 has not reached the upper limit value (No in S415), the controller 4 increments i by 1 and sets i to i+1 (step S423). Then, the controller 4 returns to S403 and determines whether or not write data subsequent to the already received write data has been received.

[0256] As described above, in the second embodiment, similarly to the first embodiment, it is possible to use a larger size as the compression unit while satisfying the constraint that the encryption key does not switch within this compression unit.

[0257] Third embodiment A third embodiment will be described. In the memory system 3 according to the third embodiment, the above-mentioned third configuration is applied. That is, in the memory system 3 according to the third embodiment, one encryption key is managed for each namespace. Then, whether or not to expand the compression unit is determined based on whether or not the NSID specified by the latest write command received from the host 2 matches the NSID specified by the previous write command.

[0258] In other words, the data compression units are divided when the namespace to which the data is to be written changes, so that data to be written to the same namespace is compressed together and data to be written to different namespaces is compressed separately.

[0259] Almost all of the components included in the memory system 3 according to the third embodiment are the same as those in the memory system 3 according to the second embodiment. Therefore, the following description will focus on the differences from the memory system 3 according to the second embodiment.

[0260] In the third embodiment, it is assumed that each of a plurality of namespaces managed in the memory system 3 includes only one LBA range. The number of encryption keys used in one namespace is one. In other words, the controller 4 manages a plurality of encryption keys that are associated with the plurality of namespaces in a one-to-one relationship.

[0261] FIG. 18 is a diagram illustrating an example of a data write process and a data read process in the memory system according to the third embodiment.

[0262] Here, when the NSID specified by the latest write command received from the host 2 matches the NSID specified by the immediately previous write command received from the host 2, the compression unit generation circuit 441 in the third embodiment expands the current size of the compression unit so that the write data associated with the latest write command received from the host 2 is compressed together with data including at least the write data associated with the immediately previous write command received from the host 2. In other words, the current size of the compression unit is expanded so that the write data associated with the latest write command and the data including at least the write data associated with the immediately previous write command received from the host 2 are included in the same compression unit. In this case, the current size of the compression unit is increased by the size of the write data associated with the latest write command.

[0263] On the other hand, when the NSID specified by the latest write command received from the host 2 is different from the NSID specified by the immediately previous write command received from the host 2, the compression unit generation circuit 441 generates (confirms) the current size of the compression unit as a compression unit so that the write data associated with the latest write command received from the host 2 and the data including at least the write data associated with the immediately previous write command received from the host 2 are compressed separately, and sets the generated compression unit in the compression circuit 406. In other words, the current size of the compression unit is generated as the compression unit so that the write data associated with the latest write command and the data including at least the write data associated with the immediately previous write command received from the host 2 are included in different compression units.

[0264] In this way, by executing control to separate (determine) data compression units at the timing when the namespace to which the data is to be written switches, data that is to be written to the same namespace can be compressed together, and data that is to be written to different namespaces can be compressed separately.

[0265] In addition, if the next write command is not received within a predetermined time since the latest write command was received from the host 2, or if the extended compression unit reaches its upper limit, the compression unit generation circuit 441 generates the current compression unit as the compression unit to be used for compressing data including the write data associated with the latest write command.

[0266] The compression unit holding circuit 442 is a circuit that holds each of the compression units generated by the compression unit generation circuit 441. As in the first embodiment, each compression unit held by the compression unit holding circuit 442 is used by the decompression circuit 407 to determine whether or not the size of the uncompressed data generated by the decompression circuit 407 matches the compression unit used when compressing the write data corresponding to this uncompressed data.

[0267] First, the data write process will be described. The controller 4 starts the data write process in response to receiving from the host 2 a write command specifying a namespace identifier NSID indicating a write destination namespace and a write destination logical address.

[0268] When the NSID specified by the latest write command received from the host 2 is the same as the NSID specified by the immediately previous write command received from the host 2, the compression unit generation circuit 441 expands the current size of the compression unit so that the write data associated with the latest write command and data including at least the write data associated with the immediately previous write command are included in the same compression unit. When the expanded compression unit reaches an upper limit, the compression unit generation circuit 441 generates the current compression unit as a compression unit used to compress the write data. In addition, when a predetermined time has passed since the latest write command was received without the next write command being received, the compression unit generation circuit 441 generates the current size of the compression unit as a compression unit used to compress the write data.

[0269] If the NSID specified by the latest write command received from host 2 is different from the NSID specified by the previous write command received from host 2, the compression unit generation circuit 441 generates the current size of the compression unit as a compression unit used to compress the write data so that the write data associated with the latest write command and data including at least the write data associated with the previous write command are included in different compression units.

[0270] The compression unit generation circuit 441 sets the generated compression unit in the compression circuit 406. Furthermore, the compression unit holding circuit 442 holds the compression unit generated by the compression unit generation circuit 442.

[0271] Then, the compression circuit 406 compresses the write data using the set compression unit to generate compressed data.

[0272] Furthermore, the encryption key management circuit 403 identifies an encryption key corresponding to the write data based on the NSID specified by the write command received from the host 2 , and outputs the identified encryption key to the encryption circuit 408 .

[0273] The encryption circuit 408 generates encrypted data by encrypting the compressed data generated by the compression circuit 406 using the encryption key output by the encryption key management circuit 403. The generated encrypted data is subjected to error correction coding processing by the ECC processing circuit 404, and then written to the non-volatile memory 5.

[0274] Next, the data read process will be described. The controller 4 executes the data read process in response to receiving from the host 2 a read command specifying a namespace identifier NSID indicating the namespace to be read in which the data to be read is written, and a logical address to be read corresponding to the data to be read.

[0275] The controller 4 reads out encrypted data including the data to be read from the non-volatile memory 5. The read encrypted data is output to the decryption circuit 409 after errors are corrected by the ECC processing circuit 404. The decryption circuit 409 decrypts the encrypted data using a decryption key (here, the encryption key received from the encryption key management circuit 403). At this time, the encryption key management circuit 403 identifies the decryption key based on the NSID specified by the read command received from the host 2. The encryption key management circuit 403 outputs the identified decryption key to the decryption circuit 409. The decryption circuit 409 generates compressed data by decrypting the encrypted data. The decryption circuit 409 outputs the generated compressed data to the decompression circuit 407.

[0276] The decompression circuit 407 decompresses the data (compressed data) decoded by the decode circuit 409 to generate uncompressed data. Then, the read target data is extracted from the uncompressed data to generate read data to be transferred to the host 2. After generating the uncompressed data, the decompression circuit 407 checks the size of the generated uncompressed data. In this case, the decompression circuit 407 determines whether the size of the generated uncompressed data matches the compression unit used when compressing the write data corresponding to this uncompressed data. For example, the compression unit used when compressing the write data corresponding to this uncompressed data may be notified to the decompression circuit 407 from the compression unit holding circuit 442. For example, the compression unit holding circuit 442 may hold information for identifying data included in the compression unit for each compression unit. This makes it possible to identify the compression unit used when compressing the write data corresponding to the uncompressed data generated by the decompression circuit 407 based on, for example, the NSID and logical address specified by the read command.

[0277] If the size of the uncompressed data does not match the compression unit used when compressing the write data corresponding to this uncompressed data, the decompression circuit 407 notifies the CPU 402 that an error has occurred. Under the control of the CPU 402, the controller 4 executes a process (error process) such as executing the data read process again.

[0278] Next, a first example of data compression for a plurality of write data will be described. Fig. 19 is a diagram showing a first example of compression processing for a plurality of write data executed in a memory system according to the third embodiment. Here, it is assumed that the upper limit of the compression unit is 8 KiB or more. It is also assumed that a write command CMD1, a write command CMD2, a write command CMD3, a write command CMD4, and a write command CMD5 are received from the host 2 in this order.

[0279] The write command CMD1 specifies the NSID(Nx) of the destination namespace Nx and a logical address included in the destination namespace Nx. The write data d1 associated with the write command CMD1 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d1 is the encryption key Kx associated with the destination namespace Nx.

[0280] The write command CMD2 specifies the NSID(Ny) of the destination namespace Ny and a logical address included in the destination namespace Ny. The write data d2 associated with the write command CMD2 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d2 is the encryption key Ky associated with the destination namespace Ny.

[0281] The write command CMD3 specifies the NSID(Nz) of the destination namespace Nz and a logical address included in the destination namespace Nz. The write data d3 associated with the write command CMD3 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d3 is the encryption key Kz associated with the destination namespace Nz.

[0282] The write command CMD4 specifies the NSID(Nz) of the destination namespace Nz and a logical address included in the destination namespace Nz. The write data d4 associated with the write command CMD4 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d4 is the encryption key Kz associated with the destination namespace Nz.

[0283] The write command CMD5 specifies the NSID(Nw) of the destination namespace Nw and a logical address included in the destination namespace Nw. The write data d5 associated with the write command CMD5 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d5 is the encryption key Kw associated with the destination namespace Nw.

[0284] First, the controller 4 receives the first write command CMD1 from the host 2.

[0285] Next, the controller 4 receives a second write command CMD2 from the host 2. The NSID of the write destination namespace of the write data d2 associated with the write command CMD2 is NSID(Ny), and the NSID of the write destination namespace of the write data d1 associated with the write command CMD1 is NSID(Nx). Therefore, the data compression units are separated at the boundary between the write data d1 and the write data d2 so that the write data d1 and the write data d2 are included in different compression units. As a result, a compression unit indicating 4KiB, which is the size of the write data d1, is used in the compression of the write data d1.

[0286] The controller 4 receives a third write command CMD3 from the host 2. The NSID of the write destination namespace of the write data d3 associated with the write command CMD3 is NSID(Nz), and the NSID of the write destination namespace of the write data d2 associated with the write command CMD2 is NSID(Ny). Therefore, the data compression unit is cut off at the boundary between the write data d2 and the write data d3 so that the write data d2 and the write data d3 are included in different compression units. Therefore, in compressing the write data d2, a compression unit indicating 4KiB, which is the size of the write data d2, is used.

[0287] Next, the controller 4 receives a fourth write command CMD4 from the host 2. The NSID of the write destination namespace of the data d4 associated with the write command CMD4 is the same NSID (Nz) as the NSID of the write destination namespace of the write data d3 associated with the write command CMD3. Therefore, the compression unit is expanded so that the write data d3 and the write data d4 are included in the same compression unit. In this case, the current size of the compression unit is expanded from 4 KiB, which is the size of the write data d3, to 8 KiB, which is the sum of the size of the write data d3 and the size of the write data d4.

[0288] The controller 4 receives a fifth write command CMD5 from the host 2. The NSID of the write destination namespace of the write data d5 associated with the write command CMD5 is NSID(Nw), and the NSID of the write destination namespace of the write data d4 associated with the write command CMD4 is NSID(Nz). Therefore, the compression units of the data are separated at the boundary between the write data d4 and the write data d5 so that the write data d4 and the write data d5 are included in different compression units. As a result, a compression unit indicating 8 KiB, which is the sum of the sizes of the write data d3 and the write data d4, is used in the compression of the data including the write data d3 and the write data d4. Then, the write data d3 and the write data d4 are compressed together.

[0289] Thereafter, when a predetermined time has elapsed without receiving a write command subsequent to the write command CMD5, the controller 4 performs compression on the write data d5 using a compression unit indicating 4 KiB.

[0290] Next, a second example of data compression for a plurality of write data will be described. Fig. 20 is a diagram showing a second example of compression for a plurality of write data executed in a memory system according to the third embodiment. Here, it is assumed that the upper limit of the compression unit is 16 KiB or more, and a plurality of write commands specifying the NSID of the same write destination namespace are received consecutively.

[0291] The write command CMD11 specifies the NSID(Nz) of the destination namespace Nz and a logical address included in the destination namespace Nz. The write data d11 associated with the write command CMD11 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d11 is the encryption key Kz associated with the destination namespace Nz.

[0292] The write command CMD12 specifies the NSID(Nz) of the destination namespace Nz and a logical address included in the destination namespace Nz. The write data d12 associated with the write command CMD12 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d12 is the encryption key Kz associated with the destination namespace Nz.

[0293] The write command CMD13 specifies the NSID(Nz) of the destination namespace Nz and a logical address included in the destination namespace Nz. The write data d13 associated with the write command CMD13 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d13 is the encryption key Kz associated with the destination namespace Nz.

[0294] The write command CMD14 specifies the NSID(Nz) of the destination namespace Nz and a logical address included in the destination namespace Nz. The write data d14 associated with the write command CMD14 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d14 is the encryption key Kz associated with the destination namespace Nz.

[0295] The write command CMD15 specifies the NSID(Nw) of the destination namespace Nw and a logical address included in the destination namespace Nw. The write data d15 associated with the write command CMD15 has a size of, for example, 4 KiB. The encryption key to be used in encrypting the write data d15 is the encryption key Kw associated with the destination namespace Nw.

[0296] First, the controller 4 receives a first write command CMD11 from the host 2.

[0297] Next, the controller 4 receives a second write command CMD12 from the host 2. The NSID of the write destination namespace of the write data d12 associated with the write command CMD12 is the same NSID (Nz) as the NSID of the write destination namespace of the write data d11 associated with the write command CMD11. Therefore, the compression unit is expanded to 8 KiB so that the write data d11 and the write data d12 are included in the same compression unit.

[0298] The controller 4 receives a third write command CMD13 from the host 2. The NSID of the write destination namespace of the write data d13 associated with the write command CMD13 is the same NSID (Nz) as the NSID of the write destination namespace of the write data d12 associated with the write command CMD12. Therefore, the compression unit is expanded to 12 KiB so that the write data d11, the write data d12, and the write data d13 are included in the same compression unit.

[0299] Next, the controller 4 receives a fourth write command CMD14 from the host 2. The NSID of the write destination namespace of the data d14 associated with the write command CMD14 is the same NSID (Nz) as the NSID of the write destination namespace of the write data d13 associated with the write command CMD13. Therefore, the compression unit is expanded to 16 KiB so that the write data d11, the write data d12, the write data d13, and the write data d14 are included in the same compression unit.

[0300] The controller 4 receives a fifth write command CMD15 from the host 2. The NSID of the write destination namespace of the write data d15 associated with the write command CMD15 is NSID(Nw), and the NSID of the write destination namespace of the write data d14 associated with the write command CMD14 is NSID(Nz). Therefore, the compression unit of the data is cut at the boundary between the write data d14 and the write data d15 so that the write data d14 and the write data d15 are included in different compression units. As a result, a compression unit indicating 16 KiB is used for compression of data including the write data d11, the write data d12, the write data d13, and the write data d14. Then, the write data d11, the write data d12, the write data d13, and the write data d14 are compressed together.

[0301] Thereafter, when a predetermined time has elapsed without receiving a write command subsequent to the write command CMD5, the controller 4 performs compression on the write data d15 using a compression unit indicating 4 KiB.

[0302] Next, a third example of data compression for a plurality of write data will be described. FIG. 21 is a diagram showing a third example of compression for a plurality of write data executed in a memory system according to the third embodiment. Here, it is assumed that the upper limit of the compression unit is 16 KiB or more, and a plurality of write commands specifying the same namespace identifier are continuously received. In this case, basically, the compression unit may be expanded so that all the write data associated with these write commands are included in the same compression unit, but control may be executed so that the write data associated with at least the last write command among these write commands is not compressed.

[0303] The write commands CMD11 to CMD15 shown in FIG. 21 are the same as the write commands CMD11 to CMD15 described with reference to FIG.

[0304] In FIG. 21, when the write command CMD15 is received, the controller 4 determines that the NSID (Nw) specified by the write command CMD15 is different from the NSID (Nz) specified by the write command CMD14.

[0305] At this time, the controller 4 subtracts 4 KiB from the compression unit indicating 16 KiB so that at least the write data d14 is not included in the same compression unit as the write data d11. At this time, not only the write data d14 but also other write data (for example, the write data d13, etc.) may be controlled so as not to be included in the same compression unit as the write data d11.

[0306] Then, the compression circuit 406 compresses the write data d11, the write data d12, and the write data d13 together to generate compressed data.

[0307] Moreover, the write data d14 is encrypted by the encryption circuit 408 without being compressed.

[0308] Next, the procedure of the data write process will be described. Fig. 22A is a flowchart showing a part of the procedure of the data write process executed in the memory system 3 according to the third embodiment. Fig. 22B is a flowchart showing the remaining procedure of the data write process executed in the memory system 3 according to the third embodiment.

[0309] First, the controller 4 receives write data d(i) from the host 2 (step S501). The write data d(i) is write data associated with the i-th write command received from the host 2.

[0310] The controller 4 identifies the NSID(d(i)) of the namespace to which the write data d(i) received in S501 is to be written, based on the namespace identifier specified by the i-th write command received from the host 2 (step S502).

[0311] The controller 4 determines whether or not the write data d(i+1) has been received within a predetermined time from the reception of the write data d(i) (step S503). The write data d(i+1) is write data associated with the (i+1)th write command received from the host 2. In other words, the controller 4 determines whether or not the (i+1)th write command has been received from the host 2 within a predetermined time from the reception of the i-th write command.

[0312] If write data d(i+1) is received within a predetermined time from receiving write data d(i), that is, if the i+1th write command is received within a predetermined time from receiving the ith write command (Yes in S503), the controller 4 identifies the NSID(d(i+1)) of the namespace to which the write data d(i+1) is to be written (step S504).

[0313] The controller 4 determines whether the NSID(d(i+1)) of the namespace to which the write data d(i+1) is to be written identified in S504 matches the NSID(d(i)) of the namespace to which the write data is to be written identified in S502 (step S505).

[0314] If the write data d(i+1) is not received within a predetermined time from the reception of the write data d(i) (No in S503), the controller 4 skips the procedures of S504 and S505 and determines the compression unit (step S506). The controller 4 generates the determined compression unit and outputs it to the compression circuit 406.

[0315] Even if the NSID(d(i+1)) of the write destination namespace of the write data d(i+1) identified in S504 does not match the NSID(d(i)) of the write destination namespace identified in S502 (No in step S505), the controller 4 also determines the compression unit (step S506). The controller 4 generates the determined compression unit and outputs it to the compression circuit 406.

[0316] The controller 4 compresses data having the size of the compression unit determined in S506, that is, data including at least the write data d(i) (step S507). For example, if the NSID(d(i)) of the namespace to which the write data d(i) is to be written matches the NSID(d(i-1)) of the namespace to which the write data d(i-1) is to be written, the data including at least the write data d(i) is data including the write data d(i) and the write data d(i-1).

[0317] The controller 4 initializes the current size of the compression unit and returns the current size of the compression unit to the initial value (step S508). The initial value is, for example, 4 KiB.

[0318] The controller 4 encrypts the data compressed in S507 using the encryption key (step S509).

[0319] The controller 4 writes the data encrypted in S509 into the non-volatile memory 5 (step S510).

[0320] The controller 4 manages the storage location in the non-volatile memory 5 where the encrypted data was written in S510 (step S511).

[0321] The controller 4 increments i by 1 and sets i to i+1 (step S512).

[0322] The controller 4 determines whether or not the condition "Yes" in S503 is satisfied (step S513).

[0323] If the result in S503 is Yes (Yes in S513), the controller 4 returns to S503 and judges whether or not write data succeeding the already received write data has been received. Since i has already been incremented, in S503, the controller 4 judges whether or not the write data d(i+2) has been received within a predetermined time from the reception of the write data d(i+1).

[0324] If the result is No in S503 (No in S513), the controller 4 returns to S501 and receives write data subsequent to the data written in the nonvolatile memory 5. Since i has already been incremented, in S501 the controller 4 receives the first write data subsequent to the data written in the nonvolatile memory 5, that is, write data d(i+1).

[0325] On the other hand, if the NSID(d(i+1)) of the destination namespace of the write data d(i+1) identified in S504 matches the NSID(d(i)) of the destination namespace of the write data d(i) identified in S502 (Yes in step S505), the controller 4 expands the current size of the compression unit by the size of the write data d(i+1) so that the data including at least the write data d(i) and the write data d(i+1) are included in the same compression unit (step S514 in FIG. 22B).

[0326] The controller 4 determines whether or not the current size of the compression unit expanded in S514 has reached the upper limit (step S515).

[0327] If the current size of the compression unit expanded in S514 reaches the upper limit (Yes in S515), the controller 4 determines the current size as the data compression unit (step S516). The controller 4 generates the determined compression unit and outputs it to the compression circuit 406.

[0328] The controller 4 compresses data having the size of the compression unit determined in S516, that is, data including at least the write data d(i) and the write data d(i+1) (step S517). For example, if the NSID(d(i)) of the namespace of the write destination of the write data d(i) matches the NSID(d(i-1)) of the namespace of the write destination of the write data d(i-1), the data including at least the write data d(i) is data including the write data d(i) and the write data d(i-1). Therefore, in this case, the write data d(i-1), the write data d(i), and the write data d(i+1) are compressed together.

[0329] The controller 4 initializes the current size of the compression unit, and returns the current size of the compression unit to the initial value (step S518).

[0330] The controller 4 encrypts the data compressed in S517 using the encryption key (step S519).

[0331] The controller 4 writes the encrypted data encrypted in S519 into the non-volatile memory 5 (step S520).

[0332] The controller 4 manages the storage location in the non-volatile memory 5 where the encrypted data was written in S520 (step S521).

[0333] The controller 4 increments i by 2 and sets i to i+2 (step S522). Then, the controller 4 returns to S501 and receives the write data subsequent to the data written in the nonvolatile memory 5.

[0334] If the compression unit expanded in S514 has not reached the upper limit value (No in S515), the controller 4 increments i by 1 and sets i to i+1 (step S523). Then, the controller 4 returns to S503 and determines whether or not write data subsequent to the already received write data has been received.

[0335] As described above, in the third embodiment, similarly to the first embodiment, it is possible to use a larger size as the compression unit while satisfying the constraint that the encryption key does not switch within this compression unit.

[0336] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0337] 1...information processing system, 2...host, 3...memory system, 4...controller, 5...non-volatile memory, 6...DRAM, 7...bus, 20...internal bus, 21...processor, 22...memory, 400...internal bus, 401...host interface, 402...CPU, 403...encryption key management circuit, 404...ECC processing circuit, 405...DRAM interface, 406...compression circuit, 407...decompression circuit, 408...encryption circuit, 409...decryption circuit, 410...buffer memory, 411...non-volatile memory interface, 421a...namespace setting information management circuit, 422a...compression unit generation circuit.

Claims

1. 1. A memory system connectable to a host, comprising: A non-volatile memory; a controller configured to manage a number of namespaces used by the host to access the memory system and to control the non-volatile memory; The controller: a compression circuit configured to compress write data received from the host; an encryption circuit configured to encrypt the compressed data output from the compression circuit using an encryption key to generate encrypted data to be written to the non-volatile memory; a compression unit generation circuit configured to generate, for each of the plurality of namespaces, a compression unit that is a unit for compressing the write data; The compression unit generation circuit includes: in response to receiving a write command from the host specifying a namespace identifier of a destination namespace, generating a first compression unit corresponding to the destination namespace, the first compression unit being calculated based on first namespace setting information indicating a setting of the destination namespace, the first compression unit having a size that satisfies a constraint that an encryption key for encrypting data to be written to the destination namespace does not switch within the first compression unit; configured to set the first compression unit in the compression circuit; Memory system.

2. The compression unit generation circuit includes: calculating in advance a plurality of compression units corresponding to the plurality of namespaces, respectively, based on a plurality of namespace setting information corresponding to the plurality of namespaces, and holding the calculated plurality of compression units; in response to receiving the write command from the host, selecting the first compression unit from the plurality of compression units, and setting the first compression unit in the compression circuit; 2. The memory system of claim 1.

3. The compression unit generation circuit includes: Calculating an encryption key switching unit, which is a unit by which an encryption key is switched in the write destination namespace, based on the first namespace setting information; obtaining a data size per logical address included in a logical address space of the write destination namespace from the first namespace setting information; a first compression unit is calculated as a smaller size of the calculated encryption key switching unit and the acquired data size.

2. The memory system of claim 1.

4. The controller: a decryption circuit that decrypts the encrypted data read from the nonvolatile memory by using an encryption key that was used to encrypt the compressed data; a decompression circuit for generating uncompressed data by decompressing the data decoded by the decoding circuit, The expansion circuit includes: and determining whether a size of the uncompressed data matches a compression unit used when compressing the write data corresponding to the uncompressed data.

2. The memory system of claim 1.

5. 1. A memory system connectable to a host, comprising: A non-volatile memory; a controller configured to manage a plurality of encryption keys associated in a one-to-one relationship with a plurality of logical address ranges in a logical address space used by the host to access the memory system, and to control the non-volatile memory; The controller: a compression circuit configured to compress write data associated with a write command received from the host; an encryption circuit configured to generate encrypted data to be written to the non-volatile memory by encrypting the compressed data output from the compression circuit using an encryption key associated with a logical address range to which the logical address specified by the write command belongs; a logical address range check circuit configured to identify a logical address range to which a logical address specified by the received write command belongs each time a write command is received from the host; a compression unit generating circuit configured to generate a compression unit that is a unit for compressing the write data; The compression unit generation circuit includes: if a first logical address range to which a first logical address specified by the latest write command received from the host belongs matches a second logical address range to which a second logical address specified by the immediately previous write command received from the host belongs, expand a current size of the compression unit such that first write data associated with the latest write command is compressed together with data including at least second write data associated with the immediately previous write command, and wait for receipt of a next write command from the host; if the first logical address range does not match the second logical address range, generate the current size of the compression unit as the compression unit so that the first write data and the data including at least the second write data are compressed separately, set the generated compression unit in the compression circuit, and wait for reception of the next write command from the host. Memory system.

6. The compression unit generation circuit includes: when the next write command is not received even after a predetermined time has elapsed since the reception of the latest write command, or when the extended compression unit has reached an upper limit, a current size of the compression unit is generated as the compression unit, and the generated compression unit is set in the compression circuit so that data including at least the first write data and write data associated with the next write command are compressed separately.

6. The memory system of claim 5.

7. The controller: and when the first logical address range does not match the second logical address range, executing a control not to compress at least the immediately previous write data among the data including at least the immediately previous write data.

6. The memory system of claim 5.

8. The controller: a decryption circuit that decrypts the encrypted data read from the nonvolatile memory by using an encryption key that was used to encrypt the compressed data; a decompression circuit for generating uncompressed data by decompressing the data decoded by the decoding circuit, The expansion circuit includes: and determining whether a size of the uncompressed data matches a compression unit used when compressing the write data corresponding to the uncompressed data.

6. The memory system of claim 5.

9. 1. A memory system connectable to a host, comprising: A non-volatile memory; a controller configured to manage a plurality of namespaces used by the host to access the memory system and a plurality of encryption keys respectively associated in a one-to-one relationship with the plurality of namespaces, and to control the non-volatile memory; The controller: a compression circuit configured to compress write data associated with a write command received from the host; an encryption circuit configured to generate encrypted data to be written to the non-volatile memory by encrypting compressed data output from the compression circuit using an encryption key associated with a namespace to which the write data is to be written; a compression unit generating circuit configured to generate a compression unit that is a unit for compressing the write data; The compression unit generation circuit includes: if a first namespace identifier specified by a latest write command received from the host matches a second namespace identifier specified by a previous write command received from the host, expand a current size of the compression unit such that first write data associated with the latest write command is compressed together with data including at least second write data associated with the previous write command, and wait for receipt of a next write command from the host; if the first namespace identifier does not match the second namespace identifier, generate the current size of the compression unit as the compression unit so that the first write data and the data including at least the second write data are compressed separately, set the generated compression unit in the compression circuit, and wait for reception of the next write command from the host. Memory system.

10. The compression unit generation circuit includes: when the next write command is not received even after a predetermined time has elapsed since the reception of the latest write command, or when the extended compression unit has reached an upper limit, a current size of the compression unit is generated as the compression unit, and the generated compression unit is set in the compression circuit so that data including at least the first write data and write data associated with the next write command are compressed separately.

10. The memory system of claim 9.

11. The controller: and if the first namespace identifier does not match the second namespace identifier, executing control not to compress at least the second write data among the data including at least the second write data.

10. The memory system of claim 9.

12. The controller: a decryption circuit that decrypts the encrypted data read from the nonvolatile memory by using an encryption key that was used to encrypt the compressed data; a decompression circuit for generating uncompressed data by decompressing the data decoded by the decoding circuit, The expansion circuit includes: and determining whether a size of the uncompressed data matches a compression unit used when compressing the write data corresponding to the uncompressed data.

10. The memory system of claim 9.

13. A method for controlling a memory system including a non-volatile memory, comprising: managing a number of namespaces used by hosts to access the memory system; compressing write data received from the host; generating encrypted data to be written to the non-volatile memory by encrypting compressed data obtained by compressing the write data using an encryption key; generating a compression unit for each of the plurality of namespaces, the compression unit being a unit for compressing the write data; generating the compression unit in response to receiving a write command from the host specifying a namespace identifier of a destination namespace, generating a first compression unit corresponding to the destination namespace, the first compression unit having a size that satisfies a constraint that an encryption key for encrypting data to be written to the destination namespace does not switch within the first compression unit, as a compression unit to be used when compressing the write data to be written to the destination namespace, the first compression unit being calculated based on first namespace setting information indicating a setting of the destination namespace and corresponding to the destination namespace, the first compression unit having a size that satisfies a constraint that an encryption key for encrypting data to be written to the destination namespace does not switch within the first compression unit; Control methods.

14. A method for controlling a memory system including a non-volatile memory, comprising: managing a plurality of encryption keys each associated in a one-to-one relationship with a plurality of logical address ranges established in a logical address space used by a host to access the memory system; compressing write data associated with a write command received from a host; generating encrypted data to be written to the non-volatile memory by encrypting compressed data obtained by compressing the write data using an encryption key associated with a logical address range to which the logical address specified by the write command belongs; Each time a write command is received from the host, identifying a logical address range to which a logical address specified by the received write command belongs; generating a compression unit that is a unit for compressing the write data; generating the compression unit when a first logical address range to which a first logical address specified by a latest write command received from the host belongs matches a second logical address range to which a second logical address specified by an immediately previous write command received from the host belongs, increasing a current size of the compression unit by a size of the first write data such that first write data associated with the latest write command is compressed together with data including at least second write data associated with the immediately previous write command, and waiting for receipt of a next write command from the host; if the first logical address range does not match the second logical address range, generating the current size of the compression unit as the compression unit so that the first write data and the data including at least the second write data are compressed separately, and waiting for receipt of a next write command from the host. Control methods.

15. A method for controlling a memory system including a non-volatile memory, comprising: managing a number of namespaces used by a host to access the memory system and a number of encryption keys respectively associated in a one-to-one relationship with the number of namespaces; compressing write data associated with a write command received from the host; generating encrypted data to be written to the non-volatile memory by encrypting compressed data obtained by compressing the write data using an encryption key associated with a namespace to which the write data is to be written; generating a compression unit that is a unit for compressing the write data; generating the compression unit if a first namespace identifier specified by a latest write command received from the host matches a second namespace identifier specified by a previous write command received from the host, increasing a current size of the compression unit by a size of the second write data such that first write data associated with the latest write command is compressed together with data including at least second write data associated with the previous write command, and waiting for receipt of a next write command from the host; if the first namespace identifier does not match the second namespace identifier, generating the current size of the compression unit as the compression unit so that the first write data and the data including at least the second write data are compressed separately, and waiting for receipt of a next write command from the host. Control methods.

Images