Memory system

Abstract

To provide a memory system capable of detecting a fraudulent intrusion.SOLUTION: A memory system according to this embodiment includes a first storing unit. A second storing unit stores log information representing an access record from the exterior to the first storing unit. A third storing unit stores a first secret key and a first public key. An arithmetic unit performs conversion to a first hash value by inputting the log information to a hash function, and gives a signature to the first hash value using the first secret key so as to generate a first signature. The arithmetic unit performs conversion to a second hash value by inputting, to the hash function, the log information read from the second storing unit, and verifies the signature using the first public key that is a pair with the first secret key, and the second hash value.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present embodiment relates to a memory system. [Background technology]

[0002] A method has been devised in which a trace log is recorded every time the memory system is accessed from the outside, and unauthorized access to the memory system is detected from the trace log. However, if the trace log is tampered with, unauthorized access cannot be detected. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 6266186 Summary of the Invention [Problem to be solved by the invention]

[0004] To provide a memory system capable of detecting unauthorized access. [Means for solving the problem]

[0005] The memory system according to the present embodiment includes a first storage unit. The second storage unit stores log information indicating a history of accesses to the first storage unit from the outside. The third storage unit stores a first private key and a first public key. The calculation unit converts the log information into a first hash value by inputting the log information into a hash function, signs the first hash value using the first private key, and generates a first signature. The calculation unit converts the log information read from the second storage unit into a second hash value by inputting the log information into a hash function, and performs signature verification using the first public key and the second hash value that form a pair with the first private key. [Brief description of the drawings]

[0006] [Figure 1]1 is a block diagram showing an example of the arrangement of an information processing system according to a first embodiment. [Diagram 2] FIG. 4 is a sequence diagram showing an example of a signature process for a trace log according to the first embodiment. [Diagram 3] FIG. 4 is a sequence diagram showing an example of a trace log verification process according to the first embodiment. [Figure 4] FIG. 11 is a sequence diagram showing an example of a signature process for a trace log according to the second embodiment. [Diagram 5] FIG. 11 is a sequence diagram showing an example of a trace log verification process according to the second embodiment. [Figure 6] FIG. 13 is a sequence diagram showing an example of a signature process for a trace log according to the third embodiment. [Figure 7] FIG. 13 is a sequence diagram showing an example of a trace log verification process according to the third embodiment. [Figure 8] FIG. 13 is a sequence diagram showing an example of a signature process for a trace log according to the fourth embodiment. [Figure 9] FIG. 13 is a sequence diagram showing an example of a trace log verification process according to the fourth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the specification and the drawings, the same elements are denoted by the same reference numerals.

[0008] (First embodiment) FIG. 1 is a block diagram showing an example of the configuration of an information processing system 1 according to the first embodiment.

[0009] The information processing system 1 includes a memory system 2 and a host 3. The memory system 2 and the host 3 are connected to each other so as to be able to communicate with each other.

[0010] The memory system 2 is a storage device. The memory system 2 is, for example, a solid state drive (SSD) or a hard disk drive (HDD). The memory system 2 is configured with a single semiconductor chip. Alternatively, the memory system 2 is configured with a module in which multiple semiconductor chips are combined.

[0011] The host 3 is an information processing device external to the memory system 2. The host 3 is, for example, a server or a PC (personal computer). The host 3 is connected to the memory system 2. The host 3 transmits a read command to the memory system 2 when reading data from the memory system 2. The host 3 transmits a write command when writing data to the memory system 2. In addition, the host 3 transmits a startup command to the memory system 2 when the information processing system 1 is started up.

[0012] The memory system 2 includes an interface circuit 20, a main storage 21, a CPU (Central Processing Unit) 22, an OTP (One Time Programmable) memory 23, a bus 24, and a system management area 25.

[0013] The interface circuit 20 is a physical interface. The interface circuit 20 receives data from the outside. The interface circuit 20 also transmits data to the outside.

[0014] The main storage 21 is a non-volatile memory. The main storage 21 is, for example, a NAND type flash memory. The main storage 21 stores data received by the interface circuit 20. A system management area 25 is provided in the main storage 21. The system management area 25 is an area for storing a trace log, a hash function, and a KDF (Key Derive Function). The system management area 25 stores the trace log, the hash function, and the KDF. The hash function is a function for hashing the trace log and converting it into a hash value. The system management area 25 may be provided as a part of the main storage 21, or may be connected to the bus 24 as a non-volatile storage device (not shown) provided separately from the main storage 21.

[0015] The CPU 22 is an arithmetic processing device. The CPU 22 converts the trace log into a hash value by inputting the trace log into a hash function. The CPU 22 signs the converted hash value using a private key of an encryption key stored in the OTP memory 23. The private key of the encryption key is a value stored in the OTP memory 23, or a value obtained by inputting a value stored in the OTP memory 23 into a KDF. Furthermore, the CPU 22 verifies the generated signature with a public key of the encryption key when the information processing system 1 is started. The trace log is log information indicating a history of access from the host 3 to the main storage 21. The trace log is information including, for example, a command received from the host 3 and a time of access from the host 3. The signature is, for example, an electronic signature of the Rivest-Shamir-Adleman (RSA) method or the Elliptic Curve Digital Signature Algorithm (ECDSA) method.

[0016] The OTP memory 23 is a memory that cannot be rewritten after data is written to it only once. The OTP memory 23 is, for example, a ROM (Read Only Memory) such as a fuse. The OTP memory 23 stores an encryption key.

[0017] The encryption key encrypts the hash value and converts it into a signature.

[0018] The bus 24 is a wiring that connects the interface circuit 20, the main storage 21, the CPU 22, and the OTP memory 23 so that they can communicate with each other.

[0019] FIG. 2 is a sequence diagram illustrating an example of a signature process for a trace log according to the first embodiment.

[0020] When the host 3 writes data to the memory system 2 ([write]), the host 3 transmits a write command and the data to the memory system 2 (S100).

[0021] The CPU 22 of the memory system 2 stores the received data in the main storage 21 based on the received write command (S102).

[0022] When the host 3 reads data from the memory system 2 ([Read]), the host 3 transmits a read command to the memory system 2 (S104).

[0023] The CPU 22 of the memory system 2 reads data from the main storage 21 based on the received read command (S105).

[0024] The CPU 22 of the memory system 2 transmits the read data to the host 3 (S106).

[0025] The CPU 22 of the memory system 2 generates a trace log mi (i is a positive integer) for the received write command and read command (S108).

[0026] The CPU 22 stores the generated trace log mi in the system management area 25 (S110).

[0027] The CPU 22 reads out the multiple trace logs m0 to mi stored in the system management area 25 (S112). The multiple trace logs m0 to mi are, for example, past access histories to the main storage 21.

[0028] The CPU 22 generates one numerical value (first value) by concatenating the multiple read trace logs m0 to mi (S113). The CPU 22 converts the first value into a first hash value H1(m0:mi) by inputting the generated first value to a first hash function (S114).

[0029] The CPU 22 signs the first hash value H1(m0:mi) using the first private key from the OTP memory 23 to generate a first signature σ1(m0:mi) (S116). The CPU 22 stores the first signature σ1(m0:mi) in the system management area 25 (S118) and ends the series of processes in FIG. 2. The first encryption key includes a pair of a first private key and a first public key. The first private key is a key used when generating a signature. The first public key is a key used when verifying a signature that has been signed and generated with the first private key.

[0030] FIG. 3 is a sequence diagram illustrating an example of a trace log verification process according to the first embodiment.

[0031] In the boot process when the information processing system 1 is started up, the host 3 transmits a start-up command to the memory system 2 (S120).

[0032] When the CPU 22 of the memory system 2 receives the start-up command, it reads out the multiple trace logs m0 to mi stored in the system management area 25 (S122).

[0033] The CPU 22 generates one numerical value (second value) by connecting the plurality of read trace logs m0 to mi (S123).

[0034] The CPU 22 converts the generated second value into a second hash value H2(m0:mi) by inputting the second value into the first hash function (S124).

[0035] The CPU 22 reads the first signature σ1(m0:mi) from the system management area 25 (S125), and performs signature verification using the second hash value H2(m0:mi) and the first public key (S126).

[0036] If the signature verification is successful (S130), the CPU 22 transmits a validity notification indicating that the trace logs m0 to mi have not been tampered with to the host 3 (S132), and ends the series of processes in Fig. 3. If the signature verification is successful, the CPU 22 does not restrict access to the main storage 21 from outside. In other words, if the signature verification is successful, the CPU 22 allows data to be written to the main storage 21 from outside.

[0037] If the signature verification fails (S134), the CPU 22 transmits an invalidation notification indicating that the trace logs m0 to mi have been tampered with to the host 3 (S136), and ends the series of processes in Fig. 3. If the signature verification fails, the CPU 22 restricts access to the main storage 21 from outside. In other words, if the signature verification fails, the CPU 22 prohibits writing data to the main storage 21 from outside.

[0038] According to the first embodiment, it is possible to detect whether or not the trace log has been tampered with. According to the first embodiment, if the trace log has been tampered with, it is possible to notify the outside that the trace log is invalid. Furthermore, according to the first embodiment, it is possible to protect data stored in the main storage.

[0039] Second embodiment The configuration of an information processing system 1 according to the second embodiment is the same as the configuration shown in FIG.

[0040] FIG. 4 is a sequence diagram illustrating an example of a signature process for a trace log according to the second embodiment.

[0041] The processes in S100 to S110 in FIG. 4 are the same as the processes in S100 to S110 in FIG.

[0042] The CPU 22 converts the trace log mi into a first hash value H1(mi) for each trace log mi by inputting the trace log mi into a first hash function (S214). The CPU 22 signs the first hash value H1(mi) for each trace log mi using the first private key to generate a first signature σ1(mi) (S216). The CPU 22 stores the encrypted first signature σ1(mi) in the system management area 25 (S218) and ends the series of processes in FIG.

[0043] Each time a trace log is generated, the CPU 22 stores the first signature in the system management area 25. Therefore, the system management area 25 stores the first signature for each trace log. That is, the system management area 25 stores first signatures σ1(m0) to σ1(mi) corresponding to the trace logs m0 to mi, respectively.

[0044] FIG. 5 is a sequence diagram illustrating an example of a trace log verification process according to the second embodiment.

[0045] The processes of S120 and S122 in FIG. 5 are the same as the processes of S120 and S122 in FIG.

[0046] The CPU 22 converts each of the read trace logs m0-mi into a plurality of second hash values ​​H2(m0)-H2(mi) by inputting each of the read trace logs m0-mi into a first hash function (S224). The CPU 22 reads out the first signatures σ1(m0)-σ1(mi) (S225) and performs signature verification for each of the second hash values ​​H2(m0)-H2(mi) and the first public key (S226). That is, the CPU 22 performs signature verification for each trace log.

[0047] If the signature verification is successful (S230), the CPU 22 transmits a validity notification indicating that the trace logs m0 to mi have not been tampered with to the host 3 (S232), and ends the series of processes in FIG.

[0048] If the signature verification fails (S234), the CPU 22 transmits an invalidation notification indicating that the trace logs m0 to mi have been tampered with to the host 3 (S236).

[0049] The CPU 22 identifies trace logs mj (j=0 to i) that have failed signature verification, that is, have been tampered with, from among the trace logs m0 to mi (S240).

[0050] The CPU 240 stores the trace log mj in the system management area 25 (S242), and ends the series of processes in FIG.

[0051] According to the second embodiment, if the trace log has been tampered with, it is possible to notify the outside that the trace log is invalid. Also, according to the second embodiment, it is possible to protect data stored in the main storage.

[0052] Furthermore, according to the second embodiment, by referencing the data stored in the system management area 25, it is possible to know which trace logs have been tampered with.

[0053] Third embodiment The configuration of an information processing system 1 according to the third embodiment is the same as the configuration shown in FIG.

[0054] 6 is a sequence diagram showing an example of a signature process for a trace log according to the third embodiment. The third embodiment is an embodiment in which the first embodiment and the second embodiment are combined.

[0055] The processes in S100 to S110 in FIG. 6 are the same as those in S100 to S110 in FIG.

[0056] The CPU 22 reads out a plurality of trace logs m0 to mi stored in the system management area 25 (S112).

[0057] The CPU 22 generates one numerical value (first value) by concatenating the multiple read trace logs m0 to mi (S113). The CPU 22 converts the first value into a first hash value H1(m0:mi) by inputting the generated first value to a first hash function (S114).

[0058] The CPU 22 uses the first private key to sign the first hash value H1(m0:mi) and generate a first signature σ1(m0:mi) (S116).

[0059] The CPU 22 stores the first signature σ1(m0:mi) in the system management area 25 (S118).

[0060] Furthermore, the CPU 22 converts the read trace log mi into a first hash value H1(mi) by inputting the read trace log mi into a first hash function (S214).

[0061] The CPU 22 uses the first private key to sign the first hash value H1(mi) and generate a first signature σ1(mi) (S216).

[0062] The CPU 22 stores the first signature σ1(mi) in the system management area 25 (S218), and ends the series of processes in FIG.

[0063] Each time a trace log is generated, the CPU 22 stores the first signature in the system management area 25. Therefore, the system management area 25 stores the first signature σ1(m0:mi) and the first signatures σ1(m0) to σ1(mi) corresponding to the trace logs m0 to mi, respectively.

[0064] FIG. 7 is a sequence diagram illustrating an example of a trace log verification process according to the third embodiment.

[0065] The processes in S120 to S136 in FIG. 7 are the same as those in S120 to S136 in FIG.

[0066] If the signature verification fails in S134, the CPU 22 further executes the processes of S224 to S226, S240 and S242, and the series of processes in FIG. 7 ends.

[0067] According to the third embodiment, tampering of the trace logs m0 to mi can be detected in a shorter time than by comparing the first signatures σ1(m0) to σ1(mi) with the second signatures σ2(m0) to σ2(mi), respectively.

[0068] According to the third embodiment, the CPU 22 can identify the tampered trace log mj corresponding to the first signature σ1(mj).

[0069] (Fourth embodiment) The configuration of an information processing system 1 according to the fourth embodiment is the same as the configuration shown in FIG.

[0070] FIG. 8 is a sequence diagram illustrating an example of a signature process for a trace log according to the fourth embodiment.

[0071] The processes of S100 to S110 and S214 to S218 in FIG. 8 are the same as the processes of S100 to S110 and S214 to S218 in FIG.

[0072] The CPU 22 reads out the first signatures σ1(m0) to σ1(mi) from the system management area 25 (S400).

[0073] The CPU 22 generates an aggregate signature σa by adding up the first signatures σ1(m0) to σ1(mi) using, for example, a BGLS (Dan Boneh, Craig Gentry, Ben Lynn, Hovav Shacham) signature (S402).

[0074] The CPU 22 stores the aggregate signature σa in the system management area 25 (S404), and the series of processes in FIG. 8 ends.

[0075] FIG. 9 is a sequence diagram illustrating an example of a trace log verification process according to the fourth embodiment.

[0076] The process of S120 in FIG. 9 is the same as the process of S120 in FIG.

[0077] The CPU 22 reads the aggregate signature σ a from the system management area 25 (S406).

[0078] The CPU 22 generates a first mapping e(σa,Q) by pairing the aggregate signature σa with a point Q on the elliptic curve (S408).

[0079] The CPU 22 stores the generated first mapping e(σa, Q) in the system management area 25 (S410).

[0080] The processes of S122 and S224 in FIG. 9 are the same as the processes of S122 and S224 in FIG.

[0081] The CPU 22 generates second encryption keys s0Q to siQ by multiplying each of the first encryption keys s0 to si by the point Q (S412). The second encryption keys are the result of multiplying each pair of the first private key and the first public key of the first encryption keys s0 to si by the point Q.

[0082] The CPU 22 generates a plurality of second mappings e(H2(m0),s0Q) to e(H2(mi),siQ) by pairing the second hash values ​​H2(m0) to H2(mi) with the second encryption keys s0Q to siQ, respectively (S414).

[0083] The CPU 22 generates a third mapping Πe(H(m),sQ) by multiplying the generated second mappings e(H2(m0),s0Q) to e(H2(mi),siQ) (S416).

[0084] The CPU 22 reads out the first mapping e(σa,Q) from the system management area 25 (S418). The CPU 22 compares the read out first mapping e(σa,Q) with the generated third mapping Πe(H(m),sQ) (S420).

[0085] If the first mapping e(σa,Q) and the third mapping Πe(H(m),sQ) match ([match]), the CPU 22 executes S232 and ends the series of processes in FIG.

[0086] If the first mapping e(σa,Q) and the third mapping Πe(H(m),sQ) do not match ([Mismatch]), the CPU 22 executes S236.

[0087] After executing S236, the CPU 22 uses the first private key to sign the second hash values ​​H2(m0) to H2(mi) generated in S224, and generates second signatures σ2(m0) to σ2(mi) (S250).

[0088] The CPU 22 reads the first signatures σ1(m0) to σ1(mi) from the system management area 25 (S252).

[0089] The CPU 22 compares the read first signatures σ1(m0) to σ1(mi) with the second signatures σ2(m0) to σ2(mi), respectively, and identifies trace logs mj, among the trace logs m0 to mi, whose first and second signatures do not match (S254).

[0090] The CPU 240 stores the identified trace log mj in the system management area 25 (S256), and ends the series of processes in FIG.

[0091] According to the fourth embodiment, it is possible to identify the tampered trace log mj corresponding to the first signature σ1(mj).

[0092] The embodiments are illustrative and the scope of the invention is not limited thereto. [Explanation of symbols]

[0093] 1. Information Processing Systems 2. Memory System 3 Host 20 Interface circuit 21 Main Storage 22 CPU 23 OTP Memory 24 Bus 25 System Management Area

Claims

1. A first storage unit; a second storage unit that stores log information indicating a history of accesses to the first storage unit from an external device; a third storage unit that stores the first private key and the first public key; a calculation unit that converts the log information into a first hash value by inputting the log information into a hash function, and signs the first hash value using a first private key to generate a first signature, The calculation unit is The log information read from the second storage unit is converted into a second hash value by inputting the log information into the hash function; performing signature verification using a first public key paired with the first private key and the second hash value; Memory system.

2. The calculation unit is When the signature verification is successful, no restriction is imposed on access to the first storage unit from outside, If the signature verification fails, external access to the first storage unit is restricted.

2. The memory system of claim 1.

3. The calculation unit is When the signature verification is successful, data can be written from an external device to the first storage unit; prohibiting data from being written to the first storage unit from outside if the signature verification fails; 2. The memory system of claim 1.

4. The calculation unit is generating one first value by concatenating a plurality of pieces of the log information; converting the generated first value into the first hash value by inputting the first value into a hash function; generating one second value by connecting the plurality of pieces of log information read from the second storage unit; converting the second value into the second hash value by inputting the second value into the hash function; 2. The memory system of claim 1.

5. The calculation unit is generating the first signature for each piece of log information; performing the signature verification for each of the log information read from the second storage unit; 2. The memory system of claim 1.

6. A first storage unit; a second storage unit that stores log information indicating a history of accesses to the first storage unit from an external device; a third storage unit that stores the first private key and the first public key; a calculation unit that converts the log information into a first hash value by inputting the log information into a hash function, signs the first hash value using a first private key, generates a first signature, and adds up a plurality of the first signatures corresponding to a plurality of the log information to generate an aggregate signature, The calculation unit is generating a first map by pairing the aggregate signature with a first point on an elliptic curve; A plurality of pieces of the log information are converted into a plurality of second hash values ​​by inputting the pieces of the log information into the hash function; generating a second map by pairing a second encryption key obtained by using the first encryption key and a first point on the elliptic curve with the second hash values; multiplying the second mappings corresponding to the log information to generate a third mapping; comparing the first mapping with the third mapping; Memory system.

7. The calculation unit is transmitting a first signal indicating that the log information has not been tampered with when the first mapping and the third mapping are equal; transmitting a second signal indicating that the log information has been tampered with when the first mapping and the third mapping are different; 7. The memory system of claim 6.

8. 2. The memory system according to claim 1, wherein said second storage unit is provided within said first storage unit.

Images