STORAGE SYSTEM AND CRYPTOGRAPHIC COMPUTATION METHOD

Abstract

To provide a storage system capable of realizing a cryptographic operation circuit corresponding to a plurality of types of cryptographic operation formats.SOLUTION: A storage system comprises an encryption operation circuit for encrypting data according to a format determined by a processor based on a request from a host terminal to write data to a storage device, and decrypting the encrypted data of the data stored in a storage device according to the format determined by the processor based on the data read request from the host terminal to the storage device.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention generally relates to storage systems that perform cryptographic operations. [Background technology]

[0002] In a storage system, a host terminal is connected to a front-end network, and a drive box is connected to a back-end network that is independent of the front-end network.

[0003] Conventionally, a FC (Fibre Channel) network or Ethernet (registered trademark) has been mainly used as a front-end network, and a SAS (Serial Attached SCSI) network has been used as a back-end network. The drive box is a JBOD (Just a Bunch Of Disks) and multiple SAS drives, SATA drives, etc. for storing data are mounted in the slots of the drive box.

[0004] In recent years, flash drives such as SSDs (Solid State Drives) have appeared with the aim of improving the performance of storage systems, and the NVMe protocol, which is optimal for flash drives, has been standardized. In addition, in order to increase the scalability of drive connections via a network, the NVMe-oF (NVMe over Fabrics) protocol standard has emerged, which allows the NVMe protocol to be used over a network, and FBOF (Fabric-attached Bunch of Flash), a drive box compatible with NVMe-oF, has been introduced.

[0005] Recently, with the rise in security awareness, the introduction of encryption functions that meet or exceed FIPS "Level 2," a standard and guideline issued by the US National Institute of Standards and Technology (NIST), is being promoted. To obtain FIPS "Level 2" or higher, it is difficult to perform cryptographic calculations (encryption and decryption) in software using a CPU (Central Processing Unit), and cryptographic calculations in hardware using circuits are required.

[0006] In this regard, in the case of the SAS protocol and the NVMe protocol, the encryption calculation is performed on the disk board of the drive box, and in the case of the NVMe-oF protocol, the encryption calculation is performed on a smart NIC (Network Interface Card). Also, a controller equipped with an encryption circuit has been disclosed that aims to apply an encryption policy desired by a user to data received from a host terminal, etc. (see Patent Document 1). [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2008-250779 A Summary of the Invention [Problem to be solved by the invention]

[0008] Recent storage systems are configured such that drives using multiple protocols are connected to a controller. Each drive and controller communicates data using a different protocol for each drive. When cryptographic calculations are performed on each drive, the specifications (format) of the cryptographic calculations differ for each protocol. When cryptographic calculations are performed on each drive in this way, the security level is not uniform, so the security level of the storage system as a whole is adjusted to the lowest security level. In addition, each drive must obtain FIPS "Level 2" or higher.

[0009] For these reasons, it is required that cryptographic calculations be performed in one type of cryptographic calculation circuit. However, since Patent Document 1 does not disclose a technology for performing cryptographic calculations in accordance with a plurality of types of cryptographic calculation formats, there is a problem in that a cryptographic calculation circuit must be built for each drive.

[0010] The present invention has been made in consideration of the above points, and aims to propose a storage system or the like capable of realizing a cryptographic operation circuit compatible with a plurality of types of cryptographic operation formats. [Means for solving the problem]

[0011] In order to solve such problems, the present invention provides From the host terminal A plurality of storage devices and a controller for controlling input / output to each of the plurality of storage devices. Ra the controller is provided with a memory that stores format management information including information indicating a cryptographic operation format corresponding to each of the plurality of storage devices, a processor that determines a format corresponding to the storage device from the format management information based on an input / output request from a host terminal to the storage device, and a cryptographic operation circuit that encrypts the data in accordance with the format determined by the processor based on a request from the host terminal to write data to the storage device, and decrypts the encrypted data of the data stored in the storage device in accordance with the format determined by the processor based on a request from the host terminal to read data from the storage device.

[0012] In the above configuration, even if the cryptographic operation format differs for each storage device, the processor determines the cryptographic operation format suitable for the storage device, and the cryptographic operation circuit performs the cryptographic operation in the format determined by the processor. With the above configuration, for example, it is possible to realize encryption by hardware without creating a cryptographic operation circuit for each storage device. Effect of the Invention

[0013] According to the present invention, a highly convenient storage system can be realized. Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 illustrates an example of a configuration of a storage system according to a first embodiment. [Diagram 2] FIG. 4 is a diagram showing an example of registration key information according to the first embodiment; [Diagram 3] FIG. 4 is a diagram showing an example of format management information according to the first embodiment. [Figure 4] FIG. 4 is a diagram showing an example of encryption setting information according to the first embodiment; [Diagram 5] FIG. 4 is a diagram showing an example of key information according to the first embodiment. [Figure 6] FIG. 11 is a diagram showing an example of circuit transfer instruction information according to the first embodiment; [Figure 7] FIG. 11 is a diagram illustrating an example of drive transfer instruction information according to the first embodiment. [Figure 8] FIG. 2 illustrates an example of a key registration process according to the first embodiment; [Figure 9] FIG. 11 is a diagram illustrating an example of encryption necessity setting processing according to the first embodiment. [Figure 10] FIG. 2 is a diagram illustrating an example of a key update process according to the first embodiment. [Figure 11] FIG. 11 illustrates an example of a write process according to the first embodiment; [Figure 12] FIG. 11 illustrates an example of a read process according to the first embodiment; [Figure 13] FIG. 11 is a diagram illustrating an example of a processing flow of a write process according to the first embodiment. [Figure 14] FIG. 11 is a diagram illustrating an example of a processing flow for a read process according to the first embodiment. [Figure 15] FIG. 13 illustrates an example of a configuration of a storage system according to a second embodiment. [Figure 16] FIG. 13 is a diagram illustrating an example of DIP processing according to the third embodiment. [Figure 17] FIG. 13 is a diagram showing an example of a processing flow relating to DIP processing according to the third embodiment. [Figure 18] FIG. 13 illustrates an example of a configuration of a storage system according to a fourth embodiment. [Figure 19] FIG. 13 illustrates an example of a configuration of a storage system according to a fifth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] (I) First embodiment An embodiment of the present invention will be described in detail below, however, the present invention is not limited to the embodiment.

[0016] The storage system of this embodiment is configured to include a controller (hereinafter sometimes referred to as CTL) and multiple types of storage devices. The controller includes a processor and a cryptographic calculation circuit. When the processor receives an input / output (IO: INPUT / OUTPUT) request from a host terminal, it determines the format of the cryptographic calculation. The cryptographic calculation circuit performs cryptographic calculation based on the result of the determination by the processor. The controller outputs data after the cryptographic calculation to the host terminal, storage device, etc.

[0017] According to the above configuration, it is possible to realize a cryptographic operation circuit that is compatible with a plurality of types of cryptographic operation formats.

[0018] The designations "first," "second," "third," and the like in this specification are given to identify components and do not necessarily limit the number or order. Furthermore, numbers for identifying components are used in each context, and a number used in one context does not necessarily indicate the same configuration in another context. Furthermore, a component identified by a certain number is not prevented from also having the function of a component identified by another number.

[0019] Next, an embodiment of the present invention will be described based on the drawings. The following description and drawings are examples for explaining the present invention, and are omitted and simplified as appropriate for clarity of explanation. The present invention can be implemented in various other forms. Unless otherwise specified, each component may be singular or plural.

[0020] In the following description, the same elements in the drawings are given the same numbers, and the description is omitted as appropriate. When describing elements of the same type without distinction, the common part (part excluding the branch number) of the reference sign including the branch number is used, and when describing elements of the same type with distinction, the reference sign including the branch number may be used. For example, when describing drives without distinction, they may be written as "drive 120", and when describing individual drives with distinction, they may be written as "drive 120-1", "drive 120-2", etc.

[0021] In FIG. 1, 100 indicates a storage system according to a first embodiment as a whole.

[0022] The storage system 100 is configured to include a CTL 110 and a plurality of types of drives 120 .

[0023] The CTL 110 is an example of a node, and controls input / output to the drive 120 in response to an IO command issued from the host terminal 101. Here, the host terminal 101 includes a communication interface (communication IF), an operating system (OS), an application program, etc. For example, when the application program performs data processing such as a file operation, the host terminal 101 transmits an IO command corresponding to this data processing from the communication IF to the CTL 110 via a communication network such as a SAN (Storage Area Network).

[0024] The IO commands include a write command that requests writing of data to the drive 120, and a read command that requests reading of data from the drive 120. When the CTL 110 receives a write command from the host terminal 101, it executes a write process according to the type of the drive 120 to be written, and when the CTL 110 receives a read command from the host terminal 101, it executes a read process according to the type of the drive 120 to be read.

[0025] More specifically, the CTL 110 includes a CPU 111, a memory 112, a cryptographic operation circuit 113, a PCIe SW (Peripheral Component Interconnect Express Switch) 114, a host IF 115, and a back-end IF .

[0026] The CPU 111 is an example of a processor and includes one or more processor cores. The CPU 111 reads and executes programs stored in the memory 112, the drive 120, etc., to realize the functions of an IO command control unit 111A, a drive control unit 111B, an encryption operation circuit control unit 111C, etc.

[0027] Note that the CTL 110 may include another processor instead of or in addition to the CPU 111. For example, the processor is one or more processors. The at least one processor is typically a microprocessor such as the CPU 111, but may also be another type of processor such as a GPU (Graphics Processing Unit). The at least one processor may be a single-core or multi-core. The at least one processor may also be a processor in the broad sense, such as a hardware circuit (e.g., a Field-Programmable Gate Array (FPGA) or an Application Specific Integrated Circuit (ASIC)) that performs part or all of the processing.

[0028] The IO command control unit 111A interprets an IO command sent from the host terminal 101. The drive control unit 111B issues an IO command (for example, a drive transfer instruction described later) to the drive 120 based on the IO command. The cryptographic calculation circuit control unit 111C issues a cryptographic calculation command (for example, a circuit transfer instruction described later) to the cryptographic calculation circuit 113 based on the IO command. Note that information on transfer instructions such as drive transfer instructions and circuit transfer instructions is accumulated, and the drive 120 and the cryptographic calculation circuit 113 start processing the transfer instruction at an appropriate timing such as when the processing being executed is completed or when the processing load becomes lower than a threshold value.

[0029] The memory 112 temporarily stores data (write data) sent from the host terminal 101 together with a write command, data (read data) read from the drive 120 based on a read command and returned to the host terminal 101, encrypted data written to the drive 120, encrypted data read from the drive 120, etc. In addition to storing communication data such as write data and read data, the memory 112 also stores various encryption-related information related to encryption calculations performed within the CTL 110. The encryption-related information includes registration key information 112A, format management information 112B, encryption setting information 112C, etc.

[0030] Furthermore, the memory 112 includes, as storage areas for storing data to be saved on the memory 112, a data storage area 112D and a registration key storage area 112E.

[0031] The memory 112 may be one or more memories, typically a primary storage device. At least one of the memories in the memory 112 may be a volatile memory or a non-volatile memory.

[0032] The cryptographic operation circuit 113 is a circuit that encrypts communication data (e.g., write data) to generate encrypted data and decrypts the generated encrypted data to return it to communication data (e.g., read data) in accordance with a circuit transfer instruction notified from the CPU 111. The cryptographic operation circuit 113 is, for example, an FPGA. In the following, the communication data will be described taking plaintext data that can be used without performing operations such as decryption and decryption as an example.

[0033] More specifically, the cryptographic operation circuit 113 stores key information 113A, and includes an encryption circuit 113B and a decryption circuit 113C. The key information 113A is information for the cryptographic operation circuit 113 to manage an encryption key. The encryption circuit 113B is a circuit for encrypting plaintext data using an encryption key managed by the key information 113A (converting plaintext data into encrypted data). The decryption circuit 113C is a circuit for decrypting encrypted data using an encryption key managed by the key information 113A (returning encrypted data to plaintext data). In the following, a common key encryption in which the same encryption key is used for encryption and decryption will be described as an example.

[0034] 1 shows a configuration in which one cryptographic operation circuit 113 is provided, but the present embodiment is not limited to this configuration. For example, a plurality of cryptographic operation circuits 113 may be provided depending on the number of drives 120, the capacity of data stored in the drives 120, etc.

[0035] The PCIeSW 114 is a chip (IC chip, microchip, etc.) located between the CPU 111 and a PCIe-connected device, and manages connections and data. The PCIeSW 114-1 communicatively connects the CPU 111 to each of the drives 120-1, 120-2, and 120-3. The PCIeSW 114-2 communicatively connects the CPU 111 to the encryption operation circuit 113.

[0036] In this embodiment, the cryptographic operation circuit 113 is connected to the CPU 111 via the PCIe SW 114-2. However, this embodiment is not limited to this configuration. For example, the cryptographic operation circuit 113 may be directly connected to the CPU 111, may be connected to the CPU 111 via other components in the CTL 110, or may be connected to the CPU 111 in other forms. Any form in which the cryptographic operation circuit 113 and the CPU 111 can be connected to each other may be adopted.

[0037] Additionally, in addition to the cryptographic operation circuit 113, other accelerators (examples of PCIe-connected devices) such as a compression / decompression circuit may be connected to the PCIe SW 114-2.

[0038] The host IF 115 controls communication between the host terminal 101 and the CTL 110. A write command and write data issued from the host terminal 101 are received by the host IF 115. Read data read in response to a read command and a notification of completion of processing of the read command are sent from the host IF 115 to the host terminal 101.

[0039] The back-end IF 116 controls communication between the drive 120 and the CTL 110. The back-end IF 116 performs operations such as conversion between a logical block address (LBA) and the physical address of the drive 120.

[0040] The drive 120 is an example of a storage device and stores various data. The drive 120-1, the drive 120-2, and the drive 120-3 are, for example, built-in drives and NVMe drives that perform processing in accordance with the NVMe protocol. For data stored in an NVMe drive directly connected to the PCIeSW 114-1, cryptographic calculation cannot be performed on a disk board or the like, but in the CTL 110, cryptographic calculation can be performed by the cryptographic calculation circuit 113.

[0041] The drive 120-4 is, for example, mounted in a drive box 130-1 (housing), a drive that performs processing in accordance with protocol A (for example, a SAS drive that performs processing in accordance with the SAS protocol), and is communicatively connected to the CTL 110 via a disk board. The drive 120-5 is, for example, mounted in a drive box 130-2, a drive that performs processing in accordance with protocol B (for example, a self-encrypting drive (SED) that performs processing in accordance with the NVMe protocol), and is communicatively connected to the CTL 110 via a smart NIC. The drive 120-6 is, for example, mounted in a drive box 130-3 (for example, an FBOF), a drive that performs processing in accordance with protocol C, and is communicatively connected to the CTL 110 via a smart NIC. The drive box 130 includes a controller board, a LAN (Local Area Network) board, a channel board, a disk board, a power supply, and the like.

[0042] The CTL 110 may be provided with a predetermined communication IF, and a management terminal may be communicatively connected thereto. The management terminal is configured as a computer device, and is connected to the CTL 110 via a communication network such as a LAN. For example, the management terminal includes storage management software. The storage management software is a program for managing the configuration, setting information, etc. of the CTL 110, and for acquiring and displaying various information about the CTL 110. A user can perform various settings related to the encryption calculation by operating a management screen provided by the storage management software.

[0043] FIG. 2 is a diagram showing an example of the registration key information 112A (a registration key table 200).

[0044] The registered key table 200 is a table for the CPU 111 to manage encryption keys for each range of physical addresses (address range) indicating a predetermined storage area of ​​the drive 120. More specifically, the registered key table 200 stores records in which data of an address range 201, a key index 202, and an encryption key 203 are associated with each other. The registered key information 112A may be stored in a non-volatile memory, a key management server device, or the like.

[0045] In the address range 201, data indicating an address range is stored. In the address range, an encryption key used for encryption calculation of data written to a storage area of ​​the address range or data read from the storage area (data to be subjected to encryption calculation) is set. One address range may be set for one drive 120, or multiple address ranges may be set for one drive 120. In other words, an encryption key may be set for each drive 120, or may be set for each predetermined storage area of ​​the drive 120. In the key index 202, data indicating identification information that can uniquely identify the encryption key in the CTL 110 is stored. In the encryption key 203, data indicating the encryption key is stored.

[0046] FIG. 3 is a diagram showing an example of the format management information 112B (format management table 300).

[0047] The format management table 300 is a table for managing the specifications (format) of cryptographic calculations for each address range by the CPU 111. More specifically, the format management table 300 stores records in which an address range 301 and data of a format 302 are associated with each other.

[0048] Data indicating an address range is stored in the address range 301. Data indicating the format of the cryptographic operation is stored in the format 302.

[0049] Here, examples of the cryptographic operation format include "SAS" and "NVMe". For example, in the "SAS" format, "plain data + protection code" is encrypted, and in the "NVMe" format, "plain data only" is encrypted and a protection code (DIF) is added. In this way, the method of processing the cryptographic operation differs depending on the cryptographic operation format. In the format management table 300, the cryptographic operation format 302 can be set for each address range 301, but the format 302 may also be set for each drive 120 or for each type of drive 120.

[0050] FIG. 4 is a diagram showing an example of the encryption setting information 112C (encryption setting table 400).

[0051] The encryption setting table 400 is a table for the CPU 111 to manage whether or not a cryptographic calculation is necessary for each address range. More specifically, the encryption setting table 400 stores records in which an address range 401 and data on whether or not a cryptographic calculation is necessary 402 are associated with each other.

[0052] Data indicating an address range is stored in the address range 401. Information indicating whether or not a cryptographic calculation is required for data related to the address range is stored in the cryptographic calculation necessity 402. For example, a user can set the cryptographic calculation necessity 402 for each address range indicating a predetermined storage area of ​​the drive 120 via a management terminal or the like.

[0053] FIG. 5 is a diagram showing an example of the key information 113A (key table 500).

[0054] The key table 500 is a table for managing encryption keys by the encryption operation circuit 113. More specifically, the key table 500 stores records in which data of a key index 501 and an encryption key 502 are associated with each other.

[0055] The key index 501 stores data indicating information that can uniquely identify an encryption key in the CTL 110. The encryption key 502 stores data indicating the encryption key. In addition, when the key index 202 and the key index 501 have the same value, this indicates that they are the same encryption key.

[0056] FIG. 6 is a diagram showing an example of information (circuit transfer instruction information 600) included in the circuit transfer instruction notified from the CPU 111 to the cryptographic operation circuit 113. As shown in FIG.

[0057] The circuit transfer instruction information 600 includes information on a transfer type 601 , a cryptographic operation 602 , a transfer source address 603 , a transfer destination address 604 , and a target drive 605 .

[0058] The transfer type 601 stores information indicating the type of the IO command sent from the host terminal 101. For example, if the IO command is a write command, "write" is stored in the transfer type 601, and if the IO command is a read command, "read" is stored in the transfer type 601. The cryptographic operation 602 stores information indicating whether or not a cryptographic operation is required. For example, the cryptographic operation 602 stores the "value of the key index 202" if a cryptographic operation is required, and stores a "value indicating that a cryptographic operation is not required" if a cryptographic operation is not required.

[0059] The source address 603 stores information indicating the address of a storage area in the memory 112 that stores data to be cryptographically operated by the cryptographic operation circuit 113 (source data). The destination address 604 stores information indicating the address of a storage area in the memory 112 that stores data cryptographically operated by the cryptographic operation circuit 113 (destination data). If the IO command is a write command, the source data is plaintext data and the destination data is encrypted data. On the other hand, if the IO command is a read command, the source data is encrypted data and the destination data is plaintext data.

[0060] Information indicating the format of the cryptographic operation is stored in the target drive 605. In the following, a case where two types of cryptographic operation formats, "SAS" and "NVMe", are provided will be described as an example.

[0061] FIG. 7 is a diagram showing an example of information (drive transfer instruction information 700) included in a drive transfer instruction notified to the drive 120 from the CPU 111. As shown in FIG.

[0062] The drive transfer instruction information 700 includes information on a transfer type 701 , a transfer source address 702 , and a transfer destination address 703 .

[0063] The transfer type 701 stores information indicating the type of IO command sent from the host terminal 101. The transfer source address 702 stores information indicating the address of a storage area in which data (source data) to be IO processed by the drive 120 is stored. The transfer destination address 703 stores information indicating the address of a storage area in which data (destination data) subjected to IO processing by the drive 120 is stored.

[0064] When the IO command is a write command, the source address 702 stores address information of the storage area on the memory 112 where the encrypted data is stored, and the destination address 703 stores address information of the storage area on the drive 120 where the encrypted data is stored. On the other hand, when the IO command is a read command, the source address 702 stores address information of the storage area on the drive 120 where the encrypted data is stored, and the destination address 703 stores address information of the storage area on the memory 112 where the encrypted data is stored.

[0065] 8 is a diagram showing an example of the key registration process. The key registration process is started at a predetermined timing, for example, when a user instructs to register an encryption key via a management terminal, when the process is called in a key update process, when the encryption operation circuit 113 is initialized, or the like.

[0066] In S801, the CPU 111 notifies the cryptographic operation circuit 113 of a key registration instruction including key registration instruction information. For example, when the CPU 111 receives an instruction to register an encryption key from a management terminal or the like, the CPU 111 stores the encryption key in a storage area (address space) on the memory 112 for transferring the encryption key, and generates key registration instruction information including information on a key index for identifying the encryption key and the address of the storage area in which the data of the encryption key is stored.

[0067] In S802, the cryptographic operation circuit 113 receives the key registration instruction notified from the CPU 111, and reads out the cryptographic key data from the address of the storage area on the memory 112 included in the key registration instruction. Note that the cryptographic key data may be transferred by, for example, DMA (Direct Memory Access).

[0068] In S803, the encryption operation circuit 113 registers the read encryption key data in the key information 113A in association with the key index included in the key registration instruction received in S802.

[0069] According to the key registration process, the cryptographic operation circuit 113 becomes able to identify the cryptographic key to be used in the cryptographic operation via the key index notified by the CPU 111.

[0070] 9 is a diagram showing an example of encryption necessity setting processing. The encryption necessity setting processing is started, for example, at the timing when necessity information indicating the necessity of encryption calculation for a predetermined storage area of ​​the drive 120 specified by the user is received from the management terminal.

[0071] In S901, the CPU 111 receives information on whether or not a cryptographic calculation is required for a specific storage area of ​​the drive 120 designated by the user.

[0072] In S902, the CPU 111 registers information on whether or not a cryptographic calculation is required for an address range indicating a predetermined storage area of ​​the drive 120 in the encryption setting information 112C.

[0073] Here, there is a risk in areas where the security level is relatively low (so-called holes). In this regard, by setting cryptographic calculations to be performed on all storage areas of all drives 120, cryptographic calculations are performed by one cryptographic calculation circuit 113, the security level becomes uniform, there are no holes, and security becomes strong.

[0074] 10 is a diagram showing an example of a key update process. The key update process is started at a predetermined timing. The predetermined timing may be periodically, at a predetermined date and time, at a timing designated by a user, or at other timing.

[0075] In S1001, the CPU 111 executes a read process, which will be described later, for data in an address range associated with the encryption key to be updated (data to be updated). The read process will be described later with reference to FIG.

[0076] In S1002, the CPU 111 notifies the encryption operation circuit 113 of a key deletion instruction including key deletion instruction information. The key deletion instruction information includes information on the key index of the encryption key to be updated.

[0077] In S1003, the cryptographic operation circuit 113 deletes the information of the cryptographic key having the key index specified in the key deletion instruction from the key information 113A.

[0078] In S1004, the cryptographic operation circuit 113 notifies the CPU 111 of an instruction to register the encryption key to be updated. Upon receiving the instruction to register the encryption key to be updated, the CPU 111 executes a key registration process. Through the key registration process, the encryption key to be updated becomes available for use in cryptographic operations.

[0079] In S1005, the CPU 111 executes a write process, which will be described later, on the data to be updated. The write process will be described later with reference to FIG.

[0080] 11 is a diagram showing an example of the write process. The write process starts at a predetermined timing, such as when the CPU 111 receives a write command or when it is called from the key update process.

[0081] In S1101, the CPU 111 performs an IO command process. In the IO command process, for example, the CPU 111 determines that the type of the IO command is a write command. Also, for example, the CPU 111 refers to the encryption setting table 400, identifies a record in the address range 401 to which the physical address calculated from the LBA of the IO command corresponds, and acquires the value of the encryption computation necessity 402 of the identified record.

[0082] In S1102, the CPU 111 determines the key index of the encryption key used by the encryption operation circuit 113 from the registered key information 112A. For example, the CPU 111 refers to the registered key table 200, identifies a record in the address range 201 to which the physical address calculated from the LBA of the IO command corresponds, and obtains the value of the key index 202 of the identified record.

[0083] It should be noted that, if the value of cryptographic computation necessity 402 acquired in S1101 is "non-cryptographic operation" indicating that cryptographic computation is not necessary, the process of S1102 does not need to be performed.

[0084] In S1103, the CPU 111 determines the format of the cryptographic operation used by the cryptographic operation circuit 113 from the format management information 112B. For example, the CPU 111 refers to the format management table 300, identifies a record in the address range 301 to which the physical address calculated from the LBA of the IO command corresponds, and acquires the value of the format 302 of the identified record ("SAS" or "NVMe").

[0085] In S1104, the CPU 111 notifies the cryptographic operation circuit 113 of a circuit transfer instruction. The CPU 111 generates circuit transfer instruction information including information indicating that it is a write command, information indicating whether or not a cryptographic operation is required, information on the address (source address) of a storage area on the memory 112 where the data transmitted together with the write command is stored, information on the address (destination address) of a storage area on the memory 112 where the encrypted data is stored, and information on a target drive indicating whether or not the format of the cryptographic operation is "SAS". The circuit transfer instruction information may be transferred to the cryptographic operation circuit 113 by DMA. In addition, in the information indicating whether or not a cryptographic operation is required, a value of a key index is set if a cryptographic operation is required, and a value indicating that a cryptographic operation is not required is set if a cryptographic operation is not required.

[0086] In S1105, the cryptographic operation circuit 113 reads the data on the memory 112 based on the address of the transfer source included in the circuit transfer instruction information.

[0087] In S1106, the cryptographic operation circuit 113 acquires data of the cryptographic key to be used from the key information 113A based on the key index included in the circuit transfer instruction.

[0088] In S1107, the cryptographic operation circuit 113 determines the processing method for the cryptographic operation based on the target drive information included in the circuit transfer instruction.

[0089] In S1108, the cryptographic operation circuit 113 encrypts the data read in S1105 by the processing method determined in S1107 using the data of the encryption key acquired in S1106. For example, when the cryptographic operation format is "SAS", the cryptographic operation circuit 113 adds a protection code to the data and then encrypts it using the encryption key, and when the cryptographic operation format is "NVMe", the cryptographic operation circuit 113 encrypts the data using the encryption key and then adds a protection code.

[0090] In S1109, the cryptographic operation circuit 113 stores the encrypted data in a storage area at the address on the memory 112 based on the address of the transfer destination included in the circuit transfer instruction.

[0091] In S1110, CPU 111 transmits a drive transfer instruction to drive 120. For example, CPU 111 generates drive transfer instruction information including information indicating a write command, information on the address (source address) of a storage area on memory 112 where the encrypted data is stored, and information on a physical address (destination address) calculated from the LBA of the IO command. Note that the drive transfer instruction information may be transferred by DMA to drive 120 in which a storage area of ​​the physical address is provided.

[0092] In S1111, the drive 120 acquires data on the memory 112 based on the transfer source address included in the drive transfer instruction, and stores the acquired data in the transfer destination address included in the drive transfer instruction.

[0093] 12 is a diagram showing an example of a read process. The read process is started at a predetermined timing, such as when the CPU 111 receives a read command or when it is called from a key update process.

[0094] In S1201, the CPU 111 performs an IO command process. In the IO command process, for example, the CPU 111 determines that the type of the IO command is a read command. Also, for example, the CPU 111 refers to the encryption setting table 400, identifies a record in the address range 401 to which the physical address calculated from the LBA of the IO command corresponds, and acquires the value of the encryption computation necessity 402 of the identified record.

[0095] In S1202, the CPU 111 determines the key index of the encryption key used by the encryption operation circuit 113 from the registered key information 112A. For example, the CPU 111 refers to the registered key table 200, identifies a record in the address range 201 to which the physical address calculated from the LBA of the IO command corresponds, and obtains the value of the key index 202 of the identified record.

[0096] It should be noted that, if the value of cryptographic computation necessity 402 acquired in S1201 is "non-cryptographic operation" indicating that cryptographic computation is not necessary, the process of S1202 does not need to be performed.

[0097] In S1203, the CPU 111 determines the format of the cryptographic operation used by the cryptographic operation circuit 113 from the format management information 112B. For example, the CPU 111 refers to the format management table 300, identifies a record in the address range 301 to which the physical address calculated from the LBA of the IO command corresponds, and acquires the value of the format 302 of the identified record ("SAS" or "NVMe").

[0098] In S1204, CPU 111 transmits a drive transfer instruction to drive 120. For example, CPU 111 generates drive transfer instruction information including information indicating that it is a read command, information of a physical address (transfer source address) calculated from the LBA of the IO command, and information of an address (transfer destination address) of a storage area on memory 112 where the read data is stored. Note that the drive transfer instruction information may be transferred by DMA to drive 120 in which a storage area of ​​the physical address is provided.

[0099] In S1205, the drive 120 acquires data on the drive 120 based on the transfer source address included in the drive transfer instruction, and stores the acquired data in the transfer destination address included in the drive transfer instruction.

[0100] In S1206, the CPU 111 notifies the cryptographic operation circuit 113 of a circuit transfer instruction. The CPU 111 generates circuit transfer instruction information including information indicating that it is a read command, information indicating whether or not cryptographic operation is required, information on the address (source address) of the storage area on the memory 112 where the data was stored in S1205, information on the address (destination address) of the storage area on the memory 112 where the decrypted data is stored, and information on the target drive indicating whether or not the format of the cryptographic operation is "SAS". The circuit transfer instruction information may be transferred to the cryptographic operation circuit 113 by DMA.

[0101] In S1207, the cryptographic operation circuit 113 reads the data on the memory 112 based on the address of the transfer source included in the circuit transfer instruction.

[0102] In S1208, the cryptographic operation circuit 113 acquires data of the cryptographic key to be used from the key information 113A based on the key index included in the circuit transfer instruction.

[0103] In S1209, the cryptographic operation circuit 113 determines the processing method for the cryptographic operation based on the target drive information included in the circuit transfer instruction.

[0104] In S1210, the cryptographic operation circuit 113 decrypts the data read in S1207 by the processing method determined in S1209 using the data of the encryption key acquired in S1208. For example, if the cryptographic operation format is "SAS", the cryptographic operation circuit 113 decrypts the data using the encryption key and then removes the protection code, and if the cryptographic operation format is "NVMe", the cryptographic operation circuit 113 removes the protection code from the data and then decrypts the data using the encryption key.

[0105] In S1211, the cryptographic operation circuit 113 stores the decrypted data in a storage area at the address on the memory 112 based on the address of the transfer destination included in the circuit transfer instruction.

[0106] In S1212, the CPU 111 outputs data, for example, returning data to the source of the read command (for example, the host terminal 101).

[0107] Fig. 13 is a diagram showing an example of a processing flow relating to a write process. In Fig. 13, an example will be explained in which write data is written to the built-in drive 120-1.

[0108] When a write request (write command and write data) is issued from the host terminal 101, the write request is stored in the memory 112 (S1301).

[0109] When the CPU 111 receives the write command, it performs format determination (S1103), etc. Then, the CPU 111 notifies the cryptographic operation circuit 113 of a circuit transfer instruction (S1104).

[0110] Next, the cryptographic operation circuit 113 transfers the write data from the memory 112 to the cryptographic operation circuit 113 based on the circuit transfer instruction (S1105). Next, the cryptographic operation circuit 113 performs processing decision (S1107), encryption (S1108), etc., and transfers the encrypted data from the cryptographic operation circuit 113 to the memory 112 (S1109).

[0111] Next, the CPU 111 transmits a drive transfer instruction to the drive 120-1 (S1110).

[0112] Drive 120-1 then transfers the encrypted data from memory 112 to drive 120-1.

[0113] Fig. 14 is a diagram showing an example of a processing flow relating to a read process. In Fig. 14, a case in which read data is read from the built-in drive 120-1 will be explained as an example.

[0114] When a read request (read command) is issued from the host terminal 101, the read request is stored in the memory 112 (S1401).

[0115] When the CPU 111 receives the read command, it performs format determination (S1203), etc. Then, the CPU 111 notifies the drive 120-1 of a drive transfer instruction (S1204).

[0116] Next, the drive 120-1 reads the data from the storage area based on the drive transfer instruction, and transfers the read data to the memory 112 (S1205).

[0117] Next, the CPU 111 notifies the cryptographic operation circuit 113 of a circuit transfer instruction (S1206).

[0118] Next, the cryptographic operation circuit 113 transfers the data read from the drive 120-1 from the memory 112 to the cryptographic operation circuit 113 based on the circuit transfer instruction (S1207). Next, the cryptographic operation circuit 113 performs processing decision (S1209), decryption (S1210), etc., and transfers the decrypted data from the cryptographic operation circuit 113 to the memory 112 (S1211).

[0119] Next, the CPU 111 returns the decrypted data to the host terminal 101 (S1402).

[0120] According to this embodiment, the encryption engines are consolidated, so the security levels of the encryption algorithms and FIPS certification are uniform, and the security of the entire storage system can be guaranteed. If the encryption engines are not consolidated, even a partial vulnerability will threaten the security of the entire storage system, increasing the security risk.

[0121] For example, previously, the encryption calculation processing method was different between SAS format and other formats, but now the encryption calculation circuit can switch between them according to the encryption calculation format determined by the CPU. In addition, by encrypting with the same encryption algorithm, there is also the advantage that common data reliability can be guaranteed between protocols.

[0122] According to this embodiment, since the same encryption engine (hardware) is used in all drives, it is not necessary to create a microcomputer for each encryption engine. Also, since encryption calculations for multiple protocols can be realized using the same procedure, even if a protocol (encryption calculation format) is added to a future product, it can be quickly handled, and the time from when a product is planned to when it is introduced to the market can be shortened, thereby maintaining competitiveness.

[0123] (II) Second embodiment The second embodiment differs in that the cryptographic operation circuit 113 is connected to the PCIe SW 114-1 instead of the PCIe SW 114-2. The other configurations are the same as those of the first embodiment, and therefore the description thereof will be omitted.

[0124] 15 is a diagram showing an example of a configuration of a storage system 1500 according to this embodiment. The storage system 1500 includes a CTL 1510. In the CTL 1510, a CPU 111 and a cryptographic operation circuit 113 are connected via a PCIe SW 114-1.

[0125] In this embodiment, since the PCIeSW 114-2 is not provided, it is more advantageous in terms of cost and implementation than the first embodiment. In addition, in the configuration of the first embodiment, the data flow rate between the CPU 111 and the PCIeSW 114-1 is less than that of the second embodiment, so that the first embodiment is more advantageous in terms of storage system performance.

[0126] (III) Third embodiment The third embodiment differs from the first embodiment in that DIP (Data In Place) is performed to upgrade the CTL 110 while leaving the data in the drive 120 as is. In this embodiment, the description of the same configuration as the first embodiment is omitted.

[0127] In the DIP of this embodiment, various information stored in the memory used by the old CTL is transferred to the new CTL. Here, there are several possible methods for transferring various data, as described below, and any of the transfer methods may be used, or other transfer methods may be used. (Takeover method 1) A method in which a node (new CTL) is added, various information is copied from the old CTL to the new CTL via the interconnect controller, and then the old CTL is removed. (Transfer Method 2) Various information from the old CTL is written to an external storage device, and after switching to the new CTL, various data is copied from the external storage device to the new CTL. (Transfer Method 3) A method in which the old CTL and the new CTL are connected using an external IF, and maintenance personnel copy various information.

[0128] 16 is a diagram showing an example of the DIP process. The DIP process is started at a predetermined timing, for example, when a new CTL (CTL 110) is added.

[0129] In S1601, the CPU 111 of the CTL 110 copies various information from the memory of the old CTL. For example, the CPU 111 copies information stored in the memory of the old CTL to the memory 112 of the own CTL 110. For example, if the old CTL is configured to include the cryptographic operation circuit 113, the information includes the registration key information 112A, the format management information 112B, the encryption setting information 112C, etc. If the old CTL is configured not to include the cryptographic operation circuit 113, the encryption key may be acquired if it is stored, or the encryption key may be acquired from the key management server device.

[0130] In S1602, the CPU 111 initializes the encryption operation circuit 113. For example, the CPU 111 performs key registration processing, encryption necessity setting processing, and the like.

[0131] Fig. 17 is a diagram showing an example of a processing flow relating to the DIP processing. In Fig. 17, a case where the old CTL (CTL 1710) does not include the cryptographic operation circuit 113 will be described as an example.

[0132] As shown in FIG. 17, the CTL 1710 receives an IO request from the host terminal 101 and controls input / output to the drive 1720 (S1701).

[0133] When a new CTL (CTL110) is added, the CPU 111 of the CTL 110 reads various information from the memory 1712 in the process of copying various information (S1601) and stores the read information in the memory 112 (S1702). For example, if encryption key data is stored in the memory 1712, the CPU 111 stores the encryption key data in the memory 112.

[0134] Next, the CPU 111 executes a key registration process in the cryptographic operation circuit initialization (S1602). In the key registration process, the CPU 111 notifies the cryptographic operation circuit 113 of a key registration instruction for the acquired registration key (S801). The cryptographic operation circuit 113 reads out the cryptographic key from the memory 112 (S802) and stores it as key information 113A (S803).

[0135] Next, when IO switching is performed (S 1703 ), the CPU 111 accepts an IO request from the host terminal 101 and controls input / output to and from the drive 1720 .

[0136] Next, the CPU 1711 stops the processing related to IO, and the CTL 1710 is blocked (S1704). After that, the CTL 1710 is removed.

[0137] According to this embodiment, the encryption key used in the drive connected to the old CTL is carried over to the new CTL, so that the data in the drive connected to the old CTL can be upgraded from the old CTL to the new CTL without changing it.

[0138] (IV) Fourth embodiment The fourth embodiment differs from the first embodiment in that two CTLs are provided for redundancy. In this embodiment, the description of the same configuration as that of the first embodiment will be omitted.

[0139] FIG. 18 is a diagram showing an example of the configuration of a storage system 1800 according to this embodiment.

[0140] The storage system 1800 comprises two CTLs 1810. The CTLs 1810 comprise an interconnect controller 1811 that performs communication between the CTLs 1810. For example, one CTL 1810 and the other CTL 1810 are communicably connected by the interconnect controller 1811, and a redundant configuration is adopted so that even if one CTL 1810 breaks down, operation can be continued by the other CTL 1810.

[0141] More specifically, the CTL 1810-1 includes an interconnect controller 1811-1, and the CTL 1810-2 includes an interconnect controller 1811-2. The interconnect controller 1811-1 and the interconnect controller 1811-2 are connected via a network SW1820.

[0142] It should be noted that this embodiment is not limited to the above-mentioned configuration, and the interconnect controllers 1811 may be directly connected to each other.

[0143] In storage system 1800, for example, after one CTL 1810 is replaced (upgraded), the other CTL 1810 is replaced (upgraded).

[0144] According to this embodiment, while the power is on (operating), it is possible to upgrade from an old CTL to a new CTL while leaving the data on the drive as is.

[0145] (V) Fifth embodiment The fifth embodiment differs from the fourth embodiment in that a plurality of nodes are provided with two CTLs for redundancy. In this embodiment, the description of the same configuration as that of the fourth embodiment is omitted.

[0146] FIG. 19 is a diagram showing an example of the configuration of a storage system 1900 according to this embodiment.

[0147] The storage system 1900 comprises a plurality of nodes 1910. The node 1910 comprises two CTLs 1810, and is configured for redundancy.

[0148] This embodiment is not limited to the above configuration. For example, a configuration in which the PCIe SWs 114-2 to which the cryptographic operation circuits 113 are connected are connected to each other may be adopted.

[0149] According to this embodiment, the data on the drives can be upgraded from an old node to a new node while remaining intact.

[0150] (VI) Notes The above-described embodiment includes, for example, the following contents.

[0151] In the above embodiment, the present invention is described as being applied to a storage system, but the present invention is not limited to this and can be widely applied to various other systems, devices, methods, and programs.

[0152] Furthermore, in the above-described embodiments, the configuration of each table is an example, and one table may be divided into two or more tables, or all or part of two or more tables may be one table.

[0153] In the above embodiment, for convenience of explanation, the information related to the storage system is explained using a table, but the data structure is not limited to a table. The information related to the storage system may be expressed by a data structure other than a table, such as XML (Extensible Markup Language), YAML (YAML Ain't a Markup Language), a hash table, a tree structure, etc.

[0154] In addition, in the above description, information such as programs, tables, files, etc. that realize each function can be placed in a storage device such as a memory, a hard disk, or an SSD (Solid State Drive), or in a recording medium such as an IC card, an SD card, or a DVD.

[0155] The above-described embodiment has the following characteristic configurations, for example.

[0156] (1) A storage system (e.g., storage system 100, storage system 1500, storage system 1800, storage system 1900) including a plurality of storage devices (e.g., drive 120) that store encrypted data, and a controller (e.g., CTL 110, CTL 1510, CTL 1810) that controls input / output for each of the plurality of storage devices, the controller including a memory (e.g., memory 112) that stores format management information (e.g., format management information 112B, format management table 300) including information indicating a format (e.g., "SAS", "NVMe") of an encryption operation corresponding to each of the plurality of storage devices; The data storage device includes a processor (e.g., CPU 111) that determines a format corresponding to the storage device from the format management information based on an input / output request from a host terminal (e.g., host terminal 101) to the storage device, and a cryptographic operation circuit (e.g., cryptographic operation circuit 113) that encrypts data in accordance with the format determined by the processor based on a request from the host terminal to write data to the storage device (e.g., a write command), and decrypts the encrypted data of the data stored in the storage device in accordance with the format determined by the processor based on a request from the host terminal to read data from the storage device (e.g., a read command).

[0157] In the above configuration, even if the cryptographic operation format differs for each storage device, the processor determines the cryptographic operation format suitable for the storage device, and the cryptographic operation circuit performs the cryptographic operation in the format determined by the processor. With the above configuration, for example, it is possible to realize encryption by hardware without creating a cryptographic operation circuit for each storage device.

[0158] (2) The memory stores an address range (e.g., address range 201) indicating a predetermined storage area provided in a storage device, an encryption key (e.g., encryption key 203) associated with the address range, and registration key information (e.g., registration key information 112A, registration key table 200) including identification information of the encryption key (e.g., key index 202), and the processor generates key registration instruction information for registering the encryption key including a memory address (e.g., a transfer source address) indicating the storage area of ​​the memory in which the encryption key is stored and the identification information, and when the encryption operation circuit receives the key registration instruction information, it reads out from the memory the encryption key stored in the storage area of ​​the memory address and stores key information (e.g., key information 113A, key table 500) that associates the read encryption key with the identification information (e.g., see FIG. 8).

[0159] In the above configuration, for example, an encryption key that is already being used in the storage system can be registered in the encryption operation circuit, so that the controller can be upgraded while leaving the encryption data stored in the storage device as is.

[0160] (3) The format management information stored in the memory includes information that associates an address range (e.g., address range 301) indicating a predetermined storage area provided in the storage device with a cryptographic operation format (e.g., format 302) corresponding to the storage device, and when the request from the host terminal is a request to write data to a storage area of ​​a storage device address in the storage device, the processor generates circuit instruction information (e.g., the cryptographic operation circuit, upon receiving the circuit instruction information, reads from the memory the data stored in the memory area of ​​the first memory address, reads an encryption key corresponding to the identification information from the stored key information, and stores the encrypted data obtained by encrypting the data using the encryption key according to the format in the memory area of ​​the second memory address; the processor generates storage device instruction information (e.g., drive transfer instruction information 700) including a request type indicating that the request is a write request, the storage device address, and the second memory address; and the storage device, upon receiving the storage device instruction information, stores the encrypted data stored in the memory area of ​​the second memory address in the memory area of ​​the storage device address (e.g., see FIG. 11).

[0161] In the above configuration, the circuit instruction information includes information on the request type, the identification information of the encryption key, and the format of the encryption operation, so that, for example, when the encryption operation circuit receives the circuit instruction information, it can encrypt data with a format and encryption key that correspond to the storage device.

[0162] (4) When the request from the host terminal is a request to read encrypted data from a storage area of ​​a storage device address in a storage device, the processor generates storage device instruction information (e.g., drive transfer instruction information 700) including a request type indicating that the request is a read request, the storage device address, and a third memory address in the memory for specifying a storage area in which the encrypted data read from the storage device is to be stored, and when the storage device receives the storage device instruction information, the storage device reads the encrypted data from the storage area of ​​the storage device address and stores the read encrypted data in the storage area of ​​the third memory address, and the processor generates drive transfer instruction information (e.g., drive transfer instruction information 700) including a request type indicating that the request is a read request, identification information of an encryption key corresponding to the storage device address, and identification information of the third memory address in the memory for specifying a storage area in which the encrypted data read from the storage device is to be stored. and generates circuit instruction information (e.g., circuit transfer instruction information 600) including information on the real address of the encrypted data stored in the memory, a fourth memory address in the memory for specifying a storage area where the decrypted data of the encrypted data is to be stored, and a cryptographic operation format corresponding to the storage device, and when the cryptographic operation circuit receives the circuit instruction information, it reads from the memory the encrypted data stored in the storage area of ​​the third memory address, reads from the memory an encryption key corresponding to the identification information from the stored key information, and stores the encrypted data decrypted using the encryption key in accordance with the format in the storage area of ​​the fourth memory address, and the processor responds with the data stored in the storage area of ​​the fourth memory address to the host terminal (e.g., see FIG. 12).

[0163] In the above configuration, the circuit instruction information includes information on the request type, identification information of the encryption key, and the format of the encryption operation, so that, for example, when the encryption operation circuit receives the circuit instruction information, it can decrypt the encrypted data using the format and encryption key that correspond to the storage device.

[0164] (5) The memory stores encryption setting information (e.g., encryption setting information 112C, encryption setting table 400) that includes an address range indicating a specific storage area provided in the storage device and necessity information indicating whether a cryptographic operation corresponding to the storage device is necessary, and the processor identifies the necessity information corresponding to the storage device address based on a request from a host terminal to write data to a storage device address in the storage device, and when the cryptographic operation circuit determines that a cryptographic operation is necessary based on the necessity information identified by the processor, it encrypts the data in accordance with the format determined by the processor.

[0165] According to the above configuration, for example, a user can set whether or not cryptographic calculation is required for each storage area. Also, for example, a user can set cryptographic calculation to be performed for all storage areas, so that cryptographic calculation is performed by the same cryptographic calculation circuit for all storage devices, thereby making it possible to maintain a constant security level for the storage system. This makes it possible to avoid cyber attacks on storage devices with relatively low security levels, and to strengthen the security of the storage system.

[0166] (6) The above-mentioned storage system is provided with the controller and another controller for redundancy of the controller having the same configuration as the controller (see, for example, Figures 18 and 19), and the controller and the other controller are provided with an interconnect controller for communication between the controllers.

[0167] According to the above configuration, for example, since the controller is made redundant, it is possible to upgrade the controller without stopping the storage system.

[0168] (7) The cryptographic operation circuit is connected to the processor via a PCIeSW (Peripheral Component Interconnect Express Switch) (see, for example, FIGS. 1, 15, 18, and 19).

[0169] According to the above configuration, it is possible to ensure expandability, for example, by allowing the addition of an additional cryptographic operation circuit, another accelerator, and the like.

[0170] (8) At least one of the plurality of storage devices and the processor are connected to a PCIeSW (Peripheral Component Interconnect Express Switch).

[0171] For example, although hardware encryption is not supported for NVMe drives directly connected to PCIeSW, the above configuration makes it possible to perform encryption using a cryptographic operation circuit. For example, even in a configuration in which an NVMe drive is directly connected to a PCIeSW, it is possible to achieve hardware encryption, which provides higher security than software encryption using a CPU or the like.

[0172] The cryptographic operation circuit may be directly connected to the processor without going through a PCIeSW. Furthermore, the above-mentioned configuration may be appropriately changed, rearranged, combined, or omitted without departing from the spirit and scope of the present invention.

[0173] It should be understood that items listed in the format "at least one of A, B, and C" can mean (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C). Similarly, items listed in the format "at least one of A, B, or C" can mean (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C). [Explanation of symbols]

[0174] 100...storage system, 110...CTL, 111...CPU, 120...memory, 113...encryption operation circuit.

Claims

1. A storage system including a controller that controls input / output from a host terminal to each of a plurality of storage devices, The controller: a memory that stores format management information including information indicating a format of a cryptographic operation corresponding to each of the plurality of storage devices; a processor that determines a format corresponding to the storage device from the format management information based on an input / output request from a host terminal to the storage device; an encryption operation circuit that encrypts data in accordance with a format determined by the processor based on a request from a host terminal to write data to the storage device, and decrypts the encrypted data of the data stored in the storage device in accordance with a format determined by the processor based on a request from the host terminal to read data from the storage device; A storage system comprising:

2. the memory stores registered key information including an address range indicating a predetermined storage area provided in a storage device, an encryption key associated with the address range, and identification information of the encryption key; the processor generates key registration instruction information for registering the encryption key, the key registration instruction information including a memory address indicating a storage area of ​​the memory in which the encryption key is stored and the identification information; when the encryption operation circuit receives the key registration instruction information, the encryption operation circuit reads out the encryption key stored in the storage area of ​​the memory address from the memory, and stores key information in which the read encryption key is associated with the identification information; The storage system according to claim 1 .

3. the format management information stored in the memory includes information in which an address range indicating a predetermined storage area provided in a storage device is associated with a cryptographic operation format corresponding to the storage device; when the request from the host terminal is a request to write data to a memory area of ​​a memory device address in a memory device, the processor generates circuit instruction information including a request type indicating that the request is a write request, identification information of an encryption key corresponding to the memory device address, a first memory address indicating the memory area in the memory in which the data is stored, a second memory address in the memory for specifying a memory area in which encrypted data obtained by encrypting the data is stored, and a cryptographic operation format corresponding to the memory device; When the cryptographic operation circuit receives the circuit instruction information, reading the data stored in the storage area of ​​the first memory address from the memory; reading an encryption key corresponding to said identification information from stored key information; storing encrypted data obtained by encrypting the data using the encryption key in accordance with the format in a storage area at the second memory address; the processor generates storage device instruction information including a request type indicating a write request, the storage device address, and the second memory address; when the storage device receives the storage device instruction information, the storage device stores the encrypted data stored in the storage area of ​​the second memory address in the storage area of ​​the storage device address; The storage system according to claim 2.

4. the format management information stored in the memory includes information in which an address range indicating a predetermined storage area provided in a storage device is associated with a cryptographic operation format corresponding to the storage device; when the request from the host terminal is a request to read encrypted data from a storage area of ​​a storage device address in a storage device, the processor generates storage device instruction information including a request type indicating that the request is a read request, the storage device address, and a third memory address in the memory for specifying a storage area in which the encrypted data read from the storage device is to be stored; when the storage device receives the storage device instruction information, the storage device reads the encrypted data from the storage area of ​​the storage device address and stores the read encrypted data in the storage area of ​​the third memory address; the processor generates circuit instruction information including a request type indicating a read request, identification information of an encryption key corresponding to the memory device address, the third memory address, a fourth memory address in the memory for specifying a storage area in which data obtained by decrypting the encrypted data is stored, and information on a cryptographic operation format corresponding to the memory device; When the cryptographic operation circuit receives the circuit instruction information, reading the encrypted data stored in the memory area at the third memory address from the memory; reading an encryption key corresponding to said identification information from stored key information; storing data obtained by decrypting the encrypted data using the encryption key in accordance with the format in a storage area at the fourth memory address; the processor responds to the host terminal with the data stored in the memory area of ​​the fourth memory address; The storage system according to claim 2.

5. the memory stores encryption setting information including an address range indicating a predetermined storage area provided in the storage device and necessity information indicating whether or not a cryptographic calculation corresponding to the storage device is necessary; The processor identifies necessity information corresponding to a storage device address based on a request from a host terminal to write data to the storage device address in the storage device; when determining that a cryptographic operation is necessary based on the necessity information specified by the processor, the cryptographic operation circuit encrypts the data in accordance with a format determined by the processor. The storage system according to claim 1 .

6. the controller and another controller having the same configuration as the controller for redundancy of the controller are provided; The controller and the other controller each include an interconnect controller for communicating between the controllers. The storage system according to claim 1 .

7. The cryptographic operation circuit is connected to the processor via a PCIeSW (Peripheral Component Interconnect Express Switch). The storage system according to claim 1 .

8. A storage system including a controller that controls input / output from a host terminal to each of a plurality of storage devices, The controller includes a memory, a processor, and a cryptographic operation circuit; the memory stores format management information including information indicating a format of a cryptographic operation corresponding to each of the plurality of storage devices; the processor determines a format corresponding to the storage device from the format management information based on an input / output request from a host terminal to the storage device; the cryptographic operation circuit encrypts the data in accordance with a format determined by the processor based on a request from a host terminal to write data to the storage device, and decrypts the encrypted data of the data stored in the storage device in accordance with a format determined by the processor based on a request from the host terminal to read data from the storage device; A cryptographic computation method comprising:

Images