Flash Controller HPB Entry Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Flash memory devices, particularly NAND flash devices, lack random access capabilities, and existing security measures for physical-address information are inadequate, making them vulnerable to data theft as illegal access can exploit plain-coded Host Performance Booster (HPB) entries.
Innovation Solution
Implementing a method and apparatus within the flash controller to encrypt and decrypt physical-address information using an encryption algorithm, ensuring that only encrypted HPB entries are delivered to the host side, thereby enhancing data security by preventing unauthorized access to internal management information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If plain-coded HPB entries are provided to the host side, then the host can efficiently access physical addresses for fast data retrieval, but the device becomes vulnerable to data theft and unauthorized access to internal management information
Solution Approach 1:
The patent introduces an encryption mechanism as an intermediary between the physical address storage and the host side. The HPB entries are encrypted before being provided to the host, and the flash controller maintains decryption capability. This intermediary encryption layer prevents direct exposure of plain physical addresses to the host while preserving the fast access capability, thus resolving the contradiction between speed and security.
2Object-affected harmful factors
If physical-address information is encrypted, then data security is enhanced and unauthorized access is prevented, but the complexity of the flash controller increases due to encryption and decryption operations
Solution Approach 1:
The flash controller performs self-service by maintaining the decryption capability internally. The encryption key is stored within the flash controller, and it autonomously decrypts the encrypted HPB entries when needed for data access operations. This self-service approach allows the system to benefit from encryption security without requiring external decryption infrastructure, thereby managing the complexity within the flash controller itself while achieving enhanced security.
3Object-affected harmful factors
If encryption algorithms are applied to HPB entries, then unauthorized access to physical addresses is blocked, but additional processing time is required for encryption and decryption operations
Solution Approach 1:
The encryption of HPB entries is performed in advance (preliminary action) when the mapping information is generated or updated, rather than encrypting in real-time during each data access operation. The encrypted entries are stored and transmitted to the host in this pre-encrypted state. During actual data access, only decryption is needed, which is faster than full encryption. This preliminary encryption action reduces the time penalty associated with cryptographic operations while maintaining security.
Data Source
AI summary
The invention relates to a method, a non-transitory computer program product, and an apparatus for encrypting and decrypting physical-address information. The method includes: receiving a first read command requesting of the flash controller for first physical block addresses (PBAs) corresponding to a logical block address (LBA) range from a host side, wherein each first PBA indicates which physical address that user data of a first LBA of the LBA range is physically stored in a flash device; reading the first PBAs corresponding to the LBA range from the flash device; arranging the first PBAs into entries; encrypting content of each entry by using an encryption algorithm with an encryption parameter to obtain an encrypted entry; and delivering the encrypted entries to the host side.