Protecting data stored on a solid state drive

Patent metadata

Field	Value
Publication number	US-9852025-B2
Application number	US-201615084224-A
Country	US
Kind code	B2
Filing date	Mar 29, 2016
Priority date	Mar 29, 2016
Publication date	Dec 26, 2017
Grant date	Dec 26, 2017

Abstract

Disclosed are different types of mechanisms for protecting data stored on a solid state drive or device (SSD) without erasing that data and/or without physically destroying the SSD. The different types of mechanisms can be used alone or in combination to prevent data stored on the SSD from being retrieved (accessed and/or read) in a usable or understandable form. The mechanisms include erasing logical-to-physical address mapping information (that is also used for error correction coding and interleaving), erasing compression information, erasing encryption keys, and changing the codec used for error correction coding. Each mechanism can be used online with the SSD installed in a computer system/server.

First claim

What is claimed is:

1. A method of protecting data that is stored on a solid state drive (SSD), the method comprising:
compressing the data to produce compressed data;
mapping a logical address to a physical address in the SSD and writing the compressed data to a location in the SSD identified by the physical address;
storing, in a first persistent memory location in the SSD, first metadata comprising a map from the logical address to the physical address for the location where the compressed data is stored;
storing, in a second persistent memory location in the SSD, second metadata comprising information for decompressing the compressed data; and
erasing the second metadata from the second persistent memory location without erasing the compressed data.

2. The method of claim 1 , further comprising:
prior to said writing, encrypting the compressed data to produce encrypted compressed data, wherein the compressed data written to the location identified by the physical address comprises the encrypted compressed data;
storing, in a third persistent memory location in the SSD, a key comprising information for decrypting the encrypted compressed data; and
erasing the key from the third persistent memory location without erasing the encrypted compressed data.

3. The method of claim 1 , further comprising, prior to said writing, error-correction-coding the compressed data with a codec to produce encoded compressed data, wherein the compressed data written to the location identified by the physical address comprises the encoded compressed data, and wherein further error-correction-decoding the encoded compressed data depends on the first metadata.

4. The method of claim 3 , further comprising, prior to said writing, interleaving the encoded compressed data to produce interleaved encoded compressed data, wherein the compressed data written to the location identified by the physical address comprises the interleaved encoded compressed data, and wherein further de-interleaving the interleaved encoded compressed data depends on the first metadata.

5. The method of claim 3 , further comprising generating a seed as an input to the codec, wherein the seed is generated using the logical address and the physical address mapped from the logical address.

6. The method of claim 3 , wherein the encoded compressed data that is output from the codec is a function of a value of a parameter of the codec, wherein the method further comprises, with the encoded compressed data still stored at the location identified by the physical address, changing the value of the parameter.

7. A computer system, comprising:
a memory;
a processor coupled to the memory; and
a solid state drive (SSD) coupled to the processor and comprising a controller and a plurality of non-volatile memories, the controller configured to prevent data that is stored on the SSD from being located and read, the controller operable for:
compressing the data to produce compressed data;
mapping a logical address to a physical address in the SSD and writing the compressed data to a first non-volatile memory location in the SSD identified by the physical address;
storing, in a second non-volatile memory location in the SSD, first metadata comprising a map from the logical address to the physical address for the first non-volatile memory location where the compressed data is stored;
storing, in a third non-volatile memory location in the SSD, second metadata comprising information for decompressing the compressed data; and
with the compressed data stored at the first non-volatile memory location, erasing the second metadata from the third non-volatile memory location.

8. The computer system of claim 7 , wherein the SSD is further operable for: encrypting the compressed data prior to writing the compressed data to produce encrypted compressed data, wherein the compressed data written to the first non-volatile memory location comprises the encrypted compressed data; storing, in a fourth non-volatile memory location in the SSD, a key comprising information for decrypting the encrypted compressed data; and with the encrypted compressed data stored at the first non-volatile memory location, erasing the key from the fourth non-volatile memory location.

9. The computer system of claim 7 , wherein the SSD is further operable for: error-correction-coding the compressed data with a codec prior to writing the compressed data to produce encoded compressed data, wherein the compressed data written to the first non-volatile memory location comprises the encoded compressed data, and wherein further error-correction-decoding the encoded compressed data depends on the first metadata.

10. The computer system of claim 9 , wherein the SSD is further operable for interleaving the encoded compressed data prior to writing the encoded compressed data to produce interleaved encoded compressed data, wherein the compressed data written to the first non-volatile memory location comprises the interleaved encoded compressed data, and wherein further de-interleaving the interleaved encoded compressed data depends on the first metadata.

11. The computer system of claim 9 , wherein the SSD is further operable for generating a seed that is input to the codec, wherein the seed is generated using the logical address and the physical address mapped from the logical address.

12. The computer system of claim 9 , wherein the encoded compressed data that is output from the codec is a function of a value of a parameter of the codec, wherein the SSD is further operable for changing the value of the parameter with the encoded compressed data stored at the first non-volatile memory location.

13. A solid state drive (SSD), comprising:
a plurality of non-volatile storage elements; and
a controller coupled to the storage elements;
the controller operable to execute operations that prevent data that is stored on the SSD from being located and read, the operations comprising:
compressing the data to produce compressed data;
mapping a logical address to a physical address in the SSD and writing the compressed data to a location in a non-volatile storage element in the SSD identified by the physical address;
storing, in a first non-volatile storage location in the SSD, first metadata comprising a map from the logical address to the physical address for the location in the non-volatile storage element where the compressed data is stored;
storing, in a second non-volatile storage location in the SSD, second metadata comprising information for decompressing the compressed data; and
with the compressed data stored at the location identified by the physical address, erasing the second metadata from the second non-volatile storage location.

14. The SSD of claim 13 , wherein the controller further comprises an encryption block operable for encrypting the compressed data prior to writing the compressed data to produce encrypted compressed data, wherein the compressed data written to the location identified by the physical address comprises the encrypted compressed data; and wherein the controller is further operable for: storing, in a third non-volatile storage location in the SSD, a key comprising information for decrypting the encrypted compressed data; and with the encrypted compressed data stored at the location identified by the physical address, erasing the key from the third non-volatile storage location.

15. The SSD of claim 13 , wherein the controller further comprises an error correction coding block operable for: generating a seed using the logical address and the physical address mapped from the logical address

Assignees

• Li Shu
• Alibaba Group Holding Ltd

Inventors

• Li Shu

Classifications

• G06F3/0611 Primary

  in relation to response time · CPC title

• G06F11/108 Primary

  Parity data distribution in semiconductor storages, e.g. in SSD · CPC title

• G06F3/0688

  Non-volatile semiconductor memory arrays · CPC title

• G06F3/0619

  in relation to data integrity, e.g. data losses, bit errors · CPC title

• G06F11/1072

  in multilevel memories · CPC title