Lsi Logic Corporation

Seagate Technology Incorporated

Robert Wayne Moss

Stacey Secatch

Dana Lynn Simonson

Kristofer Carlson Conklin

Peter Korger

David O Sluiter

Russell B Stuber

Ryan James Goss

Thomas V Spencer

Alan R Gilchrist

Darren Duane Neuman

Jon David Trantham

Mark Ish

Kevin Arthur Gomez

Laszlo Hars

David Scott Ebsen

Monty Aaron Forehand

Daniel John Benjamin

Christopher M Giles

Donald Rozinak Beaver

Charles William Thiesfeld

Donald Preston Matthews, Jr

William Preston Goodwill

Mark Jon Kwong

Eric J Behnke

Michael Shaw

Yalan Liu

Sarvani Reddy Kolli

A data storage system can organize a semiconductor memory into a first data set and a second data set with a first queue populated with a first data access request from a host. An assignment of an arbitration weight to the first queue with an arbitration circuit corresponds with the first queue being skipped during a deterministic window based on the arbitration weight.

Data storage system data access arbitration

Method and apparatus for protecting against a jitter attack upon a cryptographic processing device. In some embodiments, the cryptographic processing circuit is configured to perform a cryptographic function on a set of input data to generate a corresponding set of transformed output data. An input line supplies an input signal used by the cryptographic processing IC during execution of the cryptographic function. A monitor circuit monitors the input signal, and temporarily disables the cryptographic processing IC when time-varying changes to the input signal indicate a jitter attack may be taking place. The input signal may be a source voltage, and voltage transitions in the source voltage can be monitored. Alternatively, the input signal may be a clock signal, and frequency variations in the clock signal can be monitored. The monitor circuit may be arranged on a power island to maintain power during power fluctuations.

Jitter attack protection circuit

Systems and methods for encrypting system level data structures are described. A storage system may include a storage drive and at least one controller for the storage drive. In some embodiments, the at least one controller may be configured to identify user data assigned to be stored on the storage drive, encrypt the user data, identify a system data structure generated in relation to the user data, and encrypt the system data structure. In some cases, the data structure may include at least one of metadata, system data, and data encapsulation relative to the user data. In some embodiments, the user data and the data structure may be encrypted with one or more encryption keys programmed on the storage drive.

Encrypting system level data structures

Method and apparatus for managing data transfers. In some embodiments, first and second storage devices respectively include first and second controllers, first and second local memories, and first and second non-volatile memories (NVMs). A virtual controller memory buffer (CMB) is formed from a dedicated portion of each of the first and second local memories for control by a host device. The first controller receives a virtual command set from the host device, and extracts a first local command to transfer data between the host device and the first NVM. In some cases, the second controller also receives the virtual command set and concurrently extracts a different, second local command to transfer data between the host device and the second NVM. Alternatively, the first controller may extract and forward the second local command to the second controller. The first and second NVMs may form an NVMe (Non-Volatile Memory Express) namespace.

Virtual controller memory buffer

Method and apparatus for managing data in a data storage device configured as a storage compute appliance. In some embodiments, the data storage device has a non-volatile memory (NVM) and a controller circuit. The NVM stores a plurality of data sets encrypted by at least one encryption key. The controller circuit performs a storage compute appliance process by locally decrypting the plurality of data sets in a local memory of the data storage device, generating summary results data from the decrypted data sets, and transferring the summary results data across the host interface to an authorized user without a corresponding transfer of any portion of the decrypted data sets across the host interface.

Storage compute appliance with internal data encryption

Method and apparatus for managing data in a data storage device configured as a storage compute appliance. In some embodiments, the data storage device has a controller circuit and a non-volatile memory (NVM) with an overall data storage capacity. A processor authenticates each of a plurality of authorized users of the NVM via data exchanges between a host device and the processor without reference to an external authentication authority device. Upon authentication, each authorized user is allocated a separate portion of the overall data storage capacity of the NVM using an allocation model. The size of at least one of the separate portions is subsequently adjusted based on an access history of the NVM. The storage device may be a key-value storage device so that a separate set of key values is provided to each authorized user to identify data blocks stored to and retrieved from the NVM.

Storage compute appliance with user authentication and memory allocation capabilities

Systems and methods are disclosed for enhanced garbage collection operations at a memory device. The enhanced garbage collection may include selecting data and blocks to garbage collect to improve device performance. Data may be copied and reorganized according to a data stream via which the data was received, or data and blocks may be evaluated for garbage collection based on other access efficiency metrics. Data may be selected for collection based on sequentiality of the data, host access patterns, or other factors. Processing of host commands may be throttled based on a determined amount of work to garbage collect a plurality of blocks, in order to limit variability in host command throughput over a time period.

Enhanced garbage collection

Systems and methods for encryption key shredding to protect non-persistent data are described. In one embodiment, the storage system device may include a storage drive and a controller. In some embodiments, the controller may be configured to power on the storage drive, identify an encryption key on the storage drive created upon powering on the storage drive, and encrypt data in a cache of the storage drive using the encryption key. In some embodiments, the controller may be configured to power off the storage drive and delete the encryption key upon powering off the storage drive. In some cases, the storage drive may include at least one of a solid state drive and a hard disk drive. In some embodiments, the storage drive may include a hybrid storage drive that includes both a solid state drive and a hard disk drive.

Encryption key shredding to protect non-persistent data

Systems and methods for enhanced read recovery based on write time information are described. In one embodiment, the systems and methods include opening a block of flash memory cells for programming, tracking a block open time, and performing a read operation of a programmed page from the block based at least in part on the block open time. In some embodiments, the block includes a plurality of pages, each page including a plurality of flash memory cells. In some cases, the block open time includes an amount of time between the block opening for programming to a time the block closes for programming.

Enhanced read recovery based on write time information

Apparatus and method for defending against a side-channel information attack such as a differential power analysis (DPA) attack. In some embodiments, a cryptographic hardware pipeline circuit performs a selected cryptographic function upon a selected set of data over a processing time interval. The pipeline circuit has a sequence of stages connected in series. The stages are enabled responsive to application of an asserted enable signal. An enable interrupt circuit is configured to periodically interrupt the selected cryptographic function to provide a plurality of processing intervals interspersed with the interrupt intervals. At least a selected one of the processing intervals or the interrupt intervals have random durations selected responsive to a series of random numbers.

Random time generated interrupts in a cryptographic hardware pipeline circuit

Systems and methods for hash authenticated data are described. In one embodiment, the storage device includes a storage drive and/or a controller. In some embodiments, the controller is configured to identify data to be authenticated, compute a first hash of the data using a hash function, detect a trigger event associated with the storage drive, and authenticate, after the trigger event, the data based at least in part on the first hash of the data.

Hash authenticated data

An apparatus comprises at least one port for coupling signals to the apparatus, a mode selector for setting the apparatus to a normal mode or a debug mode, and a port control for controlling access to secure information in the apparatus through the port in accordance with the selected mode. A method for controlling access to the port is also provided.

Method and apparatus for securing communications ports in an electronic device

A data bus transfers data between at least one slave device and a plurality of master devices, and an arbiter grants access to each of the master devices. The slave device includes look-ahead apparatus that includes staging register for staging an identification of a master device and a decoder for comparing a staged identification to an identification of a command from the bus. The look-ahead apparatus issues split releases of a next master device while the slave device returns data associated with a prior command.

Growing community of inventors

Longmont, CO, United States of America

Robert Wayne Moss